1 /* By Ross Biro 1/23/92 */ 2 /* 3 * Pentium III FXSR, SSE support 4 * Gareth Hughes <gareth@valinux.com>, May 2000 5 */ 6 7 #include <linux/kernel.h> 8 #include <linux/sched.h> 9 #include <linux/mm.h> 10 #include <linux/smp.h> 11 #include <linux/errno.h> 12 #include <linux/slab.h> 13 #include <linux/ptrace.h> 14 #include <linux/regset.h> 15 #include <linux/tracehook.h> 16 #include <linux/user.h> 17 #include <linux/elf.h> 18 #include <linux/security.h> 19 #include <linux/audit.h> 20 #include <linux/seccomp.h> 21 #include <linux/signal.h> 22 #include <linux/perf_event.h> 23 #include <linux/hw_breakpoint.h> 24 25 #include <asm/uaccess.h> 26 #include <asm/pgtable.h> 27 #include <asm/system.h> 28 #include <asm/processor.h> 29 #include <asm/i387.h> 30 #include <asm/debugreg.h> 31 #include <asm/ldt.h> 32 #include <asm/desc.h> 33 #include <asm/prctl.h> 34 #include <asm/proto.h> 35 #include <asm/hw_breakpoint.h> 36 37 #include "tls.h" 38 39 #define CREATE_TRACE_POINTS 40 #include <trace/events/syscalls.h> 41 42 enum x86_regset { 43 REGSET_GENERAL, 44 REGSET_FP, 45 REGSET_XFP, 46 REGSET_IOPERM64 = REGSET_XFP, 47 REGSET_XSTATE, 48 REGSET_TLS, 49 REGSET_IOPERM32, 50 }; 51 52 struct pt_regs_offset { 53 const char *name; 54 int offset; 55 }; 56 57 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 58 #define REG_OFFSET_END {.name = NULL, .offset = 0} 59 60 static const struct pt_regs_offset regoffset_table[] = { 61 #ifdef CONFIG_X86_64 62 REG_OFFSET_NAME(r15), 63 REG_OFFSET_NAME(r14), 64 REG_OFFSET_NAME(r13), 65 REG_OFFSET_NAME(r12), 66 REG_OFFSET_NAME(r11), 67 REG_OFFSET_NAME(r10), 68 REG_OFFSET_NAME(r9), 69 REG_OFFSET_NAME(r8), 70 #endif 71 REG_OFFSET_NAME(bx), 72 REG_OFFSET_NAME(cx), 73 REG_OFFSET_NAME(dx), 74 REG_OFFSET_NAME(si), 75 REG_OFFSET_NAME(di), 76 REG_OFFSET_NAME(bp), 77 REG_OFFSET_NAME(ax), 78 #ifdef CONFIG_X86_32 79 REG_OFFSET_NAME(ds), 80 REG_OFFSET_NAME(es), 81 REG_OFFSET_NAME(fs), 82 REG_OFFSET_NAME(gs), 83 #endif 84 REG_OFFSET_NAME(orig_ax), 85 REG_OFFSET_NAME(ip), 86 REG_OFFSET_NAME(cs), 87 REG_OFFSET_NAME(flags), 88 REG_OFFSET_NAME(sp), 89 REG_OFFSET_NAME(ss), 90 REG_OFFSET_END, 91 }; 92 93 /** 94 * regs_query_register_offset() - query register offset from its name 95 * @name: the name of a register 96 * 97 * regs_query_register_offset() returns the offset of a register in struct 98 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 99 */ 100 int regs_query_register_offset(const char *name) 101 { 102 const struct pt_regs_offset *roff; 103 for (roff = regoffset_table; roff->name != NULL; roff++) 104 if (!strcmp(roff->name, name)) 105 return roff->offset; 106 return -EINVAL; 107 } 108 109 /** 110 * regs_query_register_name() - query register name from its offset 111 * @offset: the offset of a register in struct pt_regs. 112 * 113 * regs_query_register_name() returns the name of a register from its 114 * offset in struct pt_regs. If the @offset is invalid, this returns NULL; 115 */ 116 const char *regs_query_register_name(unsigned int offset) 117 { 118 const struct pt_regs_offset *roff; 119 for (roff = regoffset_table; roff->name != NULL; roff++) 120 if (roff->offset == offset) 121 return roff->name; 122 return NULL; 123 } 124 125 static const int arg_offs_table[] = { 126 #ifdef CONFIG_X86_32 127 [0] = offsetof(struct pt_regs, ax), 128 [1] = offsetof(struct pt_regs, dx), 129 [2] = offsetof(struct pt_regs, cx) 130 #else /* CONFIG_X86_64 */ 131 [0] = offsetof(struct pt_regs, di), 132 [1] = offsetof(struct pt_regs, si), 133 [2] = offsetof(struct pt_regs, dx), 134 [3] = offsetof(struct pt_regs, cx), 135 [4] = offsetof(struct pt_regs, r8), 136 [5] = offsetof(struct pt_regs, r9) 137 #endif 138 }; 139 140 /* 141 * does not yet catch signals sent when the child dies. 142 * in exit.c or in signal.c. 143 */ 144 145 /* 146 * Determines which flags the user has access to [1 = access, 0 = no access]. 147 */ 148 #define FLAG_MASK_32 ((unsigned long) \ 149 (X86_EFLAGS_CF | X86_EFLAGS_PF | \ 150 X86_EFLAGS_AF | X86_EFLAGS_ZF | \ 151 X86_EFLAGS_SF | X86_EFLAGS_TF | \ 152 X86_EFLAGS_DF | X86_EFLAGS_OF | \ 153 X86_EFLAGS_RF | X86_EFLAGS_AC)) 154 155 /* 156 * Determines whether a value may be installed in a segment register. 157 */ 158 static inline bool invalid_selector(u16 value) 159 { 160 return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL); 161 } 162 163 #ifdef CONFIG_X86_32 164 165 #define FLAG_MASK FLAG_MASK_32 166 167 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno) 168 { 169 BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0); 170 return ®s->bx + (regno >> 2); 171 } 172 173 static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 174 { 175 /* 176 * Returning the value truncates it to 16 bits. 177 */ 178 unsigned int retval; 179 if (offset != offsetof(struct user_regs_struct, gs)) 180 retval = *pt_regs_access(task_pt_regs(task), offset); 181 else { 182 if (task == current) 183 retval = get_user_gs(task_pt_regs(task)); 184 else 185 retval = task_user_gs(task); 186 } 187 return retval; 188 } 189 190 static int set_segment_reg(struct task_struct *task, 191 unsigned long offset, u16 value) 192 { 193 /* 194 * The value argument was already truncated to 16 bits. 195 */ 196 if (invalid_selector(value)) 197 return -EIO; 198 199 /* 200 * For %cs and %ss we cannot permit a null selector. 201 * We can permit a bogus selector as long as it has USER_RPL. 202 * Null selectors are fine for other segment registers, but 203 * we will never get back to user mode with invalid %cs or %ss 204 * and will take the trap in iret instead. Much code relies 205 * on user_mode() to distinguish a user trap frame (which can 206 * safely use invalid selectors) from a kernel trap frame. 207 */ 208 switch (offset) { 209 case offsetof(struct user_regs_struct, cs): 210 case offsetof(struct user_regs_struct, ss): 211 if (unlikely(value == 0)) 212 return -EIO; 213 214 default: 215 *pt_regs_access(task_pt_regs(task), offset) = value; 216 break; 217 218 case offsetof(struct user_regs_struct, gs): 219 if (task == current) 220 set_user_gs(task_pt_regs(task), value); 221 else 222 task_user_gs(task) = value; 223 } 224 225 return 0; 226 } 227 228 #else /* CONFIG_X86_64 */ 229 230 #define FLAG_MASK (FLAG_MASK_32 | X86_EFLAGS_NT) 231 232 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset) 233 { 234 BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0); 235 return ®s->r15 + (offset / sizeof(regs->r15)); 236 } 237 238 static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 239 { 240 /* 241 * Returning the value truncates it to 16 bits. 242 */ 243 unsigned int seg; 244 245 switch (offset) { 246 case offsetof(struct user_regs_struct, fs): 247 if (task == current) { 248 /* Older gas can't assemble movq %?s,%r?? */ 249 asm("movl %%fs,%0" : "=r" (seg)); 250 return seg; 251 } 252 return task->thread.fsindex; 253 case offsetof(struct user_regs_struct, gs): 254 if (task == current) { 255 asm("movl %%gs,%0" : "=r" (seg)); 256 return seg; 257 } 258 return task->thread.gsindex; 259 case offsetof(struct user_regs_struct, ds): 260 if (task == current) { 261 asm("movl %%ds,%0" : "=r" (seg)); 262 return seg; 263 } 264 return task->thread.ds; 265 case offsetof(struct user_regs_struct, es): 266 if (task == current) { 267 asm("movl %%es,%0" : "=r" (seg)); 268 return seg; 269 } 270 return task->thread.es; 271 272 case offsetof(struct user_regs_struct, cs): 273 case offsetof(struct user_regs_struct, ss): 274 break; 275 } 276 return *pt_regs_access(task_pt_regs(task), offset); 277 } 278 279 static int set_segment_reg(struct task_struct *task, 280 unsigned long offset, u16 value) 281 { 282 /* 283 * The value argument was already truncated to 16 bits. 284 */ 285 if (invalid_selector(value)) 286 return -EIO; 287 288 switch (offset) { 289 case offsetof(struct user_regs_struct,fs): 290 /* 291 * If this is setting fs as for normal 64-bit use but 292 * setting fs_base has implicitly changed it, leave it. 293 */ 294 if ((value == FS_TLS_SEL && task->thread.fsindex == 0 && 295 task->thread.fs != 0) || 296 (value == 0 && task->thread.fsindex == FS_TLS_SEL && 297 task->thread.fs == 0)) 298 break; 299 task->thread.fsindex = value; 300 if (task == current) 301 loadsegment(fs, task->thread.fsindex); 302 break; 303 case offsetof(struct user_regs_struct,gs): 304 /* 305 * If this is setting gs as for normal 64-bit use but 306 * setting gs_base has implicitly changed it, leave it. 307 */ 308 if ((value == GS_TLS_SEL && task->thread.gsindex == 0 && 309 task->thread.gs != 0) || 310 (value == 0 && task->thread.gsindex == GS_TLS_SEL && 311 task->thread.gs == 0)) 312 break; 313 task->thread.gsindex = value; 314 if (task == current) 315 load_gs_index(task->thread.gsindex); 316 break; 317 case offsetof(struct user_regs_struct,ds): 318 task->thread.ds = value; 319 if (task == current) 320 loadsegment(ds, task->thread.ds); 321 break; 322 case offsetof(struct user_regs_struct,es): 323 task->thread.es = value; 324 if (task == current) 325 loadsegment(es, task->thread.es); 326 break; 327 328 /* 329 * Can't actually change these in 64-bit mode. 330 */ 331 case offsetof(struct user_regs_struct,cs): 332 if (unlikely(value == 0)) 333 return -EIO; 334 #ifdef CONFIG_IA32_EMULATION 335 if (test_tsk_thread_flag(task, TIF_IA32)) 336 task_pt_regs(task)->cs = value; 337 #endif 338 break; 339 case offsetof(struct user_regs_struct,ss): 340 if (unlikely(value == 0)) 341 return -EIO; 342 #ifdef CONFIG_IA32_EMULATION 343 if (test_tsk_thread_flag(task, TIF_IA32)) 344 task_pt_regs(task)->ss = value; 345 #endif 346 break; 347 } 348 349 return 0; 350 } 351 352 #endif /* CONFIG_X86_32 */ 353 354 static unsigned long get_flags(struct task_struct *task) 355 { 356 unsigned long retval = task_pt_regs(task)->flags; 357 358 /* 359 * If the debugger set TF, hide it from the readout. 360 */ 361 if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 362 retval &= ~X86_EFLAGS_TF; 363 364 return retval; 365 } 366 367 static int set_flags(struct task_struct *task, unsigned long value) 368 { 369 struct pt_regs *regs = task_pt_regs(task); 370 371 /* 372 * If the user value contains TF, mark that 373 * it was not "us" (the debugger) that set it. 374 * If not, make sure it stays set if we had. 375 */ 376 if (value & X86_EFLAGS_TF) 377 clear_tsk_thread_flag(task, TIF_FORCED_TF); 378 else if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 379 value |= X86_EFLAGS_TF; 380 381 regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK); 382 383 return 0; 384 } 385 386 static int putreg(struct task_struct *child, 387 unsigned long offset, unsigned long value) 388 { 389 switch (offset) { 390 case offsetof(struct user_regs_struct, cs): 391 case offsetof(struct user_regs_struct, ds): 392 case offsetof(struct user_regs_struct, es): 393 case offsetof(struct user_regs_struct, fs): 394 case offsetof(struct user_regs_struct, gs): 395 case offsetof(struct user_regs_struct, ss): 396 return set_segment_reg(child, offset, value); 397 398 case offsetof(struct user_regs_struct, flags): 399 return set_flags(child, value); 400 401 #ifdef CONFIG_X86_64 402 case offsetof(struct user_regs_struct,fs_base): 403 if (value >= TASK_SIZE_OF(child)) 404 return -EIO; 405 /* 406 * When changing the segment base, use do_arch_prctl 407 * to set either thread.fs or thread.fsindex and the 408 * corresponding GDT slot. 409 */ 410 if (child->thread.fs != value) 411 return do_arch_prctl(child, ARCH_SET_FS, value); 412 return 0; 413 case offsetof(struct user_regs_struct,gs_base): 414 /* 415 * Exactly the same here as the %fs handling above. 416 */ 417 if (value >= TASK_SIZE_OF(child)) 418 return -EIO; 419 if (child->thread.gs != value) 420 return do_arch_prctl(child, ARCH_SET_GS, value); 421 return 0; 422 #endif 423 } 424 425 *pt_regs_access(task_pt_regs(child), offset) = value; 426 return 0; 427 } 428 429 static unsigned long getreg(struct task_struct *task, unsigned long offset) 430 { 431 switch (offset) { 432 case offsetof(struct user_regs_struct, cs): 433 case offsetof(struct user_regs_struct, ds): 434 case offsetof(struct user_regs_struct, es): 435 case offsetof(struct user_regs_struct, fs): 436 case offsetof(struct user_regs_struct, gs): 437 case offsetof(struct user_regs_struct, ss): 438 return get_segment_reg(task, offset); 439 440 case offsetof(struct user_regs_struct, flags): 441 return get_flags(task); 442 443 #ifdef CONFIG_X86_64 444 case offsetof(struct user_regs_struct, fs_base): { 445 /* 446 * do_arch_prctl may have used a GDT slot instead of 447 * the MSR. To userland, it appears the same either 448 * way, except the %fs segment selector might not be 0. 449 */ 450 unsigned int seg = task->thread.fsindex; 451 if (task->thread.fs != 0) 452 return task->thread.fs; 453 if (task == current) 454 asm("movl %%fs,%0" : "=r" (seg)); 455 if (seg != FS_TLS_SEL) 456 return 0; 457 return get_desc_base(&task->thread.tls_array[FS_TLS]); 458 } 459 case offsetof(struct user_regs_struct, gs_base): { 460 /* 461 * Exactly the same here as the %fs handling above. 462 */ 463 unsigned int seg = task->thread.gsindex; 464 if (task->thread.gs != 0) 465 return task->thread.gs; 466 if (task == current) 467 asm("movl %%gs,%0" : "=r" (seg)); 468 if (seg != GS_TLS_SEL) 469 return 0; 470 return get_desc_base(&task->thread.tls_array[GS_TLS]); 471 } 472 #endif 473 } 474 475 return *pt_regs_access(task_pt_regs(task), offset); 476 } 477 478 static int genregs_get(struct task_struct *target, 479 const struct user_regset *regset, 480 unsigned int pos, unsigned int count, 481 void *kbuf, void __user *ubuf) 482 { 483 if (kbuf) { 484 unsigned long *k = kbuf; 485 while (count >= sizeof(*k)) { 486 *k++ = getreg(target, pos); 487 count -= sizeof(*k); 488 pos += sizeof(*k); 489 } 490 } else { 491 unsigned long __user *u = ubuf; 492 while (count >= sizeof(*u)) { 493 if (__put_user(getreg(target, pos), u++)) 494 return -EFAULT; 495 count -= sizeof(*u); 496 pos += sizeof(*u); 497 } 498 } 499 500 return 0; 501 } 502 503 static int genregs_set(struct task_struct *target, 504 const struct user_regset *regset, 505 unsigned int pos, unsigned int count, 506 const void *kbuf, const void __user *ubuf) 507 { 508 int ret = 0; 509 if (kbuf) { 510 const unsigned long *k = kbuf; 511 while (count >= sizeof(*k) && !ret) { 512 ret = putreg(target, pos, *k++); 513 count -= sizeof(*k); 514 pos += sizeof(*k); 515 } 516 } else { 517 const unsigned long __user *u = ubuf; 518 while (count >= sizeof(*u) && !ret) { 519 unsigned long word; 520 ret = __get_user(word, u++); 521 if (ret) 522 break; 523 ret = putreg(target, pos, word); 524 count -= sizeof(*u); 525 pos += sizeof(*u); 526 } 527 } 528 return ret; 529 } 530 531 static void ptrace_triggered(struct perf_event *bp, int nmi, 532 struct perf_sample_data *data, 533 struct pt_regs *regs) 534 { 535 int i; 536 struct thread_struct *thread = &(current->thread); 537 538 /* 539 * Store in the virtual DR6 register the fact that the breakpoint 540 * was hit so the thread's debugger will see it. 541 */ 542 for (i = 0; i < HBP_NUM; i++) { 543 if (thread->ptrace_bps[i] == bp) 544 break; 545 } 546 547 thread->debugreg6 |= (DR_TRAP0 << i); 548 } 549 550 /* 551 * Walk through every ptrace breakpoints for this thread and 552 * build the dr7 value on top of their attributes. 553 * 554 */ 555 static unsigned long ptrace_get_dr7(struct perf_event *bp[]) 556 { 557 int i; 558 int dr7 = 0; 559 struct arch_hw_breakpoint *info; 560 561 for (i = 0; i < HBP_NUM; i++) { 562 if (bp[i] && !bp[i]->attr.disabled) { 563 info = counter_arch_bp(bp[i]); 564 dr7 |= encode_dr7(i, info->len, info->type); 565 } 566 } 567 568 return dr7; 569 } 570 571 static int 572 ptrace_modify_breakpoint(struct perf_event *bp, int len, int type, 573 struct task_struct *tsk, int disabled) 574 { 575 int err; 576 int gen_len, gen_type; 577 struct perf_event_attr attr; 578 579 /* 580 * We should have at least an inactive breakpoint at this 581 * slot. It means the user is writing dr7 without having 582 * written the address register first 583 */ 584 if (!bp) 585 return -EINVAL; 586 587 err = arch_bp_generic_fields(len, type, &gen_len, &gen_type); 588 if (err) 589 return err; 590 591 attr = bp->attr; 592 attr.bp_len = gen_len; 593 attr.bp_type = gen_type; 594 attr.disabled = disabled; 595 596 return modify_user_hw_breakpoint(bp, &attr); 597 } 598 599 /* 600 * Handle ptrace writes to debug register 7. 601 */ 602 static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data) 603 { 604 struct thread_struct *thread = &(tsk->thread); 605 unsigned long old_dr7; 606 int i, orig_ret = 0, rc = 0; 607 int enabled, second_pass = 0; 608 unsigned len, type; 609 struct perf_event *bp; 610 611 if (ptrace_get_breakpoints(tsk) < 0) 612 return -ESRCH; 613 614 data &= ~DR_CONTROL_RESERVED; 615 old_dr7 = ptrace_get_dr7(thread->ptrace_bps); 616 restore: 617 /* 618 * Loop through all the hardware breakpoints, making the 619 * appropriate changes to each. 620 */ 621 for (i = 0; i < HBP_NUM; i++) { 622 enabled = decode_dr7(data, i, &len, &type); 623 bp = thread->ptrace_bps[i]; 624 625 if (!enabled) { 626 if (bp) { 627 /* 628 * Don't unregister the breakpoints right-away, 629 * unless all register_user_hw_breakpoint() 630 * requests have succeeded. This prevents 631 * any window of opportunity for debug 632 * register grabbing by other users. 633 */ 634 if (!second_pass) 635 continue; 636 637 rc = ptrace_modify_breakpoint(bp, len, type, 638 tsk, 1); 639 if (rc) 640 break; 641 } 642 continue; 643 } 644 645 rc = ptrace_modify_breakpoint(bp, len, type, tsk, 0); 646 if (rc) 647 break; 648 } 649 /* 650 * Make a second pass to free the remaining unused breakpoints 651 * or to restore the original breakpoints if an error occurred. 652 */ 653 if (!second_pass) { 654 second_pass = 1; 655 if (rc < 0) { 656 orig_ret = rc; 657 data = old_dr7; 658 } 659 goto restore; 660 } 661 662 ptrace_put_breakpoints(tsk); 663 664 return ((orig_ret < 0) ? orig_ret : rc); 665 } 666 667 /* 668 * Handle PTRACE_PEEKUSR calls for the debug register area. 669 */ 670 static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n) 671 { 672 struct thread_struct *thread = &(tsk->thread); 673 unsigned long val = 0; 674 675 if (n < HBP_NUM) { 676 struct perf_event *bp; 677 678 if (ptrace_get_breakpoints(tsk) < 0) 679 return -ESRCH; 680 681 bp = thread->ptrace_bps[n]; 682 if (!bp) 683 val = 0; 684 else 685 val = bp->hw.info.address; 686 687 ptrace_put_breakpoints(tsk); 688 } else if (n == 6) { 689 val = thread->debugreg6; 690 } else if (n == 7) { 691 val = thread->ptrace_dr7; 692 } 693 return val; 694 } 695 696 static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr, 697 unsigned long addr) 698 { 699 struct perf_event *bp; 700 struct thread_struct *t = &tsk->thread; 701 struct perf_event_attr attr; 702 int err = 0; 703 704 if (ptrace_get_breakpoints(tsk) < 0) 705 return -ESRCH; 706 707 if (!t->ptrace_bps[nr]) { 708 ptrace_breakpoint_init(&attr); 709 /* 710 * Put stub len and type to register (reserve) an inactive but 711 * correct bp 712 */ 713 attr.bp_addr = addr; 714 attr.bp_len = HW_BREAKPOINT_LEN_1; 715 attr.bp_type = HW_BREAKPOINT_W; 716 attr.disabled = 1; 717 718 bp = register_user_hw_breakpoint(&attr, ptrace_triggered, tsk); 719 720 /* 721 * CHECKME: the previous code returned -EIO if the addr wasn't 722 * a valid task virtual addr. The new one will return -EINVAL in 723 * this case. 724 * -EINVAL may be what we want for in-kernel breakpoints users, 725 * but -EIO looks better for ptrace, since we refuse a register 726 * writing for the user. And anyway this is the previous 727 * behaviour. 728 */ 729 if (IS_ERR(bp)) { 730 err = PTR_ERR(bp); 731 goto put; 732 } 733 734 t->ptrace_bps[nr] = bp; 735 } else { 736 bp = t->ptrace_bps[nr]; 737 738 attr = bp->attr; 739 attr.bp_addr = addr; 740 err = modify_user_hw_breakpoint(bp, &attr); 741 } 742 743 put: 744 ptrace_put_breakpoints(tsk); 745 return err; 746 } 747 748 /* 749 * Handle PTRACE_POKEUSR calls for the debug register area. 750 */ 751 int ptrace_set_debugreg(struct task_struct *tsk, int n, unsigned long val) 752 { 753 struct thread_struct *thread = &(tsk->thread); 754 int rc = 0; 755 756 /* There are no DR4 or DR5 registers */ 757 if (n == 4 || n == 5) 758 return -EIO; 759 760 if (n == 6) { 761 thread->debugreg6 = val; 762 goto ret_path; 763 } 764 if (n < HBP_NUM) { 765 rc = ptrace_set_breakpoint_addr(tsk, n, val); 766 if (rc) 767 return rc; 768 } 769 /* All that's left is DR7 */ 770 if (n == 7) { 771 rc = ptrace_write_dr7(tsk, val); 772 if (!rc) 773 thread->ptrace_dr7 = val; 774 } 775 776 ret_path: 777 return rc; 778 } 779 780 /* 781 * These access the current or another (stopped) task's io permission 782 * bitmap for debugging or core dump. 783 */ 784 static int ioperm_active(struct task_struct *target, 785 const struct user_regset *regset) 786 { 787 return target->thread.io_bitmap_max / regset->size; 788 } 789 790 static int ioperm_get(struct task_struct *target, 791 const struct user_regset *regset, 792 unsigned int pos, unsigned int count, 793 void *kbuf, void __user *ubuf) 794 { 795 if (!target->thread.io_bitmap_ptr) 796 return -ENXIO; 797 798 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, 799 target->thread.io_bitmap_ptr, 800 0, IO_BITMAP_BYTES); 801 } 802 803 /* 804 * Called by kernel/ptrace.c when detaching.. 805 * 806 * Make sure the single step bit is not set. 807 */ 808 void ptrace_disable(struct task_struct *child) 809 { 810 user_disable_single_step(child); 811 #ifdef TIF_SYSCALL_EMU 812 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); 813 #endif 814 } 815 816 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 817 static const struct user_regset_view user_x86_32_view; /* Initialized below. */ 818 #endif 819 820 long arch_ptrace(struct task_struct *child, long request, 821 unsigned long addr, unsigned long data) 822 { 823 int ret; 824 unsigned long __user *datap = (unsigned long __user *)data; 825 826 switch (request) { 827 /* read the word at location addr in the USER area. */ 828 case PTRACE_PEEKUSR: { 829 unsigned long tmp; 830 831 ret = -EIO; 832 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user)) 833 break; 834 835 tmp = 0; /* Default return condition */ 836 if (addr < sizeof(struct user_regs_struct)) 837 tmp = getreg(child, addr); 838 else if (addr >= offsetof(struct user, u_debugreg[0]) && 839 addr <= offsetof(struct user, u_debugreg[7])) { 840 addr -= offsetof(struct user, u_debugreg[0]); 841 tmp = ptrace_get_debugreg(child, addr / sizeof(data)); 842 } 843 ret = put_user(tmp, datap); 844 break; 845 } 846 847 case PTRACE_POKEUSR: /* write the word at location addr in the USER area */ 848 ret = -EIO; 849 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user)) 850 break; 851 852 if (addr < sizeof(struct user_regs_struct)) 853 ret = putreg(child, addr, data); 854 else if (addr >= offsetof(struct user, u_debugreg[0]) && 855 addr <= offsetof(struct user, u_debugreg[7])) { 856 addr -= offsetof(struct user, u_debugreg[0]); 857 ret = ptrace_set_debugreg(child, 858 addr / sizeof(data), data); 859 } 860 break; 861 862 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 863 return copy_regset_to_user(child, 864 task_user_regset_view(current), 865 REGSET_GENERAL, 866 0, sizeof(struct user_regs_struct), 867 datap); 868 869 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 870 return copy_regset_from_user(child, 871 task_user_regset_view(current), 872 REGSET_GENERAL, 873 0, sizeof(struct user_regs_struct), 874 datap); 875 876 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 877 return copy_regset_to_user(child, 878 task_user_regset_view(current), 879 REGSET_FP, 880 0, sizeof(struct user_i387_struct), 881 datap); 882 883 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 884 return copy_regset_from_user(child, 885 task_user_regset_view(current), 886 REGSET_FP, 887 0, sizeof(struct user_i387_struct), 888 datap); 889 890 #ifdef CONFIG_X86_32 891 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 892 return copy_regset_to_user(child, &user_x86_32_view, 893 REGSET_XFP, 894 0, sizeof(struct user_fxsr_struct), 895 datap) ? -EIO : 0; 896 897 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 898 return copy_regset_from_user(child, &user_x86_32_view, 899 REGSET_XFP, 900 0, sizeof(struct user_fxsr_struct), 901 datap) ? -EIO : 0; 902 #endif 903 904 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 905 case PTRACE_GET_THREAD_AREA: 906 if ((int) addr < 0) 907 return -EIO; 908 ret = do_get_thread_area(child, addr, 909 (struct user_desc __user *)data); 910 break; 911 912 case PTRACE_SET_THREAD_AREA: 913 if ((int) addr < 0) 914 return -EIO; 915 ret = do_set_thread_area(child, addr, 916 (struct user_desc __user *)data, 0); 917 break; 918 #endif 919 920 #ifdef CONFIG_X86_64 921 /* normal 64bit interface to access TLS data. 922 Works just like arch_prctl, except that the arguments 923 are reversed. */ 924 case PTRACE_ARCH_PRCTL: 925 ret = do_arch_prctl(child, data, addr); 926 break; 927 #endif 928 929 default: 930 ret = ptrace_request(child, request, addr, data); 931 break; 932 } 933 934 return ret; 935 } 936 937 #ifdef CONFIG_IA32_EMULATION 938 939 #include <linux/compat.h> 940 #include <linux/syscalls.h> 941 #include <asm/ia32.h> 942 #include <asm/user32.h> 943 944 #define R32(l,q) \ 945 case offsetof(struct user32, regs.l): \ 946 regs->q = value; break 947 948 #define SEG32(rs) \ 949 case offsetof(struct user32, regs.rs): \ 950 return set_segment_reg(child, \ 951 offsetof(struct user_regs_struct, rs), \ 952 value); \ 953 break 954 955 static int putreg32(struct task_struct *child, unsigned regno, u32 value) 956 { 957 struct pt_regs *regs = task_pt_regs(child); 958 959 switch (regno) { 960 961 SEG32(cs); 962 SEG32(ds); 963 SEG32(es); 964 SEG32(fs); 965 SEG32(gs); 966 SEG32(ss); 967 968 R32(ebx, bx); 969 R32(ecx, cx); 970 R32(edx, dx); 971 R32(edi, di); 972 R32(esi, si); 973 R32(ebp, bp); 974 R32(eax, ax); 975 R32(eip, ip); 976 R32(esp, sp); 977 978 case offsetof(struct user32, regs.orig_eax): 979 /* 980 * A 32-bit debugger setting orig_eax means to restore 981 * the state of the task restarting a 32-bit syscall. 982 * Make sure we interpret the -ERESTART* codes correctly 983 * in case the task is not actually still sitting at the 984 * exit from a 32-bit syscall with TS_COMPAT still set. 985 */ 986 regs->orig_ax = value; 987 if (syscall_get_nr(child, regs) >= 0) 988 task_thread_info(child)->status |= TS_COMPAT; 989 break; 990 991 case offsetof(struct user32, regs.eflags): 992 return set_flags(child, value); 993 994 case offsetof(struct user32, u_debugreg[0]) ... 995 offsetof(struct user32, u_debugreg[7]): 996 regno -= offsetof(struct user32, u_debugreg[0]); 997 return ptrace_set_debugreg(child, regno / 4, value); 998 999 default: 1000 if (regno > sizeof(struct user32) || (regno & 3)) 1001 return -EIO; 1002 1003 /* 1004 * Other dummy fields in the virtual user structure 1005 * are ignored 1006 */ 1007 break; 1008 } 1009 return 0; 1010 } 1011 1012 #undef R32 1013 #undef SEG32 1014 1015 #define R32(l,q) \ 1016 case offsetof(struct user32, regs.l): \ 1017 *val = regs->q; break 1018 1019 #define SEG32(rs) \ 1020 case offsetof(struct user32, regs.rs): \ 1021 *val = get_segment_reg(child, \ 1022 offsetof(struct user_regs_struct, rs)); \ 1023 break 1024 1025 static int getreg32(struct task_struct *child, unsigned regno, u32 *val) 1026 { 1027 struct pt_regs *regs = task_pt_regs(child); 1028 1029 switch (regno) { 1030 1031 SEG32(ds); 1032 SEG32(es); 1033 SEG32(fs); 1034 SEG32(gs); 1035 1036 R32(cs, cs); 1037 R32(ss, ss); 1038 R32(ebx, bx); 1039 R32(ecx, cx); 1040 R32(edx, dx); 1041 R32(edi, di); 1042 R32(esi, si); 1043 R32(ebp, bp); 1044 R32(eax, ax); 1045 R32(orig_eax, orig_ax); 1046 R32(eip, ip); 1047 R32(esp, sp); 1048 1049 case offsetof(struct user32, regs.eflags): 1050 *val = get_flags(child); 1051 break; 1052 1053 case offsetof(struct user32, u_debugreg[0]) ... 1054 offsetof(struct user32, u_debugreg[7]): 1055 regno -= offsetof(struct user32, u_debugreg[0]); 1056 *val = ptrace_get_debugreg(child, regno / 4); 1057 break; 1058 1059 default: 1060 if (regno > sizeof(struct user32) || (regno & 3)) 1061 return -EIO; 1062 1063 /* 1064 * Other dummy fields in the virtual user structure 1065 * are ignored 1066 */ 1067 *val = 0; 1068 break; 1069 } 1070 return 0; 1071 } 1072 1073 #undef R32 1074 #undef SEG32 1075 1076 static int genregs32_get(struct task_struct *target, 1077 const struct user_regset *regset, 1078 unsigned int pos, unsigned int count, 1079 void *kbuf, void __user *ubuf) 1080 { 1081 if (kbuf) { 1082 compat_ulong_t *k = kbuf; 1083 while (count >= sizeof(*k)) { 1084 getreg32(target, pos, k++); 1085 count -= sizeof(*k); 1086 pos += sizeof(*k); 1087 } 1088 } else { 1089 compat_ulong_t __user *u = ubuf; 1090 while (count >= sizeof(*u)) { 1091 compat_ulong_t word; 1092 getreg32(target, pos, &word); 1093 if (__put_user(word, u++)) 1094 return -EFAULT; 1095 count -= sizeof(*u); 1096 pos += sizeof(*u); 1097 } 1098 } 1099 1100 return 0; 1101 } 1102 1103 static int genregs32_set(struct task_struct *target, 1104 const struct user_regset *regset, 1105 unsigned int pos, unsigned int count, 1106 const void *kbuf, const void __user *ubuf) 1107 { 1108 int ret = 0; 1109 if (kbuf) { 1110 const compat_ulong_t *k = kbuf; 1111 while (count >= sizeof(*k) && !ret) { 1112 ret = putreg32(target, pos, *k++); 1113 count -= sizeof(*k); 1114 pos += sizeof(*k); 1115 } 1116 } else { 1117 const compat_ulong_t __user *u = ubuf; 1118 while (count >= sizeof(*u) && !ret) { 1119 compat_ulong_t word; 1120 ret = __get_user(word, u++); 1121 if (ret) 1122 break; 1123 ret = putreg32(target, pos, word); 1124 count -= sizeof(*u); 1125 pos += sizeof(*u); 1126 } 1127 } 1128 return ret; 1129 } 1130 1131 long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 1132 compat_ulong_t caddr, compat_ulong_t cdata) 1133 { 1134 unsigned long addr = caddr; 1135 unsigned long data = cdata; 1136 void __user *datap = compat_ptr(data); 1137 int ret; 1138 __u32 val; 1139 1140 switch (request) { 1141 case PTRACE_PEEKUSR: 1142 ret = getreg32(child, addr, &val); 1143 if (ret == 0) 1144 ret = put_user(val, (__u32 __user *)datap); 1145 break; 1146 1147 case PTRACE_POKEUSR: 1148 ret = putreg32(child, addr, data); 1149 break; 1150 1151 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 1152 return copy_regset_to_user(child, &user_x86_32_view, 1153 REGSET_GENERAL, 1154 0, sizeof(struct user_regs_struct32), 1155 datap); 1156 1157 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 1158 return copy_regset_from_user(child, &user_x86_32_view, 1159 REGSET_GENERAL, 0, 1160 sizeof(struct user_regs_struct32), 1161 datap); 1162 1163 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 1164 return copy_regset_to_user(child, &user_x86_32_view, 1165 REGSET_FP, 0, 1166 sizeof(struct user_i387_ia32_struct), 1167 datap); 1168 1169 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 1170 return copy_regset_from_user( 1171 child, &user_x86_32_view, REGSET_FP, 1172 0, sizeof(struct user_i387_ia32_struct), datap); 1173 1174 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 1175 return copy_regset_to_user(child, &user_x86_32_view, 1176 REGSET_XFP, 0, 1177 sizeof(struct user32_fxsr_struct), 1178 datap); 1179 1180 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 1181 return copy_regset_from_user(child, &user_x86_32_view, 1182 REGSET_XFP, 0, 1183 sizeof(struct user32_fxsr_struct), 1184 datap); 1185 1186 case PTRACE_GET_THREAD_AREA: 1187 case PTRACE_SET_THREAD_AREA: 1188 return arch_ptrace(child, request, addr, data); 1189 1190 default: 1191 return compat_ptrace_request(child, request, addr, data); 1192 } 1193 1194 return ret; 1195 } 1196 1197 #endif /* CONFIG_IA32_EMULATION */ 1198 1199 #ifdef CONFIG_X86_64 1200 1201 static struct user_regset x86_64_regsets[] __read_mostly = { 1202 [REGSET_GENERAL] = { 1203 .core_note_type = NT_PRSTATUS, 1204 .n = sizeof(struct user_regs_struct) / sizeof(long), 1205 .size = sizeof(long), .align = sizeof(long), 1206 .get = genregs_get, .set = genregs_set 1207 }, 1208 [REGSET_FP] = { 1209 .core_note_type = NT_PRFPREG, 1210 .n = sizeof(struct user_i387_struct) / sizeof(long), 1211 .size = sizeof(long), .align = sizeof(long), 1212 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set 1213 }, 1214 [REGSET_XSTATE] = { 1215 .core_note_type = NT_X86_XSTATE, 1216 .size = sizeof(u64), .align = sizeof(u64), 1217 .active = xstateregs_active, .get = xstateregs_get, 1218 .set = xstateregs_set 1219 }, 1220 [REGSET_IOPERM64] = { 1221 .core_note_type = NT_386_IOPERM, 1222 .n = IO_BITMAP_LONGS, 1223 .size = sizeof(long), .align = sizeof(long), 1224 .active = ioperm_active, .get = ioperm_get 1225 }, 1226 }; 1227 1228 static const struct user_regset_view user_x86_64_view = { 1229 .name = "x86_64", .e_machine = EM_X86_64, 1230 .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets) 1231 }; 1232 1233 #else /* CONFIG_X86_32 */ 1234 1235 #define user_regs_struct32 user_regs_struct 1236 #define genregs32_get genregs_get 1237 #define genregs32_set genregs_set 1238 1239 #define user_i387_ia32_struct user_i387_struct 1240 #define user32_fxsr_struct user_fxsr_struct 1241 1242 #endif /* CONFIG_X86_64 */ 1243 1244 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1245 static struct user_regset x86_32_regsets[] __read_mostly = { 1246 [REGSET_GENERAL] = { 1247 .core_note_type = NT_PRSTATUS, 1248 .n = sizeof(struct user_regs_struct32) / sizeof(u32), 1249 .size = sizeof(u32), .align = sizeof(u32), 1250 .get = genregs32_get, .set = genregs32_set 1251 }, 1252 [REGSET_FP] = { 1253 .core_note_type = NT_PRFPREG, 1254 .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32), 1255 .size = sizeof(u32), .align = sizeof(u32), 1256 .active = fpregs_active, .get = fpregs_get, .set = fpregs_set 1257 }, 1258 [REGSET_XFP] = { 1259 .core_note_type = NT_PRXFPREG, 1260 .n = sizeof(struct user32_fxsr_struct) / sizeof(u32), 1261 .size = sizeof(u32), .align = sizeof(u32), 1262 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set 1263 }, 1264 [REGSET_XSTATE] = { 1265 .core_note_type = NT_X86_XSTATE, 1266 .size = sizeof(u64), .align = sizeof(u64), 1267 .active = xstateregs_active, .get = xstateregs_get, 1268 .set = xstateregs_set 1269 }, 1270 [REGSET_TLS] = { 1271 .core_note_type = NT_386_TLS, 1272 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN, 1273 .size = sizeof(struct user_desc), 1274 .align = sizeof(struct user_desc), 1275 .active = regset_tls_active, 1276 .get = regset_tls_get, .set = regset_tls_set 1277 }, 1278 [REGSET_IOPERM32] = { 1279 .core_note_type = NT_386_IOPERM, 1280 .n = IO_BITMAP_BYTES / sizeof(u32), 1281 .size = sizeof(u32), .align = sizeof(u32), 1282 .active = ioperm_active, .get = ioperm_get 1283 }, 1284 }; 1285 1286 static const struct user_regset_view user_x86_32_view = { 1287 .name = "i386", .e_machine = EM_386, 1288 .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets) 1289 }; 1290 #endif 1291 1292 /* 1293 * This represents bytes 464..511 in the memory layout exported through 1294 * the REGSET_XSTATE interface. 1295 */ 1296 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS]; 1297 1298 void update_regset_xstate_info(unsigned int size, u64 xstate_mask) 1299 { 1300 #ifdef CONFIG_X86_64 1301 x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1302 #endif 1303 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1304 x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1305 #endif 1306 xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask; 1307 } 1308 1309 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 1310 { 1311 #ifdef CONFIG_IA32_EMULATION 1312 if (test_tsk_thread_flag(task, TIF_IA32)) 1313 #endif 1314 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1315 return &user_x86_32_view; 1316 #endif 1317 #ifdef CONFIG_X86_64 1318 return &user_x86_64_view; 1319 #endif 1320 } 1321 1322 static void fill_sigtrap_info(struct task_struct *tsk, 1323 struct pt_regs *regs, 1324 int error_code, int si_code, 1325 struct siginfo *info) 1326 { 1327 tsk->thread.trap_no = 1; 1328 tsk->thread.error_code = error_code; 1329 1330 memset(info, 0, sizeof(*info)); 1331 info->si_signo = SIGTRAP; 1332 info->si_code = si_code; 1333 info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL; 1334 } 1335 1336 void user_single_step_siginfo(struct task_struct *tsk, 1337 struct pt_regs *regs, 1338 struct siginfo *info) 1339 { 1340 fill_sigtrap_info(tsk, regs, 0, TRAP_BRKPT, info); 1341 } 1342 1343 void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, 1344 int error_code, int si_code) 1345 { 1346 struct siginfo info; 1347 1348 fill_sigtrap_info(tsk, regs, error_code, si_code, &info); 1349 /* Send us the fake SIGTRAP */ 1350 force_sig_info(SIGTRAP, &info, tsk); 1351 } 1352 1353 1354 #ifdef CONFIG_X86_32 1355 # define IS_IA32 1 1356 #elif defined CONFIG_IA32_EMULATION 1357 # define IS_IA32 is_compat_task() 1358 #else 1359 # define IS_IA32 0 1360 #endif 1361 1362 /* 1363 * We must return the syscall number to actually look up in the table. 1364 * This can be -1L to skip running any syscall at all. 1365 */ 1366 long syscall_trace_enter(struct pt_regs *regs) 1367 { 1368 long ret = 0; 1369 1370 /* 1371 * If we stepped into a sysenter/syscall insn, it trapped in 1372 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP. 1373 * If user-mode had set TF itself, then it's still clear from 1374 * do_debug() and we need to set it again to restore the user 1375 * state. If we entered on the slow path, TF was already set. 1376 */ 1377 if (test_thread_flag(TIF_SINGLESTEP)) 1378 regs->flags |= X86_EFLAGS_TF; 1379 1380 /* do the secure computing check first */ 1381 secure_computing(regs->orig_ax); 1382 1383 if (unlikely(test_thread_flag(TIF_SYSCALL_EMU))) 1384 ret = -1L; 1385 1386 if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) && 1387 tracehook_report_syscall_entry(regs)) 1388 ret = -1L; 1389 1390 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 1391 trace_sys_enter(regs, regs->orig_ax); 1392 1393 if (unlikely(current->audit_context)) { 1394 if (IS_IA32) 1395 audit_syscall_entry(AUDIT_ARCH_I386, 1396 regs->orig_ax, 1397 regs->bx, regs->cx, 1398 regs->dx, regs->si); 1399 #ifdef CONFIG_X86_64 1400 else 1401 audit_syscall_entry(AUDIT_ARCH_X86_64, 1402 regs->orig_ax, 1403 regs->di, regs->si, 1404 regs->dx, regs->r10); 1405 #endif 1406 } 1407 1408 return ret ?: regs->orig_ax; 1409 } 1410 1411 void syscall_trace_leave(struct pt_regs *regs) 1412 { 1413 bool step; 1414 1415 if (unlikely(current->audit_context)) 1416 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax); 1417 1418 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 1419 trace_sys_exit(regs, regs->ax); 1420 1421 /* 1422 * If TIF_SYSCALL_EMU is set, we only get here because of 1423 * TIF_SINGLESTEP (i.e. this is PTRACE_SYSEMU_SINGLESTEP). 1424 * We already reported this syscall instruction in 1425 * syscall_trace_enter(). 1426 */ 1427 step = unlikely(test_thread_flag(TIF_SINGLESTEP)) && 1428 !test_thread_flag(TIF_SYSCALL_EMU); 1429 if (step || test_thread_flag(TIF_SYSCALL_TRACE)) 1430 tracehook_report_syscall_exit(regs, step); 1431 } 1432