]>
Commit | Line | Data |
---|---|---|
2d21ac55 | 1 | /* |
cc8bc92a | 2 | * Copyright (c) 2006-2017 Apple Inc. All rights reserved. |
2d21ac55 A |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ | |
0a7de745 | 5 | * |
2d21ac55 A |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License | |
8 | * Version 2.0 (the 'License'). You may not use this file except in | |
9 | * compliance with the License. The rights granted to you under the License | |
10 | * may not be used to create, or enable the creation or redistribution of, | |
11 | * unlawful or unlicensed copies of an Apple operating system, or to | |
12 | * circumvent, violate, or enable the circumvention or violation of, any | |
13 | * terms of an Apple operating system software license agreement. | |
0a7de745 | 14 | * |
2d21ac55 A |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. | |
0a7de745 | 17 | * |
2d21ac55 A |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER | |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, | |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, | |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. | |
23 | * Please see the License for the specific language governing rights and | |
24 | * limitations under the License. | |
0a7de745 | 25 | * |
2d21ac55 A |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ | |
28 | ||
2d21ac55 A |
29 | #include <sys/errno.h> |
30 | #include <sys/types.h> | |
31 | #include <sys/malloc.h> | |
32 | #include <sys/buf.h> | |
33 | #include <sys/time.h> | |
34 | #include <sys/kauth.h> | |
35 | #include <sys/mount.h> | |
36 | #include <sys/vnode.h> | |
39236c6e | 37 | #include <sys/syslog.h> |
2d21ac55 | 38 | #include <sys/vnode_internal.h> |
2d21ac55 A |
39 | #include <sys/fslog.h> |
40 | #include <sys/mount_internal.h> | |
39236c6e | 41 | #include <sys/kasl.h> |
2d21ac55 | 42 | |
cc8bc92a A |
43 | #include <sys/queue.h> |
44 | #include <kern/kalloc.h> | |
2d21ac55 | 45 | |
39236c6e | 46 | #include <uuid/uuid.h> |
2d21ac55 | 47 | |
39236c6e | 48 | #include <stdarg.h> |
2d21ac55 | 49 | |
39236c6e A |
50 | /* Log information about external modification of a process, |
51 | * using MessageTracer formatting. Assumes that both the caller | |
52 | * and target are appropriately locked. | |
0a7de745 A |
53 | * Currently prints following information - |
54 | * 1. Caller process name (truncated to 16 characters) | |
39236c6e A |
55 | * 2. Caller process Mach-O UUID |
56 | * 3. Target process name (truncated to 16 characters) | |
57 | * 4. Target process Mach-O UUID | |
2d21ac55 | 58 | */ |
39236c6e A |
59 | void |
60 | fslog_extmod_msgtracer(proc_t caller, proc_t target) | |
2d21ac55 | 61 | { |
39236c6e | 62 | if ((caller != PROC_NULL) && (target != PROC_NULL)) { |
39236c6e A |
63 | /* |
64 | * Print into buffer large enough for "ThisIsAnApplicat(BC223DD7-B314-42E0-B6B0-C5D2E6638337)", | |
65 | * including space for escaping, and NUL byte included in sizeof(uuid_string_t). | |
2d21ac55 | 66 | */ |
2d21ac55 | 67 | |
39236c6e | 68 | uuid_string_t uuidstr; |
0a7de745 A |
69 | char c_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; |
70 | char t_name[2 * MAXCOMLEN + 2 /* () */ + sizeof(uuid_string_t)]; | |
2d21ac55 | 71 | |
39236c6e A |
72 | strlcpy(c_name, caller->p_comm, sizeof(c_name)); |
73 | uuid_unparse_upper(caller->p_uuid, uuidstr); | |
74 | strlcat(c_name, "(", sizeof(c_name)); | |
75 | strlcat(c_name, uuidstr, sizeof(c_name)); | |
76 | strlcat(c_name, ")", sizeof(c_name)); | |
d9a64523 | 77 | if (0 != escape_str(c_name, strlen(c_name) + 1, sizeof(c_name))) { |
39236c6e | 78 | return; |
2d21ac55 | 79 | } |
2d21ac55 | 80 | |
39236c6e A |
81 | strlcpy(t_name, target->p_comm, sizeof(t_name)); |
82 | uuid_unparse_upper(target->p_uuid, uuidstr); | |
83 | strlcat(t_name, "(", sizeof(t_name)); | |
84 | strlcat(t_name, uuidstr, sizeof(t_name)); | |
85 | strlcat(t_name, ")", sizeof(t_name)); | |
d9a64523 | 86 | if (0 != escape_str(t_name, strlen(t_name) + 1, sizeof(t_name))) { |
39236c6e A |
87 | return; |
88 | } | |
89 | #if DEBUG | |
90 | printf("EXTMOD: %s(%d) -> %s(%d)\n", | |
0a7de745 A |
91 | c_name, |
92 | proc_pid(caller), | |
93 | t_name, | |
94 | proc_pid(target)); | |
39236c6e | 95 | #endif |
2d21ac55 | 96 | |
39236c6e | 97 | kern_asl_msg(LOG_DEBUG, "messagetracer", |
0a7de745 A |
98 | 5, |
99 | "com.apple.message.domain", "com.apple.kernel.external_modification", /* 0 */ | |
100 | "com.apple.message.signature", c_name, /* 1 */ | |
101 | "com.apple.message.signature2", t_name, /* 2 */ | |
102 | "com.apple.message.result", "noop", /* 3 */ | |
103 | "com.apple.message.summarize", "YES", /* 4 */ | |
104 | NULL); | |
39236c6e | 105 | } |
2d21ac55 A |
106 | } |
107 | ||
cc8bc92a A |
108 | #if defined(__x86_64__) |
109 | ||
110 | /* | |
111 | * Log information about floating point exception handling | |
112 | */ | |
113 | ||
114 | static lck_mtx_t fpxlock; | |
115 | ||
116 | void | |
117 | fpxlog_init(void) | |
118 | { | |
119 | lck_grp_attr_t *lck_grp_attr = lck_grp_attr_alloc_init(); | |
120 | lck_grp_t *lck_grp = lck_grp_alloc_init("fpx", lck_grp_attr); | |
121 | lck_mtx_init(&fpxlock, lck_grp, LCK_ATTR_NULL); | |
122 | } | |
123 | ||
124 | struct fpx_event { | |
125 | uuid_t fe_uuid; | |
126 | uint32_t fe_code; | |
127 | uint32_t fe_xcpt; | |
128 | TAILQ_ENTRY(fpx_event) fe_link; | |
129 | }; | |
130 | ||
131 | static bool | |
132 | match_fpx_event(const struct fpx_event *fe, | |
133 | const uuid_t uuid, const uint32_t code, const uint32_t xcpt) | |
134 | { | |
0a7de745 A |
135 | return code == fe->fe_code && xcpt == fe->fe_xcpt && |
136 | 0 == memcmp(uuid, fe->fe_uuid, sizeof(uuid_t)); | |
cc8bc92a A |
137 | } |
138 | ||
139 | #if FPX_EVENT_DBG | |
140 | static __attribute__((noinline)) void | |
141 | print_fpx_event(const char *pfx, const struct fpx_event *fe) | |
142 | { | |
143 | uuid_string_t uustr; | |
144 | uuid_unparse_upper(fe->fe_uuid, uustr); | |
145 | printf("%s: code 0x%x xcpt 0x%x uuid '%s'\n", | |
146 | pfx, fe->fe_code, fe->fe_xcpt, uustr); | |
147 | } | |
0a7de745 | 148 | #define DPRINTF_FPX_EVENT(pfx, fe) print_fpx_event(pfx, fe) |
cc8bc92a | 149 | #else |
0a7de745 | 150 | #define DPRINTF_FPX_EVENT(pfx, fe) /* nothing */ |
cc8bc92a A |
151 | #endif |
152 | ||
0a7de745 | 153 | #define MAX_DISTINCT_FPX_EVENTS 101 /* (approx one page of heap) */ |
cc8bc92a A |
154 | |
155 | /* | |
156 | * Filter to detect "new" <uuid, code, xcpt> tuples. | |
157 | * Uses limited amount of state, managed LRU. | |
158 | * Optimized to ignore repeated invocation with the same tuple. | |
159 | * | |
160 | * Note that there are 6 exception types, two types of FP, and | |
161 | * many binaries, so don't make the list bound too small. | |
162 | * It's also a linear search, so don't make it too large either. | |
163 | * Next level filtering provided by syslogd, and summarization. | |
164 | */ | |
165 | static bool | |
166 | novel_fpx_event(const uuid_t uuid, uint32_t code, uint32_t xcpt) | |
167 | { | |
168 | static TAILQ_HEAD(fpx_event_head, fpx_event) fehead = | |
0a7de745 | 169 | TAILQ_HEAD_INITIALIZER(fehead); |
cc8bc92a A |
170 | struct fpx_event *fe; |
171 | ||
172 | lck_mtx_lock(&fpxlock); | |
173 | ||
174 | fe = TAILQ_FIRST(&fehead); | |
175 | if (NULL != fe && | |
176 | match_fpx_event(fe, uuid, code, xcpt)) { | |
177 | /* seen before and element already at head */ | |
178 | lck_mtx_unlock(&fpxlock); | |
179 | DPRINTF_FPX_EVENT("seen, head", fe); | |
0a7de745 | 180 | return false; |
cc8bc92a A |
181 | } |
182 | ||
183 | unsigned int count = 0; | |
184 | ||
185 | TAILQ_FOREACH(fe, &fehead, fe_link) { | |
186 | if (match_fpx_event(fe, uuid, code, xcpt)) { | |
187 | /* seen before, now move element to head */ | |
188 | TAILQ_REMOVE(&fehead, fe, fe_link); | |
189 | TAILQ_INSERT_HEAD(&fehead, fe, fe_link); | |
190 | lck_mtx_unlock(&fpxlock); | |
191 | DPRINTF_FPX_EVENT("seen, moved to head", fe); | |
0a7de745 | 192 | return false; |
cc8bc92a A |
193 | } |
194 | count++; | |
195 | } | |
196 | ||
197 | /* not recorded here => novel */ | |
198 | ||
199 | if (count >= MAX_DISTINCT_FPX_EVENTS) { | |
200 | /* reuse LRU element */ | |
201 | fe = TAILQ_LAST(&fehead, fpx_event_head); | |
202 | TAILQ_REMOVE(&fehead, fe, fe_link); | |
203 | DPRINTF_FPX_EVENT("reusing", fe); | |
204 | } else { | |
205 | /* add a new element to the list */ | |
0a7de745 | 206 | fe = kalloc(sizeof(*fe)); |
cc8bc92a | 207 | } |
0a7de745 | 208 | memcpy(fe->fe_uuid, uuid, sizeof(uuid_t)); |
cc8bc92a A |
209 | fe->fe_code = code; |
210 | fe->fe_xcpt = xcpt; | |
211 | TAILQ_INSERT_HEAD(&fehead, fe, fe_link); | |
212 | lck_mtx_unlock(&fpxlock); | |
213 | ||
214 | DPRINTF_FPX_EVENT("novel", fe); | |
215 | ||
0a7de745 | 216 | return true; |
cc8bc92a A |
217 | } |
218 | ||
219 | void | |
220 | fpxlog( | |
0a7de745 A |
221 | int code, /* Mach exception code: e.g. 5 or 8 */ |
222 | uint32_t stat, /* Full FP status register bits */ | |
223 | uint32_t ctrl, /* Full FP control register bits */ | |
224 | uint32_t xcpt) /* Exception bits from FP status */ | |
cc8bc92a A |
225 | { |
226 | proc_t p = current_proc(); | |
0a7de745 | 227 | if (PROC_NULL == p) { |
cc8bc92a | 228 | return; |
0a7de745 | 229 | } |
cc8bc92a A |
230 | |
231 | uuid_t uuid; | |
0a7de745 | 232 | proc_getexecutableuuid(p, uuid, sizeof(uuid)); |
cc8bc92a A |
233 | |
234 | /* | |
235 | * Check to see if an exception with this <uuid, code, xcpt> | |
236 | * has been seen before. If "novel" then log a message. | |
237 | */ | |
0a7de745 | 238 | if (!novel_fpx_event(uuid, code, xcpt)) { |
cc8bc92a | 239 | return; |
0a7de745 | 240 | } |
cc8bc92a A |
241 | |
242 | const size_t nmlen = 2 * MAXCOMLEN + 1; | |
243 | char nm[nmlen] = {}; | |
244 | proc_selfname(nm, nmlen); | |
0a7de745 A |
245 | if (escape_str(nm, strlen(nm) + 1, nmlen)) { |
246 | snprintf(nm, nmlen, "(a.out)"); | |
247 | } | |
cc8bc92a A |
248 | |
249 | const size_t slen = 8 + 1 + 8 + 1; | |
250 | char xcptstr[slen], csrstr[slen]; | |
251 | ||
252 | snprintf(xcptstr, slen, "%x.%x", code, xcpt); | |
0a7de745 | 253 | if (ctrl == stat) { |
cc8bc92a | 254 | snprintf(csrstr, slen, "%x", ctrl); |
0a7de745 | 255 | } else { |
cc8bc92a | 256 | snprintf(csrstr, slen, "%x.%x", ctrl, stat); |
0a7de745 | 257 | } |
cc8bc92a A |
258 | |
259 | #if DEVELOPMENT || DEBUG | |
260 | printf("%s[%d]: com.apple.kernel.fpx: %s, %s\n", | |
0a7de745 | 261 | nm, proc_pid(p), xcptstr, csrstr); |
cc8bc92a A |
262 | #endif |
263 | kern_asl_msg(LOG_DEBUG, "messagetracer", 5, | |
0a7de745 A |
264 | /* 0 */ "com.apple.message.domain", "com.apple.kernel.fpx", |
265 | /* 1 */ "com.apple.message.signature", nm, | |
266 | /* 2 */ "com.apple.message.signature2", xcptstr, | |
267 | /* 3 */ "com.apple.message.value", csrstr, | |
268 | /* 4 */ "com.apple.message.summarize", "YES", | |
269 | NULL); | |
cc8bc92a A |
270 | } |
271 | ||
272 | #else | |
273 | ||
274 | void | |
275 | fpxlog_init(void) | |
0a7de745 A |
276 | { |
277 | } | |
cc8bc92a A |
278 | |
279 | #endif /* __x86_64__ */ |