tests/fp_exception.c

   1 /*
   2  * Copyright (c) 2019 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /**
  29  * On devices that support it, this test ensures that a mach exception is
  30  * generated when an ARMv8 floating point exception is triggered.
  31  */
  32 #include <darwintest.h>
  33 #include <stdbool.h>
  34 #include <stdint.h>
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <mach/mach.h>
  38 #include <mach/thread_status.h>
  39 #include <mach/exception.h>
  40 #include <pthread.h>
  41
  42 #if __has_feature(ptrauth_calls)
  43 #include <ptrauth.h>
  44 #endif
  45
  46 T_GLOBAL_META(T_META_RUN_CONCURRENTLY(true));
  47
  48 /* The bit to set in FPCR to enable the divide-by-zero floating point exception. */
  49 #define FPCR_DIV_EXC 0x200
  50
  51 /* Whether we caught the EXC_ARITHMETIC mach exception or not. */
  52 static volatile bool mach_exc_caught = false;
  53
  54 /**
  55  * mach_exc_server() is a MIG-generated function that verifies the message
  56  * that was received is indeed a mach exception and then calls
  57  * catch_mach_exception_raise_state() to handle the exception.
  58  */
  59 extern boolean_t mach_exc_server(mach_msg_header_t *, mach_msg_header_t *);
  60
  61 /**
  62  * This has to be defined for linking purposes, but it's unused in this test.
  63  */
  64 kern_return_t
  65 catch_mach_exception_raise(
  66         mach_port_t exception_port,
  67         mach_port_t thread,
  68         mach_port_t task,
  69         exception_type_t type,
  70         exception_data_t codes,
  71         mach_msg_type_number_t code_count)
  72 {
  73 #pragma unused(exception_port, thread, task, type, codes, code_count)
  74         T_FAIL("Triggered catch_mach_exception_raise() which shouldn't happen...");
  75         __builtin_unreachable();
  76 }
  77
  78 /**
  79  * Called by mach_exc_server() to handle the exception. This will verify the
  80  * exception is a floating point divide-by-zero exception and will then modify
  81  * the thread state to move to the next instruction.
  82  */
  83 kern_return_t
  84 catch_mach_exception_raise_state(
  85         mach_port_t exception_port,
  86         exception_type_t type,
  87         exception_data_t codes,
  88         mach_msg_type_number_t code_count,
  89         int *flavor,
  90         thread_state_t in_state,
  91         mach_msg_type_number_t in_state_count,
  92         thread_state_t out_state,
  93         mach_msg_type_number_t *out_state_count)
  94 {
  95 #pragma unused(exception_port, type, codes, code_count, flavor, in_state, in_state_count, out_state, out_state_count)
  96 #ifdef __arm64__
  97         T_LOG("Caught a mach exception!\n");
  98
  99         /* Floating point divide by zero should cause an EXC_ARITHMETIC exception. */
 100         T_ASSERT_EQ(type, EXC_ARITHMETIC, "Caught an EXC_ARITHMETIC exception");
 101
 102         /* There should only be two code vales. */
 103         T_ASSERT_EQ(code_count, 2, "Two code values were provided with the mach exception");
 104
 105         /**
 106          * The code values should be 64-bit since MACH_EXCEPTION_CODES was specified
 107          * when setting the exception port.
 108          */
 109         uint64_t *codes_64 = (uint64_t*)codes;
 110         T_LOG("Mach exception codes[0]: %#llx, codes[1]: %#llx\n", codes_64[0], codes_64[1]);
 111
 112         /* Verify that we're receiving 64-bit ARM thread state values. */
 113         T_ASSERT_EQ(*flavor, ARM_THREAD_STATE64, "The thread state flavor is ARM_THREAD_STATE64");
 114         T_ASSERT_EQ(in_state_count, ARM_THREAD_STATE64_COUNT, "The thread state count is ARM_THREAD_STATE64_COUNT");
 115
 116         /* Verify the exception is a floating point divide-by-zero exception. */
 117         T_ASSERT_EQ(codes_64[0], EXC_ARM_FP_DZ, "The subcode is EXC_ARM_FP_DZ (floating point divide-by-zero)");
 118
 119         /**
 120          * Increment the PC to the next instruction so the thread doesn't cause
 121          * another exception when it resumes.
 122          */
 123         *out_state_count = in_state_count; /* size of state object in 32-bit words */
 124         memcpy((void*)out_state, (void*)in_state, in_state_count * 4);
 125         arm_thread_state64_t *state = (arm_thread_state64_t*)out_state;
 126
 127         void *pc = (void*)(arm_thread_state64_get_pc(*state) + 4);
 128 #if __has_feature(ptrauth_calls)
 129         /* Have to sign the new PC value when pointer authentication is enabled. */
 130         pc = ptrauth_sign_unauthenticated(pc, ptrauth_key_function_pointer, 0);
 131 #endif
 132         arm_thread_state64_set_pc_fptr(*state, pc);
 133
 134         mach_exc_caught = true;
 135 #endif /* __arm64__ */
 136
 137         /* Return KERN_SUCCESS to tell the kernel to keep running the victim thread. */
 138         return KERN_SUCCESS;
 139 }
 140
 141 /**
 142  * This has to be defined for linking purposes, but it's unused in this test.
 143  */
 144 kern_return_t
 145 catch_mach_exception_raise_state_identity(
 146         mach_port_t exception_port,
 147         mach_port_t thread,
 148         mach_port_t task,
 149         exception_type_t type,
 150         exception_data_t codes,
 151         mach_msg_type_number_t code_count,
 152         int *flavor,
 153         thread_state_t in_state,
 154         mach_msg_type_number_t in_state_count,
 155         thread_state_t out_state,
 156         mach_msg_type_number_t *out_state_count)
 157 {
 158 #pragma unused(exception_port, thread, task, type, codes, code_count, flavor, in_state, in_state_count, out_state, out_state_count)
 159         T_FAIL("Triggered catch_mach_exception_raise_state_identity() which shouldn't happen...");
 160         __builtin_unreachable();
 161 }
 162
 163 /**
 164  * Thread to handle the mach exception generated by the floating point exception.
 165  *
 166  * @param arg The exception port to wait for a message on.
 167  */
 168 void *
 169 exc_server_thread(void *arg)
 170 {
 171         mach_port_t exc_port = *(mach_port_t*)arg;
 172
 173         /**
 174          * mach_msg_server_once is a helper function provided by libsyscall that
 175          * handles creating mach messages, blocks waiting for a message on the
 176          * exception port, calls mach_exc_server() to handle the exception, and
 177          * sends a reply based on the return value of mach_exc_server().
 178          */
 179 #define MACH_MSG_REPLY_SIZE 4096
 180         kern_return_t kr = mach_msg_server_once(mach_exc_server, MACH_MSG_REPLY_SIZE, exc_port, 0);
 181         T_ASSERT_MACH_SUCCESS(kr, "Received mach exception message");
 182
 183         pthread_exit((void*)0);
 184         __builtin_unreachable();
 185 }
 186
 187 T_DECL(armv8_fp_exception,
 188     "Test that ARMv8 floating point exceptions generate mach exceptions.")
 189 {
 190 #ifndef __arm64__
 191         T_SKIP("Running on non-arm64 target, skipping...");
 192 #else
 193         pthread_t exc_thread;
 194         mach_port_t exc_port = MACH_PORT_NULL;
 195         mach_port_t task = mach_task_self();
 196         mach_port_t thread = mach_thread_self();
 197         kern_return_t kr = KERN_SUCCESS;
 198
 199         /* Attempt to enable Divide-by-Zero floating point exceptions in hardware. */
 200         uint64_t fpcr = __builtin_arm_rsr64("FPCR") | FPCR_DIV_EXC;
 201         __builtin_arm_wsr64("FPCR", fpcr);
 202 #define DSB_ISH 0xb
 203         __builtin_arm_dsb(DSB_ISH);
 204
 205         /* Devices that don't support floating point exceptions have FPCR as RAZ/WI. */
 206         if (__builtin_arm_rsr64("FPCR") != fpcr) {
 207                 T_SKIP("Running on a device that doesn't support floating point exceptions, skipping...");
 208         }
 209
 210         /* Create the mach port the exception messages will be sent to. */
 211         kr = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
 212         T_ASSERT_MACH_SUCCESS(kr, "Allocated mach exception port");
 213
 214         /**
 215          * Insert a send right into the exception port that the kernel will use to
 216          * send the exception thread the exception messages.
 217          */
 218         kr = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
 219         T_ASSERT_MACH_SUCCESS(kr, "Inserted a SEND right into the exception port");
 220
 221         /* Tell the kernel what port to send EXC_ARITHMETIC exceptions to. */
 222         kr = thread_set_exception_ports(
 223                 thread,
 224                 EXC_MASK_ARITHMETIC,
 225                 exc_port,
 226                 EXCEPTION_STATE | MACH_EXCEPTION_CODES,
 227                 ARM_THREAD_STATE64);
 228         T_ASSERT_MACH_SUCCESS(kr, "Set the exception port to my custom handler");
 229
 230         /* Spawn the exception server's thread. */
 231         int err = pthread_create(&exc_thread, (pthread_attr_t*)0, exc_server_thread, (void*)&exc_port);
 232         T_ASSERT_POSIX_ZERO(err, "Spawned exception server thread");
 233
 234         /* No need to wait for the exception server to be joined when it exits. */
 235         pthread_detach(exc_thread);
 236
 237         /**
 238          * This should cause a floating point divide-by-zero exception to get triggered.
 239          *
 240          * The kernel shouldn't resume this thread until the mach exception is handled
 241          * by the exception server that was just spawned. The exception handler will
 242          * explicitly increment the PC += 4 to move to the next instruction.
 243          */
 244         float a = 6.5f;
 245         float b = 0.0f;
 246         __asm volatile ("fdiv %s0, %s1, %s2" : "=w" (a) : "w" (a), "w" (b));
 247
 248         if (mach_exc_caught) {
 249                 T_PASS("The expected floating point divide-by-zero exception was caught!");
 250         } else {
 251                 T_FAIL("The floating point divide-by-zero exception was not captured :(");
 252         }
 253 #endif /* __arm64__ */
 254 }