1 //===-- tsan_platform_mac.cpp ---------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file is a part of ThreadSanitizer (TSan), a race detector. 10 // 11 // Mac-specific code. 12 //===----------------------------------------------------------------------===// 13 14 #include "sanitizer_common/sanitizer_platform.h" 15 #if SANITIZER_MAC 16 17 #include "sanitizer_common/sanitizer_atomic.h" 18 #include "sanitizer_common/sanitizer_common.h" 19 #include "sanitizer_common/sanitizer_libc.h" 20 #include "sanitizer_common/sanitizer_posix.h" 21 #include "sanitizer_common/sanitizer_procmaps.h" 22 #include "sanitizer_common/sanitizer_ptrauth.h" 23 #include "sanitizer_common/sanitizer_stackdepot.h" 24 #include "tsan_platform.h" 25 #include "tsan_rtl.h" 26 #include "tsan_flags.h" 27 28 #include <mach/mach.h> 29 #include <pthread.h> 30 #include <signal.h> 31 #include <stdio.h> 32 #include <stdlib.h> 33 #include <string.h> 34 #include <stdarg.h> 35 #include <sys/mman.h> 36 #include <sys/syscall.h> 37 #include <sys/time.h> 38 #include <sys/types.h> 39 #include <sys/resource.h> 40 #include <sys/stat.h> 41 #include <unistd.h> 42 #include <errno.h> 43 #include <sched.h> 44 45 namespace __tsan { 46 47 #if !SANITIZER_GO 48 static void *SignalSafeGetOrAllocate(uptr *dst, uptr size) { 49 atomic_uintptr_t *a = (atomic_uintptr_t *)dst; 50 void *val = (void *)atomic_load_relaxed(a); 51 atomic_signal_fence(memory_order_acquire); // Turns the previous load into 52 // acquire wrt signals. 53 if (UNLIKELY(val == nullptr)) { 54 val = (void *)internal_mmap(nullptr, size, PROT_READ | PROT_WRITE, 55 MAP_PRIVATE | MAP_ANON, -1, 0); 56 CHECK(val); 57 void *cmp = nullptr; 58 if (!atomic_compare_exchange_strong(a, (uintptr_t *)&cmp, (uintptr_t)val, 59 memory_order_acq_rel)) { 60 internal_munmap(val, size); 61 val = cmp; 62 } 63 } 64 return val; 65 } 66 67 // On OS X, accessing TLVs via __thread or manually by using pthread_key_* is 68 // problematic, because there are several places where interceptors are called 69 // when TLVs are not accessible (early process startup, thread cleanup, ...). 70 // The following provides a "poor man's TLV" implementation, where we use the 71 // shadow memory of the pointer returned by pthread_self() to store a pointer to 72 // the ThreadState object. The main thread's ThreadState is stored separately 73 // in a static variable, because we need to access it even before the 74 // shadow memory is set up. 75 static uptr main_thread_identity = 0; 76 ALIGNED(64) static char main_thread_state[sizeof(ThreadState)]; 77 static ThreadState *main_thread_state_loc = (ThreadState *)main_thread_state; 78 79 // We cannot use pthread_self() before libpthread has been initialized. Our 80 // current heuristic for guarding this is checking `main_thread_identity` which 81 // is only assigned in `__tsan::InitializePlatform`. 82 static ThreadState **cur_thread_location() { 83 if (main_thread_identity == 0) 84 return &main_thread_state_loc; 85 uptr thread_identity = (uptr)pthread_self(); 86 if (thread_identity == main_thread_identity) 87 return &main_thread_state_loc; 88 return (ThreadState **)MemToMeta(thread_identity); 89 } 90 91 ThreadState *cur_thread() { 92 return (ThreadState *)SignalSafeGetOrAllocate( 93 (uptr *)cur_thread_location(), sizeof(ThreadState)); 94 } 95 96 void set_cur_thread(ThreadState *thr) { 97 *cur_thread_location() = thr; 98 } 99 100 // TODO(kuba.brecka): This is not async-signal-safe. In particular, we call 101 // munmap first and then clear `fake_tls`; if we receive a signal in between, 102 // handler will try to access the unmapped ThreadState. 103 void cur_thread_finalize() { 104 ThreadState **thr_state_loc = cur_thread_location(); 105 if (thr_state_loc == &main_thread_state_loc) { 106 // Calling dispatch_main() or xpc_main() actually invokes pthread_exit to 107 // exit the main thread. Let's keep the main thread's ThreadState. 108 return; 109 } 110 internal_munmap(*thr_state_loc, sizeof(ThreadState)); 111 *thr_state_loc = nullptr; 112 } 113 #endif 114 115 static void RegionMemUsage(uptr start, uptr end, uptr *res, uptr *dirty) { 116 vm_address_t address = start; 117 vm_address_t end_address = end; 118 uptr resident_pages = 0; 119 uptr dirty_pages = 0; 120 while (address < end_address) { 121 vm_size_t vm_region_size; 122 mach_msg_type_number_t count = VM_REGION_EXTENDED_INFO_COUNT; 123 vm_region_extended_info_data_t vm_region_info; 124 mach_port_t object_name; 125 kern_return_t ret = vm_region_64( 126 mach_task_self(), &address, &vm_region_size, VM_REGION_EXTENDED_INFO, 127 (vm_region_info_t)&vm_region_info, &count, &object_name); 128 if (ret != KERN_SUCCESS) break; 129 130 resident_pages += vm_region_info.pages_resident; 131 dirty_pages += vm_region_info.pages_dirtied; 132 133 address += vm_region_size; 134 } 135 *res = resident_pages * GetPageSizeCached(); 136 *dirty = dirty_pages * GetPageSizeCached(); 137 } 138 139 void WriteMemoryProfile(char *buf, uptr buf_size, u64 uptime_ns) { 140 uptr shadow_res, shadow_dirty; 141 uptr meta_res, meta_dirty; 142 RegionMemUsage(ShadowBeg(), ShadowEnd(), &shadow_res, &shadow_dirty); 143 RegionMemUsage(MetaShadowBeg(), MetaShadowEnd(), &meta_res, &meta_dirty); 144 145 # if !SANITIZER_GO 146 uptr low_res, low_dirty; 147 uptr high_res, high_dirty; 148 uptr heap_res, heap_dirty; 149 RegionMemUsage(LoAppMemBeg(), LoAppMemEnd(), &low_res, &low_dirty); 150 RegionMemUsage(HiAppMemBeg(), HiAppMemEnd(), &high_res, &high_dirty); 151 RegionMemUsage(HeapMemBeg(), HeapMemEnd(), &heap_res, &heap_dirty); 152 #else // !SANITIZER_GO 153 uptr app_res, app_dirty; 154 RegionMemUsage(LoAppMemBeg(), LoAppMemEnd(), &app_res, &app_dirty); 155 #endif 156 157 StackDepotStats stacks = StackDepotGetStats(); 158 uptr nthread, nlive; 159 ctx->thread_registry.GetNumberOfThreads(&nthread, &nlive); 160 internal_snprintf( 161 buf, buf_size, 162 "shadow (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 163 "meta (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 164 # if !SANITIZER_GO 165 "low app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 166 "high app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 167 "heap (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 168 # else // !SANITIZER_GO 169 "app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 170 # endif 171 "stacks: %zd unique IDs, %zd kB allocated\n" 172 "threads: %zd total, %zd live\n" 173 "------------------------------\n", 174 ShadowBeg(), ShadowEnd(), shadow_res / 1024, shadow_dirty / 1024, 175 MetaShadowBeg(), MetaShadowEnd(), meta_res / 1024, meta_dirty / 1024, 176 # if !SANITIZER_GO 177 LoAppMemBeg(), LoAppMemEnd(), low_res / 1024, low_dirty / 1024, 178 HiAppMemBeg(), HiAppMemEnd(), high_res / 1024, high_dirty / 1024, 179 HeapMemBeg(), HeapMemEnd(), heap_res / 1024, heap_dirty / 1024, 180 # else // !SANITIZER_GO 181 LoAppMemBeg(), LoAppMemEnd(), app_res / 1024, app_dirty / 1024, 182 # endif 183 stacks.n_uniq_ids, stacks.allocated / 1024, nthread, nlive); 184 } 185 186 # if !SANITIZER_GO 187 void InitializeShadowMemoryPlatform() { } 188 189 // On OS X, GCD worker threads are created without a call to pthread_create. We 190 // need to properly register these threads with ThreadCreate and ThreadStart. 191 // These threads don't have a parent thread, as they are created "spuriously". 192 // We're using a libpthread API that notifies us about a newly created thread. 193 // The `thread == pthread_self()` check indicates this is actually a worker 194 // thread. If it's just a regular thread, this hook is called on the parent 195 // thread. 196 typedef void (*pthread_introspection_hook_t)(unsigned int event, 197 pthread_t thread, void *addr, 198 size_t size); 199 extern "C" pthread_introspection_hook_t pthread_introspection_hook_install( 200 pthread_introspection_hook_t hook); 201 static const uptr PTHREAD_INTROSPECTION_THREAD_CREATE = 1; 202 static const uptr PTHREAD_INTROSPECTION_THREAD_TERMINATE = 3; 203 static pthread_introspection_hook_t prev_pthread_introspection_hook; 204 static void my_pthread_introspection_hook(unsigned int event, pthread_t thread, 205 void *addr, size_t size) { 206 if (event == PTHREAD_INTROSPECTION_THREAD_CREATE) { 207 if (thread == pthread_self()) { 208 // The current thread is a newly created GCD worker thread. 209 ThreadState *thr = cur_thread(); 210 Processor *proc = ProcCreate(); 211 ProcWire(proc, thr); 212 ThreadState *parent_thread_state = nullptr; // No parent. 213 Tid tid = ThreadCreate(parent_thread_state, 0, (uptr)thread, true); 214 CHECK_NE(tid, kMainTid); 215 ThreadStart(thr, tid, GetTid(), ThreadType::Worker); 216 } 217 } else if (event == PTHREAD_INTROSPECTION_THREAD_TERMINATE) { 218 if (thread == pthread_self()) { 219 ThreadState *thr = cur_thread(); 220 if (thr->tctx) { 221 DestroyThreadState(); 222 } 223 } 224 } 225 226 if (prev_pthread_introspection_hook != nullptr) 227 prev_pthread_introspection_hook(event, thread, addr, size); 228 } 229 #endif 230 231 void InitializePlatformEarly() { 232 # if !SANITIZER_GO && SANITIZER_IOS 233 uptr max_vm = GetMaxUserVirtualAddress() + 1; 234 if (max_vm != HiAppMemEnd()) { 235 Printf("ThreadSanitizer: unsupported vm address limit %p, expected %p.\n", 236 (void *)max_vm, (void *)HiAppMemEnd()); 237 Die(); 238 } 239 #endif 240 } 241 242 static uptr longjmp_xor_key = 0; 243 244 void InitializePlatform() { 245 DisableCoreDumperIfNecessary(); 246 #if !SANITIZER_GO 247 CheckAndProtect(); 248 249 CHECK_EQ(main_thread_identity, 0); 250 main_thread_identity = (uptr)pthread_self(); 251 252 prev_pthread_introspection_hook = 253 pthread_introspection_hook_install(&my_pthread_introspection_hook); 254 #endif 255 256 if (GetMacosAlignedVersion() >= MacosVersion(10, 14)) { 257 // Libsystem currently uses a process-global key; this might change. 258 const unsigned kTLSLongjmpXorKeySlot = 0x7; 259 longjmp_xor_key = (uptr)pthread_getspecific(kTLSLongjmpXorKeySlot); 260 } 261 } 262 263 #ifdef __aarch64__ 264 # define LONG_JMP_SP_ENV_SLOT \ 265 ((GetMacosAlignedVersion() >= MacosVersion(10, 14)) ? 12 : 13) 266 #else 267 # define LONG_JMP_SP_ENV_SLOT 2 268 #endif 269 270 uptr ExtractLongJmpSp(uptr *env) { 271 uptr mangled_sp = env[LONG_JMP_SP_ENV_SLOT]; 272 uptr sp = mangled_sp ^ longjmp_xor_key; 273 sp = (uptr)ptrauth_auth_data((void *)sp, ptrauth_key_asdb, 274 ptrauth_string_discriminator("sp")); 275 return sp; 276 } 277 278 #if !SANITIZER_GO 279 extern "C" void __tsan_tls_initialization() {} 280 281 void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) { 282 // The pointer to the ThreadState object is stored in the shadow memory 283 // of the tls. 284 uptr tls_end = tls_addr + tls_size; 285 uptr thread_identity = (uptr)pthread_self(); 286 const uptr pc = StackTrace::GetNextInstructionPc( 287 reinterpret_cast<uptr>(__tsan_tls_initialization)); 288 if (thread_identity == main_thread_identity) { 289 MemoryRangeImitateWrite(thr, pc, tls_addr, tls_size); 290 } else { 291 uptr thr_state_start = thread_identity; 292 uptr thr_state_end = thr_state_start + sizeof(uptr); 293 CHECK_GE(thr_state_start, tls_addr); 294 CHECK_LE(thr_state_start, tls_addr + tls_size); 295 CHECK_GE(thr_state_end, tls_addr); 296 CHECK_LE(thr_state_end, tls_addr + tls_size); 297 MemoryRangeImitateWrite(thr, pc, tls_addr, thr_state_start - tls_addr); 298 MemoryRangeImitateWrite(thr, pc, thr_state_end, tls_end - thr_state_end); 299 } 300 } 301 #endif 302 303 #if !SANITIZER_GO 304 // Note: this function runs with async signals enabled, 305 // so it must not touch any tsan state. 306 int call_pthread_cancel_with_cleanup(int (*fn)(void *arg), 307 void (*cleanup)(void *arg), void *arg) { 308 // pthread_cleanup_push/pop are hardcore macros mess. 309 // We can't intercept nor call them w/o including pthread.h. 310 int res; 311 pthread_cleanup_push(cleanup, arg); 312 res = fn(arg); 313 pthread_cleanup_pop(0); 314 return res; 315 } 316 #endif 317 318 } // namespace __tsan 319 320 #endif // SANITIZER_MAC 321