1 | // SPDX-License-Identifier: GPL-2.0 |
2 | |
3 | #include <linux/compiler.h> |
4 | #include <linux/context_tracking.h> |
5 | #include <linux/errno.h> |
6 | #include <linux/nospec.h> |
7 | #include <linux/ptrace.h> |
8 | #include <linux/randomize_kstack.h> |
9 | #include <linux/syscalls.h> |
10 | |
11 | #include <asm/debug-monitors.h> |
12 | #include <asm/exception.h> |
13 | #include <asm/fpsimd.h> |
14 | #include <asm/syscall.h> |
15 | #include <asm/thread_info.h> |
16 | #include <asm/unistd.h> |
17 | |
18 | long compat_arm_syscall(struct pt_regs *regs, int scno); |
19 | long sys_ni_syscall(void); |
20 | |
21 | static long do_ni_syscall(struct pt_regs *regs, int scno) |
22 | { |
23 | if (is_compat_task()) { |
24 | long ret = compat_arm_syscall(regs, scno); |
25 | if (ret != -ENOSYS) |
26 | return ret; |
27 | } |
28 | |
29 | return sys_ni_syscall(); |
30 | } |
31 | |
32 | static long __invoke_syscall(struct pt_regs *regs, syscall_fn_t syscall_fn) |
33 | { |
34 | return syscall_fn(regs); |
35 | } |
36 | |
37 | static void invoke_syscall(struct pt_regs *regs, unsigned int scno, |
38 | unsigned int sc_nr, |
39 | const syscall_fn_t syscall_table[]) |
40 | { |
41 | long ret; |
42 | |
43 | add_random_kstack_offset(); |
44 | |
45 | if (scno < sc_nr) { |
46 | syscall_fn_t syscall_fn; |
47 | syscall_fn = syscall_table[array_index_nospec(scno, sc_nr)]; |
48 | ret = __invoke_syscall(regs, syscall_fn: syscall_fn); |
49 | } else { |
50 | ret = do_ni_syscall(regs, scno); |
51 | } |
52 | |
53 | syscall_set_return_value(current, regs, error: 0, val: ret); |
54 | |
55 | /* |
56 | * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), |
57 | * but not enough for arm64 stack utilization comfort. To keep |
58 | * reasonable stack head room, reduce the maximum offset to 9 bits. |
59 | * |
60 | * The actual entropy will be further reduced by the compiler when |
61 | * applying stack alignment constraints: the AAPCS mandates a |
62 | * 16-byte (i.e. 4-bit) aligned SP at function boundaries. |
63 | * |
64 | * The resulting 5 bits of entropy is seen in SP[8:4]. |
65 | */ |
66 | choose_random_kstack_offset(get_random_u16() & 0x1FF); |
67 | } |
68 | |
69 | static inline bool has_syscall_work(unsigned long flags) |
70 | { |
71 | return unlikely(flags & _TIF_SYSCALL_WORK); |
72 | } |
73 | |
74 | static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr, |
75 | const syscall_fn_t syscall_table[]) |
76 | { |
77 | unsigned long flags = read_thread_flags(); |
78 | |
79 | regs->orig_x0 = regs->regs[0]; |
80 | regs->syscallno = scno; |
81 | |
82 | /* |
83 | * BTI note: |
84 | * The architecture does not guarantee that SPSR.BTYPE is zero |
85 | * on taking an SVC, so we could return to userspace with a |
86 | * non-zero BTYPE after the syscall. |
87 | * |
88 | * This shouldn't matter except when userspace is explicitly |
89 | * doing something stupid, such as setting PROT_BTI on a page |
90 | * that lacks conforming BTI/PACIxSP instructions, falling |
91 | * through from one executable page to another with differing |
92 | * PROT_BTI, or messing with BTYPE via ptrace: in such cases, |
93 | * userspace should not be surprised if a SIGILL occurs on |
94 | * syscall return. |
95 | * |
96 | * So, don't touch regs->pstate & PSR_BTYPE_MASK here. |
97 | * (Similarly for HVC and SMC elsewhere.) |
98 | */ |
99 | |
100 | if (flags & _TIF_MTE_ASYNC_FAULT) { |
101 | /* |
102 | * Process the asynchronous tag check fault before the actual |
103 | * syscall. do_notify_resume() will send a signal to userspace |
104 | * before the syscall is restarted. |
105 | */ |
106 | syscall_set_return_value(current, regs, error: -ERESTARTNOINTR, val: 0); |
107 | return; |
108 | } |
109 | |
110 | if (has_syscall_work(flags)) { |
111 | /* |
112 | * The de-facto standard way to skip a system call using ptrace |
113 | * is to set the system call to -1 (NO_SYSCALL) and set x0 to a |
114 | * suitable error code for consumption by userspace. However, |
115 | * this cannot be distinguished from a user-issued syscall(-1) |
116 | * and so we must set x0 to -ENOSYS here in case the tracer doesn't |
117 | * issue the skip and we fall into trace_exit with x0 preserved. |
118 | * |
119 | * This is slightly odd because it also means that if a tracer |
120 | * sets the system call number to -1 but does not initialise x0, |
121 | * then x0 will be preserved for all system calls apart from a |
122 | * user-issued syscall(-1). However, requesting a skip and not |
123 | * setting the return value is unlikely to do anything sensible |
124 | * anyway. |
125 | */ |
126 | if (scno == NO_SYSCALL) |
127 | syscall_set_return_value(current, regs, error: -ENOSYS, val: 0); |
128 | scno = syscall_trace_enter(regs); |
129 | if (scno == NO_SYSCALL) |
130 | goto trace_exit; |
131 | } |
132 | |
133 | invoke_syscall(regs, scno, sc_nr, syscall_table); |
134 | |
135 | /* |
136 | * The tracing status may have changed under our feet, so we have to |
137 | * check again. However, if we were tracing entry, then we always trace |
138 | * exit regardless, as the old entry assembly did. |
139 | */ |
140 | if (!has_syscall_work(flags) && !IS_ENABLED(CONFIG_DEBUG_RSEQ)) { |
141 | flags = read_thread_flags(); |
142 | if (!has_syscall_work(flags) && !(flags & _TIF_SINGLESTEP)) |
143 | return; |
144 | } |
145 | |
146 | trace_exit: |
147 | syscall_trace_exit(regs); |
148 | } |
149 | |
150 | void do_el0_svc(struct pt_regs *regs) |
151 | { |
152 | el0_svc_common(regs, scno: regs->regs[8], __NR_syscalls, syscall_table: sys_call_table); |
153 | } |
154 | |
155 | #ifdef CONFIG_COMPAT |
156 | void do_el0_svc_compat(struct pt_regs *regs) |
157 | { |
158 | el0_svc_common(regs, scno: regs->regs[7], sc_nr: __NR_compat_syscalls, |
159 | syscall_table: compat_sys_call_table); |
160 | } |
161 | #endif |
162 | |