1 // SPDX-License-Identifier: GPL-2.0 2 /* ptrace.c */ 3 /* By Ross Biro 1/23/92 */ 4 /* edited by Linus Torvalds */ 5 /* mangled further by Bob Manson (manson@santafe.edu) */ 6 /* more mutilation by David Mosberger (davidm@azstarnet.com) */ 7 8 #include <linux/kernel.h> 9 #include <linux/sched.h> 10 #include <linux/sched/task_stack.h> 11 #include <linux/mm.h> 12 #include <linux/smp.h> 13 #include <linux/errno.h> 14 #include <linux/ptrace.h> 15 #include <linux/user.h> 16 #include <linux/security.h> 17 #include <linux/signal.h> 18 #include <linux/audit.h> 19 #include <linux/seccomp.h> 20 #include <asm/syscall.h> 21 22 #include <linux/uaccess.h> 23 #include <asm/fpu.h> 24 25 #include "proto.h" 26 #include <linux/uio.h> 27 #include <linux/regset.h> 28 29 #define DEBUG DBG_MEM 30 #undef DEBUG 31 32 #ifndef NT_FPREGSET 33 #define NT_FPREGSET NT_PRFPREG 34 #endif 35 36 #ifdef DEBUG 37 enum { 38 DBG_MEM = (1<<0), 39 DBG_BPT = (1<<1), 40 DBG_MEM_ALL = (1<<2) 41 }; 42 #define DBG(fac,args) {if ((fac) & DEBUG) printk args;} 43 #else 44 #define DBG(fac,args) 45 #endif 46 47 #define BREAKINST 0x00000080 /* call_pal bpt */ 48 49 /* 50 * does not yet catch signals sent when the child dies. 51 * in exit.c or in signal.c. 52 */ 53 54 /* 55 * Processes always block with the following stack-layout: 56 * 57 * +================================+ <---- task + 2*PAGE_SIZE 58 * | PALcode saved frame (ps, pc, | ^ 59 * | gp, a0, a1, a2) | | 60 * +================================+ | struct pt_regs 61 * | | | 62 * | frame generated by SAVE_ALL | | 63 * | | v 64 * +================================+ 65 * | | ^ 66 * | frame saved by do_switch_stack | | struct switch_stack 67 * | | v 68 * +================================+ 69 */ 70 71 /* 72 * The following table maps a register index into the stack offset at 73 * which the register is saved. Register indices are 0-31 for integer 74 * regs, 32-63 for fp regs, and 64 for the pc. Notice that sp and 75 * zero have no stack-slot and need to be treated specially (see 76 * get_reg/put_reg below). 77 */ 78 enum { 79 REG_R0 = 0, REG_F0 = 32, REG_FPCR = 63, REG_PC = 64 80 }; 81 82 #define PT_REG(reg) \ 83 (PAGE_SIZE*2 - sizeof(struct pt_regs) + offsetof(struct pt_regs, reg)) 84 85 #define SW_REG(reg) \ 86 (PAGE_SIZE*2 - sizeof(struct pt_regs) - sizeof(struct switch_stack) \ 87 + offsetof(struct switch_stack, reg)) 88 89 #define FP_REG(reg) (offsetof(struct thread_info, reg)) 90 91 static int regoff[] = { 92 PT_REG( r0), PT_REG( r1), PT_REG( r2), PT_REG( r3), 93 PT_REG( r4), PT_REG( r5), PT_REG( r6), PT_REG( r7), 94 PT_REG( r8), SW_REG( r9), SW_REG( r10), SW_REG( r11), 95 SW_REG( r12), SW_REG( r13), SW_REG( r14), SW_REG( r15), 96 PT_REG( r16), PT_REG( r17), PT_REG( r18), PT_REG( r19), 97 PT_REG( r20), PT_REG( r21), PT_REG( r22), PT_REG( r23), 98 PT_REG( r24), PT_REG( r25), PT_REG( r26), PT_REG( r27), 99 PT_REG( r28), PT_REG( gp), -1, -1, 100 FP_REG(fp[ 0]), FP_REG(fp[ 1]), FP_REG(fp[ 2]), FP_REG(fp[ 3]), 101 FP_REG(fp[ 4]), FP_REG(fp[ 5]), FP_REG(fp[ 6]), FP_REG(fp[ 7]), 102 FP_REG(fp[ 8]), FP_REG(fp[ 9]), FP_REG(fp[10]), FP_REG(fp[11]), 103 FP_REG(fp[12]), FP_REG(fp[13]), FP_REG(fp[14]), FP_REG(fp[15]), 104 FP_REG(fp[16]), FP_REG(fp[17]), FP_REG(fp[18]), FP_REG(fp[19]), 105 FP_REG(fp[20]), FP_REG(fp[21]), FP_REG(fp[22]), FP_REG(fp[23]), 106 FP_REG(fp[24]), FP_REG(fp[25]), FP_REG(fp[26]), FP_REG(fp[27]), 107 FP_REG(fp[28]), FP_REG(fp[29]), FP_REG(fp[30]), FP_REG(fp[31]), 108 PT_REG( pc) 109 }; 110 111 static unsigned long zero; 112 113 /* 114 * Get address of register REGNO in task TASK. 115 */ 116 static unsigned long * 117 get_reg_addr(struct task_struct * task, unsigned long regno) 118 { 119 unsigned long *addr; 120 121 if (regno == 30) { 122 addr = &task_thread_info(task)->pcb.usp; 123 } else if (regno == 65) { 124 addr = &task_thread_info(task)->pcb.unique; 125 } else if (regno == 31 || regno > 65) { 126 zero = 0; 127 addr = &zero; 128 } else { 129 addr = task_stack_page(task) + regoff[regno]; 130 } 131 return addr; 132 } 133 134 /* 135 * Get contents of register REGNO in task TASK. 136 */ 137 static unsigned long 138 get_reg(struct task_struct * task, unsigned long regno) 139 { 140 /* Special hack for fpcr -- combine hardware and software bits. */ 141 if (regno == 63) { 142 unsigned long fpcr = *get_reg_addr(task, regno); 143 unsigned long swcr 144 = task_thread_info(task)->ieee_state & IEEE_SW_MASK; 145 swcr = swcr_update_status(swcr, fpcr); 146 return fpcr | swcr; 147 } 148 return *get_reg_addr(task, regno); 149 } 150 151 static void alpha_elf_fpregs_get(struct task_struct *target, 152 elf_fpreg_t *fpregs) /* points to ELF_NFPREG entries */ 153 { 154 memcpy(fpregs, task_thread_info(target)->fp, sizeof(elf_fpregset_t)); 155 } 156 157 static void alpha_elf_fpregs_set(struct task_struct *target, 158 const elf_fpreg_t *fpregs, 159 size_t nwords) 160 { 161 size_t n = min_t(size_t, nwords, ELF_NFPREG); 162 163 memcpy(task_thread_info(target)->fp, fpregs, n * sizeof(elf_fpreg_t)); 164 } 165 166 static void alpha_elf_gregs_set(struct task_struct *child, 167 const elf_greg_t *src, 168 size_t nwords) 169 { 170 struct pt_regs *pt = task_pt_regs(child); 171 struct thread_info *ti = task_thread_info(child); 172 struct switch_stack *sw = ((struct switch_stack *)pt) - 1; 173 174 /* GPRs r0..r8 live in pt_regs */ 175 if (nwords > 0) 176 pt->r0 = src[0]; 177 if (nwords > 1) 178 pt->r1 = src[1]; 179 if (nwords > 2) 180 pt->r2 = src[2]; 181 if (nwords > 3) 182 pt->r3 = src[3]; 183 if (nwords > 4) 184 pt->r4 = src[4]; 185 if (nwords > 5) 186 pt->r5 = src[5]; 187 if (nwords > 6) 188 pt->r6 = src[6]; 189 if (nwords > 7) 190 pt->r7 = src[7]; 191 if (nwords > 8) 192 pt->r8 = src[8]; 193 194 /* r9..r15 live in switch_stack */ 195 if (nwords > 9) 196 sw->r9 = src[9]; 197 if (nwords > 10) 198 sw->r10 = src[10]; 199 if (nwords > 11) 200 sw->r11 = src[11]; 201 if (nwords > 12) 202 sw->r12 = src[12]; 203 if (nwords > 13) 204 sw->r13 = src[13]; 205 if (nwords > 14) 206 sw->r14 = src[14]; 207 if (nwords > 15) 208 sw->r15 = src[15]; 209 210 /* r16..r28 live in pt_regs */ 211 if (nwords > 16) 212 pt->r16 = src[16]; 213 if (nwords > 17) 214 pt->r17 = src[17]; 215 if (nwords > 18) 216 pt->r18 = src[18]; 217 if (nwords > 19) 218 pt->r19 = src[19]; 219 if (nwords > 20) 220 pt->r20 = src[20]; 221 if (nwords > 21) 222 pt->r21 = src[21]; 223 if (nwords > 22) 224 pt->r22 = src[22]; 225 if (nwords > 23) 226 pt->r23 = src[23]; 227 if (nwords > 24) 228 pt->r24 = src[24]; 229 if (nwords > 25) 230 pt->r25 = src[25]; 231 if (nwords > 26) 232 pt->r26 = src[26]; 233 if (nwords > 27) 234 pt->r27 = src[27]; 235 if (nwords > 28) 236 pt->r28 = src[28]; 237 238 /* gp, usp, pc, unique */ 239 if (nwords > 29) 240 pt->gp = src[29]; 241 242 if (nwords > 30) { 243 ti->pcb.usp = src[30]; 244 /* 245 * If someone ever does this to current (rare), keep the 246 * hardware usp consistent. 247 */ 248 if (child == current) 249 wrusp(src[30]); 250 } 251 252 if (nwords > 31) 253 pt->pc = src[31]; 254 255 if (nwords > 32) 256 ti->pcb.unique = src[32]; 257 258 /* 259 * PTRACE_SETREGSET can be used at a syscall-entry stop to skip the 260 * syscall by setting the syscall number to -1. The seccomp/ptrace 261 * selftests use this to synthesize errno returns. 262 * 263 * Alpha uses r19/a3 as the error flag, so a skipped syscall with a 264 * small positive r0 and a clear r19 must be normalized to an error 265 * return. 266 */ 267 if (pt->r1 == (unsigned long)-1 && 268 pt->r19 == 0 && 269 pt->r0 > 0 && 270 pt->r0 < MAX_ERRNO) 271 pt->r19 = 1; 272 } 273 274 275 /* 276 * Write contents of register REGNO in task TASK. 277 */ 278 static int 279 put_reg(struct task_struct *task, unsigned long regno, unsigned long data) 280 { 281 struct pt_regs *regs = task_pt_regs(task); 282 283 if (regno == 63) { 284 task_thread_info(task)->ieee_state 285 = ((task_thread_info(task)->ieee_state & ~IEEE_SW_MASK) 286 | (data & IEEE_SW_MASK)); 287 data = (data & FPCR_DYN_MASK) | ieee_swcr_to_fpcr(data); 288 } 289 290 *get_reg_addr(task, regno) = data; 291 292 /* 293 * Alpha historically exposes r0/v0 as the syscall number at a 294 * syscall-entry stop. The generic-entry conversion keeps the 295 * mutable syscall number in regs->r1, so old ptrace users such 296 * as strace that skip a syscall by poking r0 to -1 must also 297 * update the internal shadow syscall number. 298 * 299 * Do not mirror other r0 writes. strace later pokes r0 to the 300 * injected return value, e.g. 42, while r1 must remain -1. 301 */ 302 303 if (regno == 0 && data == (unsigned long)-1) { 304 regs->r1 = data; 305 regs->r19 = 0; 306 } 307 308 return 0; 309 } 310 311 static inline int 312 read_int(struct task_struct *task, unsigned long addr, int * data) 313 { 314 int copied = access_process_vm(task, addr, data, sizeof(int), 315 FOLL_FORCE); 316 return (copied == sizeof(int)) ? 0 : -EIO; 317 } 318 319 static inline int 320 write_int(struct task_struct *task, unsigned long addr, int data) 321 { 322 int copied = access_process_vm(task, addr, &data, sizeof(int), 323 FOLL_FORCE | FOLL_WRITE); 324 return (copied == sizeof(int)) ? 0 : -EIO; 325 } 326 327 /* 328 * Set breakpoint. 329 */ 330 int 331 ptrace_set_bpt(struct task_struct * child) 332 { 333 int displ, i, res, reg_b, nsaved = 0; 334 unsigned int insn, op_code; 335 unsigned long pc; 336 337 pc = get_reg(child, REG_PC); 338 res = read_int(child, pc, (int *) &insn); 339 if (res < 0) 340 return res; 341 342 op_code = insn >> 26; 343 if (op_code >= 0x30) { 344 /* 345 * It's a branch: instead of trying to figure out 346 * whether the branch will be taken or not, we'll put 347 * a breakpoint at either location. This is simpler, 348 * more reliable, and probably not a whole lot slower 349 * than the alternative approach of emulating the 350 * branch (emulation can be tricky for fp branches). 351 */ 352 displ = ((s32)(insn << 11)) >> 9; 353 task_thread_info(child)->bpt_addr[nsaved++] = pc + 4; 354 if (displ) /* guard against unoptimized code */ 355 task_thread_info(child)->bpt_addr[nsaved++] 356 = pc + 4 + displ; 357 DBG(DBG_BPT, ("execing branch\n")); 358 } else if (op_code == 0x1a) { 359 reg_b = (insn >> 16) & 0x1f; 360 task_thread_info(child)->bpt_addr[nsaved++] = get_reg(child, reg_b); 361 DBG(DBG_BPT, ("execing jump\n")); 362 } else { 363 task_thread_info(child)->bpt_addr[nsaved++] = pc + 4; 364 DBG(DBG_BPT, ("execing normal insn\n")); 365 } 366 367 /* install breakpoints: */ 368 for (i = 0; i < nsaved; ++i) { 369 res = read_int(child, task_thread_info(child)->bpt_addr[i], 370 (int *) &insn); 371 if (res < 0) 372 return res; 373 task_thread_info(child)->bpt_insn[i] = insn; 374 DBG(DBG_BPT, (" -> next_pc=%lx\n", 375 task_thread_info(child)->bpt_addr[i])); 376 res = write_int(child, task_thread_info(child)->bpt_addr[i], 377 BREAKINST); 378 if (res < 0) 379 return res; 380 } 381 task_thread_info(child)->bpt_nsaved = nsaved; 382 return 0; 383 } 384 385 /* 386 * Ensure no single-step breakpoint is pending. Returns non-zero 387 * value if child was being single-stepped. 388 */ 389 int 390 ptrace_cancel_bpt(struct task_struct * child) 391 { 392 int i, nsaved = task_thread_info(child)->bpt_nsaved; 393 394 task_thread_info(child)->bpt_nsaved = 0; 395 396 if (nsaved > 2) { 397 printk("ptrace_cancel_bpt: bogus nsaved: %d!\n", nsaved); 398 nsaved = 2; 399 } 400 401 for (i = 0; i < nsaved; ++i) { 402 write_int(child, task_thread_info(child)->bpt_addr[i], 403 task_thread_info(child)->bpt_insn[i]); 404 } 405 return (nsaved != 0); 406 } 407 408 void user_enable_single_step(struct task_struct *child) 409 { 410 /* Mark single stepping. */ 411 task_thread_info(child)->bpt_nsaved = -1; 412 } 413 414 void user_disable_single_step(struct task_struct *child) 415 { 416 ptrace_cancel_bpt(child); 417 } 418 419 /* 420 * Called by kernel/ptrace.c when detaching.. 421 * 422 * Make sure the single step bit is not set. 423 */ 424 void ptrace_disable(struct task_struct *child) 425 { 426 user_disable_single_step(child); 427 } 428 429 long arch_ptrace(struct task_struct *child, long request, 430 unsigned long addr, unsigned long data) 431 { 432 unsigned long tmp; 433 size_t copied; 434 long ret; 435 436 switch (request) { 437 /* When I and D space are separate, these will need to be fixed. */ 438 case PTRACE_PEEKTEXT: /* read word at location addr. */ 439 case PTRACE_PEEKDATA: 440 copied = ptrace_access_vm(child, addr, &tmp, sizeof(tmp), 441 FOLL_FORCE); 442 ret = -EIO; 443 if (copied != sizeof(tmp)) 444 break; 445 446 force_successful_syscall_return(); 447 ret = tmp; 448 break; 449 450 /* Read register number ADDR. */ 451 case PTRACE_PEEKUSR: 452 force_successful_syscall_return(); 453 ret = get_reg(child, addr); 454 DBG(DBG_MEM, ("peek $%lu->%#lx\n", addr, ret)); 455 break; 456 457 /* When I and D space are separate, this will have to be fixed. */ 458 case PTRACE_POKETEXT: /* write the word at location addr. */ 459 case PTRACE_POKEDATA: 460 ret = generic_ptrace_pokedata(child, addr, data); 461 break; 462 463 case PTRACE_POKEUSR: /* write the specified register */ 464 DBG(DBG_MEM, ("poke $%lu<-%#lx\n", addr, data)); 465 ret = put_reg(child, addr, data); 466 break; 467 default: 468 ret = ptrace_request(child, request, addr, data); 469 break; 470 } 471 return ret; 472 } 473 474 asmlinkage unsigned long syscall_trace_enter(void) 475 { 476 struct pt_regs *regs = current_pt_regs(); 477 478 if (test_thread_flag(TIF_SYSCALL_TRACE) && 479 !ptrace_report_syscall_permit_entry(regs)) { 480 syscall_set_nr(current, regs, -1); 481 if (regs->r19 == 0 && regs->r0 == (unsigned long)-1) 482 syscall_set_return_value(current, regs, -ENOSYS, 0); 483 return -1UL; 484 } 485 486 /* 487 * Do the secure computing after ptrace; failures should be fast. 488 * If this fails, seccomp may already have set up the return value 489 * (e.g. SECCOMP_RET_ERRNO / TRACE). 490 */ 491 if (!seccomp_permit_syscall()) { 492 if (regs->r19 == 0 && regs->r0 == (unsigned long)-1) 493 syscall_set_return_value(current, regs, -ENOSYS, 0); 494 syscall_set_nr(current, regs, -1); 495 return -1UL; 496 } 497 498 #ifdef CONFIG_AUDITSYSCALL 499 audit_syscall_entry(syscall_get_nr(current, regs), 500 regs->r16, regs->r17, regs->r18, regs->r19); 501 #endif 502 return syscall_get_nr(current, regs); 503 } 504 505 506 507 asmlinkage void 508 syscall_trace_leave(void) 509 { 510 audit_syscall_exit(current_pt_regs()); 511 if (test_thread_flag(TIF_SYSCALL_TRACE)) 512 ptrace_report_syscall_exit(current_pt_regs(), 0); 513 } 514 515 /* 516 * Minimal regset support for Alpha. 517 * 518 * Alpha-specific notes: 519 * - Do NOT use ELF_CORE_COPY_REGS(): it uses current_thread_info(), 520 * which is wrong for non-current tasks. 521 * - dump_elf_task() returns 1 unconditionally in this tree, while 522 * regset_get should return 0 on success. So call dump_elf_thread() 523 * directly and return membuf_write()'s result. 524 */ 525 526 static int alpha_regset_set(struct task_struct *target, 527 const struct user_regset *regset, 528 unsigned int pos, unsigned int count, 529 const void *kbuf, 530 const void __user *ubuf) 531 { 532 elf_gregset_t gregs; 533 unsigned int nwords; 534 535 if (pos + count > sizeof(gregs)) 536 return -EIO; 537 538 /* 539 * Preserve registers outside the written range. 540 */ 541 dump_elf_thread(gregs, task_pt_regs(target), 542 task_thread_info(target)); 543 544 if (user_regset_copyin(&pos, &count, &kbuf, &ubuf, 545 gregs, 0, sizeof(gregs))) 546 return -EFAULT; 547 548 nwords = sizeof(gregs) / sizeof(elf_greg_t); 549 alpha_elf_gregs_set(target, gregs, nwords); 550 551 return 0; 552 } 553 554 static int alpha_fpregset_set(struct task_struct *target, 555 const struct user_regset *regset, 556 unsigned int pos, unsigned int count, 557 const void *kbuf, 558 const void __user *ubuf) 559 { 560 elf_fpregset_t fpregs; 561 unsigned int nwords; 562 563 if (pos + count > sizeof(fpregs)) 564 return -EIO; 565 566 alpha_elf_fpregs_get(target, fpregs); 567 568 if (user_regset_copyin(&pos, &count, &kbuf, &ubuf, 569 fpregs, 0, sizeof(fpregs))) 570 return -EFAULT; 571 572 nwords = sizeof(fpregs) / sizeof(elf_fpreg_t); 573 alpha_elf_fpregs_set(target, fpregs, nwords); 574 575 return 0; 576 } 577 578 static int alpha_regset_get(struct task_struct *target, 579 const struct user_regset *regset, 580 struct membuf to) 581 { 582 struct pt_regs *pt = task_pt_regs(target); 583 struct thread_info *ti = task_thread_info(target); 584 elf_gregset_t gregs; 585 586 dump_elf_thread(gregs, pt, ti); 587 return membuf_write(&to, gregs, sizeof(gregs)); 588 } 589 590 static int alpha_fpregset_get(struct task_struct *target, 591 const struct user_regset *regset, 592 struct membuf to) 593 { 594 elf_fpregset_t fpregs; 595 596 alpha_elf_fpregs_get(target, fpregs); 597 return membuf_write(&to, fpregs, sizeof(fpregs)); 598 } 599 600 enum alpha_regset { 601 REGSET_GPR, 602 REGSET_FPR, 603 }; 604 605 static const struct user_regset alpha_user_regsets[] = { 606 [REGSET_GPR] = { 607 .core_note_type = NT_PRSTATUS, 608 .n = ELF_NGREG, 609 .size = sizeof(elf_greg_t), 610 .align = sizeof(elf_greg_t), 611 .regset_get = alpha_regset_get, 612 .set = alpha_regset_set, 613 }, 614 [REGSET_FPR] = { 615 .core_note_type = NT_PRFPREG, 616 .core_note_name = "CORE", 617 .n = ELF_NFPREG, 618 .size = sizeof(elf_fpreg_t), 619 .align = sizeof(elf_fpreg_t), 620 .regset_get = alpha_fpregset_get, 621 .set = alpha_fpregset_set, 622 }, 623 }; 624 625 static const struct user_regset_view user_alpha_view = { 626 .name = "alpha", 627 .e_machine = EM_ALPHA, 628 .ei_osabi = ELF_OSABI, 629 .regsets = alpha_user_regsets, 630 .n = ARRAY_SIZE(alpha_user_regsets), 631 }; 632 633 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 634 { 635 return &user_alpha_view; 636 } 637