1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Based on arch/arm/kernel/signal.c
4 *
5 * Copyright (C) 1995-2009 Russell King
6 * Copyright (C) 2012 ARM Ltd.
7 */
8
9 #include <linux/cache.h>
10 #include <linux/compat.h>
11 #include <linux/errno.h>
12 #include <linux/irq-entry-common.h>
13 #include <linux/kernel.h>
14 #include <linux/signal.h>
15 #include <linux/freezer.h>
16 #include <linux/stddef.h>
17 #include <linux/uaccess.h>
18 #include <linux/sizes.h>
19 #include <linux/string.h>
20 #include <linux/ratelimit.h>
21 #include <linux/rseq.h>
22 #include <linux/syscalls.h>
23 #include <linux/pkeys.h>
24
25 #include <asm/daifflags.h>
26 #include <asm/debug-monitors.h>
27 #include <asm/elf.h>
28 #include <asm/exception.h>
29 #include <asm/cacheflush.h>
30 #include <asm/gcs.h>
31 #include <asm/ucontext.h>
32 #include <asm/unistd.h>
33 #include <asm/fpsimd.h>
34 #include <asm/ptrace.h>
35 #include <asm/syscall.h>
36 #include <asm/signal32.h>
37 #include <asm/traps.h>
38 #include <asm/vdso.h>
39
40 #define GCS_SIGNAL_CAP(addr) (((unsigned long)addr) & GCS_CAP_ADDR_MASK)
41
42 /*
43 * Do a signal return; undo the signal stack. These are aligned to 128-bit.
44 */
45 struct rt_sigframe {
46 struct siginfo info;
47 struct ucontext uc;
48 };
49
50 struct rt_sigframe_user_layout {
51 struct rt_sigframe __user *sigframe;
52 struct frame_record __user *next_frame;
53
54 unsigned long size; /* size of allocated sigframe data */
55 unsigned long limit; /* largest allowed size */
56
57 unsigned long fpsimd_offset;
58 unsigned long esr_offset;
59 unsigned long gcs_offset;
60 unsigned long sve_offset;
61 unsigned long tpidr2_offset;
62 unsigned long za_offset;
63 unsigned long zt_offset;
64 unsigned long fpmr_offset;
65 unsigned long poe_offset;
66 unsigned long extra_offset;
67 unsigned long end_offset;
68 };
69
70 #define TERMINATOR_SIZE round_up(sizeof(struct _aarch64_ctx), 16)
71 #define EXTRA_CONTEXT_SIZE round_up(sizeof(struct extra_context), 16)
72
73 /*
74 * Holds any EL0-controlled state that influences unprivileged memory accesses.
75 * This includes both accesses done in userspace and uaccess done in the kernel.
76 *
77 * This state needs to be carefully managed to ensure that it doesn't cause
78 * uaccess to fail when setting up the signal frame, and the signal handler
79 * itself also expects a well-defined state when entered.
80 *
81 * The struct should be zero-initialised. Its members should only be accessed
82 * via the accessors below. __valid_fields tracks which of the fields are valid
83 * (have been set to some value).
84 */
85 struct user_access_state {
86 unsigned int __valid_fields;
87 u64 __por_el0;
88 };
89
90 #define UA_STATE_HAS_POR_EL0 BIT(0)
91
set_ua_state_por_el0(struct user_access_state * ua_state,u64 por_el0)92 static void set_ua_state_por_el0(struct user_access_state *ua_state,
93 u64 por_el0)
94 {
95 ua_state->__por_el0 = por_el0;
96 ua_state->__valid_fields |= UA_STATE_HAS_POR_EL0;
97 }
98
get_ua_state_por_el0(const struct user_access_state * ua_state,u64 * por_el0)99 static int get_ua_state_por_el0(const struct user_access_state *ua_state,
100 u64 *por_el0)
101 {
102 if (ua_state->__valid_fields & UA_STATE_HAS_POR_EL0) {
103 *por_el0 = ua_state->__por_el0;
104 return 0;
105 }
106
107 return -ENOENT;
108 }
109
110 /*
111 * Save the user access state into ua_state and reset it to disable any
112 * restrictions.
113 */
save_reset_user_access_state(struct user_access_state * ua_state)114 static void save_reset_user_access_state(struct user_access_state *ua_state)
115 {
116 if (system_supports_poe()) {
117 u64 por_enable_all = 0;
118
119 for (int pkey = 0; pkey < arch_max_pkey(); pkey++)
120 por_enable_all |= POR_ELx_PERM_PREP(pkey, POE_RWX);
121
122 set_ua_state_por_el0(ua_state, read_sysreg_s(SYS_POR_EL0));
123 write_sysreg_s(por_enable_all, SYS_POR_EL0);
124 /*
125 * No ISB required as we can tolerate spurious Overlay faults -
126 * the fault handler will check again based on the new value
127 * of POR_EL0.
128 */
129 }
130 }
131
132 /*
133 * Set the user access state for invoking the signal handler.
134 *
135 * No uaccess should be done after that function is called.
136 */
set_handler_user_access_state(void)137 static void set_handler_user_access_state(void)
138 {
139 if (system_supports_poe())
140 write_sysreg_s(POR_EL0_INIT, SYS_POR_EL0);
141 }
142
143 /*
144 * Restore the user access state to the values saved in ua_state.
145 *
146 * No uaccess should be done after that function is called.
147 */
restore_user_access_state(const struct user_access_state * ua_state)148 static void restore_user_access_state(const struct user_access_state *ua_state)
149 {
150 u64 por_el0;
151
152 if (get_ua_state_por_el0(ua_state, &por_el0) == 0)
153 write_sysreg_s(por_el0, SYS_POR_EL0);
154 }
155
init_user_layout(struct rt_sigframe_user_layout * user)156 static void init_user_layout(struct rt_sigframe_user_layout *user)
157 {
158 const size_t reserved_size =
159 sizeof(user->sigframe->uc.uc_mcontext.__reserved);
160
161 memset(user, 0, sizeof(*user));
162 user->size = offsetof(struct rt_sigframe, uc.uc_mcontext.__reserved);
163
164 user->limit = user->size + reserved_size;
165
166 user->limit -= TERMINATOR_SIZE;
167 user->limit -= EXTRA_CONTEXT_SIZE;
168 /* Reserve space for extension and terminator ^ */
169 }
170
sigframe_size(struct rt_sigframe_user_layout const * user)171 static size_t sigframe_size(struct rt_sigframe_user_layout const *user)
172 {
173 return round_up(max(user->size, sizeof(struct rt_sigframe)), 16);
174 }
175
176 /*
177 * Sanity limit on the approximate maximum size of signal frame we'll
178 * try to generate. Stack alignment padding and the frame record are
179 * not taken into account. This limit is not a guarantee and is
180 * NOT ABI.
181 */
182 #define SIGFRAME_MAXSZ SZ_256K
183
__sigframe_alloc(struct rt_sigframe_user_layout * user,unsigned long * offset,size_t size,bool extend)184 static int __sigframe_alloc(struct rt_sigframe_user_layout *user,
185 unsigned long *offset, size_t size, bool extend)
186 {
187 size_t padded_size = round_up(size, 16);
188
189 if (padded_size > user->limit - user->size &&
190 !user->extra_offset &&
191 extend) {
192 int ret;
193
194 user->limit += EXTRA_CONTEXT_SIZE;
195 ret = __sigframe_alloc(user, &user->extra_offset,
196 sizeof(struct extra_context), false);
197 if (ret) {
198 user->limit -= EXTRA_CONTEXT_SIZE;
199 return ret;
200 }
201
202 /* Reserve space for the __reserved[] terminator */
203 user->size += TERMINATOR_SIZE;
204
205 /*
206 * Allow expansion up to SIGFRAME_MAXSZ, ensuring space for
207 * the terminator:
208 */
209 user->limit = SIGFRAME_MAXSZ - TERMINATOR_SIZE;
210 }
211
212 /* Still not enough space? Bad luck! */
213 if (padded_size > user->limit - user->size)
214 return -ENOMEM;
215
216 *offset = user->size;
217 user->size += padded_size;
218
219 return 0;
220 }
221
222 /*
223 * Allocate space for an optional record of <size> bytes in the user
224 * signal frame. The offset from the signal frame base address to the
225 * allocated block is assigned to *offset.
226 */
sigframe_alloc(struct rt_sigframe_user_layout * user,unsigned long * offset,size_t size)227 static int sigframe_alloc(struct rt_sigframe_user_layout *user,
228 unsigned long *offset, size_t size)
229 {
230 return __sigframe_alloc(user, offset, size, true);
231 }
232
233 /* Allocate the null terminator record and prevent further allocations */
sigframe_alloc_end(struct rt_sigframe_user_layout * user)234 static int sigframe_alloc_end(struct rt_sigframe_user_layout *user)
235 {
236 int ret;
237
238 /* Un-reserve the space reserved for the terminator: */
239 user->limit += TERMINATOR_SIZE;
240
241 ret = sigframe_alloc(user, &user->end_offset,
242 sizeof(struct _aarch64_ctx));
243 if (ret)
244 return ret;
245
246 /* Prevent further allocation: */
247 user->limit = user->size;
248 return 0;
249 }
250
apply_user_offset(struct rt_sigframe_user_layout const * user,unsigned long offset)251 static void __user *apply_user_offset(
252 struct rt_sigframe_user_layout const *user, unsigned long offset)
253 {
254 char __user *base = (char __user *)user->sigframe;
255
256 return base + offset;
257 }
258
259 struct user_ctxs {
260 struct fpsimd_context __user *fpsimd;
261 u32 fpsimd_size;
262 struct sve_context __user *sve;
263 u32 sve_size;
264 struct tpidr2_context __user *tpidr2;
265 u32 tpidr2_size;
266 struct za_context __user *za;
267 u32 za_size;
268 struct zt_context __user *zt;
269 u32 zt_size;
270 struct fpmr_context __user *fpmr;
271 u32 fpmr_size;
272 struct poe_context __user *poe;
273 u32 poe_size;
274 struct gcs_context __user *gcs;
275 u32 gcs_size;
276 };
277
preserve_fpsimd_context(struct fpsimd_context __user * ctx)278 static int preserve_fpsimd_context(struct fpsimd_context __user *ctx)
279 {
280 struct user_fpsimd_state const *fpsimd =
281 ¤t->thread.uw.fpsimd_state;
282 int err;
283
284 fpsimd_sync_from_effective_state(current);
285
286 /* copy the FP and status/control registers */
287 err = __copy_to_user(ctx->vregs, fpsimd->vregs, sizeof(fpsimd->vregs));
288 __put_user_error(fpsimd->fpsr, &ctx->fpsr, err);
289 __put_user_error(fpsimd->fpcr, &ctx->fpcr, err);
290
291 /* copy the magic/size information */
292 __put_user_error(FPSIMD_MAGIC, &ctx->head.magic, err);
293 __put_user_error(sizeof(struct fpsimd_context), &ctx->head.size, err);
294
295 return err ? -EFAULT : 0;
296 }
297
read_fpsimd_context(struct user_fpsimd_state * fpsimd,struct user_ctxs * user)298 static int read_fpsimd_context(struct user_fpsimd_state *fpsimd,
299 struct user_ctxs *user)
300 {
301 int err;
302
303 /* check the size information */
304 if (user->fpsimd_size != sizeof(struct fpsimd_context))
305 return -EINVAL;
306
307 /* copy the FP and status/control registers */
308 err = __copy_from_user(fpsimd->vregs, &(user->fpsimd->vregs),
309 sizeof(fpsimd->vregs));
310 __get_user_error(fpsimd->fpsr, &(user->fpsimd->fpsr), err);
311 __get_user_error(fpsimd->fpcr, &(user->fpsimd->fpcr), err);
312
313 return err ? -EFAULT : 0;
314 }
315
restore_fpsimd_context(struct user_ctxs * user)316 static int restore_fpsimd_context(struct user_ctxs *user)
317 {
318 struct user_fpsimd_state fpsimd;
319 int err;
320
321 err = read_fpsimd_context(&fpsimd, user);
322 if (err)
323 return err;
324
325 clear_thread_flag(TIF_SVE);
326 current->thread.svcr &= ~SVCR_SM_MASK;
327 current->thread.fp_type = FP_STATE_FPSIMD;
328
329 /* load the hardware registers from the fpsimd_state structure */
330 fpsimd_update_current_state(&fpsimd);
331 return 0;
332 }
333
preserve_fpmr_context(struct fpmr_context __user * ctx)334 static int preserve_fpmr_context(struct fpmr_context __user *ctx)
335 {
336 int err = 0;
337
338 __put_user_error(FPMR_MAGIC, &ctx->head.magic, err);
339 __put_user_error(sizeof(*ctx), &ctx->head.size, err);
340 __put_user_error(current->thread.uw.fpmr, &ctx->fpmr, err);
341
342 return err;
343 }
344
restore_fpmr_context(struct user_ctxs * user)345 static int restore_fpmr_context(struct user_ctxs *user)
346 {
347 u64 fpmr;
348 int err = 0;
349
350 if (user->fpmr_size != sizeof(*user->fpmr))
351 return -EINVAL;
352
353 __get_user_error(fpmr, &user->fpmr->fpmr, err);
354 if (!err)
355 current->thread.uw.fpmr = fpmr;
356
357 return err;
358 }
359
preserve_poe_context(struct poe_context __user * ctx,const struct user_access_state * ua_state)360 static int preserve_poe_context(struct poe_context __user *ctx,
361 const struct user_access_state *ua_state)
362 {
363 int err;
364 u64 por_el0;
365
366 err = get_ua_state_por_el0(ua_state, &por_el0);
367 if (WARN_ON_ONCE(err))
368 return err;
369
370 __put_user_error(POE_MAGIC, &ctx->head.magic, err);
371 __put_user_error(sizeof(*ctx), &ctx->head.size, err);
372 __put_user_error(por_el0, &ctx->por_el0, err);
373
374 return err;
375 }
376
restore_poe_context(struct user_ctxs * user,struct user_access_state * ua_state)377 static int restore_poe_context(struct user_ctxs *user,
378 struct user_access_state *ua_state)
379 {
380 u64 por_el0;
381 int err = 0;
382
383 if (user->poe_size != sizeof(*user->poe))
384 return -EINVAL;
385
386 __get_user_error(por_el0, &(user->poe->por_el0), err);
387 if (!err)
388 set_ua_state_por_el0(ua_state, por_el0);
389
390 return err;
391 }
392
393 #ifdef CONFIG_ARM64_SVE
394
preserve_sve_context(struct sve_context __user * ctx)395 static int preserve_sve_context(struct sve_context __user *ctx)
396 {
397 int err = 0;
398 u16 reserved[ARRAY_SIZE(ctx->__reserved)];
399 u16 flags = 0;
400 unsigned int vl = task_get_sve_vl(current);
401 unsigned int vq = 0;
402
403 if (thread_sm_enabled(¤t->thread)) {
404 vl = task_get_sme_vl(current);
405 vq = sve_vq_from_vl(vl);
406 flags |= SVE_SIG_FLAG_SM;
407 } else if (current->thread.fp_type == FP_STATE_SVE) {
408 vq = sve_vq_from_vl(vl);
409 }
410
411 memset(reserved, 0, sizeof(reserved));
412
413 __put_user_error(SVE_MAGIC, &ctx->head.magic, err);
414 __put_user_error(round_up(SVE_SIG_CONTEXT_SIZE(vq), 16),
415 &ctx->head.size, err);
416 __put_user_error(vl, &ctx->vl, err);
417 __put_user_error(flags, &ctx->flags, err);
418 BUILD_BUG_ON(sizeof(ctx->__reserved) != sizeof(reserved));
419 err |= __copy_to_user(&ctx->__reserved, reserved, sizeof(reserved));
420
421 if (vq) {
422 err |= __copy_to_user((char __user *)ctx + SVE_SIG_REGS_OFFSET,
423 current->thread.sve_state,
424 SVE_SIG_REGS_SIZE(vq));
425 }
426
427 return err ? -EFAULT : 0;
428 }
429
restore_sve_fpsimd_context(struct user_ctxs * user)430 static int restore_sve_fpsimd_context(struct user_ctxs *user)
431 {
432 int err = 0;
433 unsigned int vl, vq;
434 struct user_fpsimd_state fpsimd;
435 u16 user_vl, flags;
436 bool fpsimd_only;
437 bool sm;
438
439 if (user->sve_size < sizeof(*user->sve))
440 return -EINVAL;
441
442 __get_user_error(user_vl, &(user->sve->vl), err);
443 __get_user_error(flags, &(user->sve->flags), err);
444 if (err)
445 return err;
446
447 fpsimd_only = (user->sve_size == sizeof(*user->sve));
448 sm = flags & SVE_SIG_FLAG_SM;
449
450 if (sm) {
451 if (!system_supports_sme())
452 return -EINVAL;
453
454 /*
455 * Streaming SVE state is always preserved with an SVE payload.
456 * Only accept streaming state which has an SVE payload.
457 */
458 if (fpsimd_only)
459 return -EINVAL;
460
461 vl = task_get_sme_vl(current);
462 } else {
463 /*
464 * Non-streaming SVE state may be preserved without an SVE
465 * payload, in which case all state is saved in the FPSIMD
466 * context.
467 *
468 * On SME-only systems, non-streaming (FPSIMD-only) state is
469 * always preserved without an SVE payload, and with VL==0. On
470 * such systems, only accept non-streaming state without an SVE
471 * payload.
472 */
473 if (!system_supports_sve() && !fpsimd_only)
474 return -EINVAL;
475
476 vl = task_get_sve_vl(current);
477 }
478
479 if (user_vl != vl)
480 return -EINVAL;
481
482 if (fpsimd_only)
483 return restore_fpsimd_context(user);
484
485 vq = sve_vq_from_vl(vl);
486
487 if (user->sve_size < SVE_SIG_CONTEXT_SIZE(vq))
488 return -EINVAL;
489
490 if (sm) {
491 sme_alloc(current, false);
492 if (!current->thread.sme_state)
493 return -ENOMEM;
494 }
495
496 sve_alloc(current, true);
497 if (!current->thread.sve_state) {
498 clear_thread_flag(TIF_SVE);
499 return -ENOMEM;
500 }
501
502 if (sm) {
503 current->thread.svcr |= SVCR_SM_MASK;
504 set_thread_flag(TIF_SME);
505 } else {
506 current->thread.svcr &= ~SVCR_SM_MASK;
507 set_thread_flag(TIF_SVE);
508 }
509
510 current->thread.fp_type = FP_STATE_SVE;
511
512 err = __copy_from_user(current->thread.sve_state,
513 (char __user const *)user->sve +
514 SVE_SIG_REGS_OFFSET,
515 SVE_SIG_REGS_SIZE(vq));
516 if (err)
517 return -EFAULT;
518
519 err = read_fpsimd_context(&fpsimd, user);
520 if (err)
521 return err;
522
523 /* Merge the FPSIMD registers into the SVE state */
524 fpsimd_update_current_state(&fpsimd);
525
526 return 0;
527 }
528
529 #else /* ! CONFIG_ARM64_SVE */
530
restore_sve_fpsimd_context(struct user_ctxs * user)531 static int restore_sve_fpsimd_context(struct user_ctxs *user)
532 {
533 WARN_ON_ONCE(1);
534 return -EINVAL;
535 }
536
537 /* Turn any non-optimised out attempts to use this into a link error: */
538 extern int preserve_sve_context(void __user *ctx);
539
540 #endif /* ! CONFIG_ARM64_SVE */
541
542 #ifdef CONFIG_ARM64_SME
543
preserve_tpidr2_context(struct tpidr2_context __user * ctx)544 static int preserve_tpidr2_context(struct tpidr2_context __user *ctx)
545 {
546 u64 tpidr2_el0 = read_sysreg_s(SYS_TPIDR2_EL0);
547 int err = 0;
548
549 __put_user_error(TPIDR2_MAGIC, &ctx->head.magic, err);
550 __put_user_error(sizeof(*ctx), &ctx->head.size, err);
551 __put_user_error(tpidr2_el0, &ctx->tpidr2, err);
552
553 return err;
554 }
555
restore_tpidr2_context(struct user_ctxs * user)556 static int restore_tpidr2_context(struct user_ctxs *user)
557 {
558 u64 tpidr2_el0;
559 int err = 0;
560
561 if (user->tpidr2_size != sizeof(*user->tpidr2))
562 return -EINVAL;
563
564 __get_user_error(tpidr2_el0, &user->tpidr2->tpidr2, err);
565 if (!err)
566 write_sysreg_s(tpidr2_el0, SYS_TPIDR2_EL0);
567
568 return err;
569 }
570
preserve_za_context(struct za_context __user * ctx)571 static int preserve_za_context(struct za_context __user *ctx)
572 {
573 int err = 0;
574 u16 reserved[ARRAY_SIZE(ctx->__reserved)];
575 unsigned int vl = task_get_sme_vl(current);
576 unsigned int vq;
577
578 if (thread_za_enabled(¤t->thread))
579 vq = sve_vq_from_vl(vl);
580 else
581 vq = 0;
582
583 memset(reserved, 0, sizeof(reserved));
584
585 __put_user_error(ZA_MAGIC, &ctx->head.magic, err);
586 __put_user_error(round_up(ZA_SIG_CONTEXT_SIZE(vq), 16),
587 &ctx->head.size, err);
588 __put_user_error(vl, &ctx->vl, err);
589 BUILD_BUG_ON(sizeof(ctx->__reserved) != sizeof(reserved));
590 err |= __copy_to_user(&ctx->__reserved, reserved, sizeof(reserved));
591
592 if (vq) {
593 err |= __copy_to_user((char __user *)ctx + ZA_SIG_REGS_OFFSET,
594 current->thread.sme_state,
595 ZA_SIG_REGS_SIZE(vq));
596 }
597
598 return err ? -EFAULT : 0;
599 }
600
restore_za_context(struct user_ctxs * user)601 static int restore_za_context(struct user_ctxs *user)
602 {
603 int err = 0;
604 unsigned int vq;
605 u16 user_vl;
606
607 if (user->za_size < sizeof(*user->za))
608 return -EINVAL;
609
610 __get_user_error(user_vl, &(user->za->vl), err);
611 if (err)
612 return err;
613
614 if (user_vl != task_get_sme_vl(current))
615 return -EINVAL;
616
617 if (user->za_size == sizeof(*user->za)) {
618 current->thread.svcr &= ~SVCR_ZA_MASK;
619 return 0;
620 }
621
622 vq = sve_vq_from_vl(user_vl);
623
624 if (user->za_size < ZA_SIG_CONTEXT_SIZE(vq))
625 return -EINVAL;
626
627 sve_alloc(current, false);
628 if (!current->thread.sve_state)
629 return -ENOMEM;
630
631 sme_alloc(current, true);
632 if (!current->thread.sme_state) {
633 current->thread.svcr &= ~SVCR_ZA_MASK;
634 clear_thread_flag(TIF_SME);
635 return -ENOMEM;
636 }
637
638 err = __copy_from_user(current->thread.sme_state,
639 (char __user const *)user->za +
640 ZA_SIG_REGS_OFFSET,
641 ZA_SIG_REGS_SIZE(vq));
642 if (err)
643 return -EFAULT;
644
645 set_thread_flag(TIF_SME);
646 current->thread.svcr |= SVCR_ZA_MASK;
647
648 return 0;
649 }
650
preserve_zt_context(struct zt_context __user * ctx)651 static int preserve_zt_context(struct zt_context __user *ctx)
652 {
653 int err = 0;
654 u16 reserved[ARRAY_SIZE(ctx->__reserved)];
655
656 if (WARN_ON(!thread_za_enabled(¤t->thread)))
657 return -EINVAL;
658
659 memset(reserved, 0, sizeof(reserved));
660
661 __put_user_error(ZT_MAGIC, &ctx->head.magic, err);
662 __put_user_error(round_up(ZT_SIG_CONTEXT_SIZE(1), 16),
663 &ctx->head.size, err);
664 __put_user_error(1, &ctx->nregs, err);
665 BUILD_BUG_ON(sizeof(ctx->__reserved) != sizeof(reserved));
666 err |= __copy_to_user(&ctx->__reserved, reserved, sizeof(reserved));
667
668 err |= __copy_to_user((char __user *)ctx + ZT_SIG_REGS_OFFSET,
669 thread_zt_state(¤t->thread),
670 ZT_SIG_REGS_SIZE(1));
671
672 return err ? -EFAULT : 0;
673 }
674
restore_zt_context(struct user_ctxs * user)675 static int restore_zt_context(struct user_ctxs *user)
676 {
677 int err;
678 u16 nregs;
679
680 /* ZA must be restored first for this check to be valid */
681 if (!thread_za_enabled(¤t->thread))
682 return -EINVAL;
683
684 if (user->zt_size != ZT_SIG_CONTEXT_SIZE(1))
685 return -EINVAL;
686
687 if (__copy_from_user(&nregs, &(user->zt->nregs), sizeof(nregs)))
688 return -EFAULT;
689
690 if (nregs != 1)
691 return -EINVAL;
692
693 err = __copy_from_user(thread_zt_state(¤t->thread),
694 (char __user const *)user->zt +
695 ZT_SIG_REGS_OFFSET,
696 ZT_SIG_REGS_SIZE(1));
697 if (err)
698 return -EFAULT;
699
700 return 0;
701 }
702
703 #else /* ! CONFIG_ARM64_SME */
704
705 /* Turn any non-optimised out attempts to use these into a link error: */
706 extern int preserve_tpidr2_context(void __user *ctx);
707 extern int restore_tpidr2_context(struct user_ctxs *user);
708 extern int preserve_za_context(void __user *ctx);
709 extern int restore_za_context(struct user_ctxs *user);
710 extern int preserve_zt_context(void __user *ctx);
711 extern int restore_zt_context(struct user_ctxs *user);
712
713 #endif /* ! CONFIG_ARM64_SME */
714
715 #ifdef CONFIG_ARM64_GCS
716
preserve_gcs_context(struct gcs_context __user * ctx)717 static int preserve_gcs_context(struct gcs_context __user *ctx)
718 {
719 int err = 0;
720 u64 gcspr = read_sysreg_s(SYS_GCSPR_EL0);
721
722 /*
723 * If GCS is enabled we will add a cap token to the frame,
724 * include it in the GCSPR_EL0 we report to support stack
725 * switching via sigreturn if GCS is enabled. We do not allow
726 * enabling via sigreturn so the token is only relevant for
727 * threads with GCS enabled.
728 */
729 if (task_gcs_el0_enabled(current))
730 gcspr -= 8;
731
732 __put_user_error(GCS_MAGIC, &ctx->head.magic, err);
733 __put_user_error(sizeof(*ctx), &ctx->head.size, err);
734 __put_user_error(gcspr, &ctx->gcspr, err);
735 __put_user_error(0, &ctx->reserved, err);
736 __put_user_error(current->thread.gcs_el0_mode,
737 &ctx->features_enabled, err);
738
739 return err;
740 }
741
restore_gcs_context(struct user_ctxs * user)742 static int restore_gcs_context(struct user_ctxs *user)
743 {
744 u64 gcspr, enabled;
745 int err = 0;
746
747 if (user->gcs_size != sizeof(*user->gcs))
748 return -EINVAL;
749
750 __get_user_error(gcspr, &user->gcs->gcspr, err);
751 __get_user_error(enabled, &user->gcs->features_enabled, err);
752 if (err)
753 return err;
754
755 /* Don't allow unknown modes */
756 if (enabled & ~PR_SHADOW_STACK_SUPPORTED_STATUS_MASK)
757 return -EINVAL;
758
759 err = gcs_check_locked(current, enabled);
760 if (err != 0)
761 return err;
762
763 /* Don't allow enabling */
764 if (!task_gcs_el0_enabled(current) &&
765 (enabled & PR_SHADOW_STACK_ENABLE))
766 return -EINVAL;
767
768 /* If we are disabling disable everything */
769 if (!(enabled & PR_SHADOW_STACK_ENABLE))
770 enabled = 0;
771
772 current->thread.gcs_el0_mode = enabled;
773
774 /*
775 * We let userspace set GCSPR_EL0 to anything here, we will
776 * validate later in gcs_restore_signal().
777 */
778 write_sysreg_s(gcspr, SYS_GCSPR_EL0);
779
780 return 0;
781 }
782
783 #else /* ! CONFIG_ARM64_GCS */
784
785 /* Turn any non-optimised out attempts to use these into a link error: */
786 extern int preserve_gcs_context(void __user *ctx);
787 extern int restore_gcs_context(struct user_ctxs *user);
788
789 #endif /* ! CONFIG_ARM64_GCS */
790
parse_user_sigframe(struct user_ctxs * user,struct rt_sigframe __user * sf)791 static int parse_user_sigframe(struct user_ctxs *user,
792 struct rt_sigframe __user *sf)
793 {
794 struct sigcontext __user *const sc = &sf->uc.uc_mcontext;
795 struct _aarch64_ctx __user *head;
796 char __user *base = (char __user *)&sc->__reserved;
797 size_t offset = 0;
798 size_t limit = sizeof(sc->__reserved);
799 bool have_extra_context = false;
800 char const __user *const sfp = (char const __user *)sf;
801
802 user->fpsimd = NULL;
803 user->sve = NULL;
804 user->tpidr2 = NULL;
805 user->za = NULL;
806 user->zt = NULL;
807 user->fpmr = NULL;
808 user->poe = NULL;
809 user->gcs = NULL;
810
811 if (!IS_ALIGNED((unsigned long)base, 16))
812 goto invalid;
813
814 while (1) {
815 int err = 0;
816 u32 magic, size;
817 char const __user *userp;
818 struct extra_context const __user *extra;
819 u64 extra_datap;
820 u32 extra_size;
821 struct _aarch64_ctx const __user *end;
822 u32 end_magic, end_size;
823
824 if (limit - offset < sizeof(*head))
825 goto invalid;
826
827 if (!IS_ALIGNED(offset, 16))
828 goto invalid;
829
830 head = (struct _aarch64_ctx __user *)(base + offset);
831 __get_user_error(magic, &head->magic, err);
832 __get_user_error(size, &head->size, err);
833 if (err)
834 return err;
835
836 if (limit - offset < size)
837 goto invalid;
838
839 switch (magic) {
840 case 0:
841 if (size)
842 goto invalid;
843
844 goto done;
845
846 case FPSIMD_MAGIC:
847 if (!system_supports_fpsimd())
848 goto invalid;
849 if (user->fpsimd)
850 goto invalid;
851
852 user->fpsimd = (struct fpsimd_context __user *)head;
853 user->fpsimd_size = size;
854 break;
855
856 case ESR_MAGIC:
857 /* ignore */
858 break;
859
860 case POE_MAGIC:
861 if (!system_supports_poe())
862 goto invalid;
863
864 if (user->poe)
865 goto invalid;
866
867 user->poe = (struct poe_context __user *)head;
868 user->poe_size = size;
869 break;
870
871 case SVE_MAGIC:
872 if (!system_supports_sve() && !system_supports_sme())
873 goto invalid;
874
875 if (user->sve)
876 goto invalid;
877
878 user->sve = (struct sve_context __user *)head;
879 user->sve_size = size;
880 break;
881
882 case TPIDR2_MAGIC:
883 if (!system_supports_tpidr2())
884 goto invalid;
885
886 if (user->tpidr2)
887 goto invalid;
888
889 user->tpidr2 = (struct tpidr2_context __user *)head;
890 user->tpidr2_size = size;
891 break;
892
893 case ZA_MAGIC:
894 if (!system_supports_sme())
895 goto invalid;
896
897 if (user->za)
898 goto invalid;
899
900 user->za = (struct za_context __user *)head;
901 user->za_size = size;
902 break;
903
904 case ZT_MAGIC:
905 if (!system_supports_sme2())
906 goto invalid;
907
908 if (user->zt)
909 goto invalid;
910
911 user->zt = (struct zt_context __user *)head;
912 user->zt_size = size;
913 break;
914
915 case FPMR_MAGIC:
916 if (!system_supports_fpmr())
917 goto invalid;
918
919 if (user->fpmr)
920 goto invalid;
921
922 user->fpmr = (struct fpmr_context __user *)head;
923 user->fpmr_size = size;
924 break;
925
926 case GCS_MAGIC:
927 if (!system_supports_gcs())
928 goto invalid;
929
930 if (user->gcs)
931 goto invalid;
932
933 user->gcs = (struct gcs_context __user *)head;
934 user->gcs_size = size;
935 break;
936
937 case EXTRA_MAGIC:
938 if (have_extra_context)
939 goto invalid;
940
941 if (size < sizeof(*extra))
942 goto invalid;
943
944 userp = (char const __user *)head;
945
946 extra = (struct extra_context const __user *)userp;
947 userp += size;
948
949 __get_user_error(extra_datap, &extra->datap, err);
950 __get_user_error(extra_size, &extra->size, err);
951 if (err)
952 return err;
953
954 /* Check for the dummy terminator in __reserved[]: */
955
956 if (limit - offset - size < TERMINATOR_SIZE)
957 goto invalid;
958
959 end = (struct _aarch64_ctx const __user *)userp;
960 userp += TERMINATOR_SIZE;
961
962 __get_user_error(end_magic, &end->magic, err);
963 __get_user_error(end_size, &end->size, err);
964 if (err)
965 return err;
966
967 if (end_magic || end_size)
968 goto invalid;
969
970 /* Prevent looping/repeated parsing of extra_context */
971 have_extra_context = true;
972
973 base = (__force void __user *)extra_datap;
974 if (!IS_ALIGNED((unsigned long)base, 16))
975 goto invalid;
976
977 if (!IS_ALIGNED(extra_size, 16))
978 goto invalid;
979
980 if (base != userp)
981 goto invalid;
982
983 /* Reject "unreasonably large" frames: */
984 if (extra_size > sfp + SIGFRAME_MAXSZ - userp)
985 goto invalid;
986
987 /*
988 * Ignore trailing terminator in __reserved[]
989 * and start parsing extra data:
990 */
991 offset = 0;
992 limit = extra_size;
993
994 if (!access_ok(base, limit))
995 goto invalid;
996
997 continue;
998
999 default:
1000 goto invalid;
1001 }
1002
1003 if (size < sizeof(*head))
1004 goto invalid;
1005
1006 if (limit - offset < size)
1007 goto invalid;
1008
1009 offset += size;
1010 }
1011
1012 done:
1013 return 0;
1014
1015 invalid:
1016 return -EINVAL;
1017 }
1018
restore_sigframe(struct pt_regs * regs,struct rt_sigframe __user * sf,struct user_access_state * ua_state)1019 static int restore_sigframe(struct pt_regs *regs,
1020 struct rt_sigframe __user *sf,
1021 struct user_access_state *ua_state)
1022 {
1023 sigset_t set;
1024 int i, err;
1025 struct user_ctxs user;
1026
1027 err = __copy_from_user(&set, &sf->uc.uc_sigmask, sizeof(set));
1028 if (err == 0)
1029 set_current_blocked(&set);
1030
1031 for (i = 0; i < 31; i++)
1032 __get_user_error(regs->regs[i], &sf->uc.uc_mcontext.regs[i],
1033 err);
1034 __get_user_error(regs->sp, &sf->uc.uc_mcontext.sp, err);
1035 __get_user_error(regs->pc, &sf->uc.uc_mcontext.pc, err);
1036 __get_user_error(regs->pstate, &sf->uc.uc_mcontext.pstate, err);
1037
1038 /*
1039 * Avoid sys_rt_sigreturn() restarting.
1040 */
1041 forget_syscall(regs);
1042
1043 fpsimd_save_and_flush_current_state();
1044
1045 err |= !valid_user_regs(®s->user_regs, current);
1046 if (err == 0)
1047 err = parse_user_sigframe(&user, sf);
1048
1049 if (err == 0 && system_supports_fpsimd()) {
1050 if (!user.fpsimd)
1051 return -EINVAL;
1052
1053 if (user.sve)
1054 err = restore_sve_fpsimd_context(&user);
1055 else
1056 err = restore_fpsimd_context(&user);
1057 }
1058
1059 if (err == 0 && system_supports_gcs() && user.gcs)
1060 err = restore_gcs_context(&user);
1061
1062 if (err == 0 && system_supports_tpidr2() && user.tpidr2)
1063 err = restore_tpidr2_context(&user);
1064
1065 if (err == 0 && system_supports_fpmr() && user.fpmr)
1066 err = restore_fpmr_context(&user);
1067
1068 if (err == 0 && system_supports_sme() && user.za)
1069 err = restore_za_context(&user);
1070
1071 if (err == 0 && system_supports_sme2() && user.zt)
1072 err = restore_zt_context(&user);
1073
1074 if (err == 0 && system_supports_poe() && user.poe)
1075 err = restore_poe_context(&user, ua_state);
1076
1077 return err;
1078 }
1079
1080 #ifdef CONFIG_ARM64_GCS
gcs_restore_signal(void)1081 static int gcs_restore_signal(void)
1082 {
1083 u64 gcspr_el0, cap;
1084 int ret;
1085
1086 if (!system_supports_gcs())
1087 return 0;
1088
1089 if (!(current->thread.gcs_el0_mode & PR_SHADOW_STACK_ENABLE))
1090 return 0;
1091
1092 gcspr_el0 = read_sysreg_s(SYS_GCSPR_EL0);
1093
1094 /*
1095 * Ensure that any changes to the GCS done via GCS operations
1096 * are visible to the normal reads we do to validate the
1097 * token.
1098 */
1099 gcsb_dsync();
1100
1101 /*
1102 * GCSPR_EL0 should be pointing at a capped GCS, read the cap.
1103 * We don't enforce that this is in a GCS page, if it is not
1104 * then faults will be generated on GCS operations - the main
1105 * concern is to protect GCS pages.
1106 */
1107 ret = copy_from_user(&cap, (unsigned long __user *)gcspr_el0,
1108 sizeof(cap));
1109 if (ret)
1110 return -EFAULT;
1111
1112 /*
1113 * Check that the cap is the actual GCS before replacing it.
1114 */
1115 if (cap != GCS_SIGNAL_CAP(gcspr_el0))
1116 return -EINVAL;
1117
1118 /* Invalidate the token to prevent reuse */
1119 put_user_gcs(0, (unsigned long __user *)gcspr_el0, &ret);
1120 if (ret != 0)
1121 return -EFAULT;
1122
1123 write_sysreg_s(gcspr_el0 + 8, SYS_GCSPR_EL0);
1124
1125 return 0;
1126 }
1127
1128 #else
gcs_restore_signal(void)1129 static int gcs_restore_signal(void) { return 0; }
1130 #endif
1131
SYSCALL_DEFINE0(rt_sigreturn)1132 SYSCALL_DEFINE0(rt_sigreturn)
1133 {
1134 struct pt_regs *regs = current_pt_regs();
1135 struct rt_sigframe __user *frame;
1136 struct user_access_state ua_state = {};
1137
1138 /* Always make any pending restarted system calls return -EINTR */
1139 current->restart_block.fn = do_no_restart_syscall;
1140
1141 /*
1142 * Since we stacked the signal on a 128-bit boundary, then 'sp' should
1143 * be word aligned here.
1144 */
1145 if (regs->sp & 15)
1146 goto badframe;
1147
1148 frame = (struct rt_sigframe __user *)regs->sp;
1149
1150 if (!access_ok(frame, sizeof (*frame)))
1151 goto badframe;
1152
1153 if (restore_sigframe(regs, frame, &ua_state))
1154 goto badframe;
1155
1156 if (gcs_restore_signal())
1157 goto badframe;
1158
1159 if (restore_altstack(&frame->uc.uc_stack))
1160 goto badframe;
1161
1162 restore_user_access_state(&ua_state);
1163
1164 return regs->regs[0];
1165
1166 badframe:
1167 arm64_notify_segfault(regs->sp);
1168 return 0;
1169 }
1170
1171 /*
1172 * Determine the layout of optional records in the signal frame
1173 *
1174 * add_all: if true, lays out the biggest possible signal frame for
1175 * this task; otherwise, generates a layout for the current state
1176 * of the task.
1177 */
setup_sigframe_layout(struct rt_sigframe_user_layout * user,bool add_all)1178 static int setup_sigframe_layout(struct rt_sigframe_user_layout *user,
1179 bool add_all)
1180 {
1181 int err;
1182
1183 if (system_supports_fpsimd()) {
1184 err = sigframe_alloc(user, &user->fpsimd_offset,
1185 sizeof(struct fpsimd_context));
1186 if (err)
1187 return err;
1188 }
1189
1190 /* fault information, if valid */
1191 if (add_all || current->thread.fault_code) {
1192 err = sigframe_alloc(user, &user->esr_offset,
1193 sizeof(struct esr_context));
1194 if (err)
1195 return err;
1196 }
1197
1198 #ifdef CONFIG_ARM64_GCS
1199 if (system_supports_gcs() && (add_all || current->thread.gcspr_el0)) {
1200 err = sigframe_alloc(user, &user->gcs_offset,
1201 sizeof(struct gcs_context));
1202 if (err)
1203 return err;
1204 }
1205 #endif
1206
1207 if (system_supports_sve() || system_supports_sme()) {
1208 unsigned int vq = 0;
1209
1210 if (add_all || current->thread.fp_type == FP_STATE_SVE ||
1211 thread_sm_enabled(¤t->thread)) {
1212 int vl = max(sve_max_vl(), sme_max_vl());
1213
1214 if (!add_all)
1215 vl = thread_get_cur_vl(¤t->thread);
1216
1217 vq = sve_vq_from_vl(vl);
1218 }
1219
1220 err = sigframe_alloc(user, &user->sve_offset,
1221 SVE_SIG_CONTEXT_SIZE(vq));
1222 if (err)
1223 return err;
1224 }
1225
1226 if (system_supports_tpidr2()) {
1227 err = sigframe_alloc(user, &user->tpidr2_offset,
1228 sizeof(struct tpidr2_context));
1229 if (err)
1230 return err;
1231 }
1232
1233 if (system_supports_sme()) {
1234 unsigned int vl;
1235 unsigned int vq = 0;
1236
1237 if (add_all)
1238 vl = sme_max_vl();
1239 else
1240 vl = task_get_sme_vl(current);
1241
1242 if (thread_za_enabled(¤t->thread))
1243 vq = sve_vq_from_vl(vl);
1244
1245 err = sigframe_alloc(user, &user->za_offset,
1246 ZA_SIG_CONTEXT_SIZE(vq));
1247 if (err)
1248 return err;
1249 }
1250
1251 if (system_supports_sme2()) {
1252 if (add_all || thread_za_enabled(¤t->thread)) {
1253 err = sigframe_alloc(user, &user->zt_offset,
1254 ZT_SIG_CONTEXT_SIZE(1));
1255 if (err)
1256 return err;
1257 }
1258 }
1259
1260 if (system_supports_fpmr()) {
1261 err = sigframe_alloc(user, &user->fpmr_offset,
1262 sizeof(struct fpmr_context));
1263 if (err)
1264 return err;
1265 }
1266
1267 if (system_supports_poe()) {
1268 err = sigframe_alloc(user, &user->poe_offset,
1269 sizeof(struct poe_context));
1270 if (err)
1271 return err;
1272 }
1273
1274 return sigframe_alloc_end(user);
1275 }
1276
setup_sigframe(struct rt_sigframe_user_layout * user,struct pt_regs * regs,sigset_t * set,const struct user_access_state * ua_state)1277 static int setup_sigframe(struct rt_sigframe_user_layout *user,
1278 struct pt_regs *regs, sigset_t *set,
1279 const struct user_access_state *ua_state)
1280 {
1281 int i, err = 0;
1282 struct rt_sigframe __user *sf = user->sigframe;
1283
1284 /* set up the stack frame for unwinding */
1285 __put_user_error(regs->regs[29], &user->next_frame->fp, err);
1286 __put_user_error(regs->regs[30], &user->next_frame->lr, err);
1287
1288 for (i = 0; i < 31; i++)
1289 __put_user_error(regs->regs[i], &sf->uc.uc_mcontext.regs[i],
1290 err);
1291 __put_user_error(regs->sp, &sf->uc.uc_mcontext.sp, err);
1292 __put_user_error(regs->pc, &sf->uc.uc_mcontext.pc, err);
1293 __put_user_error(regs->pstate, &sf->uc.uc_mcontext.pstate, err);
1294
1295 __put_user_error(current->thread.fault_address, &sf->uc.uc_mcontext.fault_address, err);
1296
1297 err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(*set));
1298
1299 if (err == 0 && system_supports_fpsimd()) {
1300 struct fpsimd_context __user *fpsimd_ctx =
1301 apply_user_offset(user, user->fpsimd_offset);
1302 err |= preserve_fpsimd_context(fpsimd_ctx);
1303 }
1304
1305 /* fault information, if valid */
1306 if (err == 0 && user->esr_offset) {
1307 struct esr_context __user *esr_ctx =
1308 apply_user_offset(user, user->esr_offset);
1309
1310 __put_user_error(ESR_MAGIC, &esr_ctx->head.magic, err);
1311 __put_user_error(sizeof(*esr_ctx), &esr_ctx->head.size, err);
1312 __put_user_error(current->thread.fault_code, &esr_ctx->esr, err);
1313 }
1314
1315 if (system_supports_gcs() && err == 0 && user->gcs_offset) {
1316 struct gcs_context __user *gcs_ctx =
1317 apply_user_offset(user, user->gcs_offset);
1318 err |= preserve_gcs_context(gcs_ctx);
1319 }
1320
1321 /* Scalable Vector Extension state (including streaming), if present */
1322 if ((system_supports_sve() || system_supports_sme()) &&
1323 err == 0 && user->sve_offset) {
1324 struct sve_context __user *sve_ctx =
1325 apply_user_offset(user, user->sve_offset);
1326 err |= preserve_sve_context(sve_ctx);
1327 }
1328
1329 /* TPIDR2 if supported */
1330 if (system_supports_tpidr2() && err == 0) {
1331 struct tpidr2_context __user *tpidr2_ctx =
1332 apply_user_offset(user, user->tpidr2_offset);
1333 err |= preserve_tpidr2_context(tpidr2_ctx);
1334 }
1335
1336 /* FPMR if supported */
1337 if (system_supports_fpmr() && err == 0) {
1338 struct fpmr_context __user *fpmr_ctx =
1339 apply_user_offset(user, user->fpmr_offset);
1340 err |= preserve_fpmr_context(fpmr_ctx);
1341 }
1342
1343 if (system_supports_poe() && err == 0) {
1344 struct poe_context __user *poe_ctx =
1345 apply_user_offset(user, user->poe_offset);
1346
1347 err |= preserve_poe_context(poe_ctx, ua_state);
1348 }
1349
1350 /* ZA state if present */
1351 if (system_supports_sme() && err == 0 && user->za_offset) {
1352 struct za_context __user *za_ctx =
1353 apply_user_offset(user, user->za_offset);
1354 err |= preserve_za_context(za_ctx);
1355 }
1356
1357 /* ZT state if present */
1358 if (system_supports_sme2() && err == 0 && user->zt_offset) {
1359 struct zt_context __user *zt_ctx =
1360 apply_user_offset(user, user->zt_offset);
1361 err |= preserve_zt_context(zt_ctx);
1362 }
1363
1364 if (err == 0 && user->extra_offset) {
1365 char __user *sfp = (char __user *)user->sigframe;
1366 char __user *userp =
1367 apply_user_offset(user, user->extra_offset);
1368
1369 struct extra_context __user *extra;
1370 struct _aarch64_ctx __user *end;
1371 u64 extra_datap;
1372 u32 extra_size;
1373
1374 extra = (struct extra_context __user *)userp;
1375 userp += EXTRA_CONTEXT_SIZE;
1376
1377 end = (struct _aarch64_ctx __user *)userp;
1378 userp += TERMINATOR_SIZE;
1379
1380 /*
1381 * extra_datap is just written to the signal frame.
1382 * The value gets cast back to a void __user *
1383 * during sigreturn.
1384 */
1385 extra_datap = (__force u64)userp;
1386 extra_size = sfp + round_up(user->size, 16) - userp;
1387
1388 __put_user_error(EXTRA_MAGIC, &extra->head.magic, err);
1389 __put_user_error(EXTRA_CONTEXT_SIZE, &extra->head.size, err);
1390 __put_user_error(extra_datap, &extra->datap, err);
1391 __put_user_error(extra_size, &extra->size, err);
1392
1393 /* Add the terminator */
1394 __put_user_error(0, &end->magic, err);
1395 __put_user_error(0, &end->size, err);
1396 }
1397
1398 /* set the "end" magic */
1399 if (err == 0) {
1400 struct _aarch64_ctx __user *end =
1401 apply_user_offset(user, user->end_offset);
1402
1403 __put_user_error(0, &end->magic, err);
1404 __put_user_error(0, &end->size, err);
1405 }
1406
1407 return err;
1408 }
1409
get_sigframe(struct rt_sigframe_user_layout * user,struct ksignal * ksig,struct pt_regs * regs)1410 static int get_sigframe(struct rt_sigframe_user_layout *user,
1411 struct ksignal *ksig, struct pt_regs *regs)
1412 {
1413 unsigned long sp, sp_top;
1414 int err;
1415
1416 init_user_layout(user);
1417 err = setup_sigframe_layout(user, false);
1418 if (err)
1419 return err;
1420
1421 sp = sp_top = sigsp(regs->sp, ksig);
1422
1423 sp = round_down(sp - sizeof(struct frame_record), 16);
1424 user->next_frame = (struct frame_record __user *)sp;
1425
1426 sp = round_down(sp, 16) - sigframe_size(user);
1427 user->sigframe = (struct rt_sigframe __user *)sp;
1428
1429 /*
1430 * Check that we can actually write to the signal frame.
1431 */
1432 if (!access_ok(user->sigframe, sp_top - sp))
1433 return -EFAULT;
1434
1435 return 0;
1436 }
1437
1438 #ifdef CONFIG_ARM64_GCS
1439
gcs_signal_entry(__sigrestore_t sigtramp,struct ksignal * ksig)1440 static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig)
1441 {
1442 u64 gcspr_el0;
1443 int ret = 0;
1444
1445 if (!system_supports_gcs())
1446 return 0;
1447
1448 if (!task_gcs_el0_enabled(current))
1449 return 0;
1450
1451 /*
1452 * We are entering a signal handler, current register state is
1453 * active.
1454 */
1455 gcspr_el0 = read_sysreg_s(SYS_GCSPR_EL0);
1456
1457 /*
1458 * Push a cap and the GCS entry for the trampoline onto the GCS.
1459 */
1460 put_user_gcs((unsigned long)sigtramp,
1461 (unsigned long __user *)(gcspr_el0 - 16), &ret);
1462 put_user_gcs(GCS_SIGNAL_CAP(gcspr_el0 - 8),
1463 (unsigned long __user *)(gcspr_el0 - 8), &ret);
1464 if (ret != 0)
1465 return ret;
1466
1467 gcspr_el0 -= 16;
1468 write_sysreg_s(gcspr_el0, SYS_GCSPR_EL0);
1469
1470 return 0;
1471 }
1472 #else
1473
gcs_signal_entry(__sigrestore_t sigtramp,struct ksignal * ksig)1474 static int gcs_signal_entry(__sigrestore_t sigtramp, struct ksignal *ksig)
1475 {
1476 return 0;
1477 }
1478
1479 #endif
1480
setup_return(struct pt_regs * regs,struct ksignal * ksig,struct rt_sigframe_user_layout * user,int usig)1481 static int setup_return(struct pt_regs *regs, struct ksignal *ksig,
1482 struct rt_sigframe_user_layout *user, int usig)
1483 {
1484 __sigrestore_t sigtramp;
1485 int err;
1486
1487 if (ksig->ka.sa.sa_flags & SA_RESTORER)
1488 sigtramp = ksig->ka.sa.sa_restorer;
1489 else
1490 sigtramp = VDSO_SYMBOL(current->mm->context.vdso, sigtramp);
1491
1492 err = gcs_signal_entry(sigtramp, ksig);
1493 if (err)
1494 return err;
1495
1496 /*
1497 * We must not fail from this point onwards. We are going to update
1498 * registers, including SP, in order to invoke the signal handler. If
1499 * we failed and attempted to deliver a nested SIGSEGV to a handler
1500 * after that point, the subsequent sigreturn would end up restoring
1501 * the (partial) state for the original signal handler.
1502 */
1503
1504 regs->regs[0] = usig;
1505 if (ksig->ka.sa.sa_flags & SA_SIGINFO) {
1506 regs->regs[1] = (unsigned long)&user->sigframe->info;
1507 regs->regs[2] = (unsigned long)&user->sigframe->uc;
1508 }
1509 regs->sp = (unsigned long)user->sigframe;
1510 regs->regs[29] = (unsigned long)&user->next_frame->fp;
1511 regs->regs[30] = (unsigned long)sigtramp;
1512 regs->pc = (unsigned long)ksig->ka.sa.sa_handler;
1513
1514 /*
1515 * Signal delivery is a (wacky) indirect function call in
1516 * userspace, so simulate the same setting of BTYPE as a BLR
1517 * <register containing the signal handler entry point>.
1518 * Signal delivery to a location in a PROT_BTI guarded page
1519 * that is not a function entry point will now trigger a
1520 * SIGILL in userspace.
1521 *
1522 * If the signal handler entry point is not in a PROT_BTI
1523 * guarded page, this is harmless.
1524 */
1525 if (system_supports_bti()) {
1526 regs->pstate &= ~PSR_BTYPE_MASK;
1527 regs->pstate |= PSR_BTYPE_C;
1528 }
1529
1530 /* TCO (Tag Check Override) always cleared for signal handlers */
1531 regs->pstate &= ~PSR_TCO_BIT;
1532
1533 /* Signal handlers are invoked with ZA and streaming mode disabled */
1534 if (system_supports_sme()) {
1535 task_smstop_sm(current);
1536 current->thread.svcr &= ~SVCR_ZA_MASK;
1537 write_sysreg_s(0, SYS_TPIDR2_EL0);
1538 }
1539
1540 return 0;
1541 }
1542
setup_rt_frame(int usig,struct ksignal * ksig,sigset_t * set,struct pt_regs * regs)1543 static int setup_rt_frame(int usig, struct ksignal *ksig, sigset_t *set,
1544 struct pt_regs *regs)
1545 {
1546 struct rt_sigframe_user_layout user;
1547 struct rt_sigframe __user *frame;
1548 struct user_access_state ua_state = {};
1549 int err = 0;
1550
1551 fpsimd_save_and_flush_current_state();
1552
1553 if (get_sigframe(&user, ksig, regs))
1554 return 1;
1555
1556 save_reset_user_access_state(&ua_state);
1557 frame = user.sigframe;
1558
1559 __put_user_error(0, &frame->uc.uc_flags, err);
1560 __put_user_error(NULL, &frame->uc.uc_link, err);
1561
1562 err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
1563 err |= setup_sigframe(&user, regs, set, &ua_state);
1564 if (ksig->ka.sa.sa_flags & SA_SIGINFO)
1565 err |= copy_siginfo_to_user(&frame->info, &ksig->info);
1566
1567 if (err == 0)
1568 err = setup_return(regs, ksig, &user, usig);
1569
1570 /*
1571 * We must not fail if setup_return() succeeded - see comment at the
1572 * beginning of setup_return().
1573 */
1574
1575 if (err == 0)
1576 set_handler_user_access_state();
1577 else
1578 restore_user_access_state(&ua_state);
1579
1580 return err;
1581 }
1582
setup_restart_syscall(struct pt_regs * regs)1583 static void setup_restart_syscall(struct pt_regs *regs)
1584 {
1585 if (is_compat_task())
1586 compat_setup_restart_syscall(regs);
1587 else
1588 regs->regs[8] = __NR_restart_syscall;
1589 }
1590
1591 /*
1592 * OK, we're invoking a handler
1593 */
handle_signal(struct ksignal * ksig,struct pt_regs * regs)1594 static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
1595 {
1596 sigset_t *oldset = sigmask_to_save();
1597 int usig = ksig->sig;
1598 int ret;
1599
1600 rseq_signal_deliver(ksig, regs);
1601
1602 /*
1603 * Set up the stack frame
1604 */
1605 if (is_compat_task()) {
1606 if (ksig->ka.sa.sa_flags & SA_SIGINFO)
1607 ret = compat_setup_rt_frame(usig, ksig, oldset, regs);
1608 else
1609 ret = compat_setup_frame(usig, ksig, oldset, regs);
1610 } else {
1611 ret = setup_rt_frame(usig, ksig, oldset, regs);
1612 }
1613
1614 /*
1615 * Check that the resulting registers are actually sane.
1616 */
1617 ret |= !valid_user_regs(®s->user_regs, current);
1618
1619 /* Step into the signal handler if we are stepping */
1620 signal_setup_done(ret, ksig, test_thread_flag(TIF_SINGLESTEP));
1621 }
1622
1623 /*
1624 * Note that 'init' is a special process: it doesn't get signals it doesn't
1625 * want to handle. Thus you cannot kill init even with a SIGKILL even by
1626 * mistake.
1627 *
1628 * Note that we go through the signals twice: once to check the signals that
1629 * the kernel can handle, and then we build all the user-level signal handling
1630 * stack-frames in one go after that.
1631 */
arch_do_signal_or_restart(struct pt_regs * regs)1632 void arch_do_signal_or_restart(struct pt_regs *regs)
1633 {
1634 unsigned long continue_addr = 0, restart_addr = 0;
1635 int retval = 0;
1636 struct ksignal ksig;
1637 bool syscall = in_syscall(regs);
1638
1639 /*
1640 * If we were from a system call, check for system call restarting...
1641 */
1642 if (syscall) {
1643 continue_addr = regs->pc;
1644 restart_addr = continue_addr - (compat_thumb_mode(regs) ? 2 : 4);
1645 retval = regs->regs[0];
1646
1647 /*
1648 * Avoid additional syscall restarting via ret_to_user.
1649 */
1650 forget_syscall(regs);
1651
1652 /*
1653 * Prepare for system call restart. We do this here so that a
1654 * debugger will see the already changed PC.
1655 */
1656 switch (retval) {
1657 case -ERESTARTNOHAND:
1658 case -ERESTARTSYS:
1659 case -ERESTARTNOINTR:
1660 case -ERESTART_RESTARTBLOCK:
1661 regs->regs[0] = regs->orig_x0;
1662 regs->pc = restart_addr;
1663 break;
1664 }
1665 }
1666
1667 /*
1668 * Get the signal to deliver. When running under ptrace, at this point
1669 * the debugger may change all of our registers.
1670 */
1671 if (get_signal(&ksig)) {
1672 /*
1673 * Depending on the signal settings, we may need to revert the
1674 * decision to restart the system call, but skip this if a
1675 * debugger has chosen to restart at a different PC.
1676 */
1677 if (regs->pc == restart_addr &&
1678 (retval == -ERESTARTNOHAND ||
1679 retval == -ERESTART_RESTARTBLOCK ||
1680 (retval == -ERESTARTSYS &&
1681 !(ksig.ka.sa.sa_flags & SA_RESTART)))) {
1682 syscall_set_return_value(current, regs, -EINTR, 0);
1683 regs->pc = continue_addr;
1684 }
1685
1686 handle_signal(&ksig, regs);
1687 return;
1688 }
1689
1690 /*
1691 * Handle restarting a different system call. As above, if a debugger
1692 * has chosen to restart at a different PC, ignore the restart.
1693 */
1694 if (syscall && regs->pc == restart_addr) {
1695 if (retval == -ERESTART_RESTARTBLOCK)
1696 setup_restart_syscall(regs);
1697 user_rewind_single_step(current);
1698 }
1699
1700 restore_saved_sigmask();
1701 }
1702
1703 unsigned long __ro_after_init signal_minsigstksz;
1704
1705 /*
1706 * Determine the stack space required for guaranteed signal devliery.
1707 * This function is used to populate AT_MINSIGSTKSZ at process startup.
1708 * cpufeatures setup is assumed to be complete.
1709 */
minsigstksz_setup(void)1710 void __init minsigstksz_setup(void)
1711 {
1712 struct rt_sigframe_user_layout user;
1713
1714 init_user_layout(&user);
1715
1716 /*
1717 * If this fails, SIGFRAME_MAXSZ needs to be enlarged. It won't
1718 * be big enough, but it's our best guess:
1719 */
1720 if (WARN_ON(setup_sigframe_layout(&user, true)))
1721 return;
1722
1723 signal_minsigstksz = sigframe_size(&user) +
1724 round_up(sizeof(struct frame_record), 16) +
1725 16; /* max alignment padding */
1726 }
1727
1728 /*
1729 * Compile-time assertions for siginfo_t offsets. Check NSIG* as well, as
1730 * changes likely come with new fields that should be added below.
1731 */
1732 static_assert(NSIGILL == 11);
1733 static_assert(NSIGFPE == 15);
1734 static_assert(NSIGSEGV == 10);
1735 static_assert(NSIGBUS == 5);
1736 static_assert(NSIGTRAP == 6);
1737 static_assert(NSIGCHLD == 6);
1738 static_assert(NSIGSYS == 2);
1739 static_assert(sizeof(siginfo_t) == 128);
1740 static_assert(__alignof__(siginfo_t) == 8);
1741 static_assert(offsetof(siginfo_t, si_signo) == 0x00);
1742 static_assert(offsetof(siginfo_t, si_errno) == 0x04);
1743 static_assert(offsetof(siginfo_t, si_code) == 0x08);
1744 static_assert(offsetof(siginfo_t, si_pid) == 0x10);
1745 static_assert(offsetof(siginfo_t, si_uid) == 0x14);
1746 static_assert(offsetof(siginfo_t, si_tid) == 0x10);
1747 static_assert(offsetof(siginfo_t, si_overrun) == 0x14);
1748 static_assert(offsetof(siginfo_t, si_status) == 0x18);
1749 static_assert(offsetof(siginfo_t, si_utime) == 0x20);
1750 static_assert(offsetof(siginfo_t, si_stime) == 0x28);
1751 static_assert(offsetof(siginfo_t, si_value) == 0x18);
1752 static_assert(offsetof(siginfo_t, si_int) == 0x18);
1753 static_assert(offsetof(siginfo_t, si_ptr) == 0x18);
1754 static_assert(offsetof(siginfo_t, si_addr) == 0x10);
1755 static_assert(offsetof(siginfo_t, si_addr_lsb) == 0x18);
1756 static_assert(offsetof(siginfo_t, si_lower) == 0x20);
1757 static_assert(offsetof(siginfo_t, si_upper) == 0x28);
1758 static_assert(offsetof(siginfo_t, si_pkey) == 0x20);
1759 static_assert(offsetof(siginfo_t, si_perf_data) == 0x18);
1760 static_assert(offsetof(siginfo_t, si_perf_type) == 0x20);
1761 static_assert(offsetof(siginfo_t, si_perf_flags) == 0x24);
1762 static_assert(offsetof(siginfo_t, si_band) == 0x10);
1763 static_assert(offsetof(siginfo_t, si_fd) == 0x18);
1764 static_assert(offsetof(siginfo_t, si_call_addr) == 0x10);
1765 static_assert(offsetof(siginfo_t, si_syscall) == 0x18);
1766 static_assert(offsetof(siginfo_t, si_arch) == 0x1c);
1767