1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Based on arch/arm/kernel/ptrace.c 4 * 5 * By Ross Biro 1/23/92 6 * edited by Linus Torvalds 7 * ARM modifications Copyright (C) 2000 Russell King 8 * Copyright (C) 2012 ARM Ltd. 9 */ 10 11 #include <linux/audit.h> 12 #include <linux/compat.h> 13 #include <linux/kernel.h> 14 #include <linux/sched/signal.h> 15 #include <linux/sched/task_stack.h> 16 #include <linux/mm.h> 17 #include <linux/nospec.h> 18 #include <linux/smp.h> 19 #include <linux/ptrace.h> 20 #include <linux/user.h> 21 #include <linux/seccomp.h> 22 #include <linux/security.h> 23 #include <linux/init.h> 24 #include <linux/signal.h> 25 #include <linux/string.h> 26 #include <linux/uaccess.h> 27 #include <linux/perf_event.h> 28 #include <linux/hw_breakpoint.h> 29 #include <linux/regset.h> 30 #include <linux/elf.h> 31 32 #include <asm/compat.h> 33 #include <asm/cpufeature.h> 34 #include <asm/debug-monitors.h> 35 #include <asm/fpsimd.h> 36 #include <asm/mte.h> 37 #include <asm/pointer_auth.h> 38 #include <asm/stacktrace.h> 39 #include <asm/syscall.h> 40 #include <asm/traps.h> 41 #include <asm/system_misc.h> 42 43 #define CREATE_TRACE_POINTS 44 #include <trace/events/syscalls.h> 45 46 struct pt_regs_offset { 47 const char *name; 48 int offset; 49 }; 50 51 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 52 #define REG_OFFSET_END {.name = NULL, .offset = 0} 53 #define GPR_OFFSET_NAME(r) \ 54 {.name = "x" #r, .offset = offsetof(struct pt_regs, regs[r])} 55 56 static const struct pt_regs_offset regoffset_table[] = { 57 GPR_OFFSET_NAME(0), 58 GPR_OFFSET_NAME(1), 59 GPR_OFFSET_NAME(2), 60 GPR_OFFSET_NAME(3), 61 GPR_OFFSET_NAME(4), 62 GPR_OFFSET_NAME(5), 63 GPR_OFFSET_NAME(6), 64 GPR_OFFSET_NAME(7), 65 GPR_OFFSET_NAME(8), 66 GPR_OFFSET_NAME(9), 67 GPR_OFFSET_NAME(10), 68 GPR_OFFSET_NAME(11), 69 GPR_OFFSET_NAME(12), 70 GPR_OFFSET_NAME(13), 71 GPR_OFFSET_NAME(14), 72 GPR_OFFSET_NAME(15), 73 GPR_OFFSET_NAME(16), 74 GPR_OFFSET_NAME(17), 75 GPR_OFFSET_NAME(18), 76 GPR_OFFSET_NAME(19), 77 GPR_OFFSET_NAME(20), 78 GPR_OFFSET_NAME(21), 79 GPR_OFFSET_NAME(22), 80 GPR_OFFSET_NAME(23), 81 GPR_OFFSET_NAME(24), 82 GPR_OFFSET_NAME(25), 83 GPR_OFFSET_NAME(26), 84 GPR_OFFSET_NAME(27), 85 GPR_OFFSET_NAME(28), 86 GPR_OFFSET_NAME(29), 87 GPR_OFFSET_NAME(30), 88 {.name = "lr", .offset = offsetof(struct pt_regs, regs[30])}, 89 REG_OFFSET_NAME(sp), 90 REG_OFFSET_NAME(pc), 91 REG_OFFSET_NAME(pstate), 92 REG_OFFSET_END, 93 }; 94 95 /** 96 * regs_query_register_offset() - query register offset from its name 97 * @name: the name of a register 98 * 99 * regs_query_register_offset() returns the offset of a register in struct 100 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 101 */ 102 int regs_query_register_offset(const char *name) 103 { 104 const struct pt_regs_offset *roff; 105 106 for (roff = regoffset_table; roff->name != NULL; roff++) 107 if (!strcmp(roff->name, name)) 108 return roff->offset; 109 return -EINVAL; 110 } 111 112 /** 113 * regs_within_kernel_stack() - check the address in the stack 114 * @regs: pt_regs which contains kernel stack pointer. 115 * @addr: address which is checked. 116 * 117 * regs_within_kernel_stack() checks @addr is within the kernel stack page(s). 118 * If @addr is within the kernel stack, it returns true. If not, returns false. 119 */ 120 static bool regs_within_kernel_stack(struct pt_regs *regs, unsigned long addr) 121 { 122 return ((addr & ~(THREAD_SIZE - 1)) == 123 (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1))) || 124 on_irq_stack(addr, sizeof(unsigned long)); 125 } 126 127 /** 128 * regs_get_kernel_stack_nth() - get Nth entry of the stack 129 * @regs: pt_regs which contains kernel stack pointer. 130 * @n: stack entry number. 131 * 132 * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which 133 * is specified by @regs. If the @n th entry is NOT in the kernel stack, 134 * this returns 0. 135 */ 136 unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n) 137 { 138 unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs); 139 140 addr += n; 141 if (regs_within_kernel_stack(regs, (unsigned long)addr)) 142 return *addr; 143 else 144 return 0; 145 } 146 147 /* 148 * TODO: does not yet catch signals sent when the child dies. 149 * in exit.c or in signal.c. 150 */ 151 152 /* 153 * Called by kernel/ptrace.c when detaching.. 154 */ 155 void ptrace_disable(struct task_struct *child) 156 { 157 /* 158 * This would be better off in core code, but PTRACE_DETACH has 159 * grown its fair share of arch-specific worts and changing it 160 * is likely to cause regressions on obscure architectures. 161 */ 162 user_disable_single_step(child); 163 } 164 165 #ifdef CONFIG_HAVE_HW_BREAKPOINT 166 /* 167 * Handle hitting a HW-breakpoint. 168 */ 169 static void ptrace_hbptriggered(struct perf_event *bp, 170 struct perf_sample_data *data, 171 struct pt_regs *regs) 172 { 173 struct arch_hw_breakpoint *bkpt = counter_arch_bp(bp); 174 const char *desc = "Hardware breakpoint trap (ptrace)"; 175 176 #ifdef CONFIG_COMPAT 177 if (is_compat_task()) { 178 int si_errno = 0; 179 int i; 180 181 for (i = 0; i < ARM_MAX_BRP; ++i) { 182 if (current->thread.debug.hbp_break[i] == bp) { 183 si_errno = (i << 1) + 1; 184 break; 185 } 186 } 187 188 for (i = 0; i < ARM_MAX_WRP; ++i) { 189 if (current->thread.debug.hbp_watch[i] == bp) { 190 si_errno = -((i << 1) + 1); 191 break; 192 } 193 } 194 arm64_force_sig_ptrace_errno_trap(si_errno, bkpt->trigger, 195 desc); 196 return; 197 } 198 #endif 199 arm64_force_sig_fault(SIGTRAP, TRAP_HWBKPT, bkpt->trigger, desc); 200 } 201 202 /* 203 * Unregister breakpoints from this task and reset the pointers in 204 * the thread_struct. 205 */ 206 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 207 { 208 int i; 209 struct thread_struct *t = &tsk->thread; 210 211 for (i = 0; i < ARM_MAX_BRP; i++) { 212 if (t->debug.hbp_break[i]) { 213 unregister_hw_breakpoint(t->debug.hbp_break[i]); 214 t->debug.hbp_break[i] = NULL; 215 } 216 } 217 218 for (i = 0; i < ARM_MAX_WRP; i++) { 219 if (t->debug.hbp_watch[i]) { 220 unregister_hw_breakpoint(t->debug.hbp_watch[i]); 221 t->debug.hbp_watch[i] = NULL; 222 } 223 } 224 } 225 226 void ptrace_hw_copy_thread(struct task_struct *tsk) 227 { 228 memset(&tsk->thread.debug, 0, sizeof(struct debug_info)); 229 } 230 231 static struct perf_event *ptrace_hbp_get_event(unsigned int note_type, 232 struct task_struct *tsk, 233 unsigned long idx) 234 { 235 struct perf_event *bp = ERR_PTR(-EINVAL); 236 237 switch (note_type) { 238 case NT_ARM_HW_BREAK: 239 if (idx >= ARM_MAX_BRP) 240 goto out; 241 idx = array_index_nospec(idx, ARM_MAX_BRP); 242 bp = tsk->thread.debug.hbp_break[idx]; 243 break; 244 case NT_ARM_HW_WATCH: 245 if (idx >= ARM_MAX_WRP) 246 goto out; 247 idx = array_index_nospec(idx, ARM_MAX_WRP); 248 bp = tsk->thread.debug.hbp_watch[idx]; 249 break; 250 } 251 252 out: 253 return bp; 254 } 255 256 static int ptrace_hbp_set_event(unsigned int note_type, 257 struct task_struct *tsk, 258 unsigned long idx, 259 struct perf_event *bp) 260 { 261 int err = -EINVAL; 262 263 switch (note_type) { 264 case NT_ARM_HW_BREAK: 265 if (idx >= ARM_MAX_BRP) 266 goto out; 267 idx = array_index_nospec(idx, ARM_MAX_BRP); 268 tsk->thread.debug.hbp_break[idx] = bp; 269 err = 0; 270 break; 271 case NT_ARM_HW_WATCH: 272 if (idx >= ARM_MAX_WRP) 273 goto out; 274 idx = array_index_nospec(idx, ARM_MAX_WRP); 275 tsk->thread.debug.hbp_watch[idx] = bp; 276 err = 0; 277 break; 278 } 279 280 out: 281 return err; 282 } 283 284 static struct perf_event *ptrace_hbp_create(unsigned int note_type, 285 struct task_struct *tsk, 286 unsigned long idx) 287 { 288 struct perf_event *bp; 289 struct perf_event_attr attr; 290 int err, type; 291 292 switch (note_type) { 293 case NT_ARM_HW_BREAK: 294 type = HW_BREAKPOINT_X; 295 break; 296 case NT_ARM_HW_WATCH: 297 type = HW_BREAKPOINT_RW; 298 break; 299 default: 300 return ERR_PTR(-EINVAL); 301 } 302 303 ptrace_breakpoint_init(&attr); 304 305 /* 306 * Initialise fields to sane defaults 307 * (i.e. values that will pass validation). 308 */ 309 attr.bp_addr = 0; 310 attr.bp_len = HW_BREAKPOINT_LEN_4; 311 attr.bp_type = type; 312 attr.disabled = 1; 313 314 bp = register_user_hw_breakpoint(&attr, ptrace_hbptriggered, NULL, tsk); 315 if (IS_ERR(bp)) 316 return bp; 317 318 err = ptrace_hbp_set_event(note_type, tsk, idx, bp); 319 if (err) 320 return ERR_PTR(err); 321 322 return bp; 323 } 324 325 static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type, 326 struct arch_hw_breakpoint_ctrl ctrl, 327 struct perf_event_attr *attr) 328 { 329 int err, len, type, offset, disabled = !ctrl.enabled; 330 331 attr->disabled = disabled; 332 if (disabled) 333 return 0; 334 335 err = arch_bp_generic_fields(ctrl, &len, &type, &offset); 336 if (err) 337 return err; 338 339 switch (note_type) { 340 case NT_ARM_HW_BREAK: 341 if ((type & HW_BREAKPOINT_X) != type) 342 return -EINVAL; 343 break; 344 case NT_ARM_HW_WATCH: 345 if ((type & HW_BREAKPOINT_RW) != type) 346 return -EINVAL; 347 break; 348 default: 349 return -EINVAL; 350 } 351 352 attr->bp_len = len; 353 attr->bp_type = type; 354 attr->bp_addr += offset; 355 356 return 0; 357 } 358 359 static int ptrace_hbp_get_resource_info(unsigned int note_type, u32 *info) 360 { 361 u8 num; 362 u32 reg = 0; 363 364 switch (note_type) { 365 case NT_ARM_HW_BREAK: 366 num = hw_breakpoint_slots(TYPE_INST); 367 break; 368 case NT_ARM_HW_WATCH: 369 num = hw_breakpoint_slots(TYPE_DATA); 370 break; 371 default: 372 return -EINVAL; 373 } 374 375 reg |= debug_monitors_arch(); 376 reg <<= 8; 377 reg |= num; 378 379 *info = reg; 380 return 0; 381 } 382 383 static int ptrace_hbp_get_ctrl(unsigned int note_type, 384 struct task_struct *tsk, 385 unsigned long idx, 386 u32 *ctrl) 387 { 388 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 389 390 if (IS_ERR(bp)) 391 return PTR_ERR(bp); 392 393 *ctrl = bp ? encode_ctrl_reg(counter_arch_bp(bp)->ctrl) : 0; 394 return 0; 395 } 396 397 static int ptrace_hbp_get_addr(unsigned int note_type, 398 struct task_struct *tsk, 399 unsigned long idx, 400 u64 *addr) 401 { 402 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 403 404 if (IS_ERR(bp)) 405 return PTR_ERR(bp); 406 407 *addr = bp ? counter_arch_bp(bp)->address : 0; 408 return 0; 409 } 410 411 static struct perf_event *ptrace_hbp_get_initialised_bp(unsigned int note_type, 412 struct task_struct *tsk, 413 unsigned long idx) 414 { 415 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 416 417 if (!bp) 418 bp = ptrace_hbp_create(note_type, tsk, idx); 419 420 return bp; 421 } 422 423 static int ptrace_hbp_set_ctrl(unsigned int note_type, 424 struct task_struct *tsk, 425 unsigned long idx, 426 u32 uctrl) 427 { 428 int err; 429 struct perf_event *bp; 430 struct perf_event_attr attr; 431 struct arch_hw_breakpoint_ctrl ctrl; 432 433 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); 434 if (IS_ERR(bp)) { 435 err = PTR_ERR(bp); 436 return err; 437 } 438 439 attr = bp->attr; 440 decode_ctrl_reg(uctrl, &ctrl); 441 err = ptrace_hbp_fill_attr_ctrl(note_type, ctrl, &attr); 442 if (err) 443 return err; 444 445 return modify_user_hw_breakpoint(bp, &attr); 446 } 447 448 static int ptrace_hbp_set_addr(unsigned int note_type, 449 struct task_struct *tsk, 450 unsigned long idx, 451 u64 addr) 452 { 453 int err; 454 struct perf_event *bp; 455 struct perf_event_attr attr; 456 457 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); 458 if (IS_ERR(bp)) { 459 err = PTR_ERR(bp); 460 return err; 461 } 462 463 attr = bp->attr; 464 attr.bp_addr = addr; 465 err = modify_user_hw_breakpoint(bp, &attr); 466 return err; 467 } 468 469 #define PTRACE_HBP_ADDR_SZ sizeof(u64) 470 #define PTRACE_HBP_CTRL_SZ sizeof(u32) 471 #define PTRACE_HBP_PAD_SZ sizeof(u32) 472 473 static int hw_break_get(struct task_struct *target, 474 const struct user_regset *regset, 475 struct membuf to) 476 { 477 unsigned int note_type = regset->core_note_type; 478 int ret, idx = 0; 479 u32 info, ctrl; 480 u64 addr; 481 482 /* Resource info */ 483 ret = ptrace_hbp_get_resource_info(note_type, &info); 484 if (ret) 485 return ret; 486 487 membuf_write(&to, &info, sizeof(info)); 488 membuf_zero(&to, sizeof(u32)); 489 /* (address, ctrl) registers */ 490 while (to.left) { 491 ret = ptrace_hbp_get_addr(note_type, target, idx, &addr); 492 if (ret) 493 return ret; 494 ret = ptrace_hbp_get_ctrl(note_type, target, idx, &ctrl); 495 if (ret) 496 return ret; 497 membuf_store(&to, addr); 498 membuf_store(&to, ctrl); 499 membuf_zero(&to, sizeof(u32)); 500 idx++; 501 } 502 return 0; 503 } 504 505 static int hw_break_set(struct task_struct *target, 506 const struct user_regset *regset, 507 unsigned int pos, unsigned int count, 508 const void *kbuf, const void __user *ubuf) 509 { 510 unsigned int note_type = regset->core_note_type; 511 int ret, idx = 0, offset, limit; 512 u32 ctrl; 513 u64 addr; 514 515 /* Resource info and pad */ 516 offset = offsetof(struct user_hwdebug_state, dbg_regs); 517 user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 0, offset); 518 519 /* (address, ctrl) registers */ 520 limit = regset->n * regset->size; 521 while (count && offset < limit) { 522 if (count < PTRACE_HBP_ADDR_SZ) 523 return -EINVAL; 524 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &addr, 525 offset, offset + PTRACE_HBP_ADDR_SZ); 526 if (ret) 527 return ret; 528 ret = ptrace_hbp_set_addr(note_type, target, idx, addr); 529 if (ret) 530 return ret; 531 offset += PTRACE_HBP_ADDR_SZ; 532 533 if (!count) 534 break; 535 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 536 offset, offset + PTRACE_HBP_CTRL_SZ); 537 if (ret) 538 return ret; 539 ret = ptrace_hbp_set_ctrl(note_type, target, idx, ctrl); 540 if (ret) 541 return ret; 542 offset += PTRACE_HBP_CTRL_SZ; 543 544 user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 545 offset, offset + PTRACE_HBP_PAD_SZ); 546 offset += PTRACE_HBP_PAD_SZ; 547 idx++; 548 } 549 550 return 0; 551 } 552 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 553 554 static int gpr_get(struct task_struct *target, 555 const struct user_regset *regset, 556 struct membuf to) 557 { 558 struct user_pt_regs *uregs = &task_pt_regs(target)->user_regs; 559 return membuf_write(&to, uregs, sizeof(*uregs)); 560 } 561 562 static int gpr_set(struct task_struct *target, const struct user_regset *regset, 563 unsigned int pos, unsigned int count, 564 const void *kbuf, const void __user *ubuf) 565 { 566 int ret; 567 struct user_pt_regs newregs = task_pt_regs(target)->user_regs; 568 569 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs, 0, -1); 570 if (ret) 571 return ret; 572 573 if (!valid_user_regs(&newregs, target)) 574 return -EINVAL; 575 576 task_pt_regs(target)->user_regs = newregs; 577 return 0; 578 } 579 580 static int fpr_active(struct task_struct *target, const struct user_regset *regset) 581 { 582 if (!system_supports_fpsimd()) 583 return -ENODEV; 584 return regset->n; 585 } 586 587 /* 588 * TODO: update fp accessors for lazy context switching (sync/flush hwstate) 589 */ 590 static int __fpr_get(struct task_struct *target, 591 const struct user_regset *regset, 592 struct membuf to) 593 { 594 struct user_fpsimd_state *uregs; 595 596 sve_sync_to_fpsimd(target); 597 598 uregs = &target->thread.uw.fpsimd_state; 599 600 return membuf_write(&to, uregs, sizeof(*uregs)); 601 } 602 603 static int fpr_get(struct task_struct *target, const struct user_regset *regset, 604 struct membuf to) 605 { 606 if (!system_supports_fpsimd()) 607 return -EINVAL; 608 609 if (target == current) 610 fpsimd_preserve_current_state(); 611 612 return __fpr_get(target, regset, to); 613 } 614 615 static int __fpr_set(struct task_struct *target, 616 const struct user_regset *regset, 617 unsigned int pos, unsigned int count, 618 const void *kbuf, const void __user *ubuf, 619 unsigned int start_pos) 620 { 621 int ret; 622 struct user_fpsimd_state newstate; 623 624 /* 625 * Ensure target->thread.uw.fpsimd_state is up to date, so that a 626 * short copyin can't resurrect stale data. 627 */ 628 sve_sync_to_fpsimd(target); 629 630 newstate = target->thread.uw.fpsimd_state; 631 632 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newstate, 633 start_pos, start_pos + sizeof(newstate)); 634 if (ret) 635 return ret; 636 637 target->thread.uw.fpsimd_state = newstate; 638 639 return ret; 640 } 641 642 static int fpr_set(struct task_struct *target, const struct user_regset *regset, 643 unsigned int pos, unsigned int count, 644 const void *kbuf, const void __user *ubuf) 645 { 646 int ret; 647 648 if (!system_supports_fpsimd()) 649 return -EINVAL; 650 651 ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 0); 652 if (ret) 653 return ret; 654 655 sve_sync_from_fpsimd_zeropad(target); 656 fpsimd_flush_task_state(target); 657 658 return ret; 659 } 660 661 static int tls_get(struct task_struct *target, const struct user_regset *regset, 662 struct membuf to) 663 { 664 int ret; 665 666 if (target == current) 667 tls_preserve_current_state(); 668 669 ret = membuf_store(&to, target->thread.uw.tp_value); 670 if (system_supports_tpidr2()) 671 ret = membuf_store(&to, target->thread.tpidr2_el0); 672 else 673 ret = membuf_zero(&to, sizeof(u64)); 674 675 return ret; 676 } 677 678 static int tls_set(struct task_struct *target, const struct user_regset *regset, 679 unsigned int pos, unsigned int count, 680 const void *kbuf, const void __user *ubuf) 681 { 682 int ret; 683 unsigned long tls[2]; 684 685 tls[0] = target->thread.uw.tp_value; 686 if (system_supports_tpidr2()) 687 tls[1] = target->thread.tpidr2_el0; 688 689 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, tls, 0, count); 690 if (ret) 691 return ret; 692 693 target->thread.uw.tp_value = tls[0]; 694 if (system_supports_tpidr2()) 695 target->thread.tpidr2_el0 = tls[1]; 696 697 return ret; 698 } 699 700 static int system_call_get(struct task_struct *target, 701 const struct user_regset *regset, 702 struct membuf to) 703 { 704 return membuf_store(&to, task_pt_regs(target)->syscallno); 705 } 706 707 static int system_call_set(struct task_struct *target, 708 const struct user_regset *regset, 709 unsigned int pos, unsigned int count, 710 const void *kbuf, const void __user *ubuf) 711 { 712 int syscallno = task_pt_regs(target)->syscallno; 713 int ret; 714 715 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &syscallno, 0, -1); 716 if (ret) 717 return ret; 718 719 task_pt_regs(target)->syscallno = syscallno; 720 return ret; 721 } 722 723 #ifdef CONFIG_ARM64_SVE 724 725 static void sve_init_header_from_task(struct user_sve_header *header, 726 struct task_struct *target, 727 enum vec_type type) 728 { 729 unsigned int vq; 730 bool active; 731 bool fpsimd_only; 732 enum vec_type task_type; 733 734 memset(header, 0, sizeof(*header)); 735 736 /* Check if the requested registers are active for the task */ 737 if (thread_sm_enabled(&target->thread)) 738 task_type = ARM64_VEC_SME; 739 else 740 task_type = ARM64_VEC_SVE; 741 active = (task_type == type); 742 743 switch (type) { 744 case ARM64_VEC_SVE: 745 if (test_tsk_thread_flag(target, TIF_SVE_VL_INHERIT)) 746 header->flags |= SVE_PT_VL_INHERIT; 747 fpsimd_only = !test_tsk_thread_flag(target, TIF_SVE); 748 break; 749 case ARM64_VEC_SME: 750 if (test_tsk_thread_flag(target, TIF_SME_VL_INHERIT)) 751 header->flags |= SVE_PT_VL_INHERIT; 752 fpsimd_only = false; 753 break; 754 default: 755 WARN_ON_ONCE(1); 756 return; 757 } 758 759 if (active) { 760 if (fpsimd_only) { 761 header->flags |= SVE_PT_REGS_FPSIMD; 762 } else { 763 header->flags |= SVE_PT_REGS_SVE; 764 } 765 } 766 767 header->vl = task_get_vl(target, type); 768 vq = sve_vq_from_vl(header->vl); 769 770 header->max_vl = vec_max_vl(type); 771 header->size = SVE_PT_SIZE(vq, header->flags); 772 header->max_size = SVE_PT_SIZE(sve_vq_from_vl(header->max_vl), 773 SVE_PT_REGS_SVE); 774 } 775 776 static unsigned int sve_size_from_header(struct user_sve_header const *header) 777 { 778 return ALIGN(header->size, SVE_VQ_BYTES); 779 } 780 781 static int sve_get_common(struct task_struct *target, 782 const struct user_regset *regset, 783 struct membuf to, 784 enum vec_type type) 785 { 786 struct user_sve_header header; 787 unsigned int vq; 788 unsigned long start, end; 789 790 /* Header */ 791 sve_init_header_from_task(&header, target, type); 792 vq = sve_vq_from_vl(header.vl); 793 794 membuf_write(&to, &header, sizeof(header)); 795 796 if (target == current) 797 fpsimd_preserve_current_state(); 798 799 BUILD_BUG_ON(SVE_PT_FPSIMD_OFFSET != sizeof(header)); 800 BUILD_BUG_ON(SVE_PT_SVE_OFFSET != sizeof(header)); 801 802 switch ((header.flags & SVE_PT_REGS_MASK)) { 803 case SVE_PT_REGS_FPSIMD: 804 return __fpr_get(target, regset, to); 805 806 case SVE_PT_REGS_SVE: 807 start = SVE_PT_SVE_OFFSET; 808 end = SVE_PT_SVE_FFR_OFFSET(vq) + SVE_PT_SVE_FFR_SIZE(vq); 809 membuf_write(&to, target->thread.sve_state, end - start); 810 811 start = end; 812 end = SVE_PT_SVE_FPSR_OFFSET(vq); 813 membuf_zero(&to, end - start); 814 815 /* 816 * Copy fpsr, and fpcr which must follow contiguously in 817 * struct fpsimd_state: 818 */ 819 start = end; 820 end = SVE_PT_SVE_FPCR_OFFSET(vq) + SVE_PT_SVE_FPCR_SIZE; 821 membuf_write(&to, &target->thread.uw.fpsimd_state.fpsr, 822 end - start); 823 824 start = end; 825 end = sve_size_from_header(&header); 826 return membuf_zero(&to, end - start); 827 828 default: 829 return 0; 830 } 831 } 832 833 static int sve_get(struct task_struct *target, 834 const struct user_regset *regset, 835 struct membuf to) 836 { 837 if (!system_supports_sve()) 838 return -EINVAL; 839 840 return sve_get_common(target, regset, to, ARM64_VEC_SVE); 841 } 842 843 static int sve_set_common(struct task_struct *target, 844 const struct user_regset *regset, 845 unsigned int pos, unsigned int count, 846 const void *kbuf, const void __user *ubuf, 847 enum vec_type type) 848 { 849 int ret; 850 struct user_sve_header header; 851 unsigned int vq; 852 unsigned long start, end; 853 854 /* Header */ 855 if (count < sizeof(header)) 856 return -EINVAL; 857 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &header, 858 0, sizeof(header)); 859 if (ret) 860 goto out; 861 862 /* 863 * Apart from SVE_PT_REGS_MASK, all SVE_PT_* flags are consumed by 864 * vec_set_vector_length(), which will also validate them for us: 865 */ 866 ret = vec_set_vector_length(target, type, header.vl, 867 ((unsigned long)header.flags & ~SVE_PT_REGS_MASK) << 16); 868 if (ret) 869 goto out; 870 871 /* Actual VL set may be less than the user asked for: */ 872 vq = sve_vq_from_vl(task_get_vl(target, type)); 873 874 /* Enter/exit streaming mode */ 875 if (system_supports_sme()) { 876 u64 old_svcr = target->thread.svcr; 877 878 switch (type) { 879 case ARM64_VEC_SVE: 880 target->thread.svcr &= ~SVCR_SM_MASK; 881 break; 882 case ARM64_VEC_SME: 883 target->thread.svcr |= SVCR_SM_MASK; 884 885 /* 886 * Disable traps and ensure there is SME storage but 887 * preserve any currently set values in ZA/ZT. 888 */ 889 sme_alloc(target, false); 890 set_tsk_thread_flag(target, TIF_SME); 891 break; 892 default: 893 WARN_ON_ONCE(1); 894 ret = -EINVAL; 895 goto out; 896 } 897 898 /* 899 * If we switched then invalidate any existing SVE 900 * state and ensure there's storage. 901 */ 902 if (target->thread.svcr != old_svcr) 903 sve_alloc(target, true); 904 } 905 906 /* Registers: FPSIMD-only case */ 907 908 BUILD_BUG_ON(SVE_PT_FPSIMD_OFFSET != sizeof(header)); 909 if ((header.flags & SVE_PT_REGS_MASK) == SVE_PT_REGS_FPSIMD) { 910 ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 911 SVE_PT_FPSIMD_OFFSET); 912 clear_tsk_thread_flag(target, TIF_SVE); 913 target->thread.fp_type = FP_STATE_FPSIMD; 914 goto out; 915 } 916 917 /* 918 * Otherwise: no registers or full SVE case. For backwards 919 * compatibility reasons we treat empty flags as SVE registers. 920 */ 921 922 /* 923 * If setting a different VL from the requested VL and there is 924 * register data, the data layout will be wrong: don't even 925 * try to set the registers in this case. 926 */ 927 if (count && vq != sve_vq_from_vl(header.vl)) { 928 ret = -EIO; 929 goto out; 930 } 931 932 sve_alloc(target, true); 933 if (!target->thread.sve_state) { 934 ret = -ENOMEM; 935 clear_tsk_thread_flag(target, TIF_SVE); 936 target->thread.fp_type = FP_STATE_FPSIMD; 937 goto out; 938 } 939 940 /* 941 * Ensure target->thread.sve_state is up to date with target's 942 * FPSIMD regs, so that a short copyin leaves trailing 943 * registers unmodified. Only enable SVE if we are 944 * configuring normal SVE, a system with streaming SVE may not 945 * have normal SVE. 946 */ 947 fpsimd_sync_to_sve(target); 948 if (type == ARM64_VEC_SVE) 949 set_tsk_thread_flag(target, TIF_SVE); 950 target->thread.fp_type = FP_STATE_SVE; 951 952 BUILD_BUG_ON(SVE_PT_SVE_OFFSET != sizeof(header)); 953 start = SVE_PT_SVE_OFFSET; 954 end = SVE_PT_SVE_FFR_OFFSET(vq) + SVE_PT_SVE_FFR_SIZE(vq); 955 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 956 target->thread.sve_state, 957 start, end); 958 if (ret) 959 goto out; 960 961 start = end; 962 end = SVE_PT_SVE_FPSR_OFFSET(vq); 963 user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, start, end); 964 965 /* 966 * Copy fpsr, and fpcr which must follow contiguously in 967 * struct fpsimd_state: 968 */ 969 start = end; 970 end = SVE_PT_SVE_FPCR_OFFSET(vq) + SVE_PT_SVE_FPCR_SIZE; 971 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 972 &target->thread.uw.fpsimd_state.fpsr, 973 start, end); 974 975 out: 976 fpsimd_flush_task_state(target); 977 return ret; 978 } 979 980 static int sve_set(struct task_struct *target, 981 const struct user_regset *regset, 982 unsigned int pos, unsigned int count, 983 const void *kbuf, const void __user *ubuf) 984 { 985 if (!system_supports_sve()) 986 return -EINVAL; 987 988 return sve_set_common(target, regset, pos, count, kbuf, ubuf, 989 ARM64_VEC_SVE); 990 } 991 992 #endif /* CONFIG_ARM64_SVE */ 993 994 #ifdef CONFIG_ARM64_SME 995 996 static int ssve_get(struct task_struct *target, 997 const struct user_regset *regset, 998 struct membuf to) 999 { 1000 if (!system_supports_sme()) 1001 return -EINVAL; 1002 1003 return sve_get_common(target, regset, to, ARM64_VEC_SME); 1004 } 1005 1006 static int ssve_set(struct task_struct *target, 1007 const struct user_regset *regset, 1008 unsigned int pos, unsigned int count, 1009 const void *kbuf, const void __user *ubuf) 1010 { 1011 if (!system_supports_sme()) 1012 return -EINVAL; 1013 1014 return sve_set_common(target, regset, pos, count, kbuf, ubuf, 1015 ARM64_VEC_SME); 1016 } 1017 1018 static int za_get(struct task_struct *target, 1019 const struct user_regset *regset, 1020 struct membuf to) 1021 { 1022 struct user_za_header header; 1023 unsigned int vq; 1024 unsigned long start, end; 1025 1026 if (!system_supports_sme()) 1027 return -EINVAL; 1028 1029 /* Header */ 1030 memset(&header, 0, sizeof(header)); 1031 1032 if (test_tsk_thread_flag(target, TIF_SME_VL_INHERIT)) 1033 header.flags |= ZA_PT_VL_INHERIT; 1034 1035 header.vl = task_get_sme_vl(target); 1036 vq = sve_vq_from_vl(header.vl); 1037 header.max_vl = sme_max_vl(); 1038 header.max_size = ZA_PT_SIZE(vq); 1039 1040 /* If ZA is not active there is only the header */ 1041 if (thread_za_enabled(&target->thread)) 1042 header.size = ZA_PT_SIZE(vq); 1043 else 1044 header.size = ZA_PT_ZA_OFFSET; 1045 1046 membuf_write(&to, &header, sizeof(header)); 1047 1048 BUILD_BUG_ON(ZA_PT_ZA_OFFSET != sizeof(header)); 1049 end = ZA_PT_ZA_OFFSET; 1050 1051 if (target == current) 1052 fpsimd_preserve_current_state(); 1053 1054 /* Any register data to include? */ 1055 if (thread_za_enabled(&target->thread)) { 1056 start = end; 1057 end = ZA_PT_SIZE(vq); 1058 membuf_write(&to, target->thread.sme_state, end - start); 1059 } 1060 1061 /* Zero any trailing padding */ 1062 start = end; 1063 end = ALIGN(header.size, SVE_VQ_BYTES); 1064 return membuf_zero(&to, end - start); 1065 } 1066 1067 static int za_set(struct task_struct *target, 1068 const struct user_regset *regset, 1069 unsigned int pos, unsigned int count, 1070 const void *kbuf, const void __user *ubuf) 1071 { 1072 int ret; 1073 struct user_za_header header; 1074 unsigned int vq; 1075 unsigned long start, end; 1076 1077 if (!system_supports_sme()) 1078 return -EINVAL; 1079 1080 /* Header */ 1081 if (count < sizeof(header)) 1082 return -EINVAL; 1083 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &header, 1084 0, sizeof(header)); 1085 if (ret) 1086 goto out; 1087 1088 /* 1089 * All current ZA_PT_* flags are consumed by 1090 * vec_set_vector_length(), which will also validate them for 1091 * us: 1092 */ 1093 ret = vec_set_vector_length(target, ARM64_VEC_SME, header.vl, 1094 ((unsigned long)header.flags) << 16); 1095 if (ret) 1096 goto out; 1097 1098 /* Actual VL set may be less than the user asked for: */ 1099 vq = sve_vq_from_vl(task_get_sme_vl(target)); 1100 1101 /* Ensure there is some SVE storage for streaming mode */ 1102 if (!target->thread.sve_state) { 1103 sve_alloc(target, false); 1104 if (!target->thread.sve_state) { 1105 ret = -ENOMEM; 1106 goto out; 1107 } 1108 } 1109 1110 /* Allocate/reinit ZA storage */ 1111 sme_alloc(target, true); 1112 if (!target->thread.sme_state) { 1113 ret = -ENOMEM; 1114 goto out; 1115 } 1116 1117 /* If there is no data then disable ZA */ 1118 if (!count) { 1119 target->thread.svcr &= ~SVCR_ZA_MASK; 1120 goto out; 1121 } 1122 1123 /* 1124 * If setting a different VL from the requested VL and there is 1125 * register data, the data layout will be wrong: don't even 1126 * try to set the registers in this case. 1127 */ 1128 if (vq != sve_vq_from_vl(header.vl)) { 1129 ret = -EIO; 1130 goto out; 1131 } 1132 1133 BUILD_BUG_ON(ZA_PT_ZA_OFFSET != sizeof(header)); 1134 start = ZA_PT_ZA_OFFSET; 1135 end = ZA_PT_SIZE(vq); 1136 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 1137 target->thread.sme_state, 1138 start, end); 1139 if (ret) 1140 goto out; 1141 1142 /* Mark ZA as active and let userspace use it */ 1143 set_tsk_thread_flag(target, TIF_SME); 1144 target->thread.svcr |= SVCR_ZA_MASK; 1145 1146 out: 1147 fpsimd_flush_task_state(target); 1148 return ret; 1149 } 1150 1151 static int zt_get(struct task_struct *target, 1152 const struct user_regset *regset, 1153 struct membuf to) 1154 { 1155 if (!system_supports_sme2()) 1156 return -EINVAL; 1157 1158 /* 1159 * If PSTATE.ZA is not set then ZT will be zeroed when it is 1160 * enabled so report the current register value as zero. 1161 */ 1162 if (thread_za_enabled(&target->thread)) 1163 membuf_write(&to, thread_zt_state(&target->thread), 1164 ZT_SIG_REG_BYTES); 1165 else 1166 membuf_zero(&to, ZT_SIG_REG_BYTES); 1167 1168 return 0; 1169 } 1170 1171 static int zt_set(struct task_struct *target, 1172 const struct user_regset *regset, 1173 unsigned int pos, unsigned int count, 1174 const void *kbuf, const void __user *ubuf) 1175 { 1176 int ret; 1177 1178 if (!system_supports_sme2()) 1179 return -EINVAL; 1180 1181 /* Ensure SVE storage in case this is first use of SME */ 1182 sve_alloc(target, false); 1183 if (!target->thread.sve_state) 1184 return -ENOMEM; 1185 1186 if (!thread_za_enabled(&target->thread)) { 1187 sme_alloc(target, true); 1188 if (!target->thread.sme_state) 1189 return -ENOMEM; 1190 } 1191 1192 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 1193 thread_zt_state(&target->thread), 1194 0, ZT_SIG_REG_BYTES); 1195 if (ret == 0) { 1196 target->thread.svcr |= SVCR_ZA_MASK; 1197 set_tsk_thread_flag(target, TIF_SME); 1198 } 1199 1200 fpsimd_flush_task_state(target); 1201 1202 return ret; 1203 } 1204 1205 #endif /* CONFIG_ARM64_SME */ 1206 1207 #ifdef CONFIG_ARM64_PTR_AUTH 1208 static int pac_mask_get(struct task_struct *target, 1209 const struct user_regset *regset, 1210 struct membuf to) 1211 { 1212 /* 1213 * The PAC bits can differ across data and instruction pointers 1214 * depending on TCR_EL1.TBID*, which we may make use of in future, so 1215 * we expose separate masks. 1216 */ 1217 unsigned long mask = ptrauth_user_pac_mask(); 1218 struct user_pac_mask uregs = { 1219 .data_mask = mask, 1220 .insn_mask = mask, 1221 }; 1222 1223 if (!system_supports_address_auth()) 1224 return -EINVAL; 1225 1226 return membuf_write(&to, &uregs, sizeof(uregs)); 1227 } 1228 1229 static int pac_enabled_keys_get(struct task_struct *target, 1230 const struct user_regset *regset, 1231 struct membuf to) 1232 { 1233 long enabled_keys = ptrauth_get_enabled_keys(target); 1234 1235 if (IS_ERR_VALUE(enabled_keys)) 1236 return enabled_keys; 1237 1238 return membuf_write(&to, &enabled_keys, sizeof(enabled_keys)); 1239 } 1240 1241 static int pac_enabled_keys_set(struct task_struct *target, 1242 const struct user_regset *regset, 1243 unsigned int pos, unsigned int count, 1244 const void *kbuf, const void __user *ubuf) 1245 { 1246 int ret; 1247 long enabled_keys = ptrauth_get_enabled_keys(target); 1248 1249 if (IS_ERR_VALUE(enabled_keys)) 1250 return enabled_keys; 1251 1252 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &enabled_keys, 0, 1253 sizeof(long)); 1254 if (ret) 1255 return ret; 1256 1257 return ptrauth_set_enabled_keys(target, PR_PAC_ENABLED_KEYS_MASK, 1258 enabled_keys); 1259 } 1260 1261 #ifdef CONFIG_CHECKPOINT_RESTORE 1262 static __uint128_t pac_key_to_user(const struct ptrauth_key *key) 1263 { 1264 return (__uint128_t)key->hi << 64 | key->lo; 1265 } 1266 1267 static struct ptrauth_key pac_key_from_user(__uint128_t ukey) 1268 { 1269 struct ptrauth_key key = { 1270 .lo = (unsigned long)ukey, 1271 .hi = (unsigned long)(ukey >> 64), 1272 }; 1273 1274 return key; 1275 } 1276 1277 static void pac_address_keys_to_user(struct user_pac_address_keys *ukeys, 1278 const struct ptrauth_keys_user *keys) 1279 { 1280 ukeys->apiakey = pac_key_to_user(&keys->apia); 1281 ukeys->apibkey = pac_key_to_user(&keys->apib); 1282 ukeys->apdakey = pac_key_to_user(&keys->apda); 1283 ukeys->apdbkey = pac_key_to_user(&keys->apdb); 1284 } 1285 1286 static void pac_address_keys_from_user(struct ptrauth_keys_user *keys, 1287 const struct user_pac_address_keys *ukeys) 1288 { 1289 keys->apia = pac_key_from_user(ukeys->apiakey); 1290 keys->apib = pac_key_from_user(ukeys->apibkey); 1291 keys->apda = pac_key_from_user(ukeys->apdakey); 1292 keys->apdb = pac_key_from_user(ukeys->apdbkey); 1293 } 1294 1295 static int pac_address_keys_get(struct task_struct *target, 1296 const struct user_regset *regset, 1297 struct membuf to) 1298 { 1299 struct ptrauth_keys_user *keys = &target->thread.keys_user; 1300 struct user_pac_address_keys user_keys; 1301 1302 if (!system_supports_address_auth()) 1303 return -EINVAL; 1304 1305 pac_address_keys_to_user(&user_keys, keys); 1306 1307 return membuf_write(&to, &user_keys, sizeof(user_keys)); 1308 } 1309 1310 static int pac_address_keys_set(struct task_struct *target, 1311 const struct user_regset *regset, 1312 unsigned int pos, unsigned int count, 1313 const void *kbuf, const void __user *ubuf) 1314 { 1315 struct ptrauth_keys_user *keys = &target->thread.keys_user; 1316 struct user_pac_address_keys user_keys; 1317 int ret; 1318 1319 if (!system_supports_address_auth()) 1320 return -EINVAL; 1321 1322 pac_address_keys_to_user(&user_keys, keys); 1323 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 1324 &user_keys, 0, -1); 1325 if (ret) 1326 return ret; 1327 pac_address_keys_from_user(keys, &user_keys); 1328 1329 return 0; 1330 } 1331 1332 static void pac_generic_keys_to_user(struct user_pac_generic_keys *ukeys, 1333 const struct ptrauth_keys_user *keys) 1334 { 1335 ukeys->apgakey = pac_key_to_user(&keys->apga); 1336 } 1337 1338 static void pac_generic_keys_from_user(struct ptrauth_keys_user *keys, 1339 const struct user_pac_generic_keys *ukeys) 1340 { 1341 keys->apga = pac_key_from_user(ukeys->apgakey); 1342 } 1343 1344 static int pac_generic_keys_get(struct task_struct *target, 1345 const struct user_regset *regset, 1346 struct membuf to) 1347 { 1348 struct ptrauth_keys_user *keys = &target->thread.keys_user; 1349 struct user_pac_generic_keys user_keys; 1350 1351 if (!system_supports_generic_auth()) 1352 return -EINVAL; 1353 1354 pac_generic_keys_to_user(&user_keys, keys); 1355 1356 return membuf_write(&to, &user_keys, sizeof(user_keys)); 1357 } 1358 1359 static int pac_generic_keys_set(struct task_struct *target, 1360 const struct user_regset *regset, 1361 unsigned int pos, unsigned int count, 1362 const void *kbuf, const void __user *ubuf) 1363 { 1364 struct ptrauth_keys_user *keys = &target->thread.keys_user; 1365 struct user_pac_generic_keys user_keys; 1366 int ret; 1367 1368 if (!system_supports_generic_auth()) 1369 return -EINVAL; 1370 1371 pac_generic_keys_to_user(&user_keys, keys); 1372 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 1373 &user_keys, 0, -1); 1374 if (ret) 1375 return ret; 1376 pac_generic_keys_from_user(keys, &user_keys); 1377 1378 return 0; 1379 } 1380 #endif /* CONFIG_CHECKPOINT_RESTORE */ 1381 #endif /* CONFIG_ARM64_PTR_AUTH */ 1382 1383 #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI 1384 static int tagged_addr_ctrl_get(struct task_struct *target, 1385 const struct user_regset *regset, 1386 struct membuf to) 1387 { 1388 long ctrl = get_tagged_addr_ctrl(target); 1389 1390 if (IS_ERR_VALUE(ctrl)) 1391 return ctrl; 1392 1393 return membuf_write(&to, &ctrl, sizeof(ctrl)); 1394 } 1395 1396 static int tagged_addr_ctrl_set(struct task_struct *target, const struct 1397 user_regset *regset, unsigned int pos, 1398 unsigned int count, const void *kbuf, const 1399 void __user *ubuf) 1400 { 1401 int ret; 1402 long ctrl; 1403 1404 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); 1405 if (ret) 1406 return ret; 1407 1408 return set_tagged_addr_ctrl(target, ctrl); 1409 } 1410 #endif 1411 1412 enum aarch64_regset { 1413 REGSET_GPR, 1414 REGSET_FPR, 1415 REGSET_TLS, 1416 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1417 REGSET_HW_BREAK, 1418 REGSET_HW_WATCH, 1419 #endif 1420 REGSET_SYSTEM_CALL, 1421 #ifdef CONFIG_ARM64_SVE 1422 REGSET_SVE, 1423 #endif 1424 #ifdef CONFIG_ARM64_SME 1425 REGSET_SSVE, 1426 REGSET_ZA, 1427 REGSET_ZT, 1428 #endif 1429 #ifdef CONFIG_ARM64_PTR_AUTH 1430 REGSET_PAC_MASK, 1431 REGSET_PAC_ENABLED_KEYS, 1432 #ifdef CONFIG_CHECKPOINT_RESTORE 1433 REGSET_PACA_KEYS, 1434 REGSET_PACG_KEYS, 1435 #endif 1436 #endif 1437 #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI 1438 REGSET_TAGGED_ADDR_CTRL, 1439 #endif 1440 }; 1441 1442 static const struct user_regset aarch64_regsets[] = { 1443 [REGSET_GPR] = { 1444 .core_note_type = NT_PRSTATUS, 1445 .n = sizeof(struct user_pt_regs) / sizeof(u64), 1446 .size = sizeof(u64), 1447 .align = sizeof(u64), 1448 .regset_get = gpr_get, 1449 .set = gpr_set 1450 }, 1451 [REGSET_FPR] = { 1452 .core_note_type = NT_PRFPREG, 1453 .n = sizeof(struct user_fpsimd_state) / sizeof(u32), 1454 /* 1455 * We pretend we have 32-bit registers because the fpsr and 1456 * fpcr are 32-bits wide. 1457 */ 1458 .size = sizeof(u32), 1459 .align = sizeof(u32), 1460 .active = fpr_active, 1461 .regset_get = fpr_get, 1462 .set = fpr_set 1463 }, 1464 [REGSET_TLS] = { 1465 .core_note_type = NT_ARM_TLS, 1466 .n = 2, 1467 .size = sizeof(void *), 1468 .align = sizeof(void *), 1469 .regset_get = tls_get, 1470 .set = tls_set, 1471 }, 1472 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1473 [REGSET_HW_BREAK] = { 1474 .core_note_type = NT_ARM_HW_BREAK, 1475 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1476 .size = sizeof(u32), 1477 .align = sizeof(u32), 1478 .regset_get = hw_break_get, 1479 .set = hw_break_set, 1480 }, 1481 [REGSET_HW_WATCH] = { 1482 .core_note_type = NT_ARM_HW_WATCH, 1483 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1484 .size = sizeof(u32), 1485 .align = sizeof(u32), 1486 .regset_get = hw_break_get, 1487 .set = hw_break_set, 1488 }, 1489 #endif 1490 [REGSET_SYSTEM_CALL] = { 1491 .core_note_type = NT_ARM_SYSTEM_CALL, 1492 .n = 1, 1493 .size = sizeof(int), 1494 .align = sizeof(int), 1495 .regset_get = system_call_get, 1496 .set = system_call_set, 1497 }, 1498 #ifdef CONFIG_ARM64_SVE 1499 [REGSET_SVE] = { /* Scalable Vector Extension */ 1500 .core_note_type = NT_ARM_SVE, 1501 .n = DIV_ROUND_UP(SVE_PT_SIZE(SVE_VQ_MAX, SVE_PT_REGS_SVE), 1502 SVE_VQ_BYTES), 1503 .size = SVE_VQ_BYTES, 1504 .align = SVE_VQ_BYTES, 1505 .regset_get = sve_get, 1506 .set = sve_set, 1507 }, 1508 #endif 1509 #ifdef CONFIG_ARM64_SME 1510 [REGSET_SSVE] = { /* Streaming mode SVE */ 1511 .core_note_type = NT_ARM_SSVE, 1512 .n = DIV_ROUND_UP(SVE_PT_SIZE(SME_VQ_MAX, SVE_PT_REGS_SVE), 1513 SVE_VQ_BYTES), 1514 .size = SVE_VQ_BYTES, 1515 .align = SVE_VQ_BYTES, 1516 .regset_get = ssve_get, 1517 .set = ssve_set, 1518 }, 1519 [REGSET_ZA] = { /* SME ZA */ 1520 .core_note_type = NT_ARM_ZA, 1521 /* 1522 * ZA is a single register but it's variably sized and 1523 * the ptrace core requires that the size of any data 1524 * be an exact multiple of the configured register 1525 * size so report as though we had SVE_VQ_BYTES 1526 * registers. These values aren't exposed to 1527 * userspace. 1528 */ 1529 .n = DIV_ROUND_UP(ZA_PT_SIZE(SME_VQ_MAX), SVE_VQ_BYTES), 1530 .size = SVE_VQ_BYTES, 1531 .align = SVE_VQ_BYTES, 1532 .regset_get = za_get, 1533 .set = za_set, 1534 }, 1535 [REGSET_ZT] = { /* SME ZT */ 1536 .core_note_type = NT_ARM_ZT, 1537 .n = 1, 1538 .size = ZT_SIG_REG_BYTES, 1539 .align = sizeof(u64), 1540 .regset_get = zt_get, 1541 .set = zt_set, 1542 }, 1543 #endif 1544 #ifdef CONFIG_ARM64_PTR_AUTH 1545 [REGSET_PAC_MASK] = { 1546 .core_note_type = NT_ARM_PAC_MASK, 1547 .n = sizeof(struct user_pac_mask) / sizeof(u64), 1548 .size = sizeof(u64), 1549 .align = sizeof(u64), 1550 .regset_get = pac_mask_get, 1551 /* this cannot be set dynamically */ 1552 }, 1553 [REGSET_PAC_ENABLED_KEYS] = { 1554 .core_note_type = NT_ARM_PAC_ENABLED_KEYS, 1555 .n = 1, 1556 .size = sizeof(long), 1557 .align = sizeof(long), 1558 .regset_get = pac_enabled_keys_get, 1559 .set = pac_enabled_keys_set, 1560 }, 1561 #ifdef CONFIG_CHECKPOINT_RESTORE 1562 [REGSET_PACA_KEYS] = { 1563 .core_note_type = NT_ARM_PACA_KEYS, 1564 .n = sizeof(struct user_pac_address_keys) / sizeof(__uint128_t), 1565 .size = sizeof(__uint128_t), 1566 .align = sizeof(__uint128_t), 1567 .regset_get = pac_address_keys_get, 1568 .set = pac_address_keys_set, 1569 }, 1570 [REGSET_PACG_KEYS] = { 1571 .core_note_type = NT_ARM_PACG_KEYS, 1572 .n = sizeof(struct user_pac_generic_keys) / sizeof(__uint128_t), 1573 .size = sizeof(__uint128_t), 1574 .align = sizeof(__uint128_t), 1575 .regset_get = pac_generic_keys_get, 1576 .set = pac_generic_keys_set, 1577 }, 1578 #endif 1579 #endif 1580 #ifdef CONFIG_ARM64_TAGGED_ADDR_ABI 1581 [REGSET_TAGGED_ADDR_CTRL] = { 1582 .core_note_type = NT_ARM_TAGGED_ADDR_CTRL, 1583 .n = 1, 1584 .size = sizeof(long), 1585 .align = sizeof(long), 1586 .regset_get = tagged_addr_ctrl_get, 1587 .set = tagged_addr_ctrl_set, 1588 }, 1589 #endif 1590 }; 1591 1592 static const struct user_regset_view user_aarch64_view = { 1593 .name = "aarch64", .e_machine = EM_AARCH64, 1594 .regsets = aarch64_regsets, .n = ARRAY_SIZE(aarch64_regsets) 1595 }; 1596 1597 #ifdef CONFIG_COMPAT 1598 enum compat_regset { 1599 REGSET_COMPAT_GPR, 1600 REGSET_COMPAT_VFP, 1601 }; 1602 1603 static inline compat_ulong_t compat_get_user_reg(struct task_struct *task, int idx) 1604 { 1605 struct pt_regs *regs = task_pt_regs(task); 1606 1607 switch (idx) { 1608 case 15: 1609 return regs->pc; 1610 case 16: 1611 return pstate_to_compat_psr(regs->pstate); 1612 case 17: 1613 return regs->orig_x0; 1614 default: 1615 return regs->regs[idx]; 1616 } 1617 } 1618 1619 static int compat_gpr_get(struct task_struct *target, 1620 const struct user_regset *regset, 1621 struct membuf to) 1622 { 1623 int i = 0; 1624 1625 while (to.left) 1626 membuf_store(&to, compat_get_user_reg(target, i++)); 1627 return 0; 1628 } 1629 1630 static int compat_gpr_set(struct task_struct *target, 1631 const struct user_regset *regset, 1632 unsigned int pos, unsigned int count, 1633 const void *kbuf, const void __user *ubuf) 1634 { 1635 struct pt_regs newregs; 1636 int ret = 0; 1637 unsigned int i, start, num_regs; 1638 1639 /* Calculate the number of AArch32 registers contained in count */ 1640 num_regs = count / regset->size; 1641 1642 /* Convert pos into an register number */ 1643 start = pos / regset->size; 1644 1645 if (start + num_regs > regset->n) 1646 return -EIO; 1647 1648 newregs = *task_pt_regs(target); 1649 1650 for (i = 0; i < num_regs; ++i) { 1651 unsigned int idx = start + i; 1652 compat_ulong_t reg; 1653 1654 if (kbuf) { 1655 memcpy(®, kbuf, sizeof(reg)); 1656 kbuf += sizeof(reg); 1657 } else { 1658 ret = copy_from_user(®, ubuf, sizeof(reg)); 1659 if (ret) { 1660 ret = -EFAULT; 1661 break; 1662 } 1663 1664 ubuf += sizeof(reg); 1665 } 1666 1667 switch (idx) { 1668 case 15: 1669 newregs.pc = reg; 1670 break; 1671 case 16: 1672 reg = compat_psr_to_pstate(reg); 1673 newregs.pstate = reg; 1674 break; 1675 case 17: 1676 newregs.orig_x0 = reg; 1677 break; 1678 default: 1679 newregs.regs[idx] = reg; 1680 } 1681 1682 } 1683 1684 if (valid_user_regs(&newregs.user_regs, target)) 1685 *task_pt_regs(target) = newregs; 1686 else 1687 ret = -EINVAL; 1688 1689 return ret; 1690 } 1691 1692 static int compat_vfp_get(struct task_struct *target, 1693 const struct user_regset *regset, 1694 struct membuf to) 1695 { 1696 struct user_fpsimd_state *uregs; 1697 compat_ulong_t fpscr; 1698 1699 if (!system_supports_fpsimd()) 1700 return -EINVAL; 1701 1702 uregs = &target->thread.uw.fpsimd_state; 1703 1704 if (target == current) 1705 fpsimd_preserve_current_state(); 1706 1707 /* 1708 * The VFP registers are packed into the fpsimd_state, so they all sit 1709 * nicely together for us. We just need to create the fpscr separately. 1710 */ 1711 membuf_write(&to, uregs, VFP_STATE_SIZE - sizeof(compat_ulong_t)); 1712 fpscr = (uregs->fpsr & VFP_FPSCR_STAT_MASK) | 1713 (uregs->fpcr & VFP_FPSCR_CTRL_MASK); 1714 return membuf_store(&to, fpscr); 1715 } 1716 1717 static int compat_vfp_set(struct task_struct *target, 1718 const struct user_regset *regset, 1719 unsigned int pos, unsigned int count, 1720 const void *kbuf, const void __user *ubuf) 1721 { 1722 struct user_fpsimd_state *uregs; 1723 compat_ulong_t fpscr; 1724 int ret, vregs_end_pos; 1725 1726 if (!system_supports_fpsimd()) 1727 return -EINVAL; 1728 1729 uregs = &target->thread.uw.fpsimd_state; 1730 1731 vregs_end_pos = VFP_STATE_SIZE - sizeof(compat_ulong_t); 1732 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0, 1733 vregs_end_pos); 1734 1735 if (count && !ret) { 1736 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &fpscr, 1737 vregs_end_pos, VFP_STATE_SIZE); 1738 if (!ret) { 1739 uregs->fpsr = fpscr & VFP_FPSCR_STAT_MASK; 1740 uregs->fpcr = fpscr & VFP_FPSCR_CTRL_MASK; 1741 } 1742 } 1743 1744 fpsimd_flush_task_state(target); 1745 return ret; 1746 } 1747 1748 static int compat_tls_get(struct task_struct *target, 1749 const struct user_regset *regset, 1750 struct membuf to) 1751 { 1752 return membuf_store(&to, (compat_ulong_t)target->thread.uw.tp_value); 1753 } 1754 1755 static int compat_tls_set(struct task_struct *target, 1756 const struct user_regset *regset, unsigned int pos, 1757 unsigned int count, const void *kbuf, 1758 const void __user *ubuf) 1759 { 1760 int ret; 1761 compat_ulong_t tls = target->thread.uw.tp_value; 1762 1763 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); 1764 if (ret) 1765 return ret; 1766 1767 target->thread.uw.tp_value = tls; 1768 return ret; 1769 } 1770 1771 static const struct user_regset aarch32_regsets[] = { 1772 [REGSET_COMPAT_GPR] = { 1773 .core_note_type = NT_PRSTATUS, 1774 .n = COMPAT_ELF_NGREG, 1775 .size = sizeof(compat_elf_greg_t), 1776 .align = sizeof(compat_elf_greg_t), 1777 .regset_get = compat_gpr_get, 1778 .set = compat_gpr_set 1779 }, 1780 [REGSET_COMPAT_VFP] = { 1781 .core_note_type = NT_ARM_VFP, 1782 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), 1783 .size = sizeof(compat_ulong_t), 1784 .align = sizeof(compat_ulong_t), 1785 .active = fpr_active, 1786 .regset_get = compat_vfp_get, 1787 .set = compat_vfp_set 1788 }, 1789 }; 1790 1791 static const struct user_regset_view user_aarch32_view = { 1792 .name = "aarch32", .e_machine = EM_ARM, 1793 .regsets = aarch32_regsets, .n = ARRAY_SIZE(aarch32_regsets) 1794 }; 1795 1796 static const struct user_regset aarch32_ptrace_regsets[] = { 1797 [REGSET_GPR] = { 1798 .core_note_type = NT_PRSTATUS, 1799 .n = COMPAT_ELF_NGREG, 1800 .size = sizeof(compat_elf_greg_t), 1801 .align = sizeof(compat_elf_greg_t), 1802 .regset_get = compat_gpr_get, 1803 .set = compat_gpr_set 1804 }, 1805 [REGSET_FPR] = { 1806 .core_note_type = NT_ARM_VFP, 1807 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), 1808 .size = sizeof(compat_ulong_t), 1809 .align = sizeof(compat_ulong_t), 1810 .regset_get = compat_vfp_get, 1811 .set = compat_vfp_set 1812 }, 1813 [REGSET_TLS] = { 1814 .core_note_type = NT_ARM_TLS, 1815 .n = 1, 1816 .size = sizeof(compat_ulong_t), 1817 .align = sizeof(compat_ulong_t), 1818 .regset_get = compat_tls_get, 1819 .set = compat_tls_set, 1820 }, 1821 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1822 [REGSET_HW_BREAK] = { 1823 .core_note_type = NT_ARM_HW_BREAK, 1824 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1825 .size = sizeof(u32), 1826 .align = sizeof(u32), 1827 .regset_get = hw_break_get, 1828 .set = hw_break_set, 1829 }, 1830 [REGSET_HW_WATCH] = { 1831 .core_note_type = NT_ARM_HW_WATCH, 1832 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1833 .size = sizeof(u32), 1834 .align = sizeof(u32), 1835 .regset_get = hw_break_get, 1836 .set = hw_break_set, 1837 }, 1838 #endif 1839 [REGSET_SYSTEM_CALL] = { 1840 .core_note_type = NT_ARM_SYSTEM_CALL, 1841 .n = 1, 1842 .size = sizeof(int), 1843 .align = sizeof(int), 1844 .regset_get = system_call_get, 1845 .set = system_call_set, 1846 }, 1847 }; 1848 1849 static const struct user_regset_view user_aarch32_ptrace_view = { 1850 .name = "aarch32", .e_machine = EM_ARM, 1851 .regsets = aarch32_ptrace_regsets, .n = ARRAY_SIZE(aarch32_ptrace_regsets) 1852 }; 1853 1854 static int compat_ptrace_read_user(struct task_struct *tsk, compat_ulong_t off, 1855 compat_ulong_t __user *ret) 1856 { 1857 compat_ulong_t tmp; 1858 1859 if (off & 3) 1860 return -EIO; 1861 1862 if (off == COMPAT_PT_TEXT_ADDR) 1863 tmp = tsk->mm->start_code; 1864 else if (off == COMPAT_PT_DATA_ADDR) 1865 tmp = tsk->mm->start_data; 1866 else if (off == COMPAT_PT_TEXT_END_ADDR) 1867 tmp = tsk->mm->end_code; 1868 else if (off < sizeof(compat_elf_gregset_t)) 1869 tmp = compat_get_user_reg(tsk, off >> 2); 1870 else if (off >= COMPAT_USER_SZ) 1871 return -EIO; 1872 else 1873 tmp = 0; 1874 1875 return put_user(tmp, ret); 1876 } 1877 1878 static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, 1879 compat_ulong_t val) 1880 { 1881 struct pt_regs newregs = *task_pt_regs(tsk); 1882 unsigned int idx = off / 4; 1883 1884 if (off & 3 || off >= COMPAT_USER_SZ) 1885 return -EIO; 1886 1887 if (off >= sizeof(compat_elf_gregset_t)) 1888 return 0; 1889 1890 switch (idx) { 1891 case 15: 1892 newregs.pc = val; 1893 break; 1894 case 16: 1895 newregs.pstate = compat_psr_to_pstate(val); 1896 break; 1897 case 17: 1898 newregs.orig_x0 = val; 1899 break; 1900 default: 1901 newregs.regs[idx] = val; 1902 } 1903 1904 if (!valid_user_regs(&newregs.user_regs, tsk)) 1905 return -EINVAL; 1906 1907 *task_pt_regs(tsk) = newregs; 1908 return 0; 1909 } 1910 1911 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1912 1913 /* 1914 * Convert a virtual register number into an index for a thread_info 1915 * breakpoint array. Breakpoints are identified using positive numbers 1916 * whilst watchpoints are negative. The registers are laid out as pairs 1917 * of (address, control), each pair mapping to a unique hw_breakpoint struct. 1918 * Register 0 is reserved for describing resource information. 1919 */ 1920 static int compat_ptrace_hbp_num_to_idx(compat_long_t num) 1921 { 1922 return (abs(num) - 1) >> 1; 1923 } 1924 1925 static int compat_ptrace_hbp_get_resource_info(u32 *kdata) 1926 { 1927 u8 num_brps, num_wrps, debug_arch, wp_len; 1928 u32 reg = 0; 1929 1930 num_brps = hw_breakpoint_slots(TYPE_INST); 1931 num_wrps = hw_breakpoint_slots(TYPE_DATA); 1932 1933 debug_arch = debug_monitors_arch(); 1934 wp_len = 8; 1935 reg |= debug_arch; 1936 reg <<= 8; 1937 reg |= wp_len; 1938 reg <<= 8; 1939 reg |= num_wrps; 1940 reg <<= 8; 1941 reg |= num_brps; 1942 1943 *kdata = reg; 1944 return 0; 1945 } 1946 1947 static int compat_ptrace_hbp_get(unsigned int note_type, 1948 struct task_struct *tsk, 1949 compat_long_t num, 1950 u32 *kdata) 1951 { 1952 u64 addr = 0; 1953 u32 ctrl = 0; 1954 1955 int err, idx = compat_ptrace_hbp_num_to_idx(num); 1956 1957 if (num & 1) { 1958 err = ptrace_hbp_get_addr(note_type, tsk, idx, &addr); 1959 *kdata = (u32)addr; 1960 } else { 1961 err = ptrace_hbp_get_ctrl(note_type, tsk, idx, &ctrl); 1962 *kdata = ctrl; 1963 } 1964 1965 return err; 1966 } 1967 1968 static int compat_ptrace_hbp_set(unsigned int note_type, 1969 struct task_struct *tsk, 1970 compat_long_t num, 1971 u32 *kdata) 1972 { 1973 u64 addr; 1974 u32 ctrl; 1975 1976 int err, idx = compat_ptrace_hbp_num_to_idx(num); 1977 1978 if (num & 1) { 1979 addr = *kdata; 1980 err = ptrace_hbp_set_addr(note_type, tsk, idx, addr); 1981 } else { 1982 ctrl = *kdata; 1983 err = ptrace_hbp_set_ctrl(note_type, tsk, idx, ctrl); 1984 } 1985 1986 return err; 1987 } 1988 1989 static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, 1990 compat_ulong_t __user *data) 1991 { 1992 int ret; 1993 u32 kdata; 1994 1995 /* Watchpoint */ 1996 if (num < 0) { 1997 ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata); 1998 /* Resource info */ 1999 } else if (num == 0) { 2000 ret = compat_ptrace_hbp_get_resource_info(&kdata); 2001 /* Breakpoint */ 2002 } else { 2003 ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata); 2004 } 2005 2006 if (!ret) 2007 ret = put_user(kdata, data); 2008 2009 return ret; 2010 } 2011 2012 static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, 2013 compat_ulong_t __user *data) 2014 { 2015 int ret; 2016 u32 kdata = 0; 2017 2018 if (num == 0) 2019 return 0; 2020 2021 ret = get_user(kdata, data); 2022 if (ret) 2023 return ret; 2024 2025 if (num < 0) 2026 ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata); 2027 else 2028 ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata); 2029 2030 return ret; 2031 } 2032 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 2033 2034 long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 2035 compat_ulong_t caddr, compat_ulong_t cdata) 2036 { 2037 unsigned long addr = caddr; 2038 unsigned long data = cdata; 2039 void __user *datap = compat_ptr(data); 2040 int ret; 2041 2042 switch (request) { 2043 case PTRACE_PEEKUSR: 2044 ret = compat_ptrace_read_user(child, addr, datap); 2045 break; 2046 2047 case PTRACE_POKEUSR: 2048 ret = compat_ptrace_write_user(child, addr, data); 2049 break; 2050 2051 case COMPAT_PTRACE_GETREGS: 2052 ret = copy_regset_to_user(child, 2053 &user_aarch32_view, 2054 REGSET_COMPAT_GPR, 2055 0, sizeof(compat_elf_gregset_t), 2056 datap); 2057 break; 2058 2059 case COMPAT_PTRACE_SETREGS: 2060 ret = copy_regset_from_user(child, 2061 &user_aarch32_view, 2062 REGSET_COMPAT_GPR, 2063 0, sizeof(compat_elf_gregset_t), 2064 datap); 2065 break; 2066 2067 case COMPAT_PTRACE_GET_THREAD_AREA: 2068 ret = put_user((compat_ulong_t)child->thread.uw.tp_value, 2069 (compat_ulong_t __user *)datap); 2070 break; 2071 2072 case COMPAT_PTRACE_SET_SYSCALL: 2073 task_pt_regs(child)->syscallno = data; 2074 ret = 0; 2075 break; 2076 2077 case COMPAT_PTRACE_GETVFPREGS: 2078 ret = copy_regset_to_user(child, 2079 &user_aarch32_view, 2080 REGSET_COMPAT_VFP, 2081 0, VFP_STATE_SIZE, 2082 datap); 2083 break; 2084 2085 case COMPAT_PTRACE_SETVFPREGS: 2086 ret = copy_regset_from_user(child, 2087 &user_aarch32_view, 2088 REGSET_COMPAT_VFP, 2089 0, VFP_STATE_SIZE, 2090 datap); 2091 break; 2092 2093 #ifdef CONFIG_HAVE_HW_BREAKPOINT 2094 case COMPAT_PTRACE_GETHBPREGS: 2095 ret = compat_ptrace_gethbpregs(child, addr, datap); 2096 break; 2097 2098 case COMPAT_PTRACE_SETHBPREGS: 2099 ret = compat_ptrace_sethbpregs(child, addr, datap); 2100 break; 2101 #endif 2102 2103 default: 2104 ret = compat_ptrace_request(child, request, addr, 2105 data); 2106 break; 2107 } 2108 2109 return ret; 2110 } 2111 #endif /* CONFIG_COMPAT */ 2112 2113 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 2114 { 2115 #ifdef CONFIG_COMPAT 2116 /* 2117 * Core dumping of 32-bit tasks or compat ptrace requests must use the 2118 * user_aarch32_view compatible with arm32. Native ptrace requests on 2119 * 32-bit children use an extended user_aarch32_ptrace_view to allow 2120 * access to the TLS register. 2121 */ 2122 if (is_compat_task()) 2123 return &user_aarch32_view; 2124 else if (is_compat_thread(task_thread_info(task))) 2125 return &user_aarch32_ptrace_view; 2126 #endif 2127 return &user_aarch64_view; 2128 } 2129 2130 long arch_ptrace(struct task_struct *child, long request, 2131 unsigned long addr, unsigned long data) 2132 { 2133 switch (request) { 2134 case PTRACE_PEEKMTETAGS: 2135 case PTRACE_POKEMTETAGS: 2136 return mte_ptrace_copy_tags(child, request, addr, data); 2137 } 2138 2139 return ptrace_request(child, request, addr, data); 2140 } 2141 2142 enum ptrace_syscall_dir { 2143 PTRACE_SYSCALL_ENTER = 0, 2144 PTRACE_SYSCALL_EXIT, 2145 }; 2146 2147 static void report_syscall(struct pt_regs *regs, enum ptrace_syscall_dir dir) 2148 { 2149 int regno; 2150 unsigned long saved_reg; 2151 2152 /* 2153 * We have some ABI weirdness here in the way that we handle syscall 2154 * exit stops because we indicate whether or not the stop has been 2155 * signalled from syscall entry or syscall exit by clobbering a general 2156 * purpose register (ip/r12 for AArch32, x7 for AArch64) in the tracee 2157 * and restoring its old value after the stop. This means that: 2158 * 2159 * - Any writes by the tracer to this register during the stop are 2160 * ignored/discarded. 2161 * 2162 * - The actual value of the register is not available during the stop, 2163 * so the tracer cannot save it and restore it later. 2164 * 2165 * - Syscall stops behave differently to seccomp and pseudo-step traps 2166 * (the latter do not nobble any registers). 2167 */ 2168 regno = (is_compat_task() ? 12 : 7); 2169 saved_reg = regs->regs[regno]; 2170 regs->regs[regno] = dir; 2171 2172 if (dir == PTRACE_SYSCALL_ENTER) { 2173 if (ptrace_report_syscall_entry(regs)) 2174 forget_syscall(regs); 2175 regs->regs[regno] = saved_reg; 2176 } else if (!test_thread_flag(TIF_SINGLESTEP)) { 2177 ptrace_report_syscall_exit(regs, 0); 2178 regs->regs[regno] = saved_reg; 2179 } else { 2180 regs->regs[regno] = saved_reg; 2181 2182 /* 2183 * Signal a pseudo-step exception since we are stepping but 2184 * tracer modifications to the registers may have rewound the 2185 * state machine. 2186 */ 2187 ptrace_report_syscall_exit(regs, 1); 2188 } 2189 } 2190 2191 int syscall_trace_enter(struct pt_regs *regs) 2192 { 2193 unsigned long flags = read_thread_flags(); 2194 2195 if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) { 2196 report_syscall(regs, PTRACE_SYSCALL_ENTER); 2197 if (flags & _TIF_SYSCALL_EMU) 2198 return NO_SYSCALL; 2199 } 2200 2201 /* Do the secure computing after ptrace; failures should be fast. */ 2202 if (secure_computing() == -1) 2203 return NO_SYSCALL; 2204 2205 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) 2206 trace_sys_enter(regs, regs->syscallno); 2207 2208 audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1], 2209 regs->regs[2], regs->regs[3]); 2210 2211 return regs->syscallno; 2212 } 2213 2214 void syscall_trace_exit(struct pt_regs *regs) 2215 { 2216 unsigned long flags = read_thread_flags(); 2217 2218 audit_syscall_exit(regs); 2219 2220 if (flags & _TIF_SYSCALL_TRACEPOINT) 2221 trace_sys_exit(regs, syscall_get_return_value(current, regs)); 2222 2223 if (flags & (_TIF_SYSCALL_TRACE | _TIF_SINGLESTEP)) 2224 report_syscall(regs, PTRACE_SYSCALL_EXIT); 2225 2226 rseq_syscall(regs); 2227 } 2228 2229 /* 2230 * SPSR_ELx bits which are always architecturally RES0 per ARM DDI 0487D.a. 2231 * We permit userspace to set SSBS (AArch64 bit 12, AArch32 bit 23) which is 2232 * not described in ARM DDI 0487D.a. 2233 * We treat PAN and UAO as RES0 bits, as they are meaningless at EL0, and may 2234 * be allocated an EL0 meaning in future. 2235 * Userspace cannot use these until they have an architectural meaning. 2236 * Note that this follows the SPSR_ELx format, not the AArch32 PSR format. 2237 * We also reserve IL for the kernel; SS is handled dynamically. 2238 */ 2239 #define SPSR_EL1_AARCH64_RES0_BITS \ 2240 (GENMASK_ULL(63, 32) | GENMASK_ULL(27, 26) | GENMASK_ULL(23, 22) | \ 2241 GENMASK_ULL(20, 13) | GENMASK_ULL(5, 5)) 2242 #define SPSR_EL1_AARCH32_RES0_BITS \ 2243 (GENMASK_ULL(63, 32) | GENMASK_ULL(22, 22) | GENMASK_ULL(20, 20)) 2244 2245 static int valid_compat_regs(struct user_pt_regs *regs) 2246 { 2247 regs->pstate &= ~SPSR_EL1_AARCH32_RES0_BITS; 2248 2249 if (!system_supports_mixed_endian_el0()) { 2250 if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) 2251 regs->pstate |= PSR_AA32_E_BIT; 2252 else 2253 regs->pstate &= ~PSR_AA32_E_BIT; 2254 } 2255 2256 if (user_mode(regs) && (regs->pstate & PSR_MODE32_BIT) && 2257 (regs->pstate & PSR_AA32_A_BIT) == 0 && 2258 (regs->pstate & PSR_AA32_I_BIT) == 0 && 2259 (regs->pstate & PSR_AA32_F_BIT) == 0) { 2260 return 1; 2261 } 2262 2263 /* 2264 * Force PSR to a valid 32-bit EL0t, preserving the same bits as 2265 * arch/arm. 2266 */ 2267 regs->pstate &= PSR_AA32_N_BIT | PSR_AA32_Z_BIT | 2268 PSR_AA32_C_BIT | PSR_AA32_V_BIT | 2269 PSR_AA32_Q_BIT | PSR_AA32_IT_MASK | 2270 PSR_AA32_GE_MASK | PSR_AA32_E_BIT | 2271 PSR_AA32_T_BIT; 2272 regs->pstate |= PSR_MODE32_BIT; 2273 2274 return 0; 2275 } 2276 2277 static int valid_native_regs(struct user_pt_regs *regs) 2278 { 2279 regs->pstate &= ~SPSR_EL1_AARCH64_RES0_BITS; 2280 2281 if (user_mode(regs) && !(regs->pstate & PSR_MODE32_BIT) && 2282 (regs->pstate & PSR_D_BIT) == 0 && 2283 (regs->pstate & PSR_A_BIT) == 0 && 2284 (regs->pstate & PSR_I_BIT) == 0 && 2285 (regs->pstate & PSR_F_BIT) == 0) { 2286 return 1; 2287 } 2288 2289 /* Force PSR to a valid 64-bit EL0t */ 2290 regs->pstate &= PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT; 2291 2292 return 0; 2293 } 2294 2295 /* 2296 * Are the current registers suitable for user mode? (used to maintain 2297 * security in signal handlers) 2298 */ 2299 int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task) 2300 { 2301 /* https://lore.kernel.org/lkml/20191118131525.GA4180@willie-the-truck */ 2302 user_regs_reset_single_step(regs, task); 2303 2304 if (is_compat_thread(task_thread_info(task))) 2305 return valid_compat_regs(regs); 2306 else 2307 return valid_native_regs(regs); 2308 } 2309