xref: /xnu-10063.141.1/osfmk/kern/exception.c (revision d8b80295118ef25ac3a784134bcf95cd8e88109f)
1 /*
2  * Copyright (c) 2000-2024 Apple Computer, Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 /*
29  * @OSF_COPYRIGHT@
30  */
31 /*
32  * Mach Operating System
33  * Copyright (c) 1991,1990,1989,1988,1987 Carnegie Mellon University
34  * All Rights Reserved.
35  *
36  * Permission to use, copy, modify and distribute this software and its
37  * documentation is hereby granted, provided that both the copyright
38  * notice and this permission notice appear in all copies of the
39  * software, derivative works or modified versions, and any portions
40  * thereof, and that both notices appear in supporting documentation.
41  *
42  * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS "AS IS"
43  * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
44  * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
45  *
46  * Carnegie Mellon requests users of this software to return to
47  *
48  *  Software Distribution Coordinator  or  [email protected]
49  *  School of Computer Science
50  *  Carnegie Mellon University
51  *  Pittsburgh PA 15213-3890
52  *
53  * any improvements or extensions that they make and grant Carnegie Mellon
54  * the rights to redistribute these changes.
55  */
56 /*
57  */
58 
59 #include <mach/mach_types.h>
60 #include <mach/boolean.h>
61 #include <mach/kern_return.h>
62 #include <mach/message.h>
63 #include <mach/port.h>
64 #include <mach/mig_errors.h>
65 #include <mach/task.h>
66 #include <mach/thread_status.h>
67 #include <mach/exception_types.h>
68 #include <mach/exc.h>
69 #include <mach/mach_exc.h>
70 
71 #include <ipc/port.h>
72 #include <ipc/ipc_entry.h>
73 #include <ipc/ipc_object.h>
74 #include <ipc/ipc_notify.h>
75 #include <ipc/ipc_space.h>
76 #include <ipc/ipc_pset.h>
77 #include <ipc/ipc_machdep.h>
78 
79 #include <kern/ipc_tt.h>
80 #include <kern/task.h>
81 #include <kern/thread.h>
82 #include <kern/processor.h>
83 #include <kern/sched.h>
84 #include <kern/sched_prim.h>
85 #include <kern/host.h>
86 #include <kern/misc_protos.h>
87 #include <kern/ux_handler.h>
88 #include <kern/task_ident.h>
89 
90 #include <vm/vm_map.h>
91 
92 #include <security/mac_mach_internal.h>
93 #include <string.h>
94 
95 #include <pexpert/pexpert.h>
96 
97 #include <os/log.h>
98 #include <os/system_event_log.h>
99 
100 #include <libkern/coreanalytics/coreanalytics.h>
101 
102 #include <sys/code_signing.h> /* for developer mode state */
103 
104 bool panic_on_exception_triage = false;
105 
106 /* Not used in coded, only for inspection during debugging */
107 unsigned long c_thr_exc_raise = 0;
108 unsigned long c_thr_exc_raise_identity_token = 0;
109 unsigned long c_thr_exc_raise_state = 0;
110 unsigned long c_thr_exc_raise_state_id = 0;
111 unsigned long c_thr_exc_raise_backtrace = 0;
112 
113 /* forward declarations */
114 kern_return_t exception_deliver(
115 	thread_t                thread,
116 	exception_type_t        exception,
117 	mach_exception_data_t   code,
118 	mach_msg_type_number_t  codeCnt,
119 	struct exception_action *excp,
120 	lck_mtx_t                       *mutex);
121 
122 #ifdef MACH_BSD
123 kern_return_t bsd_exception(
124 	exception_type_t        exception,
125 	mach_exception_data_t   code,
126 	mach_msg_type_number_t  codeCnt);
127 #endif /* MACH_BSD */
128 
129 #if __has_feature(ptrauth_calls)
130 extern int exit_with_pac_exception(
131 	void *proc,
132 	exception_type_t         exception,
133 	mach_exception_code_t    code,
134 	mach_exception_subcode_t subcode);
135 #endif /* __has_feature(ptrauth_calls) */
136 
137 #ifdef MACH_BSD
138 extern bool proc_is_traced(void *p);
139 extern int      proc_selfpid(void);
140 extern char     *proc_name_address(struct proc *p);
141 #endif /* MACH_BSD */
142 
143 #if (DEVELOPMENT || DEBUG)
144 TUNABLE_WRITEABLE(unsigned int, exception_log_max_pid, "exception_log_max_pid", 0);
145 #endif /* (DEVELOPMENT || DEBUG) */
146 
147 /*
148  * Routine: exception_init
149  * Purpose:
150  *   Global initialization of state for exceptions.
151  * Conditions:
152  *   None.
153  */
154 void
exception_init(void)155 exception_init(void)
156 {
157 	int tmp = 0;
158 
159 	if (PE_parse_boot_argn("-panic_on_exception_triage", &tmp, sizeof(tmp))) {
160 		panic_on_exception_triage = true;
161 	}
162 
163 #if (DEVELOPMENT || DEBUG)
164 	if (exception_log_max_pid) {
165 		printf("Logging all exceptions where pid < exception_log_max_pid (%d)\n", exception_log_max_pid);
166 	}
167 #endif /* (DEVELOPMENT || DEBUG) */
168 }
169 
170 static TUNABLE(bool, pac_replace_ptrs_user, "pac_replace_ptrs_user", true);
171 
172 ipc_port_t
exception_port_copy_send(ipc_port_t port)173 exception_port_copy_send(ipc_port_t port)
174 {
175 	if (IP_VALID(port)) {
176 		if (is_ux_handler_port(port)) {
177 			/* is_ux_handler_port() compares against __DATA_CONST */
178 			port = ipc_port_copy_send_any(port);
179 		} else {
180 			port = ipc_port_copy_send_mqueue(port);
181 		}
182 	}
183 	return port;
184 }
185 
186 /*
187  *	Routine:	exception_deliver
188  *	Purpose:
189  *		Make an upcall to the exception server provided.
190  *	Conditions:
191  *		Nothing locked and no resources held.
192  *		Called from an exception context, so
193  *		thread_exception_return and thread_kdb_return
194  *		are possible.
195  *	Returns:
196  *		KERN_SUCCESS if the exception was handled
197  */
198 kern_return_t
exception_deliver(thread_t thread,exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t codeCnt,struct exception_action * excp,lck_mtx_t * mutex)199 exception_deliver(
200 	thread_t                thread,
201 	exception_type_t        exception,
202 	mach_exception_data_t   code,
203 	mach_msg_type_number_t  codeCnt,
204 	struct exception_action *excp,
205 	lck_mtx_t               *mutex)
206 {
207 	ipc_port_t              exc_port = IPC_PORT_NULL;
208 	exception_data_type_t   small_code[EXCEPTION_CODE_MAX];
209 	thread_state_t          new_state = NULL;
210 	int                     code64;
211 	int                     behavior;
212 	int                     flavor;
213 	kern_return_t           kr;
214 	task_t task;
215 	task_id_token_t task_token;
216 	ipc_port_t thread_port = IPC_PORT_NULL,
217 	    task_port = IPC_PORT_NULL,
218 	    task_token_port = IPC_PORT_NULL;
219 
220 	/*
221 	 *  Save work if we are terminating.
222 	 *  Just go back to our AST handler.
223 	 */
224 	if (!thread->active && !thread->inspection) {
225 		return KERN_SUCCESS;
226 	}
227 
228 	/*
229 	 * If there are no exception actions defined for this entity,
230 	 * we can't deliver here.
231 	 */
232 	if (excp == NULL) {
233 		return KERN_FAILURE;
234 	}
235 
236 	assert(exception < EXC_TYPES_COUNT);
237 	if (exception >= EXC_TYPES_COUNT) {
238 		return KERN_FAILURE;
239 	}
240 
241 	excp = &excp[exception];
242 
243 	/*
244 	 * Snapshot the exception action data under lock for consistency.
245 	 * Hold a reference to the port over the exception_raise_* calls
246 	 * so it can't be destroyed.  This seems like overkill, but keeps
247 	 * the port from disappearing between now and when
248 	 * ipc_object_copyin_from_kernel is finally called.
249 	 */
250 	lck_mtx_lock(mutex);
251 	exc_port = exception_port_copy_send(excp->port);
252 	if (!IP_VALID(exc_port)) {
253 		lck_mtx_unlock(mutex);
254 		return KERN_FAILURE;
255 	}
256 
257 	flavor = excp->flavor;
258 	behavior = excp->behavior;
259 	lck_mtx_unlock(mutex);
260 
261 	code64 = (behavior & MACH_EXCEPTION_CODES);
262 	behavior &= ~MACH_EXCEPTION_MASK;
263 
264 	if (!code64) {
265 		small_code[0] = CAST_DOWN_EXPLICIT(exception_data_type_t, code[0]);
266 		small_code[1] = CAST_DOWN_EXPLICIT(exception_data_type_t, code[1]);
267 	}
268 
269 	task = get_threadtask(thread);
270 
271 #if CONFIG_MACF
272 	/* Now is a reasonably good time to check if the exception action is
273 	 * permitted for this process, because after this point we will send
274 	 * the message out almost certainly.
275 	 * As with other failures, exception_triage_thread will go on
276 	 * to the next level.
277 	 */
278 
279 	/* The global exception-to-signal translation port is safe to be an exception handler. */
280 	if (is_ux_handler_port(exc_port) == FALSE &&
281 	    mac_exc_action_check_exception_send(task, excp) != 0) {
282 		kr = KERN_FAILURE;
283 		goto out_release_right;
284 	}
285 #endif
286 
287 	thread->options |= TH_IN_MACH_EXCEPTION;
288 
289 	switch (behavior) {
290 	case EXCEPTION_STATE: {
291 		mach_msg_type_number_t old_state_cnt, new_state_cnt;
292 		thread_state_data_t old_state;
293 		thread_set_status_flags_t get_flags = TSSF_TRANSLATE_TO_USER;
294 		thread_set_status_flags_t set_flags = TSSF_CHECK_USER_FLAGS;
295 		bool task_allow_user_state = task_needs_user_signed_thread_state(task);
296 
297 		if (pac_replace_ptrs_user || task_allow_user_state) {
298 			get_flags |= TSSF_RANDOM_USER_DIV;
299 			set_flags |= (TSSF_ALLOW_ONLY_USER_PTRS | TSSF_RANDOM_USER_DIV);
300 		}
301 
302 		c_thr_exc_raise_state++;
303 		assert(flavor < THREAD_STATE_FLAVORS);
304 		old_state_cnt = (flavor < THREAD_STATE_FLAVORS) ? _MachineStateCount[flavor] : 0;
305 		kr = thread_getstatus_to_user(thread, flavor,
306 		    (thread_state_t)old_state,
307 		    &old_state_cnt, get_flags);
308 		new_state_cnt = old_state_cnt;
309 		if (kr == KERN_SUCCESS) {
310 			new_state = (thread_state_t)kalloc_data(sizeof(thread_state_data_t), Z_WAITOK | Z_ZERO);
311 			if (new_state == NULL) {
312 				kr = KERN_RESOURCE_SHORTAGE;
313 				goto out_release_right;
314 			}
315 			if (code64) {
316 				kr = mach_exception_raise_state(exc_port,
317 				    exception,
318 				    code,
319 				    codeCnt,
320 				    &flavor,
321 				    old_state, old_state_cnt,
322 				    new_state, &new_state_cnt);
323 			} else {
324 				kr = exception_raise_state(exc_port, exception,
325 				    small_code,
326 				    codeCnt,
327 				    &flavor,
328 				    old_state, old_state_cnt,
329 				    new_state, &new_state_cnt);
330 			}
331 			if (kr == KERN_SUCCESS) {
332 				if (exception != EXC_CORPSE_NOTIFY) {
333 					kr = thread_setstatus_from_user(thread, flavor,
334 					    (thread_state_t)new_state, new_state_cnt,
335 					    (thread_state_t)old_state, old_state_cnt,
336 					    set_flags);
337 				}
338 				goto out_release_right;
339 			}
340 		}
341 
342 		goto out_release_right;
343 	}
344 
345 	case EXCEPTION_DEFAULT: {
346 		c_thr_exc_raise++;
347 
348 		task_reference(task);
349 		thread_reference(thread);
350 		/*
351 		 * Only deliver control port if Developer Mode enabled,
352 		 * or task is a corpse. Otherwise we only deliver the
353 		 * (immovable) read port in exception handler (both in
354 		 * or out of process). (94669540)
355 		 */
356 		if (developer_mode_state() || task_is_a_corpse(task)) {
357 			task_port = convert_task_to_port(task);
358 			thread_port = convert_thread_to_port(thread);
359 		} else {
360 			task_port = convert_task_read_to_port(task);
361 			thread_port = convert_thread_read_to_port(thread);
362 		}
363 		/* task and thread ref consumed */
364 
365 		if (code64) {
366 			kr = mach_exception_raise(exc_port,
367 			    thread_port,
368 			    task_port,
369 			    exception,
370 			    code,
371 			    codeCnt);
372 		} else {
373 			kr = exception_raise(exc_port,
374 			    thread_port,
375 			    task_port,
376 			    exception,
377 			    small_code,
378 			    codeCnt);
379 		}
380 
381 		goto out_release_right;
382 	}
383 
384 	case EXCEPTION_IDENTITY_PROTECTED: {
385 		c_thr_exc_raise_identity_token++;
386 
387 		kr = task_create_identity_token(task, &task_token);
388 		if (!task->active && kr == KERN_INVALID_ARGUMENT) {
389 			/* The task is terminating, don't need to send more exceptions */
390 			kr = KERN_SUCCESS;
391 			goto out_release_right;
392 		}
393 		/* task_token now represents a task, or corpse */
394 		assert(kr == KERN_SUCCESS);
395 		task_token_port = convert_task_id_token_to_port(task_token);
396 		/* task token ref consumed */
397 
398 		if (code64) {
399 			kr = mach_exception_raise_identity_protected(exc_port,
400 			    thread->thread_id,
401 			    task_token_port,
402 			    exception,
403 			    code,
404 			    codeCnt);
405 		} else {
406 			panic("mach_exception_raise_identity_protected() must be code64");
407 		}
408 
409 		goto out_release_right;
410 	}
411 
412 	case EXCEPTION_STATE_IDENTITY: {
413 		mach_msg_type_number_t old_state_cnt, new_state_cnt;
414 		thread_state_data_t old_state;
415 		thread_set_status_flags_t get_flags = TSSF_TRANSLATE_TO_USER;
416 		thread_set_status_flags_t set_flags = TSSF_CHECK_USER_FLAGS;
417 		bool task_allow_user_state = task_needs_user_signed_thread_state(task);
418 
419 		if (pac_replace_ptrs_user || task_allow_user_state) {
420 			get_flags |= TSSF_RANDOM_USER_DIV;
421 			set_flags |= (TSSF_ALLOW_ONLY_USER_PTRS | TSSF_RANDOM_USER_DIV);
422 		}
423 
424 		c_thr_exc_raise_state_id++;
425 
426 		task_reference(task);
427 		thread_reference(thread);
428 		/*
429 		 * Only deliver control port if Developer Mode enabled,
430 		 * or task is a corpse. Otherwise we only deliver the
431 		 * (immovable) read port in exception handler (both in
432 		 * or out of process). (94669540)
433 		 */
434 		if (developer_mode_state() || task_is_a_corpse(task)) {
435 			task_port = convert_task_to_port(task);
436 			thread_port = convert_thread_to_port(thread);
437 		} else {
438 			task_port = convert_task_read_to_port(task);
439 			thread_port = convert_thread_read_to_port(thread);
440 		}
441 		/* task and thread ref consumed */
442 
443 		assert(flavor < THREAD_STATE_FLAVORS);
444 		old_state_cnt = (flavor < THREAD_STATE_FLAVORS) ? _MachineStateCount[flavor] : 0;
445 		kr = thread_getstatus_to_user(thread, flavor,
446 		    (thread_state_t)old_state,
447 		    &old_state_cnt, get_flags);
448 		new_state_cnt = old_state_cnt;
449 		if (kr == KERN_SUCCESS) {
450 			new_state = (thread_state_t)kalloc_data(sizeof(thread_state_data_t), Z_WAITOK | Z_ZERO);
451 			if (new_state == NULL) {
452 				kr = KERN_RESOURCE_SHORTAGE;
453 				goto out_release_right;
454 			}
455 			if (code64) {
456 				kr = mach_exception_raise_state_identity(
457 					exc_port,
458 					thread_port,
459 					task_port,
460 					exception,
461 					code,
462 					codeCnt,
463 					&flavor,
464 					old_state, old_state_cnt,
465 					new_state, &new_state_cnt);
466 			} else {
467 				kr = exception_raise_state_identity(exc_port,
468 				    thread_port,
469 				    task_port,
470 				    exception,
471 				    small_code,
472 				    codeCnt,
473 				    &flavor,
474 				    old_state, old_state_cnt,
475 				    new_state, &new_state_cnt);
476 			}
477 
478 			if (kr == KERN_SUCCESS) {
479 				if (exception != EXC_CORPSE_NOTIFY &&
480 				    ip_kotype(thread_port) == IKOT_THREAD_CONTROL) {
481 					kr = thread_setstatus_from_user(thread, flavor,
482 					    (thread_state_t)new_state, new_state_cnt,
483 					    (thread_state_t)old_state, old_state_cnt, set_flags);
484 				}
485 				goto out_release_right;
486 			}
487 		}
488 
489 		goto out_release_right;
490 	}
491 
492 	default:
493 		panic("bad exception behavior!");
494 		return KERN_FAILURE;
495 	}/* switch */
496 
497 out_release_right:
498 
499 	thread->options &= ~TH_IN_MACH_EXCEPTION;
500 
501 	if (task_port) {
502 		ipc_port_release_send(task_port);
503 	}
504 
505 	if (thread_port) {
506 		ipc_port_release_send(thread_port);
507 	}
508 
509 	if (exc_port) {
510 		ipc_port_release_send(exc_port);
511 	}
512 
513 	if (task_token_port) {
514 		ipc_port_release_send(task_token_port);
515 	}
516 
517 	if (new_state) {
518 		kfree_data(new_state, sizeof(thread_state_data_t));
519 	}
520 
521 	return kr;
522 }
523 
524 /*
525  * Attempt exception delivery with backtrace info to exception ports
526  * in exc_ports in order.
527  */
528 /*
529  *	Routine:	exception_deliver_backtrace
530  *	Purpose:
531  *      Attempt exception delivery with backtrace info to exception ports
532  *      in exc_ports in order.
533  *	Conditions:
534  *		Caller has a reference on bt_object, and send rights on exc_ports.
535  *		Does not consume any passed references or rights
536  */
537 void
exception_deliver_backtrace(kcdata_object_t bt_object,ipc_port_t exc_ports[static BT_EXC_PORTS_COUNT],exception_type_t exception)538 exception_deliver_backtrace(
539 	kcdata_object_t  bt_object,
540 	ipc_port_t       exc_ports[static BT_EXC_PORTS_COUNT],
541 	exception_type_t exception)
542 {
543 	kern_return_t kr;
544 	mach_exception_data_type_t code[EXCEPTION_CODE_MAX];
545 	ipc_port_t target_port, bt_obj_port;
546 
547 	assert(exception == EXC_GUARD);
548 
549 	code[0] = exception;
550 	code[1] = 0;
551 
552 	kcdata_object_reference(bt_object);
553 	bt_obj_port = convert_kcdata_object_to_port(bt_object);
554 	/* backtrace object ref consumed, no-senders is armed */
555 
556 	if (!IP_VALID(bt_obj_port)) {
557 		return;
558 	}
559 
560 	/*
561 	 * We are guaranteed at task_enqueue_exception_with_corpse() time
562 	 * that the exception port prefers backtrace delivery.
563 	 */
564 	for (unsigned int i = 0; i < BT_EXC_PORTS_COUNT; i++) {
565 		target_port = exc_ports[i];
566 
567 		if (!IP_VALID(target_port)) {
568 			continue;
569 		}
570 
571 		ip_mq_lock(target_port);
572 		if (!ip_active(target_port)) {
573 			ip_mq_unlock(target_port);
574 			continue;
575 		}
576 		ip_mq_unlock(target_port);
577 
578 		kr = mach_exception_raise_backtrace(target_port,
579 		    bt_obj_port,
580 		    EXC_CORPSE_NOTIFY,
581 		    code,
582 		    EXCEPTION_CODE_MAX);
583 
584 		if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED) {
585 			/* Exception is handled at this level */
586 			break;
587 		}
588 	}
589 
590 	/* May trigger no-senders notification for backtrace object */
591 	ipc_port_release_send(bt_obj_port);
592 
593 	return;
594 }
595 
596 /*
597  * Routine: check_exc_receiver_dependency
598  * Purpose:
599  *      Verify that the port destined for receiving this exception is not
600  *      on the current task. This would cause hang in kernel for
601  *      EXC_CRASH primarily. Note: If port is transferred
602  *      between check and delivery then deadlock may happen.
603  *
604  * Conditions:
605  *		Nothing locked and no resources held.
606  *		Called from an exception context.
607  * Returns:
608  *      KERN_SUCCESS if its ok to send exception message.
609  */
610 static kern_return_t
check_exc_receiver_dependency(exception_type_t exception,struct exception_action * excp,lck_mtx_t * mutex)611 check_exc_receiver_dependency(
612 	exception_type_t exception,
613 	struct exception_action *excp,
614 	lck_mtx_t *mutex)
615 {
616 	kern_return_t retval = KERN_SUCCESS;
617 
618 	if (excp == NULL || exception != EXC_CRASH) {
619 		return retval;
620 	}
621 
622 	task_t task = current_task();
623 	lck_mtx_lock(mutex);
624 	ipc_port_t xport = excp[exception].port;
625 	if (IP_VALID(xport) && ip_in_space_noauth(xport, task->itk_space)) {
626 		retval = KERN_FAILURE;
627 	}
628 	lck_mtx_unlock(mutex);
629 	return retval;
630 }
631 
632 
633 /*
634  *	Routine:	exception_triage_thread
635  *	Purpose:
636  *		The thread caught an exception.
637  *		We make an up-call to the thread's exception server.
638  *	Conditions:
639  *		Nothing locked and no resources held.
640  *		Called from an exception context, so
641  *		thread_exception_return and thread_kdb_return
642  *		are possible.
643  *	Returns:
644  *		KERN_SUCCESS if exception is handled by any of the handlers.
645  */
646 kern_return_t
exception_triage_thread(exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t codeCnt,thread_t thread)647 exception_triage_thread(
648 	exception_type_t        exception,
649 	mach_exception_data_t   code,
650 	mach_msg_type_number_t  codeCnt,
651 	thread_t                thread)
652 {
653 	task_t                  task;
654 	thread_ro_t             tro;
655 	host_priv_t             host_priv;
656 	lck_mtx_t               *mutex;
657 	struct exception_action *actions;
658 	kern_return_t   kr = KERN_FAILURE;
659 
660 	assert(exception != EXC_RPC_ALERT);
661 
662 	/*
663 	 * If this behavior has been requested by the the kernel
664 	 * (due to the boot environment), we should panic if we
665 	 * enter this function.  This is intended as a debugging
666 	 * aid; it should allow us to debug why we caught an
667 	 * exception in environments where debugging is especially
668 	 * difficult.
669 	 */
670 	if (panic_on_exception_triage) {
671 		panic("called exception_triage when it was forbidden by the boot environment");
672 	}
673 
674 	/*
675 	 * Try to raise the exception at the activation level.
676 	 */
677 	mutex   = &thread->mutex;
678 	tro     = get_thread_ro(thread);
679 	actions = tro->tro_exc_actions;
680 	if (KERN_SUCCESS == check_exc_receiver_dependency(exception, actions, mutex)) {
681 		kr = exception_deliver(thread, exception, code, codeCnt, actions, mutex);
682 		if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED) {
683 			goto out;
684 		}
685 	}
686 
687 	/*
688 	 * Maybe the task level will handle it.
689 	 */
690 	task    = tro->tro_task;
691 	mutex   = &task->itk_lock_data;
692 	actions = task->exc_actions;
693 	if (KERN_SUCCESS == check_exc_receiver_dependency(exception, actions, mutex)) {
694 		kr = exception_deliver(thread, exception, code, codeCnt, actions, mutex);
695 		if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED) {
696 			goto out;
697 		}
698 	}
699 
700 	/*
701 	 * How about at the host level?
702 	 */
703 	host_priv = host_priv_self();
704 	mutex     = &host_priv->lock;
705 	actions   = host_priv->exc_actions;
706 	if (KERN_SUCCESS == check_exc_receiver_dependency(exception, actions, mutex)) {
707 		kr = exception_deliver(thread, exception, code, codeCnt, actions, mutex);
708 		if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED) {
709 			goto out;
710 		}
711 	}
712 
713 out:
714 	if ((exception != EXC_CRASH) && (exception != EXC_RESOURCE) &&
715 	    (exception != EXC_GUARD) && (exception != EXC_CORPSE_NOTIFY)) {
716 		thread_exception_return();
717 	}
718 	return kr;
719 }
720 
721 #if __has_feature(ptrauth_calls)
722 static TUNABLE(bool, pac_exception_telemetry, "-pac_exception_telemetry", false);
723 
724 CA_EVENT(pac_exception_event,
725     CA_INT, exception,
726     CA_INT, exception_code_0,
727     CA_INT, exception_code_1,
728     CA_STATIC_STRING(CA_PROCNAME_LEN), proc_name);
729 
730 static void
pac_exception_triage(exception_type_t exception,mach_exception_data_t code)731 pac_exception_triage(
732 	exception_type_t        exception,
733 	mach_exception_data_t   code)
734 {
735 	boolean_t traced_flag = FALSE;
736 	task_t task = current_task();
737 	void *proc = get_bsdtask_info(task);
738 	char *proc_name = (char *) "unknown";
739 	int pid = 0;
740 
741 #ifdef MACH_BSD
742 	pid = proc_selfpid();
743 	if (proc) {
744 		traced_flag = proc_is_traced(proc);
745 		/* Should only be called on current proc */
746 		proc_name = proc_name_address(proc);
747 
748 		/*
749 		 * For a ptrauth violation, check if process isn't being ptraced and
750 		 * the task has the TFRO_PAC_EXC_FATAL flag set. If both conditions are true,
751 		 * terminate the task via exit_with_reason
752 		 */
753 		if (!traced_flag) {
754 			if (pac_exception_telemetry) {
755 				ca_event_t ca_event = CA_EVENT_ALLOCATE(pac_exception_event);
756 				CA_EVENT_TYPE(pac_exception_event) * pexc_event = ca_event->data;
757 				pexc_event->exception = exception;
758 				pexc_event->exception_code_0 = code[0];
759 				pexc_event->exception_code_1 = code[1];
760 				strlcpy(pexc_event->proc_name, proc_name, CA_PROCNAME_LEN);
761 				CA_EVENT_SEND(ca_event);
762 			}
763 			if (task_is_pac_exception_fatal(task)) {
764 				os_log_error(OS_LOG_DEFAULT, "%s: process %s[%d] hit a pac violation\n", __func__, proc_name, pid);
765 				exit_with_pac_exception(proc, exception, code[0], code[1]);
766 				thread_exception_return();
767 				/* NOT_REACHABLE */
768 			}
769 		}
770 	}
771 #endif /* MACH_BSD */
772 }
773 #endif /* __has_feature(ptrauth_calls) */
774 
775 /*
776  *	Routine:	exception_triage
777  *	Purpose:
778  *		The current thread caught an exception.
779  *		We make an up-call to the thread's exception server.
780  *	Conditions:
781  *		Nothing locked and no resources held.
782  *		Called from an exception context, so
783  *		thread_exception_return and thread_kdb_return
784  *		are possible.
785  *	Returns:
786  *		KERN_SUCCESS if exception is handled by any of the handlers.
787  */
788 int debug4k_panic_on_exception = 0;
789 kern_return_t
exception_triage(exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t codeCnt)790 exception_triage(
791 	exception_type_t        exception,
792 	mach_exception_data_t   code,
793 	mach_msg_type_number_t  codeCnt)
794 {
795 	thread_t thread = current_thread();
796 	task_t   task   = current_task();
797 
798 	assert(codeCnt > 0);
799 
800 	if (VM_MAP_PAGE_SIZE(task->map) < PAGE_SIZE) {
801 		DEBUG4K_EXC("thread %p task %p map %p exception %d codes 0x%llx 0x%llx\n",
802 		    thread, task, task->map, exception, code[0], codeCnt > 1 ? code[1] : 0);
803 		if (debug4k_panic_on_exception) {
804 			panic("DEBUG4K thread %p task %p map %p exception %d codes 0x%llx 0x%llx",
805 			    thread, task, task->map, exception, code[0], codeCnt > 1 ? code[1] : 0);
806 		}
807 	}
808 
809 #if (DEVELOPMENT || DEBUG)
810 #ifdef MACH_BSD
811 	if (proc_pid(get_bsdtask_info(task)) <= exception_log_max_pid) {
812 		record_system_event(SYSTEM_EVENT_TYPE_INFO, SYSTEM_EVENT_SUBSYSTEM_PROCESS, "process exit",
813 		    "exception_log_max_pid: pid %d (%s): sending exception %d (0x%llx 0x%llx)",
814 		    proc_pid(get_bsdtask_info(task)), proc_name_address(get_bsdtask_info(task)),
815 		    exception, code[0], codeCnt > 1 ? code[1] : 0);
816 	}
817 #endif /* MACH_BSD */
818 #endif /* DEVELOPMENT || DEBUG */
819 
820 #if __has_feature(ptrauth_calls)
821 	if (exception & EXC_PTRAUTH_BIT) {
822 		exception &= ~EXC_PTRAUTH_BIT;
823 		assert(codeCnt == 2);
824 		pac_exception_triage(exception, code);
825 	}
826 #endif /* __has_feature(ptrauth_calls) */
827 	return exception_triage_thread(exception, code, codeCnt, thread);
828 }
829 
830 kern_return_t
bsd_exception(exception_type_t exception,mach_exception_data_t code,mach_msg_type_number_t codeCnt)831 bsd_exception(
832 	exception_type_t        exception,
833 	mach_exception_data_t   code,
834 	mach_msg_type_number_t  codeCnt)
835 {
836 	task_t                  task;
837 	lck_mtx_t               *mutex;
838 	thread_t                self = current_thread();
839 	kern_return_t           kr;
840 
841 	/*
842 	 * Maybe the task level will handle it.
843 	 */
844 	task = current_task();
845 	mutex = &task->itk_lock_data;
846 
847 	kr = exception_deliver(self, exception, code, codeCnt, task->exc_actions, mutex);
848 
849 	if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED) {
850 		return KERN_SUCCESS;
851 	}
852 	return KERN_FAILURE;
853 }
854 
855 
856 /*
857  * Raise an exception on a task.
858  * This should tell launchd to launch Crash Reporter for this task.
859  * If the exception is fatal, we should be careful about sending a synchronous exception
860  */
861 kern_return_t
task_exception_notify(exception_type_t exception,mach_exception_data_type_t exccode,mach_exception_data_type_t excsubcode,const bool fatal)862 task_exception_notify(exception_type_t exception,
863     mach_exception_data_type_t exccode, mach_exception_data_type_t excsubcode, const bool fatal)
864 {
865 	mach_exception_data_type_t      code[EXCEPTION_CODE_MAX];
866 	wait_interrupt_t                wsave;
867 	kern_return_t kr = KERN_SUCCESS;
868 
869 	/*
870 	 * If we are not in dev mode, nobody should be allowed to synchronously handle
871 	 * a fatal EXC_GUARD - they might stall on it indefinitely
872 	 */
873 	if (fatal && !developer_mode_state() && exception == EXC_GUARD) {
874 		return KERN_DENIED;
875 	}
876 
877 	code[0] = exccode;
878 	code[1] = excsubcode;
879 
880 	wsave = thread_interrupt_level(THREAD_UNINT);
881 	kr = exception_triage(exception, code, EXCEPTION_CODE_MAX);
882 	(void) thread_interrupt_level(wsave);
883 	return kr;
884 }
885 
886 
887 /*
888  *	Handle interface for special performance monitoring
889  *	This is a special case of the host exception handler
890  */
891 kern_return_t
sys_perf_notify(thread_t thread,int pid)892 sys_perf_notify(thread_t thread, int pid)
893 {
894 	host_priv_t             hostp;
895 	ipc_port_t              xport;
896 	wait_interrupt_t        wsave;
897 	kern_return_t           ret;
898 
899 	hostp = host_priv_self();       /* Get the host privileged ports */
900 	mach_exception_data_type_t      code[EXCEPTION_CODE_MAX];
901 	code[0] = 0xFF000001;           /* Set terminate code */
902 	code[1] = pid;          /* Pass out the pid */
903 
904 	lck_mtx_lock(&hostp->lock);
905 	xport = hostp->exc_actions[EXC_RPC_ALERT].port;
906 
907 	/* Make sure we're not catching our own exception */
908 	if (!IP_VALID(xport) ||
909 	    !ip_active(xport) ||
910 	    ip_in_space_noauth(xport, get_threadtask(thread)->itk_space)) {
911 		lck_mtx_unlock(&hostp->lock);
912 		return KERN_FAILURE;
913 	}
914 
915 	lck_mtx_unlock(&hostp->lock);
916 
917 	wsave = thread_interrupt_level(THREAD_UNINT);
918 	ret = exception_deliver(
919 		thread,
920 		EXC_RPC_ALERT,
921 		code,
922 		2,
923 		hostp->exc_actions,
924 		&hostp->lock);
925 	(void)thread_interrupt_level(wsave);
926 
927 	return ret;
928 }
929