arch/arm/include/asm/uaccess.h

   1 /*
   2  *  arch/arm/include/asm/uaccess.h
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8 #ifndef _ASMARM_UACCESS_H
   9 #define _ASMARM_UACCESS_H
  10
  11 /*
  12  * User space memory access functions
  13  */
  14 #include <linux/string.h>
  15 #include <linux/thread_info.h>
  16 #include <asm/errno.h>
  17 #include <asm/memory.h>
  18 #include <asm/domain.h>
  19 #include <asm/unified.h>
  20 #include <asm/compiler.h>
  21
  22 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
  23 #include <asm-generic/uaccess-unaligned.h>
  24 #else
  25 #define __get_user_unaligned __get_user
  26 #define __put_user_unaligned __put_user
  27 #endif
  28
  29 #define VERIFY_READ 0
  30 #define VERIFY_WRITE 1
  31
  32 /*
  33  * The exception table consists of pairs of addresses: the first is the
  34  * address of an instruction that is allowed to fault, and the second is
  35  * the address at which the program should continue.  No registers are
  36  * modified, so it is entirely up to the continuation code to figure out
  37  * what to do.
  38  *
  39  * All the routines below use bits of fixup code that are out of line
  40  * with the main instruction path.  This means when everything is well,
  41  * we don't even have to jump over them.  Further, they do not intrude
  42  * on our cache or tlb entries.
  43  */
  44
  45 struct exception_table_entry
  46 {
  47         unsigned long insn, fixup;
  48 };
  49
  50 extern int fixup_exception(struct pt_regs *regs);
  51
  52 /*
  53  * These two functions allow hooking accesses to userspace to increase
  54  * system integrity by ensuring that the kernel can not inadvertantly
  55  * perform such accesses (eg, via list poison values) which could then
  56  * be exploited for priviledge escalation.
  57  */
  58 static inline unsigned int uaccess_save_and_enable(void)
  59 {
  60 #ifdef CONFIG_CPU_SW_DOMAIN_PAN
  61         unsigned int old_domain = get_domain();
  62
  63         /* Set the current domain access to permit user accesses */
  64         set_domain((old_domain & ~domain_mask(DOMAIN_USER)) |
  65                    domain_val(DOMAIN_USER, DOMAIN_CLIENT));
  66
  67         return old_domain;
  68 #else
  69         return 0;
  70 #endif
  71 }
  72
  73 static inline void uaccess_restore(unsigned int flags)
  74 {
  75 #ifdef CONFIG_CPU_SW_DOMAIN_PAN
  76         /* Restore the user access mask */
  77         set_domain(flags);
  78 #endif
  79 }
  80
  81 /*
  82  * These two are intentionally not defined anywhere - if the kernel
  83  * code generates any references to them, that's a bug.
  84  */
  85 extern int __get_user_bad(void);
  86 extern int __put_user_bad(void);
  87
  88 /*
  89  * Note that this is actually 0x1,0000,0000
  90  */
  91 #define KERNEL_DS       0x00000000
  92 #define get_ds()        (KERNEL_DS)
  93
  94 #ifdef CONFIG_MMU
  95
  96 #define USER_DS         TASK_SIZE
  97 #define get_fs()        (current_thread_info()->addr_limit)
  98
  99 static inline void set_fs(mm_segment_t fs)
 100 {
 101         current_thread_info()->addr_limit = fs;
 102         modify_domain(DOMAIN_KERNEL, fs ? DOMAIN_CLIENT : DOMAIN_MANAGER);
 103 }
 104
 105 #define segment_eq(a, b)        ((a) == (b))
 106
 107 /* We use 33-bit arithmetic here... */
 108 #define __range_ok(addr, size) ({ \
 109         unsigned long flag, roksum; \
 110         __chk_user_ptr(addr);   \
 111         __asm__("adds %1, %2, %3; sbcccs %1, %1, %0; movcc %0, #0" \
 112                 : "=&r" (flag), "=&r" (roksum) \
 113                 : "r" (addr), "Ir" (size), "0" (current_thread_info()->addr_limit) \
 114                 : "cc"); \
 115         flag; })
 116
 117 /*
 118  * Single-value transfer routines.  They automatically use the right
 119  * size if we just have the right pointer type.  Note that the functions
 120  * which read from user space (*get_*) need to take care not to leak
 121  * kernel data even if the calling code is buggy and fails to check
 122  * the return value.  This means zeroing out the destination variable
 123  * or buffer on error.  Normally this is done out of line by the
 124  * fixup code, but there are a few places where it intrudes on the
 125  * main code path.  When we only write to user space, there is no
 126  * problem.
 127  */
 128 extern int __get_user_1(void *);
 129 extern int __get_user_2(void *);
 130 extern int __get_user_4(void *);
 131 extern int __get_user_32t_8(void *);
 132 extern int __get_user_8(void *);
 133 extern int __get_user_64t_1(void *);
 134 extern int __get_user_64t_2(void *);
 135 extern int __get_user_64t_4(void *);
 136
 137 #define __GUP_CLOBBER_1 "lr", "cc"
 138 #ifdef CONFIG_CPU_USE_DOMAINS
 139 #define __GUP_CLOBBER_2 "ip", "lr", "cc"
 140 #else
 141 #define __GUP_CLOBBER_2 "lr", "cc"
 142 #endif
 143 #define __GUP_CLOBBER_4 "lr", "cc"
 144 #define __GUP_CLOBBER_32t_8 "lr", "cc"
 145 #define __GUP_CLOBBER_8 "lr", "cc"
 146
 147 #define __get_user_x(__r2, __p, __e, __l, __s)                          \
 148            __asm__ __volatile__ (                                       \
 149                 __asmeq("%0", "r0") __asmeq("%1", "r2")                 \
 150                 __asmeq("%3", "r1")                                     \
 151                 "bl     __get_user_" #__s                               \
 152                 : "=&r" (__e), "=r" (__r2)                              \
 153                 : "0" (__p), "r" (__l)                                  \
 154                 : __GUP_CLOBBER_##__s)
 155
 156 /* narrowing a double-word get into a single 32bit word register: */
 157 #ifdef __ARMEB__
 158 #define __get_user_x_32t(__r2, __p, __e, __l, __s)                      \
 159         __get_user_x(__r2, __p, __e, __l, 32t_8)
 160 #else
 161 #define __get_user_x_32t __get_user_x
 162 #endif
 163
 164 /*
 165  * storing result into proper least significant word of 64bit target var,
 166  * different only for big endian case where 64 bit __r2 lsw is r3:
 167  */
 168 #ifdef __ARMEB__
 169 #define __get_user_x_64t(__r2, __p, __e, __l, __s)                      \
 170            __asm__ __volatile__ (                                       \
 171                 __asmeq("%0", "r0") __asmeq("%1", "r2")                 \
 172                 __asmeq("%3", "r1")                                     \
 173                 "bl     __get_user_64t_" #__s                           \
 174                 : "=&r" (__e), "=r" (__r2)                              \
 175                 : "0" (__p), "r" (__l)                                  \
 176                 : __GUP_CLOBBER_##__s)
 177 #else
 178 #define __get_user_x_64t __get_user_x
 179 #endif
 180
 181
 182 #define __get_user_check(x, p)                                          \
 183         ({                                                              \
 184                 unsigned long __limit = current_thread_info()->addr_limit - 1; \
 185                 register const typeof(*(p)) __user *__p asm("r0") = (p);\
 186                 register typeof(x) __r2 asm("r2");                      \
 187                 register unsigned long __l asm("r1") = __limit;         \
 188                 register int __e asm("r0");                             \
 189                 unsigned int __ua_flags = uaccess_save_and_enable();    \
 190                 switch (sizeof(*(__p))) {                               \
 191                 case 1:                                                 \
 192                         if (sizeof((x)) >= 8)                           \
 193                                 __get_user_x_64t(__r2, __p, __e, __l, 1); \
 194                         else                                            \
 195                                 __get_user_x(__r2, __p, __e, __l, 1);   \
 196                         break;                                          \
 197                 case 2:                                                 \
 198                         if (sizeof((x)) >= 8)                           \
 199                                 __get_user_x_64t(__r2, __p, __e, __l, 2); \
 200                         else                                            \
 201                                 __get_user_x(__r2, __p, __e, __l, 2);   \
 202                         break;                                          \
 203                 case 4:                                                 \
 204                         if (sizeof((x)) >= 8)                           \
 205                                 __get_user_x_64t(__r2, __p, __e, __l, 4); \
 206                         else                                            \
 207                                 __get_user_x(__r2, __p, __e, __l, 4);   \
 208                         break;                                          \
 209                 case 8:                                                 \
 210                         if (sizeof((x)) < 8)                            \
 211                                 __get_user_x_32t(__r2, __p, __e, __l, 4); \
 212                         else                                            \
 213                                 __get_user_x(__r2, __p, __e, __l, 8);   \
 214                         break;                                          \
 215                 default: __e = __get_user_bad(); break;                 \
 216                 }                                                       \
 217                 uaccess_restore(__ua_flags);                            \
 218                 x = (typeof(*(p))) __r2;                                \
 219                 __e;                                                    \
 220         })
 221
 222 #define get_user(x, p)                                                  \
 223         ({                                                              \
 224                 might_fault();                                          \
 225                 __get_user_check(x, p);                                 \
 226          })
 227
 228 extern int __put_user_1(void *, unsigned int);
 229 extern int __put_user_2(void *, unsigned int);
 230 extern int __put_user_4(void *, unsigned int);
 231 extern int __put_user_8(void *, unsigned long long);
 232
 233 #define __put_user_check(__pu_val, __ptr, __err, __s)                   \
 234         ({                                                              \
 235                 unsigned long __limit = current_thread_info()->addr_limit - 1; \
 236                 register typeof(__pu_val) __r2 asm("r2") = __pu_val;    \
 237                 register const void __user *__p asm("r0") = __ptr;      \
 238                 register unsigned long __l asm("r1") = __limit;         \
 239                 register int __e asm("r0");                             \
 240                 __asm__ __volatile__ (                                  \
 241                         __asmeq("%0", "r0") __asmeq("%2", "r2")         \
 242                         __asmeq("%3", "r1")                             \
 243                         "bl     __put_user_" #__s                       \
 244                         : "=&r" (__e)                                   \
 245                         : "0" (__p), "r" (__r2), "r" (__l)              \
 246                         : "ip", "lr", "cc");                            \
 247                 __err = __e;                                            \
 248         })
 249
 250 #else /* CONFIG_MMU */
 251
 252 /*
 253  * uClinux has only one addr space, so has simplified address limits.
 254  */
 255 #define USER_DS                 KERNEL_DS
 256
 257 #define segment_eq(a, b)                (1)
 258 #define __addr_ok(addr)         ((void)(addr), 1)
 259 #define __range_ok(addr, size)  ((void)(addr), 0)
 260 #define get_fs()                (KERNEL_DS)
 261
 262 static inline void set_fs(mm_segment_t fs)
 263 {
 264 }
 265
 266 #define get_user(x, p)  __get_user(x, p)
 267 #define __put_user_check __put_user_nocheck
 268
 269 #endif /* CONFIG_MMU */
 270
 271 #define access_ok(type, addr, size)     (__range_ok(addr, size) == 0)
 272
 273 #define user_addr_max() \
 274         (segment_eq(get_fs(), KERNEL_DS) ? ~0UL : get_fs())
 275
 276 /*
 277  * The "__xxx" versions of the user access functions do not verify the
 278  * address space - it must have been done previously with a separate
 279  * "access_ok()" call.
 280  *
 281  * The "xxx_error" versions set the third argument to EFAULT if an
 282  * error occurs, and leave it unchanged on success.  Note that these
 283  * versions are void (ie, don't return a value as such).
 284  */
 285 #define __get_user(x, ptr)                                              \
 286 ({                                                                      \
 287         long __gu_err = 0;                                              \
 288         __get_user_err((x), (ptr), __gu_err);                           \
 289         __gu_err;                                                       \
 290 })
 291
 292 #define __get_user_error(x, ptr, err)                                   \
 293 ({                                                                      \
 294         __get_user_err((x), (ptr), err);                                \
 295         (void) 0;                                                       \
 296 })
 297
 298 #define __get_user_err(x, ptr, err)                                     \
 299 do {                                                                    \
 300         unsigned long __gu_addr = (unsigned long)(ptr);                 \
 301         unsigned long __gu_val;                                         \
 302         unsigned int __ua_flags;                                        \
 303         __chk_user_ptr(ptr);                                            \
 304         might_fault();                                                  \
 305         __ua_flags = uaccess_save_and_enable();                         \
 306         switch (sizeof(*(ptr))) {                                       \
 307         case 1: __get_user_asm_byte(__gu_val, __gu_addr, err);  break;  \
 308         case 2: __get_user_asm_half(__gu_val, __gu_addr, err);  break;  \
 309         case 4: __get_user_asm_word(__gu_val, __gu_addr, err);  break;  \
 310         default: (__gu_val) = __get_user_bad();                         \
 311         }                                                               \
 312         uaccess_restore(__ua_flags);                                    \
 313         (x) = (__typeof__(*(ptr)))__gu_val;                             \
 314 } while (0)
 315
 316 #define __get_user_asm(x, addr, err, instr)                     \
 317         __asm__ __volatile__(                                   \
 318         "1:     " TUSER(instr) " %1, [%2], #0\n"                \
 319         "2:\n"                                                  \
 320         "       .pushsection .text.fixup,\"ax\"\n"              \
 321         "       .align  2\n"                                    \
 322         "3:     mov     %0, %3\n"                               \
 323         "       mov     %1, #0\n"                               \
 324         "       b       2b\n"                                   \
 325         "       .popsection\n"                                  \
 326         "       .pushsection __ex_table,\"a\"\n"                \
 327         "       .align  3\n"                                    \
 328         "       .long   1b, 3b\n"                               \
 329         "       .popsection"                                    \
 330         : "+r" (err), "=&r" (x)                                 \
 331         : "r" (addr), "i" (-EFAULT)                             \
 332         : "cc")
 333
 334 #define __get_user_asm_byte(x, addr, err)                       \
 335         __get_user_asm(x, addr, err, ldrb)
 336
 337 #ifndef __ARMEB__
 338 #define __get_user_asm_half(x, __gu_addr, err)                  \
 339 ({                                                              \
 340         unsigned long __b1, __b2;                               \
 341         __get_user_asm_byte(__b1, __gu_addr, err);              \
 342         __get_user_asm_byte(__b2, __gu_addr + 1, err);          \
 343         (x) = __b1 | (__b2 << 8);                               \
 344 })
 345 #else
 346 #define __get_user_asm_half(x, __gu_addr, err)                  \
 347 ({                                                              \
 348         unsigned long __b1, __b2;                               \
 349         __get_user_asm_byte(__b1, __gu_addr, err);              \
 350         __get_user_asm_byte(__b2, __gu_addr + 1, err);          \
 351         (x) = (__b1 << 8) | __b2;                               \
 352 })
 353 #endif
 354
 355 #define __get_user_asm_word(x, addr, err)                       \
 356         __get_user_asm(x, addr, err, ldr)
 357
 358
 359 #define __put_user_switch(x, ptr, __err, __fn)                          \
 360         do {                                                            \
 361                 const __typeof__(*(ptr)) __user *__pu_ptr = (ptr);      \
 362                 __typeof__(*(ptr)) __pu_val = (x);                      \
 363                 unsigned int __ua_flags;                                \
 364                 might_fault();                                          \
 365                 __ua_flags = uaccess_save_and_enable();                 \
 366                 switch (sizeof(*(ptr))) {                               \
 367                 case 1: __fn(__pu_val, __pu_ptr, __err, 1); break;      \
 368                 case 2: __fn(__pu_val, __pu_ptr, __err, 2); break;      \
 369                 case 4: __fn(__pu_val, __pu_ptr, __err, 4); break;      \
 370                 case 8: __fn(__pu_val, __pu_ptr, __err, 8); break;      \
 371                 default: __err = __put_user_bad(); break;               \
 372                 }                                                       \
 373                 uaccess_restore(__ua_flags);                            \
 374         } while (0)
 375
 376 #define put_user(x, ptr)                                                \
 377 ({                                                                      \
 378         int __pu_err = 0;                                               \
 379         __put_user_switch((x), (ptr), __pu_err, __put_user_check);      \
 380         __pu_err;                                                       \
 381 })
 382
 383 #define __put_user(x, ptr)                                              \
 384 ({                                                                      \
 385         long __pu_err = 0;                                              \
 386         __put_user_switch((x), (ptr), __pu_err, __put_user_nocheck);    \
 387         __pu_err;                                                       \
 388 })
 389
 390 #define __put_user_error(x, ptr, err)                                   \
 391 ({                                                                      \
 392         __put_user_switch((x), (ptr), (err), __put_user_nocheck);       \
 393         (void) 0;                                                       \
 394 })
 395
 396 #define __put_user_nocheck(x, __pu_ptr, __err, __size)                  \
 397         do {                                                            \
 398                 unsigned long __pu_addr = (unsigned long)__pu_ptr;      \
 399                 __put_user_nocheck_##__size(x, __pu_addr, __err);       \
 400         } while (0)
 401
 402 #define __put_user_nocheck_1 __put_user_asm_byte
 403 #define __put_user_nocheck_2 __put_user_asm_half
 404 #define __put_user_nocheck_4 __put_user_asm_word
 405 #define __put_user_nocheck_8 __put_user_asm_dword
 406
 407 #define __put_user_asm(x, __pu_addr, err, instr)                \
 408         __asm__ __volatile__(                                   \
 409         "1:     " TUSER(instr) " %1, [%2], #0\n"                \
 410         "2:\n"                                                  \
 411         "       .pushsection .text.fixup,\"ax\"\n"              \
 412         "       .align  2\n"                                    \
 413         "3:     mov     %0, %3\n"                               \
 414         "       b       2b\n"                                   \
 415         "       .popsection\n"                                  \
 416         "       .pushsection __ex_table,\"a\"\n"                \
 417         "       .align  3\n"                                    \
 418         "       .long   1b, 3b\n"                               \
 419         "       .popsection"                                    \
 420         : "+r" (err)                                            \
 421         : "r" (x), "r" (__pu_addr), "i" (-EFAULT)               \
 422         : "cc")
 423
 424 #define __put_user_asm_byte(x, __pu_addr, err)                  \
 425         __put_user_asm(x, __pu_addr, err, strb)
 426
 427 #ifndef __ARMEB__
 428 #define __put_user_asm_half(x, __pu_addr, err)                  \
 429 ({                                                              \
 430         unsigned long __temp = (__force unsigned long)(x);      \
 431         __put_user_asm_byte(__temp, __pu_addr, err);            \
 432         __put_user_asm_byte(__temp >> 8, __pu_addr + 1, err);   \
 433 })
 434 #else
 435 #define __put_user_asm_half(x, __pu_addr, err)                  \
 436 ({                                                              \
 437         unsigned long __temp = (__force unsigned long)(x);      \
 438         __put_user_asm_byte(__temp >> 8, __pu_addr, err);       \
 439         __put_user_asm_byte(__temp, __pu_addr + 1, err);        \
 440 })
 441 #endif
 442
 443 #define __put_user_asm_word(x, __pu_addr, err)                  \
 444         __put_user_asm(x, __pu_addr, err, str)
 445
 446 #ifndef __ARMEB__
 447 #define __reg_oper0     "%R2"
 448 #define __reg_oper1     "%Q2"
 449 #else
 450 #define __reg_oper0     "%Q2"
 451 #define __reg_oper1     "%R2"
 452 #endif
 453
 454 #define __put_user_asm_dword(x, __pu_addr, err)                 \
 455         __asm__ __volatile__(                                   \
 456  ARM(   "1:     " TUSER(str) "  " __reg_oper1 ", [%1], #4\n"    ) \
 457  ARM(   "2:     " TUSER(str) "  " __reg_oper0 ", [%1]\n"        ) \
 458  THUMB( "1:     " TUSER(str) "  " __reg_oper1 ", [%1]\n"        ) \
 459  THUMB( "2:     " TUSER(str) "  " __reg_oper0 ", [%1, #4]\n"    ) \
 460         "3:\n"                                                  \
 461         "       .pushsection .text.fixup,\"ax\"\n"              \
 462         "       .align  2\n"                                    \
 463         "4:     mov     %0, %3\n"                               \
 464         "       b       3b\n"                                   \
 465         "       .popsection\n"                                  \
 466         "       .pushsection __ex_table,\"a\"\n"                \
 467         "       .align  3\n"                                    \
 468         "       .long   1b, 4b\n"                               \
 469         "       .long   2b, 4b\n"                               \
 470         "       .popsection"                                    \
 471         : "+r" (err), "+r" (__pu_addr)                          \
 472         : "r" (x), "i" (-EFAULT)                                \
 473         : "cc")
 474
 475
 476 #ifdef CONFIG_MMU
 477 extern unsigned long __must_check
 478 arm_copy_from_user(void *to, const void __user *from, unsigned long n);
 479
 480 static inline unsigned long __must_check
 481 __copy_from_user(void *to, const void __user *from, unsigned long n)
 482 {
 483         unsigned int __ua_flags;
 484
 485         check_object_size(to, n, false);
 486         __ua_flags = uaccess_save_and_enable();
 487         n = arm_copy_from_user(to, from, n);
 488         uaccess_restore(__ua_flags);
 489         return n;
 490 }
 491
 492 extern unsigned long __must_check
 493 arm_copy_to_user(void __user *to, const void *from, unsigned long n);
 494 extern unsigned long __must_check
 495 __copy_to_user_std(void __user *to, const void *from, unsigned long n);
 496
 497 static inline unsigned long __must_check
 498 __copy_to_user(void __user *to, const void *from, unsigned long n)
 499 {
 500 #ifndef CONFIG_UACCESS_WITH_MEMCPY
 501         unsigned int __ua_flags;
 502
 503         check_object_size(from, n, true);
 504         __ua_flags = uaccess_save_and_enable();
 505         n = arm_copy_to_user(to, from, n);
 506         uaccess_restore(__ua_flags);
 507         return n;
 508 #else
 509         check_object_size(from, n, true);
 510         return arm_copy_to_user(to, from, n);
 511 #endif
 512 }
 513
 514 extern unsigned long __must_check
 515 arm_clear_user(void __user *addr, unsigned long n);
 516 extern unsigned long __must_check
 517 __clear_user_std(void __user *addr, unsigned long n);
 518
 519 static inline unsigned long __must_check
 520 __clear_user(void __user *addr, unsigned long n)
 521 {
 522         unsigned int __ua_flags = uaccess_save_and_enable();
 523         n = arm_clear_user(addr, n);
 524         uaccess_restore(__ua_flags);
 525         return n;
 526 }
 527
 528 #else
 529 #define __copy_from_user(to, from, n)   (memcpy(to, (void __force *)from, n), 0)
 530 #define __copy_to_user(to, from, n)     (memcpy((void __force *)to, from, n), 0)
 531 #define __clear_user(addr, n)           (memset((void __force *)addr, 0, n), 0)
 532 #endif
 533
 534 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 535 {
 536         unsigned long res = n;
 537         if (likely(access_ok(VERIFY_READ, from, n)))
 538                 res = __copy_from_user(to, from, n);
 539         if (unlikely(res))
 540                 memset(to + (n - res), 0, res);
 541         return res;
 542 }
 543
 544 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
 545 {
 546         if (access_ok(VERIFY_WRITE, to, n))
 547                 n = __copy_to_user(to, from, n);
 548         return n;
 549 }
 550
 551 #define __copy_to_user_inatomic __copy_to_user
 552 #define __copy_from_user_inatomic __copy_from_user
 553
 554 static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
 555 {
 556         if (access_ok(VERIFY_WRITE, to, n))
 557                 n = __clear_user(to, n);
 558         return n;
 559 }
 560
 561 /* These are from lib/ code, and use __get_user() and friends */
 562 extern long strncpy_from_user(char *dest, const char __user *src, long count);
 563
 564 extern __must_check long strlen_user(const char __user *str);
 565 extern __must_check long strnlen_user(const char __user *str, long n);
 566
 567 #endif /* _ASMARM_UACCESS_H */