1 //===-- tsan_platform_mac.cpp ---------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of ThreadSanitizer (TSan), a race detector. 10 // 11 // Mac-specific code. 12 //===----------------------------------------------------------------------===// 13 14 #include "sanitizer_common/sanitizer_platform.h" 15 #if SANITIZER_MAC 16 17 #include "sanitizer_common/sanitizer_atomic.h" 18 #include "sanitizer_common/sanitizer_common.h" 19 #include "sanitizer_common/sanitizer_libc.h" 20 #include "sanitizer_common/sanitizer_posix.h" 21 #include "sanitizer_common/sanitizer_procmaps.h" 22 #include "sanitizer_common/sanitizer_stackdepot.h" 23 #include "tsan_platform.h" 24 #include "tsan_rtl.h" 25 #include "tsan_flags.h" 26 27 #include <mach/mach.h> 28 #include <pthread.h> 29 #include <signal.h> 30 #include <stdio.h> 31 #include <stdlib.h> 32 #include <string.h> 33 #include <stdarg.h> 34 #include <sys/mman.h> 35 #include <sys/syscall.h> 36 #include <sys/time.h> 37 #include <sys/types.h> 38 #include <sys/resource.h> 39 #include <sys/stat.h> 40 #include <unistd.h> 41 #include <errno.h> 42 #include <sched.h> 43 44 namespace __tsan { 45 46 #if !SANITIZER_GO 47 static void *SignalSafeGetOrAllocate(uptr *dst, uptr size) { 48 atomic_uintptr_t *a = (atomic_uintptr_t *)dst; 49 void *val = (void *)atomic_load_relaxed(a); 50 atomic_signal_fence(memory_order_acquire); // Turns the previous load into 51 // acquire wrt signals. 52 if (UNLIKELY(val == nullptr)) { 53 val = (void *)internal_mmap(nullptr, size, PROT_READ | PROT_WRITE, 54 MAP_PRIVATE | MAP_ANON, -1, 0); 55 CHECK(val); 56 void *cmp = nullptr; 57 if (!atomic_compare_exchange_strong(a, (uintptr_t *)&cmp, (uintptr_t)val, 58 memory_order_acq_rel)) { 59 internal_munmap(val, size); 60 val = cmp; 61 } 62 } 63 return val; 64 } 65 66 // On OS X, accessing TLVs via __thread or manually by using pthread_key_* is 67 // problematic, because there are several places where interceptors are called 68 // when TLVs are not accessible (early process startup, thread cleanup, ...). 69 // The following provides a "poor man's TLV" implementation, where we use the 70 // shadow memory of the pointer returned by pthread_self() to store a pointer to 71 // the ThreadState object. The main thread's ThreadState is stored separately 72 // in a static variable, because we need to access it even before the 73 // shadow memory is set up. 74 static uptr main_thread_identity = 0; 75 ALIGNED(64) static char main_thread_state[sizeof(ThreadState)]; 76 static ThreadState *main_thread_state_loc = (ThreadState *)main_thread_state; 77 78 static ThreadState **cur_thread_location() { 79 uptr thread_identity = (uptr)pthread_self(); 80 if (thread_identity == main_thread_identity || main_thread_identity == 0) 81 return &main_thread_state_loc; 82 return (ThreadState **)MemToShadow(thread_identity); 83 } 84 85 ThreadState *cur_thread() { 86 return (ThreadState *)SignalSafeGetOrAllocate( 87 (uptr *)cur_thread_location(), sizeof(ThreadState)); 88 } 89 90 void set_cur_thread(ThreadState *thr) { 91 *cur_thread_location() = thr; 92 } 93 94 // TODO(kuba.brecka): This is not async-signal-safe. In particular, we call 95 // munmap first and then clear `fake_tls`; if we receive a signal in between, 96 // handler will try to access the unmapped ThreadState. 97 void cur_thread_finalize() { 98 ThreadState **thr_state_loc = cur_thread_location(); 99 if (thr_state_loc == &main_thread_state_loc) { 100 // Calling dispatch_main() or xpc_main() actually invokes pthread_exit to 101 // exit the main thread. Let's keep the main thread's ThreadState. 102 return; 103 } 104 internal_munmap(*thr_state_loc, sizeof(ThreadState)); 105 *thr_state_loc = nullptr; 106 } 107 #endif 108 109 void FlushShadowMemory() { 110 } 111 112 static void RegionMemUsage(uptr start, uptr end, uptr *res, uptr *dirty) { 113 vm_address_t address = start; 114 vm_address_t end_address = end; 115 uptr resident_pages = 0; 116 uptr dirty_pages = 0; 117 while (address < end_address) { 118 vm_size_t vm_region_size; 119 mach_msg_type_number_t count = VM_REGION_EXTENDED_INFO_COUNT; 120 vm_region_extended_info_data_t vm_region_info; 121 mach_port_t object_name; 122 kern_return_t ret = vm_region_64( 123 mach_task_self(), &address, &vm_region_size, VM_REGION_EXTENDED_INFO, 124 (vm_region_info_t)&vm_region_info, &count, &object_name); 125 if (ret != KERN_SUCCESS) break; 126 127 resident_pages += vm_region_info.pages_resident; 128 dirty_pages += vm_region_info.pages_dirtied; 129 130 address += vm_region_size; 131 } 132 *res = resident_pages * GetPageSizeCached(); 133 *dirty = dirty_pages * GetPageSizeCached(); 134 } 135 136 void WriteMemoryProfile(char *buf, uptr buf_size, uptr nthread, uptr nlive) { 137 uptr shadow_res, shadow_dirty; 138 uptr meta_res, meta_dirty; 139 uptr trace_res, trace_dirty; 140 RegionMemUsage(ShadowBeg(), ShadowEnd(), &shadow_res, &shadow_dirty); 141 RegionMemUsage(MetaShadowBeg(), MetaShadowEnd(), &meta_res, &meta_dirty); 142 RegionMemUsage(TraceMemBeg(), TraceMemEnd(), &trace_res, &trace_dirty); 143 144 #if !SANITIZER_GO 145 uptr low_res, low_dirty; 146 uptr high_res, high_dirty; 147 uptr heap_res, heap_dirty; 148 RegionMemUsage(LoAppMemBeg(), LoAppMemEnd(), &low_res, &low_dirty); 149 RegionMemUsage(HiAppMemBeg(), HiAppMemEnd(), &high_res, &high_dirty); 150 RegionMemUsage(HeapMemBeg(), HeapMemEnd(), &heap_res, &heap_dirty); 151 #else // !SANITIZER_GO 152 uptr app_res, app_dirty; 153 RegionMemUsage(AppMemBeg(), AppMemEnd(), &app_res, &app_dirty); 154 #endif 155 156 StackDepotStats *stacks = StackDepotGetStats(); 157 internal_snprintf(buf, buf_size, 158 "shadow (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 159 "meta (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 160 "traces (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 161 #if !SANITIZER_GO 162 "low app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 163 "high app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 164 "heap (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 165 #else // !SANITIZER_GO 166 "app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 167 #endif 168 "stacks: %zd unique IDs, %zd kB allocated\n" 169 "threads: %zd total, %zd live\n" 170 "------------------------------\n", 171 ShadowBeg(), ShadowEnd(), shadow_res / 1024, shadow_dirty / 1024, 172 MetaShadowBeg(), MetaShadowEnd(), meta_res / 1024, meta_dirty / 1024, 173 TraceMemBeg(), TraceMemEnd(), trace_res / 1024, trace_dirty / 1024, 174 #if !SANITIZER_GO 175 LoAppMemBeg(), LoAppMemEnd(), low_res / 1024, low_dirty / 1024, 176 HiAppMemBeg(), HiAppMemEnd(), high_res / 1024, high_dirty / 1024, 177 HeapMemBeg(), HeapMemEnd(), heap_res / 1024, heap_dirty / 1024, 178 #else // !SANITIZER_GO 179 AppMemBeg(), AppMemEnd(), app_res / 1024, app_dirty / 1024, 180 #endif 181 stacks->n_uniq_ids, stacks->allocated / 1024, 182 nthread, nlive); 183 } 184 185 #if !SANITIZER_GO 186 void InitializeShadowMemoryPlatform() { } 187 188 // On OS X, GCD worker threads are created without a call to pthread_create. We 189 // need to properly register these threads with ThreadCreate and ThreadStart. 190 // These threads don't have a parent thread, as they are created "spuriously". 191 // We're using a libpthread API that notifies us about a newly created thread. 192 // The `thread == pthread_self()` check indicates this is actually a worker 193 // thread. If it's just a regular thread, this hook is called on the parent 194 // thread. 195 typedef void (*pthread_introspection_hook_t)(unsigned int event, 196 pthread_t thread, void *addr, 197 size_t size); 198 extern "C" pthread_introspection_hook_t pthread_introspection_hook_install( 199 pthread_introspection_hook_t hook); 200 static const uptr PTHREAD_INTROSPECTION_THREAD_CREATE = 1; 201 static const uptr PTHREAD_INTROSPECTION_THREAD_TERMINATE = 3; 202 static pthread_introspection_hook_t prev_pthread_introspection_hook; 203 static void my_pthread_introspection_hook(unsigned int event, pthread_t thread, 204 void *addr, size_t size) { 205 if (event == PTHREAD_INTROSPECTION_THREAD_CREATE) { 206 if (thread == pthread_self()) { 207 // The current thread is a newly created GCD worker thread. 208 ThreadState *thr = cur_thread(); 209 Processor *proc = ProcCreate(); 210 ProcWire(proc, thr); 211 ThreadState *parent_thread_state = nullptr; // No parent. 212 int tid = ThreadCreate(parent_thread_state, 0, (uptr)thread, true); 213 CHECK_NE(tid, 0); 214 ThreadStart(thr, tid, GetTid(), ThreadType::Worker); 215 } 216 } else if (event == PTHREAD_INTROSPECTION_THREAD_TERMINATE) { 217 if (thread == pthread_self()) { 218 ThreadState *thr = cur_thread(); 219 if (thr->tctx) { 220 DestroyThreadState(); 221 } 222 } 223 } 224 225 if (prev_pthread_introspection_hook != nullptr) 226 prev_pthread_introspection_hook(event, thread, addr, size); 227 } 228 #endif 229 230 void InitializePlatformEarly() { 231 #if defined(__aarch64__) 232 uptr max_vm = GetMaxUserVirtualAddress() + 1; 233 if (max_vm != Mapping::kHiAppMemEnd) { 234 Printf("ThreadSanitizer: unsupported vm address limit %p, expected %p.\n", 235 max_vm, Mapping::kHiAppMemEnd); 236 Die(); 237 } 238 #endif 239 } 240 241 static uptr longjmp_xor_key = 0; 242 243 void InitializePlatform() { 244 DisableCoreDumperIfNecessary(); 245 #if !SANITIZER_GO 246 CheckAndProtect(); 247 248 CHECK_EQ(main_thread_identity, 0); 249 main_thread_identity = (uptr)pthread_self(); 250 251 prev_pthread_introspection_hook = 252 pthread_introspection_hook_install(&my_pthread_introspection_hook); 253 #endif 254 255 if (GetMacosVersion() >= MACOS_VERSION_MOJAVE) { 256 // Libsystem currently uses a process-global key; this might change. 257 const unsigned kTLSLongjmpXorKeySlot = 0x7; 258 longjmp_xor_key = (uptr)pthread_getspecific(kTLSLongjmpXorKeySlot); 259 } 260 } 261 262 #ifdef __aarch64__ 263 # define LONG_JMP_SP_ENV_SLOT \ 264 ((GetMacosVersion() >= MACOS_VERSION_MOJAVE) ? 12 : 13) 265 #else 266 # define LONG_JMP_SP_ENV_SLOT 2 267 #endif 268 269 uptr ExtractLongJmpSp(uptr *env) { 270 uptr mangled_sp = env[LONG_JMP_SP_ENV_SLOT]; 271 uptr sp = mangled_sp ^ longjmp_xor_key; 272 return sp; 273 } 274 275 #if !SANITIZER_GO 276 void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) { 277 // The pointer to the ThreadState object is stored in the shadow memory 278 // of the tls. 279 uptr tls_end = tls_addr + tls_size; 280 uptr thread_identity = (uptr)pthread_self(); 281 if (thread_identity == main_thread_identity) { 282 MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr, tls_size); 283 } else { 284 uptr thr_state_start = thread_identity; 285 uptr thr_state_end = thr_state_start + sizeof(uptr); 286 CHECK_GE(thr_state_start, tls_addr); 287 CHECK_LE(thr_state_start, tls_addr + tls_size); 288 CHECK_GE(thr_state_end, tls_addr); 289 CHECK_LE(thr_state_end, tls_addr + tls_size); 290 MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr, 291 thr_state_start - tls_addr); 292 MemoryRangeImitateWrite(thr, /*pc=*/2, thr_state_end, 293 tls_end - thr_state_end); 294 } 295 } 296 #endif 297 298 #if !SANITIZER_GO 299 // Note: this function runs with async signals enabled, 300 // so it must not touch any tsan state. 301 int call_pthread_cancel_with_cleanup(int(*fn)(void *c, void *m, 302 void *abstime), void *c, void *m, void *abstime, 303 void(*cleanup)(void *arg), void *arg) { 304 // pthread_cleanup_push/pop are hardcore macros mess. 305 // We can't intercept nor call them w/o including pthread.h. 306 int res; 307 pthread_cleanup_push(cleanup, arg); 308 res = fn(c, m, abstime); 309 pthread_cleanup_pop(0); 310 return res; 311 } 312 #endif 313 314 } // namespace __tsan 315 316 #endif // SANITIZER_MAC 317