linux/arch/x86/kernel/ptrace.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-only
   2/* By Ross Biro 1/23/92 */
   3/*
   4 * Pentium III FXSR, SSE support
   5 *      Gareth Hughes <gareth@valinux.com>, May 2000
   6 */
   7
   8#include <linux/kernel.h>
   9#include <linux/sched.h>
  10#include <linux/sched/task_stack.h>
  11#include <linux/mm.h>
  12#include <linux/smp.h>
  13#include <linux/errno.h>
  14#include <linux/slab.h>
  15#include <linux/ptrace.h>
  16#include <linux/tracehook.h>
  17#include <linux/user.h>
  18#include <linux/elf.h>
  19#include <linux/security.h>
  20#include <linux/audit.h>
  21#include <linux/seccomp.h>
  22#include <linux/signal.h>
  23#include <linux/perf_event.h>
  24#include <linux/hw_breakpoint.h>
  25#include <linux/rcupdate.h>
  26#include <linux/export.h>
  27#include <linux/context_tracking.h>
  28#include <linux/nospec.h>
  29
  30#include <linux/uaccess.h>
  31#include <asm/processor.h>
  32#include <asm/fpu/internal.h>
  33#include <asm/fpu/signal.h>
  34#include <asm/fpu/regset.h>
  35#include <asm/debugreg.h>
  36#include <asm/ldt.h>
  37#include <asm/desc.h>
  38#include <asm/prctl.h>
  39#include <asm/proto.h>
  40#include <asm/hw_breakpoint.h>
  41#include <asm/traps.h>
  42#include <asm/syscall.h>
  43#include <asm/fsgsbase.h>
  44#include <asm/io_bitmap.h>
  45
  46#include "tls.h"
  47
  48enum x86_regset {
  49        REGSET_GENERAL,
  50        REGSET_FP,
  51        REGSET_XFP,
  52        REGSET_IOPERM64 = REGSET_XFP,
  53        REGSET_XSTATE,
  54        REGSET_TLS,
  55        REGSET_IOPERM32,
  56};
  57
  58struct pt_regs_offset {
  59        const char *name;
  60        int offset;
  61};
  62
  63#define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)}
  64#define REG_OFFSET_END {.name = NULL, .offset = 0}
  65
  66static const struct pt_regs_offset regoffset_table[] = {
  67#ifdef CONFIG_X86_64
  68        REG_OFFSET_NAME(r15),
  69        REG_OFFSET_NAME(r14),
  70        REG_OFFSET_NAME(r13),
  71        REG_OFFSET_NAME(r12),
  72        REG_OFFSET_NAME(r11),
  73        REG_OFFSET_NAME(r10),
  74        REG_OFFSET_NAME(r9),
  75        REG_OFFSET_NAME(r8),
  76#endif
  77        REG_OFFSET_NAME(bx),
  78        REG_OFFSET_NAME(cx),
  79        REG_OFFSET_NAME(dx),
  80        REG_OFFSET_NAME(si),
  81        REG_OFFSET_NAME(di),
  82        REG_OFFSET_NAME(bp),
  83        REG_OFFSET_NAME(ax),
  84#ifdef CONFIG_X86_32
  85        REG_OFFSET_NAME(ds),
  86        REG_OFFSET_NAME(es),
  87        REG_OFFSET_NAME(fs),
  88        REG_OFFSET_NAME(gs),
  89#endif
  90        REG_OFFSET_NAME(orig_ax),
  91        REG_OFFSET_NAME(ip),
  92        REG_OFFSET_NAME(cs),
  93        REG_OFFSET_NAME(flags),
  94        REG_OFFSET_NAME(sp),
  95        REG_OFFSET_NAME(ss),
  96        REG_OFFSET_END,
  97};
  98
  99/**
 100 * regs_query_register_offset() - query register offset from its name
 101 * @name:       the name of a register
 102 *
 103 * regs_query_register_offset() returns the offset of a register in struct
 104 * pt_regs from its name. If the name is invalid, this returns -EINVAL;
 105 */
 106int regs_query_register_offset(const char *name)
 107{
 108        const struct pt_regs_offset *roff;
 109        for (roff = regoffset_table; roff->name != NULL; roff++)
 110                if (!strcmp(roff->name, name))
 111                        return roff->offset;
 112        return -EINVAL;
 113}
 114
 115/**
 116 * regs_query_register_name() - query register name from its offset
 117 * @offset:     the offset of a register in struct pt_regs.
 118 *
 119 * regs_query_register_name() returns the name of a register from its
 120 * offset in struct pt_regs. If the @offset is invalid, this returns NULL;
 121 */
 122const char *regs_query_register_name(unsigned int offset)
 123{
 124        const struct pt_regs_offset *roff;
 125        for (roff = regoffset_table; roff->name != NULL; roff++)
 126                if (roff->offset == offset)
 127                        return roff->name;
 128        return NULL;
 129}
 130
 131/*
 132 * does not yet catch signals sent when the child dies.
 133 * in exit.c or in signal.c.
 134 */
 135
 136/*
 137 * Determines which flags the user has access to [1 = access, 0 = no access].
 138 */
 139#define FLAG_MASK_32            ((unsigned long)                        \
 140                                 (X86_EFLAGS_CF | X86_EFLAGS_PF |       \
 141                                  X86_EFLAGS_AF | X86_EFLAGS_ZF |       \
 142                                  X86_EFLAGS_SF | X86_EFLAGS_TF |       \
 143                                  X86_EFLAGS_DF | X86_EFLAGS_OF |       \
 144                                  X86_EFLAGS_RF | X86_EFLAGS_AC))
 145
 146/*
 147 * Determines whether a value may be installed in a segment register.
 148 */
 149static inline bool invalid_selector(u16 value)
 150{
 151        return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL);
 152}
 153
 154#ifdef CONFIG_X86_32
 155
 156#define FLAG_MASK               FLAG_MASK_32
 157
 158static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 159{
 160        BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
 161        return &regs->bx + (regno >> 2);
 162}
 163
 164static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 165{
 166        /*
 167         * Returning the value truncates it to 16 bits.
 168         */
 169        unsigned int retval;
 170        if (offset != offsetof(struct user_regs_struct, gs))
 171                retval = *pt_regs_access(task_pt_regs(task), offset);
 172        else {
 173                if (task == current)
 174                        retval = get_user_gs(task_pt_regs(task));
 175                else
 176                        retval = task_user_gs(task);
 177        }
 178        return retval;
 179}
 180
 181static int set_segment_reg(struct task_struct *task,
 182                           unsigned long offset, u16 value)
 183{
 184        if (WARN_ON_ONCE(task == current))
 185                return -EIO;
 186
 187        /*
 188         * The value argument was already truncated to 16 bits.
 189         */
 190        if (invalid_selector(value))
 191                return -EIO;
 192
 193        /*
 194         * For %cs and %ss we cannot permit a null selector.
 195         * We can permit a bogus selector as long as it has USER_RPL.
 196         * Null selectors are fine for other segment registers, but
 197         * we will never get back to user mode with invalid %cs or %ss
 198         * and will take the trap in iret instead.  Much code relies
 199         * on user_mode() to distinguish a user trap frame (which can
 200         * safely use invalid selectors) from a kernel trap frame.
 201         */
 202        switch (offset) {
 203        case offsetof(struct user_regs_struct, cs):
 204        case offsetof(struct user_regs_struct, ss):
 205                if (unlikely(value == 0))
 206                        return -EIO;
 207                /* Else, fall through */
 208
 209        default:
 210                *pt_regs_access(task_pt_regs(task), offset) = value;
 211                break;
 212
 213        case offsetof(struct user_regs_struct, gs):
 214                task_user_gs(task) = value;
 215        }
 216
 217        return 0;
 218}
 219
 220#else  /* CONFIG_X86_64 */
 221
 222#define FLAG_MASK               (FLAG_MASK_32 | X86_EFLAGS_NT)
 223
 224static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
 225{
 226        BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
 227        return &regs->r15 + (offset / sizeof(regs->r15));
 228}
 229
 230static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 231{
 232        /*
 233         * Returning the value truncates it to 16 bits.
 234         */
 235        unsigned int seg;
 236
 237        switch (offset) {
 238        case offsetof(struct user_regs_struct, fs):
 239                if (task == current) {
 240                        /* Older gas can't assemble movq %?s,%r?? */
 241                        asm("movl %%fs,%0" : "=r" (seg));
 242                        return seg;
 243                }
 244                return task->thread.fsindex;
 245        case offsetof(struct user_regs_struct, gs):
 246                if (task == current) {
 247                        asm("movl %%gs,%0" : "=r" (seg));
 248                        return seg;
 249                }
 250                return task->thread.gsindex;
 251        case offsetof(struct user_regs_struct, ds):
 252                if (task == current) {
 253                        asm("movl %%ds,%0" : "=r" (seg));
 254                        return seg;
 255                }
 256                return task->thread.ds;
 257        case offsetof(struct user_regs_struct, es):
 258                if (task == current) {
 259                        asm("movl %%es,%0" : "=r" (seg));
 260                        return seg;
 261                }
 262                return task->thread.es;
 263
 264        case offsetof(struct user_regs_struct, cs):
 265        case offsetof(struct user_regs_struct, ss):
 266                break;
 267        }
 268        return *pt_regs_access(task_pt_regs(task), offset);
 269}
 270
 271static int set_segment_reg(struct task_struct *task,
 272                           unsigned long offset, u16 value)
 273{
 274        if (WARN_ON_ONCE(task == current))
 275                return -EIO;
 276
 277        /*
 278         * The value argument was already truncated to 16 bits.
 279         */
 280        if (invalid_selector(value))
 281                return -EIO;
 282
 283        /*
 284         * This function has some ABI oddities.
 285         *
 286         * A 32-bit ptracer probably expects that writing FS or GS will change
 287         * FSBASE or GSBASE respectively.  In the absence of FSGSBASE support,
 288         * this code indeed has that effect.  When FSGSBASE is added, this
 289         * will require a special case.
 290         *
 291         * For existing 64-bit ptracers, writing FS or GS *also* currently
 292         * changes the base if the selector is nonzero the next time the task
 293         * is run.  This behavior may not be needed, and trying to preserve it
 294         * when FSGSBASE is added would be complicated at best.
 295         */
 296
 297        switch (offset) {
 298        case offsetof(struct user_regs_struct,fs):
 299                task->thread.fsindex = value;
 300                break;
 301        case offsetof(struct user_regs_struct,gs):
 302                task->thread.gsindex = value;
 303                break;
 304        case offsetof(struct user_regs_struct,ds):
 305                task->thread.ds = value;
 306                break;
 307        case offsetof(struct user_regs_struct,es):
 308                task->thread.es = value;
 309                break;
 310
 311                /*
 312                 * Can't actually change these in 64-bit mode.
 313                 */
 314        case offsetof(struct user_regs_struct,cs):
 315                if (unlikely(value == 0))
 316                        return -EIO;
 317                task_pt_regs(task)->cs = value;
 318                break;
 319        case offsetof(struct user_regs_struct,ss):
 320                if (unlikely(value == 0))
 321                        return -EIO;
 322                task_pt_regs(task)->ss = value;
 323                break;
 324        }
 325
 326        return 0;
 327}
 328
 329#endif  /* CONFIG_X86_32 */
 330
 331static unsigned long get_flags(struct task_struct *task)
 332{
 333        unsigned long retval = task_pt_regs(task)->flags;
 334
 335        /*
 336         * If the debugger set TF, hide it from the readout.
 337         */
 338        if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 339                retval &= ~X86_EFLAGS_TF;
 340
 341        return retval;
 342}
 343
 344static int set_flags(struct task_struct *task, unsigned long value)
 345{
 346        struct pt_regs *regs = task_pt_regs(task);
 347
 348        /*
 349         * If the user value contains TF, mark that
 350         * it was not "us" (the debugger) that set it.
 351         * If not, make sure it stays set if we had.
 352         */
 353        if (value & X86_EFLAGS_TF)
 354                clear_tsk_thread_flag(task, TIF_FORCED_TF);
 355        else if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 356                value |= X86_EFLAGS_TF;
 357
 358        regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK);
 359
 360        return 0;
 361}
 362
 363static int putreg(struct task_struct *child,
 364                  unsigned long offset, unsigned long value)
 365{
 366        switch (offset) {
 367        case offsetof(struct user_regs_struct, cs):
 368        case offsetof(struct user_regs_struct, ds):
 369        case offsetof(struct user_regs_struct, es):
 370        case offsetof(struct user_regs_struct, fs):
 371        case offsetof(struct user_regs_struct, gs):
 372        case offsetof(struct user_regs_struct, ss):
 373                return set_segment_reg(child, offset, value);
 374
 375        case offsetof(struct user_regs_struct, flags):
 376                return set_flags(child, value);
 377
 378#ifdef CONFIG_X86_64
 379        case offsetof(struct user_regs_struct,fs_base):
 380                if (value >= TASK_SIZE_MAX)
 381                        return -EIO;
 382                /*
 383                 * When changing the FS base, use do_arch_prctl_64()
 384                 * to set the index to zero and to set the base
 385                 * as requested.
 386                 *
 387                 * NB: This behavior is nonsensical and likely needs to
 388                 * change when FSGSBASE support is added.
 389                 */
 390                if (child->thread.fsbase != value)
 391                        return do_arch_prctl_64(child, ARCH_SET_FS, value);
 392                return 0;
 393        case offsetof(struct user_regs_struct,gs_base):
 394                /*
 395                 * Exactly the same here as the %fs handling above.
 396                 */
 397                if (value >= TASK_SIZE_MAX)
 398                        return -EIO;
 399                if (child->thread.gsbase != value)
 400                        return do_arch_prctl_64(child, ARCH_SET_GS, value);
 401                return 0;
 402#endif
 403        }
 404
 405        *pt_regs_access(task_pt_regs(child), offset) = value;
 406        return 0;
 407}
 408
 409static unsigned long getreg(struct task_struct *task, unsigned long offset)
 410{
 411        switch (offset) {
 412        case offsetof(struct user_regs_struct, cs):
 413        case offsetof(struct user_regs_struct, ds):
 414        case offsetof(struct user_regs_struct, es):
 415        case offsetof(struct user_regs_struct, fs):
 416        case offsetof(struct user_regs_struct, gs):
 417        case offsetof(struct user_regs_struct, ss):
 418                return get_segment_reg(task, offset);
 419
 420        case offsetof(struct user_regs_struct, flags):
 421                return get_flags(task);
 422
 423#ifdef CONFIG_X86_64
 424        case offsetof(struct user_regs_struct, fs_base):
 425                return x86_fsbase_read_task(task);
 426        case offsetof(struct user_regs_struct, gs_base):
 427                return x86_gsbase_read_task(task);
 428#endif
 429        }
 430
 431        return *pt_regs_access(task_pt_regs(task), offset);
 432}
 433
 434static int genregs_get(struct task_struct *target,
 435                       const struct user_regset *regset,
 436                       unsigned int pos, unsigned int count,
 437                       void *kbuf, void __user *ubuf)
 438{
 439        if (kbuf) {
 440                unsigned long *k = kbuf;
 441                while (count >= sizeof(*k)) {
 442                        *k++ = getreg(target, pos);
 443                        count -= sizeof(*k);
 444                        pos += sizeof(*k);
 445                }
 446        } else {
 447                unsigned long __user *u = ubuf;
 448                while (count >= sizeof(*u)) {
 449                        if (__put_user(getreg(target, pos), u++))
 450                                return -EFAULT;
 451                        count -= sizeof(*u);
 452                        pos += sizeof(*u);
 453                }
 454        }
 455
 456        return 0;
 457}
 458
 459static int genregs_set(struct task_struct *target,
 460                       const struct user_regset *regset,
 461                       unsigned int pos, unsigned int count,
 462                       const void *kbuf, const void __user *ubuf)
 463{
 464        int ret = 0;
 465        if (kbuf) {
 466                const unsigned long *k = kbuf;
 467                while (count >= sizeof(*k) && !ret) {
 468                        ret = putreg(target, pos, *k++);
 469                        count -= sizeof(*k);
 470                        pos += sizeof(*k);
 471                }
 472        } else {
 473                const unsigned long  __user *u = ubuf;
 474                while (count >= sizeof(*u) && !ret) {
 475                        unsigned long word;
 476                        ret = __get_user(word, u++);
 477                        if (ret)
 478                                break;
 479                        ret = putreg(target, pos, word);
 480                        count -= sizeof(*u);
 481                        pos += sizeof(*u);
 482                }
 483        }
 484        return ret;
 485}
 486
 487static void ptrace_triggered(struct perf_event *bp,
 488                             struct perf_sample_data *data,
 489                             struct pt_regs *regs)
 490{
 491        int i;
 492        struct thread_struct *thread = &(current->thread);
 493
 494        /*
 495         * Store in the virtual DR6 register the fact that the breakpoint
 496         * was hit so the thread's debugger will see it.
 497         */
 498        for (i = 0; i < HBP_NUM; i++) {
 499                if (thread->ptrace_bps[i] == bp)
 500                        break;
 501        }
 502
 503        thread->debugreg6 |= (DR_TRAP0 << i);
 504}
 505
 506/*
 507 * Walk through every ptrace breakpoints for this thread and
 508 * build the dr7 value on top of their attributes.
 509 *
 510 */
 511static unsigned long ptrace_get_dr7(struct perf_event *bp[])
 512{
 513        int i;
 514        int dr7 = 0;
 515        struct arch_hw_breakpoint *info;
 516
 517        for (i = 0; i < HBP_NUM; i++) {
 518                if (bp[i] && !bp[i]->attr.disabled) {
 519                        info = counter_arch_bp(bp[i]);
 520                        dr7 |= encode_dr7(i, info->len, info->type);
 521                }
 522        }
 523
 524        return dr7;
 525}
 526
 527static int ptrace_fill_bp_fields(struct perf_event_attr *attr,
 528                                        int len, int type, bool disabled)
 529{
 530        int err, bp_len, bp_type;
 531
 532        err = arch_bp_generic_fields(len, type, &bp_len, &bp_type);
 533        if (!err) {
 534                attr->bp_len = bp_len;
 535                attr->bp_type = bp_type;
 536                attr->disabled = disabled;
 537        }
 538
 539        return err;
 540}
 541
 542static struct perf_event *
 543ptrace_register_breakpoint(struct task_struct *tsk, int len, int type,
 544                                unsigned long addr, bool disabled)
 545{
 546        struct perf_event_attr attr;
 547        int err;
 548
 549        ptrace_breakpoint_init(&attr);
 550        attr.bp_addr = addr;
 551
 552        err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 553        if (err)
 554                return ERR_PTR(err);
 555
 556        return register_user_hw_breakpoint(&attr, ptrace_triggered,
 557                                                 NULL, tsk);
 558}
 559
 560static int ptrace_modify_breakpoint(struct perf_event *bp, int len, int type,
 561                                        int disabled)
 562{
 563        struct perf_event_attr attr = bp->attr;
 564        int err;
 565
 566        err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 567        if (err)
 568                return err;
 569
 570        return modify_user_hw_breakpoint(bp, &attr);
 571}
 572
 573/*
 574 * Handle ptrace writes to debug register 7.
 575 */
 576static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data)
 577{
 578        struct thread_struct *thread = &tsk->thread;
 579        unsigned long old_dr7;
 580        bool second_pass = false;
 581        int i, rc, ret = 0;
 582
 583        data &= ~DR_CONTROL_RESERVED;
 584        old_dr7 = ptrace_get_dr7(thread->ptrace_bps);
 585
 586restore:
 587        rc = 0;
 588        for (i = 0; i < HBP_NUM; i++) {
 589                unsigned len, type;
 590                bool disabled = !decode_dr7(data, i, &len, &type);
 591                struct perf_event *bp = thread->ptrace_bps[i];
 592
 593                if (!bp) {
 594                        if (disabled)
 595                                continue;
 596
 597                        bp = ptrace_register_breakpoint(tsk,
 598                                        len, type, 0, disabled);
 599                        if (IS_ERR(bp)) {
 600                                rc = PTR_ERR(bp);
 601                                break;
 602                        }
 603
 604                        thread->ptrace_bps[i] = bp;
 605                        continue;
 606                }
 607
 608                rc = ptrace_modify_breakpoint(bp, len, type, disabled);
 609                if (rc)
 610                        break;
 611        }
 612
 613        /* Restore if the first pass failed, second_pass shouldn't fail. */
 614        if (rc && !WARN_ON(second_pass)) {
 615                ret = rc;
 616                data = old_dr7;
 617                second_pass = true;
 618                goto restore;
 619        }
 620
 621        return ret;
 622}
 623
 624/*
 625 * Handle PTRACE_PEEKUSR calls for the debug register area.
 626 */
 627static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
 628{
 629        struct thread_struct *thread = &tsk->thread;
 630        unsigned long val = 0;
 631
 632        if (n < HBP_NUM) {
 633                int index = array_index_nospec(n, HBP_NUM);
 634                struct perf_event *bp = thread->ptrace_bps[index];
 635
 636                if (bp)
 637                        val = bp->hw.info.address;
 638        } else if (n == 6) {
 639                val = thread->debugreg6;
 640        } else if (n == 7) {
 641                val = thread->ptrace_dr7;
 642        }
 643        return val;
 644}
 645
 646static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
 647                                      unsigned long addr)
 648{
 649        struct thread_struct *t = &tsk->thread;
 650        struct perf_event *bp = t->ptrace_bps[nr];
 651        int err = 0;
 652
 653        if (!bp) {
 654                /*
 655                 * Put stub len and type to create an inactive but correct bp.
 656                 *
 657                 * CHECKME: the previous code returned -EIO if the addr wasn't
 658                 * a valid task virtual addr. The new one will return -EINVAL in
 659                 *  this case.
 660                 * -EINVAL may be what we want for in-kernel breakpoints users,
 661                 * but -EIO looks better for ptrace, since we refuse a register
 662                 * writing for the user. And anyway this is the previous
 663                 * behaviour.
 664                 */
 665                bp = ptrace_register_breakpoint(tsk,
 666                                X86_BREAKPOINT_LEN_1, X86_BREAKPOINT_WRITE,
 667                                addr, true);
 668                if (IS_ERR(bp))
 669                        err = PTR_ERR(bp);
 670                else
 671                        t->ptrace_bps[nr] = bp;
 672        } else {
 673                struct perf_event_attr attr = bp->attr;
 674
 675                attr.bp_addr = addr;
 676                err = modify_user_hw_breakpoint(bp, &attr);
 677        }
 678
 679        return err;
 680}
 681
 682/*
 683 * Handle PTRACE_POKEUSR calls for the debug register area.
 684 */
 685static int ptrace_set_debugreg(struct task_struct *tsk, int n,
 686                               unsigned long val)
 687{
 688        struct thread_struct *thread = &tsk->thread;
 689        /* There are no DR4 or DR5 registers */
 690        int rc = -EIO;
 691
 692        if (n < HBP_NUM) {
 693                rc = ptrace_set_breakpoint_addr(tsk, n, val);
 694        } else if (n == 6) {
 695                thread->debugreg6 = val;
 696                rc = 0;
 697        } else if (n == 7) {
 698                rc = ptrace_write_dr7(tsk, val);
 699                if (!rc)
 700                        thread->ptrace_dr7 = val;
 701        }
 702        return rc;
 703}
 704
 705/*
 706 * These access the current or another (stopped) task's io permission
 707 * bitmap for debugging or core dump.
 708 */
 709static int ioperm_active(struct task_struct *target,
 710                         const struct user_regset *regset)
 711{
 712        struct io_bitmap *iobm = target->thread.io_bitmap;
 713
 714        return iobm ? DIV_ROUND_UP(iobm->max, regset->size) : 0;
 715}
 716
 717static int ioperm_get(struct task_struct *target,
 718                      const struct user_regset *regset,
 719                      unsigned int pos, unsigned int count,
 720                      void *kbuf, void __user *ubuf)
 721{
 722        struct io_bitmap *iobm = target->thread.io_bitmap;
 723
 724        if (!iobm)
 725                return -ENXIO;
 726
 727        return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
 728                                   iobm->bitmap, 0, IO_BITMAP_BYTES);
 729}
 730
 731/*
 732 * Called by kernel/ptrace.c when detaching..
 733 *
 734 * Make sure the single step bit is not set.
 735 */
 736void ptrace_disable(struct task_struct *child)
 737{
 738        user_disable_single_step(child);
 739}
 740
 741#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 742static const struct user_regset_view user_x86_32_view; /* Initialized below. */
 743#endif
 744
 745long arch_ptrace(struct task_struct *child, long request,
 746                 unsigned long addr, unsigned long data)
 747{
 748        int ret;
 749        unsigned long __user *datap = (unsigned long __user *)data;
 750
 751        switch (request) {
 752        /* read the word at location addr in the USER area. */
 753        case PTRACE_PEEKUSR: {
 754                unsigned long tmp;
 755
 756                ret = -EIO;
 757                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 758                        break;
 759
 760                tmp = 0;  /* Default return condition */
 761                if (addr < sizeof(struct user_regs_struct))
 762                        tmp = getreg(child, addr);
 763                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 764                         addr <= offsetof(struct user, u_debugreg[7])) {
 765                        addr -= offsetof(struct user, u_debugreg[0]);
 766                        tmp = ptrace_get_debugreg(child, addr / sizeof(data));
 767                }
 768                ret = put_user(tmp, datap);
 769                break;
 770        }
 771
 772        case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
 773                ret = -EIO;
 774                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 775                        break;
 776
 777                if (addr < sizeof(struct user_regs_struct))
 778                        ret = putreg(child, addr, data);
 779                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 780                         addr <= offsetof(struct user, u_debugreg[7])) {
 781                        addr -= offsetof(struct user, u_debugreg[0]);
 782                        ret = ptrace_set_debugreg(child,
 783                                                  addr / sizeof(data), data);
 784                }
 785                break;
 786
 787        case PTRACE_GETREGS:    /* Get all gp regs from the child. */
 788                return copy_regset_to_user(child,
 789                                           task_user_regset_view(current),
 790                                           REGSET_GENERAL,
 791                                           0, sizeof(struct user_regs_struct),
 792                                           datap);
 793
 794        case PTRACE_SETREGS:    /* Set all gp regs in the child. */
 795                return copy_regset_from_user(child,
 796                                             task_user_regset_view(current),
 797                                             REGSET_GENERAL,
 798                                             0, sizeof(struct user_regs_struct),
 799                                             datap);
 800
 801        case PTRACE_GETFPREGS:  /* Get the child FPU state. */
 802                return copy_regset_to_user(child,
 803                                           task_user_regset_view(current),
 804                                           REGSET_FP,
 805                                           0, sizeof(struct user_i387_struct),
 806                                           datap);
 807
 808        case PTRACE_SETFPREGS:  /* Set the child FPU state. */
 809                return copy_regset_from_user(child,
 810                                             task_user_regset_view(current),
 811                                             REGSET_FP,
 812                                             0, sizeof(struct user_i387_struct),
 813                                             datap);
 814
 815#ifdef CONFIG_X86_32
 816        case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
 817                return copy_regset_to_user(child, &user_x86_32_view,
 818                                           REGSET_XFP,
 819                                           0, sizeof(struct user_fxsr_struct),
 820                                           datap) ? -EIO : 0;
 821
 822        case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
 823                return copy_regset_from_user(child, &user_x86_32_view,
 824                                             REGSET_XFP,
 825                                             0, sizeof(struct user_fxsr_struct),
 826                                             datap) ? -EIO : 0;
 827#endif
 828
 829#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 830        case PTRACE_GET_THREAD_AREA:
 831                if ((int) addr < 0)
 832                        return -EIO;
 833                ret = do_get_thread_area(child, addr,
 834                                        (struct user_desc __user *)data);
 835                break;
 836
 837        case PTRACE_SET_THREAD_AREA:
 838                if ((int) addr < 0)
 839                        return -EIO;
 840                ret = do_set_thread_area(child, addr,
 841                                        (struct user_desc __user *)data, 0);
 842                break;
 843#endif
 844
 845#ifdef CONFIG_X86_64
 846                /* normal 64bit interface to access TLS data.
 847                   Works just like arch_prctl, except that the arguments
 848                   are reversed. */
 849        case PTRACE_ARCH_PRCTL:
 850                ret = do_arch_prctl_64(child, data, addr);
 851                break;
 852#endif
 853
 854        default:
 855                ret = ptrace_request(child, request, addr, data);
 856                break;
 857        }
 858
 859        return ret;
 860}
 861
 862#ifdef CONFIG_IA32_EMULATION
 863
 864#include <linux/compat.h>
 865#include <linux/syscalls.h>
 866#include <asm/ia32.h>
 867#include <asm/user32.h>
 868
 869#define R32(l,q)                                                        \
 870        case offsetof(struct user32, regs.l):                           \
 871                regs->q = value; break
 872
 873#define SEG32(rs)                                                       \
 874        case offsetof(struct user32, regs.rs):                          \
 875                return set_segment_reg(child,                           \
 876                                       offsetof(struct user_regs_struct, rs), \
 877                                       value);                          \
 878                break
 879
 880static int putreg32(struct task_struct *child, unsigned regno, u32 value)
 881{
 882        struct pt_regs *regs = task_pt_regs(child);
 883
 884        switch (regno) {
 885
 886        SEG32(cs);
 887        SEG32(ds);
 888        SEG32(es);
 889        SEG32(fs);
 890        SEG32(gs);
 891        SEG32(ss);
 892
 893        R32(ebx, bx);
 894        R32(ecx, cx);
 895        R32(edx, dx);
 896        R32(edi, di);
 897        R32(esi, si);
 898        R32(ebp, bp);
 899        R32(eax, ax);
 900        R32(eip, ip);
 901        R32(esp, sp);
 902
 903        case offsetof(struct user32, regs.orig_eax):
 904                /*
 905                 * Warning: bizarre corner case fixup here.  A 32-bit
 906                 * debugger setting orig_eax to -1 wants to disable
 907                 * syscall restart.  Make sure that the syscall
 908                 * restart code sign-extends orig_ax.  Also make sure
 909                 * we interpret the -ERESTART* codes correctly if
 910                 * loaded into regs->ax in case the task is not
 911                 * actually still sitting at the exit from a 32-bit
 912                 * syscall with TS_COMPAT still set.
 913                 */
 914                regs->orig_ax = value;
 915                if (syscall_get_nr(child, regs) >= 0)
 916                        child->thread_info.status |= TS_I386_REGS_POKED;
 917                break;
 918
 919        case offsetof(struct user32, regs.eflags):
 920                return set_flags(child, value);
 921
 922        case offsetof(struct user32, u_debugreg[0]) ...
 923                offsetof(struct user32, u_debugreg[7]):
 924                regno -= offsetof(struct user32, u_debugreg[0]);
 925                return ptrace_set_debugreg(child, regno / 4, value);
 926
 927        default:
 928                if (regno > sizeof(struct user32) || (regno & 3))
 929                        return -EIO;
 930
 931                /*
 932                 * Other dummy fields in the virtual user structure
 933                 * are ignored
 934                 */
 935                break;
 936        }
 937        return 0;
 938}
 939
 940#undef R32
 941#undef SEG32
 942
 943#define R32(l,q)                                                        \
 944        case offsetof(struct user32, regs.l):                           \
 945                *val = regs->q; break
 946
 947#define SEG32(rs)                                                       \
 948        case offsetof(struct user32, regs.rs):                          \
 949                *val = get_segment_reg(child,                           \
 950                                       offsetof(struct user_regs_struct, rs)); \
 951                break
 952
 953static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
 954{
 955        struct pt_regs *regs = task_pt_regs(child);
 956
 957        switch (regno) {
 958
 959        SEG32(ds);
 960        SEG32(es);
 961        SEG32(fs);
 962        SEG32(gs);
 963
 964        R32(cs, cs);
 965        R32(ss, ss);
 966        R32(ebx, bx);
 967        R32(ecx, cx);
 968        R32(edx, dx);
 969        R32(edi, di);
 970        R32(esi, si);
 971        R32(ebp, bp);
 972        R32(eax, ax);
 973        R32(orig_eax, orig_ax);
 974        R32(eip, ip);
 975        R32(esp, sp);
 976
 977        case offsetof(struct user32, regs.eflags):
 978                *val = get_flags(child);
 979                break;
 980
 981        case offsetof(struct user32, u_debugreg[0]) ...
 982                offsetof(struct user32, u_debugreg[7]):
 983                regno -= offsetof(struct user32, u_debugreg[0]);
 984                *val = ptrace_get_debugreg(child, regno / 4);
 985                break;
 986
 987        default:
 988                if (regno > sizeof(struct user32) || (regno & 3))
 989                        return -EIO;
 990
 991                /*
 992                 * Other dummy fields in the virtual user structure
 993                 * are ignored
 994                 */
 995                *val = 0;
 996                break;
 997        }
 998        return 0;
 999}
1000
1001#undef R32
1002#undef SEG32
1003
1004static int genregs32_get(struct task_struct *target,
1005                         const struct user_regset *regset,
1006                         unsigned int pos, unsigned int count,
1007                         void *kbuf, void __user *ubuf)
1008{
1009        if (kbuf) {
1010                compat_ulong_t *k = kbuf;
1011                while (count >= sizeof(*k)) {
1012                        getreg32(target, pos, k++);
1013                        count -= sizeof(*k);
1014                        pos += sizeof(*k);
1015                }
1016        } else {
1017                compat_ulong_t __user *u = ubuf;
1018                while (count >= sizeof(*u)) {
1019                        compat_ulong_t word;
1020                        getreg32(target, pos, &word);
1021                        if (__put_user(word, u++))
1022                                return -EFAULT;
1023                        count -= sizeof(*u);
1024                        pos += sizeof(*u);
1025                }
1026        }
1027
1028        return 0;
1029}
1030
1031static int genregs32_set(struct task_struct *target,
1032                         const struct user_regset *regset,
1033                         unsigned int pos, unsigned int count,
1034                         const void *kbuf, const void __user *ubuf)
1035{
1036        int ret = 0;
1037        if (kbuf) {
1038                const compat_ulong_t *k = kbuf;
1039                while (count >= sizeof(*k) && !ret) {
1040                        ret = putreg32(target, pos, *k++);
1041                        count -= sizeof(*k);
1042                        pos += sizeof(*k);
1043                }
1044        } else {
1045                const compat_ulong_t __user *u = ubuf;
1046                while (count >= sizeof(*u) && !ret) {
1047                        compat_ulong_t word;
1048                        ret = __get_user(word, u++);
1049                        if (ret)
1050                                break;
1051                        ret = putreg32(target, pos, word);
1052                        count -= sizeof(*u);
1053                        pos += sizeof(*u);
1054                }
1055        }
1056        return ret;
1057}
1058
1059static long ia32_arch_ptrace(struct task_struct *child, compat_long_t request,
1060                             compat_ulong_t caddr, compat_ulong_t cdata)
1061{
1062        unsigned long addr = caddr;
1063        unsigned long data = cdata;
1064        void __user *datap = compat_ptr(data);
1065        int ret;
1066        __u32 val;
1067
1068        switch (request) {
1069        case PTRACE_PEEKUSR:
1070                ret = getreg32(child, addr, &val);
1071                if (ret == 0)
1072                        ret = put_user(val, (__u32 __user *)datap);
1073                break;
1074
1075        case PTRACE_POKEUSR:
1076                ret = putreg32(child, addr, data);
1077                break;
1078
1079        case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1080                return copy_regset_to_user(child, &user_x86_32_view,
1081                                           REGSET_GENERAL,
1082                                           0, sizeof(struct user_regs_struct32),
1083                                           datap);
1084
1085        case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1086                return copy_regset_from_user(child, &user_x86_32_view,
1087                                             REGSET_GENERAL, 0,
1088                                             sizeof(struct user_regs_struct32),
1089                                             datap);
1090
1091        case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1092                return copy_regset_to_user(child, &user_x86_32_view,
1093                                           REGSET_FP, 0,
1094                                           sizeof(struct user_i387_ia32_struct),
1095                                           datap);
1096
1097        case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1098                return copy_regset_from_user(
1099                        child, &user_x86_32_view, REGSET_FP,
1100                        0, sizeof(struct user_i387_ia32_struct), datap);
1101
1102        case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
1103                return copy_regset_to_user(child, &user_x86_32_view,
1104                                           REGSET_XFP, 0,
1105                                           sizeof(struct user32_fxsr_struct),
1106                                           datap);
1107
1108        case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
1109                return copy_regset_from_user(child, &user_x86_32_view,
1110                                             REGSET_XFP, 0,
1111                                             sizeof(struct user32_fxsr_struct),
1112                                             datap);
1113
1114        case PTRACE_GET_THREAD_AREA:
1115        case PTRACE_SET_THREAD_AREA:
1116                return arch_ptrace(child, request, addr, data);
1117
1118        default:
1119                return compat_ptrace_request(child, request, addr, data);
1120        }
1121
1122        return ret;
1123}
1124#endif /* CONFIG_IA32_EMULATION */
1125
1126#ifdef CONFIG_X86_X32_ABI
1127static long x32_arch_ptrace(struct task_struct *child,
1128                            compat_long_t request, compat_ulong_t caddr,
1129                            compat_ulong_t cdata)
1130{
1131        unsigned long addr = caddr;
1132        unsigned long data = cdata;
1133        void __user *datap = compat_ptr(data);
1134        int ret;
1135
1136        switch (request) {
1137        /* Read 32bits at location addr in the USER area.  Only allow
1138           to return the lower 32bits of segment and debug registers.  */
1139        case PTRACE_PEEKUSR: {
1140                u32 tmp;
1141
1142                ret = -EIO;
1143                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1144                    addr < offsetof(struct user_regs_struct, cs))
1145                        break;
1146
1147                tmp = 0;  /* Default return condition */
1148                if (addr < sizeof(struct user_regs_struct))
1149                        tmp = getreg(child, addr);
1150                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1151                         addr <= offsetof(struct user, u_debugreg[7])) {
1152                        addr -= offsetof(struct user, u_debugreg[0]);
1153                        tmp = ptrace_get_debugreg(child, addr / sizeof(data));
1154                }
1155                ret = put_user(tmp, (__u32 __user *)datap);
1156                break;
1157        }
1158
1159        /* Write the word at location addr in the USER area.  Only allow
1160           to update segment and debug registers with the upper 32bits
1161           zero-extended. */
1162        case PTRACE_POKEUSR:
1163                ret = -EIO;
1164                if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1165                    addr < offsetof(struct user_regs_struct, cs))
1166                        break;
1167
1168                if (addr < sizeof(struct user_regs_struct))
1169                        ret = putreg(child, addr, data);
1170                else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1171                         addr <= offsetof(struct user, u_debugreg[7])) {
1172                        addr -= offsetof(struct user, u_debugreg[0]);
1173                        ret = ptrace_set_debugreg(child,
1174                                                  addr / sizeof(data), data);
1175                }
1176                break;
1177
1178        case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1179                return copy_regset_to_user(child,
1180                                           task_user_regset_view(current),
1181                                           REGSET_GENERAL,
1182                                           0, sizeof(struct user_regs_struct),
1183                                           datap);
1184
1185        case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1186                return copy_regset_from_user(child,
1187                                             task_user_regset_view(current),
1188                                             REGSET_GENERAL,
1189                                             0, sizeof(struct user_regs_struct),
1190                                             datap);
1191
1192        case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1193                return copy_regset_to_user(child,
1194                                           task_user_regset_view(current),
1195                                           REGSET_FP,
1196                                           0, sizeof(struct user_i387_struct),
1197                                           datap);
1198
1199        case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1200                return copy_regset_from_user(child,
1201                                             task_user_regset_view(current),
1202                                             REGSET_FP,
1203                                             0, sizeof(struct user_i387_struct),
1204                                             datap);
1205
1206        default:
1207                return compat_ptrace_request(child, request, addr, data);
1208        }
1209
1210        return ret;
1211}
1212#endif
1213
1214#ifdef CONFIG_COMPAT
1215long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1216                        compat_ulong_t caddr, compat_ulong_t cdata)
1217{
1218#ifdef CONFIG_X86_X32_ABI
1219        if (!in_ia32_syscall())
1220                return x32_arch_ptrace(child, request, caddr, cdata);
1221#endif
1222#ifdef CONFIG_IA32_EMULATION
1223        return ia32_arch_ptrace(child, request, caddr, cdata);
1224#else
1225        return 0;
1226#endif
1227}
1228#endif  /* CONFIG_COMPAT */
1229
1230#ifdef CONFIG_X86_64
1231
1232static struct user_regset x86_64_regsets[] __ro_after_init = {
1233        [REGSET_GENERAL] = {
1234                .core_note_type = NT_PRSTATUS,
1235                .n = sizeof(struct user_regs_struct) / sizeof(long),
1236                .size = sizeof(long), .align = sizeof(long),
1237                .get = genregs_get, .set = genregs_set
1238        },
1239        [REGSET_FP] = {
1240                .core_note_type = NT_PRFPREG,
1241                .n = sizeof(struct user_i387_struct) / sizeof(long),
1242                .size = sizeof(long), .align = sizeof(long),
1243                .active = regset_xregset_fpregs_active, .get = xfpregs_get, .set = xfpregs_set
1244        },
1245        [REGSET_XSTATE] = {
1246                .core_note_type = NT_X86_XSTATE,
1247                .size = sizeof(u64), .align = sizeof(u64),
1248                .active = xstateregs_active, .get = xstateregs_get,
1249                .set = xstateregs_set
1250        },
1251        [REGSET_IOPERM64] = {
1252                .core_note_type = NT_386_IOPERM,
1253                .n = IO_BITMAP_LONGS,
1254                .size = sizeof(long), .align = sizeof(long),
1255                .active = ioperm_active, .get = ioperm_get
1256        },
1257};
1258
1259static const struct user_regset_view user_x86_64_view = {
1260        .name = "x86_64", .e_machine = EM_X86_64,
1261        .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets)
1262};
1263
1264#else  /* CONFIG_X86_32 */
1265
1266#define user_regs_struct32      user_regs_struct
1267#define genregs32_get           genregs_get
1268#define genregs32_set           genregs_set
1269
1270#endif  /* CONFIG_X86_64 */
1271
1272#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1273static struct user_regset x86_32_regsets[] __ro_after_init = {
1274        [REGSET_GENERAL] = {
1275                .core_note_type = NT_PRSTATUS,
1276                .n = sizeof(struct user_regs_struct32) / sizeof(u32),
1277                .size = sizeof(u32), .align = sizeof(u32),
1278                .get = genregs32_get, .set = genregs32_set
1279        },
1280        [REGSET_FP] = {
1281                .core_note_type = NT_PRFPREG,
1282                .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32),
1283                .size = sizeof(u32), .align = sizeof(u32),
1284                .active = regset_fpregs_active, .get = fpregs_get, .set = fpregs_set
1285        },
1286        [REGSET_XFP] = {
1287                .core_note_type = NT_PRXFPREG,
1288                .n = sizeof(struct user32_fxsr_struct) / sizeof(u32),
1289                .size = sizeof(u32), .align = sizeof(u32),
1290                .active = regset_xregset_fpregs_active, .get = xfpregs_get, .set = xfpregs_set
1291        },
1292        [REGSET_XSTATE] = {
1293                .core_note_type = NT_X86_XSTATE,
1294                .size = sizeof(u64), .align = sizeof(u64),
1295                .active = xstateregs_active, .get = xstateregs_get,
1296                .set = xstateregs_set
1297        },
1298        [REGSET_TLS] = {
1299                .core_note_type = NT_386_TLS,
1300                .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN,
1301                .size = sizeof(struct user_desc),
1302                .align = sizeof(struct user_desc),
1303                .active = regset_tls_active,
1304                .get = regset_tls_get, .set = regset_tls_set
1305        },
1306        [REGSET_IOPERM32] = {
1307                .core_note_type = NT_386_IOPERM,
1308                .n = IO_BITMAP_BYTES / sizeof(u32),
1309                .size = sizeof(u32), .align = sizeof(u32),
1310                .active = ioperm_active, .get = ioperm_get
1311        },
1312};
1313
1314static const struct user_regset_view user_x86_32_view = {
1315        .name = "i386", .e_machine = EM_386,
1316        .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets)
1317};
1318#endif
1319
1320/*
1321 * This represents bytes 464..511 in the memory layout exported through
1322 * the REGSET_XSTATE interface.
1323 */
1324u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
1325
1326void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
1327{
1328#ifdef CONFIG_X86_64
1329        x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1330#endif
1331#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1332        x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1333#endif
1334        xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
1335}
1336
1337const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1338{
1339#ifdef CONFIG_IA32_EMULATION
1340        if (!user_64bit_mode(task_pt_regs(task)))
1341#endif
1342#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1343                return &user_x86_32_view;
1344#endif
1345#ifdef CONFIG_X86_64
1346        return &user_x86_64_view;
1347#endif
1348}
1349
1350void send_sigtrap(struct pt_regs *regs, int error_code, int si_code)
1351{
1352        struct task_struct *tsk = current;
1353
1354        tsk->thread.trap_nr = X86_TRAP_DB;
1355        tsk->thread.error_code = error_code;
1356
1357        /* Send us the fake SIGTRAP */
1358        force_sig_fault(SIGTRAP, si_code,
1359                        user_mode(regs) ? (void __user *)regs->ip : NULL);
1360}
1361
1362void user_single_step_report(struct pt_regs *regs)
1363{
1364        send_sigtrap(regs, 0, TRAP_BRKPT);
1365}
1366