tests/thread_set_state_arm64_cpsr.c

   1 /*
   2  * Copyright (c) 2019 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <stdlib.h>
  30 #include <darwintest.h>
  31 #include <mach/mach.h>
  32 #include <mach/thread_status.h>
  33
  34 T_GLOBAL_META(
  35         T_META_NAMESPACE("xnu.arm"),
  36         T_META_RUN_CONCURRENTLY(true)
  37         );
  38
  39 #define PSR64_USER_MASK (0xFU << 28)
  40
  41 #if __arm64__
  42 __attribute__((noreturn))
  43 static void
  44 phase2()
  45 {
  46         kern_return_t err;
  47         arm_thread_state64_t ts;
  48         mach_msg_type_number_t count = ARM_THREAD_STATE64_COUNT;
  49         uint32_t nzcv = (uint32_t) __builtin_arm_rsr64("NZCV");
  50
  51         T_QUIET; T_ASSERT_EQ(nzcv & PSR64_USER_MASK, PSR64_USER_MASK, "All condition flags are set");
  52
  53         err = thread_get_state(mach_thread_self(), ARM_THREAD_STATE64, (thread_state_t)&ts, &count);
  54         T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got own thread state after corrupting CPSR");
  55
  56         T_QUIET; T_ASSERT_EQ(ts.__cpsr & ~PSR64_USER_MASK, 0, "No privileged fields in CPSR are set");
  57
  58         exit(0);
  59 }
  60 #endif
  61
  62 T_DECL(thread_set_state_arm64_cpsr,
  63     "Test that user mode cannot control privileged fields in CPSR/PSTATE.")
  64 {
  65 #if !__arm64__
  66         T_SKIP("Running on non-arm64 target, skipping...");
  67 #else
  68         kern_return_t err;
  69         mach_msg_type_number_t count;
  70         arm_thread_state64_t ts;
  71
  72         count = ARM_THREAD_STATE64_COUNT;
  73         err = thread_get_state(mach_thread_self(), ARM_THREAD_STATE64, (thread_state_t)&ts, &count);
  74         T_QUIET; T_ASSERT_EQ(err, KERN_SUCCESS, "Got own thread state");
  75
  76         /*
  77          * jump to the second phase while attempting to set all the bits
  78          * in CPSR. If we survive the jump and read back CPSR without any
  79          * bits besides condition flags set, the test passes. If kernel
  80          * does not mask out the privileged CPSR bits correctly, we can
  81          * expect an illegal instruction set panic due to SPSR.IL being
  82          * set upon ERET to user mode.
  83          */
  84
  85         void *new_pc = (void *)&phase2;
  86         arm_thread_state64_set_pc_fptr(ts, new_pc);
  87         ts.__cpsr = ~0U;
  88
  89         err = thread_set_state(mach_thread_self(), ARM_THREAD_STATE64, (thread_state_t)&ts, ARM_THREAD_STATE64_COUNT);
  90
  91         /* NOT REACHED */
  92
  93         T_ASSERT_FAIL("Thread did not reach expected state. err = %d", err);
  94
  95 #endif
  96 }