1
2
3
4
5
6
7
8
9#include <linux/kernel.h>
10#include <linux/sched/signal.h>
11#include <linux/sched/task_stack.h>
12#include <linux/mm.h>
13#include <linux/elf.h>
14#include <linux/smp.h>
15#include <linux/ptrace.h>
16#include <linux/user.h>
17#include <linux/security.h>
18#include <linux/init.h>
19#include <linux/signal.h>
20#include <linux/uaccess.h>
21#include <linux/perf_event.h>
22#include <linux/hw_breakpoint.h>
23#include <linux/regset.h>
24#include <linux/audit.h>
25#include <linux/tracehook.h>
26#include <linux/unistd.h>
27
28#include <asm/syscall.h>
29#include <asm/traps.h>
30
31#define CREATE_TRACE_POINTS
32#include <trace/events/syscalls.h>
33
34#define REG_PC 15
35#define REG_PSR 16
36
37
38
39
40
41#if 0
42
43
44
45#define BREAKINST_ARM 0xef9f0001
46#define BREAKINST_THUMB 0xdf00
47#else
48
49
50
51
52
53
54
55
56#define BREAKINST_ARM 0xe7f001f0
57#define BREAKINST_THUMB 0xde01
58#endif
59
60struct pt_regs_offset {
61 const char *name;
62 int offset;
63};
64
65#define REG_OFFSET_NAME(r) \
66 {.name = #r, .offset = offsetof(struct pt_regs, ARM_##r)}
67#define REG_OFFSET_END {.name = NULL, .offset = 0}
68
69static const struct pt_regs_offset regoffset_table[] = {
70 REG_OFFSET_NAME(r0),
71 REG_OFFSET_NAME(r1),
72 REG_OFFSET_NAME(r2),
73 REG_OFFSET_NAME(r3),
74 REG_OFFSET_NAME(r4),
75 REG_OFFSET_NAME(r5),
76 REG_OFFSET_NAME(r6),
77 REG_OFFSET_NAME(r7),
78 REG_OFFSET_NAME(r8),
79 REG_OFFSET_NAME(r9),
80 REG_OFFSET_NAME(r10),
81 REG_OFFSET_NAME(fp),
82 REG_OFFSET_NAME(ip),
83 REG_OFFSET_NAME(sp),
84 REG_OFFSET_NAME(lr),
85 REG_OFFSET_NAME(pc),
86 REG_OFFSET_NAME(cpsr),
87 REG_OFFSET_NAME(ORIG_r0),
88 REG_OFFSET_END,
89};
90
91
92
93
94
95
96
97
98int regs_query_register_offset(const char *name)
99{
100 const struct pt_regs_offset *roff;
101 for (roff = regoffset_table; roff->name != NULL; roff++)
102 if (!strcmp(roff->name, name))
103 return roff->offset;
104 return -EINVAL;
105}
106
107
108
109
110
111
112
113
114const char *regs_query_register_name(unsigned int offset)
115{
116 const struct pt_regs_offset *roff;
117 for (roff = regoffset_table; roff->name != NULL; roff++)
118 if (roff->offset == offset)
119 return roff->name;
120 return NULL;
121}
122
123
124
125
126
127
128
129
130
131bool regs_within_kernel_stack(struct pt_regs *regs, unsigned long addr)
132{
133 return ((addr & ~(THREAD_SIZE - 1)) ==
134 (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1)));
135}
136
137
138
139
140
141
142
143
144
145
146unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, unsigned int n)
147{
148 unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs);
149 addr += n;
150 if (regs_within_kernel_stack(regs, (unsigned long)addr))
151 return *addr;
152 else
153 return 0;
154}
155
156
157
158
159
160
161
162static inline long get_user_reg(struct task_struct *task, int offset)
163{
164 return task_pt_regs(task)->uregs[offset];
165}
166
167
168
169
170
171
172
173static inline int
174put_user_reg(struct task_struct *task, int offset, long data)
175{
176 struct pt_regs newregs, *regs = task_pt_regs(task);
177 int ret = -EINVAL;
178
179 newregs = *regs;
180 newregs.uregs[offset] = data;
181
182 if (valid_user_regs(&newregs)) {
183 regs->uregs[offset] = data;
184 ret = 0;
185 }
186
187 return ret;
188}
189
190
191
192
193void ptrace_disable(struct task_struct *child)
194{
195
196}
197
198
199
200
201void ptrace_break(struct pt_regs *regs)
202{
203 force_sig_fault(SIGTRAP, TRAP_BRKPT,
204 (void __user *)instruction_pointer(regs));
205}
206
207static int break_trap(struct pt_regs *regs, unsigned int instr)
208{
209 ptrace_break(regs);
210 return 0;
211}
212
213static struct undef_hook arm_break_hook = {
214 .instr_mask = 0x0fffffff,
215 .instr_val = 0x07f001f0,
216 .cpsr_mask = PSR_T_BIT,
217 .cpsr_val = 0,
218 .fn = break_trap,
219};
220
221static struct undef_hook thumb_break_hook = {
222 .instr_mask = 0xffffffff,
223 .instr_val = 0x0000de01,
224 .cpsr_mask = PSR_T_BIT,
225 .cpsr_val = PSR_T_BIT,
226 .fn = break_trap,
227};
228
229static struct undef_hook thumb2_break_hook = {
230 .instr_mask = 0xffffffff,
231 .instr_val = 0xf7f0a000,
232 .cpsr_mask = PSR_T_BIT,
233 .cpsr_val = PSR_T_BIT,
234 .fn = break_trap,
235};
236
237static int __init ptrace_break_init(void)
238{
239 register_undef_hook(&arm_break_hook);
240 register_undef_hook(&thumb_break_hook);
241 register_undef_hook(&thumb2_break_hook);
242 return 0;
243}
244
245core_initcall(ptrace_break_init);
246
247
248
249
250
251static int ptrace_read_user(struct task_struct *tsk, unsigned long off,
252 unsigned long __user *ret)
253{
254 unsigned long tmp;
255
256 if (off & 3)
257 return -EIO;
258
259 tmp = 0;
260 if (off == PT_TEXT_ADDR)
261 tmp = tsk->mm->start_code;
262 else if (off == PT_DATA_ADDR)
263 tmp = tsk->mm->start_data;
264 else if (off == PT_TEXT_END_ADDR)
265 tmp = tsk->mm->end_code;
266 else if (off < sizeof(struct pt_regs))
267 tmp = get_user_reg(tsk, off >> 2);
268 else if (off >= sizeof(struct user))
269 return -EIO;
270
271 return put_user(tmp, ret);
272}
273
274
275
276
277
278static int ptrace_write_user(struct task_struct *tsk, unsigned long off,
279 unsigned long val)
280{
281 if (off & 3 || off >= sizeof(struct user))
282 return -EIO;
283
284 if (off >= sizeof(struct pt_regs))
285 return 0;
286
287 return put_user_reg(tsk, off >> 2, val);
288}
289
290#ifdef CONFIG_IWMMXT
291
292
293
294
295static int ptrace_getwmmxregs(struct task_struct *tsk, void __user *ufp)
296{
297 struct thread_info *thread = task_thread_info(tsk);
298
299 if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
300 return -ENODATA;
301 iwmmxt_task_disable(thread);
302 return copy_to_user(ufp, &thread->fpstate.iwmmxt, IWMMXT_SIZE)
303 ? -EFAULT : 0;
304}
305
306
307
308
309static int ptrace_setwmmxregs(struct task_struct *tsk, void __user *ufp)
310{
311 struct thread_info *thread = task_thread_info(tsk);
312
313 if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
314 return -EACCES;
315 iwmmxt_task_release(thread);
316 return copy_from_user(&thread->fpstate.iwmmxt, ufp, IWMMXT_SIZE)
317 ? -EFAULT : 0;
318}
319
320#endif
321
322#ifdef CONFIG_HAVE_HW_BREAKPOINT
323
324
325
326
327
328
329
330static int ptrace_hbp_num_to_idx(long num)
331{
332 if (num < 0)
333 num = (ARM_MAX_BRP << 1) - num;
334 return (num - 1) >> 1;
335}
336
337
338
339
340
341static long ptrace_hbp_idx_to_num(int idx)
342{
343 long mid = ARM_MAX_BRP << 1;
344 long num = (idx << 1) + 1;
345 return num > mid ? mid - num : num;
346}
347
348
349
350
351static void ptrace_hbptriggered(struct perf_event *bp,
352 struct perf_sample_data *data,
353 struct pt_regs *regs)
354{
355 struct arch_hw_breakpoint *bkpt = counter_arch_bp(bp);
356 long num;
357 int i;
358
359 for (i = 0; i < ARM_MAX_HBP_SLOTS; ++i)
360 if (current->thread.debug.hbp[i] == bp)
361 break;
362
363 num = (i == ARM_MAX_HBP_SLOTS) ? 0 : ptrace_hbp_idx_to_num(i);
364
365 force_sig_ptrace_errno_trap((int)num, (void __user *)(bkpt->trigger));
366}
367
368
369
370
371
372
373void clear_ptrace_hw_breakpoint(struct task_struct *tsk)
374{
375 memset(tsk->thread.debug.hbp, 0, sizeof(tsk->thread.debug.hbp));
376}
377
378
379
380
381
382void flush_ptrace_hw_breakpoint(struct task_struct *tsk)
383{
384 int i;
385 struct thread_struct *t = &tsk->thread;
386
387 for (i = 0; i < ARM_MAX_HBP_SLOTS; i++) {
388 if (t->debug.hbp[i]) {
389 unregister_hw_breakpoint(t->debug.hbp[i]);
390 t->debug.hbp[i] = NULL;
391 }
392 }
393}
394
395static u32 ptrace_get_hbp_resource_info(void)
396{
397 u8 num_brps, num_wrps, debug_arch, wp_len;
398 u32 reg = 0;
399
400 num_brps = hw_breakpoint_slots(TYPE_INST);
401 num_wrps = hw_breakpoint_slots(TYPE_DATA);
402 debug_arch = arch_get_debug_arch();
403 wp_len = arch_get_max_wp_len();
404
405 reg |= debug_arch;
406 reg <<= 8;
407 reg |= wp_len;
408 reg <<= 8;
409 reg |= num_wrps;
410 reg <<= 8;
411 reg |= num_brps;
412
413 return reg;
414}
415
416static struct perf_event *ptrace_hbp_create(struct task_struct *tsk, int type)
417{
418 struct perf_event_attr attr;
419
420 ptrace_breakpoint_init(&attr);
421
422
423 attr.bp_addr = 0;
424 attr.bp_len = HW_BREAKPOINT_LEN_4;
425 attr.bp_type = type;
426 attr.disabled = 1;
427
428 return register_user_hw_breakpoint(&attr, ptrace_hbptriggered, NULL,
429 tsk);
430}
431
432static int ptrace_gethbpregs(struct task_struct *tsk, long num,
433 unsigned long __user *data)
434{
435 u32 reg;
436 int idx, ret = 0;
437 struct perf_event *bp;
438 struct arch_hw_breakpoint_ctrl arch_ctrl;
439
440 if (num == 0) {
441 reg = ptrace_get_hbp_resource_info();
442 } else {
443 idx = ptrace_hbp_num_to_idx(num);
444 if (idx < 0 || idx >= ARM_MAX_HBP_SLOTS) {
445 ret = -EINVAL;
446 goto out;
447 }
448
449 bp = tsk->thread.debug.hbp[idx];
450 if (!bp) {
451 reg = 0;
452 goto put;
453 }
454
455 arch_ctrl = counter_arch_bp(bp)->ctrl;
456
457
458
459
460
461 while (!(arch_ctrl.len & 0x1))
462 arch_ctrl.len >>= 1;
463
464 if (num & 0x1)
465 reg = bp->attr.bp_addr;
466 else
467 reg = encode_ctrl_reg(arch_ctrl);
468 }
469
470put:
471 if (put_user(reg, data))
472 ret = -EFAULT;
473
474out:
475 return ret;
476}
477
478static int ptrace_sethbpregs(struct task_struct *tsk, long num,
479 unsigned long __user *data)
480{
481 int idx, gen_len, gen_type, implied_type, ret = 0;
482 u32 user_val;
483 struct perf_event *bp;
484 struct arch_hw_breakpoint_ctrl ctrl;
485 struct perf_event_attr attr;
486
487 if (num == 0)
488 goto out;
489 else if (num < 0)
490 implied_type = HW_BREAKPOINT_RW;
491 else
492 implied_type = HW_BREAKPOINT_X;
493
494 idx = ptrace_hbp_num_to_idx(num);
495 if (idx < 0 || idx >= ARM_MAX_HBP_SLOTS) {
496 ret = -EINVAL;
497 goto out;
498 }
499
500 if (get_user(user_val, data)) {
501 ret = -EFAULT;
502 goto out;
503 }
504
505 bp = tsk->thread.debug.hbp[idx];
506 if (!bp) {
507 bp = ptrace_hbp_create(tsk, implied_type);
508 if (IS_ERR(bp)) {
509 ret = PTR_ERR(bp);
510 goto out;
511 }
512 tsk->thread.debug.hbp[idx] = bp;
513 }
514
515 attr = bp->attr;
516
517 if (num & 0x1) {
518
519 attr.bp_addr = user_val;
520 } else {
521
522 decode_ctrl_reg(user_val, &ctrl);
523 ret = arch_bp_generic_fields(ctrl, &gen_len, &gen_type);
524 if (ret)
525 goto out;
526
527 if ((gen_type & implied_type) != gen_type) {
528 ret = -EINVAL;
529 goto out;
530 }
531
532 attr.bp_len = gen_len;
533 attr.bp_type = gen_type;
534 attr.disabled = !ctrl.enabled;
535 }
536
537 ret = modify_user_hw_breakpoint(bp, &attr);
538out:
539 return ret;
540}
541#endif
542
543
544
545static int gpr_get(struct task_struct *target,
546 const struct user_regset *regset,
547 struct membuf to)
548{
549 return membuf_write(&to, task_pt_regs(target), sizeof(struct pt_regs));
550}
551
552static int gpr_set(struct task_struct *target,
553 const struct user_regset *regset,
554 unsigned int pos, unsigned int count,
555 const void *kbuf, const void __user *ubuf)
556{
557 int ret;
558 struct pt_regs newregs = *task_pt_regs(target);
559
560 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
561 &newregs,
562 0, sizeof(newregs));
563 if (ret)
564 return ret;
565
566 if (!valid_user_regs(&newregs))
567 return -EINVAL;
568
569 *task_pt_regs(target) = newregs;
570 return 0;
571}
572
573static int fpa_get(struct task_struct *target,
574 const struct user_regset *regset,
575 struct membuf to)
576{
577 return membuf_write(&to, &task_thread_info(target)->fpstate,
578 sizeof(struct user_fp));
579}
580
581static int fpa_set(struct task_struct *target,
582 const struct user_regset *regset,
583 unsigned int pos, unsigned int count,
584 const void *kbuf, const void __user *ubuf)
585{
586 struct thread_info *thread = task_thread_info(target);
587
588 thread->used_cp[1] = thread->used_cp[2] = 1;
589
590 return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
591 &thread->fpstate,
592 0, sizeof(struct user_fp));
593}
594
595#ifdef CONFIG_VFP
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614static int vfp_get(struct task_struct *target,
615 const struct user_regset *regset,
616 struct membuf to)
617{
618 struct thread_info *thread = task_thread_info(target);
619 struct vfp_hard_struct const *vfp = &thread->vfpstate.hard;
620 const size_t user_fpscr_offset = offsetof(struct user_vfp, fpscr);
621
622 vfp_sync_hwstate(thread);
623
624 membuf_write(&to, vfp->fpregs, sizeof(vfp->fpregs));
625 membuf_zero(&to, user_fpscr_offset - sizeof(vfp->fpregs));
626 return membuf_store(&to, vfp->fpscr);
627}
628
629
630
631
632
633
634static int vfp_set(struct task_struct *target,
635 const struct user_regset *regset,
636 unsigned int pos, unsigned int count,
637 const void *kbuf, const void __user *ubuf)
638{
639 int ret;
640 struct thread_info *thread = task_thread_info(target);
641 struct vfp_hard_struct new_vfp;
642 const size_t user_fpregs_offset = offsetof(struct user_vfp, fpregs);
643 const size_t user_fpscr_offset = offsetof(struct user_vfp, fpscr);
644
645 vfp_sync_hwstate(thread);
646 new_vfp = thread->vfpstate.hard;
647
648 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
649 &new_vfp.fpregs,
650 user_fpregs_offset,
651 user_fpregs_offset + sizeof(new_vfp.fpregs));
652 if (ret)
653 return ret;
654
655 ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
656 user_fpregs_offset + sizeof(new_vfp.fpregs),
657 user_fpscr_offset);
658 if (ret)
659 return ret;
660
661 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
662 &new_vfp.fpscr,
663 user_fpscr_offset,
664 user_fpscr_offset + sizeof(new_vfp.fpscr));
665 if (ret)
666 return ret;
667
668 thread->vfpstate.hard = new_vfp;
669 vfp_flush_hwstate(thread);
670
671 return 0;
672}
673#endif
674
675enum arm_regset {
676 REGSET_GPR,
677 REGSET_FPR,
678#ifdef CONFIG_VFP
679 REGSET_VFP,
680#endif
681};
682
683static const struct user_regset arm_regsets[] = {
684 [REGSET_GPR] = {
685 .core_note_type = NT_PRSTATUS,
686 .n = ELF_NGREG,
687 .size = sizeof(u32),
688 .align = sizeof(u32),
689 .regset_get = gpr_get,
690 .set = gpr_set
691 },
692 [REGSET_FPR] = {
693
694
695
696
697 .core_note_type = NT_PRFPREG,
698 .n = sizeof(struct user_fp) / sizeof(u32),
699 .size = sizeof(u32),
700 .align = sizeof(u32),
701 .regset_get = fpa_get,
702 .set = fpa_set
703 },
704#ifdef CONFIG_VFP
705 [REGSET_VFP] = {
706
707
708
709
710 .core_note_type = NT_ARM_VFP,
711 .n = ARM_VFPREGS_SIZE / sizeof(u32),
712 .size = sizeof(u32),
713 .align = sizeof(u32),
714 .regset_get = vfp_get,
715 .set = vfp_set
716 },
717#endif
718};
719
720static const struct user_regset_view user_arm_view = {
721 .name = "arm", .e_machine = ELF_ARCH, .ei_osabi = ELF_OSABI,
722 .regsets = arm_regsets, .n = ARRAY_SIZE(arm_regsets)
723};
724
725const struct user_regset_view *task_user_regset_view(struct task_struct *task)
726{
727 return &user_arm_view;
728}
729
730long arch_ptrace(struct task_struct *child, long request,
731 unsigned long addr, unsigned long data)
732{
733 int ret;
734 unsigned long __user *datap = (unsigned long __user *) data;
735
736 switch (request) {
737 case PTRACE_PEEKUSR:
738 ret = ptrace_read_user(child, addr, datap);
739 break;
740
741 case PTRACE_POKEUSR:
742 ret = ptrace_write_user(child, addr, data);
743 break;
744
745 case PTRACE_GETREGS:
746 ret = copy_regset_to_user(child,
747 &user_arm_view, REGSET_GPR,
748 0, sizeof(struct pt_regs),
749 datap);
750 break;
751
752 case PTRACE_SETREGS:
753 ret = copy_regset_from_user(child,
754 &user_arm_view, REGSET_GPR,
755 0, sizeof(struct pt_regs),
756 datap);
757 break;
758
759 case PTRACE_GETFPREGS:
760 ret = copy_regset_to_user(child,
761 &user_arm_view, REGSET_FPR,
762 0, sizeof(union fp_state),
763 datap);
764 break;
765
766 case PTRACE_SETFPREGS:
767 ret = copy_regset_from_user(child,
768 &user_arm_view, REGSET_FPR,
769 0, sizeof(union fp_state),
770 datap);
771 break;
772
773#ifdef CONFIG_IWMMXT
774 case PTRACE_GETWMMXREGS:
775 ret = ptrace_getwmmxregs(child, datap);
776 break;
777
778 case PTRACE_SETWMMXREGS:
779 ret = ptrace_setwmmxregs(child, datap);
780 break;
781#endif
782
783 case PTRACE_GET_THREAD_AREA:
784 ret = put_user(task_thread_info(child)->tp_value[0],
785 datap);
786 break;
787
788 case PTRACE_SET_SYSCALL:
789 task_thread_info(child)->abi_syscall = data &
790 __NR_SYSCALL_MASK;
791 ret = 0;
792 break;
793
794#ifdef CONFIG_VFP
795 case PTRACE_GETVFPREGS:
796 ret = copy_regset_to_user(child,
797 &user_arm_view, REGSET_VFP,
798 0, ARM_VFPREGS_SIZE,
799 datap);
800 break;
801
802 case PTRACE_SETVFPREGS:
803 ret = copy_regset_from_user(child,
804 &user_arm_view, REGSET_VFP,
805 0, ARM_VFPREGS_SIZE,
806 datap);
807 break;
808#endif
809
810#ifdef CONFIG_HAVE_HW_BREAKPOINT
811 case PTRACE_GETHBPREGS:
812 ret = ptrace_gethbpregs(child, addr,
813 (unsigned long __user *)data);
814 break;
815 case PTRACE_SETHBPREGS:
816 ret = ptrace_sethbpregs(child, addr,
817 (unsigned long __user *)data);
818 break;
819#endif
820
821 default:
822 ret = ptrace_request(child, request, addr, data);
823 break;
824 }
825
826 return ret;
827}
828
829enum ptrace_syscall_dir {
830 PTRACE_SYSCALL_ENTER = 0,
831 PTRACE_SYSCALL_EXIT,
832};
833
834static void tracehook_report_syscall(struct pt_regs *regs,
835 enum ptrace_syscall_dir dir)
836{
837 unsigned long ip;
838
839
840
841
842
843 ip = regs->ARM_ip;
844 regs->ARM_ip = dir;
845
846 if (dir == PTRACE_SYSCALL_EXIT)
847 tracehook_report_syscall_exit(regs, 0);
848 else if (tracehook_report_syscall_entry(regs))
849 current_thread_info()->abi_syscall = -1;
850
851 regs->ARM_ip = ip;
852}
853
854asmlinkage int syscall_trace_enter(struct pt_regs *regs)
855{
856 int scno;
857
858 if (test_thread_flag(TIF_SYSCALL_TRACE))
859 tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER);
860
861
862#ifdef CONFIG_HAVE_ARCH_SECCOMP_FILTER
863 if (secure_computing() == -1)
864 return -1;
865#else
866
867 secure_computing_strict(syscall_get_nr(current, regs));
868#endif
869
870
871 scno = syscall_get_nr(current, regs);
872
873 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
874 trace_sys_enter(regs, scno);
875
876 audit_syscall_entry(scno, regs->ARM_r0, regs->ARM_r1, regs->ARM_r2,
877 regs->ARM_r3);
878
879 return scno;
880}
881
882asmlinkage void syscall_trace_exit(struct pt_regs *regs)
883{
884
885
886
887
888 audit_syscall_exit(regs);
889
890
891
892
893
894
895
896 if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
897 trace_sys_exit(regs, regs_return_value(regs));
898
899 if (test_thread_flag(TIF_SYSCALL_TRACE))
900 tracehook_report_syscall(regs, PTRACE_SYSCALL_EXIT);
901}
902