1 /*
2 * Copyright (c) 2018-2021 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <os/atomic_private.h>
30 #include <kern/cpu_data.h>
31 #include <kern/kalloc.h>
32 #include <kern/simple_lock.h> // hw_wait_while_equals
33 #include <libkern/libkern.h>
34 #include <sys/sysctl.h>
35 #include "ubsan.h"
36
37 /*
38 * To dump the violation log:
39 * $ sysctl kern.ubsan.log
40 *
41 * To reset:
42 * $ sysctl kern.ubsan.logentries=0
43 */
44
45 static const size_t ubsan_log_size = 2048;
46 ubsan_violation_t ubsan_log[ubsan_log_size];
47
48 /*
49 * Implement a fixed-size buffer FIFO, similar to the Chase-Lev DeQueue.
50 *
51 * See https://fzn.fr/readings/ppopp13.pdf for explanations on barriers.
52 */
53 _Atomic size_t ubsan_log_head = 0; /* first valid entry */
54 _Atomic size_t ubsan_log_tail = 0; /* next free slot (reader) */
55 _Atomic size_t ubsan_log_next = 0; /* next free slot (writer) */
56
57 static const bool ubsan_logging = true;
58
59 static inline size_t
next_entry(size_t x)60 next_entry(size_t x)
61 {
62 return (x + 1) % ubsan_log_size;
63 }
64
65 void
ubsan_log_append(ubsan_violation_t * violation)66 ubsan_log_append(ubsan_violation_t *violation)
67 {
68 if (!ubsan_logging) {
69 return;
70 }
71
72 /* reserve a slot */
73 size_t i, e, n;
74
75 disable_preemption();
76
77 os_atomic_rmw_loop(&ubsan_log_next, i, n, relaxed, {
78 n = next_entry(i);
79 if (n == os_atomic_load(&ubsan_log_tail, acquire)) {
80 enable_preemption();
81 return; /* full */
82 }
83 });
84
85 ubsan_log[i] = *violation;
86 os_atomic_thread_fence(release);
87
88 /* make the entry available */
89 again:
90 os_atomic_rmw_loop(&ubsan_log_head, e, n, relaxed, {
91 if (e != i) {
92 // we need to wait for another enqueuer
93 os_atomic_rmw_loop_give_up({
94 hw_wait_while_equals_long(&ubsan_log_head, e);
95 goto again;
96 });
97 }
98 });
99
100 enable_preemption();
101 }
102
103 static size_t
ubsan_log_recorded(size_t head,size_t tail)104 ubsan_log_recorded(size_t head, size_t tail)
105 {
106 if (head >= tail) {
107 return head - tail;
108 }
109 return ubsan_log_size - (tail - head + 1);
110 }
111
112 static int
113 sysctl_ubsan_log_dump SYSCTL_HANDLER_ARGS
114 {
115 #pragma unused(oidp, arg1, arg2)
116 const size_t buf_size = ubsan_log_size * 256;
117 size_t head, tail;
118
119 head = os_atomic_load(&ubsan_log_head, relaxed);
120 os_atomic_thread_fence(seq_cst);
121 tail = os_atomic_load(&ubsan_log_tail, relaxed);
122
123 size_t nentries = ubsan_log_recorded(head, tail);
124 if (nentries == 0) {
125 return 0; /* log is empty */
126 }
127
128 char *buf = kalloc_data(buf_size, Z_WAITOK | Z_ZERO);
129 if (!buf) {
130 return 0;
131 }
132
133 ubsan_buf_t ubsan_buf;
134 ubsan_json_init(&ubsan_buf, buf, buf_size);
135 ubsan_json_begin(&ubsan_buf, nentries);
136
137 for (size_t i = tail; i != head; i = next_entry(i)) {
138 if (!ubsan_json_format(&ubsan_log[i], &ubsan_buf)) {
139 break;
140 }
141 }
142
143 size_t buf_written = ubsan_json_finish(&ubsan_buf);
144
145 int err = SYSCTL_OUT(req, buf, buf_written);
146
147 kfree_data(buf, buf_size);
148 return err;
149 }
150
151 static int
152 sysctl_ubsan_log_entries SYSCTL_HANDLER_ARGS
153 {
154 #pragma unused(oidp, arg1, arg2)
155 size_t head, tail;
156
157 head = os_atomic_load(&ubsan_log_head, relaxed);
158 os_atomic_thread_fence(seq_cst);
159 tail = os_atomic_load(&ubsan_log_tail, relaxed);
160
161 size_t nentries = ubsan_log_recorded(head, tail);
162 int changed = 0;
163 int err = sysctl_io_number(req, nentries, sizeof(nentries), &nentries, &changed);
164
165 if (err || !changed) {
166 return err;
167 }
168 if (nentries != 0) {
169 return EINVAL;
170 }
171
172 os_atomic_store(&ubsan_log_tail, head, relaxed);
173
174 return 0;
175 }
176
177 SYSCTL_DECL(ubsan);
178 SYSCTL_NODE(_kern, OID_AUTO, ubsan, CTLFLAG_RW | CTLFLAG_LOCKED, 0, "");
179
180 SYSCTL_COMPAT_UINT(_kern_ubsan, OID_AUTO, logsize, CTLFLAG_RD, NULL, (unsigned)ubsan_log_size, "");
181
182 SYSCTL_PROC(_kern_ubsan, OID_AUTO, logentries,
183 CTLTYPE_INT | CTLFLAG_RW,
184 0, 0, sysctl_ubsan_log_entries, "I", "");
185
186 SYSCTL_PROC(_kern_ubsan, OID_AUTO, log,
187 CTLTYPE_STRING | CTLFLAG_RD | CTLFLAG_MASKED,
188 0, 0, sysctl_ubsan_log_dump, "A", "");
189