1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Based on arch/arm/kernel/ptrace.c 4 * 5 * By Ross Biro 1/23/92 6 * edited by Linus Torvalds 7 * ARM modifications Copyright (C) 2000 Russell King 8 * Copyright (C) 2012 ARM Ltd. 9 */ 10 11 #include <linux/audit.h> 12 #include <linux/compat.h> 13 #include <linux/kernel.h> 14 #include <linux/sched/signal.h> 15 #include <linux/sched/task_stack.h> 16 #include <linux/mm.h> 17 #include <linux/nospec.h> 18 #include <linux/smp.h> 19 #include <linux/ptrace.h> 20 #include <linux/user.h> 21 #include <linux/seccomp.h> 22 #include <linux/security.h> 23 #include <linux/init.h> 24 #include <linux/signal.h> 25 #include <linux/string.h> 26 #include <linux/uaccess.h> 27 #include <linux/perf_event.h> 28 #include <linux/hw_breakpoint.h> 29 #include <linux/regset.h> 30 #include <linux/tracehook.h> 31 #include <linux/elf.h> 32 33 #include <asm/compat.h> 34 #include <asm/cpufeature.h> 35 #include <asm/debug-monitors.h> 36 #include <asm/fpsimd.h> 37 #include <asm/mte.h> 38 #include <asm/pointer_auth.h> 39 #include <asm/stacktrace.h> 40 #include <asm/syscall.h> 41 #include <asm/traps.h> 42 #include <asm/system_misc.h> 43 44 #define CREATE_TRACE_POINTS 45 #include <trace/events/syscalls.h> 46 47 struct pt_regs_offset { 48 const char *name; 49 int offset; 50 }; 51 52 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 53 #define REG_OFFSET_END {.name = NULL, .offset = 0} 54 #define GPR_OFFSET_NAME(r) \ 55 {.name = "x" #r, .offset = offsetof(struct pt_regs, regs[r])} 56 57 static const struct pt_regs_offset regoffset_table[] = { 58 GPR_OFFSET_NAME(0), 59 GPR_OFFSET_NAME(1), 60 GPR_OFFSET_NAME(2), 61 GPR_OFFSET_NAME(3), 62 GPR_OFFSET_NAME(4), 63 GPR_OFFSET_NAME(5), 64 GPR_OFFSET_NAME(6), 65 GPR_OFFSET_NAME(7), 66 GPR_OFFSET_NAME(8), 67 GPR_OFFSET_NAME(9), 68 GPR_OFFSET_NAME(10), 69 GPR_OFFSET_NAME(11), 70 GPR_OFFSET_NAME(12), 71 GPR_OFFSET_NAME(13), 72 GPR_OFFSET_NAME(14), 73 GPR_OFFSET_NAME(15), 74 GPR_OFFSET_NAME(16), 75 GPR_OFFSET_NAME(17), 76 GPR_OFFSET_NAME(18), 77 GPR_OFFSET_NAME(19), 78 GPR_OFFSET_NAME(20), 79 GPR_OFFSET_NAME(21), 80 GPR_OFFSET_NAME(22), 81 GPR_OFFSET_NAME(23), 82 GPR_OFFSET_NAME(24), 83 GPR_OFFSET_NAME(25), 84 GPR_OFFSET_NAME(26), 85 GPR_OFFSET_NAME(27), 86 GPR_OFFSET_NAME(28), 87 GPR_OFFSET_NAME(29), 88 GPR_OFFSET_NAME(30), 89 {.name = "lr", .offset = offsetof(struct pt_regs, regs[30])}, 90 REG_OFFSET_NAME(sp), 91 REG_OFFSET_NAME(pc), 92 REG_OFFSET_NAME(pstate), 93 REG_OFFSET_END, 94 }; 95 96 /** 97 * regs_query_register_offset() - query register offset from its name 98 * @name: the name of a register 99 * 100 * regs_query_register_offset() returns the offset of a register in struct 101 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 102 */ 103 int regs_query_register_offset(const char *name) 104 { 105 const struct pt_regs_offset *roff; 106 107 for (roff = regoffset_table; roff->name != NULL; roff++) 108 if (!strcmp(roff->name, name)) 109 return roff->offset; 110 return -EINVAL; 111 } 112 113 /** 114 * regs_within_kernel_stack() - check the address in the stack 115 * @regs: pt_regs which contains kernel stack pointer. 116 * @addr: address which is checked. 117 * 118 * regs_within_kernel_stack() checks @addr is within the kernel stack page(s). 119 * If @addr is within the kernel stack, it returns true. If not, returns false. 120 */ 121 static bool regs_within_kernel_stack(struct pt_regs *regs, unsigned long addr) 122 { 123 return ((addr & ~(THREAD_SIZE - 1)) == 124 (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1))) || 125 on_irq_stack(addr, NULL); 126 } 127 128 /** 129 * regs_get_kernel_stack_nth() - get Nth entry of the stack 130 * @regs: pt_regs which contains kernel stack pointer. 131 * @n: stack entry number. 132 * 133 * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which 134 * is specified by @regs. If the @n th entry is NOT in the kernel stack, 135 * this returns 0. 136 */ 137 unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n) 138 { 139 unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs); 140 141 addr += n; 142 if (regs_within_kernel_stack(regs, (unsigned long)addr)) 143 return *addr; 144 else 145 return 0; 146 } 147 148 /* 149 * TODO: does not yet catch signals sent when the child dies. 150 * in exit.c or in signal.c. 151 */ 152 153 /* 154 * Called by kernel/ptrace.c when detaching.. 155 */ 156 void ptrace_disable(struct task_struct *child) 157 { 158 /* 159 * This would be better off in core code, but PTRACE_DETACH has 160 * grown its fair share of arch-specific worts and changing it 161 * is likely to cause regressions on obscure architectures. 162 */ 163 user_disable_single_step(child); 164 } 165 166 #ifdef CONFIG_HAVE_HW_BREAKPOINT 167 /* 168 * Handle hitting a HW-breakpoint. 169 */ 170 static void ptrace_hbptriggered(struct perf_event *bp, 171 struct perf_sample_data *data, 172 struct pt_regs *regs) 173 { 174 struct arch_hw_breakpoint *bkpt = counter_arch_bp(bp); 175 const char *desc = "Hardware breakpoint trap (ptrace)"; 176 177 #ifdef CONFIG_COMPAT 178 if (is_compat_task()) { 179 int si_errno = 0; 180 int i; 181 182 for (i = 0; i < ARM_MAX_BRP; ++i) { 183 if (current->thread.debug.hbp_break[i] == bp) { 184 si_errno = (i << 1) + 1; 185 break; 186 } 187 } 188 189 for (i = 0; i < ARM_MAX_WRP; ++i) { 190 if (current->thread.debug.hbp_watch[i] == bp) { 191 si_errno = -((i << 1) + 1); 192 break; 193 } 194 } 195 arm64_force_sig_ptrace_errno_trap(si_errno, bkpt->trigger, 196 desc); 197 return; 198 } 199 #endif 200 arm64_force_sig_fault(SIGTRAP, TRAP_HWBKPT, bkpt->trigger, desc); 201 } 202 203 /* 204 * Unregister breakpoints from this task and reset the pointers in 205 * the thread_struct. 206 */ 207 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 208 { 209 int i; 210 struct thread_struct *t = &tsk->thread; 211 212 for (i = 0; i < ARM_MAX_BRP; i++) { 213 if (t->debug.hbp_break[i]) { 214 unregister_hw_breakpoint(t->debug.hbp_break[i]); 215 t->debug.hbp_break[i] = NULL; 216 } 217 } 218 219 for (i = 0; i < ARM_MAX_WRP; i++) { 220 if (t->debug.hbp_watch[i]) { 221 unregister_hw_breakpoint(t->debug.hbp_watch[i]); 222 t->debug.hbp_watch[i] = NULL; 223 } 224 } 225 } 226 227 void ptrace_hw_copy_thread(struct task_struct *tsk) 228 { 229 memset(&tsk->thread.debug, 0, sizeof(struct debug_info)); 230 } 231 232 static struct perf_event *ptrace_hbp_get_event(unsigned int note_type, 233 struct task_struct *tsk, 234 unsigned long idx) 235 { 236 struct perf_event *bp = ERR_PTR(-EINVAL); 237 238 switch (note_type) { 239 case NT_ARM_HW_BREAK: 240 if (idx >= ARM_MAX_BRP) 241 goto out; 242 idx = array_index_nospec(idx, ARM_MAX_BRP); 243 bp = tsk->thread.debug.hbp_break[idx]; 244 break; 245 case NT_ARM_HW_WATCH: 246 if (idx >= ARM_MAX_WRP) 247 goto out; 248 idx = array_index_nospec(idx, ARM_MAX_WRP); 249 bp = tsk->thread.debug.hbp_watch[idx]; 250 break; 251 } 252 253 out: 254 return bp; 255 } 256 257 static int ptrace_hbp_set_event(unsigned int note_type, 258 struct task_struct *tsk, 259 unsigned long idx, 260 struct perf_event *bp) 261 { 262 int err = -EINVAL; 263 264 switch (note_type) { 265 case NT_ARM_HW_BREAK: 266 if (idx >= ARM_MAX_BRP) 267 goto out; 268 idx = array_index_nospec(idx, ARM_MAX_BRP); 269 tsk->thread.debug.hbp_break[idx] = bp; 270 err = 0; 271 break; 272 case NT_ARM_HW_WATCH: 273 if (idx >= ARM_MAX_WRP) 274 goto out; 275 idx = array_index_nospec(idx, ARM_MAX_WRP); 276 tsk->thread.debug.hbp_watch[idx] = bp; 277 err = 0; 278 break; 279 } 280 281 out: 282 return err; 283 } 284 285 static struct perf_event *ptrace_hbp_create(unsigned int note_type, 286 struct task_struct *tsk, 287 unsigned long idx) 288 { 289 struct perf_event *bp; 290 struct perf_event_attr attr; 291 int err, type; 292 293 switch (note_type) { 294 case NT_ARM_HW_BREAK: 295 type = HW_BREAKPOINT_X; 296 break; 297 case NT_ARM_HW_WATCH: 298 type = HW_BREAKPOINT_RW; 299 break; 300 default: 301 return ERR_PTR(-EINVAL); 302 } 303 304 ptrace_breakpoint_init(&attr); 305 306 /* 307 * Initialise fields to sane defaults 308 * (i.e. values that will pass validation). 309 */ 310 attr.bp_addr = 0; 311 attr.bp_len = HW_BREAKPOINT_LEN_4; 312 attr.bp_type = type; 313 attr.disabled = 1; 314 315 bp = register_user_hw_breakpoint(&attr, ptrace_hbptriggered, NULL, tsk); 316 if (IS_ERR(bp)) 317 return bp; 318 319 err = ptrace_hbp_set_event(note_type, tsk, idx, bp); 320 if (err) 321 return ERR_PTR(err); 322 323 return bp; 324 } 325 326 static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type, 327 struct arch_hw_breakpoint_ctrl ctrl, 328 struct perf_event_attr *attr) 329 { 330 int err, len, type, offset, disabled = !ctrl.enabled; 331 332 attr->disabled = disabled; 333 if (disabled) 334 return 0; 335 336 err = arch_bp_generic_fields(ctrl, &len, &type, &offset); 337 if (err) 338 return err; 339 340 switch (note_type) { 341 case NT_ARM_HW_BREAK: 342 if ((type & HW_BREAKPOINT_X) != type) 343 return -EINVAL; 344 break; 345 case NT_ARM_HW_WATCH: 346 if ((type & HW_BREAKPOINT_RW) != type) 347 return -EINVAL; 348 break; 349 default: 350 return -EINVAL; 351 } 352 353 attr->bp_len = len; 354 attr->bp_type = type; 355 attr->bp_addr += offset; 356 357 return 0; 358 } 359 360 static int ptrace_hbp_get_resource_info(unsigned int note_type, u32 *info) 361 { 362 u8 num; 363 u32 reg = 0; 364 365 switch (note_type) { 366 case NT_ARM_HW_BREAK: 367 num = hw_breakpoint_slots(TYPE_INST); 368 break; 369 case NT_ARM_HW_WATCH: 370 num = hw_breakpoint_slots(TYPE_DATA); 371 break; 372 default: 373 return -EINVAL; 374 } 375 376 reg |= debug_monitors_arch(); 377 reg <<= 8; 378 reg |= num; 379 380 *info = reg; 381 return 0; 382 } 383 384 static int ptrace_hbp_get_ctrl(unsigned int note_type, 385 struct task_struct *tsk, 386 unsigned long idx, 387 u32 *ctrl) 388 { 389 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 390 391 if (IS_ERR(bp)) 392 return PTR_ERR(bp); 393 394 *ctrl = bp ? encode_ctrl_reg(counter_arch_bp(bp)->ctrl) : 0; 395 return 0; 396 } 397 398 static int ptrace_hbp_get_addr(unsigned int note_type, 399 struct task_struct *tsk, 400 unsigned long idx, 401 u64 *addr) 402 { 403 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 404 405 if (IS_ERR(bp)) 406 return PTR_ERR(bp); 407 408 *addr = bp ? counter_arch_bp(bp)->address : 0; 409 return 0; 410 } 411 412 static struct perf_event *ptrace_hbp_get_initialised_bp(unsigned int note_type, 413 struct task_struct *tsk, 414 unsigned long idx) 415 { 416 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 417 418 if (!bp) 419 bp = ptrace_hbp_create(note_type, tsk, idx); 420 421 return bp; 422 } 423 424 static int ptrace_hbp_set_ctrl(unsigned int note_type, 425 struct task_struct *tsk, 426 unsigned long idx, 427 u32 uctrl) 428 { 429 int err; 430 struct perf_event *bp; 431 struct perf_event_attr attr; 432 struct arch_hw_breakpoint_ctrl ctrl; 433 434 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); 435 if (IS_ERR(bp)) { 436 err = PTR_ERR(bp); 437 return err; 438 } 439 440 attr = bp->attr; 441 decode_ctrl_reg(uctrl, &ctrl); 442 err = ptrace_hbp_fill_attr_ctrl(note_type, ctrl, &attr); 443 if (err) 444 return err; 445 446 return modify_user_hw_breakpoint(bp, &attr); 447 } 448 449 static int ptrace_hbp_set_addr(unsigned int note_type, 450 struct task_struct *tsk, 451 unsigned long idx, 452 u64 addr) 453 { 454 int err; 455 struct perf_event *bp; 456 struct perf_event_attr attr; 457 458 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); 459 if (IS_ERR(bp)) { 460 err = PTR_ERR(bp); 461 return err; 462 } 463 464 attr = bp->attr; 465 attr.bp_addr = addr; 466 err = modify_user_hw_breakpoint(bp, &attr); 467 return err; 468 } 469 470 #define PTRACE_HBP_ADDR_SZ sizeof(u64) 471 #define PTRACE_HBP_CTRL_SZ sizeof(u32) 472 #define PTRACE_HBP_PAD_SZ sizeof(u32) 473 474 static int hw_break_get(struct task_struct *target, 475 const struct user_regset *regset, 476 struct membuf to) 477 { 478 unsigned int note_type = regset->core_note_type; 479 int ret, idx = 0; 480 u32 info, ctrl; 481 u64 addr; 482 483 /* Resource info */ 484 ret = ptrace_hbp_get_resource_info(note_type, &info); 485 if (ret) 486 return ret; 487 488 membuf_write(&to, &info, sizeof(info)); 489 membuf_zero(&to, sizeof(u32)); 490 /* (address, ctrl) registers */ 491 while (to.left) { 492 ret = ptrace_hbp_get_addr(note_type, target, idx, &addr); 493 if (ret) 494 return ret; 495 ret = ptrace_hbp_get_ctrl(note_type, target, idx, &ctrl); 496 if (ret) 497 return ret; 498 membuf_store(&to, addr); 499 membuf_store(&to, ctrl); 500 membuf_zero(&to, sizeof(u32)); 501 idx++; 502 } 503 return 0; 504 } 505 506 static int hw_break_set(struct task_struct *target, 507 const struct user_regset *regset, 508 unsigned int pos, unsigned int count, 509 const void *kbuf, const void __user *ubuf) 510 { 511 unsigned int note_type = regset->core_note_type; 512 int ret, idx = 0, offset, limit; 513 u32 ctrl; 514 u64 addr; 515 516 /* Resource info and pad */ 517 offset = offsetof(struct user_hwdebug_state, dbg_regs); 518 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 0, offset); 519 if (ret) 520 return ret; 521 522 /* (address, ctrl) registers */ 523 limit = regset->n * regset->size; 524 while (count && offset < limit) { 525 if (count < PTRACE_HBP_ADDR_SZ) 526 return -EINVAL; 527 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &addr, 528 offset, offset + PTRACE_HBP_ADDR_SZ); 529 if (ret) 530 return ret; 531 ret = ptrace_hbp_set_addr(note_type, target, idx, addr); 532 if (ret) 533 return ret; 534 offset += PTRACE_HBP_ADDR_SZ; 535 536 if (!count) 537 break; 538 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 539 offset, offset + PTRACE_HBP_CTRL_SZ); 540 if (ret) 541 return ret; 542 ret = ptrace_hbp_set_ctrl(note_type, target, idx, ctrl); 543 if (ret) 544 return ret; 545 offset += PTRACE_HBP_CTRL_SZ; 546 547 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 548 offset, 549 offset + PTRACE_HBP_PAD_SZ); 550 if (ret) 551 return ret; 552 offset += PTRACE_HBP_PAD_SZ; 553 idx++; 554 } 555 556 return 0; 557 } 558 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 559 560 static int gpr_get(struct task_struct *target, 561 const struct user_regset *regset, 562 struct membuf to) 563 { 564 struct user_pt_regs *uregs = &task_pt_regs(target)->user_regs; 565 return membuf_write(&to, uregs, sizeof(*uregs)); 566 } 567 568 static int gpr_set(struct task_struct *target, const struct user_regset *regset, 569 unsigned int pos, unsigned int count, 570 const void *kbuf, const void __user *ubuf) 571 { 572 int ret; 573 struct user_pt_regs newregs = task_pt_regs(target)->user_regs; 574 575 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs, 0, -1); 576 if (ret) 577 return ret; 578 579 if (!valid_user_regs(&newregs, target)) 580 return -EINVAL; 581 582 task_pt_regs(target)->user_regs = newregs; 583 return 0; 584 } 585 586 static int fpr_active(struct task_struct *target, const struct user_regset *regset) 587 { 588 if (!system_supports_fpsimd()) 589 return -ENODEV; 590 return regset->n; 591 } 592 593 /* 594 * TODO: update fp accessors for lazy context switching (sync/flush hwstate) 595 */ 596 static int __fpr_get(struct task_struct *target, 597 const struct user_regset *regset, 598 struct membuf to) 599 { 600 struct user_fpsimd_state *uregs; 601 602 sve_sync_to_fpsimd(target); 603 604 uregs = &target->thread.uw.fpsimd_state; 605 606 return membuf_write(&to, uregs, sizeof(*uregs)); 607 } 608 609 static int fpr_get(struct task_struct *target, const struct user_regset *regset, 610 struct membuf to) 611 { 612 if (!system_supports_fpsimd()) 613 return -EINVAL; 614 615 if (target == current) 616 fpsimd_preserve_current_state(); 617 618 return __fpr_get(target, regset, to); 619 } 620 621 static int __fpr_set(struct task_struct *target, 622 const struct user_regset *regset, 623 unsigned int pos, unsigned int count, 624 const void *kbuf, const void __user *ubuf, 625 unsigned int start_pos) 626 { 627 int ret; 628 struct user_fpsimd_state newstate; 629 630 /* 631 * Ensure target->thread.uw.fpsimd_state is up to date, so that a 632 * short copyin can't resurrect stale data. 633 */ 634 sve_sync_to_fpsimd(target); 635 636 newstate = target->thread.uw.fpsimd_state; 637 638 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newstate, 639 start_pos, start_pos + sizeof(newstate)); 640 if (ret) 641 return ret; 642 643 target->thread.uw.fpsimd_state = newstate; 644 645 return ret; 646 } 647 648 static int fpr_set(struct task_struct *target, const struct user_regset *regset, 649 unsigned int pos, unsigned int count, 650 const void *kbuf, const void __user *ubuf) 651 { 652 int ret; 653 654 if (!system_supports_fpsimd()) 655 return -EINVAL; 656 657 ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 0); 658 if (ret) 659 return ret; 660 661 sve_sync_from_fpsimd_zeropad(target); 662 fpsimd_flush_task_state(target); 663 664 return ret; 665 } 666 667 static int tls_get(struct task_struct *target, const struct user_regset *regset, 668 struct membuf to) 669 { 670 if (target == current) 671 tls_preserve_current_state(); 672 673 return membuf_store(&to, target->thread.uw.tp_value); 674 } 675 676 static int tls_set(struct task_struct *target, const struct user_regset *regset, 677 unsigned int pos, unsigned int count, 678 const void *kbuf, const void __user *ubuf) 679 { 680 int ret; 681 unsigned long tls = target->thread.uw.tp_value; 682 683 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); 684 if (ret) 685 return ret; 686 687 target->thread.uw.tp_value = tls; 688 return ret; 689 } 690 691 static int system_call_get(struct task_struct *target, 692 const struct user_regset *regset, 693 struct membuf to) 694 { 695 return membuf_store(&to, task_pt_regs(target)->syscallno); 696 } 697 698 static int system_call_set(struct task_struct *target, 699 const struct user_regset *regset, 700 unsigned int pos, unsigned int count, 701 const void *kbuf, const void __user *ubuf) 702 { 703 int syscallno = task_pt_regs(target)->syscallno; 704 int ret; 705 706 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &syscallno, 0, -1); 707 if (ret) 708 return ret; 709 710 task_pt_regs(target)->syscallno = syscallno; 711 return ret; 712 } 713 714 #ifdef CONFIG_ARM64_SVE 715 716 static void sve_init_header_from_task(struct user_sve_header *header, 717 struct task_struct *target) 718 { 719 unsigned int vq; 720 721 memset(header, 0, sizeof(*header)); 722 723 header->flags = test_tsk_thread_flag(target, TIF_SVE) ? 724 SVE_PT_REGS_SVE : SVE_PT_REGS_FPSIMD; 725 if (test_tsk_thread_flag(target, TIF_SVE_VL_INHERIT)) 726 header->flags |= SVE_PT_VL_INHERIT; 727 728 header->vl = target->thread.sve_vl; 729 vq = sve_vq_from_vl(header->vl); 730 731 header->max_vl = sve_max_vl; 732 header->size = SVE_PT_SIZE(vq, header->flags); 733 header->max_size = SVE_PT_SIZE(sve_vq_from_vl(header->max_vl), 734 SVE_PT_REGS_SVE); 735 } 736 737 static unsigned int sve_size_from_header(struct user_sve_header const *header) 738 { 739 return ALIGN(header->size, SVE_VQ_BYTES); 740 } 741 742 static int sve_get(struct task_struct *target, 743 const struct user_regset *regset, 744 struct membuf to) 745 { 746 struct user_sve_header header; 747 unsigned int vq; 748 unsigned long start, end; 749 750 if (!system_supports_sve()) 751 return -EINVAL; 752 753 /* Header */ 754 sve_init_header_from_task(&header, target); 755 vq = sve_vq_from_vl(header.vl); 756 757 membuf_write(&to, &header, sizeof(header)); 758 759 if (target == current) 760 fpsimd_preserve_current_state(); 761 762 /* Registers: FPSIMD-only case */ 763 764 BUILD_BUG_ON(SVE_PT_FPSIMD_OFFSET != sizeof(header)); 765 if ((header.flags & SVE_PT_REGS_MASK) == SVE_PT_REGS_FPSIMD) 766 return __fpr_get(target, regset, to); 767 768 /* Otherwise: full SVE case */ 769 770 BUILD_BUG_ON(SVE_PT_SVE_OFFSET != sizeof(header)); 771 start = SVE_PT_SVE_OFFSET; 772 end = SVE_PT_SVE_FFR_OFFSET(vq) + SVE_PT_SVE_FFR_SIZE(vq); 773 membuf_write(&to, target->thread.sve_state, end - start); 774 775 start = end; 776 end = SVE_PT_SVE_FPSR_OFFSET(vq); 777 membuf_zero(&to, end - start); 778 779 /* 780 * Copy fpsr, and fpcr which must follow contiguously in 781 * struct fpsimd_state: 782 */ 783 start = end; 784 end = SVE_PT_SVE_FPCR_OFFSET(vq) + SVE_PT_SVE_FPCR_SIZE; 785 membuf_write(&to, &target->thread.uw.fpsimd_state.fpsr, end - start); 786 787 start = end; 788 end = sve_size_from_header(&header); 789 return membuf_zero(&to, end - start); 790 } 791 792 static int sve_set(struct task_struct *target, 793 const struct user_regset *regset, 794 unsigned int pos, unsigned int count, 795 const void *kbuf, const void __user *ubuf) 796 { 797 int ret; 798 struct user_sve_header header; 799 unsigned int vq; 800 unsigned long start, end; 801 802 if (!system_supports_sve()) 803 return -EINVAL; 804 805 /* Header */ 806 if (count < sizeof(header)) 807 return -EINVAL; 808 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &header, 809 0, sizeof(header)); 810 if (ret) 811 goto out; 812 813 /* 814 * Apart from SVE_PT_REGS_MASK, all SVE_PT_* flags are consumed by 815 * sve_set_vector_length(), which will also validate them for us: 816 */ 817 ret = sve_set_vector_length(target, header.vl, 818 ((unsigned long)header.flags & ~SVE_PT_REGS_MASK) << 16); 819 if (ret) 820 goto out; 821 822 /* Actual VL set may be less than the user asked for: */ 823 vq = sve_vq_from_vl(target->thread.sve_vl); 824 825 /* Registers: FPSIMD-only case */ 826 827 BUILD_BUG_ON(SVE_PT_FPSIMD_OFFSET != sizeof(header)); 828 if ((header.flags & SVE_PT_REGS_MASK) == SVE_PT_REGS_FPSIMD) { 829 ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 830 SVE_PT_FPSIMD_OFFSET); 831 clear_tsk_thread_flag(target, TIF_SVE); 832 goto out; 833 } 834 835 /* Otherwise: full SVE case */ 836 837 /* 838 * If setting a different VL from the requested VL and there is 839 * register data, the data layout will be wrong: don't even 840 * try to set the registers in this case. 841 */ 842 if (count && vq != sve_vq_from_vl(header.vl)) { 843 ret = -EIO; 844 goto out; 845 } 846 847 sve_alloc(target); 848 849 /* 850 * Ensure target->thread.sve_state is up to date with target's 851 * FPSIMD regs, so that a short copyin leaves trailing registers 852 * unmodified. 853 */ 854 fpsimd_sync_to_sve(target); 855 set_tsk_thread_flag(target, TIF_SVE); 856 857 BUILD_BUG_ON(SVE_PT_SVE_OFFSET != sizeof(header)); 858 start = SVE_PT_SVE_OFFSET; 859 end = SVE_PT_SVE_FFR_OFFSET(vq) + SVE_PT_SVE_FFR_SIZE(vq); 860 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 861 target->thread.sve_state, 862 start, end); 863 if (ret) 864 goto out; 865 866 start = end; 867 end = SVE_PT_SVE_FPSR_OFFSET(vq); 868 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 869 start, end); 870 if (ret) 871 goto out; 872 873 /* 874 * Copy fpsr, and fpcr which must follow contiguously in 875 * struct fpsimd_state: 876 */ 877 start = end; 878 end = SVE_PT_SVE_FPCR_OFFSET(vq) + SVE_PT_SVE_FPCR_SIZE; 879 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 880 &target->thread.uw.fpsimd_state.fpsr, 881 start, end); 882 883 out: 884 fpsimd_flush_task_state(target); 885 return ret; 886 } 887 888 #endif /* CONFIG_ARM64_SVE */ 889 890 #ifdef CONFIG_ARM64_PTR_AUTH 891 static int pac_mask_get(struct task_struct *target, 892 const struct user_regset *regset, 893 struct membuf to) 894 { 895 /* 896 * The PAC bits can differ across data and instruction pointers 897 * depending on TCR_EL1.TBID*, which we may make use of in future, so 898 * we expose separate masks. 899 */ 900 unsigned long mask = ptrauth_user_pac_mask(); 901 struct user_pac_mask uregs = { 902 .data_mask = mask, 903 .insn_mask = mask, 904 }; 905 906 if (!system_supports_address_auth()) 907 return -EINVAL; 908 909 return membuf_write(&to, &uregs, sizeof(uregs)); 910 } 911 912 #ifdef CONFIG_CHECKPOINT_RESTORE 913 static __uint128_t pac_key_to_user(const struct ptrauth_key *key) 914 { 915 return (__uint128_t)key->hi << 64 | key->lo; 916 } 917 918 static struct ptrauth_key pac_key_from_user(__uint128_t ukey) 919 { 920 struct ptrauth_key key = { 921 .lo = (unsigned long)ukey, 922 .hi = (unsigned long)(ukey >> 64), 923 }; 924 925 return key; 926 } 927 928 static void pac_address_keys_to_user(struct user_pac_address_keys *ukeys, 929 const struct ptrauth_keys_user *keys) 930 { 931 ukeys->apiakey = pac_key_to_user(&keys->apia); 932 ukeys->apibkey = pac_key_to_user(&keys->apib); 933 ukeys->apdakey = pac_key_to_user(&keys->apda); 934 ukeys->apdbkey = pac_key_to_user(&keys->apdb); 935 } 936 937 static void pac_address_keys_from_user(struct ptrauth_keys_user *keys, 938 const struct user_pac_address_keys *ukeys) 939 { 940 keys->apia = pac_key_from_user(ukeys->apiakey); 941 keys->apib = pac_key_from_user(ukeys->apibkey); 942 keys->apda = pac_key_from_user(ukeys->apdakey); 943 keys->apdb = pac_key_from_user(ukeys->apdbkey); 944 } 945 946 static int pac_address_keys_get(struct task_struct *target, 947 const struct user_regset *regset, 948 struct membuf to) 949 { 950 struct ptrauth_keys_user *keys = &target->thread.keys_user; 951 struct user_pac_address_keys user_keys; 952 953 if (!system_supports_address_auth()) 954 return -EINVAL; 955 956 pac_address_keys_to_user(&user_keys, keys); 957 958 return membuf_write(&to, &user_keys, sizeof(user_keys)); 959 } 960 961 static int pac_address_keys_set(struct task_struct *target, 962 const struct user_regset *regset, 963 unsigned int pos, unsigned int count, 964 const void *kbuf, const void __user *ubuf) 965 { 966 struct ptrauth_keys_user *keys = &target->thread.keys_user; 967 struct user_pac_address_keys user_keys; 968 int ret; 969 970 if (!system_supports_address_auth()) 971 return -EINVAL; 972 973 pac_address_keys_to_user(&user_keys, keys); 974 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 975 &user_keys, 0, -1); 976 if (ret) 977 return ret; 978 pac_address_keys_from_user(keys, &user_keys); 979 980 return 0; 981 } 982 983 static void pac_generic_keys_to_user(struct user_pac_generic_keys *ukeys, 984 const struct ptrauth_keys_user *keys) 985 { 986 ukeys->apgakey = pac_key_to_user(&keys->apga); 987 } 988 989 static void pac_generic_keys_from_user(struct ptrauth_keys_user *keys, 990 const struct user_pac_generic_keys *ukeys) 991 { 992 keys->apga = pac_key_from_user(ukeys->apgakey); 993 } 994 995 static int pac_generic_keys_get(struct task_struct *target, 996 const struct user_regset *regset, 997 struct membuf to) 998 { 999 struct ptrauth_keys_user *keys = &target->thread.keys_user; 1000 struct user_pac_generic_keys user_keys; 1001 1002 if (!system_supports_generic_auth()) 1003 return -EINVAL; 1004 1005 pac_generic_keys_to_user(&user_keys, keys); 1006 1007 return membuf_write(&to, &user_keys, sizeof(user_keys)); 1008 } 1009 1010 static int pac_generic_keys_set(struct task_struct *target, 1011 const struct user_regset *regset, 1012 unsigned int pos, unsigned int count, 1013 const void *kbuf, const void __user *ubuf) 1014 { 1015 struct ptrauth_keys_user *keys = &target->thread.keys_user; 1016 struct user_pac_generic_keys user_keys; 1017 int ret; 1018 1019 if (!system_supports_generic_auth()) 1020 return -EINVAL; 1021 1022 pac_generic_keys_to_user(&user_keys, keys); 1023 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 1024 &user_keys, 0, -1); 1025 if (ret) 1026 return ret; 1027 pac_generic_keys_from_user(keys, &user_keys); 1028 1029 return 0; 1030 } 1031 #endif /* CONFIG_CHECKPOINT_RESTORE */ 1032 #endif /* CONFIG_ARM64_PTR_AUTH */ 1033 1034 #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI 1035 static int tagged_addr_ctrl_get(struct task_struct *target, 1036 const struct user_regset *regset, 1037 struct membuf to) 1038 { 1039 long ctrl = get_tagged_addr_ctrl(target); 1040 1041 if (IS_ERR_VALUE(ctrl)) 1042 return ctrl; 1043 1044 return membuf_write(&to, &ctrl, sizeof(ctrl)); 1045 } 1046 1047 static int tagged_addr_ctrl_set(struct task_struct *target, const struct 1048 user_regset *regset, unsigned int pos, 1049 unsigned int count, const void *kbuf, const 1050 void __user *ubuf) 1051 { 1052 int ret; 1053 long ctrl; 1054 1055 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); 1056 if (ret) 1057 return ret; 1058 1059 return set_tagged_addr_ctrl(target, ctrl); 1060 } 1061 #endif 1062 1063 enum aarch64_regset { 1064 REGSET_GPR, 1065 REGSET_FPR, 1066 REGSET_TLS, 1067 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1068 REGSET_HW_BREAK, 1069 REGSET_HW_WATCH, 1070 #endif 1071 REGSET_SYSTEM_CALL, 1072 #ifdef CONFIG_ARM64_SVE 1073 REGSET_SVE, 1074 #endif 1075 #ifdef CONFIG_ARM64_PTR_AUTH 1076 REGSET_PAC_MASK, 1077 #ifdef CONFIG_CHECKPOINT_RESTORE 1078 REGSET_PACA_KEYS, 1079 REGSET_PACG_KEYS, 1080 #endif 1081 #endif 1082 #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI 1083 REGSET_TAGGED_ADDR_CTRL, 1084 #endif 1085 }; 1086 1087 static const struct user_regset aarch64_regsets[] = { 1088 [REGSET_GPR] = { 1089 .core_note_type = NT_PRSTATUS, 1090 .n = sizeof(struct user_pt_regs) / sizeof(u64), 1091 .size = sizeof(u64), 1092 .align = sizeof(u64), 1093 .regset_get = gpr_get, 1094 .set = gpr_set 1095 }, 1096 [REGSET_FPR] = { 1097 .core_note_type = NT_PRFPREG, 1098 .n = sizeof(struct user_fpsimd_state) / sizeof(u32), 1099 /* 1100 * We pretend we have 32-bit registers because the fpsr and 1101 * fpcr are 32-bits wide. 1102 */ 1103 .size = sizeof(u32), 1104 .align = sizeof(u32), 1105 .active = fpr_active, 1106 .regset_get = fpr_get, 1107 .set = fpr_set 1108 }, 1109 [REGSET_TLS] = { 1110 .core_note_type = NT_ARM_TLS, 1111 .n = 1, 1112 .size = sizeof(void *), 1113 .align = sizeof(void *), 1114 .regset_get = tls_get, 1115 .set = tls_set, 1116 }, 1117 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1118 [REGSET_HW_BREAK] = { 1119 .core_note_type = NT_ARM_HW_BREAK, 1120 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1121 .size = sizeof(u32), 1122 .align = sizeof(u32), 1123 .regset_get = hw_break_get, 1124 .set = hw_break_set, 1125 }, 1126 [REGSET_HW_WATCH] = { 1127 .core_note_type = NT_ARM_HW_WATCH, 1128 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1129 .size = sizeof(u32), 1130 .align = sizeof(u32), 1131 .regset_get = hw_break_get, 1132 .set = hw_break_set, 1133 }, 1134 #endif 1135 [REGSET_SYSTEM_CALL] = { 1136 .core_note_type = NT_ARM_SYSTEM_CALL, 1137 .n = 1, 1138 .size = sizeof(int), 1139 .align = sizeof(int), 1140 .regset_get = system_call_get, 1141 .set = system_call_set, 1142 }, 1143 #ifdef CONFIG_ARM64_SVE 1144 [REGSET_SVE] = { /* Scalable Vector Extension */ 1145 .core_note_type = NT_ARM_SVE, 1146 .n = DIV_ROUND_UP(SVE_PT_SIZE(SVE_VQ_MAX, SVE_PT_REGS_SVE), 1147 SVE_VQ_BYTES), 1148 .size = SVE_VQ_BYTES, 1149 .align = SVE_VQ_BYTES, 1150 .regset_get = sve_get, 1151 .set = sve_set, 1152 }, 1153 #endif 1154 #ifdef CONFIG_ARM64_PTR_AUTH 1155 [REGSET_PAC_MASK] = { 1156 .core_note_type = NT_ARM_PAC_MASK, 1157 .n = sizeof(struct user_pac_mask) / sizeof(u64), 1158 .size = sizeof(u64), 1159 .align = sizeof(u64), 1160 .regset_get = pac_mask_get, 1161 /* this cannot be set dynamically */ 1162 }, 1163 #ifdef CONFIG_CHECKPOINT_RESTORE 1164 [REGSET_PACA_KEYS] = { 1165 .core_note_type = NT_ARM_PACA_KEYS, 1166 .n = sizeof(struct user_pac_address_keys) / sizeof(__uint128_t), 1167 .size = sizeof(__uint128_t), 1168 .align = sizeof(__uint128_t), 1169 .regset_get = pac_address_keys_get, 1170 .set = pac_address_keys_set, 1171 }, 1172 [REGSET_PACG_KEYS] = { 1173 .core_note_type = NT_ARM_PACG_KEYS, 1174 .n = sizeof(struct user_pac_generic_keys) / sizeof(__uint128_t), 1175 .size = sizeof(__uint128_t), 1176 .align = sizeof(__uint128_t), 1177 .regset_get = pac_generic_keys_get, 1178 .set = pac_generic_keys_set, 1179 }, 1180 #endif 1181 #endif 1182 #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI 1183 [REGSET_TAGGED_ADDR_CTRL] = { 1184 .core_note_type = NT_ARM_TAGGED_ADDR_CTRL, 1185 .n = 1, 1186 .size = sizeof(long), 1187 .align = sizeof(long), 1188 .regset_get = tagged_addr_ctrl_get, 1189 .set = tagged_addr_ctrl_set, 1190 }, 1191 #endif 1192 }; 1193 1194 static const struct user_regset_view user_aarch64_view = { 1195 .name = "aarch64", .e_machine = EM_AARCH64, 1196 .regsets = aarch64_regsets, .n = ARRAY_SIZE(aarch64_regsets) 1197 }; 1198 1199 #ifdef CONFIG_COMPAT 1200 enum compat_regset { 1201 REGSET_COMPAT_GPR, 1202 REGSET_COMPAT_VFP, 1203 }; 1204 1205 static inline compat_ulong_t compat_get_user_reg(struct task_struct *task, int idx) 1206 { 1207 struct pt_regs *regs = task_pt_regs(task); 1208 1209 switch (idx) { 1210 case 15: 1211 return regs->pc; 1212 case 16: 1213 return pstate_to_compat_psr(regs->pstate); 1214 case 17: 1215 return regs->orig_x0; 1216 default: 1217 return regs->regs[idx]; 1218 } 1219 } 1220 1221 static int compat_gpr_get(struct task_struct *target, 1222 const struct user_regset *regset, 1223 struct membuf to) 1224 { 1225 int i = 0; 1226 1227 while (to.left) 1228 membuf_store(&to, compat_get_user_reg(target, i++)); 1229 return 0; 1230 } 1231 1232 static int compat_gpr_set(struct task_struct *target, 1233 const struct user_regset *regset, 1234 unsigned int pos, unsigned int count, 1235 const void *kbuf, const void __user *ubuf) 1236 { 1237 struct pt_regs newregs; 1238 int ret = 0; 1239 unsigned int i, start, num_regs; 1240 1241 /* Calculate the number of AArch32 registers contained in count */ 1242 num_regs = count / regset->size; 1243 1244 /* Convert pos into an register number */ 1245 start = pos / regset->size; 1246 1247 if (start + num_regs > regset->n) 1248 return -EIO; 1249 1250 newregs = *task_pt_regs(target); 1251 1252 for (i = 0; i < num_regs; ++i) { 1253 unsigned int idx = start + i; 1254 compat_ulong_t reg; 1255 1256 if (kbuf) { 1257 memcpy(®, kbuf, sizeof(reg)); 1258 kbuf += sizeof(reg); 1259 } else { 1260 ret = copy_from_user(®, ubuf, sizeof(reg)); 1261 if (ret) { 1262 ret = -EFAULT; 1263 break; 1264 } 1265 1266 ubuf += sizeof(reg); 1267 } 1268 1269 switch (idx) { 1270 case 15: 1271 newregs.pc = reg; 1272 break; 1273 case 16: 1274 reg = compat_psr_to_pstate(reg); 1275 newregs.pstate = reg; 1276 break; 1277 case 17: 1278 newregs.orig_x0 = reg; 1279 break; 1280 default: 1281 newregs.regs[idx] = reg; 1282 } 1283 1284 } 1285 1286 if (valid_user_regs(&newregs.user_regs, target)) 1287 *task_pt_regs(target) = newregs; 1288 else 1289 ret = -EINVAL; 1290 1291 return ret; 1292 } 1293 1294 static int compat_vfp_get(struct task_struct *target, 1295 const struct user_regset *regset, 1296 struct membuf to) 1297 { 1298 struct user_fpsimd_state *uregs; 1299 compat_ulong_t fpscr; 1300 1301 if (!system_supports_fpsimd()) 1302 return -EINVAL; 1303 1304 uregs = &target->thread.uw.fpsimd_state; 1305 1306 if (target == current) 1307 fpsimd_preserve_current_state(); 1308 1309 /* 1310 * The VFP registers are packed into the fpsimd_state, so they all sit 1311 * nicely together for us. We just need to create the fpscr separately. 1312 */ 1313 membuf_write(&to, uregs, VFP_STATE_SIZE - sizeof(compat_ulong_t)); 1314 fpscr = (uregs->fpsr & VFP_FPSCR_STAT_MASK) | 1315 (uregs->fpcr & VFP_FPSCR_CTRL_MASK); 1316 return membuf_store(&to, fpscr); 1317 } 1318 1319 static int compat_vfp_set(struct task_struct *target, 1320 const struct user_regset *regset, 1321 unsigned int pos, unsigned int count, 1322 const void *kbuf, const void __user *ubuf) 1323 { 1324 struct user_fpsimd_state *uregs; 1325 compat_ulong_t fpscr; 1326 int ret, vregs_end_pos; 1327 1328 if (!system_supports_fpsimd()) 1329 return -EINVAL; 1330 1331 uregs = &target->thread.uw.fpsimd_state; 1332 1333 vregs_end_pos = VFP_STATE_SIZE - sizeof(compat_ulong_t); 1334 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0, 1335 vregs_end_pos); 1336 1337 if (count && !ret) { 1338 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &fpscr, 1339 vregs_end_pos, VFP_STATE_SIZE); 1340 if (!ret) { 1341 uregs->fpsr = fpscr & VFP_FPSCR_STAT_MASK; 1342 uregs->fpcr = fpscr & VFP_FPSCR_CTRL_MASK; 1343 } 1344 } 1345 1346 fpsimd_flush_task_state(target); 1347 return ret; 1348 } 1349 1350 static int compat_tls_get(struct task_struct *target, 1351 const struct user_regset *regset, 1352 struct membuf to) 1353 { 1354 return membuf_store(&to, (compat_ulong_t)target->thread.uw.tp_value); 1355 } 1356 1357 static int compat_tls_set(struct task_struct *target, 1358 const struct user_regset *regset, unsigned int pos, 1359 unsigned int count, const void *kbuf, 1360 const void __user *ubuf) 1361 { 1362 int ret; 1363 compat_ulong_t tls = target->thread.uw.tp_value; 1364 1365 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); 1366 if (ret) 1367 return ret; 1368 1369 target->thread.uw.tp_value = tls; 1370 return ret; 1371 } 1372 1373 static const struct user_regset aarch32_regsets[] = { 1374 [REGSET_COMPAT_GPR] = { 1375 .core_note_type = NT_PRSTATUS, 1376 .n = COMPAT_ELF_NGREG, 1377 .size = sizeof(compat_elf_greg_t), 1378 .align = sizeof(compat_elf_greg_t), 1379 .regset_get = compat_gpr_get, 1380 .set = compat_gpr_set 1381 }, 1382 [REGSET_COMPAT_VFP] = { 1383 .core_note_type = NT_ARM_VFP, 1384 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), 1385 .size = sizeof(compat_ulong_t), 1386 .align = sizeof(compat_ulong_t), 1387 .active = fpr_active, 1388 .regset_get = compat_vfp_get, 1389 .set = compat_vfp_set 1390 }, 1391 }; 1392 1393 static const struct user_regset_view user_aarch32_view = { 1394 .name = "aarch32", .e_machine = EM_ARM, 1395 .regsets = aarch32_regsets, .n = ARRAY_SIZE(aarch32_regsets) 1396 }; 1397 1398 static const struct user_regset aarch32_ptrace_regsets[] = { 1399 [REGSET_GPR] = { 1400 .core_note_type = NT_PRSTATUS, 1401 .n = COMPAT_ELF_NGREG, 1402 .size = sizeof(compat_elf_greg_t), 1403 .align = sizeof(compat_elf_greg_t), 1404 .regset_get = compat_gpr_get, 1405 .set = compat_gpr_set 1406 }, 1407 [REGSET_FPR] = { 1408 .core_note_type = NT_ARM_VFP, 1409 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), 1410 .size = sizeof(compat_ulong_t), 1411 .align = sizeof(compat_ulong_t), 1412 .regset_get = compat_vfp_get, 1413 .set = compat_vfp_set 1414 }, 1415 [REGSET_TLS] = { 1416 .core_note_type = NT_ARM_TLS, 1417 .n = 1, 1418 .size = sizeof(compat_ulong_t), 1419 .align = sizeof(compat_ulong_t), 1420 .regset_get = compat_tls_get, 1421 .set = compat_tls_set, 1422 }, 1423 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1424 [REGSET_HW_BREAK] = { 1425 .core_note_type = NT_ARM_HW_BREAK, 1426 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1427 .size = sizeof(u32), 1428 .align = sizeof(u32), 1429 .regset_get = hw_break_get, 1430 .set = hw_break_set, 1431 }, 1432 [REGSET_HW_WATCH] = { 1433 .core_note_type = NT_ARM_HW_WATCH, 1434 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1435 .size = sizeof(u32), 1436 .align = sizeof(u32), 1437 .regset_get = hw_break_get, 1438 .set = hw_break_set, 1439 }, 1440 #endif 1441 [REGSET_SYSTEM_CALL] = { 1442 .core_note_type = NT_ARM_SYSTEM_CALL, 1443 .n = 1, 1444 .size = sizeof(int), 1445 .align = sizeof(int), 1446 .regset_get = system_call_get, 1447 .set = system_call_set, 1448 }, 1449 }; 1450 1451 static const struct user_regset_view user_aarch32_ptrace_view = { 1452 .name = "aarch32", .e_machine = EM_ARM, 1453 .regsets = aarch32_ptrace_regsets, .n = ARRAY_SIZE(aarch32_ptrace_regsets) 1454 }; 1455 1456 static int compat_ptrace_read_user(struct task_struct *tsk, compat_ulong_t off, 1457 compat_ulong_t __user *ret) 1458 { 1459 compat_ulong_t tmp; 1460 1461 if (off & 3) 1462 return -EIO; 1463 1464 if (off == COMPAT_PT_TEXT_ADDR) 1465 tmp = tsk->mm->start_code; 1466 else if (off == COMPAT_PT_DATA_ADDR) 1467 tmp = tsk->mm->start_data; 1468 else if (off == COMPAT_PT_TEXT_END_ADDR) 1469 tmp = tsk->mm->end_code; 1470 else if (off < sizeof(compat_elf_gregset_t)) 1471 tmp = compat_get_user_reg(tsk, off >> 2); 1472 else if (off >= COMPAT_USER_SZ) 1473 return -EIO; 1474 else 1475 tmp = 0; 1476 1477 return put_user(tmp, ret); 1478 } 1479 1480 static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, 1481 compat_ulong_t val) 1482 { 1483 struct pt_regs newregs = *task_pt_regs(tsk); 1484 unsigned int idx = off / 4; 1485 1486 if (off & 3 || off >= COMPAT_USER_SZ) 1487 return -EIO; 1488 1489 if (off >= sizeof(compat_elf_gregset_t)) 1490 return 0; 1491 1492 switch (idx) { 1493 case 15: 1494 newregs.pc = val; 1495 break; 1496 case 16: 1497 newregs.pstate = compat_psr_to_pstate(val); 1498 break; 1499 case 17: 1500 newregs.orig_x0 = val; 1501 break; 1502 default: 1503 newregs.regs[idx] = val; 1504 } 1505 1506 if (!valid_user_regs(&newregs.user_regs, tsk)) 1507 return -EINVAL; 1508 1509 *task_pt_regs(tsk) = newregs; 1510 return 0; 1511 } 1512 1513 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1514 1515 /* 1516 * Convert a virtual register number into an index for a thread_info 1517 * breakpoint array. Breakpoints are identified using positive numbers 1518 * whilst watchpoints are negative. The registers are laid out as pairs 1519 * of (address, control), each pair mapping to a unique hw_breakpoint struct. 1520 * Register 0 is reserved for describing resource information. 1521 */ 1522 static int compat_ptrace_hbp_num_to_idx(compat_long_t num) 1523 { 1524 return (abs(num) - 1) >> 1; 1525 } 1526 1527 static int compat_ptrace_hbp_get_resource_info(u32 *kdata) 1528 { 1529 u8 num_brps, num_wrps, debug_arch, wp_len; 1530 u32 reg = 0; 1531 1532 num_brps = hw_breakpoint_slots(TYPE_INST); 1533 num_wrps = hw_breakpoint_slots(TYPE_DATA); 1534 1535 debug_arch = debug_monitors_arch(); 1536 wp_len = 8; 1537 reg |= debug_arch; 1538 reg <<= 8; 1539 reg |= wp_len; 1540 reg <<= 8; 1541 reg |= num_wrps; 1542 reg <<= 8; 1543 reg |= num_brps; 1544 1545 *kdata = reg; 1546 return 0; 1547 } 1548 1549 static int compat_ptrace_hbp_get(unsigned int note_type, 1550 struct task_struct *tsk, 1551 compat_long_t num, 1552 u32 *kdata) 1553 { 1554 u64 addr = 0; 1555 u32 ctrl = 0; 1556 1557 int err, idx = compat_ptrace_hbp_num_to_idx(num); 1558 1559 if (num & 1) { 1560 err = ptrace_hbp_get_addr(note_type, tsk, idx, &addr); 1561 *kdata = (u32)addr; 1562 } else { 1563 err = ptrace_hbp_get_ctrl(note_type, tsk, idx, &ctrl); 1564 *kdata = ctrl; 1565 } 1566 1567 return err; 1568 } 1569 1570 static int compat_ptrace_hbp_set(unsigned int note_type, 1571 struct task_struct *tsk, 1572 compat_long_t num, 1573 u32 *kdata) 1574 { 1575 u64 addr; 1576 u32 ctrl; 1577 1578 int err, idx = compat_ptrace_hbp_num_to_idx(num); 1579 1580 if (num & 1) { 1581 addr = *kdata; 1582 err = ptrace_hbp_set_addr(note_type, tsk, idx, addr); 1583 } else { 1584 ctrl = *kdata; 1585 err = ptrace_hbp_set_ctrl(note_type, tsk, idx, ctrl); 1586 } 1587 1588 return err; 1589 } 1590 1591 static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, 1592 compat_ulong_t __user *data) 1593 { 1594 int ret; 1595 u32 kdata; 1596 1597 /* Watchpoint */ 1598 if (num < 0) { 1599 ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata); 1600 /* Resource info */ 1601 } else if (num == 0) { 1602 ret = compat_ptrace_hbp_get_resource_info(&kdata); 1603 /* Breakpoint */ 1604 } else { 1605 ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata); 1606 } 1607 1608 if (!ret) 1609 ret = put_user(kdata, data); 1610 1611 return ret; 1612 } 1613 1614 static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, 1615 compat_ulong_t __user *data) 1616 { 1617 int ret; 1618 u32 kdata = 0; 1619 1620 if (num == 0) 1621 return 0; 1622 1623 ret = get_user(kdata, data); 1624 if (ret) 1625 return ret; 1626 1627 if (num < 0) 1628 ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata); 1629 else 1630 ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata); 1631 1632 return ret; 1633 } 1634 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 1635 1636 long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 1637 compat_ulong_t caddr, compat_ulong_t cdata) 1638 { 1639 unsigned long addr = caddr; 1640 unsigned long data = cdata; 1641 void __user *datap = compat_ptr(data); 1642 int ret; 1643 1644 switch (request) { 1645 case PTRACE_PEEKUSR: 1646 ret = compat_ptrace_read_user(child, addr, datap); 1647 break; 1648 1649 case PTRACE_POKEUSR: 1650 ret = compat_ptrace_write_user(child, addr, data); 1651 break; 1652 1653 case COMPAT_PTRACE_GETREGS: 1654 ret = copy_regset_to_user(child, 1655 &user_aarch32_view, 1656 REGSET_COMPAT_GPR, 1657 0, sizeof(compat_elf_gregset_t), 1658 datap); 1659 break; 1660 1661 case COMPAT_PTRACE_SETREGS: 1662 ret = copy_regset_from_user(child, 1663 &user_aarch32_view, 1664 REGSET_COMPAT_GPR, 1665 0, sizeof(compat_elf_gregset_t), 1666 datap); 1667 break; 1668 1669 case COMPAT_PTRACE_GET_THREAD_AREA: 1670 ret = put_user((compat_ulong_t)child->thread.uw.tp_value, 1671 (compat_ulong_t __user *)datap); 1672 break; 1673 1674 case COMPAT_PTRACE_SET_SYSCALL: 1675 task_pt_regs(child)->syscallno = data; 1676 ret = 0; 1677 break; 1678 1679 case COMPAT_PTRACE_GETVFPREGS: 1680 ret = copy_regset_to_user(child, 1681 &user_aarch32_view, 1682 REGSET_COMPAT_VFP, 1683 0, VFP_STATE_SIZE, 1684 datap); 1685 break; 1686 1687 case COMPAT_PTRACE_SETVFPREGS: 1688 ret = copy_regset_from_user(child, 1689 &user_aarch32_view, 1690 REGSET_COMPAT_VFP, 1691 0, VFP_STATE_SIZE, 1692 datap); 1693 break; 1694 1695 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1696 case COMPAT_PTRACE_GETHBPREGS: 1697 ret = compat_ptrace_gethbpregs(child, addr, datap); 1698 break; 1699 1700 case COMPAT_PTRACE_SETHBPREGS: 1701 ret = compat_ptrace_sethbpregs(child, addr, datap); 1702 break; 1703 #endif 1704 1705 default: 1706 ret = compat_ptrace_request(child, request, addr, 1707 data); 1708 break; 1709 } 1710 1711 return ret; 1712 } 1713 #endif /* CONFIG_COMPAT */ 1714 1715 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 1716 { 1717 #ifdef CONFIG_COMPAT 1718 /* 1719 * Core dumping of 32-bit tasks or compat ptrace requests must use the 1720 * user_aarch32_view compatible with arm32. Native ptrace requests on 1721 * 32-bit children use an extended user_aarch32_ptrace_view to allow 1722 * access to the TLS register. 1723 */ 1724 if (is_compat_task()) 1725 return &user_aarch32_view; 1726 else if (is_compat_thread(task_thread_info(task))) 1727 return &user_aarch32_ptrace_view; 1728 #endif 1729 return &user_aarch64_view; 1730 } 1731 1732 long arch_ptrace(struct task_struct *child, long request, 1733 unsigned long addr, unsigned long data) 1734 { 1735 switch (request) { 1736 case PTRACE_PEEKMTETAGS: 1737 case PTRACE_POKEMTETAGS: 1738 return mte_ptrace_copy_tags(child, request, addr, data); 1739 } 1740 1741 return ptrace_request(child, request, addr, data); 1742 } 1743 1744 enum ptrace_syscall_dir { 1745 PTRACE_SYSCALL_ENTER = 0, 1746 PTRACE_SYSCALL_EXIT, 1747 }; 1748 1749 static void tracehook_report_syscall(struct pt_regs *regs, 1750 enum ptrace_syscall_dir dir) 1751 { 1752 int regno; 1753 unsigned long saved_reg; 1754 1755 /* 1756 * We have some ABI weirdness here in the way that we handle syscall 1757 * exit stops because we indicate whether or not the stop has been 1758 * signalled from syscall entry or syscall exit by clobbering a general 1759 * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee 1760 * and restoring its old value after the stop. This means that: 1761 * 1762 * - Any writes by the tracer to this register during the stop are 1763 * ignored/discarded. 1764 * 1765 * - The actual value of the register is not available during the stop, 1766 * so the tracer cannot save it and restore it later. 1767 * 1768 * - Syscall stops behave differently to seccomp and pseudo-step traps 1769 * (the latter do not nobble any registers). 1770 */ 1771 regno = (is_compat_task() ? 12 : 7); 1772 saved_reg = regs->regs[regno]; 1773 regs->regs[regno] = dir; 1774 1775 if (dir == PTRACE_SYSCALL_ENTER) { 1776 if (tracehook_report_syscall_entry(regs)) 1777 forget_syscall(regs); 1778 regs->regs[regno] = saved_reg; 1779 } else if (!test_thread_flag(TIF_SINGLESTEP)) { 1780 tracehook_report_syscall_exit(regs, 0); 1781 regs->regs[regno] = saved_reg; 1782 } else { 1783 regs->regs[regno] = saved_reg; 1784 1785 /* 1786 * Signal a pseudo-step exception since we are stepping but 1787 * tracer modifications to the registers may have rewound the 1788 * state machine. 1789 */ 1790 tracehook_report_syscall_exit(regs, 1); 1791 } 1792 } 1793 1794 int syscall_trace_enter(struct pt_regs *regs) 1795 { 1796 unsigned long flags = READ_ONCE(current_thread_info()->flags); 1797 1798 if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) { 1799 tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); 1800 if (flags & _TIF_SYSCALL_EMU) 1801 return NO_SYSCALL; 1802 } 1803 1804 /* Do the secure computing after ptrace; failures should be fast. */ 1805 if (secure_computing() == -1) 1806 return NO_SYSCALL; 1807 1808 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) 1809 trace_sys_enter(regs, regs->syscallno); 1810 1811 audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1], 1812 regs->regs[2], regs->regs[3]); 1813 1814 return regs->syscallno; 1815 } 1816 1817 void syscall_trace_exit(struct pt_regs *regs) 1818 { 1819 unsigned long flags = READ_ONCE(current_thread_info()->flags); 1820 1821 audit_syscall_exit(regs); 1822 1823 if (flags & _TIF_SYSCALL_TRACEPOINT) 1824 trace_sys_exit(regs, regs_return_value(regs)); 1825 1826 if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP)) 1827 tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT); 1828 1829 rseq_syscall(regs); 1830 } 1831 1832 /* 1833 * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a. 1834 * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is 1835 * not described in ARM DDI 0487D.a. 1836 * We treat PAN and UAO as RES0 bits, as they are meaningless at EL0, and may 1837 * be allocated an EL0 meaning in future. 1838 * Userspace cannot use these until they have an architectural meaning. 1839 * Note that this follows the SPSR_ELx format, not the AArch32 PSR format. 1840 * We also reserve IL for the kernel; SS is handled dynamically. 1841 */ 1842 #define SPSR_EL1_AARCH64_RES0_BITS \ 1843 (GENMASK_ULL(63, 32) | GENMASK_ULL(27, 26) | GENMASK_ULL(23, 22) | \ 1844 GENMASK_ULL(20, 13) | GENMASK_ULL(5, 5)) 1845 #define SPSR_EL1_AARCH32_RES0_BITS \ 1846 (GENMASK_ULL(63, 32) | GENMASK_ULL(22, 22) | GENMASK_ULL(20, 20)) 1847 1848 static int valid_compat_regs(struct user_pt_regs *regs) 1849 { 1850 regs->pstate &= ~SPSR_EL1_AARCH32_RES0_BITS; 1851 1852 if (!system_supports_mixed_endian_el0()) { 1853 if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) 1854 regs->pstate |= PSR_AA32_E_BIT; 1855 else 1856 regs->pstate &= ~PSR_AA32_E_BIT; 1857 } 1858 1859 if (user_mode(regs) && (regs->pstate & PSR_MODE32_BIT) && 1860 (regs->pstate & PSR_AA32_A_BIT) == 0 && 1861 (regs->pstate & PSR_AA32_I_BIT) == 0 && 1862 (regs->pstate & PSR_AA32_F_BIT) == 0) { 1863 return 1; 1864 } 1865 1866 /* 1867 * Force PSR to a valid 32-bit EL0t, preserving the same bits as 1868 * arch/arm. 1869 */ 1870 regs->pstate &= PSR_AA32_N_BIT | PSR_AA32_Z_BIT | 1871 PSR_AA32_C_BIT | PSR_AA32_V_BIT | 1872 PSR_AA32_Q_BIT | PSR_AA32_IT_MASK | 1873 PSR_AA32_GE_MASK | PSR_AA32_E_BIT | 1874 PSR_AA32_T_BIT; 1875 regs->pstate |= PSR_MODE32_BIT; 1876 1877 return 0; 1878 } 1879 1880 static int valid_native_regs(struct user_pt_regs *regs) 1881 { 1882 regs->pstate &= ~SPSR_EL1_AARCH64_RES0_BITS; 1883 1884 if (user_mode(regs) && !(regs->pstate & PSR_MODE32_BIT) && 1885 (regs->pstate & PSR_D_BIT) == 0 && 1886 (regs->pstate & PSR_A_BIT) == 0 && 1887 (regs->pstate & PSR_I_BIT) == 0 && 1888 (regs->pstate & PSR_F_BIT) == 0) { 1889 return 1; 1890 } 1891 1892 /* Force PSR to a valid 64-bit EL0t */ 1893 regs->pstate &= PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT; 1894 1895 return 0; 1896 } 1897 1898 /* 1899 * Are the current registers suitable for user mode? (used to maintain 1900 * security in signal handlers) 1901 */ 1902 int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task) 1903 { 1904 /* https://lore.kernel.org/lkml/20191118131525.GA4180@willie-the-truck */ 1905 user_regs_reset_single_step(regs, task); 1906 1907 if (is_compat_thread(task_thread_info(task))) 1908 return valid_compat_regs(regs); 1909 else 1910 return valid_native_regs(regs); 1911 } 1912