1//===-- tsan_platform_mac.cc ----------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of ThreadSanitizer (TSan), a race detector. 11// 12// Mac-specific code. 13//===----------------------------------------------------------------------===// 14 15#include "sanitizer_common/sanitizer_platform.h" 16#if SANITIZER_MAC 17 18#include "sanitizer_common/sanitizer_atomic.h" 19#include "sanitizer_common/sanitizer_common.h" 20#include "sanitizer_common/sanitizer_libc.h" 21#include "sanitizer_common/sanitizer_posix.h" 22#include "sanitizer_common/sanitizer_procmaps.h" 23#include "sanitizer_common/sanitizer_stackdepot.h" 24#include "tsan_platform.h" 25#include "tsan_rtl.h" 26#include "tsan_flags.h" 27 28#include <mach/mach.h> 29#include <pthread.h> 30#include <signal.h> 31#include <stdio.h> 32#include <stdlib.h> 33#include <string.h> 34#include <stdarg.h> 35#include <sys/mman.h> 36#include <sys/syscall.h> 37#include <sys/time.h> 38#include <sys/types.h> 39#include <sys/resource.h> 40#include <sys/stat.h> 41#include <unistd.h> 42#include <errno.h> 43#include <sched.h> 44 45namespace __tsan { 46 47#if !SANITIZER_GO 48static void *SignalSafeGetOrAllocate(uptr *dst, uptr size) { 49 atomic_uintptr_t *a = (atomic_uintptr_t *)dst; 50 void *val = (void *)atomic_load_relaxed(a); 51 atomic_signal_fence(memory_order_acquire); // Turns the previous load into 52 // acquire wrt signals. 53 if (UNLIKELY(val == nullptr)) { 54 val = (void *)internal_mmap(nullptr, size, PROT_READ | PROT_WRITE, 55 MAP_PRIVATE | MAP_ANON, -1, 0); 56 CHECK(val); 57 void *cmp = nullptr; 58 if (!atomic_compare_exchange_strong(a, (uintptr_t *)&cmp, (uintptr_t)val, 59 memory_order_acq_rel)) { 60 internal_munmap(val, size); 61 val = cmp; 62 } 63 } 64 return val; 65} 66 67// On OS X, accessing TLVs via __thread or manually by using pthread_key_* is 68// problematic, because there are several places where interceptors are called 69// when TLVs are not accessible (early process startup, thread cleanup, ...). 70// The following provides a "poor man's TLV" implementation, where we use the 71// shadow memory of the pointer returned by pthread_self() to store a pointer to 72// the ThreadState object. The main thread's ThreadState is stored separately 73// in a static variable, because we need to access it even before the 74// shadow memory is set up. 75static uptr main_thread_identity = 0; 76ALIGNED(64) static char main_thread_state[sizeof(ThreadState)]; 77 78ThreadState **cur_thread_location() { 79 ThreadState **thread_identity = (ThreadState **)pthread_self(); 80 return ((uptr)thread_identity == main_thread_identity) ? nullptr 81 : thread_identity; 82} 83 84ThreadState *cur_thread() { 85 ThreadState **thr_state_loc = cur_thread_location(); 86 if (thr_state_loc == nullptr || main_thread_identity == 0) { 87 return (ThreadState *)&main_thread_state; 88 } 89 ThreadState **fake_tls = (ThreadState **)MemToShadow((uptr)thr_state_loc); 90 ThreadState *thr = (ThreadState *)SignalSafeGetOrAllocate( 91 (uptr *)fake_tls, sizeof(ThreadState)); 92 return thr; 93} 94 95// TODO(kuba.brecka): This is not async-signal-safe. In particular, we call 96// munmap first and then clear `fake_tls`; if we receive a signal in between, 97// handler will try to access the unmapped ThreadState. 98void cur_thread_finalize() { 99 ThreadState **thr_state_loc = cur_thread_location(); 100 if (thr_state_loc == nullptr) { 101 // Calling dispatch_main() or xpc_main() actually invokes pthread_exit to 102 // exit the main thread. Let's keep the main thread's ThreadState. 103 return; 104 } 105 ThreadState **fake_tls = (ThreadState **)MemToShadow((uptr)thr_state_loc); 106 internal_munmap(*fake_tls, sizeof(ThreadState)); 107 *fake_tls = nullptr; 108} 109#endif 110 111void FlushShadowMemory() { 112} 113 114static void RegionMemUsage(uptr start, uptr end, uptr *res, uptr *dirty) { 115 vm_address_t address = start; 116 vm_address_t end_address = end; 117 uptr resident_pages = 0; 118 uptr dirty_pages = 0; 119 while (address < end_address) { 120 vm_size_t vm_region_size; 121 mach_msg_type_number_t count = VM_REGION_EXTENDED_INFO_COUNT; 122 vm_region_extended_info_data_t vm_region_info; 123 mach_port_t object_name; 124 kern_return_t ret = vm_region_64( 125 mach_task_self(), &address, &vm_region_size, VM_REGION_EXTENDED_INFO, 126 (vm_region_info_t)&vm_region_info, &count, &object_name); 127 if (ret != KERN_SUCCESS) break; 128 129 resident_pages += vm_region_info.pages_resident; 130 dirty_pages += vm_region_info.pages_dirtied; 131 132 address += vm_region_size; 133 } 134 *res = resident_pages * GetPageSizeCached(); 135 *dirty = dirty_pages * GetPageSizeCached(); 136} 137 138void WriteMemoryProfile(char *buf, uptr buf_size, uptr nthread, uptr nlive) { 139 uptr shadow_res, shadow_dirty; 140 uptr meta_res, meta_dirty; 141 uptr trace_res, trace_dirty; 142 RegionMemUsage(ShadowBeg(), ShadowEnd(), &shadow_res, &shadow_dirty); 143 RegionMemUsage(MetaShadowBeg(), MetaShadowEnd(), &meta_res, &meta_dirty); 144 RegionMemUsage(TraceMemBeg(), TraceMemEnd(), &trace_res, &trace_dirty); 145 146#if !SANITIZER_GO 147 uptr low_res, low_dirty; 148 uptr high_res, high_dirty; 149 uptr heap_res, heap_dirty; 150 RegionMemUsage(LoAppMemBeg(), LoAppMemEnd(), &low_res, &low_dirty); 151 RegionMemUsage(HiAppMemBeg(), HiAppMemEnd(), &high_res, &high_dirty); 152 RegionMemUsage(HeapMemBeg(), HeapMemEnd(), &heap_res, &heap_dirty); 153#else // !SANITIZER_GO 154 uptr app_res, app_dirty; 155 RegionMemUsage(AppMemBeg(), AppMemEnd(), &app_res, &app_dirty); 156#endif 157 158 StackDepotStats *stacks = StackDepotGetStats(); 159 internal_snprintf(buf, buf_size, 160 "shadow (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 161 "meta (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 162 "traces (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 163#if !SANITIZER_GO 164 "low app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 165 "high app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 166 "heap (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 167#else // !SANITIZER_GO 168 "app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n" 169#endif 170 "stacks: %zd unique IDs, %zd kB allocated\n" 171 "threads: %zd total, %zd live\n" 172 "------------------------------\n", 173 ShadowBeg(), ShadowEnd(), shadow_res / 1024, shadow_dirty / 1024, 174 MetaShadowBeg(), MetaShadowEnd(), meta_res / 1024, meta_dirty / 1024, 175 TraceMemBeg(), TraceMemEnd(), trace_res / 1024, trace_dirty / 1024, 176#if !SANITIZER_GO 177 LoAppMemBeg(), LoAppMemEnd(), low_res / 1024, low_dirty / 1024, 178 HiAppMemBeg(), HiAppMemEnd(), high_res / 1024, high_dirty / 1024, 179 HeapMemBeg(), HeapMemEnd(), heap_res / 1024, heap_dirty / 1024, 180#else // !SANITIZER_GO 181 AppMemBeg(), AppMemEnd(), app_res / 1024, app_dirty / 1024, 182#endif 183 stacks->n_uniq_ids, stacks->allocated / 1024, 184 nthread, nlive); 185} 186 187#if !SANITIZER_GO 188void InitializeShadowMemoryPlatform() { } 189 190// On OS X, GCD worker threads are created without a call to pthread_create. We 191// need to properly register these threads with ThreadCreate and ThreadStart. 192// These threads don't have a parent thread, as they are created "spuriously". 193// We're using a libpthread API that notifies us about a newly created thread. 194// The `thread == pthread_self()` check indicates this is actually a worker 195// thread. If it's just a regular thread, this hook is called on the parent 196// thread. 197typedef void (*pthread_introspection_hook_t)(unsigned int event, 198 pthread_t thread, void *addr, 199 size_t size); 200extern "C" pthread_introspection_hook_t pthread_introspection_hook_install( 201 pthread_introspection_hook_t hook); 202static const uptr PTHREAD_INTROSPECTION_THREAD_CREATE = 1; 203static const uptr PTHREAD_INTROSPECTION_THREAD_TERMINATE = 3; 204static pthread_introspection_hook_t prev_pthread_introspection_hook; 205static void my_pthread_introspection_hook(unsigned int event, pthread_t thread, 206 void *addr, size_t size) { 207 if (event == PTHREAD_INTROSPECTION_THREAD_CREATE) { 208 if (thread == pthread_self()) { 209 // The current thread is a newly created GCD worker thread. 210 ThreadState *thr = cur_thread(); 211 Processor *proc = ProcCreate(); 212 ProcWire(proc, thr); 213 ThreadState *parent_thread_state = nullptr; // No parent. 214 int tid = ThreadCreate(parent_thread_state, 0, (uptr)thread, true); 215 CHECK_NE(tid, 0); 216 ThreadStart(thr, tid, GetTid(), /*workerthread*/ true); 217 } 218 } else if (event == PTHREAD_INTROSPECTION_THREAD_TERMINATE) { 219 if (thread == pthread_self()) { 220 ThreadState *thr = cur_thread(); 221 if (thr->tctx) { 222 DestroyThreadState(); 223 } 224 } 225 } 226 227 if (prev_pthread_introspection_hook != nullptr) 228 prev_pthread_introspection_hook(event, thread, addr, size); 229} 230#endif 231 232void InitializePlatformEarly() { 233#if defined(__aarch64__) 234 uptr max_vm = GetMaxUserVirtualAddress() + 1; 235 if (max_vm != Mapping::kHiAppMemEnd) { 236 Printf("ThreadSanitizer: unsupported vm address limit %p, expected %p.\n", 237 max_vm, Mapping::kHiAppMemEnd); 238 Die(); 239 } 240#endif 241} 242 243static const uptr kPthreadSetjmpXorKeySlot = 0x7; 244extern "C" uptr __tsan_darwin_setjmp_xor_key = 0; 245 246void InitializePlatform() { 247 DisableCoreDumperIfNecessary(); 248#if !SANITIZER_GO 249 CheckAndProtect(); 250 251 CHECK_EQ(main_thread_identity, 0); 252 main_thread_identity = (uptr)pthread_self(); 253 254 prev_pthread_introspection_hook = 255 pthread_introspection_hook_install(&my_pthread_introspection_hook); 256#endif 257 258 if (GetMacosVersion() >= MACOS_VERSION_MOJAVE) { 259 __tsan_darwin_setjmp_xor_key = 260 (uptr)pthread_getspecific(kPthreadSetjmpXorKeySlot); 261 } 262} 263 264#if !SANITIZER_GO 265void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) { 266 // The pointer to the ThreadState object is stored in the shadow memory 267 // of the tls. 268 uptr tls_end = tls_addr + tls_size; 269 ThreadState **thr_state_loc = cur_thread_location(); 270 if (thr_state_loc == nullptr) { 271 MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr, tls_size); 272 } else { 273 uptr thr_state_start = (uptr)thr_state_loc; 274 uptr thr_state_end = thr_state_start + sizeof(uptr); 275 CHECK_GE(thr_state_start, tls_addr); 276 CHECK_LE(thr_state_start, tls_addr + tls_size); 277 CHECK_GE(thr_state_end, tls_addr); 278 CHECK_LE(thr_state_end, tls_addr + tls_size); 279 MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr, 280 thr_state_start - tls_addr); 281 MemoryRangeImitateWrite(thr, /*pc=*/2, thr_state_end, 282 tls_end - thr_state_end); 283 } 284} 285#endif 286 287#if !SANITIZER_GO 288// Note: this function runs with async signals enabled, 289// so it must not touch any tsan state. 290int call_pthread_cancel_with_cleanup(int(*fn)(void *c, void *m, 291 void *abstime), void *c, void *m, void *abstime, 292 void(*cleanup)(void *arg), void *arg) { 293 // pthread_cleanup_push/pop are hardcore macros mess. 294 // We can't intercept nor call them w/o including pthread.h. 295 int res; 296 pthread_cleanup_push(cleanup, arg); 297 res = fn(c, m, abstime); 298 pthread_cleanup_pop(0); 299 return res; 300} 301#endif 302 303} // namespace __tsan 304 305#endif // SANITIZER_MAC 306