linux/arch/x86/kernel/ptrace.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-only
   2/* By Ross Biro 1/23/92 */
   3/*
   4 * Pentium III FXSR, SSE support
   5 *      Gareth Hughes <gareth@valinux.com>, May 2000
   6 */
   7
   8#include <linux/kernel.h>
   9#include <linux/sched.h>
  10#include <linux/sched/task_stack.h>
  11#include <linux/mm.h>
  12#include <linux/smp.h>
  13#include <linux/errno.h>
  14#include <linux/slab.h>
  15#include <linux/ptrace.h>
  16#include <linux/tracehook.h>
  17#include <linux/user.h>
  18#include <linux/elf.h>
  19#include <linux/security.h>
  20#include <linux/audit.h>
  21#include <linux/seccomp.h>
  22#include <linux/signal.h>
  23#include <linux/perf_event.h>
  24#include <linux/hw_breakpoint.h>
  25#include <linux/rcupdate.h>
  26#include <linux/export.h>
  27#include <linux/context_tracking.h>
  28#include <linux/nospec.h>
  29
  30#include <linux/uaccess.h>
  31#include <asm/processor.h>
  32#include <asm/fpu/internal.h>
  33#include <asm/fpu/signal.h>
  34#include <asm/fpu/regset.h>
  35#include <asm/debugreg.h>
  36#include <asm/ldt.h>
  37#include <asm/desc.h>
  38#include <asm/prctl.h>
  39#include <asm/proto.h>
  40#include <asm/hw_breakpoint.h>
  41#include <asm/traps.h>
  42#include <asm/syscall.h>
  43#include <asm/fsgsbase.h>
  44#include <asm/io_bitmap.h>
  45
  46#include "tls.h"
  47
  48enum x86_regset {
  49        REGSET_GENERAL,
  50        REGSET_FP,
  51        REGSET_XFP,
  52        REGSET_IOPERM64 = REGSET_XFP,
  53        REGSET_XSTATE,
  54        REGSET_TLS,
  55        REGSET_IOPERM32,
  56};
  57
  58struct pt_regs_offset {
  59        const char *name;
  60        int offset;
  61};
  62
  63#define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)}
  64#define REG_OFFSET_END {.name = NULL, .offset = 0}
  65
  66static const struct pt_regs_offset regoffset_table[] = {
  67#ifdef CONFIG_X86_64
  68        REG_OFFSET_NAME(r15),
  69        REG_OFFSET_NAME(r14),
  70        REG_OFFSET_NAME(r13),
  71        REG_OFFSET_NAME(r12),
  72        REG_OFFSET_NAME(r11),
  73        REG_OFFSET_NAME(r10),
  74        REG_OFFSET_NAME(r9),
  75        REG_OFFSET_NAME(r8),
  76#endif
  77        REG_OFFSET_NAME(bx),
  78        REG_OFFSET_NAME(cx),
  79        REG_OFFSET_NAME(dx),
  80        REG_OFFSET_NAME(si),
  81        REG_OFFSET_NAME(di),
  82        REG_OFFSET_NAME(bp),
  83        REG_OFFSET_NAME(ax),
  84#ifdef CONFIG_X86_32
  85        REG_OFFSET_NAME(ds),
  86        REG_OFFSET_NAME(es),
  87        REG_OFFSET_NAME(fs),
  88        REG_OFFSET_NAME(gs),
  89#endif
  90        REG_OFFSET_NAME(orig_ax),
  91        REG_OFFSET_NAME(ip),
  92        REG_OFFSET_NAME(cs),
  93        REG_OFFSET_NAME(flags),
  94        REG_OFFSET_NAME(sp),
  95        REG_OFFSET_NAME(ss),
  96        REG_OFFSET_END,
  97};
  98
  99/**
 100 * regs_query_register_offset() - query register offset from its name
 101 * @name:       the name of a register
 102 *
 103 * regs_query_register_offset() returns the offset of a register in struct
 104 * pt_regs from its name. If the name is invalid, this returns -EINVAL;
 105 */
 106int regs_query_register_offset(const char *name)
 107{
 108        const struct pt_regs_offset *roff;
 109        for (roff = regoffset_table; roff->name != NULL; roff++)
 110                if (!strcmp(roff->name, name))
 111                        return roff->offset;
 112        return -EINVAL;
 113}
 114
 115/**
 116 * regs_query_register_name() - query register name from its offset
 117 * @offset:     the offset of a register in struct pt_regs.
 118 *
 119 * regs_query_register_name() returns the name of a register from its
 120 * offset in struct pt_regs. If the @offset is invalid, this returns NULL;
 121 */
 122const char *regs_query_register_name(unsigned int offset)
 123{
 124        const struct pt_regs_offset *roff;
 125        for (roff = regoffset_table; roff->name != NULL; roff++)
 126                if (roff->offset == offset)
 127                        return roff->name;
 128        return NULL;
 129}
 130
 131/*
 132 * does not yet catch signals sent when the child dies.
 133 * in exit.c or in signal.c.
 134 */
 135
 136/*
 137 * Determines which flags the user has access to [1 = access, 0 = no access].
 138 */
 139#define FLAG_MASK_32            ((unsigned long)                        \
 140                                 (X86_EFLAGS_CF | X86_EFLAGS_PF |       \
 141                                  X86_EFLAGS_AF | X86_EFLAGS_ZF |       \
 142                                  X86_EFLAGS_SF | X86_EFLAGS_TF |       \
 143                                  X86_EFLAGS_DF | X86_EFLAGS_OF |       \
 144                                  X86_EFLAGS_RF | X86_EFLAGS_AC))
 145
 146/*
 147 * Determines whether a value may be installed in a segment register.
 148 */
 149static inline bool invalid_selector(u16 value)
 150{
 151        return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL);
 152}
 153
 154#ifdef CONFIG_X86_32
 155
 156#define FLAG_MASK               FLAG_MASK_32
 157
 158static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 159{
 160        BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
 161        return &regs->bx + (regno >> 2);
 162}
 163
 164static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 165{
 166        /*
 167         * Returning the value truncates it to 16 bits.
 168         */
 169        unsigned int retval;
 170        if (offset != offsetof(struct user_regs_struct, gs))
 171                retval = *pt_regs_access(task_pt_regs(task), offset);
 172        else {
 173                if (task == current)
 174                        retval = get_user_gs(task_pt_regs(task));
 175                else
 176                        retval = task_user_gs(task);
 177        }
 178        return retval;
 179}
 180
 181static int set_segment_reg(struct task_struct *task,
 182                           unsigned long offset, u16 value)
 183{
 184        if (WARN_ON_ONCE(task == current))
 185                return -EIO;
 186
 187        /*
 188         * The value argument was already truncated to 16 bits.
 189         */
 190        if (invalid_selector(value))
 191                return -EIO;
 192
 193        /*
 194         * For %cs and %ss we cannot permit a null selector.
 195         * We can permit a bogus selector as long as it has USER_RPL.
 196         * Null selectors are fine for other segment registers, but
 197         * we will never get back to user mode with invalid %cs or %ss
 198         * and will take the trap in iret instead.  Much code relies
 199         * on user_mode() to distinguish a user trap frame (which can
 200         * safely use invalid selectors) from a kernel trap frame.
 201         */
 202        switch (offset) {
 203        case offsetof(struct user_regs_struct, cs):
 204        case offsetof(struct user_regs_struct, ss):
 205                if (unlikely(value == 0))
 206                        return -EIO;
 207                fallthrough;
 208
 209        default:
 210                *pt_regs_access(task_pt_regs(task), offset) = value;
 211                break;
 212
 213        case offsetof(struct user_regs_struct, gs):
 214                task_user_gs(task) = value;
 215        }
 216
 217        return 0;
 218}
 219
 220#else  /* CONFIG_X86_64 */
 221
 222#define FLAG_MASK               (FLAG_MASK_32 | X86_EFLAGS_NT)
 223
 224static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
 225{
 226        BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
 227        return &regs->r15 + (offset / sizeof(regs->r15));
 228}
 229
 230static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 231{
 232        /*
 233         * Returning the value truncates it to 16 bits.
 234         */
 235        unsigned int seg;
 236
 237        switch (offset) {
 238        case offsetof(struct user_regs_struct, fs):
 239                if (task == current) {
 240                        /* Older gas can't assemble movq %?s,%r?? */
 241                        asm("movl %%fs,%0" : "=r" (seg));
 242                        return seg;
 243                }
 244                return task->thread.fsindex;
 245        case offsetof(struct user_regs_struct, gs):
 246                if (task == current) {
 247                        asm("movl %%gs,%0" : "=r" (seg));
 248                        return seg;
 249                }
 250                return task->thread.gsindex;
 251        case offsetof(struct user_regs_struct, ds):
 252                if (task == current) {
 253                        asm("movl %%ds,%0" : "=r" (seg));
 254                        return seg;
 255                }
 256                return task->thread.ds;
 257        case offsetof(struct user_regs_struct, es):
 258                if (task == current) {
 259                        asm("movl %%es,%0" : "=r" (seg));
 260                        return seg;
 261                }
 262                return task->thread.es;
 263
 264        case offsetof(struct user_regs_struct, cs):
 265        case offsetof(struct user_regs_struct, ss):
 266                break;
 267        }
 268        return *pt_regs_access(task_pt_regs(task), offset);
 269}
 270
 271static int set_segment_reg(struct task_struct *task,
 272                           unsigned long offset, u16 value)
 273{
 274        if (WARN_ON_ONCE(task == current))
 275                return -EIO;
 276
 277        /*
 278         * The value argument was already truncated to 16 bits.
 279         */
 280        if (invalid_selector(value))
 281                return -EIO;
 282
 283        /*
 284         * Writes to FS and GS will change the stored selector.  Whether
 285         * this changes the segment base as well depends on whether
 286         * FSGSBASE is enabled.
 287         */
 288
 289        switch (offset) {
 290        case offsetof(struct user_regs_struct,fs):
 291                task->thread.fsindex = value;
 292                break;
 293        case offsetof(struct user_regs_struct,gs):
 294                task->thread.gsindex = value;
 295                break;
 296        case offsetof(struct user_regs_struct,ds):
 297                task->thread.ds = value;
 298                break;
 299        case offsetof(struct user_regs_struct,es):
 300                task->thread.es = value;
 301                break;
 302
 303                /*
 304                 * Can't actually change these in 64-bit mode.
 305                 */
 306        case offsetof(struct user_regs_struct,cs):
 307                if (unlikely(value == 0))
 308                        return -EIO;
 309                task_pt_regs(task)->cs = value;
 310                break;
 311        case offsetof(struct user_regs_struct,ss):
 312                if (unlikely(value == 0))
 313                        return -EIO;
 314                task_pt_regs(task)->ss = value;
 315                break;
 316        }
 317
 318        return 0;
 319}
 320
 321#endif  /* CONFIG_X86_32 */
 322
 323static unsigned long get_flags(struct task_struct *task)
 324{
 325        unsigned long retval = task_pt_regs(task)->flags;
 326
 327        /*
 328         * If the debugger set TF, hide it from the readout.
 329         */
 330        if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 331                retval &= ~X86_EFLAGS_TF;
 332
 333        return retval;
 334}
 335
 336static int set_flags(struct task_struct *task, unsigned long value)
 337{
 338        struct pt_regs *regs = task_pt_regs(task);
 339
 340        /*
 341         * If the user value contains TF, mark that
 342         * it was not "us" (the debugger) that set it.
 343         * If not, make sure it stays set if we had.
 344         */
 345        if (value & X86_EFLAGS_TF)
 346                clear_tsk_thread_flag(task, TIF_FORCED_TF);
 347        else if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 348                value |= X86_EFLAGS_TF;
 349
 350        regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK);
 351
 352        return 0;
 353}
 354
 355static int putreg(struct task_struct *child,
 356                  unsigned long offset, unsigned long value)
 357{
 358        switch (offset) {
 359        case offsetof(struct user_regs_struct, cs):
 360        case offsetof(struct user_regs_struct, ds):
 361        case offsetof(struct user_regs_struct, es):
 362        case offsetof(struct user_regs_struct, fs):
 363        case offsetof(struct user_regs_struct, gs):
 364        case offsetof(struct user_regs_struct, ss):
 365                return set_segment_reg(child, offset, value);
 366
 367        case offsetof(struct user_regs_struct, flags):
 368                return set_flags(child, value);
 369
 370#ifdef CONFIG_X86_64
 371        case offsetof(struct user_regs_struct,fs_base):
 372                if (value >= TASK_SIZE_MAX)
 373                        return -EIO;
 374                x86_fsbase_write_task(child, value);
 375                return 0;
 376        case offsetof(struct user_regs_struct,gs_base):
 377                if (value >= TASK_SIZE_MAX)
 378                        return -EIO;
 379                x86_gsbase_write_task(child, value);
 380                return 0;
 381#endif
 382        }
 383
 384        *pt_regs_access(task_pt_regs(child), offset) = value;
 385        return 0;
 386}
 387
 388static unsigned long getreg(struct task_struct *task, unsigned long offset)
 389{
 390        switch (offset) {
 391        case offsetof(struct user_regs_struct, cs):
 392        case offsetof(struct user_regs_struct, ds):
 393        case offsetof(struct user_regs_struct, es):
 394        case offsetof(struct user_regs_struct, fs):
 395        case offsetof(struct user_regs_struct, gs):
 396        case offsetof(struct user_regs_struct, ss):
 397                return get_segment_reg(task, offset);
 398
 399        case offsetof(struct user_regs_struct, flags):
 400                return get_flags(task);
 401
 402#ifdef CONFIG_X86_64
 403        case offsetof(struct user_regs_struct, fs_base):
 404                return x86_fsbase_read_task(task);
 405        case offsetof(struct user_regs_struct, gs_base):
 406                return x86_gsbase_read_task(task);
 407#endif
 408        }
 409
 410        return *pt_regs_access(task_pt_regs(task), offset);
 411}
 412
 413static int genregs_get(struct task_struct *target,
 414                       const struct user_regset *regset,
 415                       struct membuf to)
 416{
 417        int reg;
 418
 419        for (reg = 0; to.left; reg++)
 420                membuf_store(&to, getreg(target, reg * sizeof(unsigned long)));
 421        return 0;
 422}
 423
 424static int genregs_set(struct task_struct *target,
 425                       const struct user_regset *regset,
 426                       unsigned int pos, unsigned int count,
 427                       const void *kbuf, const void __user *ubuf)
 428{
 429        int ret = 0;
 430        if (kbuf) {
 431                const unsigned long *k = kbuf;
 432                while (count >= sizeof(*k) && !ret) {
 433                        ret = putreg(target, pos, *k++);
 434                        count -= sizeof(*k);
 435                        pos += sizeof(*k);
 436                }
 437        } else {
 438                const unsigned long  __user *u = ubuf;
 439                while (count >= sizeof(*u) && !ret) {
 440                        unsigned long word;
 441                        ret = __get_user(word, u++);
 442                        if (ret)
 443                                break;
 444                        ret = putreg(target, pos, word);
 445                        count -= sizeof(*u);
 446                        pos += sizeof(*u);
 447                }
 448        }
 449        return ret;
 450}
 451
 452static void ptrace_triggered(struct perf_event *bp,
 453                             struct perf_sample_data *data,
 454                             struct pt_regs *regs)
 455{
 456        int i;
 457        struct thread_struct *thread = &(current->thread);
 458
 459        /*
 460         * Store in the virtual DR6 register the fact that the breakpoint
 461         * was hit so the thread's debugger will see it.
 462         */
 463        for (i = 0; i < HBP_NUM; i++) {
 464                if (thread->ptrace_bps[i] == bp)
 465                        break;
 466        }
 467
 468        thread->virtual_dr6 |= (DR_TRAP0 << i);
 469}
 470
 471/*
 472 * Walk through every ptrace breakpoints for this thread and
 473 * build the dr7 value on top of their attributes.
 474 *
 475 */
 476static unsigned long ptrace_get_dr7(struct perf_event *bp[])
 477{
 478        int i;
 479        int dr7 = 0;
 480        struct arch_hw_breakpoint *info;
 481
 482        for (i = 0; i < HBP_NUM; i++) {
 483                if (bp[i] && !bp[i]->attr.disabled) {
 484                        info = counter_arch_bp(bp[i]);
 485                        dr7 |= encode_dr7(i, info->len, info->type);
 486                }
 487        }
 488
 489        return dr7;
 490}
 491
 492static int ptrace_fill_bp_fields(struct perf_event_attr *attr,
 493                                        int len, int type, bool disabled)
 494{
 495        int err, bp_len, bp_type;
 496
 497        err = arch_bp_generic_fields(len, type, &bp_len, &bp_type);
 498        if (!err) {
 499                attr->bp_len = bp_len;
 500                attr->bp_type = bp_type;
 501                attr->disabled = disabled;
 502        }
 503
 504        return err;
 505}
 506
 507static struct perf_event *
 508ptrace_register_breakpoint(struct task_struct *tsk, int len, int type,
 509                                unsigned long addr, bool disabled)
 510{
 511        struct perf_event_attr attr;
 512        int err;
 513
 514        ptrace_breakpoint_init(&attr);
 515        attr.bp_addr = addr;
 516
 517        err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 518        if (err)
 519                return ERR_PTR(err);
 520
 521        return register_user_hw_breakpoint(&attr, ptrace_triggered,
 522                                                 NULL, tsk);
 523}
 524
 525static int ptrace_modify_breakpoint(struct perf_event *bp, int len, int type,
 526                                        int disabled)
 527{
 528        struct perf_event_attr attr = bp->attr;
 529        int err;
 530
 531        err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 532        if (err)
 533                return err;
 534
 535        return modify_user_hw_breakpoint(bp, &attr);
 536}
 537
 538/*
 539 * Handle ptrace writes to debug register 7.
 540 */
 541static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data)
 542{
 543        struct thread_struct *thread = &tsk->thread;
 544        unsigned long old_dr7;
 545        bool second_pass = false;
 546        int i, rc, ret = 0;
 547
 548        data &= ~DR_CONTROL_RESERVED;
 549        old_dr7 = ptrace_get_dr7(thread->ptrace_bps);
 550
 551restore:
 552        rc = 0;
 553        for (i = 0; i < HBP_NUM; i++) {
 554                unsigned len, type;
 555                bool disabled = !decode_dr7(data, i, &len, &type);
 556                struct perf_event *bp = thread->ptrace_bps[i];
 557
 558                if (!bp) {
 559                        if (disabled)
 560                                continue;
 561
 562                        bp = ptrace_register_breakpoint(tsk,
 563                                        len, type, 0, disabled);
 564                        if (IS_ERR(bp)) {
 565                                rc = PTR_ERR(bp);
 566                                break;
 567                        }
 568
 569                        thread->ptrace_bps[i] = bp;
 570                        continue;
 571                }
 572
 573                rc = ptrace_modify_breakpoint(bp, len, type, disabled);
 574                if (rc)
 575                        break;
 576        }
 577
 578        /* Restore if the first pass failed, second_pass shouldn't fail. */
 579        if (rc && !WARN_ON(second_pass)) {
 580                ret = rc;
 581                data = old_dr7;
 582                second_pass = true;
 583                goto restore;
 584        }
 585
 586        return ret;
 587}
 588
 589/*
 590 * Handle PTRACE_PEEKUSR calls for the debug register area.
 591 */
 592static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
 593{
 594        struct thread_struct *thread = &tsk->thread;
 595        unsigned long val = 0;
 596
 597        if (n < HBP_NUM) {
 598                int index = array_index_nospec(n, HBP_NUM);
 599                struct perf_event *bp = thread->ptrace_bps[index];
 600
 601                if (bp)
 602                        val = bp->hw.info.address;
 603        } else if (n == 6) {
 604                val = thread->virtual_dr6 ^ DR6_RESERVED; /* Flip back to arch polarity */
 605        } else if (n == 7) {
 606                val = thread->ptrace_dr7;
 607        }
 608        return val;
 609}
 610
 611static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
 612                                      unsigned long addr)
 613{
 614        struct thread_struct *t = &tsk->thread;
 615        struct perf_event *bp = t->ptrace_bps[nr];
 616        int err = 0;
 617
 618        if (!bp) {
 619                /*
 620                 * Put stub len and type to create an inactive but correct bp.
 621                 *
 622                 * CHECKME: the previous code returned -EIO if the addr wasn't
 623                 * a valid task virtual addr. The new one will return -EINVAL in
 624                 *  this case.
 625                 * -EINVAL may be what we want for in-kernel breakpoints users,
 626                 * but -EIO looks better for ptrace, since we refuse a register
 627                 * writing for the user. And anyway this is the previous
 628                 * behaviour.
 629                 */
 630                bp = ptrace_register_breakpoint(tsk,
 631                                X86_BREAKPOINT_LEN_1, X86_BREAKPOINT_WRITE,
 632                                addr, true);
 633                if (IS_ERR(bp))
 634                        err = PTR_ERR(bp);
 635                else
 636                        t->ptrace_bps[nr] = bp;
 637        } else {
 638                struct perf_event_attr attr = bp->attr;
 639
 640                attr.bp_addr = addr;
 641                err = modify_user_hw_breakpoint(bp, &attr);
 642        }
 643
 644        return err;
 645}
 646
 647/*
 648 * Handle PTRACE_POKEUSR calls for the debug register area.
 649 */
 650static int ptrace_set_debugreg(struct task_struct *tsk, int n,
 651                               unsigned long val)
 652{
 653        struct thread_struct *thread = &tsk->thread;
 654        /* There are no DR4 or DR5 registers */
 655        int rc = -EIO;
 656
 657        if (n < HBP_NUM) {
 658                rc = ptrace_set_breakpoint_addr(tsk, n, val);
 659        } else if (n == 6) {
 660                thread->virtual_dr6 = val ^ DR6_RESERVED; /* Flip to positive polarity */
 661                rc = 0;
 662        } else if (n == 7) {
 663                rc = ptrace_write_dr7(tsk, val);
 664                if (!rc)
 665                        thread->ptrace_dr7 = val;
 666        }
 667        return rc;
 668}
 669
 670/*
 671 * These access the current or another (stopped) task's io permission
 672 * bitmap for debugging or core dump.
 673 */
 674static int ioperm_active(struct task_struct *target,
 675                         const struct user_regset *regset)
 676{
 677        struct io_bitmap *iobm = target->thread.io_bitmap;
 678
 679        return iobm ? DIV_ROUND_UP(iobm->max, regset->size) : 0;
 680}
 681
 682static int ioperm_get(struct task_struct *target,
 683                      const struct user_regset *regset,
 684                      struct membuf to)
 685{
 686        struct io_bitmap *iobm = target->thread.io_bitmap;
 687
 688        if (!iobm)
 689                return -ENXIO;
 690
 691        return membuf_write(&to, iobm->bitmap, IO_BITMAP_BYTES);
 692}
 693
 694/*
 695 * Called by kernel/ptrace.c when detaching..
 696 *
 697 * Make sure the single step bit is not set.
 698 */
 699void ptrace_disable(struct task_struct *child)
 700{
 701        user_disable_single_step(child);
 702}
 703
 704#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 705static const struct user_regset_view user_x86_32_view; /* Initialized below. */
 706#endif
 707
 708long arch_ptrace(struct task_struct *child, long request,
 709                 unsigned long addr, unsigned long data)
 710{
 711        int ret;
 712        unsigned long __user *datap = (unsigned long __user *)data;
 713
 714        switch (request) {
 715        /* read the word at location addr in the USER area. */
 716        case PTRACE_PEEKUSR: {
 717                unsigned long tmp;
 718
 719                ret = -EIO;
 720                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 721                        break;
 722
 723                tmp = 0;  /* Default return condition */
 724                if (addr < sizeof(struct user_regs_struct))
 725                        tmp = getreg(child, addr);
 726                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 727                         addr <= offsetof(struct user, u_debugreg[7])) {
 728                        addr -= offsetof(struct user, u_debugreg[0]);
 729                        tmp = ptrace_get_debugreg(child, addr / sizeof(data));
 730                }
 731                ret = put_user(tmp, datap);
 732                break;
 733        }
 734
 735        case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
 736                ret = -EIO;
 737                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 738                        break;
 739
 740                if (addr < sizeof(struct user_regs_struct))
 741                        ret = putreg(child, addr, data);
 742                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 743                         addr <= offsetof(struct user, u_debugreg[7])) {
 744                        addr -= offsetof(struct user, u_debugreg[0]);
 745                        ret = ptrace_set_debugreg(child,
 746                                                  addr / sizeof(data), data);
 747                }
 748                break;
 749
 750        case PTRACE_GETREGS:    /* Get all gp regs from the child. */
 751                return copy_regset_to_user(child,
 752                                           task_user_regset_view(current),
 753                                           REGSET_GENERAL,
 754                                           0, sizeof(struct user_regs_struct),
 755                                           datap);
 756
 757        case PTRACE_SETREGS:    /* Set all gp regs in the child. */
 758                return copy_regset_from_user(child,
 759                                             task_user_regset_view(current),
 760                                             REGSET_GENERAL,
 761                                             0, sizeof(struct user_regs_struct),
 762                                             datap);
 763
 764        case PTRACE_GETFPREGS:  /* Get the child FPU state. */
 765                return copy_regset_to_user(child,
 766                                           task_user_regset_view(current),
 767                                           REGSET_FP,
 768                                           0, sizeof(struct user_i387_struct),
 769                                           datap);
 770
 771        case PTRACE_SETFPREGS:  /* Set the child FPU state. */
 772                return copy_regset_from_user(child,
 773                                             task_user_regset_view(current),
 774                                             REGSET_FP,
 775                                             0, sizeof(struct user_i387_struct),
 776                                             datap);
 777
 778#ifdef CONFIG_X86_32
 779        case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
 780                return copy_regset_to_user(child, &user_x86_32_view,
 781                                           REGSET_XFP,
 782                                           0, sizeof(struct user_fxsr_struct),
 783                                           datap) ? -EIO : 0;
 784
 785        case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
 786                return copy_regset_from_user(child, &user_x86_32_view,
 787                                             REGSET_XFP,
 788                                             0, sizeof(struct user_fxsr_struct),
 789                                             datap) ? -EIO : 0;
 790#endif
 791
 792#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 793        case PTRACE_GET_THREAD_AREA:
 794                if ((int) addr < 0)
 795                        return -EIO;
 796                ret = do_get_thread_area(child, addr,
 797                                        (struct user_desc __user *)data);
 798                break;
 799
 800        case PTRACE_SET_THREAD_AREA:
 801                if ((int) addr < 0)
 802                        return -EIO;
 803                ret = do_set_thread_area(child, addr,
 804                                        (struct user_desc __user *)data, 0);
 805                break;
 806#endif
 807
 808#ifdef CONFIG_X86_64
 809                /* normal 64bit interface to access TLS data.
 810                   Works just like arch_prctl, except that the arguments
 811                   are reversed. */
 812        case PTRACE_ARCH_PRCTL:
 813                ret = do_arch_prctl_64(child, data, addr);
 814                break;
 815#endif
 816
 817        default:
 818                ret = ptrace_request(child, request, addr, data);
 819                break;
 820        }
 821
 822        return ret;
 823}
 824
 825#ifdef CONFIG_IA32_EMULATION
 826
 827#include <linux/compat.h>
 828#include <linux/syscalls.h>
 829#include <asm/ia32.h>
 830#include <asm/user32.h>
 831
 832#define R32(l,q)                                                        \
 833        case offsetof(struct user32, regs.l):                           \
 834                regs->q = value; break
 835
 836#define SEG32(rs)                                                       \
 837        case offsetof(struct user32, regs.rs):                          \
 838                return set_segment_reg(child,                           \
 839                                       offsetof(struct user_regs_struct, rs), \
 840                                       value);                          \
 841                break
 842
 843static int putreg32(struct task_struct *child, unsigned regno, u32 value)
 844{
 845        struct pt_regs *regs = task_pt_regs(child);
 846        int ret;
 847
 848        switch (regno) {
 849
 850        SEG32(cs);
 851        SEG32(ds);
 852        SEG32(es);
 853
 854        /*
 855         * A 32-bit ptracer on a 64-bit kernel expects that writing
 856         * FS or GS will also update the base.  This is needed for
 857         * operations like PTRACE_SETREGS to fully restore a saved
 858         * CPU state.
 859         */
 860
 861        case offsetof(struct user32, regs.fs):
 862                ret = set_segment_reg(child,
 863                                      offsetof(struct user_regs_struct, fs),
 864                                      value);
 865                if (ret == 0)
 866                        child->thread.fsbase =
 867                                x86_fsgsbase_read_task(child, value);
 868                return ret;
 869
 870        case offsetof(struct user32, regs.gs):
 871                ret = set_segment_reg(child,
 872                                      offsetof(struct user_regs_struct, gs),
 873                                      value);
 874                if (ret == 0)
 875                        child->thread.gsbase =
 876                                x86_fsgsbase_read_task(child, value);
 877                return ret;
 878
 879        SEG32(ss);
 880
 881        R32(ebx, bx);
 882        R32(ecx, cx);
 883        R32(edx, dx);
 884        R32(edi, di);
 885        R32(esi, si);
 886        R32(ebp, bp);
 887        R32(eax, ax);
 888        R32(eip, ip);
 889        R32(esp, sp);
 890
 891        case offsetof(struct user32, regs.orig_eax):
 892                /*
 893                 * Warning: bizarre corner case fixup here.  A 32-bit
 894                 * debugger setting orig_eax to -1 wants to disable
 895                 * syscall restart.  Make sure that the syscall
 896                 * restart code sign-extends orig_ax.  Also make sure
 897                 * we interpret the -ERESTART* codes correctly if
 898                 * loaded into regs->ax in case the task is not
 899                 * actually still sitting at the exit from a 32-bit
 900                 * syscall with TS_COMPAT still set.
 901                 */
 902                regs->orig_ax = value;
 903                if (syscall_get_nr(child, regs) >= 0)
 904                        child->thread_info.status |= TS_I386_REGS_POKED;
 905                break;
 906
 907        case offsetof(struct user32, regs.eflags):
 908                return set_flags(child, value);
 909
 910        case offsetof(struct user32, u_debugreg[0]) ...
 911                offsetof(struct user32, u_debugreg[7]):
 912                regno -= offsetof(struct user32, u_debugreg[0]);
 913                return ptrace_set_debugreg(child, regno / 4, value);
 914
 915        default:
 916                if (regno > sizeof(struct user32) || (regno & 3))
 917                        return -EIO;
 918
 919                /*
 920                 * Other dummy fields in the virtual user structure
 921                 * are ignored
 922                 */
 923                break;
 924        }
 925        return 0;
 926}
 927
 928#undef R32
 929#undef SEG32
 930
 931#define R32(l,q)                                                        \
 932        case offsetof(struct user32, regs.l):                           \
 933                *val = regs->q; break
 934
 935#define SEG32(rs)                                                       \
 936        case offsetof(struct user32, regs.rs):                          \
 937                *val = get_segment_reg(child,                           \
 938                                       offsetof(struct user_regs_struct, rs)); \
 939                break
 940
 941static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
 942{
 943        struct pt_regs *regs = task_pt_regs(child);
 944
 945        switch (regno) {
 946
 947        SEG32(ds);
 948        SEG32(es);
 949        SEG32(fs);
 950        SEG32(gs);
 951
 952        R32(cs, cs);
 953        R32(ss, ss);
 954        R32(ebx, bx);
 955        R32(ecx, cx);
 956        R32(edx, dx);
 957        R32(edi, di);
 958        R32(esi, si);
 959        R32(ebp, bp);
 960        R32(eax, ax);
 961        R32(orig_eax, orig_ax);
 962        R32(eip, ip);
 963        R32(esp, sp);
 964
 965        case offsetof(struct user32, regs.eflags):
 966                *val = get_flags(child);
 967                break;
 968
 969        case offsetof(struct user32, u_debugreg[0]) ...
 970                offsetof(struct user32, u_debugreg[7]):
 971                regno -= offsetof(struct user32, u_debugreg[0]);
 972                *val = ptrace_get_debugreg(child, regno / 4);
 973                break;
 974
 975        default:
 976                if (regno > sizeof(struct user32) || (regno & 3))
 977                        return -EIO;
 978
 979                /*
 980                 * Other dummy fields in the virtual user structure
 981                 * are ignored
 982                 */
 983                *val = 0;
 984                break;
 985        }
 986        return 0;
 987}
 988
 989#undef R32
 990#undef SEG32
 991
 992static int genregs32_get(struct task_struct *target,
 993                         const struct user_regset *regset,
 994                         struct membuf to)
 995{
 996        int reg;
 997
 998        for (reg = 0; to.left; reg++) {
 999                u32 val;
1000                getreg32(target, reg * 4, &val);
1001                membuf_store(&to, val);
1002        }
1003        return 0;
1004}
1005
1006static int genregs32_set(struct task_struct *target,
1007                         const struct user_regset *regset,
1008                         unsigned int pos, unsigned int count,
1009                         const void *kbuf, const void __user *ubuf)
1010{
1011        int ret = 0;
1012        if (kbuf) {
1013                const compat_ulong_t *k = kbuf;
1014                while (count >= sizeof(*k) && !ret) {
1015                        ret = putreg32(target, pos, *k++);
1016                        count -= sizeof(*k);
1017                        pos += sizeof(*k);
1018                }
1019        } else {
1020                const compat_ulong_t __user *u = ubuf;
1021                while (count >= sizeof(*u) && !ret) {
1022                        compat_ulong_t word;
1023                        ret = __get_user(word, u++);
1024                        if (ret)
1025                                break;
1026                        ret = putreg32(target, pos, word);
1027                        count -= sizeof(*u);
1028                        pos += sizeof(*u);
1029                }
1030        }
1031        return ret;
1032}
1033
1034static long ia32_arch_ptrace(struct task_struct *child, compat_long_t request,
1035                             compat_ulong_t caddr, compat_ulong_t cdata)
1036{
1037        unsigned long addr = caddr;
1038        unsigned long data = cdata;
1039        void __user *datap = compat_ptr(data);
1040        int ret;
1041        __u32 val;
1042
1043        switch (request) {
1044        case PTRACE_PEEKUSR:
1045                ret = getreg32(child, addr, &val);
1046                if (ret == 0)
1047                        ret = put_user(val, (__u32 __user *)datap);
1048                break;
1049
1050        case PTRACE_POKEUSR:
1051                ret = putreg32(child, addr, data);
1052                break;
1053
1054        case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1055                return copy_regset_to_user(child, &user_x86_32_view,
1056                                           REGSET_GENERAL,
1057                                           0, sizeof(struct user_regs_struct32),
1058                                           datap);
1059
1060        case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1061                return copy_regset_from_user(child, &user_x86_32_view,
1062                                             REGSET_GENERAL, 0,
1063                                             sizeof(struct user_regs_struct32),
1064                                             datap);
1065
1066        case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1067                return copy_regset_to_user(child, &user_x86_32_view,
1068                                           REGSET_FP, 0,
1069                                           sizeof(struct user_i387_ia32_struct),
1070                                           datap);
1071
1072        case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1073                return copy_regset_from_user(
1074                        child, &user_x86_32_view, REGSET_FP,
1075                        0, sizeof(struct user_i387_ia32_struct), datap);
1076
1077        case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
1078                return copy_regset_to_user(child, &user_x86_32_view,
1079                                           REGSET_XFP, 0,
1080                                           sizeof(struct user32_fxsr_struct),
1081                                           datap);
1082
1083        case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
1084                return copy_regset_from_user(child, &user_x86_32_view,
1085                                             REGSET_XFP, 0,
1086                                             sizeof(struct user32_fxsr_struct),
1087                                             datap);
1088
1089        case PTRACE_GET_THREAD_AREA:
1090        case PTRACE_SET_THREAD_AREA:
1091                return arch_ptrace(child, request, addr, data);
1092
1093        default:
1094                return compat_ptrace_request(child, request, addr, data);
1095        }
1096
1097        return ret;
1098}
1099#endif /* CONFIG_IA32_EMULATION */
1100
1101#ifdef CONFIG_X86_X32_ABI
1102static long x32_arch_ptrace(struct task_struct *child,
1103                            compat_long_t request, compat_ulong_t caddr,
1104                            compat_ulong_t cdata)
1105{
1106        unsigned long addr = caddr;
1107        unsigned long data = cdata;
1108        void __user *datap = compat_ptr(data);
1109        int ret;
1110
1111        switch (request) {
1112        /* Read 32bits at location addr in the USER area.  Only allow
1113           to return the lower 32bits of segment and debug registers.  */
1114        case PTRACE_PEEKUSR: {
1115                u32 tmp;
1116
1117                ret = -EIO;
1118                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1119                    addr < offsetof(struct user_regs_struct, cs))
1120                        break;
1121
1122                tmp = 0;  /* Default return condition */
1123                if (addr < sizeof(struct user_regs_struct))
1124                        tmp = getreg(child, addr);
1125                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1126                         addr <= offsetof(struct user, u_debugreg[7])) {
1127                        addr -= offsetof(struct user, u_debugreg[0]);
1128                        tmp = ptrace_get_debugreg(child, addr / sizeof(data));
1129                }
1130                ret = put_user(tmp, (__u32 __user *)datap);
1131                break;
1132        }
1133
1134        /* Write the word at location addr in the USER area.  Only allow
1135           to update segment and debug registers with the upper 32bits
1136           zero-extended. */
1137        case PTRACE_POKEUSR:
1138                ret = -EIO;
1139                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1140                    addr < offsetof(struct user_regs_struct, cs))
1141                        break;
1142
1143                if (addr < sizeof(struct user_regs_struct))
1144                        ret = putreg(child, addr, data);
1145                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1146                         addr <= offsetof(struct user, u_debugreg[7])) {
1147                        addr -= offsetof(struct user, u_debugreg[0]);
1148                        ret = ptrace_set_debugreg(child,
1149                                                  addr / sizeof(data), data);
1150                }
1151                break;
1152
1153        case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1154                return copy_regset_to_user(child,
1155                                           task_user_regset_view(current),
1156                                           REGSET_GENERAL,
1157                                           0, sizeof(struct user_regs_struct),
1158                                           datap);
1159
1160        case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1161                return copy_regset_from_user(child,
1162                                             task_user_regset_view(current),
1163                                             REGSET_GENERAL,
1164                                             0, sizeof(struct user_regs_struct),
1165                                             datap);
1166
1167        case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1168                return copy_regset_to_user(child,
1169                                           task_user_regset_view(current),
1170                                           REGSET_FP,
1171                                           0, sizeof(struct user_i387_struct),
1172                                           datap);
1173
1174        case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1175                return copy_regset_from_user(child,
1176                                             task_user_regset_view(current),
1177                                             REGSET_FP,
1178                                             0, sizeof(struct user_i387_struct),
1179                                             datap);
1180
1181        default:
1182                return compat_ptrace_request(child, request, addr, data);
1183        }
1184
1185        return ret;
1186}
1187#endif
1188
1189#ifdef CONFIG_COMPAT
1190long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1191                        compat_ulong_t caddr, compat_ulong_t cdata)
1192{
1193#ifdef CONFIG_X86_X32_ABI
1194        if (!in_ia32_syscall())
1195                return x32_arch_ptrace(child, request, caddr, cdata);
1196#endif
1197#ifdef CONFIG_IA32_EMULATION
1198        return ia32_arch_ptrace(child, request, caddr, cdata);
1199#else
1200        return 0;
1201#endif
1202}
1203#endif  /* CONFIG_COMPAT */
1204
1205#ifdef CONFIG_X86_64
1206
1207static struct user_regset x86_64_regsets[] __ro_after_init = {
1208        [REGSET_GENERAL] = {
1209                .core_note_type = NT_PRSTATUS,
1210                .n = sizeof(struct user_regs_struct) / sizeof(long),
1211                .size = sizeof(long), .align = sizeof(long),
1212                .regset_get = genregs_get, .set = genregs_set
1213        },
1214        [REGSET_FP] = {
1215                .core_note_type = NT_PRFPREG,
1216                .n = sizeof(struct user_i387_struct) / sizeof(long),
1217                .size = sizeof(long), .align = sizeof(long),
1218                .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
1219        },
1220        [REGSET_XSTATE] = {
1221                .core_note_type = NT_X86_XSTATE,
1222                .size = sizeof(u64), .align = sizeof(u64),
1223                .active = xstateregs_active, .regset_get = xstateregs_get,
1224                .set = xstateregs_set
1225        },
1226        [REGSET_IOPERM64] = {
1227                .core_note_type = NT_386_IOPERM,
1228                .n = IO_BITMAP_LONGS,
1229                .size = sizeof(long), .align = sizeof(long),
1230                .active = ioperm_active, .regset_get = ioperm_get
1231        },
1232};
1233
1234static const struct user_regset_view user_x86_64_view = {
1235        .name = "x86_64", .e_machine = EM_X86_64,
1236        .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets)
1237};
1238
1239#else  /* CONFIG_X86_32 */
1240
1241#define user_regs_struct32      user_regs_struct
1242#define genregs32_get           genregs_get
1243#define genregs32_set           genregs_set
1244
1245#endif  /* CONFIG_X86_64 */
1246
1247#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1248static struct user_regset x86_32_regsets[] __ro_after_init = {
1249        [REGSET_GENERAL] = {
1250                .core_note_type = NT_PRSTATUS,
1251                .n = sizeof(struct user_regs_struct32) / sizeof(u32),
1252                .size = sizeof(u32), .align = sizeof(u32),
1253                .regset_get = genregs32_get, .set = genregs32_set
1254        },
1255        [REGSET_FP] = {
1256                .core_note_type = NT_PRFPREG,
1257                .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32),
1258                .size = sizeof(u32), .align = sizeof(u32),
1259                .active = regset_fpregs_active, .regset_get = fpregs_get, .set = fpregs_set
1260        },
1261        [REGSET_XFP] = {
1262                .core_note_type = NT_PRXFPREG,
1263                .n = sizeof(struct user32_fxsr_struct) / sizeof(u32),
1264                .size = sizeof(u32), .align = sizeof(u32),
1265                .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
1266        },
1267        [REGSET_XSTATE] = {
1268                .core_note_type = NT_X86_XSTATE,
1269                .size = sizeof(u64), .align = sizeof(u64),
1270                .active = xstateregs_active, .regset_get = xstateregs_get,
1271                .set = xstateregs_set
1272        },
1273        [REGSET_TLS] = {
1274                .core_note_type = NT_386_TLS,
1275                .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN,
1276                .size = sizeof(struct user_desc),
1277                .align = sizeof(struct user_desc),
1278                .active = regset_tls_active,
1279                .regset_get = regset_tls_get, .set = regset_tls_set
1280        },
1281        [REGSET_IOPERM32] = {
1282                .core_note_type = NT_386_IOPERM,
1283                .n = IO_BITMAP_BYTES / sizeof(u32),
1284                .size = sizeof(u32), .align = sizeof(u32),
1285                .active = ioperm_active, .regset_get = ioperm_get
1286        },
1287};
1288
1289static const struct user_regset_view user_x86_32_view = {
1290        .name = "i386", .e_machine = EM_386,
1291        .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets)
1292};
1293#endif
1294
1295/*
1296 * This represents bytes 464..511 in the memory layout exported through
1297 * the REGSET_XSTATE interface.
1298 */
1299u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
1300
1301void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
1302{
1303#ifdef CONFIG_X86_64
1304        x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1305#endif
1306#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1307        x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1308#endif
1309        xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
1310}
1311
1312const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1313{
1314#ifdef CONFIG_IA32_EMULATION
1315        if (!user_64bit_mode(task_pt_regs(task)))
1316#endif
1317#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1318                return &user_x86_32_view;
1319#endif
1320#ifdef CONFIG_X86_64
1321        return &user_x86_64_view;
1322#endif
1323}
1324
1325void send_sigtrap(struct pt_regs *regs, int error_code, int si_code)
1326{
1327        struct task_struct *tsk = current;
1328
1329        tsk->thread.trap_nr = X86_TRAP_DB;
1330        tsk->thread.error_code = error_code;
1331
1332        /* Send us the fake SIGTRAP */
1333        force_sig_fault(SIGTRAP, si_code,
1334                        user_mode(regs) ? (void __user *)regs->ip : NULL);
1335}
1336
1337void user_single_step_report(struct pt_regs *regs)
1338{
1339        send_sigtrap(regs, 0, TRAP_BRKPT);
1340}
1341