⬢ DragonFlyBSD Kernel Audit
DF-5611 / run5611.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5611 driver: boot the real vkernel and fire real process-directed
# SIGXCPU at it.  The siglog.so shim only OBSERVES (which thread, which
# %gs base); the trigger is `kill -XCPU` from this script.
#
# $1 = label (control | fault | fixed...)   -> log /root/vk5611.$1.log
# mode: control = no kills; anything else = 40 x kill -XCPU @150ms

LABEL=$1
MODE=${2:-fault}
VK=/usr/obj/usr/src/sys/VKERNEL64/kernel.debug
LOG=/root/vk5611.$LABEL.log

pkill -9 -f kernel.debug 2>/dev/null; sleep 1
rm -f /tmp/vkin /tmp/vk5611.boot.$LABEL
mkfifo /tmp/vkin
(sleep 600 > /tmp/vkin) &
HOLDER=$!
(
  exec 3> /tmp/vkin
  echo "ufs:vkd0" >&3
) &
PUMP=$!

ulimit -c unlimited
cd /root
rm -f /root/kernel.debug.core /root/vk.pid
env LD_PRELOAD=/root/siglog.so $VK -m 512m -r /vkroot.img -n 2 \
    -e init_path=/bin/vkinit -p /root/vk.pid \
    -s < /tmp/vkin > /tmp/vk5611.boot.$LABEL 2>&1 &
TOPPID=$!
# main() forks a watchdog parent (init.c:204); the REAL kernel is the child
# and publishes its own pid via -p (writepid, init.c:1383-1404).
i=0
while [ $i -lt 30 ]; do
  [ -s /root/vk.pid ] && break
  kill -0 $TOPPID 2>/dev/null || break
  sleep 1
  i=$((i+1))
done
VKPID=$(cat /root/vk.pid 2>/dev/null || echo $TOPPID)
echo "MODE=$MODE LABEL=$LABEL toppid=$TOPPID vkernel_pid=$VKPID" | tee $LOG

# watch for death or boot completion
i=0
while [ $i -lt 150 ]; do
  grep -q "Mounting root from ufs:vkd0" /tmp/vk5611.boot.$LABEL 2>/dev/null && break
  kill -0 $VKPID 2>/dev/null || break
  sleep 1
  i=$((i+1))
done
BOOTED=$(grep -c "Mounting root from ufs:vkd0" /tmp/vk5611.boot.$LABEL 2>/dev/null)
echo "BOOTED=$BOOTED (after ${i}s)" | tee -a $LOG

# let the system settle: cothreads (vktimer, vkd) are all live now
sleep 8

RESULT=ALIVE
ITER=0
if [ "$MODE" != control ]; then
  n=1
  while [ $n -le 40 ]; do
    kill -XCPU $VKPID 2>/dev/null || { RESULT=DEAD_SEND_FAIL; ITER=$n; break; }
    sleep 0.15
    if ! kill -0 $VKPID 2>/dev/null; then RESULT=DEAD; ITER=$n; break; fi
    n=$((n+1))
  done
  [ "$RESULT" = ALIVE ] && ITER=$((n-1))
fi

if [ "$RESULT" = ALIVE ]; then
  kill -9 $VKPID 2>/dev/null
  wait $VKPID 2>/dev/null
  echo "RESULT: ALIVE after $ITER SIGXCPU sends (killed at end)" | tee -a $LOG
else
  wait $VKPID 2>/dev/null; WRC=$?
  echo "RESULT: $RESULT at iteration $ITER wait_status=$WRC" | tee -a $LOG
fi

echo "=== SIGLOG lines (boot console) ===" | tee -a $LOG
grep -a "SIGLOG" /tmp/vk5611.boot.$LABEL | tee -a $LOG
echo "=== markers ===" | tee -a $LOG
grep -an "Mounting root\|panic\|Fatal trap\|exc_segfault\|recursive" \
    /tmp/vk5611.boot.$LABEL | head -20 | tee -a $LOG
echo "=== console tail ===" | tee -a $LOG
tail -12 /tmp/vk5611.boot.$LABEL | tee -a $LOG
ls -la /root/kernel.debug.core 2>/dev/null | tee -a $LOG

kill $HOLDER 2>/dev/null
kill -9 $TOPPID 2>/dev/null
pkill -9 -f kernel.debug 2>/dev/null
rm -f /root/vk.pid
exit 0