1 /*
2 * Copyright (c) 2023 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <darwintest.h>
30 #include <stdlib.h>
31 #include <unistd.h>
32 #include <mach/exception_types.h>
33 #include <sys/wait.h>
34 #include <sys/sysctl.h>
35 #include <sys/code_signing.h>
36
37 #include "exc_helpers.h"
38 #include "test_utils.h"
39
40 T_GLOBAL_META(
41 T_META_NAMESPACE("xnu.arm"),
42 T_META_RADAR_COMPONENT_NAME("xnu"),
43 T_META_RADAR_COMPONENT_VERSION("arm"),
44 T_META_OWNER("ghackmann"),
45 T_META_REQUIRES_SYSCTL_EQ("hw.optional.ptrauth", 1),
46 T_META_IGNORECRASHES(".*pac_exception_entitlement.*"),
47 XNU_T_META_SOC_SPECIFIC
48 );
49
50 #if __arm64e__
51 static size_t
exception_handler(mach_port_t task __unused,mach_port_t thread __unused,exception_type_t type __unused,mach_exception_data_t codes __unused,uint64_t exception_pc __unused)52 exception_handler(mach_port_t task __unused, mach_port_t thread __unused,
53 exception_type_t type __unused, mach_exception_data_t codes __unused,
54 uint64_t exception_pc __unused)
55 {
56 T_ASSERT_FAIL("kernel ran exception handler instead of terminating process");
57 }
58
59 /*
60 * To trigger PAC failure, we create a validly-signed pointer and then flip an
61 * arbitrary PAC bit before accessing it. The exact number and location of PAC
62 * bits depends on the device configuration. For instruction pointers, the PAC
63 * field always includes bit 63. For data pointers, it may start as low as bit
64 * 54: bits 63-56 can be carved out for software tagging, and bit 55 is always
65 * reserved for addressing.
66 *
67 * Real-world software should use ptrauth.h when it needs to manually sign or
68 * auth pointers. But for testing purposes we need clang to emit specific
69 * ptrauth instructions, so we use inline asm here instead.
70 *
71 * Likewise clang would normally combine the "naked" auth and brk testcases as
72 * part of a sequence like:
73 *
74 * output = auth(...);
75 * if (output is poisoned) {
76 * brk(PTRAUTH_FAILURE_COMMENT);
77 * }
78 *
79 * On auth failure, CPUs that implement FEAT_FPAC will trap immediately at the
80 * auth instruction, and CPUs without FEAT_FPAC will trap at the later brk
81 * instruction. But again, for testing purposes we want these to be two
82 * discrete cases. (On FPAC-enabled CPUs, the kernel should treat *both* traps
83 * as ptrauth failure, even if we don't expect the latter to be reachable in
84 * real-world software.)
85 */
86
87 static void
naked_auth(void)88 naked_auth(void)
89 {
90 asm volatile (
91 "mov x0, #0" "\n"
92 "paciza x0" "\n"
93 "eor x0, x0, (1 << 63)" "\n"
94 "autiza x0"
95 :
96 :
97 : "x0"
98 );
99 }
100
101 static void
ptrauth_brk(void)102 ptrauth_brk(void)
103 {
104 asm volatile ("brk 0xc470");
105 }
106
107 static void
combined_branch_auth(void)108 combined_branch_auth(void)
109 {
110 asm volatile (
111 "adr x0, 1f" "\n"
112 "paciza x0" "\n"
113 "eor x0, x0, (1 << 63)" "\n"
114 "braaz x0" "\n"
115 "1:"
116 :
117 :
118 : "x0"
119 );
120 }
121
122 static void
combined_load_auth(void)123 combined_load_auth(void)
124 {
125 asm volatile (
126 "mov x0, sp" "\n"
127 "pacdza x0" "\n"
128 "eor x0, x0, (1 << 54)" "\n"
129 "ldraa x0, [x0]" "\n"
130 :
131 :
132 : "x0"
133 );
134 }
135
136 static void
run_pac_exception_test(void (* ptrauth_failure_fn)(void))137 run_pac_exception_test(void (*ptrauth_failure_fn)(void))
138 {
139
140 pid_t pid = fork();
141 T_QUIET; T_ASSERT_POSIX_SUCCESS(pid, "fork");
142
143 if (pid == 0) {
144 mach_port_t exc_port = create_exception_port(EXC_MASK_BAD_ACCESS | EXC_MASK_BREAKPOINT);
145 run_exception_handler(exc_port, exception_handler);
146
147 ptrauth_failure_fn();
148 /* ptrauth_failure_fn() should have raised an uncatchable exception */
149 T_FAIL("child ran to completion");
150 } else {
151 int status;
152 int err = waitpid(pid, &status, 0);
153 T_QUIET; T_ASSERT_POSIX_SUCCESS(err, "waitpid");
154
155 T_EXPECT_TRUE(WIFSIGNALED(status), "child terminated due to signal");
156 T_EXPECT_EQ(SIGKILL, WTERMSIG(status), "child terminated due to SIGKILL");
157 }
158 }
159 #endif //__arm64e__
160
161 T_DECL(pac_exception_naked_auth,
162 "Test the com.apple.private.pac.exception entitlement (naked auth failure)",
163 T_META_REQUIRES_SYSCTL_EQ("hw.optional.arm.FEAT_FPAC", 1), T_META_TAG_VM_NOT_ELIGIBLE)
164 {
165 #if __arm64e__
166 run_pac_exception_test(naked_auth);
167 #else
168 T_SKIP("Running on non-arm64e target, skipping...");
169 #endif
170 }
171
172
173 T_DECL(pac_exception_ptrauth_brk,
174 "Test the com.apple.private.pac.exception entitlement (brk with comment indicating ptrauth failure)", T_META_TAG_VM_NOT_ELIGIBLE)
175 {
176 #if __arm64e__
177 run_pac_exception_test(ptrauth_brk);
178 #else
179 T_SKIP("Running on non-arm64e target, skipping...");
180 #endif
181 }
182
183 T_DECL(pac_exception_combined_branch_auth,
184 "Test the com.apple.private.pac.exception entitlement (combined branch + auth failure)", T_META_TAG_VM_NOT_ELIGIBLE)
185 {
186 #if __arm64e__
187 run_pac_exception_test(combined_branch_auth);
188 #else
189 T_SKIP("Running on non-arm64e target, skipping...");
190 #endif
191 }
192
193 T_DECL(pac_exception_combined_load_auth,
194 "Test the com.apple.private.pac.exception entitlement (combined branch + auth failure)", T_META_TAG_VM_NOT_ELIGIBLE)
195 {
196 #if __arm64e__
197 run_pac_exception_test(combined_load_auth);
198 #else
199 T_SKIP("Running on non-arm64e target, skipping...");
200 #endif
201 }
202