1 /* 2 * Based on arch/arm/kernel/ptrace.c 3 * 4 * By Ross Biro 1/23/92 5 * edited by Linus Torvalds 6 * ARM modifications Copyright (C) 2000 Russell King 7 * Copyright (C) 2012 ARM Ltd. 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program. If not, see <http://www.gnu.org/licenses/>. 20 */ 21 22 #include <linux/audit.h> 23 #include <linux/compat.h> 24 #include <linux/kernel.h> 25 #include <linux/sched/signal.h> 26 #include <linux/sched/task_stack.h> 27 #include <linux/mm.h> 28 #include <linux/nospec.h> 29 #include <linux/smp.h> 30 #include <linux/ptrace.h> 31 #include <linux/user.h> 32 #include <linux/seccomp.h> 33 #include <linux/security.h> 34 #include <linux/init.h> 35 #include <linux/signal.h> 36 #include <linux/string.h> 37 #include <linux/uaccess.h> 38 #include <linux/perf_event.h> 39 #include <linux/hw_breakpoint.h> 40 #include <linux/regset.h> 41 #include <linux/tracehook.h> 42 #include <linux/elf.h> 43 44 #include <asm/compat.h> 45 #include <asm/cpufeature.h> 46 #include <asm/debug-monitors.h> 47 #include <asm/pgtable.h> 48 #include <asm/stacktrace.h> 49 #include <asm/syscall.h> 50 #include <asm/traps.h> 51 #include <asm/system_misc.h> 52 53 #define CREATE_TRACE_POINTS 54 #include <trace/events/syscalls.h> 55 56 struct pt_regs_offset { 57 const char *name; 58 int offset; 59 }; 60 61 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 62 #define REG_OFFSET_END {.name = NULL, .offset = 0} 63 #define GPR_OFFSET_NAME(r) \ 64 {.name = "x" #r, .offset = offsetof(struct pt_regs, regs[r])} 65 66 static const struct pt_regs_offset regoffset_table[] = { 67 GPR_OFFSET_NAME(0), 68 GPR_OFFSET_NAME(1), 69 GPR_OFFSET_NAME(2), 70 GPR_OFFSET_NAME(3), 71 GPR_OFFSET_NAME(4), 72 GPR_OFFSET_NAME(5), 73 GPR_OFFSET_NAME(6), 74 GPR_OFFSET_NAME(7), 75 GPR_OFFSET_NAME(8), 76 GPR_OFFSET_NAME(9), 77 GPR_OFFSET_NAME(10), 78 GPR_OFFSET_NAME(11), 79 GPR_OFFSET_NAME(12), 80 GPR_OFFSET_NAME(13), 81 GPR_OFFSET_NAME(14), 82 GPR_OFFSET_NAME(15), 83 GPR_OFFSET_NAME(16), 84 GPR_OFFSET_NAME(17), 85 GPR_OFFSET_NAME(18), 86 GPR_OFFSET_NAME(19), 87 GPR_OFFSET_NAME(20), 88 GPR_OFFSET_NAME(21), 89 GPR_OFFSET_NAME(22), 90 GPR_OFFSET_NAME(23), 91 GPR_OFFSET_NAME(24), 92 GPR_OFFSET_NAME(25), 93 GPR_OFFSET_NAME(26), 94 GPR_OFFSET_NAME(27), 95 GPR_OFFSET_NAME(28), 96 GPR_OFFSET_NAME(29), 97 GPR_OFFSET_NAME(30), 98 {.name = "lr", .offset = offsetof(struct pt_regs, regs[30])}, 99 REG_OFFSET_NAME(sp), 100 REG_OFFSET_NAME(pc), 101 REG_OFFSET_NAME(pstate), 102 REG_OFFSET_END, 103 }; 104 105 /** 106 * regs_query_register_offset() - query register offset from its name 107 * @name: the name of a register 108 * 109 * regs_query_register_offset() returns the offset of a register in struct 110 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 111 */ 112 int regs_query_register_offset(const char *name) 113 { 114 const struct pt_regs_offset *roff; 115 116 for (roff = regoffset_table; roff->name != NULL; roff++) 117 if (!strcmp(roff->name, name)) 118 return roff->offset; 119 return -EINVAL; 120 } 121 122 /** 123 * regs_within_kernel_stack() - check the address in the stack 124 * @regs: pt_regs which contains kernel stack pointer. 125 * @addr: address which is checked. 126 * 127 * regs_within_kernel_stack() checks @addr is within the kernel stack page(s). 128 * If @addr is within the kernel stack, it returns true. If not, returns false. 129 */ 130 static bool regs_within_kernel_stack(struct pt_regs *regs, unsigned long addr) 131 { 132 return ((addr & ~(THREAD_SIZE - 1)) == 133 (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1))) || 134 on_irq_stack(addr); 135 } 136 137 /** 138 * regs_get_kernel_stack_nth() - get Nth entry of the stack 139 * @regs: pt_regs which contains kernel stack pointer. 140 * @n: stack entry number. 141 * 142 * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which 143 * is specified by @regs. If the @n th entry is NOT in the kernel stack, 144 * this returns 0. 145 */ 146 unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n) 147 { 148 unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs); 149 150 addr += n; 151 if (regs_within_kernel_stack(regs, (unsigned long)addr)) 152 return *addr; 153 else 154 return 0; 155 } 156 157 /* 158 * TODO: does not yet catch signals sent when the child dies. 159 * in exit.c or in signal.c. 160 */ 161 162 /* 163 * Called by kernel/ptrace.c when detaching.. 164 */ 165 void ptrace_disable(struct task_struct *child) 166 { 167 /* 168 * This would be better off in core code, but PTRACE_DETACH has 169 * grown its fair share of arch-specific worts and changing it 170 * is likely to cause regressions on obscure architectures. 171 */ 172 user_disable_single_step(child); 173 } 174 175 #ifdef CONFIG_HAVE_HW_BREAKPOINT 176 /* 177 * Handle hitting a HW-breakpoint. 178 */ 179 static void ptrace_hbptriggered(struct perf_event *bp, 180 struct perf_sample_data *data, 181 struct pt_regs *regs) 182 { 183 struct arch_hw_breakpoint *bkpt = counter_arch_bp(bp); 184 siginfo_t info; 185 186 clear_siginfo(&info); 187 info.si_signo = SIGTRAP; 188 info.si_errno = 0; 189 info.si_code = TRAP_HWBKPT; 190 info.si_addr = (void __user *)(bkpt->trigger); 191 192 #ifdef CONFIG_COMPAT 193 if (is_compat_task()) { 194 int si_errno = 0; 195 int i; 196 197 for (i = 0; i < ARM_MAX_BRP; ++i) { 198 if (current->thread.debug.hbp_break[i] == bp) { 199 si_errno = (i << 1) + 1; 200 break; 201 } 202 } 203 204 for (i = 0; i < ARM_MAX_WRP; ++i) { 205 if (current->thread.debug.hbp_watch[i] == bp) { 206 si_errno = -((i << 1) + 1); 207 break; 208 } 209 } 210 force_sig_ptrace_errno_trap(si_errno, (void __user *)bkpt->trigger); 211 } 212 #endif 213 arm64_force_sig_info(&info, "Hardware breakpoint trap (ptrace)", current); 214 } 215 216 /* 217 * Unregister breakpoints from this task and reset the pointers in 218 * the thread_struct. 219 */ 220 void flush_ptrace_hw_breakpoint(struct task_struct *tsk) 221 { 222 int i; 223 struct thread_struct *t = &tsk->thread; 224 225 for (i = 0; i < ARM_MAX_BRP; i++) { 226 if (t->debug.hbp_break[i]) { 227 unregister_hw_breakpoint(t->debug.hbp_break[i]); 228 t->debug.hbp_break[i] = NULL; 229 } 230 } 231 232 for (i = 0; i < ARM_MAX_WRP; i++) { 233 if (t->debug.hbp_watch[i]) { 234 unregister_hw_breakpoint(t->debug.hbp_watch[i]); 235 t->debug.hbp_watch[i] = NULL; 236 } 237 } 238 } 239 240 void ptrace_hw_copy_thread(struct task_struct *tsk) 241 { 242 memset(&tsk->thread.debug, 0, sizeof(struct debug_info)); 243 } 244 245 static struct perf_event *ptrace_hbp_get_event(unsigned int note_type, 246 struct task_struct *tsk, 247 unsigned long idx) 248 { 249 struct perf_event *bp = ERR_PTR(-EINVAL); 250 251 switch (note_type) { 252 case NT_ARM_HW_BREAK: 253 if (idx >= ARM_MAX_BRP) 254 goto out; 255 idx = array_index_nospec(idx, ARM_MAX_BRP); 256 bp = tsk->thread.debug.hbp_break[idx]; 257 break; 258 case NT_ARM_HW_WATCH: 259 if (idx >= ARM_MAX_WRP) 260 goto out; 261 idx = array_index_nospec(idx, ARM_MAX_WRP); 262 bp = tsk->thread.debug.hbp_watch[idx]; 263 break; 264 } 265 266 out: 267 return bp; 268 } 269 270 static int ptrace_hbp_set_event(unsigned int note_type, 271 struct task_struct *tsk, 272 unsigned long idx, 273 struct perf_event *bp) 274 { 275 int err = -EINVAL; 276 277 switch (note_type) { 278 case NT_ARM_HW_BREAK: 279 if (idx < ARM_MAX_BRP) { 280 tsk->thread.debug.hbp_break[idx] = bp; 281 err = 0; 282 } 283 break; 284 case NT_ARM_HW_WATCH: 285 if (idx < ARM_MAX_WRP) { 286 tsk->thread.debug.hbp_watch[idx] = bp; 287 err = 0; 288 } 289 break; 290 } 291 292 return err; 293 } 294 295 static struct perf_event *ptrace_hbp_create(unsigned int note_type, 296 struct task_struct *tsk, 297 unsigned long idx) 298 { 299 struct perf_event *bp; 300 struct perf_event_attr attr; 301 int err, type; 302 303 switch (note_type) { 304 case NT_ARM_HW_BREAK: 305 type = HW_BREAKPOINT_X; 306 break; 307 case NT_ARM_HW_WATCH: 308 type = HW_BREAKPOINT_RW; 309 break; 310 default: 311 return ERR_PTR(-EINVAL); 312 } 313 314 ptrace_breakpoint_init(&attr); 315 316 /* 317 * Initialise fields to sane defaults 318 * (i.e. values that will pass validation). 319 */ 320 attr.bp_addr = 0; 321 attr.bp_len = HW_BREAKPOINT_LEN_4; 322 attr.bp_type = type; 323 attr.disabled = 1; 324 325 bp = register_user_hw_breakpoint(&attr, ptrace_hbptriggered, NULL, tsk); 326 if (IS_ERR(bp)) 327 return bp; 328 329 err = ptrace_hbp_set_event(note_type, tsk, idx, bp); 330 if (err) 331 return ERR_PTR(err); 332 333 return bp; 334 } 335 336 static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type, 337 struct arch_hw_breakpoint_ctrl ctrl, 338 struct perf_event_attr *attr) 339 { 340 int err, len, type, offset, disabled = !ctrl.enabled; 341 342 attr->disabled = disabled; 343 if (disabled) 344 return 0; 345 346 err = arch_bp_generic_fields(ctrl, &len, &type, &offset); 347 if (err) 348 return err; 349 350 switch (note_type) { 351 case NT_ARM_HW_BREAK: 352 if ((type & HW_BREAKPOINT_X) != type) 353 return -EINVAL; 354 break; 355 case NT_ARM_HW_WATCH: 356 if ((type & HW_BREAKPOINT_RW) != type) 357 return -EINVAL; 358 break; 359 default: 360 return -EINVAL; 361 } 362 363 attr->bp_len = len; 364 attr->bp_type = type; 365 attr->bp_addr += offset; 366 367 return 0; 368 } 369 370 static int ptrace_hbp_get_resource_info(unsigned int note_type, u32 *info) 371 { 372 u8 num; 373 u32 reg = 0; 374 375 switch (note_type) { 376 case NT_ARM_HW_BREAK: 377 num = hw_breakpoint_slots(TYPE_INST); 378 break; 379 case NT_ARM_HW_WATCH: 380 num = hw_breakpoint_slots(TYPE_DATA); 381 break; 382 default: 383 return -EINVAL; 384 } 385 386 reg |= debug_monitors_arch(); 387 reg <<= 8; 388 reg |= num; 389 390 *info = reg; 391 return 0; 392 } 393 394 static int ptrace_hbp_get_ctrl(unsigned int note_type, 395 struct task_struct *tsk, 396 unsigned long idx, 397 u32 *ctrl) 398 { 399 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 400 401 if (IS_ERR(bp)) 402 return PTR_ERR(bp); 403 404 *ctrl = bp ? encode_ctrl_reg(counter_arch_bp(bp)->ctrl) : 0; 405 return 0; 406 } 407 408 static int ptrace_hbp_get_addr(unsigned int note_type, 409 struct task_struct *tsk, 410 unsigned long idx, 411 u64 *addr) 412 { 413 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 414 415 if (IS_ERR(bp)) 416 return PTR_ERR(bp); 417 418 *addr = bp ? counter_arch_bp(bp)->address : 0; 419 return 0; 420 } 421 422 static struct perf_event *ptrace_hbp_get_initialised_bp(unsigned int note_type, 423 struct task_struct *tsk, 424 unsigned long idx) 425 { 426 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx); 427 428 if (!bp) 429 bp = ptrace_hbp_create(note_type, tsk, idx); 430 431 return bp; 432 } 433 434 static int ptrace_hbp_set_ctrl(unsigned int note_type, 435 struct task_struct *tsk, 436 unsigned long idx, 437 u32 uctrl) 438 { 439 int err; 440 struct perf_event *bp; 441 struct perf_event_attr attr; 442 struct arch_hw_breakpoint_ctrl ctrl; 443 444 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); 445 if (IS_ERR(bp)) { 446 err = PTR_ERR(bp); 447 return err; 448 } 449 450 attr = bp->attr; 451 decode_ctrl_reg(uctrl, &ctrl); 452 err = ptrace_hbp_fill_attr_ctrl(note_type, ctrl, &attr); 453 if (err) 454 return err; 455 456 return modify_user_hw_breakpoint(bp, &attr); 457 } 458 459 static int ptrace_hbp_set_addr(unsigned int note_type, 460 struct task_struct *tsk, 461 unsigned long idx, 462 u64 addr) 463 { 464 int err; 465 struct perf_event *bp; 466 struct perf_event_attr attr; 467 468 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx); 469 if (IS_ERR(bp)) { 470 err = PTR_ERR(bp); 471 return err; 472 } 473 474 attr = bp->attr; 475 attr.bp_addr = addr; 476 err = modify_user_hw_breakpoint(bp, &attr); 477 return err; 478 } 479 480 #define PTRACE_HBP_ADDR_SZ sizeof(u64) 481 #define PTRACE_HBP_CTRL_SZ sizeof(u32) 482 #define PTRACE_HBP_PAD_SZ sizeof(u32) 483 484 static int hw_break_get(struct task_struct *target, 485 const struct user_regset *regset, 486 unsigned int pos, unsigned int count, 487 void *kbuf, void __user *ubuf) 488 { 489 unsigned int note_type = regset->core_note_type; 490 int ret, idx = 0, offset, limit; 491 u32 info, ctrl; 492 u64 addr; 493 494 /* Resource info */ 495 ret = ptrace_hbp_get_resource_info(note_type, &info); 496 if (ret) 497 return ret; 498 499 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &info, 0, 500 sizeof(info)); 501 if (ret) 502 return ret; 503 504 /* Pad */ 505 offset = offsetof(struct user_hwdebug_state, pad); 506 ret = user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf, offset, 507 offset + PTRACE_HBP_PAD_SZ); 508 if (ret) 509 return ret; 510 511 /* (address, ctrl) registers */ 512 offset = offsetof(struct user_hwdebug_state, dbg_regs); 513 limit = regset->n * regset->size; 514 while (count && offset < limit) { 515 ret = ptrace_hbp_get_addr(note_type, target, idx, &addr); 516 if (ret) 517 return ret; 518 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &addr, 519 offset, offset + PTRACE_HBP_ADDR_SZ); 520 if (ret) 521 return ret; 522 offset += PTRACE_HBP_ADDR_SZ; 523 524 ret = ptrace_hbp_get_ctrl(note_type, target, idx, &ctrl); 525 if (ret) 526 return ret; 527 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &ctrl, 528 offset, offset + PTRACE_HBP_CTRL_SZ); 529 if (ret) 530 return ret; 531 offset += PTRACE_HBP_CTRL_SZ; 532 533 ret = user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf, 534 offset, 535 offset + PTRACE_HBP_PAD_SZ); 536 if (ret) 537 return ret; 538 offset += PTRACE_HBP_PAD_SZ; 539 idx++; 540 } 541 542 return 0; 543 } 544 545 static int hw_break_set(struct task_struct *target, 546 const struct user_regset *regset, 547 unsigned int pos, unsigned int count, 548 const void *kbuf, const void __user *ubuf) 549 { 550 unsigned int note_type = regset->core_note_type; 551 int ret, idx = 0, offset, limit; 552 u32 ctrl; 553 u64 addr; 554 555 /* Resource info and pad */ 556 offset = offsetof(struct user_hwdebug_state, dbg_regs); 557 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 0, offset); 558 if (ret) 559 return ret; 560 561 /* (address, ctrl) registers */ 562 limit = regset->n * regset->size; 563 while (count && offset < limit) { 564 if (count < PTRACE_HBP_ADDR_SZ) 565 return -EINVAL; 566 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &addr, 567 offset, offset + PTRACE_HBP_ADDR_SZ); 568 if (ret) 569 return ret; 570 ret = ptrace_hbp_set_addr(note_type, target, idx, addr); 571 if (ret) 572 return ret; 573 offset += PTRACE_HBP_ADDR_SZ; 574 575 if (!count) 576 break; 577 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 578 offset, offset + PTRACE_HBP_CTRL_SZ); 579 if (ret) 580 return ret; 581 ret = ptrace_hbp_set_ctrl(note_type, target, idx, ctrl); 582 if (ret) 583 return ret; 584 offset += PTRACE_HBP_CTRL_SZ; 585 586 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 587 offset, 588 offset + PTRACE_HBP_PAD_SZ); 589 if (ret) 590 return ret; 591 offset += PTRACE_HBP_PAD_SZ; 592 idx++; 593 } 594 595 return 0; 596 } 597 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 598 599 static int gpr_get(struct task_struct *target, 600 const struct user_regset *regset, 601 unsigned int pos, unsigned int count, 602 void *kbuf, void __user *ubuf) 603 { 604 struct user_pt_regs *uregs = &task_pt_regs(target)->user_regs; 605 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0, -1); 606 } 607 608 static int gpr_set(struct task_struct *target, const struct user_regset *regset, 609 unsigned int pos, unsigned int count, 610 const void *kbuf, const void __user *ubuf) 611 { 612 int ret; 613 struct user_pt_regs newregs = task_pt_regs(target)->user_regs; 614 615 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs, 0, -1); 616 if (ret) 617 return ret; 618 619 if (!valid_user_regs(&newregs, target)) 620 return -EINVAL; 621 622 task_pt_regs(target)->user_regs = newregs; 623 return 0; 624 } 625 626 /* 627 * TODO: update fp accessors for lazy context switching (sync/flush hwstate) 628 */ 629 static int __fpr_get(struct task_struct *target, 630 const struct user_regset *regset, 631 unsigned int pos, unsigned int count, 632 void *kbuf, void __user *ubuf, unsigned int start_pos) 633 { 634 struct user_fpsimd_state *uregs; 635 636 sve_sync_to_fpsimd(target); 637 638 uregs = &target->thread.uw.fpsimd_state; 639 640 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 641 start_pos, start_pos + sizeof(*uregs)); 642 } 643 644 static int fpr_get(struct task_struct *target, const struct user_regset *regset, 645 unsigned int pos, unsigned int count, 646 void *kbuf, void __user *ubuf) 647 { 648 if (target == current) 649 fpsimd_preserve_current_state(); 650 651 return __fpr_get(target, regset, pos, count, kbuf, ubuf, 0); 652 } 653 654 static int __fpr_set(struct task_struct *target, 655 const struct user_regset *regset, 656 unsigned int pos, unsigned int count, 657 const void *kbuf, const void __user *ubuf, 658 unsigned int start_pos) 659 { 660 int ret; 661 struct user_fpsimd_state newstate; 662 663 /* 664 * Ensure target->thread.uw.fpsimd_state is up to date, so that a 665 * short copyin can't resurrect stale data. 666 */ 667 sve_sync_to_fpsimd(target); 668 669 newstate = target->thread.uw.fpsimd_state; 670 671 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newstate, 672 start_pos, start_pos + sizeof(newstate)); 673 if (ret) 674 return ret; 675 676 target->thread.uw.fpsimd_state = newstate; 677 678 return ret; 679 } 680 681 static int fpr_set(struct task_struct *target, const struct user_regset *regset, 682 unsigned int pos, unsigned int count, 683 const void *kbuf, const void __user *ubuf) 684 { 685 int ret; 686 687 ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 0); 688 if (ret) 689 return ret; 690 691 sve_sync_from_fpsimd_zeropad(target); 692 fpsimd_flush_task_state(target); 693 694 return ret; 695 } 696 697 static int tls_get(struct task_struct *target, const struct user_regset *regset, 698 unsigned int pos, unsigned int count, 699 void *kbuf, void __user *ubuf) 700 { 701 unsigned long *tls = &target->thread.uw.tp_value; 702 703 if (target == current) 704 tls_preserve_current_state(); 705 706 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, tls, 0, -1); 707 } 708 709 static int tls_set(struct task_struct *target, const struct user_regset *regset, 710 unsigned int pos, unsigned int count, 711 const void *kbuf, const void __user *ubuf) 712 { 713 int ret; 714 unsigned long tls = target->thread.uw.tp_value; 715 716 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); 717 if (ret) 718 return ret; 719 720 target->thread.uw.tp_value = tls; 721 return ret; 722 } 723 724 static int system_call_get(struct task_struct *target, 725 const struct user_regset *regset, 726 unsigned int pos, unsigned int count, 727 void *kbuf, void __user *ubuf) 728 { 729 int syscallno = task_pt_regs(target)->syscallno; 730 731 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, 732 &syscallno, 0, -1); 733 } 734 735 static int system_call_set(struct task_struct *target, 736 const struct user_regset *regset, 737 unsigned int pos, unsigned int count, 738 const void *kbuf, const void __user *ubuf) 739 { 740 int syscallno = task_pt_regs(target)->syscallno; 741 int ret; 742 743 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &syscallno, 0, -1); 744 if (ret) 745 return ret; 746 747 task_pt_regs(target)->syscallno = syscallno; 748 return ret; 749 } 750 751 #ifdef CONFIG_ARM64_SVE 752 753 static void sve_init_header_from_task(struct user_sve_header *header, 754 struct task_struct *target) 755 { 756 unsigned int vq; 757 758 memset(header, 0, sizeof(*header)); 759 760 header->flags = test_tsk_thread_flag(target, TIF_SVE) ? 761 SVE_PT_REGS_SVE : SVE_PT_REGS_FPSIMD; 762 if (test_tsk_thread_flag(target, TIF_SVE_VL_INHERIT)) 763 header->flags |= SVE_PT_VL_INHERIT; 764 765 header->vl = target->thread.sve_vl; 766 vq = sve_vq_from_vl(header->vl); 767 768 header->max_vl = sve_max_vl; 769 header->size = SVE_PT_SIZE(vq, header->flags); 770 header->max_size = SVE_PT_SIZE(sve_vq_from_vl(header->max_vl), 771 SVE_PT_REGS_SVE); 772 } 773 774 static unsigned int sve_size_from_header(struct user_sve_header const *header) 775 { 776 return ALIGN(header->size, SVE_VQ_BYTES); 777 } 778 779 static unsigned int sve_get_size(struct task_struct *target, 780 const struct user_regset *regset) 781 { 782 struct user_sve_header header; 783 784 if (!system_supports_sve()) 785 return 0; 786 787 sve_init_header_from_task(&header, target); 788 return sve_size_from_header(&header); 789 } 790 791 static int sve_get(struct task_struct *target, 792 const struct user_regset *regset, 793 unsigned int pos, unsigned int count, 794 void *kbuf, void __user *ubuf) 795 { 796 int ret; 797 struct user_sve_header header; 798 unsigned int vq; 799 unsigned long start, end; 800 801 if (!system_supports_sve()) 802 return -EINVAL; 803 804 /* Header */ 805 sve_init_header_from_task(&header, target); 806 vq = sve_vq_from_vl(header.vl); 807 808 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &header, 809 0, sizeof(header)); 810 if (ret) 811 return ret; 812 813 if (target == current) 814 fpsimd_preserve_current_state(); 815 816 /* Registers: FPSIMD-only case */ 817 818 BUILD_BUG_ON(SVE_PT_FPSIMD_OFFSET != sizeof(header)); 819 if ((header.flags & SVE_PT_REGS_MASK) == SVE_PT_REGS_FPSIMD) 820 return __fpr_get(target, regset, pos, count, kbuf, ubuf, 821 SVE_PT_FPSIMD_OFFSET); 822 823 /* Otherwise: full SVE case */ 824 825 BUILD_BUG_ON(SVE_PT_SVE_OFFSET != sizeof(header)); 826 start = SVE_PT_SVE_OFFSET; 827 end = SVE_PT_SVE_FFR_OFFSET(vq) + SVE_PT_SVE_FFR_SIZE(vq); 828 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, 829 target->thread.sve_state, 830 start, end); 831 if (ret) 832 return ret; 833 834 start = end; 835 end = SVE_PT_SVE_FPSR_OFFSET(vq); 836 ret = user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf, 837 start, end); 838 if (ret) 839 return ret; 840 841 /* 842 * Copy fpsr, and fpcr which must follow contiguously in 843 * struct fpsimd_state: 844 */ 845 start = end; 846 end = SVE_PT_SVE_FPCR_OFFSET(vq) + SVE_PT_SVE_FPCR_SIZE; 847 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, 848 &target->thread.uw.fpsimd_state.fpsr, 849 start, end); 850 if (ret) 851 return ret; 852 853 start = end; 854 end = sve_size_from_header(&header); 855 return user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf, 856 start, end); 857 } 858 859 static int sve_set(struct task_struct *target, 860 const struct user_regset *regset, 861 unsigned int pos, unsigned int count, 862 const void *kbuf, const void __user *ubuf) 863 { 864 int ret; 865 struct user_sve_header header; 866 unsigned int vq; 867 unsigned long start, end; 868 869 if (!system_supports_sve()) 870 return -EINVAL; 871 872 /* Header */ 873 if (count < sizeof(header)) 874 return -EINVAL; 875 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &header, 876 0, sizeof(header)); 877 if (ret) 878 goto out; 879 880 /* 881 * Apart from PT_SVE_REGS_MASK, all PT_SVE_* flags are consumed by 882 * sve_set_vector_length(), which will also validate them for us: 883 */ 884 ret = sve_set_vector_length(target, header.vl, 885 ((unsigned long)header.flags & ~SVE_PT_REGS_MASK) << 16); 886 if (ret) 887 goto out; 888 889 /* Actual VL set may be less than the user asked for: */ 890 vq = sve_vq_from_vl(target->thread.sve_vl); 891 892 /* Registers: FPSIMD-only case */ 893 894 BUILD_BUG_ON(SVE_PT_FPSIMD_OFFSET != sizeof(header)); 895 if ((header.flags & SVE_PT_REGS_MASK) == SVE_PT_REGS_FPSIMD) { 896 ret = __fpr_set(target, regset, pos, count, kbuf, ubuf, 897 SVE_PT_FPSIMD_OFFSET); 898 clear_tsk_thread_flag(target, TIF_SVE); 899 goto out; 900 } 901 902 /* Otherwise: full SVE case */ 903 904 /* 905 * If setting a different VL from the requested VL and there is 906 * register data, the data layout will be wrong: don't even 907 * try to set the registers in this case. 908 */ 909 if (count && vq != sve_vq_from_vl(header.vl)) { 910 ret = -EIO; 911 goto out; 912 } 913 914 sve_alloc(target); 915 916 /* 917 * Ensure target->thread.sve_state is up to date with target's 918 * FPSIMD regs, so that a short copyin leaves trailing registers 919 * unmodified. 920 */ 921 fpsimd_sync_to_sve(target); 922 set_tsk_thread_flag(target, TIF_SVE); 923 924 BUILD_BUG_ON(SVE_PT_SVE_OFFSET != sizeof(header)); 925 start = SVE_PT_SVE_OFFSET; 926 end = SVE_PT_SVE_FFR_OFFSET(vq) + SVE_PT_SVE_FFR_SIZE(vq); 927 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 928 target->thread.sve_state, 929 start, end); 930 if (ret) 931 goto out; 932 933 start = end; 934 end = SVE_PT_SVE_FPSR_OFFSET(vq); 935 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 936 start, end); 937 if (ret) 938 goto out; 939 940 /* 941 * Copy fpsr, and fpcr which must follow contiguously in 942 * struct fpsimd_state: 943 */ 944 start = end; 945 end = SVE_PT_SVE_FPCR_OFFSET(vq) + SVE_PT_SVE_FPCR_SIZE; 946 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, 947 &target->thread.uw.fpsimd_state.fpsr, 948 start, end); 949 950 out: 951 fpsimd_flush_task_state(target); 952 return ret; 953 } 954 955 #endif /* CONFIG_ARM64_SVE */ 956 957 enum aarch64_regset { 958 REGSET_GPR, 959 REGSET_FPR, 960 REGSET_TLS, 961 #ifdef CONFIG_HAVE_HW_BREAKPOINT 962 REGSET_HW_BREAK, 963 REGSET_HW_WATCH, 964 #endif 965 REGSET_SYSTEM_CALL, 966 #ifdef CONFIG_ARM64_SVE 967 REGSET_SVE, 968 #endif 969 }; 970 971 static const struct user_regset aarch64_regsets[] = { 972 [REGSET_GPR] = { 973 .core_note_type = NT_PRSTATUS, 974 .n = sizeof(struct user_pt_regs) / sizeof(u64), 975 .size = sizeof(u64), 976 .align = sizeof(u64), 977 .get = gpr_get, 978 .set = gpr_set 979 }, 980 [REGSET_FPR] = { 981 .core_note_type = NT_PRFPREG, 982 .n = sizeof(struct user_fpsimd_state) / sizeof(u32), 983 /* 984 * We pretend we have 32-bit registers because the fpsr and 985 * fpcr are 32-bits wide. 986 */ 987 .size = sizeof(u32), 988 .align = sizeof(u32), 989 .get = fpr_get, 990 .set = fpr_set 991 }, 992 [REGSET_TLS] = { 993 .core_note_type = NT_ARM_TLS, 994 .n = 1, 995 .size = sizeof(void *), 996 .align = sizeof(void *), 997 .get = tls_get, 998 .set = tls_set, 999 }, 1000 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1001 [REGSET_HW_BREAK] = { 1002 .core_note_type = NT_ARM_HW_BREAK, 1003 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1004 .size = sizeof(u32), 1005 .align = sizeof(u32), 1006 .get = hw_break_get, 1007 .set = hw_break_set, 1008 }, 1009 [REGSET_HW_WATCH] = { 1010 .core_note_type = NT_ARM_HW_WATCH, 1011 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1012 .size = sizeof(u32), 1013 .align = sizeof(u32), 1014 .get = hw_break_get, 1015 .set = hw_break_set, 1016 }, 1017 #endif 1018 [REGSET_SYSTEM_CALL] = { 1019 .core_note_type = NT_ARM_SYSTEM_CALL, 1020 .n = 1, 1021 .size = sizeof(int), 1022 .align = sizeof(int), 1023 .get = system_call_get, 1024 .set = system_call_set, 1025 }, 1026 #ifdef CONFIG_ARM64_SVE 1027 [REGSET_SVE] = { /* Scalable Vector Extension */ 1028 .core_note_type = NT_ARM_SVE, 1029 .n = DIV_ROUND_UP(SVE_PT_SIZE(SVE_VQ_MAX, SVE_PT_REGS_SVE), 1030 SVE_VQ_BYTES), 1031 .size = SVE_VQ_BYTES, 1032 .align = SVE_VQ_BYTES, 1033 .get = sve_get, 1034 .set = sve_set, 1035 .get_size = sve_get_size, 1036 }, 1037 #endif 1038 }; 1039 1040 static const struct user_regset_view user_aarch64_view = { 1041 .name = "aarch64", .e_machine = EM_AARCH64, 1042 .regsets = aarch64_regsets, .n = ARRAY_SIZE(aarch64_regsets) 1043 }; 1044 1045 #ifdef CONFIG_COMPAT 1046 enum compat_regset { 1047 REGSET_COMPAT_GPR, 1048 REGSET_COMPAT_VFP, 1049 }; 1050 1051 static int compat_gpr_get(struct task_struct *target, 1052 const struct user_regset *regset, 1053 unsigned int pos, unsigned int count, 1054 void *kbuf, void __user *ubuf) 1055 { 1056 int ret = 0; 1057 unsigned int i, start, num_regs; 1058 1059 /* Calculate the number of AArch32 registers contained in count */ 1060 num_regs = count / regset->size; 1061 1062 /* Convert pos into an register number */ 1063 start = pos / regset->size; 1064 1065 if (start + num_regs > regset->n) 1066 return -EIO; 1067 1068 for (i = 0; i < num_regs; ++i) { 1069 unsigned int idx = start + i; 1070 compat_ulong_t reg; 1071 1072 switch (idx) { 1073 case 15: 1074 reg = task_pt_regs(target)->pc; 1075 break; 1076 case 16: 1077 reg = task_pt_regs(target)->pstate; 1078 break; 1079 case 17: 1080 reg = task_pt_regs(target)->orig_x0; 1081 break; 1082 default: 1083 reg = task_pt_regs(target)->regs[idx]; 1084 } 1085 1086 if (kbuf) { 1087 memcpy(kbuf, ®, sizeof(reg)); 1088 kbuf += sizeof(reg); 1089 } else { 1090 ret = copy_to_user(ubuf, ®, sizeof(reg)); 1091 if (ret) { 1092 ret = -EFAULT; 1093 break; 1094 } 1095 1096 ubuf += sizeof(reg); 1097 } 1098 } 1099 1100 return ret; 1101 } 1102 1103 static int compat_gpr_set(struct task_struct *target, 1104 const struct user_regset *regset, 1105 unsigned int pos, unsigned int count, 1106 const void *kbuf, const void __user *ubuf) 1107 { 1108 struct pt_regs newregs; 1109 int ret = 0; 1110 unsigned int i, start, num_regs; 1111 1112 /* Calculate the number of AArch32 registers contained in count */ 1113 num_regs = count / regset->size; 1114 1115 /* Convert pos into an register number */ 1116 start = pos / regset->size; 1117 1118 if (start + num_regs > regset->n) 1119 return -EIO; 1120 1121 newregs = *task_pt_regs(target); 1122 1123 for (i = 0; i < num_regs; ++i) { 1124 unsigned int idx = start + i; 1125 compat_ulong_t reg; 1126 1127 if (kbuf) { 1128 memcpy(®, kbuf, sizeof(reg)); 1129 kbuf += sizeof(reg); 1130 } else { 1131 ret = copy_from_user(®, ubuf, sizeof(reg)); 1132 if (ret) { 1133 ret = -EFAULT; 1134 break; 1135 } 1136 1137 ubuf += sizeof(reg); 1138 } 1139 1140 switch (idx) { 1141 case 15: 1142 newregs.pc = reg; 1143 break; 1144 case 16: 1145 newregs.pstate = reg; 1146 break; 1147 case 17: 1148 newregs.orig_x0 = reg; 1149 break; 1150 default: 1151 newregs.regs[idx] = reg; 1152 } 1153 1154 } 1155 1156 if (valid_user_regs(&newregs.user_regs, target)) 1157 *task_pt_regs(target) = newregs; 1158 else 1159 ret = -EINVAL; 1160 1161 return ret; 1162 } 1163 1164 static int compat_vfp_get(struct task_struct *target, 1165 const struct user_regset *regset, 1166 unsigned int pos, unsigned int count, 1167 void *kbuf, void __user *ubuf) 1168 { 1169 struct user_fpsimd_state *uregs; 1170 compat_ulong_t fpscr; 1171 int ret, vregs_end_pos; 1172 1173 uregs = &target->thread.uw.fpsimd_state; 1174 1175 if (target == current) 1176 fpsimd_preserve_current_state(); 1177 1178 /* 1179 * The VFP registers are packed into the fpsimd_state, so they all sit 1180 * nicely together for us. We just need to create the fpscr separately. 1181 */ 1182 vregs_end_pos = VFP_STATE_SIZE - sizeof(compat_ulong_t); 1183 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 1184 0, vregs_end_pos); 1185 1186 if (count && !ret) { 1187 fpscr = (uregs->fpsr & VFP_FPSCR_STAT_MASK) | 1188 (uregs->fpcr & VFP_FPSCR_CTRL_MASK); 1189 1190 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &fpscr, 1191 vregs_end_pos, VFP_STATE_SIZE); 1192 } 1193 1194 return ret; 1195 } 1196 1197 static int compat_vfp_set(struct task_struct *target, 1198 const struct user_regset *regset, 1199 unsigned int pos, unsigned int count, 1200 const void *kbuf, const void __user *ubuf) 1201 { 1202 struct user_fpsimd_state *uregs; 1203 compat_ulong_t fpscr; 1204 int ret, vregs_end_pos; 1205 1206 uregs = &target->thread.uw.fpsimd_state; 1207 1208 vregs_end_pos = VFP_STATE_SIZE - sizeof(compat_ulong_t); 1209 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0, 1210 vregs_end_pos); 1211 1212 if (count && !ret) { 1213 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &fpscr, 1214 vregs_end_pos, VFP_STATE_SIZE); 1215 if (!ret) { 1216 uregs->fpsr = fpscr & VFP_FPSCR_STAT_MASK; 1217 uregs->fpcr = fpscr & VFP_FPSCR_CTRL_MASK; 1218 } 1219 } 1220 1221 fpsimd_flush_task_state(target); 1222 return ret; 1223 } 1224 1225 static int compat_tls_get(struct task_struct *target, 1226 const struct user_regset *regset, unsigned int pos, 1227 unsigned int count, void *kbuf, void __user *ubuf) 1228 { 1229 compat_ulong_t tls = (compat_ulong_t)target->thread.uw.tp_value; 1230 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); 1231 } 1232 1233 static int compat_tls_set(struct task_struct *target, 1234 const struct user_regset *regset, unsigned int pos, 1235 unsigned int count, const void *kbuf, 1236 const void __user *ubuf) 1237 { 1238 int ret; 1239 compat_ulong_t tls = target->thread.uw.tp_value; 1240 1241 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); 1242 if (ret) 1243 return ret; 1244 1245 target->thread.uw.tp_value = tls; 1246 return ret; 1247 } 1248 1249 static const struct user_regset aarch32_regsets[] = { 1250 [REGSET_COMPAT_GPR] = { 1251 .core_note_type = NT_PRSTATUS, 1252 .n = COMPAT_ELF_NGREG, 1253 .size = sizeof(compat_elf_greg_t), 1254 .align = sizeof(compat_elf_greg_t), 1255 .get = compat_gpr_get, 1256 .set = compat_gpr_set 1257 }, 1258 [REGSET_COMPAT_VFP] = { 1259 .core_note_type = NT_ARM_VFP, 1260 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), 1261 .size = sizeof(compat_ulong_t), 1262 .align = sizeof(compat_ulong_t), 1263 .get = compat_vfp_get, 1264 .set = compat_vfp_set 1265 }, 1266 }; 1267 1268 static const struct user_regset_view user_aarch32_view = { 1269 .name = "aarch32", .e_machine = EM_ARM, 1270 .regsets = aarch32_regsets, .n = ARRAY_SIZE(aarch32_regsets) 1271 }; 1272 1273 static const struct user_regset aarch32_ptrace_regsets[] = { 1274 [REGSET_GPR] = { 1275 .core_note_type = NT_PRSTATUS, 1276 .n = COMPAT_ELF_NGREG, 1277 .size = sizeof(compat_elf_greg_t), 1278 .align = sizeof(compat_elf_greg_t), 1279 .get = compat_gpr_get, 1280 .set = compat_gpr_set 1281 }, 1282 [REGSET_FPR] = { 1283 .core_note_type = NT_ARM_VFP, 1284 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t), 1285 .size = sizeof(compat_ulong_t), 1286 .align = sizeof(compat_ulong_t), 1287 .get = compat_vfp_get, 1288 .set = compat_vfp_set 1289 }, 1290 [REGSET_TLS] = { 1291 .core_note_type = NT_ARM_TLS, 1292 .n = 1, 1293 .size = sizeof(compat_ulong_t), 1294 .align = sizeof(compat_ulong_t), 1295 .get = compat_tls_get, 1296 .set = compat_tls_set, 1297 }, 1298 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1299 [REGSET_HW_BREAK] = { 1300 .core_note_type = NT_ARM_HW_BREAK, 1301 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1302 .size = sizeof(u32), 1303 .align = sizeof(u32), 1304 .get = hw_break_get, 1305 .set = hw_break_set, 1306 }, 1307 [REGSET_HW_WATCH] = { 1308 .core_note_type = NT_ARM_HW_WATCH, 1309 .n = sizeof(struct user_hwdebug_state) / sizeof(u32), 1310 .size = sizeof(u32), 1311 .align = sizeof(u32), 1312 .get = hw_break_get, 1313 .set = hw_break_set, 1314 }, 1315 #endif 1316 [REGSET_SYSTEM_CALL] = { 1317 .core_note_type = NT_ARM_SYSTEM_CALL, 1318 .n = 1, 1319 .size = sizeof(int), 1320 .align = sizeof(int), 1321 .get = system_call_get, 1322 .set = system_call_set, 1323 }, 1324 }; 1325 1326 static const struct user_regset_view user_aarch32_ptrace_view = { 1327 .name = "aarch32", .e_machine = EM_ARM, 1328 .regsets = aarch32_ptrace_regsets, .n = ARRAY_SIZE(aarch32_ptrace_regsets) 1329 }; 1330 1331 static int compat_ptrace_read_user(struct task_struct *tsk, compat_ulong_t off, 1332 compat_ulong_t __user *ret) 1333 { 1334 compat_ulong_t tmp; 1335 1336 if (off & 3) 1337 return -EIO; 1338 1339 if (off == COMPAT_PT_TEXT_ADDR) 1340 tmp = tsk->mm->start_code; 1341 else if (off == COMPAT_PT_DATA_ADDR) 1342 tmp = tsk->mm->start_data; 1343 else if (off == COMPAT_PT_TEXT_END_ADDR) 1344 tmp = tsk->mm->end_code; 1345 else if (off < sizeof(compat_elf_gregset_t)) 1346 return copy_regset_to_user(tsk, &user_aarch32_view, 1347 REGSET_COMPAT_GPR, off, 1348 sizeof(compat_ulong_t), ret); 1349 else if (off >= COMPAT_USER_SZ) 1350 return -EIO; 1351 else 1352 tmp = 0; 1353 1354 return put_user(tmp, ret); 1355 } 1356 1357 static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off, 1358 compat_ulong_t val) 1359 { 1360 int ret; 1361 mm_segment_t old_fs = get_fs(); 1362 1363 if (off & 3 || off >= COMPAT_USER_SZ) 1364 return -EIO; 1365 1366 if (off >= sizeof(compat_elf_gregset_t)) 1367 return 0; 1368 1369 set_fs(KERNEL_DS); 1370 ret = copy_regset_from_user(tsk, &user_aarch32_view, 1371 REGSET_COMPAT_GPR, off, 1372 sizeof(compat_ulong_t), 1373 &val); 1374 set_fs(old_fs); 1375 1376 return ret; 1377 } 1378 1379 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1380 1381 /* 1382 * Convert a virtual register number into an index for a thread_info 1383 * breakpoint array. Breakpoints are identified using positive numbers 1384 * whilst watchpoints are negative. The registers are laid out as pairs 1385 * of (address, control), each pair mapping to a unique hw_breakpoint struct. 1386 * Register 0 is reserved for describing resource information. 1387 */ 1388 static int compat_ptrace_hbp_num_to_idx(compat_long_t num) 1389 { 1390 return (abs(num) - 1) >> 1; 1391 } 1392 1393 static int compat_ptrace_hbp_get_resource_info(u32 *kdata) 1394 { 1395 u8 num_brps, num_wrps, debug_arch, wp_len; 1396 u32 reg = 0; 1397 1398 num_brps = hw_breakpoint_slots(TYPE_INST); 1399 num_wrps = hw_breakpoint_slots(TYPE_DATA); 1400 1401 debug_arch = debug_monitors_arch(); 1402 wp_len = 8; 1403 reg |= debug_arch; 1404 reg <<= 8; 1405 reg |= wp_len; 1406 reg <<= 8; 1407 reg |= num_wrps; 1408 reg <<= 8; 1409 reg |= num_brps; 1410 1411 *kdata = reg; 1412 return 0; 1413 } 1414 1415 static int compat_ptrace_hbp_get(unsigned int note_type, 1416 struct task_struct *tsk, 1417 compat_long_t num, 1418 u32 *kdata) 1419 { 1420 u64 addr = 0; 1421 u32 ctrl = 0; 1422 1423 int err, idx = compat_ptrace_hbp_num_to_idx(num); 1424 1425 if (num & 1) { 1426 err = ptrace_hbp_get_addr(note_type, tsk, idx, &addr); 1427 *kdata = (u32)addr; 1428 } else { 1429 err = ptrace_hbp_get_ctrl(note_type, tsk, idx, &ctrl); 1430 *kdata = ctrl; 1431 } 1432 1433 return err; 1434 } 1435 1436 static int compat_ptrace_hbp_set(unsigned int note_type, 1437 struct task_struct *tsk, 1438 compat_long_t num, 1439 u32 *kdata) 1440 { 1441 u64 addr; 1442 u32 ctrl; 1443 1444 int err, idx = compat_ptrace_hbp_num_to_idx(num); 1445 1446 if (num & 1) { 1447 addr = *kdata; 1448 err = ptrace_hbp_set_addr(note_type, tsk, idx, addr); 1449 } else { 1450 ctrl = *kdata; 1451 err = ptrace_hbp_set_ctrl(note_type, tsk, idx, ctrl); 1452 } 1453 1454 return err; 1455 } 1456 1457 static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, 1458 compat_ulong_t __user *data) 1459 { 1460 int ret; 1461 u32 kdata; 1462 1463 /* Watchpoint */ 1464 if (num < 0) { 1465 ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata); 1466 /* Resource info */ 1467 } else if (num == 0) { 1468 ret = compat_ptrace_hbp_get_resource_info(&kdata); 1469 /* Breakpoint */ 1470 } else { 1471 ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata); 1472 } 1473 1474 if (!ret) 1475 ret = put_user(kdata, data); 1476 1477 return ret; 1478 } 1479 1480 static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, 1481 compat_ulong_t __user *data) 1482 { 1483 int ret; 1484 u32 kdata = 0; 1485 1486 if (num == 0) 1487 return 0; 1488 1489 ret = get_user(kdata, data); 1490 if (ret) 1491 return ret; 1492 1493 if (num < 0) 1494 ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata); 1495 else 1496 ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata); 1497 1498 return ret; 1499 } 1500 #endif /* CONFIG_HAVE_HW_BREAKPOINT */ 1501 1502 long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 1503 compat_ulong_t caddr, compat_ulong_t cdata) 1504 { 1505 unsigned long addr = caddr; 1506 unsigned long data = cdata; 1507 void __user *datap = compat_ptr(data); 1508 int ret; 1509 1510 switch (request) { 1511 case PTRACE_PEEKUSR: 1512 ret = compat_ptrace_read_user(child, addr, datap); 1513 break; 1514 1515 case PTRACE_POKEUSR: 1516 ret = compat_ptrace_write_user(child, addr, data); 1517 break; 1518 1519 case COMPAT_PTRACE_GETREGS: 1520 ret = copy_regset_to_user(child, 1521 &user_aarch32_view, 1522 REGSET_COMPAT_GPR, 1523 0, sizeof(compat_elf_gregset_t), 1524 datap); 1525 break; 1526 1527 case COMPAT_PTRACE_SETREGS: 1528 ret = copy_regset_from_user(child, 1529 &user_aarch32_view, 1530 REGSET_COMPAT_GPR, 1531 0, sizeof(compat_elf_gregset_t), 1532 datap); 1533 break; 1534 1535 case COMPAT_PTRACE_GET_THREAD_AREA: 1536 ret = put_user((compat_ulong_t)child->thread.uw.tp_value, 1537 (compat_ulong_t __user *)datap); 1538 break; 1539 1540 case COMPAT_PTRACE_SET_SYSCALL: 1541 task_pt_regs(child)->syscallno = data; 1542 ret = 0; 1543 break; 1544 1545 case COMPAT_PTRACE_GETVFPREGS: 1546 ret = copy_regset_to_user(child, 1547 &user_aarch32_view, 1548 REGSET_COMPAT_VFP, 1549 0, VFP_STATE_SIZE, 1550 datap); 1551 break; 1552 1553 case COMPAT_PTRACE_SETVFPREGS: 1554 ret = copy_regset_from_user(child, 1555 &user_aarch32_view, 1556 REGSET_COMPAT_VFP, 1557 0, VFP_STATE_SIZE, 1558 datap); 1559 break; 1560 1561 #ifdef CONFIG_HAVE_HW_BREAKPOINT 1562 case COMPAT_PTRACE_GETHBPREGS: 1563 ret = compat_ptrace_gethbpregs(child, addr, datap); 1564 break; 1565 1566 case COMPAT_PTRACE_SETHBPREGS: 1567 ret = compat_ptrace_sethbpregs(child, addr, datap); 1568 break; 1569 #endif 1570 1571 default: 1572 ret = compat_ptrace_request(child, request, addr, 1573 data); 1574 break; 1575 } 1576 1577 return ret; 1578 } 1579 #endif /* CONFIG_COMPAT */ 1580 1581 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 1582 { 1583 #ifdef CONFIG_COMPAT 1584 /* 1585 * Core dumping of 32-bit tasks or compat ptrace requests must use the 1586 * user_aarch32_view compatible with arm32. Native ptrace requests on 1587 * 32-bit children use an extended user_aarch32_ptrace_view to allow 1588 * access to the TLS register. 1589 */ 1590 if (is_compat_task()) 1591 return &user_aarch32_view; 1592 else if (is_compat_thread(task_thread_info(task))) 1593 return &user_aarch32_ptrace_view; 1594 #endif 1595 return &user_aarch64_view; 1596 } 1597 1598 long arch_ptrace(struct task_struct *child, long request, 1599 unsigned long addr, unsigned long data) 1600 { 1601 return ptrace_request(child, request, addr, data); 1602 } 1603 1604 enum ptrace_syscall_dir { 1605 PTRACE_SYSCALL_ENTER = 0, 1606 PTRACE_SYSCALL_EXIT, 1607 }; 1608 1609 static void tracehook_report_syscall(struct pt_regs *regs, 1610 enum ptrace_syscall_dir dir) 1611 { 1612 int regno; 1613 unsigned long saved_reg; 1614 1615 /* 1616 * A scratch register (ip(r12) on AArch32, x7 on AArch64) is 1617 * used to denote syscall entry/exit: 1618 */ 1619 regno = (is_compat_task() ? 12 : 7); 1620 saved_reg = regs->regs[regno]; 1621 regs->regs[regno] = dir; 1622 1623 if (dir == PTRACE_SYSCALL_EXIT) 1624 tracehook_report_syscall_exit(regs, 0); 1625 else if (tracehook_report_syscall_entry(regs)) 1626 forget_syscall(regs); 1627 1628 regs->regs[regno] = saved_reg; 1629 } 1630 1631 asmlinkage int syscall_trace_enter(struct pt_regs *regs) 1632 { 1633 if (test_thread_flag(TIF_SYSCALL_TRACE)) 1634 tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); 1635 1636 /* Do the secure computing after ptrace; failures should be fast. */ 1637 if (secure_computing(NULL) == -1) 1638 return -1; 1639 1640 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) 1641 trace_sys_enter(regs, regs->syscallno); 1642 1643 audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1], 1644 regs->regs[2], regs->regs[3]); 1645 1646 return regs->syscallno; 1647 } 1648 1649 asmlinkage void syscall_trace_exit(struct pt_regs *regs) 1650 { 1651 audit_syscall_exit(regs); 1652 1653 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) 1654 trace_sys_exit(regs, regs_return_value(regs)); 1655 1656 if (test_thread_flag(TIF_SYSCALL_TRACE)) 1657 tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT); 1658 } 1659 1660 /* 1661 * Bits which are always architecturally RES0 per ARM DDI 0487A.h 1662 * Userspace cannot use these until they have an architectural meaning. 1663 * We also reserve IL for the kernel; SS is handled dynamically. 1664 */ 1665 #define SPSR_EL1_AARCH64_RES0_BITS \ 1666 (GENMASK_ULL(63,32) | GENMASK_ULL(27, 22) | GENMASK_ULL(20, 10) | \ 1667 GENMASK_ULL(5, 5)) 1668 #define SPSR_EL1_AARCH32_RES0_BITS \ 1669 (GENMASK_ULL(63,32) | GENMASK_ULL(24, 22) | GENMASK_ULL(20,20)) 1670 1671 static int valid_compat_regs(struct user_pt_regs *regs) 1672 { 1673 regs->pstate &= ~SPSR_EL1_AARCH32_RES0_BITS; 1674 1675 if (!system_supports_mixed_endian_el0()) { 1676 if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) 1677 regs->pstate |= COMPAT_PSR_E_BIT; 1678 else 1679 regs->pstate &= ~COMPAT_PSR_E_BIT; 1680 } 1681 1682 if (user_mode(regs) && (regs->pstate & PSR_MODE32_BIT) && 1683 (regs->pstate & COMPAT_PSR_A_BIT) == 0 && 1684 (regs->pstate & COMPAT_PSR_I_BIT) == 0 && 1685 (regs->pstate & COMPAT_PSR_F_BIT) == 0) { 1686 return 1; 1687 } 1688 1689 /* 1690 * Force PSR to a valid 32-bit EL0t, preserving the same bits as 1691 * arch/arm. 1692 */ 1693 regs->pstate &= COMPAT_PSR_N_BIT | COMPAT_PSR_Z_BIT | 1694 COMPAT_PSR_C_BIT | COMPAT_PSR_V_BIT | 1695 COMPAT_PSR_Q_BIT | COMPAT_PSR_IT_MASK | 1696 COMPAT_PSR_GE_MASK | COMPAT_PSR_E_BIT | 1697 COMPAT_PSR_T_BIT; 1698 regs->pstate |= PSR_MODE32_BIT; 1699 1700 return 0; 1701 } 1702 1703 static int valid_native_regs(struct user_pt_regs *regs) 1704 { 1705 regs->pstate &= ~SPSR_EL1_AARCH64_RES0_BITS; 1706 1707 if (user_mode(regs) && !(regs->pstate & PSR_MODE32_BIT) && 1708 (regs->pstate & PSR_D_BIT) == 0 && 1709 (regs->pstate & PSR_A_BIT) == 0 && 1710 (regs->pstate & PSR_I_BIT) == 0 && 1711 (regs->pstate & PSR_F_BIT) == 0) { 1712 return 1; 1713 } 1714 1715 /* Force PSR to a valid 64-bit EL0t */ 1716 regs->pstate &= PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT; 1717 1718 return 0; 1719 } 1720 1721 /* 1722 * Are the current registers suitable for user mode? (used to maintain 1723 * security in signal handlers) 1724 */ 1725 int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task) 1726 { 1727 if (!test_tsk_thread_flag(task, TIF_SINGLESTEP)) 1728 regs->pstate &= ~DBG_SPSR_SS; 1729 1730 if (is_compat_thread(task_thread_info(task))) 1731 return valid_compat_regs(regs); 1732 else 1733 return valid_native_regs(regs); 1734 } 1735