1 /*
2 * Copyright (c) 2019 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #ifdef MACH_BSD
30 #include <mach_debug.h>
31 #include <mach_ldebug.h>
32
33 #include <mach/kern_return.h>
34 #include <mach/mach_traps.h>
35 #include <mach/vm_param.h>
36
37 #include <kern/bits.h>
38 #include <kern/cpu_data.h>
39 #include <arm/cpu_data_internal.h>
40 #include <kern/mach_param.h>
41 #include <kern/task.h>
42 #include <kern/thread.h>
43 #include <kern/sched_prim.h>
44 #include <kern/misc_protos.h>
45 #include <kern/assert.h>
46 #include <kern/spl.h>
47 #include <kern/syscall_sw.h>
48 #include <ipc/ipc_port.h>
49 #include <vm/vm_kern.h>
50 #include <mach/thread_status.h>
51 #include <vm/pmap.h>
52
53 #include <sys/kdebug.h>
54
55 #include <sys/syscall.h>
56
57 #if CONFIG_MACF
58 #include <security/mac_mach_internal.h>
59 #endif
60
61 extern void throttle_lowpri_io(int);
62 extern arm_debug_state64_t *find_or_allocate_debug_state64(thread_t thread);
63 void mach_syscall(struct arm_saved_state*);
64 typedef kern_return_t (*mach_call_t)(void *);
65
66 struct mach_call_args {
67 syscall_arg_t arg1;
68 syscall_arg_t arg2;
69 syscall_arg_t arg3;
70 syscall_arg_t arg4;
71 syscall_arg_t arg5;
72 syscall_arg_t arg6;
73 syscall_arg_t arg7;
74 syscall_arg_t arg8;
75 syscall_arg_t arg9;
76 };
77
78 static void
arm_set_mach_syscall_ret(struct arm_saved_state * state,int retval)79 arm_set_mach_syscall_ret(struct arm_saved_state *state, int retval)
80 {
81 if (is_saved_state32(state)) {
82 saved_state32(state)->r[0] = retval;
83 } else {
84 saved_state64(state)->x[0] = retval;
85 }
86 }
87
88 static kern_return_t
arm_get_mach_syscall_args(struct arm_saved_state * state,struct mach_call_args * dest,const mach_trap_t * trapp)89 arm_get_mach_syscall_args(struct arm_saved_state *state, struct mach_call_args *dest, const mach_trap_t *trapp)
90 {
91 uint32_t reg_count;
92
93 if (is_saved_state32(state)) {
94 /* The trap table entry defines the number of 32-bit words to be copied in from userspace. */
95 reg_count = trapp->mach_trap_u32_words;
96
97 /*
98 * We get 7 contiguous words; r0-r6, hop over r7
99 * (frame pointer), optionally r8
100 */
101 if (reg_count <= 7) {
102 bcopy((char*)saved_state32(state), (char*)dest, sizeof(uint32_t) * reg_count);
103 } else if (reg_count <= 9) {
104 bcopy((char*)saved_state32(state), (char*)dest, sizeof(uint32_t) * 7);
105 bcopy((char*)&saved_state32(state)->r[8], ((char*)dest) + sizeof(uint32_t) * 7,
106 reg_count - 7);
107 } else {
108 panic("Trap with %d words of args? We only support 9.", reg_count);
109 }
110
111 #if CONFIG_REQUIRES_U32_MUNGING
112 trapp->mach_trap_arg_munge32(dest);
113 #else
114 #error U32 mach traps on ARM64 kernel requires munging
115 #endif
116 } else {
117 assert(is_saved_state64(state));
118 bcopy((char*)saved_state64(state), (char*)dest, trapp->mach_trap_arg_count * sizeof(uint64_t));
119 }
120
121 return KERN_SUCCESS;
122 }
123
124 /**
125 * Marks or unmarks the given thread to be single stepped such
126 * that it executes exactly one instruction and then takes an exception to
127 * prevent further execution.
128 *
129 * @param thread 64 bit thread to be single stepped
130 * @param on boolean value representing whether the thread should be
131 * single stepped (on is true) or not (on is false)
132 *
133 * @returns KERN_SUCCESS if the status is successfully set or KERN_FAILURE if
134 * it fails for any reason.
135 */
136 kern_return_t
thread_setsinglestep(thread_t thread,int on)137 thread_setsinglestep(thread_t thread, int on)
138 {
139 arm_debug_state64_t *thread_state = find_or_allocate_debug_state64(thread);
140
141 if (thread_state == NULL) {
142 return KERN_FAILURE;
143 }
144
145 if (on) {
146 thread_state->mdscr_el1 |= MDSCR_SS;
147 } else {
148 thread_state->mdscr_el1 &= ~MDSCR_SS;
149 }
150
151 if (thread == current_thread()) {
152 arm_debug_set64(thread->machine.DebugData);
153 }
154 return KERN_SUCCESS;
155 }
156
157 #if CONFIG_DTRACE
158
159 vm_offset_t dtrace_get_cpu_int_stack_top(void);
160
161 vm_offset_t
dtrace_get_cpu_int_stack_top(void)162 dtrace_get_cpu_int_stack_top(void)
163 {
164 return getCpuDatap()->intstack_top;
165 }
166 #endif /* CONFIG_DTRACE */
167
168 /* ARM64_TODO: remove this. still TODO?*/
169 extern struct proc* current_proc(void);
170 extern int proc_pid(struct proc*);
171
172 #if CONFIG_DEBUG_SYSCALL_REJECTION
173 extern int debug_syscall_rejection_mode;
174 extern bool debug_syscall_rejection_handle(int syscall_mach_trap_number);
175 #endif /* CONFIG_DEBUG_SYSCALL_REJECTION */
176
177 void
mach_syscall(struct arm_saved_state * state)178 mach_syscall(struct arm_saved_state *state)
179 {
180 kern_return_t retval;
181 mach_call_t mach_call;
182 struct mach_call_args args = {
183 .arg1 = 0,
184 .arg2 = 0,
185 .arg3 = 0,
186 .arg4 = 0,
187 .arg5 = 0,
188 .arg6 = 0,
189 .arg7 = 0,
190 .arg8 = 0,
191 .arg9 = 0
192 };
193 int call_number = get_saved_state_svc_number(state);
194 int64_t exc_code;
195 int argc;
196
197 struct uthread *ut = get_bsdthread_info(current_thread());
198 uthread_reset_proc_refcount(ut);
199
200 assert(call_number < 0); /* Otherwise it would be a Unix syscall */
201 call_number = -call_number;
202
203 if (call_number >= MACH_TRAP_TABLE_COUNT) {
204 goto bad;
205 }
206
207 DEBUG_KPRINT_SYSCALL_MACH(
208 "mach_syscall: code=%d(%s) (pid %d, tid %lld)\n",
209 call_number, mach_syscall_name_table[call_number],
210 proc_pid(current_proc()), thread_tid(current_thread()));
211
212 #if DEBUG_TRACE
213 kprintf("mach_syscall(0x%08x) code=%d\n", state, call_number);
214 #endif
215
216 mach_call = (mach_call_t)mach_trap_table[call_number].mach_trap_function;
217
218 if (mach_call == (mach_call_t)kern_invalid) {
219 DEBUG_KPRINT_SYSCALL_MACH(
220 "mach_syscall: kern_invalid 0x%x\n", call_number);
221 goto bad;
222 }
223
224 argc = mach_trap_table[call_number].mach_trap_arg_count;
225 if (argc) {
226 retval = arm_get_mach_syscall_args(state, &args, &mach_trap_table[call_number]);
227 if (retval != KERN_SUCCESS) {
228 arm_set_mach_syscall_ret(state, retval);
229
230 DEBUG_KPRINT_SYSCALL_MACH(
231 "mach_syscall: retval=0x%x\n", retval);
232 return;
233 }
234 }
235
236 KERNEL_DEBUG_CONSTANT_IST(KDEBUG_TRACE,
237 MACHDBG_CODE(DBG_MACH_EXCP_SC, (call_number)) | DBG_FUNC_START,
238 args.arg1, args.arg2, args.arg3, args.arg4, 0);
239
240 #if CONFIG_MACF
241 /*
242 * Check syscall filter mask, if exists.
243 *
244 * Not all mach traps are filtered. e.g., mach_absolute_time() and
245 * mach_continuous_time(). See handle_svc().
246 */
247 thread_ro_t tro = current_thread_ro();
248 task_t task = tro->tro_task;
249 struct proc *proc = tro->tro_proc;
250 uint8_t *filter_mask = task_get_mach_trap_filter_mask(task);
251
252 if (__improbable(filter_mask != NULL &&
253 !bitstr_test(filter_mask, call_number))) {
254 if (mac_task_mach_trap_evaluate != NULL) {
255 retval = mac_task_mach_trap_evaluate(proc, call_number);
256 if (retval) {
257 DEBUG_KPRINT_SYSCALL_MACH(
258 "mach_syscall: MACF retval=0x%x\n", retval);
259 goto bad;
260 }
261 }
262 }
263 #endif /* CONFIG_MACF */
264
265 #if CONFIG_DEBUG_SYSCALL_REJECTION
266 bitmap_t const *rejection_mask = uthread_get_syscall_rejection_mask(ut);
267 if (__improbable(rejection_mask != NULL &&
268 debug_syscall_rejection_mode != 0) &&
269 !bitmap_test(rejection_mask, call_number)) {
270 if (debug_syscall_rejection_handle(-call_number)) {
271 goto skip_machcall;
272 }
273 }
274 #endif /* CONFIG_DEBUG_SYSCALL_REJECTION */
275
276
277 retval = mach_call(&args);
278
279 #if CONFIG_DEBUG_SYSCALL_REJECTION
280 skip_machcall:
281 #endif
282
283 DEBUG_KPRINT_SYSCALL_MACH("mach_syscall: retval=0x%x (pid %d, tid %lld)\n", retval,
284 proc_pid(current_proc()), thread_tid(current_thread()));
285
286 KERNEL_DEBUG_CONSTANT_IST(KDEBUG_TRACE,
287 MACHDBG_CODE(DBG_MACH_EXCP_SC, (call_number)) | DBG_FUNC_END,
288 retval, 0, 0, 0, 0);
289
290 arm_set_mach_syscall_ret(state, retval);
291
292 throttle_lowpri_io(1);
293
294 #if DEBUG || DEVELOPMENT
295 kern_allocation_name_t
296 prior __assert_only = thread_get_kernel_state(current_thread())->allocation_name;
297 assertf(prior == NULL, "thread_set_allocation_name(\"%s\") not cleared", kern_allocation_get_name(prior));
298 #endif /* DEBUG || DEVELOPMENT */
299
300 uthread_assert_zero_proc_refcount(ut);
301 return;
302
303 bad:
304 exc_code = call_number;
305 exception_triage(EXC_SYSCALL, &exc_code, 1);
306 /* NOTREACHED */
307 panic("Returned from exception_triage()?");
308 }
309 #endif /* MACH_BSD */
310