arm64: fix NULL dereference in have_cpu_die()
[linux/fpc-iii.git] / arch / arm64 / kernel / ptrace.c
blob8eedeef375d606961db5235b8d3c60d2eb184d51
1 /*
2 * Based on arch/arm/kernel/ptrace.c
4 * By Ross Biro 1/23/92
5 * edited by Linus Torvalds
6 * ARM modifications Copyright (C) 2000 Russell King
7 * Copyright (C) 2012 ARM Ltd.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include <linux/audit.h>
23 #include <linux/compat.h>
24 #include <linux/kernel.h>
25 #include <linux/sched.h>
26 #include <linux/mm.h>
27 #include <linux/smp.h>
28 #include <linux/ptrace.h>
29 #include <linux/user.h>
30 #include <linux/seccomp.h>
31 #include <linux/security.h>
32 #include <linux/init.h>
33 #include <linux/signal.h>
34 #include <linux/uaccess.h>
35 #include <linux/perf_event.h>
36 #include <linux/hw_breakpoint.h>
37 #include <linux/regset.h>
38 #include <linux/tracehook.h>
39 #include <linux/elf.h>
41 #include <asm/compat.h>
42 #include <asm/debug-monitors.h>
43 #include <asm/pgtable.h>
44 #include <asm/syscall.h>
45 #include <asm/traps.h>
46 #include <asm/system_misc.h>
48 #define CREATE_TRACE_POINTS
49 #include <trace/events/syscalls.h>
51 struct pt_regs_offset {
52 const char *name;
53 int offset;
56 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)}
57 #define REG_OFFSET_END {.name = NULL, .offset = 0}
58 #define GPR_OFFSET_NAME(r) \
59 {.name = "x" #r, .offset = offsetof(struct pt_regs, regs[r])}
61 static const struct pt_regs_offset regoffset_table[] = {
62 GPR_OFFSET_NAME(0),
63 GPR_OFFSET_NAME(1),
64 GPR_OFFSET_NAME(2),
65 GPR_OFFSET_NAME(3),
66 GPR_OFFSET_NAME(4),
67 GPR_OFFSET_NAME(5),
68 GPR_OFFSET_NAME(6),
69 GPR_OFFSET_NAME(7),
70 GPR_OFFSET_NAME(8),
71 GPR_OFFSET_NAME(9),
72 GPR_OFFSET_NAME(10),
73 GPR_OFFSET_NAME(11),
74 GPR_OFFSET_NAME(12),
75 GPR_OFFSET_NAME(13),
76 GPR_OFFSET_NAME(14),
77 GPR_OFFSET_NAME(15),
78 GPR_OFFSET_NAME(16),
79 GPR_OFFSET_NAME(17),
80 GPR_OFFSET_NAME(18),
81 GPR_OFFSET_NAME(19),
82 GPR_OFFSET_NAME(20),
83 GPR_OFFSET_NAME(21),
84 GPR_OFFSET_NAME(22),
85 GPR_OFFSET_NAME(23),
86 GPR_OFFSET_NAME(24),
87 GPR_OFFSET_NAME(25),
88 GPR_OFFSET_NAME(26),
89 GPR_OFFSET_NAME(27),
90 GPR_OFFSET_NAME(28),
91 GPR_OFFSET_NAME(29),
92 GPR_OFFSET_NAME(30),
93 {.name = "lr", .offset = offsetof(struct pt_regs, regs[30])},
94 REG_OFFSET_NAME(sp),
95 REG_OFFSET_NAME(pc),
96 REG_OFFSET_NAME(pstate),
97 REG_OFFSET_END,
101 * regs_query_register_offset() - query register offset from its name
102 * @name: the name of a register
104 * regs_query_register_offset() returns the offset of a register in struct
105 * pt_regs from its name. If the name is invalid, this returns -EINVAL;
107 int regs_query_register_offset(const char *name)
109 const struct pt_regs_offset *roff;
111 for (roff = regoffset_table; roff->name != NULL; roff++)
112 if (!strcmp(roff->name, name))
113 return roff->offset;
114 return -EINVAL;
118 * regs_within_kernel_stack() - check the address in the stack
119 * @regs: pt_regs which contains kernel stack pointer.
120 * @addr: address which is checked.
122 * regs_within_kernel_stack() checks @addr is within the kernel stack page(s).
123 * If @addr is within the kernel stack, it returns true. If not, returns false.
125 static bool regs_within_kernel_stack(struct pt_regs *regs, unsigned long addr)
127 return ((addr & ~(THREAD_SIZE - 1)) ==
128 (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1))) ||
129 on_irq_stack(addr, raw_smp_processor_id());
133 * regs_get_kernel_stack_nth() - get Nth entry of the stack
134 * @regs: pt_regs which contains kernel stack pointer.
135 * @n: stack entry number.
137 * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which
138 * is specified by @regs. If the @n th entry is NOT in the kernel stack,
139 * this returns 0.
141 unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n)
143 unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
145 addr += n;
146 if (regs_within_kernel_stack(regs, (unsigned long)addr))
147 return *addr;
148 else
149 return 0;
153 * TODO: does not yet catch signals sent when the child dies.
154 * in exit.c or in signal.c.
158 * Called by kernel/ptrace.c when detaching..
160 void ptrace_disable(struct task_struct *child)
163 * This would be better off in core code, but PTRACE_DETACH has
164 * grown its fair share of arch-specific worts and changing it
165 * is likely to cause regressions on obscure architectures.
167 user_disable_single_step(child);
170 #ifdef CONFIG_HAVE_HW_BREAKPOINT
172 * Handle hitting a HW-breakpoint.
174 static void ptrace_hbptriggered(struct perf_event *bp,
175 struct perf_sample_data *data,
176 struct pt_regs *regs)
178 struct arch_hw_breakpoint *bkpt = counter_arch_bp(bp);
179 siginfo_t info = {
180 .si_signo = SIGTRAP,
181 .si_errno = 0,
182 .si_code = TRAP_HWBKPT,
183 .si_addr = (void __user *)(bkpt->trigger),
186 #ifdef CONFIG_COMPAT
187 int i;
189 if (!is_compat_task())
190 goto send_sig;
192 for (i = 0; i < ARM_MAX_BRP; ++i) {
193 if (current->thread.debug.hbp_break[i] == bp) {
194 info.si_errno = (i << 1) + 1;
195 break;
199 for (i = 0; i < ARM_MAX_WRP; ++i) {
200 if (current->thread.debug.hbp_watch[i] == bp) {
201 info.si_errno = -((i << 1) + 1);
202 break;
206 send_sig:
207 #endif
208 force_sig_info(SIGTRAP, &info, current);
212 * Unregister breakpoints from this task and reset the pointers in
213 * the thread_struct.
215 void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
217 int i;
218 struct thread_struct *t = &tsk->thread;
220 for (i = 0; i < ARM_MAX_BRP; i++) {
221 if (t->debug.hbp_break[i]) {
222 unregister_hw_breakpoint(t->debug.hbp_break[i]);
223 t->debug.hbp_break[i] = NULL;
227 for (i = 0; i < ARM_MAX_WRP; i++) {
228 if (t->debug.hbp_watch[i]) {
229 unregister_hw_breakpoint(t->debug.hbp_watch[i]);
230 t->debug.hbp_watch[i] = NULL;
235 void ptrace_hw_copy_thread(struct task_struct *tsk)
237 memset(&tsk->thread.debug, 0, sizeof(struct debug_info));
240 static struct perf_event *ptrace_hbp_get_event(unsigned int note_type,
241 struct task_struct *tsk,
242 unsigned long idx)
244 struct perf_event *bp = ERR_PTR(-EINVAL);
246 switch (note_type) {
247 case NT_ARM_HW_BREAK:
248 if (idx < ARM_MAX_BRP)
249 bp = tsk->thread.debug.hbp_break[idx];
250 break;
251 case NT_ARM_HW_WATCH:
252 if (idx < ARM_MAX_WRP)
253 bp = tsk->thread.debug.hbp_watch[idx];
254 break;
257 return bp;
260 static int ptrace_hbp_set_event(unsigned int note_type,
261 struct task_struct *tsk,
262 unsigned long idx,
263 struct perf_event *bp)
265 int err = -EINVAL;
267 switch (note_type) {
268 case NT_ARM_HW_BREAK:
269 if (idx < ARM_MAX_BRP) {
270 tsk->thread.debug.hbp_break[idx] = bp;
271 err = 0;
273 break;
274 case NT_ARM_HW_WATCH:
275 if (idx < ARM_MAX_WRP) {
276 tsk->thread.debug.hbp_watch[idx] = bp;
277 err = 0;
279 break;
282 return err;
285 static struct perf_event *ptrace_hbp_create(unsigned int note_type,
286 struct task_struct *tsk,
287 unsigned long idx)
289 struct perf_event *bp;
290 struct perf_event_attr attr;
291 int err, type;
293 switch (note_type) {
294 case NT_ARM_HW_BREAK:
295 type = HW_BREAKPOINT_X;
296 break;
297 case NT_ARM_HW_WATCH:
298 type = HW_BREAKPOINT_RW;
299 break;
300 default:
301 return ERR_PTR(-EINVAL);
304 ptrace_breakpoint_init(&attr);
307 * Initialise fields to sane defaults
308 * (i.e. values that will pass validation).
310 attr.bp_addr = 0;
311 attr.bp_len = HW_BREAKPOINT_LEN_4;
312 attr.bp_type = type;
313 attr.disabled = 1;
315 bp = register_user_hw_breakpoint(&attr, ptrace_hbptriggered, NULL, tsk);
316 if (IS_ERR(bp))
317 return bp;
319 err = ptrace_hbp_set_event(note_type, tsk, idx, bp);
320 if (err)
321 return ERR_PTR(err);
323 return bp;
326 static int ptrace_hbp_fill_attr_ctrl(unsigned int note_type,
327 struct arch_hw_breakpoint_ctrl ctrl,
328 struct perf_event_attr *attr)
330 int err, len, type, disabled = !ctrl.enabled;
332 attr->disabled = disabled;
333 if (disabled)
334 return 0;
336 err = arch_bp_generic_fields(ctrl, &len, &type);
337 if (err)
338 return err;
340 switch (note_type) {
341 case NT_ARM_HW_BREAK:
342 if ((type & HW_BREAKPOINT_X) != type)
343 return -EINVAL;
344 break;
345 case NT_ARM_HW_WATCH:
346 if ((type & HW_BREAKPOINT_RW) != type)
347 return -EINVAL;
348 break;
349 default:
350 return -EINVAL;
353 attr->bp_len = len;
354 attr->bp_type = type;
356 return 0;
359 static int ptrace_hbp_get_resource_info(unsigned int note_type, u32 *info)
361 u8 num;
362 u32 reg = 0;
364 switch (note_type) {
365 case NT_ARM_HW_BREAK:
366 num = hw_breakpoint_slots(TYPE_INST);
367 break;
368 case NT_ARM_HW_WATCH:
369 num = hw_breakpoint_slots(TYPE_DATA);
370 break;
371 default:
372 return -EINVAL;
375 reg |= debug_monitors_arch();
376 reg <<= 8;
377 reg |= num;
379 *info = reg;
380 return 0;
383 static int ptrace_hbp_get_ctrl(unsigned int note_type,
384 struct task_struct *tsk,
385 unsigned long idx,
386 u32 *ctrl)
388 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx);
390 if (IS_ERR(bp))
391 return PTR_ERR(bp);
393 *ctrl = bp ? encode_ctrl_reg(counter_arch_bp(bp)->ctrl) : 0;
394 return 0;
397 static int ptrace_hbp_get_addr(unsigned int note_type,
398 struct task_struct *tsk,
399 unsigned long idx,
400 u64 *addr)
402 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx);
404 if (IS_ERR(bp))
405 return PTR_ERR(bp);
407 *addr = bp ? bp->attr.bp_addr : 0;
408 return 0;
411 static struct perf_event *ptrace_hbp_get_initialised_bp(unsigned int note_type,
412 struct task_struct *tsk,
413 unsigned long idx)
415 struct perf_event *bp = ptrace_hbp_get_event(note_type, tsk, idx);
417 if (!bp)
418 bp = ptrace_hbp_create(note_type, tsk, idx);
420 return bp;
423 static int ptrace_hbp_set_ctrl(unsigned int note_type,
424 struct task_struct *tsk,
425 unsigned long idx,
426 u32 uctrl)
428 int err;
429 struct perf_event *bp;
430 struct perf_event_attr attr;
431 struct arch_hw_breakpoint_ctrl ctrl;
433 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx);
434 if (IS_ERR(bp)) {
435 err = PTR_ERR(bp);
436 return err;
439 attr = bp->attr;
440 decode_ctrl_reg(uctrl, &ctrl);
441 err = ptrace_hbp_fill_attr_ctrl(note_type, ctrl, &attr);
442 if (err)
443 return err;
445 return modify_user_hw_breakpoint(bp, &attr);
448 static int ptrace_hbp_set_addr(unsigned int note_type,
449 struct task_struct *tsk,
450 unsigned long idx,
451 u64 addr)
453 int err;
454 struct perf_event *bp;
455 struct perf_event_attr attr;
457 bp = ptrace_hbp_get_initialised_bp(note_type, tsk, idx);
458 if (IS_ERR(bp)) {
459 err = PTR_ERR(bp);
460 return err;
463 attr = bp->attr;
464 attr.bp_addr = addr;
465 err = modify_user_hw_breakpoint(bp, &attr);
466 return err;
469 #define PTRACE_HBP_ADDR_SZ sizeof(u64)
470 #define PTRACE_HBP_CTRL_SZ sizeof(u32)
471 #define PTRACE_HBP_PAD_SZ sizeof(u32)
473 static int hw_break_get(struct task_struct *target,
474 const struct user_regset *regset,
475 unsigned int pos, unsigned int count,
476 void *kbuf, void __user *ubuf)
478 unsigned int note_type = regset->core_note_type;
479 int ret, idx = 0, offset, limit;
480 u32 info, ctrl;
481 u64 addr;
483 /* Resource info */
484 ret = ptrace_hbp_get_resource_info(note_type, &info);
485 if (ret)
486 return ret;
488 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &info, 0,
489 sizeof(info));
490 if (ret)
491 return ret;
493 /* Pad */
494 offset = offsetof(struct user_hwdebug_state, pad);
495 ret = user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf, offset,
496 offset + PTRACE_HBP_PAD_SZ);
497 if (ret)
498 return ret;
500 /* (address, ctrl) registers */
501 offset = offsetof(struct user_hwdebug_state, dbg_regs);
502 limit = regset->n * regset->size;
503 while (count && offset < limit) {
504 ret = ptrace_hbp_get_addr(note_type, target, idx, &addr);
505 if (ret)
506 return ret;
507 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &addr,
508 offset, offset + PTRACE_HBP_ADDR_SZ);
509 if (ret)
510 return ret;
511 offset += PTRACE_HBP_ADDR_SZ;
513 ret = ptrace_hbp_get_ctrl(note_type, target, idx, &ctrl);
514 if (ret)
515 return ret;
516 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &ctrl,
517 offset, offset + PTRACE_HBP_CTRL_SZ);
518 if (ret)
519 return ret;
520 offset += PTRACE_HBP_CTRL_SZ;
522 ret = user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf,
523 offset,
524 offset + PTRACE_HBP_PAD_SZ);
525 if (ret)
526 return ret;
527 offset += PTRACE_HBP_PAD_SZ;
528 idx++;
531 return 0;
534 static int hw_break_set(struct task_struct *target,
535 const struct user_regset *regset,
536 unsigned int pos, unsigned int count,
537 const void *kbuf, const void __user *ubuf)
539 unsigned int note_type = regset->core_note_type;
540 int ret, idx = 0, offset, limit;
541 u32 ctrl;
542 u64 addr;
544 /* Resource info and pad */
545 offset = offsetof(struct user_hwdebug_state, dbg_regs);
546 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, 0, offset);
547 if (ret)
548 return ret;
550 /* (address, ctrl) registers */
551 limit = regset->n * regset->size;
552 while (count && offset < limit) {
553 if (count < PTRACE_HBP_ADDR_SZ)
554 return -EINVAL;
555 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &addr,
556 offset, offset + PTRACE_HBP_ADDR_SZ);
557 if (ret)
558 return ret;
559 ret = ptrace_hbp_set_addr(note_type, target, idx, addr);
560 if (ret)
561 return ret;
562 offset += PTRACE_HBP_ADDR_SZ;
564 if (!count)
565 break;
566 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl,
567 offset, offset + PTRACE_HBP_CTRL_SZ);
568 if (ret)
569 return ret;
570 ret = ptrace_hbp_set_ctrl(note_type, target, idx, ctrl);
571 if (ret)
572 return ret;
573 offset += PTRACE_HBP_CTRL_SZ;
575 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
576 offset,
577 offset + PTRACE_HBP_PAD_SZ);
578 if (ret)
579 return ret;
580 offset += PTRACE_HBP_PAD_SZ;
581 idx++;
584 return 0;
586 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
588 static int gpr_get(struct task_struct *target,
589 const struct user_regset *regset,
590 unsigned int pos, unsigned int count,
591 void *kbuf, void __user *ubuf)
593 struct user_pt_regs *uregs = &task_pt_regs(target)->user_regs;
594 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0, -1);
597 static int gpr_set(struct task_struct *target, const struct user_regset *regset,
598 unsigned int pos, unsigned int count,
599 const void *kbuf, const void __user *ubuf)
601 int ret;
602 struct user_pt_regs newregs = task_pt_regs(target)->user_regs;
604 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs, 0, -1);
605 if (ret)
606 return ret;
608 if (!valid_user_regs(&newregs, target))
609 return -EINVAL;
611 task_pt_regs(target)->user_regs = newregs;
612 return 0;
616 * TODO: update fp accessors for lazy context switching (sync/flush hwstate)
618 static int fpr_get(struct task_struct *target, const struct user_regset *regset,
619 unsigned int pos, unsigned int count,
620 void *kbuf, void __user *ubuf)
622 struct user_fpsimd_state *uregs;
623 uregs = &target->thread.fpsimd_state.user_fpsimd;
624 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0, -1);
627 static int fpr_set(struct task_struct *target, const struct user_regset *regset,
628 unsigned int pos, unsigned int count,
629 const void *kbuf, const void __user *ubuf)
631 int ret;
632 struct user_fpsimd_state newstate =
633 target->thread.fpsimd_state.user_fpsimd;
635 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newstate, 0, -1);
636 if (ret)
637 return ret;
639 target->thread.fpsimd_state.user_fpsimd = newstate;
640 fpsimd_flush_task_state(target);
641 return ret;
644 static int tls_get(struct task_struct *target, const struct user_regset *regset,
645 unsigned int pos, unsigned int count,
646 void *kbuf, void __user *ubuf)
648 unsigned long *tls = &target->thread.tp_value;
649 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, tls, 0, -1);
652 static int tls_set(struct task_struct *target, const struct user_regset *regset,
653 unsigned int pos, unsigned int count,
654 const void *kbuf, const void __user *ubuf)
656 int ret;
657 unsigned long tls = target->thread.tp_value;
659 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
660 if (ret)
661 return ret;
663 target->thread.tp_value = tls;
664 return ret;
667 static int system_call_get(struct task_struct *target,
668 const struct user_regset *regset,
669 unsigned int pos, unsigned int count,
670 void *kbuf, void __user *ubuf)
672 int syscallno = task_pt_regs(target)->syscallno;
674 return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
675 &syscallno, 0, -1);
678 static int system_call_set(struct task_struct *target,
679 const struct user_regset *regset,
680 unsigned int pos, unsigned int count,
681 const void *kbuf, const void __user *ubuf)
683 int syscallno = task_pt_regs(target)->syscallno;
684 int ret;
686 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &syscallno, 0, -1);
687 if (ret)
688 return ret;
690 task_pt_regs(target)->syscallno = syscallno;
691 return ret;
694 enum aarch64_regset {
695 REGSET_GPR,
696 REGSET_FPR,
697 REGSET_TLS,
698 #ifdef CONFIG_HAVE_HW_BREAKPOINT
699 REGSET_HW_BREAK,
700 REGSET_HW_WATCH,
701 #endif
702 REGSET_SYSTEM_CALL,
705 static const struct user_regset aarch64_regsets[] = {
706 [REGSET_GPR] = {
707 .core_note_type = NT_PRSTATUS,
708 .n = sizeof(struct user_pt_regs) / sizeof(u64),
709 .size = sizeof(u64),
710 .align = sizeof(u64),
711 .get = gpr_get,
712 .set = gpr_set
714 [REGSET_FPR] = {
715 .core_note_type = NT_PRFPREG,
716 .n = sizeof(struct user_fpsimd_state) / sizeof(u32),
718 * We pretend we have 32-bit registers because the fpsr and
719 * fpcr are 32-bits wide.
721 .size = sizeof(u32),
722 .align = sizeof(u32),
723 .get = fpr_get,
724 .set = fpr_set
726 [REGSET_TLS] = {
727 .core_note_type = NT_ARM_TLS,
728 .n = 1,
729 .size = sizeof(void *),
730 .align = sizeof(void *),
731 .get = tls_get,
732 .set = tls_set,
734 #ifdef CONFIG_HAVE_HW_BREAKPOINT
735 [REGSET_HW_BREAK] = {
736 .core_note_type = NT_ARM_HW_BREAK,
737 .n = sizeof(struct user_hwdebug_state) / sizeof(u32),
738 .size = sizeof(u32),
739 .align = sizeof(u32),
740 .get = hw_break_get,
741 .set = hw_break_set,
743 [REGSET_HW_WATCH] = {
744 .core_note_type = NT_ARM_HW_WATCH,
745 .n = sizeof(struct user_hwdebug_state) / sizeof(u32),
746 .size = sizeof(u32),
747 .align = sizeof(u32),
748 .get = hw_break_get,
749 .set = hw_break_set,
751 #endif
752 [REGSET_SYSTEM_CALL] = {
753 .core_note_type = NT_ARM_SYSTEM_CALL,
754 .n = 1,
755 .size = sizeof(int),
756 .align = sizeof(int),
757 .get = system_call_get,
758 .set = system_call_set,
762 static const struct user_regset_view user_aarch64_view = {
763 .name = "aarch64", .e_machine = EM_AARCH64,
764 .regsets = aarch64_regsets, .n = ARRAY_SIZE(aarch64_regsets)
767 #ifdef CONFIG_COMPAT
768 #include <linux/compat.h>
770 enum compat_regset {
771 REGSET_COMPAT_GPR,
772 REGSET_COMPAT_VFP,
775 static int compat_gpr_get(struct task_struct *target,
776 const struct user_regset *regset,
777 unsigned int pos, unsigned int count,
778 void *kbuf, void __user *ubuf)
780 int ret = 0;
781 unsigned int i, start, num_regs;
783 /* Calculate the number of AArch32 registers contained in count */
784 num_regs = count / regset->size;
786 /* Convert pos into an register number */
787 start = pos / regset->size;
789 if (start + num_regs > regset->n)
790 return -EIO;
792 for (i = 0; i < num_regs; ++i) {
793 unsigned int idx = start + i;
794 compat_ulong_t reg;
796 switch (idx) {
797 case 15:
798 reg = task_pt_regs(target)->pc;
799 break;
800 case 16:
801 reg = task_pt_regs(target)->pstate;
802 break;
803 case 17:
804 reg = task_pt_regs(target)->orig_x0;
805 break;
806 default:
807 reg = task_pt_regs(target)->regs[idx];
810 if (kbuf) {
811 memcpy(kbuf, &reg, sizeof(reg));
812 kbuf += sizeof(reg);
813 } else {
814 ret = copy_to_user(ubuf, &reg, sizeof(reg));
815 if (ret) {
816 ret = -EFAULT;
817 break;
820 ubuf += sizeof(reg);
824 return ret;
827 static int compat_gpr_set(struct task_struct *target,
828 const struct user_regset *regset,
829 unsigned int pos, unsigned int count,
830 const void *kbuf, const void __user *ubuf)
832 struct pt_regs newregs;
833 int ret = 0;
834 unsigned int i, start, num_regs;
836 /* Calculate the number of AArch32 registers contained in count */
837 num_regs = count / regset->size;
839 /* Convert pos into an register number */
840 start = pos / regset->size;
842 if (start + num_regs > regset->n)
843 return -EIO;
845 newregs = *task_pt_regs(target);
847 for (i = 0; i < num_regs; ++i) {
848 unsigned int idx = start + i;
849 compat_ulong_t reg;
851 if (kbuf) {
852 memcpy(&reg, kbuf, sizeof(reg));
853 kbuf += sizeof(reg);
854 } else {
855 ret = copy_from_user(&reg, ubuf, sizeof(reg));
856 if (ret) {
857 ret = -EFAULT;
858 break;
861 ubuf += sizeof(reg);
864 switch (idx) {
865 case 15:
866 newregs.pc = reg;
867 break;
868 case 16:
869 newregs.pstate = reg;
870 break;
871 case 17:
872 newregs.orig_x0 = reg;
873 break;
874 default:
875 newregs.regs[idx] = reg;
880 if (valid_user_regs(&newregs.user_regs, target))
881 *task_pt_regs(target) = newregs;
882 else
883 ret = -EINVAL;
885 return ret;
888 static int compat_vfp_get(struct task_struct *target,
889 const struct user_regset *regset,
890 unsigned int pos, unsigned int count,
891 void *kbuf, void __user *ubuf)
893 struct user_fpsimd_state *uregs;
894 compat_ulong_t fpscr;
895 int ret;
897 uregs = &target->thread.fpsimd_state.user_fpsimd;
900 * The VFP registers are packed into the fpsimd_state, so they all sit
901 * nicely together for us. We just need to create the fpscr separately.
903 ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, uregs, 0,
904 VFP_STATE_SIZE - sizeof(compat_ulong_t));
906 if (count && !ret) {
907 fpscr = (uregs->fpsr & VFP_FPSCR_STAT_MASK) |
908 (uregs->fpcr & VFP_FPSCR_CTRL_MASK);
909 ret = put_user(fpscr, (compat_ulong_t *)ubuf);
912 return ret;
915 static int compat_vfp_set(struct task_struct *target,
916 const struct user_regset *regset,
917 unsigned int pos, unsigned int count,
918 const void *kbuf, const void __user *ubuf)
920 struct user_fpsimd_state *uregs;
921 compat_ulong_t fpscr;
922 int ret;
924 if (pos + count > VFP_STATE_SIZE)
925 return -EIO;
927 uregs = &target->thread.fpsimd_state.user_fpsimd;
929 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, uregs, 0,
930 VFP_STATE_SIZE - sizeof(compat_ulong_t));
932 if (count && !ret) {
933 ret = get_user(fpscr, (compat_ulong_t *)ubuf);
934 uregs->fpsr = fpscr & VFP_FPSCR_STAT_MASK;
935 uregs->fpcr = fpscr & VFP_FPSCR_CTRL_MASK;
938 fpsimd_flush_task_state(target);
939 return ret;
942 static int compat_tls_get(struct task_struct *target,
943 const struct user_regset *regset, unsigned int pos,
944 unsigned int count, void *kbuf, void __user *ubuf)
946 compat_ulong_t tls = (compat_ulong_t)target->thread.tp_value;
947 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
950 static int compat_tls_set(struct task_struct *target,
951 const struct user_regset *regset, unsigned int pos,
952 unsigned int count, const void *kbuf,
953 const void __user *ubuf)
955 int ret;
956 compat_ulong_t tls = target->thread.tp_value;
958 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
959 if (ret)
960 return ret;
962 target->thread.tp_value = tls;
963 return ret;
966 static const struct user_regset aarch32_regsets[] = {
967 [REGSET_COMPAT_GPR] = {
968 .core_note_type = NT_PRSTATUS,
969 .n = COMPAT_ELF_NGREG,
970 .size = sizeof(compat_elf_greg_t),
971 .align = sizeof(compat_elf_greg_t),
972 .get = compat_gpr_get,
973 .set = compat_gpr_set
975 [REGSET_COMPAT_VFP] = {
976 .core_note_type = NT_ARM_VFP,
977 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t),
978 .size = sizeof(compat_ulong_t),
979 .align = sizeof(compat_ulong_t),
980 .get = compat_vfp_get,
981 .set = compat_vfp_set
985 static const struct user_regset_view user_aarch32_view = {
986 .name = "aarch32", .e_machine = EM_ARM,
987 .regsets = aarch32_regsets, .n = ARRAY_SIZE(aarch32_regsets)
990 static const struct user_regset aarch32_ptrace_regsets[] = {
991 [REGSET_GPR] = {
992 .core_note_type = NT_PRSTATUS,
993 .n = COMPAT_ELF_NGREG,
994 .size = sizeof(compat_elf_greg_t),
995 .align = sizeof(compat_elf_greg_t),
996 .get = compat_gpr_get,
997 .set = compat_gpr_set
999 [REGSET_FPR] = {
1000 .core_note_type = NT_ARM_VFP,
1001 .n = VFP_STATE_SIZE / sizeof(compat_ulong_t),
1002 .size = sizeof(compat_ulong_t),
1003 .align = sizeof(compat_ulong_t),
1004 .get = compat_vfp_get,
1005 .set = compat_vfp_set
1007 [REGSET_TLS] = {
1008 .core_note_type = NT_ARM_TLS,
1009 .n = 1,
1010 .size = sizeof(compat_ulong_t),
1011 .align = sizeof(compat_ulong_t),
1012 .get = compat_tls_get,
1013 .set = compat_tls_set,
1015 #ifdef CONFIG_HAVE_HW_BREAKPOINT
1016 [REGSET_HW_BREAK] = {
1017 .core_note_type = NT_ARM_HW_BREAK,
1018 .n = sizeof(struct user_hwdebug_state) / sizeof(u32),
1019 .size = sizeof(u32),
1020 .align = sizeof(u32),
1021 .get = hw_break_get,
1022 .set = hw_break_set,
1024 [REGSET_HW_WATCH] = {
1025 .core_note_type = NT_ARM_HW_WATCH,
1026 .n = sizeof(struct user_hwdebug_state) / sizeof(u32),
1027 .size = sizeof(u32),
1028 .align = sizeof(u32),
1029 .get = hw_break_get,
1030 .set = hw_break_set,
1032 #endif
1033 [REGSET_SYSTEM_CALL] = {
1034 .core_note_type = NT_ARM_SYSTEM_CALL,
1035 .n = 1,
1036 .size = sizeof(int),
1037 .align = sizeof(int),
1038 .get = system_call_get,
1039 .set = system_call_set,
1043 static const struct user_regset_view user_aarch32_ptrace_view = {
1044 .name = "aarch32", .e_machine = EM_ARM,
1045 .regsets = aarch32_ptrace_regsets, .n = ARRAY_SIZE(aarch32_ptrace_regsets)
1048 static int compat_ptrace_read_user(struct task_struct *tsk, compat_ulong_t off,
1049 compat_ulong_t __user *ret)
1051 compat_ulong_t tmp;
1053 if (off & 3)
1054 return -EIO;
1056 if (off == COMPAT_PT_TEXT_ADDR)
1057 tmp = tsk->mm->start_code;
1058 else if (off == COMPAT_PT_DATA_ADDR)
1059 tmp = tsk->mm->start_data;
1060 else if (off == COMPAT_PT_TEXT_END_ADDR)
1061 tmp = tsk->mm->end_code;
1062 else if (off < sizeof(compat_elf_gregset_t))
1063 return copy_regset_to_user(tsk, &user_aarch32_view,
1064 REGSET_COMPAT_GPR, off,
1065 sizeof(compat_ulong_t), ret);
1066 else if (off >= COMPAT_USER_SZ)
1067 return -EIO;
1068 else
1069 tmp = 0;
1071 return put_user(tmp, ret);
1074 static int compat_ptrace_write_user(struct task_struct *tsk, compat_ulong_t off,
1075 compat_ulong_t val)
1077 int ret;
1078 mm_segment_t old_fs = get_fs();
1080 if (off & 3 || off >= COMPAT_USER_SZ)
1081 return -EIO;
1083 if (off >= sizeof(compat_elf_gregset_t))
1084 return 0;
1086 set_fs(KERNEL_DS);
1087 ret = copy_regset_from_user(tsk, &user_aarch32_view,
1088 REGSET_COMPAT_GPR, off,
1089 sizeof(compat_ulong_t),
1090 &val);
1091 set_fs(old_fs);
1093 return ret;
1096 #ifdef CONFIG_HAVE_HW_BREAKPOINT
1099 * Convert a virtual register number into an index for a thread_info
1100 * breakpoint array. Breakpoints are identified using positive numbers
1101 * whilst watchpoints are negative. The registers are laid out as pairs
1102 * of (address, control), each pair mapping to a unique hw_breakpoint struct.
1103 * Register 0 is reserved for describing resource information.
1105 static int compat_ptrace_hbp_num_to_idx(compat_long_t num)
1107 return (abs(num) - 1) >> 1;
1110 static int compat_ptrace_hbp_get_resource_info(u32 *kdata)
1112 u8 num_brps, num_wrps, debug_arch, wp_len;
1113 u32 reg = 0;
1115 num_brps = hw_breakpoint_slots(TYPE_INST);
1116 num_wrps = hw_breakpoint_slots(TYPE_DATA);
1118 debug_arch = debug_monitors_arch();
1119 wp_len = 8;
1120 reg |= debug_arch;
1121 reg <<= 8;
1122 reg |= wp_len;
1123 reg <<= 8;
1124 reg |= num_wrps;
1125 reg <<= 8;
1126 reg |= num_brps;
1128 *kdata = reg;
1129 return 0;
1132 static int compat_ptrace_hbp_get(unsigned int note_type,
1133 struct task_struct *tsk,
1134 compat_long_t num,
1135 u32 *kdata)
1137 u64 addr = 0;
1138 u32 ctrl = 0;
1140 int err, idx = compat_ptrace_hbp_num_to_idx(num);;
1142 if (num & 1) {
1143 err = ptrace_hbp_get_addr(note_type, tsk, idx, &addr);
1144 *kdata = (u32)addr;
1145 } else {
1146 err = ptrace_hbp_get_ctrl(note_type, tsk, idx, &ctrl);
1147 *kdata = ctrl;
1150 return err;
1153 static int compat_ptrace_hbp_set(unsigned int note_type,
1154 struct task_struct *tsk,
1155 compat_long_t num,
1156 u32 *kdata)
1158 u64 addr;
1159 u32 ctrl;
1161 int err, idx = compat_ptrace_hbp_num_to_idx(num);
1163 if (num & 1) {
1164 addr = *kdata;
1165 err = ptrace_hbp_set_addr(note_type, tsk, idx, addr);
1166 } else {
1167 ctrl = *kdata;
1168 err = ptrace_hbp_set_ctrl(note_type, tsk, idx, ctrl);
1171 return err;
1174 static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num,
1175 compat_ulong_t __user *data)
1177 int ret;
1178 u32 kdata;
1179 mm_segment_t old_fs = get_fs();
1181 set_fs(KERNEL_DS);
1182 /* Watchpoint */
1183 if (num < 0) {
1184 ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata);
1185 /* Resource info */
1186 } else if (num == 0) {
1187 ret = compat_ptrace_hbp_get_resource_info(&kdata);
1188 /* Breakpoint */
1189 } else {
1190 ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata);
1192 set_fs(old_fs);
1194 if (!ret)
1195 ret = put_user(kdata, data);
1197 return ret;
1200 static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num,
1201 compat_ulong_t __user *data)
1203 int ret;
1204 u32 kdata = 0;
1205 mm_segment_t old_fs = get_fs();
1207 if (num == 0)
1208 return 0;
1210 ret = get_user(kdata, data);
1211 if (ret)
1212 return ret;
1214 set_fs(KERNEL_DS);
1215 if (num < 0)
1216 ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata);
1217 else
1218 ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata);
1219 set_fs(old_fs);
1221 return ret;
1223 #endif /* CONFIG_HAVE_HW_BREAKPOINT */
1225 long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1226 compat_ulong_t caddr, compat_ulong_t cdata)
1228 unsigned long addr = caddr;
1229 unsigned long data = cdata;
1230 void __user *datap = compat_ptr(data);
1231 int ret;
1233 switch (request) {
1234 case PTRACE_PEEKUSR:
1235 ret = compat_ptrace_read_user(child, addr, datap);
1236 break;
1238 case PTRACE_POKEUSR:
1239 ret = compat_ptrace_write_user(child, addr, data);
1240 break;
1242 case COMPAT_PTRACE_GETREGS:
1243 ret = copy_regset_to_user(child,
1244 &user_aarch32_view,
1245 REGSET_COMPAT_GPR,
1246 0, sizeof(compat_elf_gregset_t),
1247 datap);
1248 break;
1250 case COMPAT_PTRACE_SETREGS:
1251 ret = copy_regset_from_user(child,
1252 &user_aarch32_view,
1253 REGSET_COMPAT_GPR,
1254 0, sizeof(compat_elf_gregset_t),
1255 datap);
1256 break;
1258 case COMPAT_PTRACE_GET_THREAD_AREA:
1259 ret = put_user((compat_ulong_t)child->thread.tp_value,
1260 (compat_ulong_t __user *)datap);
1261 break;
1263 case COMPAT_PTRACE_SET_SYSCALL:
1264 task_pt_regs(child)->syscallno = data;
1265 ret = 0;
1266 break;
1268 case COMPAT_PTRACE_GETVFPREGS:
1269 ret = copy_regset_to_user(child,
1270 &user_aarch32_view,
1271 REGSET_COMPAT_VFP,
1272 0, VFP_STATE_SIZE,
1273 datap);
1274 break;
1276 case COMPAT_PTRACE_SETVFPREGS:
1277 ret = copy_regset_from_user(child,
1278 &user_aarch32_view,
1279 REGSET_COMPAT_VFP,
1280 0, VFP_STATE_SIZE,
1281 datap);
1282 break;
1284 #ifdef CONFIG_HAVE_HW_BREAKPOINT
1285 case COMPAT_PTRACE_GETHBPREGS:
1286 ret = compat_ptrace_gethbpregs(child, addr, datap);
1287 break;
1289 case COMPAT_PTRACE_SETHBPREGS:
1290 ret = compat_ptrace_sethbpregs(child, addr, datap);
1291 break;
1292 #endif
1294 default:
1295 ret = compat_ptrace_request(child, request, addr,
1296 data);
1297 break;
1300 return ret;
1302 #endif /* CONFIG_COMPAT */
1304 const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1306 #ifdef CONFIG_COMPAT
1308 * Core dumping of 32-bit tasks or compat ptrace requests must use the
1309 * user_aarch32_view compatible with arm32. Native ptrace requests on
1310 * 32-bit children use an extended user_aarch32_ptrace_view to allow
1311 * access to the TLS register.
1313 if (is_compat_task())
1314 return &user_aarch32_view;
1315 else if (is_compat_thread(task_thread_info(task)))
1316 return &user_aarch32_ptrace_view;
1317 #endif
1318 return &user_aarch64_view;
1321 long arch_ptrace(struct task_struct *child, long request,
1322 unsigned long addr, unsigned long data)
1324 return ptrace_request(child, request, addr, data);
1327 enum ptrace_syscall_dir {
1328 PTRACE_SYSCALL_ENTER = 0,
1329 PTRACE_SYSCALL_EXIT,
1332 static void tracehook_report_syscall(struct pt_regs *regs,
1333 enum ptrace_syscall_dir dir)
1335 int regno;
1336 unsigned long saved_reg;
1339 * A scratch register (ip(r12) on AArch32, x7 on AArch64) is
1340 * used to denote syscall entry/exit:
1342 regno = (is_compat_task() ? 12 : 7);
1343 saved_reg = regs->regs[regno];
1344 regs->regs[regno] = dir;
1346 if (dir == PTRACE_SYSCALL_EXIT)
1347 tracehook_report_syscall_exit(regs, 0);
1348 else if (tracehook_report_syscall_entry(regs))
1349 regs->syscallno = ~0UL;
1351 regs->regs[regno] = saved_reg;
1354 asmlinkage int syscall_trace_enter(struct pt_regs *regs)
1356 if (test_thread_flag(TIF_SYSCALL_TRACE))
1357 tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
1359 /* Do the secure computing after ptrace; failures should be fast. */
1360 if (secure_computing(NULL) == -1)
1361 return -1;
1363 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
1364 trace_sys_enter(regs, regs->syscallno);
1366 audit_syscall_entry(regs->syscallno, regs->orig_x0, regs->regs[1],
1367 regs->regs[2], regs->regs[3]);
1369 return regs->syscallno;
1372 asmlinkage void syscall_trace_exit(struct pt_regs *regs)
1374 audit_syscall_exit(regs);
1376 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
1377 trace_sys_exit(regs, regs_return_value(regs));
1379 if (test_thread_flag(TIF_SYSCALL_TRACE))
1380 tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT);
1384 * Bits which are always architecturally RES0 per ARM DDI 0487A.h
1385 * Userspace cannot use these until they have an architectural meaning.
1386 * We also reserve IL for the kernel; SS is handled dynamically.
1388 #define SPSR_EL1_AARCH64_RES0_BITS \
1389 (GENMASK_ULL(63,32) | GENMASK_ULL(27, 22) | GENMASK_ULL(20, 10) | \
1390 GENMASK_ULL(5, 5))
1391 #define SPSR_EL1_AARCH32_RES0_BITS \
1392 (GENMASK_ULL(63,32) | GENMASK_ULL(24, 22) | GENMASK_ULL(20,20))
1394 static int valid_compat_regs(struct user_pt_regs *regs)
1396 regs->pstate &= ~SPSR_EL1_AARCH32_RES0_BITS;
1398 if (!system_supports_mixed_endian_el0()) {
1399 if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN))
1400 regs->pstate |= COMPAT_PSR_E_BIT;
1401 else
1402 regs->pstate &= ~COMPAT_PSR_E_BIT;
1405 if (user_mode(regs) && (regs->pstate & PSR_MODE32_BIT) &&
1406 (regs->pstate & COMPAT_PSR_A_BIT) == 0 &&
1407 (regs->pstate & COMPAT_PSR_I_BIT) == 0 &&
1408 (regs->pstate & COMPAT_PSR_F_BIT) == 0) {
1409 return 1;
1413 * Force PSR to a valid 32-bit EL0t, preserving the same bits as
1414 * arch/arm.
1416 regs->pstate &= COMPAT_PSR_N_BIT | COMPAT_PSR_Z_BIT |
1417 COMPAT_PSR_C_BIT | COMPAT_PSR_V_BIT |
1418 COMPAT_PSR_Q_BIT | COMPAT_PSR_IT_MASK |
1419 COMPAT_PSR_GE_MASK | COMPAT_PSR_E_BIT |
1420 COMPAT_PSR_T_BIT;
1421 regs->pstate |= PSR_MODE32_BIT;
1423 return 0;
1426 static int valid_native_regs(struct user_pt_regs *regs)
1428 regs->pstate &= ~SPSR_EL1_AARCH64_RES0_BITS;
1430 if (user_mode(regs) && !(regs->pstate & PSR_MODE32_BIT) &&
1431 (regs->pstate & PSR_D_BIT) == 0 &&
1432 (regs->pstate & PSR_A_BIT) == 0 &&
1433 (regs->pstate & PSR_I_BIT) == 0 &&
1434 (regs->pstate & PSR_F_BIT) == 0) {
1435 return 1;
1438 /* Force PSR to a valid 64-bit EL0t */
1439 regs->pstate &= PSR_N_BIT | PSR_Z_BIT | PSR_C_BIT | PSR_V_BIT;
1441 return 0;
1445 * Are the current registers suitable for user mode? (used to maintain
1446 * security in signal handlers)
1448 int valid_user_regs(struct user_pt_regs *regs, struct task_struct *task)
1450 if (!test_tsk_thread_flag(task, TIF_SINGLESTEP))
1451 regs->pstate &= ~DBG_SPSR_SS;
1453 if (is_compat_thread(task_thread_info(task)))
1454 return valid_compat_regs(regs);
1455 else
1456 return valid_native_regs(regs);