tests/exc_helpers.c

   1 /*
   2  * Copyright (c) 2019 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include "exc_helpers.h"
  30
  31 #include <darwintest.h>
  32 #include <ptrauth.h>
  33
  34 #if __arm64__
  35 #define EXCEPTION_THREAD_STATE          ARM_THREAD_STATE64
  36 #define EXCEPTION_THREAD_STATE_COUNT    ARM_THREAD_STATE64_COUNT
  37 #elif __arm__
  38 #define EXCEPTION_THREAD_STATE          ARM_THREAD_STATE
  39 #define EXCEPTION_THREAD_STATE_COUNT    ARM_THREAD_STATE_COUNT
  40 #elif __x86_64__
  41 #define EXCEPTION_THREAD_STATE          x86_THREAD_STATE
  42 #define EXCEPTION_THREAD_STATE_COUNT    x86_THREAD_STATE_COUNT
  43 #else
  44 #error Unsupported architecture
  45 #endif
  46
  47 /**
  48  * mach_exc_server() is a MIG-generated function that verifies the message
  49  * that was received is indeed a mach exception and then calls
  50  * catch_mach_exception_raise_state() to handle the exception.
  51  */
  52 extern boolean_t mach_exc_server(mach_msg_header_t *, mach_msg_header_t *);
  53
  54 extern kern_return_t
  55 catch_mach_exception_raise(
  56         mach_port_t exception_port,
  57         mach_port_t thread,
  58         mach_port_t task,
  59         exception_type_t type,
  60         exception_data_t codes,
  61         mach_msg_type_number_t code_count);
  62
  63 extern kern_return_t
  64 catch_mach_exception_raise_state(
  65         mach_port_t exception_port,
  66         exception_type_t type,
  67         exception_data_t codes,
  68         mach_msg_type_number_t code_count,
  69         int *flavor,
  70         thread_state_t in_state,
  71         mach_msg_type_number_t in_state_count,
  72         thread_state_t out_state,
  73         mach_msg_type_number_t *out_state_count);
  74
  75 extern kern_return_t
  76 catch_mach_exception_raise_state_identity(
  77         mach_port_t exception_port,
  78         mach_port_t thread,
  79         mach_port_t task,
  80         exception_type_t type,
  81         exception_data_t codes,
  82         mach_msg_type_number_t code_count,
  83         int *flavor,
  84         thread_state_t in_state,
  85         mach_msg_type_number_t in_state_count,
  86         thread_state_t out_state,
  87         mach_msg_type_number_t *out_state_count);
  88
  89 static exc_handler_callback_t exc_handler_callback;
  90
  91 /**
  92  * This has to be defined for linking purposes, but it's unused.
  93  */
  94 kern_return_t
  95 catch_mach_exception_raise(
  96         mach_port_t exception_port,
  97         mach_port_t thread,
  98         mach_port_t task,
  99         exception_type_t type,
 100         exception_data_t codes,
 101         mach_msg_type_number_t code_count)
 102 {
 103 #pragma unused(exception_port, thread, task, type, codes, code_count)
 104         T_FAIL("Triggered catch_mach_exception_raise() which shouldn't happen...");
 105         __builtin_unreachable();
 106 }
 107
 108 /**
 109  * This has to be defined for linking purposes, but it's unused.
 110  */
 111 kern_return_t
 112 catch_mach_exception_raise_state(
 113         mach_port_t exception_port,
 114         exception_type_t type,
 115         exception_data_t codes,
 116         mach_msg_type_number_t code_count,
 117         int *flavor,
 118         thread_state_t in_state,
 119         mach_msg_type_number_t in_state_count,
 120         thread_state_t out_state,
 121         mach_msg_type_number_t *out_state_count)
 122 {
 123 #pragma unused(exception_port, type, codes, code_count, flavor, in_state, in_state_count, out_state, out_state_count)
 124         T_FAIL("Triggered catch_mach_exception_raise_state() which shouldn't happen...");
 125         __builtin_unreachable();
 126 }
 127
 128 /**
 129  * Called by mach_exc_server() to handle the exception. This will call the
 130  * test's exception-handler callback and will then modify
 131  * the thread state to move to the next instruction.
 132  */
 133 kern_return_t
 134 catch_mach_exception_raise_state_identity(
 135         mach_port_t exception_port __unused,
 136         mach_port_t thread,
 137         mach_port_t task,
 138         exception_type_t type,
 139         exception_data_t codes,
 140         mach_msg_type_number_t code_count,
 141         int *flavor,
 142         thread_state_t in_state,
 143         mach_msg_type_number_t in_state_count,
 144         thread_state_t out_state,
 145         mach_msg_type_number_t *out_state_count)
 146 {
 147         T_LOG("Caught a mach exception!\n");
 148
 149         /* There should only be two code values. */
 150         T_ASSERT_EQ(code_count, 2, "Two code values were provided with the mach exception");
 151
 152         /**
 153          * The code values should be 64-bit since MACH_EXCEPTION_CODES was specified
 154          * when setting the exception port.
 155          */
 156         mach_exception_data_t codes_64 = (mach_exception_data_t)(void *)codes;
 157         T_LOG("Mach exception codes[0]: %#llx, codes[1]: %#llx\n", codes_64[0], codes_64[1]);
 158
 159         /* Verify that we're receiving the expected thread state flavor. */
 160         T_ASSERT_EQ(*flavor, EXCEPTION_THREAD_STATE, "The thread state flavor is EXCEPTION_THREAD_STATE");
 161         T_ASSERT_EQ(in_state_count, EXCEPTION_THREAD_STATE_COUNT, "The thread state count is EXCEPTION_THREAD_STATE_COUNT");
 162
 163         size_t advance_pc = exc_handler_callback(task, thread, type, codes_64);
 164
 165         /**
 166          * Increment the PC by the requested amount so the thread doesn't cause
 167          * another exception when it resumes.
 168          */
 169         *out_state_count = in_state_count; /* size of state object in 32-bit words */
 170         memcpy((void*)out_state, (void*)in_state, in_state_count * 4);
 171
 172 #if __arm64__
 173         arm_thread_state64_t *state = (arm_thread_state64_t*)(void *)out_state;
 174
 175         void *pc = (void*)(arm_thread_state64_get_pc(*state) + advance_pc);
 176         /* Have to sign the new PC value when pointer authentication is enabled. */
 177         pc = ptrauth_sign_unauthenticated(pc, ptrauth_key_function_pointer, 0);
 178         arm_thread_state64_set_pc_fptr(*state, pc);
 179 #else
 180         (void)advance_pc;
 181         T_FAIL("catch_mach_exception_raise_state() not fully implemented on this architecture");
 182         __builtin_unreachable();
 183 #endif
 184
 185         /* Return KERN_SUCCESS to tell the kernel to keep running the victim thread. */
 186         return KERN_SUCCESS;
 187 }
 188
 189 mach_port_t
 190 create_exception_port(exception_mask_t exception_mask)
 191 {
 192         mach_port_t exc_port = MACH_PORT_NULL;
 193         mach_port_t task = mach_task_self();
 194         mach_port_t thread = mach_thread_self();
 195         kern_return_t kr = KERN_SUCCESS;
 196
 197         /* Create the mach port the exception messages will be sent to. */
 198         kr = mach_port_allocate(task, MACH_PORT_RIGHT_RECEIVE, &exc_port);
 199         T_ASSERT_MACH_SUCCESS(kr, "Allocated mach exception port");
 200
 201         /**
 202          * Insert a send right into the exception port that the kernel will use to
 203          * send the exception thread the exception messages.
 204          */
 205         kr = mach_port_insert_right(task, exc_port, exc_port, MACH_MSG_TYPE_MAKE_SEND);
 206         T_ASSERT_MACH_SUCCESS(kr, "Inserted a SEND right into the exception port");
 207
 208         /* Tell the kernel what port to send exceptions to. */
 209         kr = thread_set_exception_ports(
 210                 thread,
 211                 exception_mask,
 212                 exc_port,
 213                 (exception_behavior_t)(EXCEPTION_STATE_IDENTITY | MACH_EXCEPTION_CODES),
 214                 EXCEPTION_THREAD_STATE);
 215         T_ASSERT_MACH_SUCCESS(kr, "Set the exception port to my custom handler");
 216
 217         return exc_port;
 218 }
 219
 220 /**
 221  * Thread to handle the mach exception.
 222  *
 223  * @param arg The exception port to wait for a message on.
 224  */
 225 static void *
 226 exc_server_thread(void *arg)
 227 {
 228         mach_port_t exc_port = (mach_port_t)arg;
 229
 230         /**
 231          * mach_msg_server_once is a helper function provided by libsyscall that
 232          * handles creating mach messages, blocks waiting for a message on the
 233          * exception port, calls mach_exc_server() to handle the exception, and
 234          * sends a reply based on the return value of mach_exc_server().
 235          */
 236 #define MACH_MSG_REPLY_SIZE 4096
 237         kern_return_t kr = mach_msg_server_once(mach_exc_server, MACH_MSG_REPLY_SIZE, exc_port, 0);
 238         T_ASSERT_MACH_SUCCESS(kr, "Received mach exception message");
 239
 240         pthread_exit((void*)0);
 241         __builtin_unreachable();
 242 }
 243
 244 void
 245 run_exception_handler(mach_port_t exc_port, exc_handler_callback_t callback)
 246 {
 247         exc_handler_callback = callback;
 248
 249         pthread_t exc_thread;
 250
 251         /* Spawn the exception server's thread. */
 252         int err = pthread_create(&exc_thread, (pthread_attr_t*)0, exc_server_thread, (void*)(uintptr_t)exc_port);
 253         T_ASSERT_POSIX_ZERO(err, "Spawned exception server thread");
 254
 255         /* No need to wait for the exception server to be joined when it exits. */
 256         pthread_detach(exc_thread);
 257 }