@@ -1,2 +1,5 @@
mangle_pstate_invalid_compat_toggle
mangle_pstate_invalid_daif_bits
+mangle_pstate_invalid_mode_el1
+mangle_pstate_invalid_mode_el2
+mangle_pstate_invalid_mode_el3
new file mode 100644
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (C) 2019 ARM Limited */
+
+#include "test_signals_utils.h"
+#include "testcases.h"
+
+static int mangle_invalid_pstate_run(struct tdescr *td, siginfo_t *si,
+ ucontext_t *uc)
+{
+ ASSERT_GOOD_CONTEXT(uc);
+
+ /*
+ * This config should trigger a SIGSEGV by Kernel
+ * when checking valid_user_regs()
+ */
+ uc->uc_mcontext.pstate &= ~PSR_MODE_MASK;
+ uc->uc_mcontext.pstate |= PSR_MODE_EL1t;
+
+ return 1;
+}
+
+struct tdescr tde = {
+ .sanity_disabled = true,
+ .name = "MANGLE_PSTATE_INVALID_MODE_EL1t",
+ .descr = "Mangling uc_mcontext with INVALID MODE EL1t",
+ .sig_trig = SIGUSR1,
+ .sig_ok = SIGSEGV,
+ .run = mangle_invalid_pstate_run,
+};
new file mode 100644
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (C) 2019 ARM Limited */
+
+#include "test_signals_utils.h"
+#include "testcases.h"
+
+static int mangle_invalid_pstate_run(struct tdescr *td, siginfo_t *si,
+ ucontext_t *uc)
+{
+ ASSERT_GOOD_CONTEXT(uc);
+
+ /*
+ * This config should trigger a SIGSEGV by Kernel
+ * when checking valid_user_regs()
+ */
+ uc->uc_mcontext.pstate &= ~PSR_MODE_MASK;
+ uc->uc_mcontext.pstate |= PSR_MODE_EL2t;
+
+ return 1;
+}
+
+struct tdescr tde = {
+ .sanity_disabled = true,
+ .name = "MANGLE_PSTATE_INVALID_MODE_EL2t",
+ .descr = "Mangling uc_mcontext with INVALID MODE EL2t",
+ .sig_trig = SIGUSR1,
+ .sig_ok = SIGSEGV,
+ .run = mangle_invalid_pstate_run,
+};
new file mode 100644
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/* Copyright (C) 2019 ARM Limited */
+
+#include "test_signals_utils.h"
+#include "testcases.h"
+
+static int mangle_invalid_pstate_run(struct tdescr *td, siginfo_t *si,
+ ucontext_t *uc)
+{
+ ASSERT_GOOD_CONTEXT(uc);
+
+ /*
+ * This config should trigger a SIGSEGV by Kernel
+ * when checking valid_user_regs()
+ */
+ uc->uc_mcontext.pstate &= ~PSR_MODE_MASK;
+ uc->uc_mcontext.pstate |= PSR_MODE_EL3t;
+
+ return 1;
+}
+
+struct tdescr tde = {
+ .sanity_disabled = true,
+ .name = "MANGLE_PSTATE_INVALID_MODE_EL3t",
+ .descr = "Mangling uc_mcontext with INVALID MODE EL3t",
+ .sig_trig = SIGUSR1,
+ .sig_ok = SIGSEGV,
+ .run = mangle_invalid_pstate_run,
+};
Added 3 simple mangle testcases that mess with the ucontext_t from within the sig_handler, trying to toggle PSTATE mode bits to trick the system into switching to EL1/EL2/EL3. Expects SIGSEGV on test PASS. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> --- .../arm64/signal/testcases/.gitignore | 3 ++ .../mangle_pstate_invalid_mode_el1.c | 29 +++++++++++++++++++ .../mangle_pstate_invalid_mode_el2.c | 29 +++++++++++++++++++ .../mangle_pstate_invalid_mode_el3.c | 29 +++++++++++++++++++ 4 files changed, 90 insertions(+) create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pstate_invalid_mode_el1.c create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pstate_invalid_mode_el2.c create mode 100644 tools/testing/selftests/arm64/signal/testcases/mangle_pstate_invalid_mode_el3.c