1 /* 2 * Copyright (c) 2019 Apple Computer, Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 #include <darwintest.h> 29 #include <pthread.h> 30 #include <ptrauth.h> 31 #include <mach/machine/thread_state.h> 32 #include <sys/types.h> 33 #include <sys/sysctl.h> 34 #include <sys/code_signing.h> 35 #include <stdlib.h> 36 #include "exc_helpers.h" 37 38 T_GLOBAL_META( 39 T_META_NAMESPACE("xnu.arm"), 40 T_META_RADAR_COMPONENT_NAME("xnu"), 41 T_META_RADAR_COMPONENT_VERSION("arm"), 42 T_META_OWNER("ghackmann"), 43 T_META_RUN_CONCURRENTLY(true) 44 ); 45 46 47 T_DECL(thread_set_state_corrupted_pc, 48 "Test that ptrauth failures in thread_set_state() poison the respective register.") 49 { 50 #if !__arm64e__ 51 T_SKIP("Running on non-arm64e target, skipping..."); 52 #else 53 mach_port_t thread; 54 kern_return_t err = thread_create(mach_task_self(), &thread); 55 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Created thread"); 56 57 arm_thread_state64_t state; 58 mach_msg_type_number_t count = ARM_THREAD_STATE64_COUNT; 59 err = thread_get_state(mach_thread_self(), ARM_THREAD_STATE64, (thread_state_t)&state, &count); 60 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got own thread state"); 61 62 void *corrupted_pc = (void *)((uintptr_t)state.__opaque_pc ^ 0x4); 63 state.__opaque_pc = corrupted_pc; 64 err = thread_set_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, count); 65 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Set child thread's PC to a corrupted pointer"); 66 67 err = thread_get_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, &count); 68 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got child's thread state"); 69 T_EXPECT_NE(state.__opaque_pc, corrupted_pc, "thread_set_state() with a corrupted PC should poison the PC value"); 70 71 err = thread_terminate(thread); 72 T_QUIET; T_EXPECT_EQ(err, KERN_SUCCESS, "Terminated thread"); 73 #endif // __arm64e__ 74 } 75 76