1 /* Copyright (c) 2020 Apple Computer, Inc. All rights reserved. */
2
3 #include <CoreSymbolication/CoreSymbolication.h>
4 #include <CoreSymbolication/CoreSymbolicationPrivate.h>
5 #include <darwintest.h>
6 #include <dispatch/dispatch.h>
7
8 #include <mach-o/loader.h>
9
10 #include <sys/kas_info.h>
11
12 #include <sys/mman.h>
13 #include <sys/stat.h>
14 #include <sys/sysctl.h>
15 #include <sys/types.h>
16
17 #include <fcntl.h>
18
19 #include <stdint.h>
20
21 T_GLOBAL_META(
22 T_META_NAMESPACE("xnu.kas_info"),
23 T_META_CHECK_LEAKS(false),
24 T_META_ASROOT(true));
25
26 static bool
slide_enabled(void)27 slide_enabled(void)
28 {
29 int slide_enabled, err;
30 size_t size = sizeof(slide_enabled);
31 err = sysctlbyname("kern.slide", &slide_enabled, &size, NULL, 0);
32 T_ASSERT_POSIX_SUCCESS(err, "sysctl(\"kern.slide\");");
33 return slide_enabled != 0;
34 }
35
36 static uint64_t
kernel_slide(int selector)37 kernel_slide(int selector)
38 {
39 uint64_t slide;
40 size_t size = sizeof(slide);
41 int err = kas_info(selector, &slide, &size);
42 if (err && errno == ENOTSUP) {
43 T_SKIP("Running on kernel without kas_info");
44 }
45
46 T_ASSERT_POSIX_SUCCESS(errno, "kas_info with selector %d", selector);
47 T_ASSERT_EQ(size, sizeof(slide), "returned size is valid");
48
49 return slide;
50 }
51
52 T_DECL(kernel_text_slide,
53 "ensures that kas_info can return the kernel text slide")
54 {
55 if (!slide_enabled()) {
56 T_SKIP("KASLR is not enabled");
57 __builtin_unreachable();
58 }
59
60 uint64_t slide = kernel_slide(KAS_INFO_KERNEL_TEXT_SLIDE_SELECTOR);
61
62 T_ASSERT_GT_ULLONG(slide, 0ULL, "kernel slide is non-zero");
63 }
64
65 static void
test_kas_info_invalid_args(int selector)66 test_kas_info_invalid_args(int selector)
67 {
68 uint64_t slide;
69 size_t size = 0;
70 int err;
71
72 err = kas_info(selector, &slide, NULL);
73 if (errno == ENOTSUP) {
74 T_SKIP("Running on kernel without kas_info %d", selector);
75 }
76 T_ASSERT_POSIX_FAILURE(err, EFAULT, "kas_info %d with NULL size", selector);
77
78 size = sizeof(uint64_t);
79 err = kas_info(selector, NULL, &size);
80 T_ASSERT_POSIX_FAILURE(err, EFAULT, "kas_info %d with NULL slide", selector);
81
82 size = sizeof(uint32_t);
83 err = kas_info(selector, &slide, &size);
84 T_ASSERT_POSIX_FAILURE(err, EINVAL, "kas_info %d with invalid size", selector);
85 }
86
87 T_DECL(kernel_text_slide_invalid,
88 "ensures that kas_info handles invalid input to KERNEL_TEXT_SLIDE_SELECTOR")
89 {
90 test_kas_info_invalid_args(KAS_INFO_KERNEL_TEXT_SLIDE_SELECTOR);
91 }
92
93
94 static char const*
kernel_path(void)95 kernel_path(void)
96 {
97 static CSSymbolicatorRef symbolicator;
98 static char const* path;
99 static dispatch_once_t once;
100 dispatch_once(&once, ^{
101 uint32_t flags = kCSSymbolicatorDefaultCreateFlags;
102 symbolicator = CSSymbolicatorCreateWithMachKernelFlagsAndNotification(flags, NULL);
103 T_QUIET; T_ASSERT_TRUE(!CSIsNull(symbolicator), "CSSymbolicatorCreateWithMachKernelFlagsAndNotification");
104 path = CSSymbolOwnerGetPath(CSSymbolicatorGetAOutSymbolOwner(symbolicator));
105 if (!path) {
106 path = CSSymbolOwnerGetPath(CSSymbolicatorGetSymbolOwner(symbolicator));
107 }
108 T_QUIET; T_ASSERT_NOTNULL(path, "CSSymbolOwnerGetPath/CSSymbolicatorGetSymbolOwner");
109 });
110 return path;
111 }
112
113 static void
disk_kernel_segments(uint64_t ** segs_out,size_t * nsegs_out)114 disk_kernel_segments(uint64_t **segs_out, size_t *nsegs_out)
115 {
116 char const* path = kernel_path();
117 int fd = open(path, O_RDONLY);
118 int err;
119 struct stat sb;
120 size_t nsegs = 0;
121 uint64_t *segs = NULL;
122 void *data;
123
124 T_LOG("Kernel file is %s", path);
125 T_QUIET; T_ASSERT_POSIX_SUCCESS(fd, "open kernel file");
126
127 err = fstat(fd, &sb);
128 T_ASSERT_POSIX_SUCCESS(err, "fstat kernel file");
129
130 data = mmap(NULL, (size_t)sb.st_size, PROT_READ, MAP_SHARED, fd, 0);
131 T_ASSERT_NE(data, MAP_FAILED, "mmap kernel file");
132
133 /*
134 * TODO: If we bring back FAT kernel binaries
135 * this will need to be fixed to handle them properly
136 */
137 uint32_t magic = *(uint32_t*)data;
138 struct load_command *cmd = NULL;
139
140 switch (magic) {
141 case MH_MAGIC: OS_FALLTHROUGH;
142 case MH_CIGAM: {
143 struct mach_header *mh = (struct mach_header *)data;
144 cmd = (struct load_command *)(&(mh[1]));
145 nsegs = mh->ncmds;
146 }
147 break;
148 case MH_MAGIC_64: OS_FALLTHROUGH;
149 case MH_CIGAM_64: {
150 struct mach_header_64 *mh = (struct mach_header_64 *)data;
151 cmd = (struct load_command *)(&(mh[1]));
152 nsegs = mh->ncmds;
153 }
154 break;
155 default:
156 T_FAIL("kernel file is not a Mach-O file, magic is %x", magic);
157 }
158
159 /* Adjust for the LC_UUID && LC_BUILD_VERSION commands in front of
160 * load commands for dSYMs
161 */
162 while (cmd->cmd != LC_SEGMENT && cmd->cmd != LC_SEGMENT_64) {
163 cmd = (struct load_command *) ((uintptr_t) cmd + cmd->cmdsize);
164 nsegs--;
165 }
166
167 segs = calloc(nsegs, sizeof(*segs));
168 T_ASSERT_NOTNULL(segs, "calloc disk segment array");
169
170 for (uint8_t i = 0; i < nsegs; i++) {
171 if (cmd->cmd == LC_SEGMENT) {
172 struct segment_command *sg = (struct segment_command *) cmd;
173 if (sg->vmsize > 0) {
174 segs[i] = sg->vmaddr;
175 }
176 } else if (cmd->cmd == LC_SEGMENT_64) {
177 struct segment_command_64 *sg = (struct segment_command_64 *) cmd;
178 if (sg->vmsize > 0) {
179 segs[i] = sg->vmaddr;
180 }
181 }
182 cmd = (struct load_command *) ((uintptr_t) cmd + cmd->cmdsize);
183 }
184
185 *segs_out = segs;
186 *nsegs_out = nsegs;
187
188 err = munmap(data, (size_t)sb.st_size);
189
190 err = close(fd);
191 T_ASSERT_POSIX_SUCCESS(err, "close kernel fd");
192 }
193
194 static bool
is_fileset_kc(void)195 is_fileset_kc(void)
196 {
197 char uuid[1024];
198 int err;
199 size_t size = sizeof(uuid);
200 err = sysctlbyname("kern.filesetuuid", uuid, &size, NULL, 0);
201 return err == 0;
202 }
203
204 #define KAS_INFO_KERNEL_SEGMENT_LOCATION_SELECTOR 1
205
206 T_DECL(kernel_segment_location,
207 "ensures that KAS_INFO_KERNEL_SEGMENT_LOCATION returns correct segment locations")
208 {
209 int err;
210
211 if (!slide_enabled()) {
212 T_SKIP("KASLR is not enabled");
213 __builtin_unreachable();
214 }
215
216 uint64_t *disk_segs;
217 size_t disk_nsegs;
218 disk_kernel_segments(&disk_segs, &disk_nsegs);
219
220 size_t size = 0;
221
222 err = kas_info(KAS_INFO_KERNEL_SEGMENT_VMADDR_SELECTOR, NULL, &size);
223 if (errno == ENOTSUP) {
224 T_SKIP("KAS_INFO_KERNEL_SEGMENT_VMADDR_SELECTOR not supported");
225 }
226 T_ASSERT_POSIX_SUCCESS(err, "kas_info KAS_INFO_KERNEL_SEGMENT_VMADDR_SELECTOR for size");
227
228 uint64_t mem_nsegs = size / sizeof(uint64_t);
229 uint64_t *mem_segs = calloc(mem_nsegs, sizeof(*disk_segs));
230
231 err = kas_info(KAS_INFO_KERNEL_SEGMENT_VMADDR_SELECTOR, mem_segs, &size);
232 if (errno == ENOTSUP) {
233 T_SKIP("KAS_INFO_KERNEL_SEGMENT_VMADDR_SELECTOR not supported");
234 }
235
236 T_ASSERT_POSIX_SUCCESS(err, "kas_info KAS_INFO_KERNEL_SEGMENT_VMADDR_SELECTOR for data");
237
238 T_LOG("Kernel has %zu segments on disk, %zu in memory:", disk_nsegs, mem_nsegs);
239 for (size_t i = 0; i < disk_nsegs; i++) {
240 T_LOG("%zu %llx %llx", i, disk_segs[i], mem_segs[i]);
241 }
242
243 /*
244 * If the kernel is not a fileset, verify that all
245 * the segments in memory are the segment on disk
246 * + the kaslr slide
247 */
248 if (!is_fileset_kc()) {
249 T_LOG("Kernelcache is not a fileset kernelcache");
250
251 uint64_t slide = kernel_slide(KAS_INFO_KERNEL_TEXT_SLIDE_SELECTOR);
252 for (size_t i = 0; i < disk_nsegs; i++) {
253 if (disk_segs[i] == 0 || mem_segs[i] == 0) {
254 continue;
255 }
256 T_ASSERT_EQ(disk_segs[i] + slide, mem_segs[i], "segment %zu is slid", i);
257 }
258 }
259
260 free(disk_segs);
261 free(mem_segs);
262 }
263