1 /*
2 * Copyright (c) 2019 Apple Computer, Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 #include <darwintest.h>
29 #include <pthread.h>
30 #include <ptrauth.h>
31 #include <mach/machine/thread_state.h>
32 #include <sys/types.h>
33 #include <sys/sysctl.h>
34 #include <sys/code_signing.h>
35 #include <stdlib.h>
36 #include "exc_helpers.h"
37
38 T_GLOBAL_META(
39 T_META_NAMESPACE("xnu.arm"),
40 T_META_RADAR_COMPONENT_NAME("xnu"),
41 T_META_RADAR_COMPONENT_VERSION("arm"),
42 T_META_OWNER("ghackmann"),
43 T_META_RUN_CONCURRENTLY(true)
44 );
45
46 #if __arm64e__
47 #ifndef EXC_ARM_PAC_FAIL
48 #define EXC_ARM_PAC_FAIL 0x105 /* PAC authentication failure */
49 #endif
50
51 static volatile bool mach_exc_caught = false;
52
53 static size_t
pac_exception_handler(__unused mach_port_t task,__unused mach_port_t thread,exception_type_t type,mach_exception_data_t codes,__unused uint64_t exception_pc)54 pac_exception_handler(
55 __unused mach_port_t task,
56 __unused mach_port_t thread,
57 exception_type_t type,
58 mach_exception_data_t codes,
59 __unused uint64_t exception_pc)
60 {
61 T_ASSERT_EQ(type, EXC_BAD_ACCESS, "Caught an EXC_BAD_ACCESS exception");
62 T_ASSERT_EQ(codes[0], (uint64_t)EXC_ARM_PAC_FAIL, "The subcode is EXC_ARM_PAC_FAIL");
63 mach_exc_caught = true;
64 return 4;
65 }
66
67 #define ID_AA64ISAR1_EL1_APA(x) ((x >> 4) & 0xf)
68 #define ID_AA64ISAR1_EL1_API(x) ((x >> 8) & 0xf)
69
70 static bool
have_fpac(void)71 have_fpac(void)
72 {
73 uint64_t id_aa64isar1_el1;
74 size_t id_aa64isar1_el1_size = sizeof(id_aa64isar1_el1);
75
76 int err = sysctlbyname("machdep.cpu.sysreg_ID_AA64ISAR1_EL1", &id_aa64isar1_el1, &id_aa64isar1_el1_size, NULL, 0);
77 if (err) {
78 return false;
79 }
80
81 const uint8_t APA_API_HAVE_FPAC = 0x4;
82 return ID_AA64ISAR1_EL1_APA(id_aa64isar1_el1) >= APA_API_HAVE_FPAC ||
83 ID_AA64ISAR1_EL1_API(id_aa64isar1_el1) >= APA_API_HAVE_FPAC;
84 }
85
86 static int
virtual_address_size(void)87 virtual_address_size(void)
88 {
89 int ret;
90 size_t ret_size = sizeof(ret);
91
92 int err = sysctlbyname("machdep.virtual_address_size", &ret, &ret_size, NULL, 0);
93 T_QUIET; T_WITH_ERRNO; T_ASSERT_POSIX_SUCCESS(err, "sysctlbyname()");
94 return ret;
95 }
96
97 static void *
canonical_address(void * ptr)98 canonical_address(void *ptr)
99 {
100 uint64_t mask = (1ULL << virtual_address_size()) - 1;
101 return (void *)((uintptr_t)ptr & mask);
102 }
103 #endif // __arm64e__
104
105 T_DECL(thread_set_state_corrupted_pc,
106 "Test that ptrauth failures in thread_set_state() poison the respective register.", T_META_TAG_VM_NOT_PREFERRED)
107 {
108 #if !__arm64e__
109 T_SKIP("Running on non-arm64e target, skipping...");
110 #else
111 mach_port_t thread;
112 kern_return_t err = thread_create(mach_task_self(), &thread);
113 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Created thread");
114
115 arm_thread_state64_t state;
116 mach_msg_type_number_t count = ARM_THREAD_STATE64_COUNT;
117 err = thread_get_state(mach_thread_self(), ARM_THREAD_STATE64, (thread_state_t)&state, &count);
118 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got own thread state");
119
120 void *corrupted_pc = (void *)((uintptr_t)state.__opaque_pc ^ 0x4);
121 state.__opaque_pc = corrupted_pc;
122 err = thread_set_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, count);
123 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Set child thread's PC to a corrupted pointer");
124
125 err = thread_get_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, &count);
126 T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got child's thread state");
127 T_EXPECT_NE(state.__opaque_pc, corrupted_pc, "thread_set_state() with a corrupted PC should poison the PC value");
128 T_EXPECT_EQ(canonical_address(state.__opaque_pc), canonical_address(corrupted_pc),
129 "thread_set_state() with a corrupted PC should preserve the canonical address bits");
130
131 err = thread_terminate(thread);
132 T_QUIET; T_EXPECT_EQ(err, KERN_SUCCESS, "Terminated thread");
133 #endif // __arm64e__
134 }
135
136 T_DECL(ptrauth_exception,
137 "Test naked ptrauth failures.",
138 T_META_IGNORECRASHES("ptrauth_failure.*"), T_META_TAG_VM_NOT_PREFERRED)
139 {
140 #if !__arm64e__
141 T_SKIP("Running on non-arm64e target, skipping...");
142 #else
143 if (!have_fpac()) {
144 T_SKIP("Running on non-FPAC target, skipping...");
145 return;
146 }
147
148 int pid, stat;
149 mach_port_t exc_port = create_exception_port(EXC_MASK_BAD_ACCESS);
150
151 extern int main(int, char *[]);
152 void *func_ptr = (void *)main;
153 void *func_ptr_stripped = ptrauth_strip(func_ptr, ptrauth_key_function_pointer);
154 void *func_ptr_corrupted = (void *)((uintptr_t)func_ptr ^ 1);
155
156 void *func_ptr_authed = func_ptr;
157 mach_exc_caught = false;
158 run_exception_handler(exc_port, pac_exception_handler);
159 asm volatile ("autiza %0" : "+r"(func_ptr_authed));
160
161 T_EXPECT_FALSE(mach_exc_caught, "Authing valid pointer should not cause an exception");
162 T_EXPECT_EQ(func_ptr_authed, func_ptr_stripped, "Valid pointer should auth to stripped value");
163
164 pid = fork();
165 if (pid == 0) {
166 func_ptr_authed = func_ptr_corrupted;
167 asm volatile ("autiza %0" : "+r"(func_ptr_authed));
168 T_FAIL("Expected PAC EXCEPTION");
169 __builtin_unreachable();
170 }
171 T_ASSERT_TRUE(pid != -1, "Checking fork success in parent");
172
173 T_ASSERT_POSIX_SUCCESS(waitpid(pid, &stat, 0), "waitpid");
174 T_ASSERT_TRUE(stat == SIGKILL, "Expect a PAC EXCEPTION to SIGKILL the process");
175 #endif // __arm64e__
176 }
177