]> git.saurik.com Git - apple/xnu.git/blob - tests/stackshot_accuracy.m
a183a87dd656830225a8549b2c56bbd18a507738
[apple/xnu.git] / tests / stackshot_accuracy.m
1 #include <darwintest.h>
2 #include <darwintest_utils.h>
3 #include <sys/kern_memorystatus.h>
4 #include <kern/debug.h>
5 #include <mach-o/dyld.h>
6 #include <sys/stackshot.h>
7 #include <kdd.h>
8 #include <signal.h>
9
10 #define RECURSIONS 25
11 #define FIRST_RECURSIVE_FRAME 3
12
13 T_GLOBAL_META(
14 T_META_NAMESPACE("xnu.stackshot.accuracy"),
15 T_META_CHECK_LEAKS(false),
16 T_META_ASROOT(true)
17 );
18
19
20 void child_init(void);
21 void parent_helper_singleproc(int);
22
23 #define CHECK_FOR_FAULT_STATS (1 << 0)
24 #define WRITE_STACKSHOT_BUFFER_TO_TMP (1 << 1)
25 #define CHECK_FOR_KERNEL_THREADS (1 << 2)
26 int check_stackshot(void *, int);
27
28 /* used for WRITE_STACKSHOT_BUFFER_TO_TMP */
29 static char const *current_scenario_name;
30 static pid_t child_pid;
31
32 /* helpers */
33
34 static void __attribute__((noinline))
35 child_recurse(int r, int spin, void (^cb)(void))
36 {
37 if (r > 0) {
38 child_recurse(r - 1, spin, cb);
39 }
40
41 cb();
42
43 /* wait forever */
44 if (spin == 0) {
45 sleep(100000);
46 } else if (spin == 2) {
47 int v = 1;
48 /* ssh won't let the session die if we still have file handles open to its output. */
49 close(STDERR_FILENO);
50 close(STDOUT_FILENO);
51 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.wedge_thread", NULL, NULL, &v, sizeof(v)),
52 "wedged thread in the kernel");
53 } else {
54 while (1) {
55 __asm__ volatile("" : : : "memory");
56 }
57 }
58 }
59
60 T_HELPER_DECL(simple_child_process, "child process that will be frozen and others")
61 {
62 child_init();
63 }
64
65 T_HELPER_DECL(sid_child_process, "child process that setsid()s")
66 {
67 pid_t ppid = getppid();
68
69 T_ASSERT_POSIX_SUCCESS(setsid(), "session id set");
70
71 child_recurse(RECURSIONS, 2, ^{
72 kill(ppid, SIGUSR1);
73 });
74
75 T_ASSERT_FAIL("child_init returned!");
76 }
77
78 static void
79 kill_children(void)
80 {
81 kill(child_pid, SIGKILL);
82 }
83
84 static void *
85 take_stackshot(pid_t target_pid, uint32_t extra_flags, uint64_t since_timestamp)
86 {
87 void *stackshot_config;
88 int err, retries = 5;
89 uint32_t stackshot_flags = STACKSHOT_KCDATA_FORMAT |
90 STACKSHOT_THREAD_WAITINFO |
91 STACKSHOT_GET_DQ;
92
93 /* we should be able to verify delta stackshots */
94 if (since_timestamp != 0) {
95 stackshot_flags |= STACKSHOT_COLLECT_DELTA_SNAPSHOT;
96 }
97
98 stackshot_flags |= extra_flags;
99
100 stackshot_config = stackshot_config_create();
101 T_ASSERT_NOTNULL(stackshot_config, "allocate stackshot config");
102
103 err = stackshot_config_set_flags(stackshot_config, stackshot_flags);
104 T_ASSERT_EQ(err, 0, "set flags on stackshot config");
105
106 err = stackshot_config_set_pid(stackshot_config, target_pid);
107 T_ASSERT_EQ(err, 0, "set target pid on stackshot config");
108
109 if (since_timestamp != 0) {
110 err = stackshot_config_set_delta_timestamp(stackshot_config, since_timestamp);
111 T_ASSERT_EQ(err, 0, "set prev snapshot time on stackshot config");
112 }
113
114 while (retries > 0) {
115 err = stackshot_capture_with_config(stackshot_config);
116 if (err == 0) {
117 break;
118 } else if (err == EBUSY || err == ETIMEDOUT) {
119 T_LOG("stackshot capture returned %d (%s)\n", err, strerror(err));
120 if (retries == 0) {
121 T_ASSERT_FAIL("failed to take stackshot with error after retries: %d: %s\n", err, strerror(err));
122 }
123
124 retries--;
125 continue;
126 } else {
127 T_ASSERT_FAIL("failed to take stackshot with error: %d: %s\n", err, strerror(err));
128 }
129 }
130
131 return stackshot_config;
132 }
133
134 int
135 check_stackshot(void *stackshot_config, int flags)
136 {
137 void *buf;
138 uint32_t buflen, kcdata_type;
139 kcdata_iter_t iter;
140 NSError *nserror = nil;
141 pid_t target_pid;
142 int ret = 0;
143 uint64_t expected_return_addr = 0;
144 bool found_fault_stats = false;
145 struct stackshot_fault_stats fault_stats = {0};
146
147 buf = stackshot_config_get_stackshot_buffer(stackshot_config);
148 T_ASSERT_NOTNULL(buf, "stackshot buffer is not null");
149 buflen = stackshot_config_get_stackshot_size(stackshot_config);
150 T_ASSERT_GT(buflen, 0, "valid stackshot buffer length");
151 target_pid = ((struct stackshot_config*)stackshot_config)->sc_pid;
152 T_ASSERT_GT(target_pid, 0, "valid target_pid");
153
154 /* if need to write it to fs, do it now */
155 if (flags & WRITE_STACKSHOT_BUFFER_TO_TMP) {
156 char sspath[MAXPATHLEN];
157 strlcpy(sspath, current_scenario_name, sizeof(sspath));
158 strlcat(sspath, ".kcdata", sizeof(sspath));
159 T_QUIET; T_ASSERT_POSIX_ZERO(dt_resultfile(sspath, sizeof(sspath)),
160 "create result file path");
161
162 FILE *f = fopen(sspath, "w");
163 T_WITH_ERRNO; T_QUIET; T_ASSERT_NOTNULL(f,
164 "open stackshot output file");
165
166 size_t written = fwrite(buf, buflen, 1, f);
167 T_QUIET; T_ASSERT_POSIX_SUCCESS(written, "wrote stackshot to file");
168
169 fclose(f);
170 }
171
172 /* begin iterating */
173 iter = kcdata_iter(buf, buflen);
174 T_ASSERT_EQ(kcdata_iter_type(iter), KCDATA_BUFFER_BEGIN_STACKSHOT, "buffer is a stackshot");
175
176 /* time to iterate */
177 iter = kcdata_iter_next(iter);
178 KCDATA_ITER_FOREACH(iter) {
179 kcdata_type = kcdata_iter_type(iter);
180 NSNumber *parsedPid;
181 NSMutableDictionary *parsedContainer, *parsedThreads;
182
183 if ((flags & CHECK_FOR_FAULT_STATS) != 0 &&
184 kcdata_type == STACKSHOT_KCTYPE_STACKSHOT_FAULT_STATS) {
185 memcpy(&fault_stats, kcdata_iter_payload(iter), sizeof(fault_stats));
186 found_fault_stats = true;
187 }
188
189 if (kcdata_type != KCDATA_TYPE_CONTAINER_BEGIN) {
190 continue;
191 }
192
193 if (kcdata_iter_container_type(iter) != STACKSHOT_KCCONTAINER_TASK) {
194 continue;
195 }
196
197 parsedContainer = parseKCDataContainer(&iter, &nserror);
198 T_ASSERT_NOTNULL(parsedContainer, "parsedContainer is not null");
199 T_ASSERT_NULL(nserror, "no NSError occured while parsing the kcdata container");
200
201 /*
202 * given that we've targetted the pid, we can be sure that this
203 * ts_pid will be the pid we expect
204 */
205 parsedPid = parsedContainer[@"task_snapshots"][@"task_snapshot"][@"ts_pid"];
206 T_ASSERT_EQ([parsedPid intValue], target_pid, "found correct pid");
207
208 /* start parsing the threads */
209 parsedThreads = parsedContainer[@"task_snapshots"][@"thread_snapshots"];
210 for (id th_key in parsedThreads) {
211 uint32_t frame_index = 0;
212
213 if ((flags & CHECK_FOR_KERNEL_THREADS) == 0) {
214 /* skip threads that don't have enough frames */
215 if ([parsedThreads[th_key][@"user_stack_frames"] count] < RECURSIONS) {
216 continue;
217 }
218
219 for (id frame in parsedThreads[th_key][@"user_stack_frames"]) {
220 if ((frame_index >= FIRST_RECURSIVE_FRAME) && (frame_index < (RECURSIONS - FIRST_RECURSIVE_FRAME))) {
221 if (expected_return_addr == 0ull) {
222 expected_return_addr = [frame[@"lr"] unsignedLongLongValue];
223 } else {
224 T_QUIET;
225 T_ASSERT_EQ(expected_return_addr, [frame[@"lr"] unsignedLongLongValue], "expected return address found");
226 }
227 }
228 frame_index ++;
229 }
230 } else {
231 T_ASSERT_NOTNULL(parsedThreads[th_key][@"kernel_stack_frames"],
232 "found kernel stack frames");
233 }
234
235 }
236 }
237
238 if (found_fault_stats) {
239 T_LOG("number of pages faulted in: %d", fault_stats.sfs_pages_faulted_in);
240 T_LOG("MATUs spent faulting: %lld", fault_stats.sfs_time_spent_faulting);
241 T_LOG("MATUS fault time limit: %lld", fault_stats.sfs_system_max_fault_time);
242 T_LOG("did we stop because of the limit?: %s", fault_stats.sfs_stopped_faulting ? "yes" : "no");
243 if (expected_return_addr != 0ull) {
244 T_ASSERT_GT(fault_stats.sfs_pages_faulted_in, 0, "faulted at least one page in");
245 T_LOG("NOTE: successfully faulted in the pages");
246 } else {
247 T_LOG("NOTE: We were not able to fault the stack's pages back in");
248
249 /* if we couldn't fault the pages back in, then at least verify that we tried */
250 T_ASSERT_GT(fault_stats.sfs_time_spent_faulting, 0ull, "spent time trying to fault");
251 }
252 } else if ((flags & CHECK_FOR_KERNEL_THREADS) == 0) {
253 T_ASSERT_NE(expected_return_addr, 0ull, "found child thread with recursions");
254 }
255
256 if (flags & CHECK_FOR_FAULT_STATS) {
257 T_ASSERT_EQ(found_fault_stats, true, "found fault stats");
258 }
259
260 return ret;
261 }
262
263 void
264 child_init(void)
265 {
266 #if !TARGET_OS_OSX
267 int freeze_state;
268 #endif /* !TARGET_OS_OSX */
269 pid_t pid = getpid();
270 char padding[16 * 1024];
271 __asm__ volatile(""::"r"(padding));
272
273 T_LOG("child pid: %d\n", pid);
274
275 #if !TARGET_OS_OSX
276 /* allow us to be frozen */
277 freeze_state = memorystatus_control(MEMORYSTATUS_CMD_GET_PROCESS_IS_FREEZABLE, pid, 0, NULL, 0);
278 if (freeze_state == -1) {
279 T_SKIP("This device doesn't have CONFIG_FREEZE enabled.");
280 } else if (freeze_state == 0) {
281 T_LOG("CHILD was found to be UNFREEZABLE, enabling freezing.");
282 memorystatus_control(MEMORYSTATUS_CMD_SET_PROCESS_IS_FREEZABLE, pid, 1, NULL, 0);
283 freeze_state = memorystatus_control(MEMORYSTATUS_CMD_GET_PROCESS_IS_FREEZABLE, pid, 0, NULL, 0);
284 T_ASSERT_EQ(freeze_state, 1, "successfully set freezeability");
285 }
286 #else
287 T_LOG("Cannot change freezeability as freezing is only available on embedded devices");
288 #endif /* !TARGET_OS_OSX */
289
290 /*
291 * recurse a bunch of times to generate predictable data in the stackshot,
292 * then send SIGUSR1 to the parent to let it know that we are done.
293 */
294 child_recurse(RECURSIONS, 0, ^{
295 kill(getppid(), SIGUSR1);
296 });
297
298 T_ASSERT_FAIL("child_recurse returned, but it must not?");
299 }
300
301 void
302 parent_helper_singleproc(int spin)
303 {
304 dispatch_semaphore_t child_done_sema = dispatch_semaphore_create(0);
305 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot_accuracy.basic_sp", NULL);
306 void *stackshot_config;
307
308 dispatch_async(dq, ^{
309 char padding[16 * 1024];
310 __asm__ volatile(""::"r"(padding));
311
312 child_recurse(RECURSIONS, spin, ^{
313 dispatch_semaphore_signal(child_done_sema);
314 });
315 });
316
317 dispatch_semaphore_wait(child_done_sema, DISPATCH_TIME_FOREVER);
318 T_LOG("done waiting for child");
319
320 /* take the stackshot and parse it */
321 stackshot_config = take_stackshot(getpid(), 0, 0);
322
323 /* check that the stackshot has the stack frames */
324 check_stackshot(stackshot_config, 0);
325
326 T_LOG("done!");
327 }
328
329 T_DECL(basic, "test that no-fault stackshot works correctly")
330 {
331 char path[PATH_MAX];
332 uint32_t path_size = sizeof(path);
333 char *args[] = { path, "-n", "simple_child_process", NULL };
334 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot_accuracy.basic", NULL);
335 dispatch_semaphore_t child_done_sema = dispatch_semaphore_create(0);
336 dispatch_source_t child_sig_src;
337 void *stackshot_config;
338
339 current_scenario_name = __func__;
340
341 T_LOG("parent pid: %d\n", getpid());
342 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
343
344 /* setup signal handling */
345 signal(SIGUSR1, SIG_IGN);
346 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
347 dispatch_source_set_event_handler(child_sig_src, ^{
348 dispatch_semaphore_signal(child_done_sema);
349 });
350 dispatch_activate(child_sig_src);
351
352 /* create the child process */
353 T_ASSERT_POSIX_SUCCESS(dt_launch_tool(&child_pid, args, false, NULL, NULL), "child launched");
354 T_ATEND(kill_children);
355
356 /* wait until the child has recursed enough */
357 dispatch_semaphore_wait(child_done_sema, DISPATCH_TIME_FOREVER);
358
359 T_LOG("child finished, parent executing");
360
361 /* take the stackshot and parse it */
362 stackshot_config = take_stackshot(child_pid, 0, 0);
363
364 /* check that the stackshot has the stack frames */
365 check_stackshot(stackshot_config, 0);
366
367 T_LOG("all done, killing child");
368
369 /* tell the child to quit */
370 T_ASSERT_POSIX_SUCCESS(kill(child_pid, SIGTERM), "killed child");
371 }
372
373 T_DECL(basic_singleproc, "test that no-fault stackshot works correctly in single process setting")
374 {
375 current_scenario_name = __func__;
376 parent_helper_singleproc(0);
377 }
378
379 T_DECL(basic_singleproc_spin, "test that no-fault stackshot works correctly in single process setting with spinning")
380 {
381 current_scenario_name = __func__;
382 parent_helper_singleproc(1);
383 }
384
385 T_DECL(fault, "test that faulting stackshots work correctly")
386 {
387 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot_fault_accuracy", NULL);
388 dispatch_source_t child_sig_src;
389 dispatch_semaphore_t child_done_sema = dispatch_semaphore_create(0);
390 void *stackshot_config;
391 int oldftm, newval = 1, freeze_enabled, oldratio, newratio = 0;
392 size_t oldlen = sizeof(oldftm), fe_len = sizeof(freeze_enabled), ratiolen = sizeof(oldratio);
393 char path[PATH_MAX];
394 uint32_t path_size = sizeof(path);
395 char *args[] = { path, "-n", "simple_child_process", NULL };
396
397 current_scenario_name = __func__;
398 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
399
400 #if TARGET_OS_OSX
401 T_SKIP("freezing is not available on macOS");
402 #endif /* TARGET_OS_OSX */
403
404 /* Try checking if freezing is enabled at all */
405 if (sysctlbyname("vm.freeze_enabled", &freeze_enabled, &fe_len, NULL, 0) == -1) {
406 if (errno == ENOENT) {
407 T_SKIP("This device doesn't have CONFIG_FREEZE enabled.");
408 } else {
409 T_FAIL("failed to query vm.freeze_enabled, errno: %d", errno);
410 }
411 }
412
413 if (!freeze_enabled) {
414 T_SKIP("Freeze is not enabled, skipping test.");
415 }
416
417 /* signal handling */
418 signal(SIGUSR1, SIG_IGN);
419 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
420 dispatch_source_set_event_handler(child_sig_src, ^{
421 dispatch_semaphore_signal(child_done_sema);
422 });
423 dispatch_activate(child_sig_src);
424
425 T_ASSERT_POSIX_SUCCESS(dt_launch_tool(&child_pid, args, false, NULL, NULL), "child launched");
426 T_ATEND(kill_children);
427
428 dispatch_semaphore_wait(child_done_sema, DISPATCH_TIME_FOREVER);
429
430 /* keep processes in memory */
431 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.memorystatus_freeze_to_memory", &oldftm, &oldlen, &newval, sizeof(newval)),
432 "disabled freezing to disk");
433
434 /* set the ratio to zero */
435 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.memorystatus_freeze_private_shared_pages_ratio", &oldratio, &ratiolen, &newratio, sizeof(newratio)), "disabled private:shared ratio checking");
436
437 /* freeze the child */
438 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.memorystatus_freeze", NULL, 0, &child_pid, sizeof(child_pid)),
439 "froze child");
440
441 /* Sleep to allow the compressor to finish compressing the child */
442 sleep(5);
443
444 /* take the stackshot and parse it */
445 stackshot_config = take_stackshot(child_pid, STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING, 0);
446
447 /* check that the stackshot has the stack frames */
448 check_stackshot(stackshot_config, CHECK_FOR_FAULT_STATS);
449
450 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.memorystatus_freeze_to_memory", NULL, 0, &oldftm, sizeof(oldftm)),
451 "reset freezing to disk");
452
453 /* reset the private:shared ratio */
454 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.memorystatus_freeze_private_shared_pages_ratio", NULL, 0, &oldratio, sizeof(oldratio)), "reset private:shared ratio");
455
456 T_LOG("all done, killing child");
457
458 /* tell the child to quit */
459 T_ASSERT_POSIX_SUCCESS(kill(child_pid, SIGTERM), "killed child");
460 }
461
462 T_DECL(fault_singleproc, "test that faulting stackshots work correctly in a single process setting")
463 {
464 dispatch_semaphore_t child_done_sema = dispatch_semaphore_create(0);
465 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot_accuracy.fault_sp", NULL);
466 void *stackshot_config;
467 __block pthread_t child_thread;
468 char *child_stack;
469 size_t child_stacklen;
470
471 #if !TARGET_OS_OSX
472 T_SKIP("madvise(..., ..., MADV_PAGEOUT) is not available on embedded platforms");
473 #endif /* !TARGET_OS_OSX */
474
475 dispatch_async(dq, ^{
476 char padding[16 * 1024];
477 __asm__ volatile(""::"r"(padding));
478
479 child_recurse(RECURSIONS, 0, ^{
480 child_thread = pthread_self();
481 dispatch_semaphore_signal(child_done_sema);
482 });
483 });
484
485 dispatch_semaphore_wait(child_done_sema, DISPATCH_TIME_FOREVER);
486 T_LOG("done waiting for child");
487
488 child_stack = pthread_get_stackaddr_np(child_thread);
489 child_stacklen = pthread_get_stacksize_np(child_thread);
490 child_stack -= child_stacklen;
491 T_LOG("child stack: [0x%p - 0x%p]: 0x%zu bytes", (void *)child_stack,
492 (void *)(child_stack + child_stacklen), child_stacklen);
493
494 /* paging out the child */
495 T_ASSERT_POSIX_SUCCESS(madvise(child_stack, child_stacklen, MADV_PAGEOUT), "paged out via madvise(2) the child stack");
496
497 /* take the stackshot and parse it */
498 stackshot_config = take_stackshot(getpid(), STACKSHOT_ENABLE_BT_FAULTING | STACKSHOT_ENABLE_UUID_FAULTING, 0);
499
500 /* check that the stackshot has the stack frames */
501 check_stackshot(stackshot_config, CHECK_FOR_FAULT_STATS);
502
503 T_LOG("done!");
504 }
505
506 T_DECL(zombie, "test that threads wedged in the kernel can be stackshot'd")
507 {
508 dispatch_queue_t dq = dispatch_queue_create("com.apple.stackshot_accuracy.zombie", NULL);
509 dispatch_semaphore_t child_done_sema = dispatch_semaphore_create(0);
510 dispatch_source_t child_sig_src;
511 void *stackshot_config;
512 char path[PATH_MAX];
513 uint32_t path_size = sizeof(path);
514 char *args[] = { path, "-n", "sid_child_process", NULL };
515
516 current_scenario_name = __func__;
517 T_QUIET; T_ASSERT_POSIX_ZERO(_NSGetExecutablePath(path, &path_size), "_NSGetExecutablePath");
518
519 T_LOG("parent pid: %d\n", getpid());
520
521 /* setup signal handling */
522 signal(SIGUSR1, SIG_IGN);
523 child_sig_src = dispatch_source_create(DISPATCH_SOURCE_TYPE_SIGNAL, SIGUSR1, 0, dq);
524 dispatch_source_set_event_handler(child_sig_src, ^{
525 dispatch_semaphore_signal(child_done_sema);
526 });
527 dispatch_activate(child_sig_src);
528
529 /* create the child process */
530 T_ASSERT_POSIX_SUCCESS(dt_launch_tool(&child_pid, args, false, NULL, NULL), "child launched");
531 T_ATEND(kill_children);
532
533 /* wait until the child has recursed enough */
534 dispatch_semaphore_wait(child_done_sema, DISPATCH_TIME_FOREVER);
535
536 T_LOG("child finished, parent executing. invoking jetsam");
537
538 T_ASSERT_POSIX_SUCCESS(memorystatus_control(MEMORYSTATUS_CMD_TEST_JETSAM, child_pid, 0, 0, 0),
539 "jetsam'd the child");
540
541 /* Sleep to allow the target process to become zombified */
542 sleep(1);
543
544 /* take the stackshot and parse it */
545 stackshot_config = take_stackshot(child_pid, 0, 0);
546
547 /* check that the stackshot has the stack frames */
548 check_stackshot(stackshot_config, CHECK_FOR_KERNEL_THREADS);
549
550 T_LOG("all done, unwedging and killing child");
551
552 int v = 1;
553 T_ASSERT_POSIX_SUCCESS(sysctlbyname("kern.unwedge_thread", NULL, NULL, &v, sizeof(v)),
554 "unwedged child");
555
556 /* tell the child to quit */
557 T_ASSERT_POSIX_SUCCESS(kill(child_pid, SIGTERM), "killed child");
558 }