1 /* By Ross Biro 1/23/92 */ 2 /* 3 * Pentium III FXSR, SSE support 4 * Gareth Hughes <gareth@valinux.com>, May 2000 5 */ 6 7 #include <linux/kernel.h> 8 #include <linux/sched.h> 9 #include <linux/mm.h> 10 #include <linux/smp.h> 11 #include <linux/errno.h> 12 #include <linux/slab.h> 13 #include <linux/ptrace.h> 14 #include <linux/regset.h> 15 #include <linux/tracehook.h> 16 #include <linux/user.h> 17 #include <linux/elf.h> 18 #include <linux/security.h> 19 #include <linux/audit.h> 20 #include <linux/seccomp.h> 21 #include <linux/signal.h> 22 #include <linux/perf_event.h> 23 #include <linux/hw_breakpoint.h> 24 25 #include <asm/uaccess.h> 26 #include <asm/pgtable.h> 27 #include <asm/system.h> 28 #include <asm/processor.h> 29 #include <asm/i387.h> 30 #include <asm/debugreg.h> 31 #include <asm/ldt.h> 32 #include <asm/desc.h> 33 #include <asm/prctl.h> 34 #include <asm/proto.h> 35 #include <asm/hw_breakpoint.h> 36 37 #include "tls.h" 38 39 #define CREATE_TRACE_POINTS 40 #include <trace/events/syscalls.h> 41 42 enum x86_regset { 43 REGSET_GENERAL, 44 REGSET_FP, 45 REGSET_XFP, 46 REGSET_IOPERM64 = REGSET_XFP, 47 REGSET_XSTATE, 48 REGSET_TLS, 49 REGSET_IOPERM32, 50 }; 51 52 struct pt_regs_offset { 53 const char *name; 54 int offset; 55 }; 56 57 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 58 #define REG_OFFSET_END {.name = NULL, .offset = 0} 59 60 static const struct pt_regs_offset regoffset_table[] = { 61 #ifdef CONFIG_X86_64 62 REG_OFFSET_NAME(r15), 63 REG_OFFSET_NAME(r14), 64 REG_OFFSET_NAME(r13), 65 REG_OFFSET_NAME(r12), 66 REG_OFFSET_NAME(r11), 67 REG_OFFSET_NAME(r10), 68 REG_OFFSET_NAME(r9), 69 REG_OFFSET_NAME(r8), 70 #endif 71 REG_OFFSET_NAME(bx), 72 REG_OFFSET_NAME(cx), 73 REG_OFFSET_NAME(dx), 74 REG_OFFSET_NAME(si), 75 REG_OFFSET_NAME(di), 76 REG_OFFSET_NAME(bp), 77 REG_OFFSET_NAME(ax), 78 #ifdef CONFIG_X86_32 79 REG_OFFSET_NAME(ds), 80 REG_OFFSET_NAME(es), 81 REG_OFFSET_NAME(fs), 82 REG_OFFSET_NAME(gs), 83 #endif 84 REG_OFFSET_NAME(orig_ax), 85 REG_OFFSET_NAME(ip), 86 REG_OFFSET_NAME(cs), 87 REG_OFFSET_NAME(flags), 88 REG_OFFSET_NAME(sp), 89 REG_OFFSET_NAME(ss), 90 REG_OFFSET_END, 91 }; 92 93 /** 94 * regs_query_register_offset() - query register offset from its name 95 * @name: the name of a register 96 * 97 * regs_query_register_offset() returns the offset of a register in struct 98 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 99 */ 100 int regs_query_register_offset(const char *name) 101 { 102 const struct pt_regs_offset *roff; 103 for (roff = regoffset_table; roff->name != NULL; roff++) 104 if (!strcmp(roff->name, name)) 105 return roff->offset; 106 return -EINVAL; 107 } 108 109 /** 110 * regs_query_register_name() - query register name from its offset 111 * @offset: the offset of a register in struct pt_regs. 112 * 113 * regs_query_register_name() returns the name of a register from its 114 * offset in struct pt_regs. If the @offset is invalid, this returns NULL; 115 */ 116 const char *regs_query_register_name(unsigned int offset) 117 { 118 const struct pt_regs_offset *roff; 119 for (roff = regoffset_table; roff->name != NULL; roff++) 120 if (roff->offset == offset) 121 return roff->name; 122 return NULL; 123 } 124 125 static const int arg_offs_table[] = { 126 #ifdef CONFIG_X86_32 127 [0] = offsetof(struct pt_regs, ax), 128 [1] = offsetof(struct pt_regs, dx), 129 [2] = offsetof(struct pt_regs, cx) 130 #else /* CONFIG_X86_64 */ 131 [0] = offsetof(struct pt_regs, di), 132 [1] = offsetof(struct pt_regs, si), 133 [2] = offsetof(struct pt_regs, dx), 134 [3] = offsetof(struct pt_regs, cx), 135 [4] = offsetof(struct pt_regs, r8), 136 [5] = offsetof(struct pt_regs, r9) 137 #endif 138 }; 139 140 /* 141 * does not yet catch signals sent when the child dies. 142 * in exit.c or in signal.c. 143 */ 144 145 /* 146 * Determines which flags the user has access to [1 = access, 0 = no access]. 147 */ 148 #define FLAG_MASK_32 ((unsigned long) \ 149 (X86_EFLAGS_CF | X86_EFLAGS_PF | \ 150 X86_EFLAGS_AF | X86_EFLAGS_ZF | \ 151 X86_EFLAGS_SF | X86_EFLAGS_TF | \ 152 X86_EFLAGS_DF | X86_EFLAGS_OF | \ 153 X86_EFLAGS_RF | X86_EFLAGS_AC)) 154 155 /* 156 * Determines whether a value may be installed in a segment register. 157 */ 158 static inline bool invalid_selector(u16 value) 159 { 160 return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL); 161 } 162 163 #ifdef CONFIG_X86_32 164 165 #define FLAG_MASK FLAG_MASK_32 166 167 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno) 168 { 169 BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0); 170 return ®s->bx + (regno >> 2); 171 } 172 173 static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 174 { 175 /* 176 * Returning the value truncates it to 16 bits. 177 */ 178 unsigned int retval; 179 if (offset != offsetof(struct user_regs_struct, gs)) 180 retval = *pt_regs_access(task_pt_regs(task), offset); 181 else { 182 if (task == current) 183 retval = get_user_gs(task_pt_regs(task)); 184 else 185 retval = task_user_gs(task); 186 } 187 return retval; 188 } 189 190 static int set_segment_reg(struct task_struct *task, 191 unsigned long offset, u16 value) 192 { 193 /* 194 * The value argument was already truncated to 16 bits. 195 */ 196 if (invalid_selector(value)) 197 return -EIO; 198 199 /* 200 * For %cs and %ss we cannot permit a null selector. 201 * We can permit a bogus selector as long as it has USER_RPL. 202 * Null selectors are fine for other segment registers, but 203 * we will never get back to user mode with invalid %cs or %ss 204 * and will take the trap in iret instead. Much code relies 205 * on user_mode() to distinguish a user trap frame (which can 206 * safely use invalid selectors) from a kernel trap frame. 207 */ 208 switch (offset) { 209 case offsetof(struct user_regs_struct, cs): 210 case offsetof(struct user_regs_struct, ss): 211 if (unlikely(value == 0)) 212 return -EIO; 213 214 default: 215 *pt_regs_access(task_pt_regs(task), offset) = value; 216 break; 217 218 case offsetof(struct user_regs_struct, gs): 219 if (task == current) 220 set_user_gs(task_pt_regs(task), value); 221 else 222 task_user_gs(task) = value; 223 } 224 225 return 0; 226 } 227 228 #else /* CONFIG_X86_64 */ 229 230 #define FLAG_MASK (FLAG_MASK_32 | X86_EFLAGS_NT) 231 232 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset) 233 { 234 BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0); 235 return ®s->r15 + (offset / sizeof(regs->r15)); 236 } 237 238 static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 239 { 240 /* 241 * Returning the value truncates it to 16 bits. 242 */ 243 unsigned int seg; 244 245 switch (offset) { 246 case offsetof(struct user_regs_struct, fs): 247 if (task == current) { 248 /* Older gas can't assemble movq %?s,%r?? */ 249 asm("movl %%fs,%0" : "=r" (seg)); 250 return seg; 251 } 252 return task->thread.fsindex; 253 case offsetof(struct user_regs_struct, gs): 254 if (task == current) { 255 asm("movl %%gs,%0" : "=r" (seg)); 256 return seg; 257 } 258 return task->thread.gsindex; 259 case offsetof(struct user_regs_struct, ds): 260 if (task == current) { 261 asm("movl %%ds,%0" : "=r" (seg)); 262 return seg; 263 } 264 return task->thread.ds; 265 case offsetof(struct user_regs_struct, es): 266 if (task == current) { 267 asm("movl %%es,%0" : "=r" (seg)); 268 return seg; 269 } 270 return task->thread.es; 271 272 case offsetof(struct user_regs_struct, cs): 273 case offsetof(struct user_regs_struct, ss): 274 break; 275 } 276 return *pt_regs_access(task_pt_regs(task), offset); 277 } 278 279 static int set_segment_reg(struct task_struct *task, 280 unsigned long offset, u16 value) 281 { 282 /* 283 * The value argument was already truncated to 16 bits. 284 */ 285 if (invalid_selector(value)) 286 return -EIO; 287 288 switch (offset) { 289 case offsetof(struct user_regs_struct,fs): 290 /* 291 * If this is setting fs as for normal 64-bit use but 292 * setting fs_base has implicitly changed it, leave it. 293 */ 294 if ((value == FS_TLS_SEL && task->thread.fsindex == 0 && 295 task->thread.fs != 0) || 296 (value == 0 && task->thread.fsindex == FS_TLS_SEL && 297 task->thread.fs == 0)) 298 break; 299 task->thread.fsindex = value; 300 if (task == current) 301 loadsegment(fs, task->thread.fsindex); 302 break; 303 case offsetof(struct user_regs_struct,gs): 304 /* 305 * If this is setting gs as for normal 64-bit use but 306 * setting gs_base has implicitly changed it, leave it. 307 */ 308 if ((value == GS_TLS_SEL && task->thread.gsindex == 0 && 309 task->thread.gs != 0) || 310 (value == 0 && task->thread.gsindex == GS_TLS_SEL && 311 task->thread.gs == 0)) 312 break; 313 task->thread.gsindex = value; 314 if (task == current) 315 load_gs_index(task->thread.gsindex); 316 break; 317 case offsetof(struct user_regs_struct,ds): 318 task->thread.ds = value; 319 if (task == current) 320 loadsegment(ds, task->thread.ds); 321 break; 322 case offsetof(struct user_regs_struct,es): 323 task->thread.es = value; 324 if (task == current) 325 loadsegment(es, task->thread.es); 326 break; 327 328 /* 329 * Can't actually change these in 64-bit mode. 330 */ 331 case offsetof(struct user_regs_struct,cs): 332 if (unlikely(value == 0)) 333 return -EIO; 334 #ifdef CONFIG_IA32_EMULATION 335 if (test_tsk_thread_flag(task, TIF_IA32)) 336 task_pt_regs(task)->cs = value; 337 #endif 338 break; 339 case offsetof(struct user_regs_struct,ss): 340 if (unlikely(value == 0)) 341 return -EIO; 342 #ifdef CONFIG_IA32_EMULATION 343 if (test_tsk_thread_flag(task, TIF_IA32)) 344 task_pt_regs(task)->ss = value; 345 #endif 346 break; 347 } 348 349 return 0; 350 } 351 352 #endif /* CONFIG_X86_32 */ 353 354 static unsigned long get_flags(struct task_struct *task) 355 { 356 unsigned long retval = task_pt_regs(task)->flags; 357 358 /* 359 * If the debugger set TF, hide it from the readout. 360 */ 361 if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 362 retval &= ~X86_EFLAGS_TF; 363 364 return retval; 365 } 366 367 static int set_flags(struct task_struct *task, unsigned long value) 368 { 369 struct pt_regs *regs = task_pt_regs(task); 370 371 /* 372 * If the user value contains TF, mark that 373 * it was not "us" (the debugger) that set it. 374 * If not, make sure it stays set if we had. 375 */ 376 if (value & X86_EFLAGS_TF) 377 clear_tsk_thread_flag(task, TIF_FORCED_TF); 378 else if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 379 value |= X86_EFLAGS_TF; 380 381 regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK); 382 383 return 0; 384 } 385 386 static int putreg(struct task_struct *child, 387 unsigned long offset, unsigned long value) 388 { 389 switch (offset) { 390 case offsetof(struct user_regs_struct, cs): 391 case offsetof(struct user_regs_struct, ds): 392 case offsetof(struct user_regs_struct, es): 393 case offsetof(struct user_regs_struct, fs): 394 case offsetof(struct user_regs_struct, gs): 395 case offsetof(struct user_regs_struct, ss): 396 return set_segment_reg(child, offset, value); 397 398 case offsetof(struct user_regs_struct, flags): 399 return set_flags(child, value); 400 401 #ifdef CONFIG_X86_64 402 case offsetof(struct user_regs_struct,fs_base): 403 if (value >= TASK_SIZE_OF(child)) 404 return -EIO; 405 /* 406 * When changing the segment base, use do_arch_prctl 407 * to set either thread.fs or thread.fsindex and the 408 * corresponding GDT slot. 409 */ 410 if (child->thread.fs != value) 411 return do_arch_prctl(child, ARCH_SET_FS, value); 412 return 0; 413 case offsetof(struct user_regs_struct,gs_base): 414 /* 415 * Exactly the same here as the %fs handling above. 416 */ 417 if (value >= TASK_SIZE_OF(child)) 418 return -EIO; 419 if (child->thread.gs != value) 420 return do_arch_prctl(child, ARCH_SET_GS, value); 421 return 0; 422 #endif 423 } 424 425 *pt_regs_access(task_pt_regs(child), offset) = value; 426 return 0; 427 } 428 429 static unsigned long getreg(struct task_struct *task, unsigned long offset) 430 { 431 switch (offset) { 432 case offsetof(struct user_regs_struct, cs): 433 case offsetof(struct user_regs_struct, ds): 434 case offsetof(struct user_regs_struct, es): 435 case offsetof(struct user_regs_struct, fs): 436 case offsetof(struct user_regs_struct, gs): 437 case offsetof(struct user_regs_struct, ss): 438 return get_segment_reg(task, offset); 439 440 case offsetof(struct user_regs_struct, flags): 441 return get_flags(task); 442 443 #ifdef CONFIG_X86_64 444 case offsetof(struct user_regs_struct, fs_base): { 445 /* 446 * do_arch_prctl may have used a GDT slot instead of 447 * the MSR. To userland, it appears the same either 448 * way, except the %fs segment selector might not be 0. 449 */ 450 unsigned int seg = task->thread.fsindex; 451 if (task->thread.fs != 0) 452 return task->thread.fs; 453 if (task == current) 454 asm("movl %%fs,%0" : "=r" (seg)); 455 if (seg != FS_TLS_SEL) 456 return 0; 457 return get_desc_base(&task->thread.tls_array[FS_TLS]); 458 } 459 case offsetof(struct user_regs_struct, gs_base): { 460 /* 461 * Exactly the same here as the %fs handling above. 462 */ 463 unsigned int seg = task->thread.gsindex; 464 if (task->thread.gs != 0) 465 return task->thread.gs; 466 if (task == current) 467 asm("movl %%gs,%0" : "=r" (seg)); 468 if (seg != GS_TLS_SEL) 469 return 0; 470 return get_desc_base(&task->thread.tls_array[GS_TLS]); 471 } 472 #endif 473 } 474 475 return *pt_regs_access(task_pt_regs(task), offset); 476 } 477 478 static int genregs_get(struct task_struct *target, 479 const struct user_regset *regset, 480 unsigned int pos, unsigned int count, 481 void *kbuf, void __user *ubuf) 482 { 483 if (kbuf) { 484 unsigned long *k = kbuf; 485 while (count >= sizeof(*k)) { 486 *k++ = getreg(target, pos); 487 count -= sizeof(*k); 488 pos += sizeof(*k); 489 } 490 } else { 491 unsigned long __user *u = ubuf; 492 while (count >= sizeof(*u)) { 493 if (__put_user(getreg(target, pos), u++)) 494 return -EFAULT; 495 count -= sizeof(*u); 496 pos += sizeof(*u); 497 } 498 } 499 500 return 0; 501 } 502 503 static int genregs_set(struct task_struct *target, 504 const struct user_regset *regset, 505 unsigned int pos, unsigned int count, 506 const void *kbuf, const void __user *ubuf) 507 { 508 int ret = 0; 509 if (kbuf) { 510 const unsigned long *k = kbuf; 511 while (count >= sizeof(*k) && !ret) { 512 ret = putreg(target, pos, *k++); 513 count -= sizeof(*k); 514 pos += sizeof(*k); 515 } 516 } else { 517 const unsigned long __user *u = ubuf; 518 while (count >= sizeof(*u) && !ret) { 519 unsigned long word; 520 ret = __get_user(word, u++); 521 if (ret) 522 break; 523 ret = putreg(target, pos, word); 524 count -= sizeof(*u); 525 pos += sizeof(*u); 526 } 527 } 528 return ret; 529 } 530 531 static void ptrace_triggered(struct perf_event *bp, 532 struct perf_sample_data *data, 533 struct pt_regs *regs) 534 { 535 int i; 536 struct thread_struct *thread = &(current->thread); 537 538 /* 539 * Store in the virtual DR6 register the fact that the breakpoint 540 * was hit so the thread's debugger will see it. 541 */ 542 for (i = 0; i < HBP_NUM; i++) { 543 if (thread->ptrace_bps[i] == bp) 544 break; 545 } 546 547 thread->debugreg6 |= (DR_TRAP0 << i); 548 } 549 550 /* 551 * Walk through every ptrace breakpoints for this thread and 552 * build the dr7 value on top of their attributes. 553 * 554 */ 555 static unsigned long ptrace_get_dr7(struct perf_event *bp[]) 556 { 557 int i; 558 int dr7 = 0; 559 struct arch_hw_breakpoint *info; 560 561 for (i = 0; i < HBP_NUM; i++) { 562 if (bp[i] && !bp[i]->attr.disabled) { 563 info = counter_arch_bp(bp[i]); 564 dr7 |= encode_dr7(i, info->len, info->type); 565 } 566 } 567 568 return dr7; 569 } 570 571 static int 572 ptrace_modify_breakpoint(struct perf_event *bp, int len, int type, 573 struct task_struct *tsk, int disabled) 574 { 575 int err; 576 int gen_len, gen_type; 577 struct perf_event_attr attr; 578 579 /* 580 * We should have at least an inactive breakpoint at this 581 * slot. It means the user is writing dr7 without having 582 * written the address register first 583 */ 584 if (!bp) 585 return -EINVAL; 586 587 err = arch_bp_generic_fields(len, type, &gen_len, &gen_type); 588 if (err) 589 return err; 590 591 attr = bp->attr; 592 attr.bp_len = gen_len; 593 attr.bp_type = gen_type; 594 attr.disabled = disabled; 595 596 return modify_user_hw_breakpoint(bp, &attr); 597 } 598 599 /* 600 * Handle ptrace writes to debug register 7. 601 */ 602 static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data) 603 { 604 struct thread_struct *thread = &(tsk->thread); 605 unsigned long old_dr7; 606 int i, orig_ret = 0, rc = 0; 607 int enabled, second_pass = 0; 608 unsigned len, type; 609 struct perf_event *bp; 610 611 if (ptrace_get_breakpoints(tsk) < 0) 612 return -ESRCH; 613 614 data &= ~DR_CONTROL_RESERVED; 615 old_dr7 = ptrace_get_dr7(thread->ptrace_bps); 616 restore: 617 /* 618 * Loop through all the hardware breakpoints, making the 619 * appropriate changes to each. 620 */ 621 for (i = 0; i < HBP_NUM; i++) { 622 enabled = decode_dr7(data, i, &len, &type); 623 bp = thread->ptrace_bps[i]; 624 625 if (!enabled) { 626 if (bp) { 627 /* 628 * Don't unregister the breakpoints right-away, 629 * unless all register_user_hw_breakpoint() 630 * requests have succeeded. This prevents 631 * any window of opportunity for debug 632 * register grabbing by other users. 633 */ 634 if (!second_pass) 635 continue; 636 637 rc = ptrace_modify_breakpoint(bp, len, type, 638 tsk, 1); 639 if (rc) 640 break; 641 } 642 continue; 643 } 644 645 rc = ptrace_modify_breakpoint(bp, len, type, tsk, 0); 646 if (rc) 647 break; 648 } 649 /* 650 * Make a second pass to free the remaining unused breakpoints 651 * or to restore the original breakpoints if an error occurred. 652 */ 653 if (!second_pass) { 654 second_pass = 1; 655 if (rc < 0) { 656 orig_ret = rc; 657 data = old_dr7; 658 } 659 goto restore; 660 } 661 662 ptrace_put_breakpoints(tsk); 663 664 return ((orig_ret < 0) ? orig_ret : rc); 665 } 666 667 /* 668 * Handle PTRACE_PEEKUSR calls for the debug register area. 669 */ 670 static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n) 671 { 672 struct thread_struct *thread = &(tsk->thread); 673 unsigned long val = 0; 674 675 if (n < HBP_NUM) { 676 struct perf_event *bp; 677 678 if (ptrace_get_breakpoints(tsk) < 0) 679 return -ESRCH; 680 681 bp = thread->ptrace_bps[n]; 682 if (!bp) 683 val = 0; 684 else 685 val = bp->hw.info.address; 686 687 ptrace_put_breakpoints(tsk); 688 } else if (n == 6) { 689 val = thread->debugreg6; 690 } else if (n == 7) { 691 val = thread->ptrace_dr7; 692 } 693 return val; 694 } 695 696 static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr, 697 unsigned long addr) 698 { 699 struct perf_event *bp; 700 struct thread_struct *t = &tsk->thread; 701 struct perf_event_attr attr; 702 int err = 0; 703 704 if (ptrace_get_breakpoints(tsk) < 0) 705 return -ESRCH; 706 707 if (!t->ptrace_bps[nr]) { 708 ptrace_breakpoint_init(&attr); 709 /* 710 * Put stub len and type to register (reserve) an inactive but 711 * correct bp 712 */ 713 attr.bp_addr = addr; 714 attr.bp_len = HW_BREAKPOINT_LEN_1; 715 attr.bp_type = HW_BREAKPOINT_W; 716 attr.disabled = 1; 717 718 bp = register_user_hw_breakpoint(&attr, ptrace_triggered, 719 NULL, tsk); 720 721 /* 722 * CHECKME: the previous code returned -EIO if the addr wasn't 723 * a valid task virtual addr. The new one will return -EINVAL in 724 * this case. 725 * -EINVAL may be what we want for in-kernel breakpoints users, 726 * but -EIO looks better for ptrace, since we refuse a register 727 * writing for the user. And anyway this is the previous 728 * behaviour. 729 */ 730 if (IS_ERR(bp)) { 731 err = PTR_ERR(bp); 732 goto put; 733 } 734 735 t->ptrace_bps[nr] = bp; 736 } else { 737 bp = t->ptrace_bps[nr]; 738 739 attr = bp->attr; 740 attr.bp_addr = addr; 741 err = modify_user_hw_breakpoint(bp, &attr); 742 } 743 744 put: 745 ptrace_put_breakpoints(tsk); 746 return err; 747 } 748 749 /* 750 * Handle PTRACE_POKEUSR calls for the debug register area. 751 */ 752 static int ptrace_set_debugreg(struct task_struct *tsk, int n, 753 unsigned long val) 754 { 755 struct thread_struct *thread = &(tsk->thread); 756 int rc = 0; 757 758 /* There are no DR4 or DR5 registers */ 759 if (n == 4 || n == 5) 760 return -EIO; 761 762 if (n == 6) { 763 thread->debugreg6 = val; 764 goto ret_path; 765 } 766 if (n < HBP_NUM) { 767 rc = ptrace_set_breakpoint_addr(tsk, n, val); 768 if (rc) 769 return rc; 770 } 771 /* All that's left is DR7 */ 772 if (n == 7) { 773 rc = ptrace_write_dr7(tsk, val); 774 if (!rc) 775 thread->ptrace_dr7 = val; 776 } 777 778 ret_path: 779 return rc; 780 } 781 782 /* 783 * These access the current or another (stopped) task's io permission 784 * bitmap for debugging or core dump. 785 */ 786 static int ioperm_active(struct task_struct *target, 787 const struct user_regset *regset) 788 { 789 return target->thread.io_bitmap_max / regset->size; 790 } 791 792 static int ioperm_get(struct task_struct *target, 793 const struct user_regset *regset, 794 unsigned int pos, unsigned int count, 795 void *kbuf, void __user *ubuf) 796 { 797 if (!target->thread.io_bitmap_ptr) 798 return -ENXIO; 799 800 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, 801 target->thread.io_bitmap_ptr, 802 0, IO_BITMAP_BYTES); 803 } 804 805 /* 806 * Called by kernel/ptrace.c when detaching.. 807 * 808 * Make sure the single step bit is not set. 809 */ 810 void ptrace_disable(struct task_struct *child) 811 { 812 user_disable_single_step(child); 813 #ifdef TIF_SYSCALL_EMU 814 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); 815 #endif 816 } 817 818 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 819 static const struct user_regset_view user_x86_32_view; /* Initialized below. */ 820 #endif 821 822 long arch_ptrace(struct task_struct *child, long request, 823 unsigned long addr, unsigned long data) 824 { 825 int ret; 826 unsigned long __user *datap = (unsigned long __user *)data; 827 828 switch (request) { 829 /* read the word at location addr in the USER area. */ 830 case PTRACE_PEEKUSR: { 831 unsigned long tmp; 832 833 ret = -EIO; 834 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user)) 835 break; 836 837 tmp = 0; /* Default return condition */ 838 if (addr < sizeof(struct user_regs_struct)) 839 tmp = getreg(child, addr); 840 else if (addr >= offsetof(struct user, u_debugreg[0]) && 841 addr <= offsetof(struct user, u_debugreg[7])) { 842 addr -= offsetof(struct user, u_debugreg[0]); 843 tmp = ptrace_get_debugreg(child, addr / sizeof(data)); 844 } 845 ret = put_user(tmp, datap); 846 break; 847 } 848 849 case PTRACE_POKEUSR: /* write the word at location addr in the USER area */ 850 ret = -EIO; 851 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user)) 852 break; 853 854 if (addr < sizeof(struct user_regs_struct)) 855 ret = putreg(child, addr, data); 856 else if (addr >= offsetof(struct user, u_debugreg[0]) && 857 addr <= offsetof(struct user, u_debugreg[7])) { 858 addr -= offsetof(struct user, u_debugreg[0]); 859 ret = ptrace_set_debugreg(child, 860 addr / sizeof(data), data); 861 } 862 break; 863 864 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 865 return copy_regset_to_user(child, 866 task_user_regset_view(current), 867 REGSET_GENERAL, 868 0, sizeof(struct user_regs_struct), 869 datap); 870 871 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 872 return copy_regset_from_user(child, 873 task_user_regset_view(current), 874 REGSET_GENERAL, 875 0, sizeof(struct user_regs_struct), 876 datap); 877 878 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 879 return copy_regset_to_user(child, 880 task_user_regset_view(current), 881 REGSET_FP, 882 0, sizeof(struct user_i387_struct), 883 datap); 884 885 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 886 return copy_regset_from_user(child, 887 task_user_regset_view(current), 888 REGSET_FP, 889 0, sizeof(struct user_i387_struct), 890 datap); 891 892 #ifdef CONFIG_X86_32 893 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 894 return copy_regset_to_user(child, &user_x86_32_view, 895 REGSET_XFP, 896 0, sizeof(struct user_fxsr_struct), 897 datap) ? -EIO : 0; 898 899 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 900 return copy_regset_from_user(child, &user_x86_32_view, 901 REGSET_XFP, 902 0, sizeof(struct user_fxsr_struct), 903 datap) ? -EIO : 0; 904 #endif 905 906 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 907 case PTRACE_GET_THREAD_AREA: 908 if ((int) addr < 0) 909 return -EIO; 910 ret = do_get_thread_area(child, addr, 911 (struct user_desc __user *)data); 912 break; 913 914 case PTRACE_SET_THREAD_AREA: 915 if ((int) addr < 0) 916 return -EIO; 917 ret = do_set_thread_area(child, addr, 918 (struct user_desc __user *)data, 0); 919 break; 920 #endif 921 922 #ifdef CONFIG_X86_64 923 /* normal 64bit interface to access TLS data. 924 Works just like arch_prctl, except that the arguments 925 are reversed. */ 926 case PTRACE_ARCH_PRCTL: 927 ret = do_arch_prctl(child, data, addr); 928 break; 929 #endif 930 931 default: 932 ret = ptrace_request(child, request, addr, data); 933 break; 934 } 935 936 return ret; 937 } 938 939 #ifdef CONFIG_IA32_EMULATION 940 941 #include <linux/compat.h> 942 #include <linux/syscalls.h> 943 #include <asm/ia32.h> 944 #include <asm/user32.h> 945 946 #define R32(l,q) \ 947 case offsetof(struct user32, regs.l): \ 948 regs->q = value; break 949 950 #define SEG32(rs) \ 951 case offsetof(struct user32, regs.rs): \ 952 return set_segment_reg(child, \ 953 offsetof(struct user_regs_struct, rs), \ 954 value); \ 955 break 956 957 static int putreg32(struct task_struct *child, unsigned regno, u32 value) 958 { 959 struct pt_regs *regs = task_pt_regs(child); 960 961 switch (regno) { 962 963 SEG32(cs); 964 SEG32(ds); 965 SEG32(es); 966 SEG32(fs); 967 SEG32(gs); 968 SEG32(ss); 969 970 R32(ebx, bx); 971 R32(ecx, cx); 972 R32(edx, dx); 973 R32(edi, di); 974 R32(esi, si); 975 R32(ebp, bp); 976 R32(eax, ax); 977 R32(eip, ip); 978 R32(esp, sp); 979 980 case offsetof(struct user32, regs.orig_eax): 981 /* 982 * A 32-bit debugger setting orig_eax means to restore 983 * the state of the task restarting a 32-bit syscall. 984 * Make sure we interpret the -ERESTART* codes correctly 985 * in case the task is not actually still sitting at the 986 * exit from a 32-bit syscall with TS_COMPAT still set. 987 */ 988 regs->orig_ax = value; 989 if (syscall_get_nr(child, regs) >= 0) 990 task_thread_info(child)->status |= TS_COMPAT; 991 break; 992 993 case offsetof(struct user32, regs.eflags): 994 return set_flags(child, value); 995 996 case offsetof(struct user32, u_debugreg[0]) ... 997 offsetof(struct user32, u_debugreg[7]): 998 regno -= offsetof(struct user32, u_debugreg[0]); 999 return ptrace_set_debugreg(child, regno / 4, value); 1000 1001 default: 1002 if (regno > sizeof(struct user32) || (regno & 3)) 1003 return -EIO; 1004 1005 /* 1006 * Other dummy fields in the virtual user structure 1007 * are ignored 1008 */ 1009 break; 1010 } 1011 return 0; 1012 } 1013 1014 #undef R32 1015 #undef SEG32 1016 1017 #define R32(l,q) \ 1018 case offsetof(struct user32, regs.l): \ 1019 *val = regs->q; break 1020 1021 #define SEG32(rs) \ 1022 case offsetof(struct user32, regs.rs): \ 1023 *val = get_segment_reg(child, \ 1024 offsetof(struct user_regs_struct, rs)); \ 1025 break 1026 1027 static int getreg32(struct task_struct *child, unsigned regno, u32 *val) 1028 { 1029 struct pt_regs *regs = task_pt_regs(child); 1030 1031 switch (regno) { 1032 1033 SEG32(ds); 1034 SEG32(es); 1035 SEG32(fs); 1036 SEG32(gs); 1037 1038 R32(cs, cs); 1039 R32(ss, ss); 1040 R32(ebx, bx); 1041 R32(ecx, cx); 1042 R32(edx, dx); 1043 R32(edi, di); 1044 R32(esi, si); 1045 R32(ebp, bp); 1046 R32(eax, ax); 1047 R32(orig_eax, orig_ax); 1048 R32(eip, ip); 1049 R32(esp, sp); 1050 1051 case offsetof(struct user32, regs.eflags): 1052 *val = get_flags(child); 1053 break; 1054 1055 case offsetof(struct user32, u_debugreg[0]) ... 1056 offsetof(struct user32, u_debugreg[7]): 1057 regno -= offsetof(struct user32, u_debugreg[0]); 1058 *val = ptrace_get_debugreg(child, regno / 4); 1059 break; 1060 1061 default: 1062 if (regno > sizeof(struct user32) || (regno & 3)) 1063 return -EIO; 1064 1065 /* 1066 * Other dummy fields in the virtual user structure 1067 * are ignored 1068 */ 1069 *val = 0; 1070 break; 1071 } 1072 return 0; 1073 } 1074 1075 #undef R32 1076 #undef SEG32 1077 1078 static int genregs32_get(struct task_struct *target, 1079 const struct user_regset *regset, 1080 unsigned int pos, unsigned int count, 1081 void *kbuf, void __user *ubuf) 1082 { 1083 if (kbuf) { 1084 compat_ulong_t *k = kbuf; 1085 while (count >= sizeof(*k)) { 1086 getreg32(target, pos, k++); 1087 count -= sizeof(*k); 1088 pos += sizeof(*k); 1089 } 1090 } else { 1091 compat_ulong_t __user *u = ubuf; 1092 while (count >= sizeof(*u)) { 1093 compat_ulong_t word; 1094 getreg32(target, pos, &word); 1095 if (__put_user(word, u++)) 1096 return -EFAULT; 1097 count -= sizeof(*u); 1098 pos += sizeof(*u); 1099 } 1100 } 1101 1102 return 0; 1103 } 1104 1105 static int genregs32_set(struct task_struct *target, 1106 const struct user_regset *regset, 1107 unsigned int pos, unsigned int count, 1108 const void *kbuf, const void __user *ubuf) 1109 { 1110 int ret = 0; 1111 if (kbuf) { 1112 const compat_ulong_t *k = kbuf; 1113 while (count >= sizeof(*k) && !ret) { 1114 ret = putreg32(target, pos, *k++); 1115 count -= sizeof(*k); 1116 pos += sizeof(*k); 1117 } 1118 } else { 1119 const compat_ulong_t __user *u = ubuf; 1120 while (count >= sizeof(*u) && !ret) { 1121 compat_ulong_t word; 1122 ret = __get_user(word, u++); 1123 if (ret) 1124 break; 1125 ret = putreg32(target, pos, word); 1126 count -= sizeof(*u); 1127 pos += sizeof(*u); 1128 } 1129 } 1130 return ret; 1131 } 1132 1133 long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 1134 compat_ulong_t caddr, compat_ulong_t cdata) 1135 { 1136 unsigned long addr = caddr; 1137 unsigned long data = cdata; 1138 void __user *datap = compat_ptr(data); 1139 int ret; 1140 __u32 val; 1141 1142 switch (request) { 1143 case PTRACE_PEEKUSR: 1144 ret = getreg32(child, addr, &val); 1145 if (ret == 0) 1146 ret = put_user(val, (__u32 __user *)datap); 1147 break; 1148 1149 case PTRACE_POKEUSR: 1150 ret = putreg32(child, addr, data); 1151 break; 1152 1153 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 1154 return copy_regset_to_user(child, &user_x86_32_view, 1155 REGSET_GENERAL, 1156 0, sizeof(struct user_regs_struct32), 1157 datap); 1158 1159 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 1160 return copy_regset_from_user(child, &user_x86_32_view, 1161 REGSET_GENERAL, 0, 1162 sizeof(struct user_regs_struct32), 1163 datap); 1164 1165 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 1166 return copy_regset_to_user(child, &user_x86_32_view, 1167 REGSET_FP, 0, 1168 sizeof(struct user_i387_ia32_struct), 1169 datap); 1170 1171 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 1172 return copy_regset_from_user( 1173 child, &user_x86_32_view, REGSET_FP, 1174 0, sizeof(struct user_i387_ia32_struct), datap); 1175 1176 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 1177 return copy_regset_to_user(child, &user_x86_32_view, 1178 REGSET_XFP, 0, 1179 sizeof(struct user32_fxsr_struct), 1180 datap); 1181 1182 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 1183 return copy_regset_from_user(child, &user_x86_32_view, 1184 REGSET_XFP, 0, 1185 sizeof(struct user32_fxsr_struct), 1186 datap); 1187 1188 case PTRACE_GET_THREAD_AREA: 1189 case PTRACE_SET_THREAD_AREA: 1190 return arch_ptrace(child, request, addr, data); 1191 1192 default: 1193 return compat_ptrace_request(child, request, addr, data); 1194 } 1195 1196 return ret; 1197 } 1198 1199 #endif /* CONFIG_IA32_EMULATION */ 1200 1201 #ifdef CONFIG_X86_64 1202 1203 static struct user_regset x86_64_regsets[] __read_mostly = { 1204 [REGSET_GENERAL] = { 1205 .core_note_type = NT_PRSTATUS, 1206 .n = sizeof(struct user_regs_struct) / sizeof(long), 1207 .size = sizeof(long), .align = sizeof(long), 1208 .get = genregs_get, .set = genregs_set 1209 }, 1210 [REGSET_FP] = { 1211 .core_note_type = NT_PRFPREG, 1212 .n = sizeof(struct user_i387_struct) / sizeof(long), 1213 .size = sizeof(long), .align = sizeof(long), 1214 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set 1215 }, 1216 [REGSET_XSTATE] = { 1217 .core_note_type = NT_X86_XSTATE, 1218 .size = sizeof(u64), .align = sizeof(u64), 1219 .active = xstateregs_active, .get = xstateregs_get, 1220 .set = xstateregs_set 1221 }, 1222 [REGSET_IOPERM64] = { 1223 .core_note_type = NT_386_IOPERM, 1224 .n = IO_BITMAP_LONGS, 1225 .size = sizeof(long), .align = sizeof(long), 1226 .active = ioperm_active, .get = ioperm_get 1227 }, 1228 }; 1229 1230 static const struct user_regset_view user_x86_64_view = { 1231 .name = "x86_64", .e_machine = EM_X86_64, 1232 .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets) 1233 }; 1234 1235 #else /* CONFIG_X86_32 */ 1236 1237 #define user_regs_struct32 user_regs_struct 1238 #define genregs32_get genregs_get 1239 #define genregs32_set genregs_set 1240 1241 #define user_i387_ia32_struct user_i387_struct 1242 #define user32_fxsr_struct user_fxsr_struct 1243 1244 #endif /* CONFIG_X86_64 */ 1245 1246 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1247 static struct user_regset x86_32_regsets[] __read_mostly = { 1248 [REGSET_GENERAL] = { 1249 .core_note_type = NT_PRSTATUS, 1250 .n = sizeof(struct user_regs_struct32) / sizeof(u32), 1251 .size = sizeof(u32), .align = sizeof(u32), 1252 .get = genregs32_get, .set = genregs32_set 1253 }, 1254 [REGSET_FP] = { 1255 .core_note_type = NT_PRFPREG, 1256 .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32), 1257 .size = sizeof(u32), .align = sizeof(u32), 1258 .active = fpregs_active, .get = fpregs_get, .set = fpregs_set 1259 }, 1260 [REGSET_XFP] = { 1261 .core_note_type = NT_PRXFPREG, 1262 .n = sizeof(struct user32_fxsr_struct) / sizeof(u32), 1263 .size = sizeof(u32), .align = sizeof(u32), 1264 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set 1265 }, 1266 [REGSET_XSTATE] = { 1267 .core_note_type = NT_X86_XSTATE, 1268 .size = sizeof(u64), .align = sizeof(u64), 1269 .active = xstateregs_active, .get = xstateregs_get, 1270 .set = xstateregs_set 1271 }, 1272 [REGSET_TLS] = { 1273 .core_note_type = NT_386_TLS, 1274 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN, 1275 .size = sizeof(struct user_desc), 1276 .align = sizeof(struct user_desc), 1277 .active = regset_tls_active, 1278 .get = regset_tls_get, .set = regset_tls_set 1279 }, 1280 [REGSET_IOPERM32] = { 1281 .core_note_type = NT_386_IOPERM, 1282 .n = IO_BITMAP_BYTES / sizeof(u32), 1283 .size = sizeof(u32), .align = sizeof(u32), 1284 .active = ioperm_active, .get = ioperm_get 1285 }, 1286 }; 1287 1288 static const struct user_regset_view user_x86_32_view = { 1289 .name = "i386", .e_machine = EM_386, 1290 .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets) 1291 }; 1292 #endif 1293 1294 /* 1295 * This represents bytes 464..511 in the memory layout exported through 1296 * the REGSET_XSTATE interface. 1297 */ 1298 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS]; 1299 1300 void update_regset_xstate_info(unsigned int size, u64 xstate_mask) 1301 { 1302 #ifdef CONFIG_X86_64 1303 x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1304 #endif 1305 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1306 x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1307 #endif 1308 xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask; 1309 } 1310 1311 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 1312 { 1313 #ifdef CONFIG_IA32_EMULATION 1314 if (test_tsk_thread_flag(task, TIF_IA32)) 1315 #endif 1316 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1317 return &user_x86_32_view; 1318 #endif 1319 #ifdef CONFIG_X86_64 1320 return &user_x86_64_view; 1321 #endif 1322 } 1323 1324 static void fill_sigtrap_info(struct task_struct *tsk, 1325 struct pt_regs *regs, 1326 int error_code, int si_code, 1327 struct siginfo *info) 1328 { 1329 tsk->thread.trap_no = 1; 1330 tsk->thread.error_code = error_code; 1331 1332 memset(info, 0, sizeof(*info)); 1333 info->si_signo = SIGTRAP; 1334 info->si_code = si_code; 1335 info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL; 1336 } 1337 1338 void user_single_step_siginfo(struct task_struct *tsk, 1339 struct pt_regs *regs, 1340 struct siginfo *info) 1341 { 1342 fill_sigtrap_info(tsk, regs, 0, TRAP_BRKPT, info); 1343 } 1344 1345 void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, 1346 int error_code, int si_code) 1347 { 1348 struct siginfo info; 1349 1350 fill_sigtrap_info(tsk, regs, error_code, si_code, &info); 1351 /* Send us the fake SIGTRAP */ 1352 force_sig_info(SIGTRAP, &info, tsk); 1353 } 1354 1355 1356 #ifdef CONFIG_X86_32 1357 # define IS_IA32 1 1358 #elif defined CONFIG_IA32_EMULATION 1359 # define IS_IA32 is_compat_task() 1360 #else 1361 # define IS_IA32 0 1362 #endif 1363 1364 /* 1365 * We must return the syscall number to actually look up in the table. 1366 * This can be -1L to skip running any syscall at all. 1367 */ 1368 long syscall_trace_enter(struct pt_regs *regs) 1369 { 1370 long ret = 0; 1371 1372 /* 1373 * If we stepped into a sysenter/syscall insn, it trapped in 1374 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP. 1375 * If user-mode had set TF itself, then it's still clear from 1376 * do_debug() and we need to set it again to restore the user 1377 * state. If we entered on the slow path, TF was already set. 1378 */ 1379 if (test_thread_flag(TIF_SINGLESTEP)) 1380 regs->flags |= X86_EFLAGS_TF; 1381 1382 /* do the secure computing check first */ 1383 secure_computing(regs->orig_ax); 1384 1385 if (unlikely(test_thread_flag(TIF_SYSCALL_EMU))) 1386 ret = -1L; 1387 1388 if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) && 1389 tracehook_report_syscall_entry(regs)) 1390 ret = -1L; 1391 1392 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 1393 trace_sys_enter(regs, regs->orig_ax); 1394 1395 if (IS_IA32) 1396 audit_syscall_entry(AUDIT_ARCH_I386, 1397 regs->orig_ax, 1398 regs->bx, regs->cx, 1399 regs->dx, regs->si); 1400 #ifdef CONFIG_X86_64 1401 else 1402 audit_syscall_entry(AUDIT_ARCH_X86_64, 1403 regs->orig_ax, 1404 regs->di, regs->si, 1405 regs->dx, regs->r10); 1406 #endif 1407 1408 return ret ?: regs->orig_ax; 1409 } 1410 1411 void syscall_trace_leave(struct pt_regs *regs) 1412 { 1413 bool step; 1414 1415 audit_syscall_exit(regs); 1416 1417 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 1418 trace_sys_exit(regs, regs->ax); 1419 1420 /* 1421 * If TIF_SYSCALL_EMU is set, we only get here because of 1422 * TIF_SINGLESTEP (i.e. this is PTRACE_SYSEMU_SINGLESTEP). 1423 * We already reported this syscall instruction in 1424 * syscall_trace_enter(). 1425 */ 1426 step = unlikely(test_thread_flag(TIF_SINGLESTEP)) && 1427 !test_thread_flag(TIF_SYSCALL_EMU); 1428 if (step || test_thread_flag(TIF_SYSCALL_TRACE)) 1429 tracehook_report_syscall_exit(regs, step); 1430 } 1431