tests: arm: validate arm PAC with pseudo rng

Add tests to validate pointer authentication code (PAC) in 2 scenarios:
1. when the PAC key itself is corrupted
2. when lr is corrupted on stack

Signed-off-by: Sudan Landge <[email protected]>

Author: wearyzen

tests/arch/arm/arm_pacbti/prj.conf

@@ -1,2 +1,6 @@
 CONFIG_ZTEST=y
 CONFIG_ZTEST_FATAL_HOOK=y
+
+CONFIG_TEST_RANDOM_GENERATOR=y
+CONFIG_TIMER_RANDOM_INITIAL_STATE=123456789
+CONFIG_TIMER_RANDOM_GENERATOR=y

tests/arch/arm/arm_pacbti/src/main.c

@@ -16,6 +16,57 @@ void test_arm_pacbti(void)
 	ztest_test_fail();
 }
 
+/* Without PAC this function would have returned to test_arm_pacbti() but with PAC enabled
+ * the AUT instruction should result in a USAGE FAULT since the `lr` was corrupted on stack.
+ */
+__asm__ (".thumb\n"
+	 ".thumb_func\n"
+	 ".global corrupt_lr_on_stack\n"
+	 "corrupt_lr_on_stack:\n"
+	 "    pacbti r12, lr, sp\n"
+	 "    stmdb sp!, {ip, lr}\n"
+	 "    ldr r0,=test_arm_pacbti\n"
+	 "    str r0, [sp, #4]\n"
+	 "    ldmia.w sp!, {ip, lr}\n"
+	 "    aut r12, lr, sp\n"
+	 "    bx lr\n");
+void corrupt_lr_on_stack();
+
+static int set_invalid_pac_key(void)
+{
+	struct pac_keys test_pac_keys = {0};
+
+	__get_PAC_KEY_P((uint32_t *)&test_pac_keys);
+
+	/* Change PAC KEY for the current thread */
+	test_pac_keys.key_0 += 1;
+	test_pac_keys.key_1 += 1;
+	test_pac_keys.key_2 += 1;
+	test_pac_keys.key_3 += 1;
+
+	__set_PAC_KEY_P((uint32_t *)&test_pac_keys);
+
+	/* The AUT instruction before this test returns should now result in a USAGE FAULT */
+	return 1;
+}
+
+ZTEST(arm_pacbti, test_arm_pac_corrupt_lr)
+{
+	ztest_set_fault_valid(true);
+
+	corrupt_lr_on_stack();
+}
+
+ZTEST(arm_pacbti, test_arm_pac_invalid_key)
+{
+	ztest_set_fault_valid(true);
+
+	if (set_invalid_pac_key()) {
+		printf("set_invalid_pac_key should never have returned if AUT was enforced\n");
+		ztest_test_fail();
+	}
+}
+
 ZTEST(arm_pacbti, test_arm_bti)
 {
 	/* Try jumping to middle of a random function and mark that fault as expected because if

tests/arch/arm/arm_pacbti/testcase.yaml

@@ -12,3 +12,4 @@ tests:
     skip: true
     extra_configs:
       - CONFIG_ARM_PACBTI_STANDARD=y
+      - CONFIG_ARM_PAC_PER_THREAD=y