Skip to content

Commit

Permalink
kselftest: arm64: mangle_pstate_invalid_mode_el[123][ht]
Browse files Browse the repository at this point in the history
Add 6 simple mangle testcases that mess with the ucontext_t from within
the signal handler, trying to toggle PSTATE mode bits to trick the system
into switching to EL1/EL2/EL3 using both SP_EL0(t) and SP_ELx(h).
Expects SIGSEGV on test PASS.

Reviewed-by: Dave Martin <[email protected]>
Signed-off-by: Cristian Marussi <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>
  • Loading branch information
freefall75 authored and ctmarinas committed Nov 8, 2019
1 parent 0fc89f0 commit c282098
Show file tree
Hide file tree
Showing 7 changed files with 118 additions and 0 deletions.
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2019 ARM Limited
*
* Try to mangle the ucontext from inside a signal handler, toggling
* the mode bit to escalate exception level: this attempt must be spotted
* by Kernel and the test case is expected to be termninated via SEGV.
*/

#include "test_signals_utils.h"
#include "testcases.h"

#include "mangle_pstate_invalid_mode_template.h"

DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(1h);
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2019 ARM Limited
*
* Try to mangle the ucontext from inside a signal handler, toggling
* the mode bit to escalate exception level: this attempt must be spotted
* by Kernel and the test case is expected to be termninated via SEGV.
*/

#include "test_signals_utils.h"
#include "testcases.h"

#include "mangle_pstate_invalid_mode_template.h"

DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(1t);
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2019 ARM Limited
*
* Try to mangle the ucontext from inside a signal handler, toggling
* the mode bit to escalate exception level: this attempt must be spotted
* by Kernel and the test case is expected to be termninated via SEGV.
*/

#include "test_signals_utils.h"
#include "testcases.h"

#include "mangle_pstate_invalid_mode_template.h"

DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(2h);
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2019 ARM Limited
*
* Try to mangle the ucontext from inside a signal handler, toggling
* the mode bit to escalate exception level: this attempt must be spotted
* by Kernel and the test case is expected to be termninated via SEGV.
*/

#include "test_signals_utils.h"
#include "testcases.h"

#include "mangle_pstate_invalid_mode_template.h"

DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(2t);
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2019 ARM Limited
*
* Try to mangle the ucontext from inside a signal handler, toggling
* the mode bit to escalate exception level: this attempt must be spotted
* by Kernel and the test case is expected to be termninated via SEGV.
*/

#include "test_signals_utils.h"
#include "testcases.h"

#include "mangle_pstate_invalid_mode_template.h"

DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(3h);
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
// SPDX-License-Identifier: GPL-2.0
/*
* Copyright (C) 2019 ARM Limited
*
* Try to mangle the ucontext from inside a signal handler, toggling
* the mode bit to escalate exception level: this attempt must be spotted
* by Kernel and the test case is expected to be termninated via SEGV.
*/

#include "test_signals_utils.h"
#include "testcases.h"

#include "mangle_pstate_invalid_mode_template.h"

DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(3t);
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
/* SPDX-License-Identifier: GPL-2.0 */
/*
* Copyright (C) 2019 ARM Limited
*
* Utility macro to ease definition of testcases toggling mode EL
*/

#define DEFINE_TESTCASE_MANGLE_PSTATE_INVALID_MODE(_mode) \
\
static int mangle_invalid_pstate_run(struct tdescr *td, siginfo_t *si, \
ucontext_t *uc) \
{ \
ASSERT_GOOD_CONTEXT(uc); \
\
uc->uc_mcontext.pstate &= ~PSR_MODE_MASK; \
uc->uc_mcontext.pstate |= PSR_MODE_EL ## _mode; \
\
return 1; \
} \
\
struct tdescr tde = { \
.sanity_disabled = true, \
.name = "MANGLE_PSTATE_INVALID_MODE_EL"#_mode, \
.descr = "Mangling uc_mcontext INVALID MODE EL"#_mode, \
.sig_trig = SIGUSR1, \
.sig_ok = SIGSEGV, \
.run = mangle_invalid_pstate_run, \
}

0 comments on commit c282098

Please sign in to comment.