bsd/kern/kern_debug.c

/*
 * Copyright (c) 2020 Apple Inc. All rights reserved.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
 *
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. The rights granted to you under the License
 * may not be used to create, or enable the creation or redistribution of,
 * unlawful or unlicensed copies of an Apple operating system, or to
 * circumvent, violate, or enable the circumvention or violation of, any
 * terms of an Apple operating system software license agreement.
 *
 * Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this file.
 *
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 *
 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 */

#include <sys/sysctl.h>

#include <kern/cpu_data.h>

#if __arm64__
#include <arm/machine_routines.h>
#endif /* __arm64__ */

#if CONFIG_DEBUG_SYSCALL_REJECTION

#include <mach/mach_time.h>

#include <kern/bits.h>
#include <kern/clock.h>
#include <kern/exc_guard.h>
#include <kern/exception.h>
#include <kern/kalloc.h>
#include <kern/simple_lock.h>
#include <kern/startup.h>
#include <kern/syscall_sw.h>
#include <kern/task.h>

#include <pexpert/pexpert.h>

#include <sys/syscall.h>
#include <sys/sysent.h>
#include <sys/systm.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/variant_internal.h>
#include <sys/reason.h>

#include <sys/kern_debug.h>

#define SYSCALL_REJECTION_MODE_IGNORE   0
#define SYSCALL_REJECTION_MODE_GUARD    1
#define SYSCALL_REJECTION_MODE_CRASH    2

TUNABLE_WRITEABLE(int, debug_syscall_rejection_mode, "syscall_rejection_mode",
#if DEVELOPMENT || DEBUG
    SYSCALL_REJECTION_MODE_GUARD
#else
    SYSCALL_REJECTION_MODE_IGNORE
#endif
    );

static int
sysctl_debug_syscall_rejection_mode(struct sysctl_oid __unused *oidp, void * __unused arg1, int __unused arg2,
    struct sysctl_req *req)
{
	int error, changed;
	int value = *(int *) arg1;

	if (!os_variant_has_internal_diagnostics("com.apple.xnu")) {
		return ENOTSUP;
	}

	error = sysctl_io_number(req, value, sizeof(value), &value, &changed);
	if (!error && changed) {
		debug_syscall_rejection_mode = value;
	}
	return error;
}

void
reset_debug_syscall_rejection_mode(void)
{
	if (!os_variant_has_internal_diagnostics("com.apple.xnu")) {
		debug_syscall_rejection_mode = 0;
	}
}

SYSCTL_PROC(_kern, OID_AUTO, debug_syscall_rejection_mode, CTLFLAG_RW | CTLFLAG_LOCKED,
    &debug_syscall_rejection_mode, 0, sysctl_debug_syscall_rejection_mode, "I", "0: ignore, 1: non-fatal, 2: crash");


static size_t const predefined_masks = 2; // 0: null mask (all 0), 1: all mask (all 1)

/*
 * The number of masks is derived from the mask selector width:
 *
 * A selector is just made of an index into syscall_rejection_masks,
 * with the exception of the highest bit, which indicates whether the
 * mask is to be added as an "allow" mask or a "deny" mask.
 * Additionally, predefined masks don't actually have storage and are
 * handled specially, so syscall_rejection_masks starts with the first
 * non-predefined mask (and is sized appropriately).
 */
static size_t const syscall_rejection_mask_count = SYSCALL_REJECTION_SELECTOR_MASK_COUNT - predefined_masks;
static syscall_rejection_mask_t syscall_rejection_masks[syscall_rejection_mask_count];

#define SR_MASK_SIZE (BITMAP_SIZE(mach_trap_count + nsysent))

static LCK_GRP_DECLARE(syscall_rejection_lck_grp, "syscall rejection lock");
static LCK_MTX_DECLARE(syscall_rejection_mtx, &syscall_rejection_lck_grp);

bool
debug_syscall_rejection_handle(int syscall_mach_trap_number)
{
	uthread_t ut = current_uthread();
	uint64_t const flags = ut->syscall_rejection_flags;
	bool fatal = (bool)(flags & SYSCALL_REJECTION_FLAGS_FORCE_FATAL);

	switch (debug_syscall_rejection_mode) {
	case SYSCALL_REJECTION_MODE_IGNORE:
		if (!fatal) {
			/* ignore */
			break;
		}
		OS_FALLTHROUGH;
	case SYSCALL_REJECTION_MODE_CRASH:
		fatal = true;
		OS_FALLTHROUGH;
	case SYSCALL_REJECTION_MODE_GUARD: {
		if (flags & SYSCALL_REJECTION_FLAGS_ONCE) {
			int const number = syscall_mach_trap_number < 0 ? -syscall_mach_trap_number : (mach_trap_count + syscall_mach_trap_number);

			// don't trip on this system call again
			bitmap_set(ut->syscall_rejection_mask, number);
			bitmap_set(ut->syscall_rejection_once_mask, number);
		}

		mach_exception_code_t code = 0;
		EXC_GUARD_ENCODE_TYPE(code, GUARD_TYPE_REJECTED_SC);
		EXC_GUARD_ENCODE_FLAVOR(code, 0);
		EXC_GUARD_ENCODE_TARGET(code, syscall_mach_trap_number < 0);
		mach_exception_subcode_t subcode =
		    syscall_mach_trap_number < 0 ? -syscall_mach_trap_number : syscall_mach_trap_number;

		if (!fatal) {
			task_violated_guard(code, subcode, NULL, TRUE);
		} else {
			thread_guard_violation(current_thread(), code, subcode, fatal);
		}
		break;
	};
	default:
		/* ignore */
		;
	}
	return fatal;
}

void
rejected_syscall_guard_ast(
	thread_t t,
	mach_exception_data_type_t code,
	mach_exception_data_type_t subcode)
{
	const bool fatal = true;
	/*
	 * Check if anyone has registered for Synchronous EXC_GUARD, if yes then,
	 * deliver it synchronously and then kill the process, else kill the process
	 * and deliver the exception via EXC_CORPSE_NOTIFY. Always kill the process if we are not in dev mode.
	 */

	int flags = PX_DEBUG_NO_HONOR;
	exception_info_t info = {
		.os_reason = OS_REASON_GUARD,
		.exception_type = EXC_GUARD,
		.mx_code = code,
		.mx_subcode = subcode,
	};

	if (task_exception_notify(EXC_GUARD, code, subcode, fatal) == KERN_SUCCESS) {
		psignal_uthread(t, SIGSYS);
	} else {
		exit_with_mach_exception(current_proc(), info, flags);
	}
}


static void
_syscall_rejection_apply_mask(syscall_rejection_mask_t dest, const syscall_rejection_mask_t src, bool apply_as_allow)
{
	assert(dest != NULL);
	assert(src != NULL);

	if (apply_as_allow) {
		bitmap_or(dest, dest, src, mach_trap_count + nsysent);
	} else {
		bitmap_and_not(dest, dest, src, mach_trap_count + nsysent);
	}
}

/*
 * The masks to apply are passed to the kernel as packed selectors,
 * which are just however many of the selector data type fit into one
 * (or more) fields of the natural word size (i.e. a register). This
 * avoids copying from user space.
 *
 * More specifically, at the time of this writing, a selector is 7
 * bits wide, and there are two uint64_t arguments
 * (args->packed_selectors<n>), so up to 18 selectors can be
 * specified, which are then stuffed into the 128 bits of the
 * arguments. If less than 18 masks are requested to be applied, the
 * remaining selectors will just be left as 0, which naturally
 * resolves as the "empty" or "NULL" mask that changes nothing.
 *
 * The libsyscall wrapper provides a more convenient interface where
 * an array (up to 18 elements long) and its length are passed in,
 * which the wrapper then packs into packed_selectors of the actual
 * system call.
 */

int
sys_debug_syscall_reject_config(struct proc *p __unused, struct debug_syscall_reject_config_args *args, int *retval)
{
	int error = 0;

	*retval = 0;

	uthread_t ut = current_uthread();

	bitmap_t mask[SR_MASK_SIZE / sizeof(bitmap_t)];
	// syscall rejection masks are always reset to "deny all"
	memset(mask, 0, SR_MASK_SIZE);

	lck_mtx_lock(&syscall_rejection_mtx);

	for (int i = 0;
	    i + SYSCALL_REJECTION_SELECTOR_BITS < (sizeof(args->packed_selectors1) + sizeof(args->packed_selectors2)) * 8;
	    i += SYSCALL_REJECTION_SELECTOR_BITS) {
#define s_left_shift(x, n) ((n) < 0 ? ((x) >> -(n)) : ((x) << (n)))

		syscall_rejection_selector_t const selector = (syscall_rejection_selector_t)
		    (((i < 64 ? (args->packed_selectors1 >> i) : 0) |
		    (i > 64 - SYSCALL_REJECTION_SELECTOR_BITS ? s_left_shift(args->packed_selectors2, 64 - i) : 0)) & SYSCALL_REJECTION_SELECTOR_MASK);
		bool const is_allow_mask = selector & SYSCALL_REJECTION_IS_ALLOW_MASK;
		int const mask_index = selector & SYSCALL_REJECTION_INDEX_MASK;

		if (mask_index == SYSCALL_REJECTION_NULL) {
			// mask 0 is always empty (nothing to apply)
			continue;
		}

		if (mask_index == SYSCALL_REJECTION_ALL) {
			// mask 1 is always full (overrides everything)
			memset(mask, is_allow_mask ? 0xff : 0x00, SR_MASK_SIZE);
			continue;
		}

		syscall_rejection_mask_t mask_to_apply = syscall_rejection_masks[mask_index - predefined_masks];

		if (mask_to_apply == NULL) {
			error = ENOENT;
			goto out_locked;
		}

		_syscall_rejection_apply_mask(mask, mask_to_apply, is_allow_mask);
	}

	/* Not RT-safe, but only necessary once. */
	if (ut->syscall_rejection_mask == NULL) {
		ut->syscall_rejection_mask = kalloc_data(SR_MASK_SIZE, Z_WAITOK);

		if (ut->syscall_rejection_mask == NULL) {
			error = ENOMEM;
			goto out_locked;
		}
	}

	memcpy(ut->syscall_rejection_mask, mask, SR_MASK_SIZE);

	if ((args->flags & SYSCALL_REJECTION_FLAGS_ONCE)) {
		if (ut->syscall_rejection_once_mask == NULL) {
			ut->syscall_rejection_once_mask = kalloc_data(SR_MASK_SIZE, Z_WAITOK);

			if (ut->syscall_rejection_once_mask == NULL) {
				kfree_data(ut->syscall_rejection_mask, SR_MASK_SIZE);
				ut->syscall_rejection_mask = NULL;
				error = ENOMEM;
				goto out_locked;
			}

			memset(ut->syscall_rejection_once_mask, 0, SR_MASK_SIZE);
		} else {
			// prevent the already hit syscalls from hitting again.
			bitmap_or(ut->syscall_rejection_mask, ut->syscall_rejection_mask, ut->syscall_rejection_once_mask, mach_trap_count + nsysent);
		}
	}

out_locked:
	lck_mtx_unlock(&syscall_rejection_mtx);

	if (error == 0) {
		ut->syscall_rejection_flags = args->flags;
	}

	if (error == ENOENT && debug_syscall_rejection_mode == SYSCALL_REJECTION_MODE_IGNORE) {
		/* Existing code may rely on the system call failing
		 * gracefully if syscall rejection is currently off. */
		error = 0;
	}

	return error;
}

/*
 * debug_syscall_reject
 *
 * Compatibility interface to the old form of the system call.
 */
int
debug_syscall_reject(struct proc *p, struct debug_syscall_reject_args *args, int *retval)
{
	struct debug_syscall_reject_config_args new_args;

	bzero(&new_args, sizeof(new_args));
	new_args.packed_selectors1 = args->packed_selectors;
	// packed_selectors2 left empty
	new_args.flags = SYSCALL_REJECTION_FLAGS_DEFAULT;

	return sys_debug_syscall_reject_config(p, &new_args, retval);
}


static bool
_syscall_rejection_add(syscall_rejection_mask_t dst, char const *name)
{
	/*
	 * Yes, this function is O(n+m), making the whole act of setting a
	 * mask O(l*(n+m)), but defining masks is done rarely enough (and
	 * i, n and m small enough) for this to not matter.
	 */

	for (int i = 0; i < mach_trap_count; i++) {
		if (strcmp(mach_syscall_name_table[i], name) == 0) {
			bitmap_set(dst, i);
			return true;
		}
	}

	extern char const *syscallnames[];

	for (int i = 0; i < nsysent; i++) {
		if (strcmp(syscallnames[i], name) == 0) {
			bitmap_set(dst, i + mach_trap_count);
			return true;
		}
	}

	printf("%s: trying to add non-existing syscall/mach trap '%s'\n", __func__, name);
	return false;
}

/* Pretty much arbitrary, we just don't want userspace to pass
 * unreasonably large buffers to parse. */
static size_t const max_input_size = 16 * PAGE_MAX_SIZE;

static int
_sysctl_debug_syscall_rejection_masks(struct sysctl_oid __unused *oidp, void * __unused arg1, int __unused arg2,
    struct sysctl_req *req)
{
	size_t const max_name_len = 128;
	char name[max_name_len];

	if (req->newptr == 0) {
		return 0;
	}

	if (req->newlen > max_input_size) {
		return E2BIG;
	}

	size_t const len = req->newlen;
	char *buf = kalloc_data(len + 1, Z_WAITOK);

	if (buf == NULL) {
		return ENOMEM;
	}

	/*
	 * sysctl_io_string always copies out the given buffer as the
	 * "old" value if requested.  We could construct a text
	 * representation of existing masks, but this is not particularly
	 * interesting, so we just return the dummy string "<masks>".
	 */
	strlcpy(buf, "<masks>", len + 1);
	int changed = 0;
	int error = sysctl_io_string(req, buf, len + 1, 0, &changed);

	if (error != 0 || !changed) {
		goto out;
	}

	char const *p = buf;

	int id = 0;
	int l = 0;
	int n = sscanf(p, "%i: %n", &id, &l);

	if (n != 1 || id < predefined_masks || id > syscall_rejection_mask_count + predefined_masks) {
		printf("%s: invalid mask id %i (or conversion failed)\n", __FUNCTION__, id);
		error = EINVAL;
		goto out;
	}

	p += l;

	syscall_rejection_mask_t new_mask = kalloc_data(SR_MASK_SIZE,
	    Z_WAITOK | Z_ZERO);
	if (new_mask == NULL) {
		printf("%s: allocating new mask for id %i failed\n", __FUNCTION__, id);
		error = ENOMEM;
		goto out;
	}

	error = 0;

	while (p < buf + len && *p != 0) {
		name[0] = 0;
		n = sscanf(p, "%127s %n", name, &l);
		if (n != 1 || name[0] == 0) {
			error = EINVAL;
			kfree_data(new_mask, SR_MASK_SIZE);
			goto out;
		}

		if (!_syscall_rejection_add(new_mask, name)) {
			error = ENOENT;
			kfree_data(new_mask, SR_MASK_SIZE);
			goto out;
		}

		p += l;
	}


	syscall_rejection_mask_t to_free = NULL;

	lck_mtx_lock(&syscall_rejection_mtx);

	syscall_rejection_mask_t *target_mask = &syscall_rejection_masks[id - predefined_masks];

	to_free = *target_mask;
	*target_mask = new_mask;

	lck_mtx_unlock(&syscall_rejection_mtx);

	kfree_data(to_free, SR_MASK_SIZE);
out:

	kfree_data(buf, len + 1);
	return error;
}

SYSCTL_PROC(_kern, OID_AUTO, syscall_rejection_masks, CTLTYPE_STRING | CTLFLAG_WR | CTLFLAG_MASKED | CTLFLAG_LOCKED,
    0, 0, _sysctl_debug_syscall_rejection_masks, "A", "system call rejection masks");

#else /* CONFIG_DEBUG_SYSCALL_REJECTION */

#include <sys/kern_debug.h>

int
sys_debug_syscall_reject_config(struct proc * __unused p, struct debug_syscall_reject_config_args * __unused args, int __unused *ret)
{
	/* not supported. */
	return ENOTSUP;
}

int
debug_syscall_reject(struct proc * __unused p, struct debug_syscall_reject_args * __unused args, int * __unused retval)
{
	/* not supported. */
	return ENOTSUP;
}

void
reset_debug_syscall_rejection_mode(void)
{
	/* not supported. */
}

#endif /* CONFIG_DEBUG_SYSCALL_REJECTION */

#if __arm64__ && (DEBUG || DEVELOPMENT)

static void
_spinfor(uint64_t nanoseconds)
{
	uint64_t mt = 0;
	nanoseconds_to_absolutetime(nanoseconds, &mt);

	uint64_t start = mach_absolute_time();

	while (mach_absolute_time() < start + mt) {
		// Spinning.
	}
}

static int
_sysctl_debug_disable_interrupts_test(struct sysctl_oid __unused *oidp, void * __unused arg1, int __unused arg2,
    struct sysctl_req *req)
{
	int error = 0;

	if (req->newptr == 0) {
		goto out;
	}

	uint64_t val = 0;
	error = sysctl_io_number(req, 0, sizeof(val), &val, NULL);

	if (error != 0 || val == 0) {
		goto out;
	}

	boolean_t istate = ml_set_interrupts_enabled(false);
	_spinfor(val);
	ml_set_interrupts_enabled(istate);

out:
	return error;
}

static int
_sysctl_debug_disable_preemption_test(struct sysctl_oid __unused *oidp, void * __unused arg1, int __unused arg2,
    struct sysctl_req *req)
{
	int error = 0;

	if (req->newptr == 0) {
		goto out;
	}

	uint64_t val = 0;
	error = sysctl_io_number(req, 0, sizeof(val), &val, NULL);

	if (error != 0 || val == 0) {
		goto out;
	}

	disable_preemption();
	_spinfor(val);
	enable_preemption();

out:
	return error;
}

SYSCTL_PROC(_kern, OID_AUTO, debug_disable_interrupts_test, CTLTYPE_QUAD | CTLFLAG_WR | CTLFLAG_MASKED | CTLFLAG_LOCKED,
    0, 0, _sysctl_debug_disable_interrupts_test, "Q", "disable interrupts for specified number of nanoseconds, for testing");

SYSCTL_PROC(_kern, OID_AUTO, debug_disable_preemption_test, CTLTYPE_QUAD | CTLFLAG_WR | CTLFLAG_MASKED | CTLFLAG_LOCKED,
    0, 0, _sysctl_debug_disable_preemption_test, "Q", "disable preemption for specified number of nanoseconds, for testing");

#endif /* __arm64__ && (DEBUG || DEVELOPMENT) */