1*a325d9c4SApple OSS Distributions /* 2*a325d9c4SApple OSS Distributions * Copyright (c) 2019 Apple Computer, Inc. All rights reserved. 3*a325d9c4SApple OSS Distributions * 4*a325d9c4SApple OSS Distributions * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5*a325d9c4SApple OSS Distributions * 6*a325d9c4SApple OSS Distributions * This file contains Original Code and/or Modifications of Original Code 7*a325d9c4SApple OSS Distributions * as defined in and that are subject to the Apple Public Source License 8*a325d9c4SApple OSS Distributions * Version 2.0 (the 'License'). You may not use this file except in 9*a325d9c4SApple OSS Distributions * compliance with the License. The rights granted to you under the License 10*a325d9c4SApple OSS Distributions * may not be used to create, or enable the creation or redistribution of, 11*a325d9c4SApple OSS Distributions * unlawful or unlicensed copies of an Apple operating system, or to 12*a325d9c4SApple OSS Distributions * circumvent, violate, or enable the circumvention or violation of, any 13*a325d9c4SApple OSS Distributions * terms of an Apple operating system software license agreement. 14*a325d9c4SApple OSS Distributions * 15*a325d9c4SApple OSS Distributions * Please obtain a copy of the License at 16*a325d9c4SApple OSS Distributions * http://www.opensource.apple.com/apsl/ and read it before using this file. 17*a325d9c4SApple OSS Distributions * 18*a325d9c4SApple OSS Distributions * The Original Code and all software distributed under the License are 19*a325d9c4SApple OSS Distributions * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20*a325d9c4SApple OSS Distributions * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21*a325d9c4SApple OSS Distributions * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22*a325d9c4SApple OSS Distributions * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23*a325d9c4SApple OSS Distributions * Please see the License for the specific language governing rights and 24*a325d9c4SApple OSS Distributions * limitations under the License. 25*a325d9c4SApple OSS Distributions * 26*a325d9c4SApple OSS Distributions * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27*a325d9c4SApple OSS Distributions */ 28*a325d9c4SApple OSS Distributions #include <darwintest.h> 29*a325d9c4SApple OSS Distributions #include <pthread.h> 30*a325d9c4SApple OSS Distributions #include <ptrauth.h> 31*a325d9c4SApple OSS Distributions #include <mach/machine/thread_state.h> 32*a325d9c4SApple OSS Distributions #include <sys/types.h> 33*a325d9c4SApple OSS Distributions #include <sys/sysctl.h> 34*a325d9c4SApple OSS Distributions #include "exc_helpers.h" 35*a325d9c4SApple OSS Distributions 36*a325d9c4SApple OSS Distributions T_GLOBAL_META( 37*a325d9c4SApple OSS Distributions T_META_NAMESPACE("xnu.arm"), 38*a325d9c4SApple OSS Distributions T_META_RADAR_COMPONENT_NAME("xnu"), 39*a325d9c4SApple OSS Distributions T_META_RADAR_COMPONENT_VERSION("arm"), 40*a325d9c4SApple OSS Distributions T_META_OWNER("ghackmann"), 41*a325d9c4SApple OSS Distributions T_META_RUN_CONCURRENTLY(true) 42*a325d9c4SApple OSS Distributions ); 43*a325d9c4SApple OSS Distributions 44*a325d9c4SApple OSS Distributions 45*a325d9c4SApple OSS Distributions T_DECL(thread_set_state_corrupted_pc, 46*a325d9c4SApple OSS Distributions "Test that ptrauth failures in thread_set_state() poison the respective register.") 47*a325d9c4SApple OSS Distributions { 48*a325d9c4SApple OSS Distributions #if !__arm64e__ 49*a325d9c4SApple OSS Distributions T_SKIP("Running on non-arm64e target, skipping..."); 50*a325d9c4SApple OSS Distributions #else 51*a325d9c4SApple OSS Distributions mach_port_t thread; 52*a325d9c4SApple OSS Distributions kern_return_t err = thread_create(mach_task_self(), &thread); 53*a325d9c4SApple OSS Distributions T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Created thread"); 54*a325d9c4SApple OSS Distributions 55*a325d9c4SApple OSS Distributions arm_thread_state64_t state; 56*a325d9c4SApple OSS Distributions mach_msg_type_number_t count = ARM_THREAD_STATE64_COUNT; 57*a325d9c4SApple OSS Distributions err = thread_get_state(mach_thread_self(), ARM_THREAD_STATE64, (thread_state_t)&state, &count); 58*a325d9c4SApple OSS Distributions T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got own thread state"); 59*a325d9c4SApple OSS Distributions 60*a325d9c4SApple OSS Distributions void *corrupted_pc = (void *)((uintptr_t)state.__opaque_pc ^ 0x4); 61*a325d9c4SApple OSS Distributions state.__opaque_pc = corrupted_pc; 62*a325d9c4SApple OSS Distributions err = thread_set_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, count); 63*a325d9c4SApple OSS Distributions T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Set child thread's PC to a corrupted pointer"); 64*a325d9c4SApple OSS Distributions 65*a325d9c4SApple OSS Distributions err = thread_get_state(thread, ARM_THREAD_STATE64, (thread_state_t)&state, &count); 66*a325d9c4SApple OSS Distributions T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got child's thread state"); 67*a325d9c4SApple OSS Distributions T_EXPECT_NE(state.__opaque_pc, corrupted_pc, "thread_set_state() with a corrupted PC should poison the PC value"); 68*a325d9c4SApple OSS Distributions 69*a325d9c4SApple OSS Distributions err = thread_terminate(thread); 70*a325d9c4SApple OSS Distributions T_QUIET; T_EXPECT_EQ(err, KERN_SUCCESS, "Terminated thread"); 71*a325d9c4SApple OSS Distributions #endif // __arm64e__ 72*a325d9c4SApple OSS Distributions } 73*a325d9c4SApple OSS Distributions 74