libsanitizer/tsan/tsan_platform_mac.cpp

   1 //===-- tsan_platform_mac.cpp ---------------------------------------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file is a part of ThreadSanitizer (TSan), a race detector.
  10 //
  11 // Mac-specific code.
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "sanitizer_common/sanitizer_platform.h"
  15 #if SANITIZER_MAC
  16
  17 #include "sanitizer_common/sanitizer_atomic.h"
  18 #include "sanitizer_common/sanitizer_common.h"
  19 #include "sanitizer_common/sanitizer_libc.h"
  20 #include "sanitizer_common/sanitizer_posix.h"
  21 #include "sanitizer_common/sanitizer_procmaps.h"
  22 #include "sanitizer_common/sanitizer_stackdepot.h"
  23 #include "tsan_platform.h"
  24 #include "tsan_rtl.h"
  25 #include "tsan_flags.h"
  26
  27 #include <mach/mach.h>
  28 #include <pthread.h>
  29 #include <signal.h>
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <string.h>
  33 #include <stdarg.h>
  34 #include <sys/mman.h>
  35 #include <sys/syscall.h>
  36 #include <sys/time.h>
  37 #include <sys/types.h>
  38 #include <sys/resource.h>
  39 #include <sys/stat.h>
  40 #include <unistd.h>
  41 #include <errno.h>
  42 #include <sched.h>
  43
  44 namespace __tsan {
  45
  46 #if !SANITIZER_GO
  47 static void *SignalSafeGetOrAllocate(uptr *dst, uptr size) {
  48   atomic_uintptr_t *a = (atomic_uintptr_t *)dst;
  49   void *val = (void *)atomic_load_relaxed(a);
  50   atomic_signal_fence(memory_order_acquire);  // Turns the previous load into
  51                                               // acquire wrt signals.
  52   if (UNLIKELY(val == nullptr)) {
  53     val = (void *)internal_mmap(nullptr, size, PROT_READ | PROT_WRITE,
  54                                 MAP_PRIVATE | MAP_ANON, -1, 0);
  55     CHECK(val);
  56     void *cmp = nullptr;
  57     if (!atomic_compare_exchange_strong(a, (uintptr_t *)&cmp, (uintptr_t)val,
  58                                         memory_order_acq_rel)) {
  59       internal_munmap(val, size);
  60       val = cmp;
  61     }
  62   }
  63   return val;
  64 }
  65
  66 // On OS X, accessing TLVs via __thread or manually by using pthread_key_* is
  67 // problematic, because there are several places where interceptors are called
  68 // when TLVs are not accessible (early process startup, thread cleanup, ...).
  69 // The following provides a "poor man's TLV" implementation, where we use the
  70 // shadow memory of the pointer returned by pthread_self() to store a pointer to
  71 // the ThreadState object. The main thread's ThreadState is stored separately
  72 // in a static variable, because we need to access it even before the
  73 // shadow memory is set up.
  74 static uptr main_thread_identity = 0;
  75 ALIGNED(64) static char main_thread_state[sizeof(ThreadState)];
  76 static ThreadState *main_thread_state_loc = (ThreadState *)main_thread_state;
  77
  78 static ThreadState **cur_thread_location() {
  79   uptr thread_identity = (uptr)pthread_self();
  80   if (thread_identity == main_thread_identity || main_thread_identity == 0)
  81     return &main_thread_state_loc;
  82   return (ThreadState **)MemToShadow(thread_identity);
  83 }
  84
  85 ThreadState *cur_thread() {
  86   return (ThreadState *)SignalSafeGetOrAllocate(
  87       (uptr *)cur_thread_location(), sizeof(ThreadState));
  88 }
  89
  90 void set_cur_thread(ThreadState *thr) {
  91   *cur_thread_location() = thr;
  92 }
  93
  94 // TODO(kuba.brecka): This is not async-signal-safe. In particular, we call
  95 // munmap first and then clear `fake_tls`; if we receive a signal in between,
  96 // handler will try to access the unmapped ThreadState.
  97 void cur_thread_finalize() {
  98   ThreadState **thr_state_loc = cur_thread_location();
  99   if (thr_state_loc == &main_thread_state_loc) {
 100     // Calling dispatch_main() or xpc_main() actually invokes pthread_exit to
 101     // exit the main thread. Let's keep the main thread's ThreadState.
 102     return;
 103   }
 104   internal_munmap(*thr_state_loc, sizeof(ThreadState));
 105   *thr_state_loc = nullptr;
 106 }
 107 #endif
 108
 109 void FlushShadowMemory() {
 110 }
 111
 112 static void RegionMemUsage(uptr start, uptr end, uptr *res, uptr *dirty) {
 113   vm_address_t address = start;
 114   vm_address_t end_address = end;
 115   uptr resident_pages = 0;
 116   uptr dirty_pages = 0;
 117   while (address < end_address) {
 118     vm_size_t vm_region_size;
 119     mach_msg_type_number_t count = VM_REGION_EXTENDED_INFO_COUNT;
 120     vm_region_extended_info_data_t vm_region_info;
 121     mach_port_t object_name;
 122     kern_return_t ret = vm_region_64(
 123         mach_task_self(), &address, &vm_region_size, VM_REGION_EXTENDED_INFO,
 124         (vm_region_info_t)&vm_region_info, &count, &object_name);
 125     if (ret != KERN_SUCCESS) break;
 126
 127     resident_pages += vm_region_info.pages_resident;
 128     dirty_pages += vm_region_info.pages_dirtied;
 129
 130     address += vm_region_size;
 131   }
 132   *res = resident_pages * GetPageSizeCached();
 133   *dirty = dirty_pages * GetPageSizeCached();
 134 }
 135
 136 void WriteMemoryProfile(char *buf, uptr buf_size, uptr nthread, uptr nlive) {
 137   uptr shadow_res, shadow_dirty;
 138   uptr meta_res, meta_dirty;
 139   uptr trace_res, trace_dirty;
 140   RegionMemUsage(ShadowBeg(), ShadowEnd(), &shadow_res, &shadow_dirty);
 141   RegionMemUsage(MetaShadowBeg(), MetaShadowEnd(), &meta_res, &meta_dirty);
 142   RegionMemUsage(TraceMemBeg(), TraceMemEnd(), &trace_res, &trace_dirty);
 143
 144 #if !SANITIZER_GO
 145   uptr low_res, low_dirty;
 146   uptr high_res, high_dirty;
 147   uptr heap_res, heap_dirty;
 148   RegionMemUsage(LoAppMemBeg(), LoAppMemEnd(), &low_res, &low_dirty);
 149   RegionMemUsage(HiAppMemBeg(), HiAppMemEnd(), &high_res, &high_dirty);
 150   RegionMemUsage(HeapMemBeg(), HeapMemEnd(), &heap_res, &heap_dirty);
 151 #else  // !SANITIZER_GO
 152   uptr app_res, app_dirty;
 153   RegionMemUsage(AppMemBeg(), AppMemEnd(), &app_res, &app_dirty);
 154 #endif
 155
 156   StackDepotStats *stacks = StackDepotGetStats();
 157   internal_snprintf(buf, buf_size,
 158     "shadow   (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 159     "meta     (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 160     "traces   (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 161 #if !SANITIZER_GO
 162     "low app  (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 163     "high app (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 164     "heap     (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 165 #else  // !SANITIZER_GO
 166     "app      (0x%016zx-0x%016zx): resident %zd kB, dirty %zd kB\n"
 167 #endif
 168     "stacks: %zd unique IDs, %zd kB allocated\n"
 169     "threads: %zd total, %zd live\n"
 170     "------------------------------\n",
 171     ShadowBeg(), ShadowEnd(), shadow_res / 1024, shadow_dirty / 1024,
 172     MetaShadowBeg(), MetaShadowEnd(), meta_res / 1024, meta_dirty / 1024,
 173     TraceMemBeg(), TraceMemEnd(), trace_res / 1024, trace_dirty / 1024,
 174 #if !SANITIZER_GO
 175     LoAppMemBeg(), LoAppMemEnd(), low_res / 1024, low_dirty / 1024,
 176     HiAppMemBeg(), HiAppMemEnd(), high_res / 1024, high_dirty / 1024,
 177     HeapMemBeg(), HeapMemEnd(), heap_res / 1024, heap_dirty / 1024,
 178 #else  // !SANITIZER_GO
 179     AppMemBeg(), AppMemEnd(), app_res / 1024, app_dirty / 1024,
 180 #endif
 181     stacks->n_uniq_ids, stacks->allocated / 1024,
 182     nthread, nlive);
 183 }
 184
 185 #if !SANITIZER_GO
 186 void InitializeShadowMemoryPlatform() { }
 187
 188 // On OS X, GCD worker threads are created without a call to pthread_create. We
 189 // need to properly register these threads with ThreadCreate and ThreadStart.
 190 // These threads don't have a parent thread, as they are created "spuriously".
 191 // We're using a libpthread API that notifies us about a newly created thread.
 192 // The `thread == pthread_self()` check indicates this is actually a worker
 193 // thread. If it's just a regular thread, this hook is called on the parent
 194 // thread.
 195 typedef void (*pthread_introspection_hook_t)(unsigned int event,
 196                                              pthread_t thread, void *addr,
 197                                              size_t size);
 198 extern "C" pthread_introspection_hook_t pthread_introspection_hook_install(
 199     pthread_introspection_hook_t hook);
 200 static const uptr PTHREAD_INTROSPECTION_THREAD_CREATE = 1;
 201 static const uptr PTHREAD_INTROSPECTION_THREAD_TERMINATE = 3;
 202 static pthread_introspection_hook_t prev_pthread_introspection_hook;
 203 static void my_pthread_introspection_hook(unsigned int event, pthread_t thread,
 204                                           void *addr, size_t size) {
 205   if (event == PTHREAD_INTROSPECTION_THREAD_CREATE) {
 206     if (thread == pthread_self()) {
 207       // The current thread is a newly created GCD worker thread.
 208       ThreadState *thr = cur_thread();
 209       Processor *proc = ProcCreate();
 210       ProcWire(proc, thr);
 211       ThreadState *parent_thread_state = nullptr;  // No parent.
 212       int tid = ThreadCreate(parent_thread_state, 0, (uptr)thread, true);
 213       CHECK_NE(tid, 0);
 214       ThreadStart(thr, tid, GetTid(), ThreadType::Worker);
 215     }
 216   } else if (event == PTHREAD_INTROSPECTION_THREAD_TERMINATE) {
 217     if (thread == pthread_self()) {
 218       ThreadState *thr = cur_thread();
 219       if (thr->tctx) {
 220         DestroyThreadState();
 221       }
 222     }
 223   }
 224
 225   if (prev_pthread_introspection_hook != nullptr)
 226     prev_pthread_introspection_hook(event, thread, addr, size);
 227 }
 228 #endif
 229
 230 void InitializePlatformEarly() {
 231 #if defined(__aarch64__)
 232   uptr max_vm = GetMaxUserVirtualAddress() + 1;
 233   if (max_vm != Mapping::kHiAppMemEnd) {
 234     Printf("ThreadSanitizer: unsupported vm address limit %p, expected %p.\n",
 235            max_vm, Mapping::kHiAppMemEnd);
 236     Die();
 237   }
 238 #endif
 239 }
 240
 241 static uptr longjmp_xor_key = 0;
 242
 243 void InitializePlatform() {
 244   DisableCoreDumperIfNecessary();
 245 #if !SANITIZER_GO
 246   CheckAndProtect();
 247
 248   CHECK_EQ(main_thread_identity, 0);
 249   main_thread_identity = (uptr)pthread_self();
 250
 251   prev_pthread_introspection_hook =
 252       pthread_introspection_hook_install(&my_pthread_introspection_hook);
 253 #endif
 254
 255   if (GetMacosVersion() >= MACOS_VERSION_MOJAVE) {
 256     // Libsystem currently uses a process-global key; this might change.
 257     const unsigned kTLSLongjmpXorKeySlot = 0x7;
 258     longjmp_xor_key = (uptr)pthread_getspecific(kTLSLongjmpXorKeySlot);
 259   }
 260 }
 261
 262 #ifdef __aarch64__
 263 # define LONG_JMP_SP_ENV_SLOT \
 264     ((GetMacosVersion() >= MACOS_VERSION_MOJAVE) ? 12 : 13)
 265 #else
 266 # define LONG_JMP_SP_ENV_SLOT 2
 267 #endif
 268
 269 uptr ExtractLongJmpSp(uptr *env) {
 270   uptr mangled_sp = env[LONG_JMP_SP_ENV_SLOT];
 271   uptr sp = mangled_sp ^ longjmp_xor_key;
 272   return sp;
 273 }
 274
 275 #if !SANITIZER_GO
 276 void ImitateTlsWrite(ThreadState *thr, uptr tls_addr, uptr tls_size) {
 277   // The pointer to the ThreadState object is stored in the shadow memory
 278   // of the tls.
 279   uptr tls_end = tls_addr + tls_size;
 280   uptr thread_identity = (uptr)pthread_self();
 281   if (thread_identity == main_thread_identity) {
 282     MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr, tls_size);
 283   } else {
 284     uptr thr_state_start = thread_identity;
 285     uptr thr_state_end = thr_state_start + sizeof(uptr);
 286     CHECK_GE(thr_state_start, tls_addr);
 287     CHECK_LE(thr_state_start, tls_addr + tls_size);
 288     CHECK_GE(thr_state_end, tls_addr);
 289     CHECK_LE(thr_state_end, tls_addr + tls_size);
 290     MemoryRangeImitateWrite(thr, /*pc=*/2, tls_addr,
 291                             thr_state_start - tls_addr);
 292     MemoryRangeImitateWrite(thr, /*pc=*/2, thr_state_end,
 293                             tls_end - thr_state_end);
 294   }
 295 }
 296 #endif
 297
 298 #if !SANITIZER_GO
 299 // Note: this function runs with async signals enabled,
 300 // so it must not touch any tsan state.
 301 int call_pthread_cancel_with_cleanup(int(*fn)(void *c, void *m,
 302     void *abstime), void *c, void *m, void *abstime,
 303     void(*cleanup)(void *arg), void *arg) {
 304   // pthread_cleanup_push/pop are hardcore macros mess.
 305   // We can't intercept nor call them w/o including pthread.h.
 306   int res;
 307   pthread_cleanup_push(cleanup, arg);
 308   res = fn(c, m, abstime);
 309   pthread_cleanup_pop(0);
 310   return res;
 311 }
 312 #endif
 313
 314 }  // namespace __tsan
 315
 316 #endif  // SANITIZER_MAC