1 /* By Ross Biro 1/23/92 */ 2 /* 3 * Pentium III FXSR, SSE support 4 * Gareth Hughes <gareth@valinux.com>, May 2000 5 */ 6 7 #include <linux/kernel.h> 8 #include <linux/sched.h> 9 #include <linux/mm.h> 10 #include <linux/smp.h> 11 #include <linux/errno.h> 12 #include <linux/slab.h> 13 #include <linux/ptrace.h> 14 #include <linux/regset.h> 15 #include <linux/tracehook.h> 16 #include <linux/user.h> 17 #include <linux/elf.h> 18 #include <linux/security.h> 19 #include <linux/audit.h> 20 #include <linux/seccomp.h> 21 #include <linux/signal.h> 22 #include <linux/perf_event.h> 23 #include <linux/hw_breakpoint.h> 24 25 #include <asm/uaccess.h> 26 #include <asm/pgtable.h> 27 #include <asm/system.h> 28 #include <asm/processor.h> 29 #include <asm/i387.h> 30 #include <asm/debugreg.h> 31 #include <asm/ldt.h> 32 #include <asm/desc.h> 33 #include <asm/prctl.h> 34 #include <asm/proto.h> 35 #include <asm/hw_breakpoint.h> 36 37 #include "tls.h" 38 39 #define CREATE_TRACE_POINTS 40 #include <trace/events/syscalls.h> 41 42 enum x86_regset { 43 REGSET_GENERAL, 44 REGSET_FP, 45 REGSET_XFP, 46 REGSET_IOPERM64 = REGSET_XFP, 47 REGSET_XSTATE, 48 REGSET_TLS, 49 REGSET_IOPERM32, 50 }; 51 52 struct pt_regs_offset { 53 const char *name; 54 int offset; 55 }; 56 57 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 58 #define REG_OFFSET_END {.name = NULL, .offset = 0} 59 60 static const struct pt_regs_offset regoffset_table[] = { 61 #ifdef CONFIG_X86_64 62 REG_OFFSET_NAME(r15), 63 REG_OFFSET_NAME(r14), 64 REG_OFFSET_NAME(r13), 65 REG_OFFSET_NAME(r12), 66 REG_OFFSET_NAME(r11), 67 REG_OFFSET_NAME(r10), 68 REG_OFFSET_NAME(r9), 69 REG_OFFSET_NAME(r8), 70 #endif 71 REG_OFFSET_NAME(bx), 72 REG_OFFSET_NAME(cx), 73 REG_OFFSET_NAME(dx), 74 REG_OFFSET_NAME(si), 75 REG_OFFSET_NAME(di), 76 REG_OFFSET_NAME(bp), 77 REG_OFFSET_NAME(ax), 78 #ifdef CONFIG_X86_32 79 REG_OFFSET_NAME(ds), 80 REG_OFFSET_NAME(es), 81 REG_OFFSET_NAME(fs), 82 REG_OFFSET_NAME(gs), 83 #endif 84 REG_OFFSET_NAME(orig_ax), 85 REG_OFFSET_NAME(ip), 86 REG_OFFSET_NAME(cs), 87 REG_OFFSET_NAME(flags), 88 REG_OFFSET_NAME(sp), 89 REG_OFFSET_NAME(ss), 90 REG_OFFSET_END, 91 }; 92 93 /** 94 * regs_query_register_offset() - query register offset from its name 95 * @name: the name of a register 96 * 97 * regs_query_register_offset() returns the offset of a register in struct 98 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 99 */ 100 int regs_query_register_offset(const char *name) 101 { 102 const struct pt_regs_offset *roff; 103 for (roff = regoffset_table; roff->name != NULL; roff++) 104 if (!strcmp(roff->name, name)) 105 return roff->offset; 106 return -EINVAL; 107 } 108 109 /** 110 * regs_query_register_name() - query register name from its offset 111 * @offset: the offset of a register in struct pt_regs. 112 * 113 * regs_query_register_name() returns the name of a register from its 114 * offset in struct pt_regs. If the @offset is invalid, this returns NULL; 115 */ 116 const char *regs_query_register_name(unsigned int offset) 117 { 118 const struct pt_regs_offset *roff; 119 for (roff = regoffset_table; roff->name != NULL; roff++) 120 if (roff->offset == offset) 121 return roff->name; 122 return NULL; 123 } 124 125 static const int arg_offs_table[] = { 126 #ifdef CONFIG_X86_32 127 [0] = offsetof(struct pt_regs, ax), 128 [1] = offsetof(struct pt_regs, dx), 129 [2] = offsetof(struct pt_regs, cx) 130 #else /* CONFIG_X86_64 */ 131 [0] = offsetof(struct pt_regs, di), 132 [1] = offsetof(struct pt_regs, si), 133 [2] = offsetof(struct pt_regs, dx), 134 [3] = offsetof(struct pt_regs, cx), 135 [4] = offsetof(struct pt_regs, r8), 136 [5] = offsetof(struct pt_regs, r9) 137 #endif 138 }; 139 140 /* 141 * does not yet catch signals sent when the child dies. 142 * in exit.c or in signal.c. 143 */ 144 145 /* 146 * Determines which flags the user has access to [1 = access, 0 = no access]. 147 */ 148 #define FLAG_MASK_32 ((unsigned long) \ 149 (X86_EFLAGS_CF | X86_EFLAGS_PF | \ 150 X86_EFLAGS_AF | X86_EFLAGS_ZF | \ 151 X86_EFLAGS_SF | X86_EFLAGS_TF | \ 152 X86_EFLAGS_DF | X86_EFLAGS_OF | \ 153 X86_EFLAGS_RF | X86_EFLAGS_AC)) 154 155 /* 156 * Determines whether a value may be installed in a segment register. 157 */ 158 static inline bool invalid_selector(u16 value) 159 { 160 return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL); 161 } 162 163 #ifdef CONFIG_X86_32 164 165 #define FLAG_MASK FLAG_MASK_32 166 167 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno) 168 { 169 BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0); 170 return ®s->bx + (regno >> 2); 171 } 172 173 static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 174 { 175 /* 176 * Returning the value truncates it to 16 bits. 177 */ 178 unsigned int retval; 179 if (offset != offsetof(struct user_regs_struct, gs)) 180 retval = *pt_regs_access(task_pt_regs(task), offset); 181 else { 182 if (task == current) 183 retval = get_user_gs(task_pt_regs(task)); 184 else 185 retval = task_user_gs(task); 186 } 187 return retval; 188 } 189 190 static int set_segment_reg(struct task_struct *task, 191 unsigned long offset, u16 value) 192 { 193 /* 194 * The value argument was already truncated to 16 bits. 195 */ 196 if (invalid_selector(value)) 197 return -EIO; 198 199 /* 200 * For %cs and %ss we cannot permit a null selector. 201 * We can permit a bogus selector as long as it has USER_RPL. 202 * Null selectors are fine for other segment registers, but 203 * we will never get back to user mode with invalid %cs or %ss 204 * and will take the trap in iret instead. Much code relies 205 * on user_mode() to distinguish a user trap frame (which can 206 * safely use invalid selectors) from a kernel trap frame. 207 */ 208 switch (offset) { 209 case offsetof(struct user_regs_struct, cs): 210 case offsetof(struct user_regs_struct, ss): 211 if (unlikely(value == 0)) 212 return -EIO; 213 214 default: 215 *pt_regs_access(task_pt_regs(task), offset) = value; 216 break; 217 218 case offsetof(struct user_regs_struct, gs): 219 if (task == current) 220 set_user_gs(task_pt_regs(task), value); 221 else 222 task_user_gs(task) = value; 223 } 224 225 return 0; 226 } 227 228 #else /* CONFIG_X86_64 */ 229 230 #define FLAG_MASK (FLAG_MASK_32 | X86_EFLAGS_NT) 231 232 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset) 233 { 234 BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0); 235 return ®s->r15 + (offset / sizeof(regs->r15)); 236 } 237 238 static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 239 { 240 /* 241 * Returning the value truncates it to 16 bits. 242 */ 243 unsigned int seg; 244 245 switch (offset) { 246 case offsetof(struct user_regs_struct, fs): 247 if (task == current) { 248 /* Older gas can't assemble movq %?s,%r?? */ 249 asm("movl %%fs,%0" : "=r" (seg)); 250 return seg; 251 } 252 return task->thread.fsindex; 253 case offsetof(struct user_regs_struct, gs): 254 if (task == current) { 255 asm("movl %%gs,%0" : "=r" (seg)); 256 return seg; 257 } 258 return task->thread.gsindex; 259 case offsetof(struct user_regs_struct, ds): 260 if (task == current) { 261 asm("movl %%ds,%0" : "=r" (seg)); 262 return seg; 263 } 264 return task->thread.ds; 265 case offsetof(struct user_regs_struct, es): 266 if (task == current) { 267 asm("movl %%es,%0" : "=r" (seg)); 268 return seg; 269 } 270 return task->thread.es; 271 272 case offsetof(struct user_regs_struct, cs): 273 case offsetof(struct user_regs_struct, ss): 274 break; 275 } 276 return *pt_regs_access(task_pt_regs(task), offset); 277 } 278 279 static int set_segment_reg(struct task_struct *task, 280 unsigned long offset, u16 value) 281 { 282 /* 283 * The value argument was already truncated to 16 bits. 284 */ 285 if (invalid_selector(value)) 286 return -EIO; 287 288 switch (offset) { 289 case offsetof(struct user_regs_struct,fs): 290 /* 291 * If this is setting fs as for normal 64-bit use but 292 * setting fs_base has implicitly changed it, leave it. 293 */ 294 if ((value == FS_TLS_SEL && task->thread.fsindex == 0 && 295 task->thread.fs != 0) || 296 (value == 0 && task->thread.fsindex == FS_TLS_SEL && 297 task->thread.fs == 0)) 298 break; 299 task->thread.fsindex = value; 300 if (task == current) 301 loadsegment(fs, task->thread.fsindex); 302 break; 303 case offsetof(struct user_regs_struct,gs): 304 /* 305 * If this is setting gs as for normal 64-bit use but 306 * setting gs_base has implicitly changed it, leave it. 307 */ 308 if ((value == GS_TLS_SEL && task->thread.gsindex == 0 && 309 task->thread.gs != 0) || 310 (value == 0 && task->thread.gsindex == GS_TLS_SEL && 311 task->thread.gs == 0)) 312 break; 313 task->thread.gsindex = value; 314 if (task == current) 315 load_gs_index(task->thread.gsindex); 316 break; 317 case offsetof(struct user_regs_struct,ds): 318 task->thread.ds = value; 319 if (task == current) 320 loadsegment(ds, task->thread.ds); 321 break; 322 case offsetof(struct user_regs_struct,es): 323 task->thread.es = value; 324 if (task == current) 325 loadsegment(es, task->thread.es); 326 break; 327 328 /* 329 * Can't actually change these in 64-bit mode. 330 */ 331 case offsetof(struct user_regs_struct,cs): 332 if (unlikely(value == 0)) 333 return -EIO; 334 #ifdef CONFIG_IA32_EMULATION 335 if (test_tsk_thread_flag(task, TIF_IA32)) 336 task_pt_regs(task)->cs = value; 337 #endif 338 break; 339 case offsetof(struct user_regs_struct,ss): 340 if (unlikely(value == 0)) 341 return -EIO; 342 #ifdef CONFIG_IA32_EMULATION 343 if (test_tsk_thread_flag(task, TIF_IA32)) 344 task_pt_regs(task)->ss = value; 345 #endif 346 break; 347 } 348 349 return 0; 350 } 351 352 #endif /* CONFIG_X86_32 */ 353 354 static unsigned long get_flags(struct task_struct *task) 355 { 356 unsigned long retval = task_pt_regs(task)->flags; 357 358 /* 359 * If the debugger set TF, hide it from the readout. 360 */ 361 if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 362 retval &= ~X86_EFLAGS_TF; 363 364 return retval; 365 } 366 367 static int set_flags(struct task_struct *task, unsigned long value) 368 { 369 struct pt_regs *regs = task_pt_regs(task); 370 371 /* 372 * If the user value contains TF, mark that 373 * it was not "us" (the debugger) that set it. 374 * If not, make sure it stays set if we had. 375 */ 376 if (value & X86_EFLAGS_TF) 377 clear_tsk_thread_flag(task, TIF_FORCED_TF); 378 else if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 379 value |= X86_EFLAGS_TF; 380 381 regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK); 382 383 return 0; 384 } 385 386 static int putreg(struct task_struct *child, 387 unsigned long offset, unsigned long value) 388 { 389 switch (offset) { 390 case offsetof(struct user_regs_struct, cs): 391 case offsetof(struct user_regs_struct, ds): 392 case offsetof(struct user_regs_struct, es): 393 case offsetof(struct user_regs_struct, fs): 394 case offsetof(struct user_regs_struct, gs): 395 case offsetof(struct user_regs_struct, ss): 396 return set_segment_reg(child, offset, value); 397 398 case offsetof(struct user_regs_struct, flags): 399 return set_flags(child, value); 400 401 #ifdef CONFIG_X86_64 402 case offsetof(struct user_regs_struct,fs_base): 403 if (value >= TASK_SIZE_OF(child)) 404 return -EIO; 405 /* 406 * When changing the segment base, use do_arch_prctl 407 * to set either thread.fs or thread.fsindex and the 408 * corresponding GDT slot. 409 */ 410 if (child->thread.fs != value) 411 return do_arch_prctl(child, ARCH_SET_FS, value); 412 return 0; 413 case offsetof(struct user_regs_struct,gs_base): 414 /* 415 * Exactly the same here as the %fs handling above. 416 */ 417 if (value >= TASK_SIZE_OF(child)) 418 return -EIO; 419 if (child->thread.gs != value) 420 return do_arch_prctl(child, ARCH_SET_GS, value); 421 return 0; 422 #endif 423 } 424 425 *pt_regs_access(task_pt_regs(child), offset) = value; 426 return 0; 427 } 428 429 static unsigned long getreg(struct task_struct *task, unsigned long offset) 430 { 431 switch (offset) { 432 case offsetof(struct user_regs_struct, cs): 433 case offsetof(struct user_regs_struct, ds): 434 case offsetof(struct user_regs_struct, es): 435 case offsetof(struct user_regs_struct, fs): 436 case offsetof(struct user_regs_struct, gs): 437 case offsetof(struct user_regs_struct, ss): 438 return get_segment_reg(task, offset); 439 440 case offsetof(struct user_regs_struct, flags): 441 return get_flags(task); 442 443 #ifdef CONFIG_X86_64 444 case offsetof(struct user_regs_struct, fs_base): { 445 /* 446 * do_arch_prctl may have used a GDT slot instead of 447 * the MSR. To userland, it appears the same either 448 * way, except the %fs segment selector might not be 0. 449 */ 450 unsigned int seg = task->thread.fsindex; 451 if (task->thread.fs != 0) 452 return task->thread.fs; 453 if (task == current) 454 asm("movl %%fs,%0" : "=r" (seg)); 455 if (seg != FS_TLS_SEL) 456 return 0; 457 return get_desc_base(&task->thread.tls_array[FS_TLS]); 458 } 459 case offsetof(struct user_regs_struct, gs_base): { 460 /* 461 * Exactly the same here as the %fs handling above. 462 */ 463 unsigned int seg = task->thread.gsindex; 464 if (task->thread.gs != 0) 465 return task->thread.gs; 466 if (task == current) 467 asm("movl %%gs,%0" : "=r" (seg)); 468 if (seg != GS_TLS_SEL) 469 return 0; 470 return get_desc_base(&task->thread.tls_array[GS_TLS]); 471 } 472 #endif 473 } 474 475 return *pt_regs_access(task_pt_regs(task), offset); 476 } 477 478 static int genregs_get(struct task_struct *target, 479 const struct user_regset *regset, 480 unsigned int pos, unsigned int count, 481 void *kbuf, void __user *ubuf) 482 { 483 if (kbuf) { 484 unsigned long *k = kbuf; 485 while (count >= sizeof(*k)) { 486 *k++ = getreg(target, pos); 487 count -= sizeof(*k); 488 pos += sizeof(*k); 489 } 490 } else { 491 unsigned long __user *u = ubuf; 492 while (count >= sizeof(*u)) { 493 if (__put_user(getreg(target, pos), u++)) 494 return -EFAULT; 495 count -= sizeof(*u); 496 pos += sizeof(*u); 497 } 498 } 499 500 return 0; 501 } 502 503 static int genregs_set(struct task_struct *target, 504 const struct user_regset *regset, 505 unsigned int pos, unsigned int count, 506 const void *kbuf, const void __user *ubuf) 507 { 508 int ret = 0; 509 if (kbuf) { 510 const unsigned long *k = kbuf; 511 while (count >= sizeof(*k) && !ret) { 512 ret = putreg(target, pos, *k++); 513 count -= sizeof(*k); 514 pos += sizeof(*k); 515 } 516 } else { 517 const unsigned long __user *u = ubuf; 518 while (count >= sizeof(*u) && !ret) { 519 unsigned long word; 520 ret = __get_user(word, u++); 521 if (ret) 522 break; 523 ret = putreg(target, pos, word); 524 count -= sizeof(*u); 525 pos += sizeof(*u); 526 } 527 } 528 return ret; 529 } 530 531 static void ptrace_triggered(struct perf_event *bp, int nmi, 532 struct perf_sample_data *data, 533 struct pt_regs *regs) 534 { 535 int i; 536 struct thread_struct *thread = &(current->thread); 537 538 /* 539 * Store in the virtual DR6 register the fact that the breakpoint 540 * was hit so the thread's debugger will see it. 541 */ 542 for (i = 0; i < HBP_NUM; i++) { 543 if (thread->ptrace_bps[i] == bp) 544 break; 545 } 546 547 thread->debugreg6 |= (DR_TRAP0 << i); 548 } 549 550 /* 551 * Walk through every ptrace breakpoints for this thread and 552 * build the dr7 value on top of their attributes. 553 * 554 */ 555 static unsigned long ptrace_get_dr7(struct perf_event *bp[]) 556 { 557 int i; 558 int dr7 = 0; 559 struct arch_hw_breakpoint *info; 560 561 for (i = 0; i < HBP_NUM; i++) { 562 if (bp[i] && !bp[i]->attr.disabled) { 563 info = counter_arch_bp(bp[i]); 564 dr7 |= encode_dr7(i, info->len, info->type); 565 } 566 } 567 568 return dr7; 569 } 570 571 static int 572 ptrace_modify_breakpoint(struct perf_event *bp, int len, int type, 573 struct task_struct *tsk, int disabled) 574 { 575 int err; 576 int gen_len, gen_type; 577 struct perf_event_attr attr; 578 579 /* 580 * We should have at least an inactive breakpoint at this 581 * slot. It means the user is writing dr7 without having 582 * written the address register first 583 */ 584 if (!bp) 585 return -EINVAL; 586 587 err = arch_bp_generic_fields(len, type, &gen_len, &gen_type); 588 if (err) 589 return err; 590 591 attr = bp->attr; 592 attr.bp_len = gen_len; 593 attr.bp_type = gen_type; 594 attr.disabled = disabled; 595 596 return modify_user_hw_breakpoint(bp, &attr); 597 } 598 599 /* 600 * Handle ptrace writes to debug register 7. 601 */ 602 static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data) 603 { 604 struct thread_struct *thread = &(tsk->thread); 605 unsigned long old_dr7; 606 int i, orig_ret = 0, rc = 0; 607 int enabled, second_pass = 0; 608 unsigned len, type; 609 struct perf_event *bp; 610 611 data &= ~DR_CONTROL_RESERVED; 612 old_dr7 = ptrace_get_dr7(thread->ptrace_bps); 613 restore: 614 /* 615 * Loop through all the hardware breakpoints, making the 616 * appropriate changes to each. 617 */ 618 for (i = 0; i < HBP_NUM; i++) { 619 enabled = decode_dr7(data, i, &len, &type); 620 bp = thread->ptrace_bps[i]; 621 622 if (!enabled) { 623 if (bp) { 624 /* 625 * Don't unregister the breakpoints right-away, 626 * unless all register_user_hw_breakpoint() 627 * requests have succeeded. This prevents 628 * any window of opportunity for debug 629 * register grabbing by other users. 630 */ 631 if (!second_pass) 632 continue; 633 634 rc = ptrace_modify_breakpoint(bp, len, type, 635 tsk, 1); 636 if (rc) 637 break; 638 } 639 continue; 640 } 641 642 rc = ptrace_modify_breakpoint(bp, len, type, tsk, 0); 643 if (rc) 644 break; 645 } 646 /* 647 * Make a second pass to free the remaining unused breakpoints 648 * or to restore the original breakpoints if an error occurred. 649 */ 650 if (!second_pass) { 651 second_pass = 1; 652 if (rc < 0) { 653 orig_ret = rc; 654 data = old_dr7; 655 } 656 goto restore; 657 } 658 return ((orig_ret < 0) ? orig_ret : rc); 659 } 660 661 /* 662 * Handle PTRACE_PEEKUSR calls for the debug register area. 663 */ 664 static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n) 665 { 666 struct thread_struct *thread = &(tsk->thread); 667 unsigned long val = 0; 668 669 if (n < HBP_NUM) { 670 struct perf_event *bp; 671 bp = thread->ptrace_bps[n]; 672 if (!bp) 673 return 0; 674 val = bp->hw.info.address; 675 } else if (n == 6) { 676 val = thread->debugreg6; 677 } else if (n == 7) { 678 val = thread->ptrace_dr7; 679 } 680 return val; 681 } 682 683 static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr, 684 unsigned long addr) 685 { 686 struct perf_event *bp; 687 struct thread_struct *t = &tsk->thread; 688 struct perf_event_attr attr; 689 690 if (!t->ptrace_bps[nr]) { 691 ptrace_breakpoint_init(&attr); 692 /* 693 * Put stub len and type to register (reserve) an inactive but 694 * correct bp 695 */ 696 attr.bp_addr = addr; 697 attr.bp_len = HW_BREAKPOINT_LEN_1; 698 attr.bp_type = HW_BREAKPOINT_W; 699 attr.disabled = 1; 700 701 bp = register_user_hw_breakpoint(&attr, ptrace_triggered, tsk); 702 703 /* 704 * CHECKME: the previous code returned -EIO if the addr wasn't 705 * a valid task virtual addr. The new one will return -EINVAL in 706 * this case. 707 * -EINVAL may be what we want for in-kernel breakpoints users, 708 * but -EIO looks better for ptrace, since we refuse a register 709 * writing for the user. And anyway this is the previous 710 * behaviour. 711 */ 712 if (IS_ERR(bp)) 713 return PTR_ERR(bp); 714 715 t->ptrace_bps[nr] = bp; 716 } else { 717 int err; 718 719 bp = t->ptrace_bps[nr]; 720 721 attr = bp->attr; 722 attr.bp_addr = addr; 723 err = modify_user_hw_breakpoint(bp, &attr); 724 if (err) 725 return err; 726 } 727 728 729 return 0; 730 } 731 732 /* 733 * Handle PTRACE_POKEUSR calls for the debug register area. 734 */ 735 int ptrace_set_debugreg(struct task_struct *tsk, int n, unsigned long val) 736 { 737 struct thread_struct *thread = &(tsk->thread); 738 int rc = 0; 739 740 /* There are no DR4 or DR5 registers */ 741 if (n == 4 || n == 5) 742 return -EIO; 743 744 if (n == 6) { 745 thread->debugreg6 = val; 746 goto ret_path; 747 } 748 if (n < HBP_NUM) { 749 rc = ptrace_set_breakpoint_addr(tsk, n, val); 750 if (rc) 751 return rc; 752 } 753 /* All that's left is DR7 */ 754 if (n == 7) { 755 rc = ptrace_write_dr7(tsk, val); 756 if (!rc) 757 thread->ptrace_dr7 = val; 758 } 759 760 ret_path: 761 return rc; 762 } 763 764 /* 765 * These access the current or another (stopped) task's io permission 766 * bitmap for debugging or core dump. 767 */ 768 static int ioperm_active(struct task_struct *target, 769 const struct user_regset *regset) 770 { 771 return target->thread.io_bitmap_max / regset->size; 772 } 773 774 static int ioperm_get(struct task_struct *target, 775 const struct user_regset *regset, 776 unsigned int pos, unsigned int count, 777 void *kbuf, void __user *ubuf) 778 { 779 if (!target->thread.io_bitmap_ptr) 780 return -ENXIO; 781 782 return user_regset_copyout(&pos, &count, &kbuf, &ubuf, 783 target->thread.io_bitmap_ptr, 784 0, IO_BITMAP_BYTES); 785 } 786 787 /* 788 * Called by kernel/ptrace.c when detaching.. 789 * 790 * Make sure the single step bit is not set. 791 */ 792 void ptrace_disable(struct task_struct *child) 793 { 794 user_disable_single_step(child); 795 #ifdef TIF_SYSCALL_EMU 796 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); 797 #endif 798 } 799 800 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 801 static const struct user_regset_view user_x86_32_view; /* Initialized below. */ 802 #endif 803 804 long arch_ptrace(struct task_struct *child, long request, long addr, long data) 805 { 806 int ret; 807 unsigned long __user *datap = (unsigned long __user *)data; 808 809 switch (request) { 810 /* read the word at location addr in the USER area. */ 811 case PTRACE_PEEKUSR: { 812 unsigned long tmp; 813 814 ret = -EIO; 815 if ((addr & (sizeof(data) - 1)) || addr < 0 || 816 addr >= sizeof(struct user)) 817 break; 818 819 tmp = 0; /* Default return condition */ 820 if (addr < sizeof(struct user_regs_struct)) 821 tmp = getreg(child, addr); 822 else if (addr >= offsetof(struct user, u_debugreg[0]) && 823 addr <= offsetof(struct user, u_debugreg[7])) { 824 addr -= offsetof(struct user, u_debugreg[0]); 825 tmp = ptrace_get_debugreg(child, addr / sizeof(data)); 826 } 827 ret = put_user(tmp, datap); 828 break; 829 } 830 831 case PTRACE_POKEUSR: /* write the word at location addr in the USER area */ 832 ret = -EIO; 833 if ((addr & (sizeof(data) - 1)) || addr < 0 || 834 addr >= sizeof(struct user)) 835 break; 836 837 if (addr < sizeof(struct user_regs_struct)) 838 ret = putreg(child, addr, data); 839 else if (addr >= offsetof(struct user, u_debugreg[0]) && 840 addr <= offsetof(struct user, u_debugreg[7])) { 841 addr -= offsetof(struct user, u_debugreg[0]); 842 ret = ptrace_set_debugreg(child, 843 addr / sizeof(data), data); 844 } 845 break; 846 847 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 848 return copy_regset_to_user(child, 849 task_user_regset_view(current), 850 REGSET_GENERAL, 851 0, sizeof(struct user_regs_struct), 852 datap); 853 854 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 855 return copy_regset_from_user(child, 856 task_user_regset_view(current), 857 REGSET_GENERAL, 858 0, sizeof(struct user_regs_struct), 859 datap); 860 861 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 862 return copy_regset_to_user(child, 863 task_user_regset_view(current), 864 REGSET_FP, 865 0, sizeof(struct user_i387_struct), 866 datap); 867 868 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 869 return copy_regset_from_user(child, 870 task_user_regset_view(current), 871 REGSET_FP, 872 0, sizeof(struct user_i387_struct), 873 datap); 874 875 #ifdef CONFIG_X86_32 876 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 877 return copy_regset_to_user(child, &user_x86_32_view, 878 REGSET_XFP, 879 0, sizeof(struct user_fxsr_struct), 880 datap) ? -EIO : 0; 881 882 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 883 return copy_regset_from_user(child, &user_x86_32_view, 884 REGSET_XFP, 885 0, sizeof(struct user_fxsr_struct), 886 datap) ? -EIO : 0; 887 #endif 888 889 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 890 case PTRACE_GET_THREAD_AREA: 891 if (addr < 0) 892 return -EIO; 893 ret = do_get_thread_area(child, addr, 894 (struct user_desc __user *) data); 895 break; 896 897 case PTRACE_SET_THREAD_AREA: 898 if (addr < 0) 899 return -EIO; 900 ret = do_set_thread_area(child, addr, 901 (struct user_desc __user *) data, 0); 902 break; 903 #endif 904 905 #ifdef CONFIG_X86_64 906 /* normal 64bit interface to access TLS data. 907 Works just like arch_prctl, except that the arguments 908 are reversed. */ 909 case PTRACE_ARCH_PRCTL: 910 ret = do_arch_prctl(child, data, addr); 911 break; 912 #endif 913 914 default: 915 ret = ptrace_request(child, request, addr, data); 916 break; 917 } 918 919 return ret; 920 } 921 922 #ifdef CONFIG_IA32_EMULATION 923 924 #include <linux/compat.h> 925 #include <linux/syscalls.h> 926 #include <asm/ia32.h> 927 #include <asm/user32.h> 928 929 #define R32(l,q) \ 930 case offsetof(struct user32, regs.l): \ 931 regs->q = value; break 932 933 #define SEG32(rs) \ 934 case offsetof(struct user32, regs.rs): \ 935 return set_segment_reg(child, \ 936 offsetof(struct user_regs_struct, rs), \ 937 value); \ 938 break 939 940 static int putreg32(struct task_struct *child, unsigned regno, u32 value) 941 { 942 struct pt_regs *regs = task_pt_regs(child); 943 944 switch (regno) { 945 946 SEG32(cs); 947 SEG32(ds); 948 SEG32(es); 949 SEG32(fs); 950 SEG32(gs); 951 SEG32(ss); 952 953 R32(ebx, bx); 954 R32(ecx, cx); 955 R32(edx, dx); 956 R32(edi, di); 957 R32(esi, si); 958 R32(ebp, bp); 959 R32(eax, ax); 960 R32(eip, ip); 961 R32(esp, sp); 962 963 case offsetof(struct user32, regs.orig_eax): 964 /* 965 * A 32-bit debugger setting orig_eax means to restore 966 * the state of the task restarting a 32-bit syscall. 967 * Make sure we interpret the -ERESTART* codes correctly 968 * in case the task is not actually still sitting at the 969 * exit from a 32-bit syscall with TS_COMPAT still set. 970 */ 971 regs->orig_ax = value; 972 if (syscall_get_nr(child, regs) >= 0) 973 task_thread_info(child)->status |= TS_COMPAT; 974 break; 975 976 case offsetof(struct user32, regs.eflags): 977 return set_flags(child, value); 978 979 case offsetof(struct user32, u_debugreg[0]) ... 980 offsetof(struct user32, u_debugreg[7]): 981 regno -= offsetof(struct user32, u_debugreg[0]); 982 return ptrace_set_debugreg(child, regno / 4, value); 983 984 default: 985 if (regno > sizeof(struct user32) || (regno & 3)) 986 return -EIO; 987 988 /* 989 * Other dummy fields in the virtual user structure 990 * are ignored 991 */ 992 break; 993 } 994 return 0; 995 } 996 997 #undef R32 998 #undef SEG32 999 1000 #define R32(l,q) \ 1001 case offsetof(struct user32, regs.l): \ 1002 *val = regs->q; break 1003 1004 #define SEG32(rs) \ 1005 case offsetof(struct user32, regs.rs): \ 1006 *val = get_segment_reg(child, \ 1007 offsetof(struct user_regs_struct, rs)); \ 1008 break 1009 1010 static int getreg32(struct task_struct *child, unsigned regno, u32 *val) 1011 { 1012 struct pt_regs *regs = task_pt_regs(child); 1013 1014 switch (regno) { 1015 1016 SEG32(ds); 1017 SEG32(es); 1018 SEG32(fs); 1019 SEG32(gs); 1020 1021 R32(cs, cs); 1022 R32(ss, ss); 1023 R32(ebx, bx); 1024 R32(ecx, cx); 1025 R32(edx, dx); 1026 R32(edi, di); 1027 R32(esi, si); 1028 R32(ebp, bp); 1029 R32(eax, ax); 1030 R32(orig_eax, orig_ax); 1031 R32(eip, ip); 1032 R32(esp, sp); 1033 1034 case offsetof(struct user32, regs.eflags): 1035 *val = get_flags(child); 1036 break; 1037 1038 case offsetof(struct user32, u_debugreg[0]) ... 1039 offsetof(struct user32, u_debugreg[7]): 1040 regno -= offsetof(struct user32, u_debugreg[0]); 1041 *val = ptrace_get_debugreg(child, regno / 4); 1042 break; 1043 1044 default: 1045 if (regno > sizeof(struct user32) || (regno & 3)) 1046 return -EIO; 1047 1048 /* 1049 * Other dummy fields in the virtual user structure 1050 * are ignored 1051 */ 1052 *val = 0; 1053 break; 1054 } 1055 return 0; 1056 } 1057 1058 #undef R32 1059 #undef SEG32 1060 1061 static int genregs32_get(struct task_struct *target, 1062 const struct user_regset *regset, 1063 unsigned int pos, unsigned int count, 1064 void *kbuf, void __user *ubuf) 1065 { 1066 if (kbuf) { 1067 compat_ulong_t *k = kbuf; 1068 while (count >= sizeof(*k)) { 1069 getreg32(target, pos, k++); 1070 count -= sizeof(*k); 1071 pos += sizeof(*k); 1072 } 1073 } else { 1074 compat_ulong_t __user *u = ubuf; 1075 while (count >= sizeof(*u)) { 1076 compat_ulong_t word; 1077 getreg32(target, pos, &word); 1078 if (__put_user(word, u++)) 1079 return -EFAULT; 1080 count -= sizeof(*u); 1081 pos += sizeof(*u); 1082 } 1083 } 1084 1085 return 0; 1086 } 1087 1088 static int genregs32_set(struct task_struct *target, 1089 const struct user_regset *regset, 1090 unsigned int pos, unsigned int count, 1091 const void *kbuf, const void __user *ubuf) 1092 { 1093 int ret = 0; 1094 if (kbuf) { 1095 const compat_ulong_t *k = kbuf; 1096 while (count >= sizeof(*k) && !ret) { 1097 ret = putreg32(target, pos, *k++); 1098 count -= sizeof(*k); 1099 pos += sizeof(*k); 1100 } 1101 } else { 1102 const compat_ulong_t __user *u = ubuf; 1103 while (count >= sizeof(*u) && !ret) { 1104 compat_ulong_t word; 1105 ret = __get_user(word, u++); 1106 if (ret) 1107 break; 1108 ret = putreg32(target, pos, word); 1109 count -= sizeof(*u); 1110 pos += sizeof(*u); 1111 } 1112 } 1113 return ret; 1114 } 1115 1116 long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 1117 compat_ulong_t caddr, compat_ulong_t cdata) 1118 { 1119 unsigned long addr = caddr; 1120 unsigned long data = cdata; 1121 void __user *datap = compat_ptr(data); 1122 int ret; 1123 __u32 val; 1124 1125 switch (request) { 1126 case PTRACE_PEEKUSR: 1127 ret = getreg32(child, addr, &val); 1128 if (ret == 0) 1129 ret = put_user(val, (__u32 __user *)datap); 1130 break; 1131 1132 case PTRACE_POKEUSR: 1133 ret = putreg32(child, addr, data); 1134 break; 1135 1136 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 1137 return copy_regset_to_user(child, &user_x86_32_view, 1138 REGSET_GENERAL, 1139 0, sizeof(struct user_regs_struct32), 1140 datap); 1141 1142 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 1143 return copy_regset_from_user(child, &user_x86_32_view, 1144 REGSET_GENERAL, 0, 1145 sizeof(struct user_regs_struct32), 1146 datap); 1147 1148 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 1149 return copy_regset_to_user(child, &user_x86_32_view, 1150 REGSET_FP, 0, 1151 sizeof(struct user_i387_ia32_struct), 1152 datap); 1153 1154 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 1155 return copy_regset_from_user( 1156 child, &user_x86_32_view, REGSET_FP, 1157 0, sizeof(struct user_i387_ia32_struct), datap); 1158 1159 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 1160 return copy_regset_to_user(child, &user_x86_32_view, 1161 REGSET_XFP, 0, 1162 sizeof(struct user32_fxsr_struct), 1163 datap); 1164 1165 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 1166 return copy_regset_from_user(child, &user_x86_32_view, 1167 REGSET_XFP, 0, 1168 sizeof(struct user32_fxsr_struct), 1169 datap); 1170 1171 case PTRACE_GET_THREAD_AREA: 1172 case PTRACE_SET_THREAD_AREA: 1173 return arch_ptrace(child, request, addr, data); 1174 1175 default: 1176 return compat_ptrace_request(child, request, addr, data); 1177 } 1178 1179 return ret; 1180 } 1181 1182 #endif /* CONFIG_IA32_EMULATION */ 1183 1184 #ifdef CONFIG_X86_64 1185 1186 static struct user_regset x86_64_regsets[] __read_mostly = { 1187 [REGSET_GENERAL] = { 1188 .core_note_type = NT_PRSTATUS, 1189 .n = sizeof(struct user_regs_struct) / sizeof(long), 1190 .size = sizeof(long), .align = sizeof(long), 1191 .get = genregs_get, .set = genregs_set 1192 }, 1193 [REGSET_FP] = { 1194 .core_note_type = NT_PRFPREG, 1195 .n = sizeof(struct user_i387_struct) / sizeof(long), 1196 .size = sizeof(long), .align = sizeof(long), 1197 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set 1198 }, 1199 [REGSET_XSTATE] = { 1200 .core_note_type = NT_X86_XSTATE, 1201 .size = sizeof(u64), .align = sizeof(u64), 1202 .active = xstateregs_active, .get = xstateregs_get, 1203 .set = xstateregs_set 1204 }, 1205 [REGSET_IOPERM64] = { 1206 .core_note_type = NT_386_IOPERM, 1207 .n = IO_BITMAP_LONGS, 1208 .size = sizeof(long), .align = sizeof(long), 1209 .active = ioperm_active, .get = ioperm_get 1210 }, 1211 }; 1212 1213 static const struct user_regset_view user_x86_64_view = { 1214 .name = "x86_64", .e_machine = EM_X86_64, 1215 .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets) 1216 }; 1217 1218 #else /* CONFIG_X86_32 */ 1219 1220 #define user_regs_struct32 user_regs_struct 1221 #define genregs32_get genregs_get 1222 #define genregs32_set genregs_set 1223 1224 #define user_i387_ia32_struct user_i387_struct 1225 #define user32_fxsr_struct user_fxsr_struct 1226 1227 #endif /* CONFIG_X86_64 */ 1228 1229 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1230 static struct user_regset x86_32_regsets[] __read_mostly = { 1231 [REGSET_GENERAL] = { 1232 .core_note_type = NT_PRSTATUS, 1233 .n = sizeof(struct user_regs_struct32) / sizeof(u32), 1234 .size = sizeof(u32), .align = sizeof(u32), 1235 .get = genregs32_get, .set = genregs32_set 1236 }, 1237 [REGSET_FP] = { 1238 .core_note_type = NT_PRFPREG, 1239 .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32), 1240 .size = sizeof(u32), .align = sizeof(u32), 1241 .active = fpregs_active, .get = fpregs_get, .set = fpregs_set 1242 }, 1243 [REGSET_XFP] = { 1244 .core_note_type = NT_PRXFPREG, 1245 .n = sizeof(struct user32_fxsr_struct) / sizeof(u32), 1246 .size = sizeof(u32), .align = sizeof(u32), 1247 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set 1248 }, 1249 [REGSET_XSTATE] = { 1250 .core_note_type = NT_X86_XSTATE, 1251 .size = sizeof(u64), .align = sizeof(u64), 1252 .active = xstateregs_active, .get = xstateregs_get, 1253 .set = xstateregs_set 1254 }, 1255 [REGSET_TLS] = { 1256 .core_note_type = NT_386_TLS, 1257 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN, 1258 .size = sizeof(struct user_desc), 1259 .align = sizeof(struct user_desc), 1260 .active = regset_tls_active, 1261 .get = regset_tls_get, .set = regset_tls_set 1262 }, 1263 [REGSET_IOPERM32] = { 1264 .core_note_type = NT_386_IOPERM, 1265 .n = IO_BITMAP_BYTES / sizeof(u32), 1266 .size = sizeof(u32), .align = sizeof(u32), 1267 .active = ioperm_active, .get = ioperm_get 1268 }, 1269 }; 1270 1271 static const struct user_regset_view user_x86_32_view = { 1272 .name = "i386", .e_machine = EM_386, 1273 .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets) 1274 }; 1275 #endif 1276 1277 /* 1278 * This represents bytes 464..511 in the memory layout exported through 1279 * the REGSET_XSTATE interface. 1280 */ 1281 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS]; 1282 1283 void update_regset_xstate_info(unsigned int size, u64 xstate_mask) 1284 { 1285 #ifdef CONFIG_X86_64 1286 x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1287 #endif 1288 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1289 x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1290 #endif 1291 xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask; 1292 } 1293 1294 const struct user_regset_view *task_user_regset_view(struct task_struct *task) 1295 { 1296 #ifdef CONFIG_IA32_EMULATION 1297 if (test_tsk_thread_flag(task, TIF_IA32)) 1298 #endif 1299 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1300 return &user_x86_32_view; 1301 #endif 1302 #ifdef CONFIG_X86_64 1303 return &user_x86_64_view; 1304 #endif 1305 } 1306 1307 static void fill_sigtrap_info(struct task_struct *tsk, 1308 struct pt_regs *regs, 1309 int error_code, int si_code, 1310 struct siginfo *info) 1311 { 1312 tsk->thread.trap_no = 1; 1313 tsk->thread.error_code = error_code; 1314 1315 memset(info, 0, sizeof(*info)); 1316 info->si_signo = SIGTRAP; 1317 info->si_code = si_code; 1318 info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL; 1319 } 1320 1321 void user_single_step_siginfo(struct task_struct *tsk, 1322 struct pt_regs *regs, 1323 struct siginfo *info) 1324 { 1325 fill_sigtrap_info(tsk, regs, 0, TRAP_BRKPT, info); 1326 } 1327 1328 void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, 1329 int error_code, int si_code) 1330 { 1331 struct siginfo info; 1332 1333 fill_sigtrap_info(tsk, regs, error_code, si_code, &info); 1334 /* Send us the fake SIGTRAP */ 1335 force_sig_info(SIGTRAP, &info, tsk); 1336 } 1337 1338 1339 #ifdef CONFIG_X86_32 1340 # define IS_IA32 1 1341 #elif defined CONFIG_IA32_EMULATION 1342 # define IS_IA32 is_compat_task() 1343 #else 1344 # define IS_IA32 0 1345 #endif 1346 1347 /* 1348 * We must return the syscall number to actually look up in the table. 1349 * This can be -1L to skip running any syscall at all. 1350 */ 1351 asmregparm long syscall_trace_enter(struct pt_regs *regs) 1352 { 1353 long ret = 0; 1354 1355 /* 1356 * If we stepped into a sysenter/syscall insn, it trapped in 1357 * kernel mode; do_debug() cleared TF and set TIF_SINGLESTEP. 1358 * If user-mode had set TF itself, then it's still clear from 1359 * do_debug() and we need to set it again to restore the user 1360 * state. If we entered on the slow path, TF was already set. 1361 */ 1362 if (test_thread_flag(TIF_SINGLESTEP)) 1363 regs->flags |= X86_EFLAGS_TF; 1364 1365 /* do the secure computing check first */ 1366 secure_computing(regs->orig_ax); 1367 1368 if (unlikely(test_thread_flag(TIF_SYSCALL_EMU))) 1369 ret = -1L; 1370 1371 if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) && 1372 tracehook_report_syscall_entry(regs)) 1373 ret = -1L; 1374 1375 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 1376 trace_sys_enter(regs, regs->orig_ax); 1377 1378 if (unlikely(current->audit_context)) { 1379 if (IS_IA32) 1380 audit_syscall_entry(AUDIT_ARCH_I386, 1381 regs->orig_ax, 1382 regs->bx, regs->cx, 1383 regs->dx, regs->si); 1384 #ifdef CONFIG_X86_64 1385 else 1386 audit_syscall_entry(AUDIT_ARCH_X86_64, 1387 regs->orig_ax, 1388 regs->di, regs->si, 1389 regs->dx, regs->r10); 1390 #endif 1391 } 1392 1393 return ret ?: regs->orig_ax; 1394 } 1395 1396 asmregparm void syscall_trace_leave(struct pt_regs *regs) 1397 { 1398 bool step; 1399 1400 if (unlikely(current->audit_context)) 1401 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax); 1402 1403 if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) 1404 trace_sys_exit(regs, regs->ax); 1405 1406 /* 1407 * If TIF_SYSCALL_EMU is set, we only get here because of 1408 * TIF_SINGLESTEP (i.e. this is PTRACE_SYSEMU_SINGLESTEP). 1409 * We already reported this syscall instruction in 1410 * syscall_trace_enter(). 1411 */ 1412 step = unlikely(test_thread_flag(TIF_SINGLESTEP)) && 1413 !test_thread_flag(TIF_SYSCALL_EMU); 1414 if (step || test_thread_flag(TIF_SYSCALL_TRACE)) 1415 tracehook_report_syscall_exit(regs, step); 1416 } 1417