1// SPDX-License-Identifier: GPL-2.0-only 2/* By Ross Biro 1/23/92 */ 3/* 4 * Pentium III FXSR, SSE support 5 * Gareth Hughes <gareth@valinux.com>, May 2000 6 */ 7 8#include <linux/kernel.h> 9#include <linux/sched.h> 10#include <linux/sched/task_stack.h> 11#include <linux/mm.h> 12#include <linux/smp.h> 13#include <linux/errno.h> 14#include <linux/slab.h> 15#include <linux/ptrace.h> 16#include <linux/tracehook.h> 17#include <linux/user.h> 18#include <linux/elf.h> 19#include <linux/security.h> 20#include <linux/audit.h> 21#include <linux/seccomp.h> 22#include <linux/signal.h> 23#include <linux/perf_event.h> 24#include <linux/hw_breakpoint.h> 25#include <linux/rcupdate.h> 26#include <linux/export.h> 27#include <linux/context_tracking.h> 28#include <linux/nospec.h> 29 30#include <linux/uaccess.h> 31#include <asm/processor.h> 32#include <asm/fpu/internal.h> 33#include <asm/fpu/signal.h> 34#include <asm/fpu/regset.h> 35#include <asm/debugreg.h> 36#include <asm/ldt.h> 37#include <asm/desc.h> 38#include <asm/prctl.h> 39#include <asm/proto.h> 40#include <asm/hw_breakpoint.h> 41#include <asm/traps.h> 42#include <asm/syscall.h> 43#include <asm/fsgsbase.h> 44#include <asm/io_bitmap.h> 45 46#include "tls.h" 47 48enum x86_regset { 49 REGSET_GENERAL, 50 REGSET_FP, 51 REGSET_XFP, 52 REGSET_IOPERM64 = REGSET_XFP, 53 REGSET_XSTATE, 54 REGSET_TLS, 55 REGSET_IOPERM32, 56}; 57 58struct pt_regs_offset { 59 const char *name; 60 int offset; 61}; 62 63#define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)} 64#define REG_OFFSET_END {.name = NULL, .offset = 0} 65 66static const struct pt_regs_offset regoffset_table[] = { 67#ifdef CONFIG_X86_64 68 REG_OFFSET_NAME(r15), 69 REG_OFFSET_NAME(r14), 70 REG_OFFSET_NAME(r13), 71 REG_OFFSET_NAME(r12), 72 REG_OFFSET_NAME(r11), 73 REG_OFFSET_NAME(r10), 74 REG_OFFSET_NAME(r9), 75 REG_OFFSET_NAME(r8), 76#endif 77 REG_OFFSET_NAME(bx), 78 REG_OFFSET_NAME(cx), 79 REG_OFFSET_NAME(dx), 80 REG_OFFSET_NAME(si), 81 REG_OFFSET_NAME(di), 82 REG_OFFSET_NAME(bp), 83 REG_OFFSET_NAME(ax), 84#ifdef CONFIG_X86_32 85 REG_OFFSET_NAME(ds), 86 REG_OFFSET_NAME(es), 87 REG_OFFSET_NAME(fs), 88 REG_OFFSET_NAME(gs), 89#endif 90 REG_OFFSET_NAME(orig_ax), 91 REG_OFFSET_NAME(ip), 92 REG_OFFSET_NAME(cs), 93 REG_OFFSET_NAME(flags), 94 REG_OFFSET_NAME(sp), 95 REG_OFFSET_NAME(ss), 96 REG_OFFSET_END, 97}; 98 99/** 100 * regs_query_register_offset() - query register offset from its name 101 * @name: the name of a register 102 * 103 * regs_query_register_offset() returns the offset of a register in struct 104 * pt_regs from its name. If the name is invalid, this returns -EINVAL; 105 */ 106int regs_query_register_offset(const char *name) 107{ 108 const struct pt_regs_offset *roff; 109 for (roff = regoffset_table; roff->name != NULL; roff++) 110 if (!strcmp(roff->name, name)) 111 return roff->offset; 112 return -EINVAL; 113} 114 115/** 116 * regs_query_register_name() - query register name from its offset 117 * @offset: the offset of a register in struct pt_regs. 118 * 119 * regs_query_register_name() returns the name of a register from its 120 * offset in struct pt_regs. If the @offset is invalid, this returns NULL; 121 */ 122const char *regs_query_register_name(unsigned int offset) 123{ 124 const struct pt_regs_offset *roff; 125 for (roff = regoffset_table; roff->name != NULL; roff++) 126 if (roff->offset == offset) 127 return roff->name; 128 return NULL; 129} 130 131/* 132 * does not yet catch signals sent when the child dies. 133 * in exit.c or in signal.c. 134 */ 135 136/* 137 * Determines which flags the user has access to [1 = access, 0 = no access]. 138 */ 139#define FLAG_MASK_32 ((unsigned long) \ 140 (X86_EFLAGS_CF | X86_EFLAGS_PF | \ 141 X86_EFLAGS_AF | X86_EFLAGS_ZF | \ 142 X86_EFLAGS_SF | X86_EFLAGS_TF | \ 143 X86_EFLAGS_DF | X86_EFLAGS_OF | \ 144 X86_EFLAGS_RF | X86_EFLAGS_AC)) 145 146/* 147 * Determines whether a value may be installed in a segment register. 148 */ 149static inline bool invalid_selector(u16 value) 150{ 151 return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL); 152} 153 154#ifdef CONFIG_X86_32 155 156#define FLAG_MASK FLAG_MASK_32 157 158static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno) 159{ 160 BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0); 161 return ®s->bx + (regno >> 2); 162} 163 164static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 165{ 166 /* 167 * Returning the value truncates it to 16 bits. 168 */ 169 unsigned int retval; 170 if (offset != offsetof(struct user_regs_struct, gs)) 171 retval = *pt_regs_access(task_pt_regs(task), offset); 172 else { 173 if (task == current) 174 retval = get_user_gs(task_pt_regs(task)); 175 else 176 retval = task_user_gs(task); 177 } 178 return retval; 179} 180 181static int set_segment_reg(struct task_struct *task, 182 unsigned long offset, u16 value) 183{ 184 if (WARN_ON_ONCE(task == current)) 185 return -EIO; 186 187 /* 188 * The value argument was already truncated to 16 bits. 189 */ 190 if (invalid_selector(value)) 191 return -EIO; 192 193 /* 194 * For %cs and %ss we cannot permit a null selector. 195 * We can permit a bogus selector as long as it has USER_RPL. 196 * Null selectors are fine for other segment registers, but 197 * we will never get back to user mode with invalid %cs or %ss 198 * and will take the trap in iret instead. Much code relies 199 * on user_mode() to distinguish a user trap frame (which can 200 * safely use invalid selectors) from a kernel trap frame. 201 */ 202 switch (offset) { 203 case offsetof(struct user_regs_struct, cs): 204 case offsetof(struct user_regs_struct, ss): 205 if (unlikely(value == 0)) 206 return -EIO; 207 fallthrough; 208 209 default: 210 *pt_regs_access(task_pt_regs(task), offset) = value; 211 break; 212 213 case offsetof(struct user_regs_struct, gs): 214 task_user_gs(task) = value; 215 } 216 217 return 0; 218} 219 220#else /* CONFIG_X86_64 */ 221 222#define FLAG_MASK (FLAG_MASK_32 | X86_EFLAGS_NT) 223 224static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset) 225{ 226 BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0); 227 return ®s->r15 + (offset / sizeof(regs->r15)); 228} 229 230static u16 get_segment_reg(struct task_struct *task, unsigned long offset) 231{ 232 /* 233 * Returning the value truncates it to 16 bits. 234 */ 235 unsigned int seg; 236 237 switch (offset) { 238 case offsetof(struct user_regs_struct, fs): 239 if (task == current) { 240 /* Older gas can't assemble movq %?s,%r?? */ 241 asm("movl %%fs,%0" : "=r" (seg)); 242 return seg; 243 } 244 return task->thread.fsindex; 245 case offsetof(struct user_regs_struct, gs): 246 if (task == current) { 247 asm("movl %%gs,%0" : "=r" (seg)); 248 return seg; 249 } 250 return task->thread.gsindex; 251 case offsetof(struct user_regs_struct, ds): 252 if (task == current) { 253 asm("movl %%ds,%0" : "=r" (seg)); 254 return seg; 255 } 256 return task->thread.ds; 257 case offsetof(struct user_regs_struct, es): 258 if (task == current) { 259 asm("movl %%es,%0" : "=r" (seg)); 260 return seg; 261 } 262 return task->thread.es; 263 264 case offsetof(struct user_regs_struct, cs): 265 case offsetof(struct user_regs_struct, ss): 266 break; 267 } 268 return *pt_regs_access(task_pt_regs(task), offset); 269} 270 271static int set_segment_reg(struct task_struct *task, 272 unsigned long offset, u16 value) 273{ 274 if (WARN_ON_ONCE(task == current)) 275 return -EIO; 276 277 /* 278 * The value argument was already truncated to 16 bits. 279 */ 280 if (invalid_selector(value)) 281 return -EIO; 282 283 /* 284 * Writes to FS and GS will change the stored selector. Whether 285 * this changes the segment base as well depends on whether 286 * FSGSBASE is enabled. 287 */ 288 289 switch (offset) { 290 case offsetof(struct user_regs_struct,fs): 291 task->thread.fsindex = value; 292 break; 293 case offsetof(struct user_regs_struct,gs): 294 task->thread.gsindex = value; 295 break; 296 case offsetof(struct user_regs_struct,ds): 297 task->thread.ds = value; 298 break; 299 case offsetof(struct user_regs_struct,es): 300 task->thread.es = value; 301 break; 302 303 /* 304 * Can't actually change these in 64-bit mode. 305 */ 306 case offsetof(struct user_regs_struct,cs): 307 if (unlikely(value == 0)) 308 return -EIO; 309 task_pt_regs(task)->cs = value; 310 break; 311 case offsetof(struct user_regs_struct,ss): 312 if (unlikely(value == 0)) 313 return -EIO; 314 task_pt_regs(task)->ss = value; 315 break; 316 } 317 318 return 0; 319} 320 321#endif /* CONFIG_X86_32 */ 322 323static unsigned long get_flags(struct task_struct *task) 324{ 325 unsigned long retval = task_pt_regs(task)->flags; 326 327 /* 328 * If the debugger set TF, hide it from the readout. 329 */ 330 if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 331 retval &= ~X86_EFLAGS_TF; 332 333 return retval; 334} 335 336static int set_flags(struct task_struct *task, unsigned long value) 337{ 338 struct pt_regs *regs = task_pt_regs(task); 339 340 /* 341 * If the user value contains TF, mark that 342 * it was not "us" (the debugger) that set it. 343 * If not, make sure it stays set if we had. 344 */ 345 if (value & X86_EFLAGS_TF) 346 clear_tsk_thread_flag(task, TIF_FORCED_TF); 347 else if (test_tsk_thread_flag(task, TIF_FORCED_TF)) 348 value |= X86_EFLAGS_TF; 349 350 regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK); 351 352 return 0; 353} 354 355static int putreg(struct task_struct *child, 356 unsigned long offset, unsigned long value) 357{ 358 switch (offset) { 359 case offsetof(struct user_regs_struct, cs): 360 case offsetof(struct user_regs_struct, ds): 361 case offsetof(struct user_regs_struct, es): 362 case offsetof(struct user_regs_struct, fs): 363 case offsetof(struct user_regs_struct, gs): 364 case offsetof(struct user_regs_struct, ss): 365 return set_segment_reg(child, offset, value); 366 367 case offsetof(struct user_regs_struct, flags): 368 return set_flags(child, value); 369 370#ifdef CONFIG_X86_64 371 case offsetof(struct user_regs_struct,fs_base): 372 if (value >= TASK_SIZE_MAX) 373 return -EIO; 374 x86_fsbase_write_task(child, value); 375 return 0; 376 case offsetof(struct user_regs_struct,gs_base): 377 if (value >= TASK_SIZE_MAX) 378 return -EIO; 379 x86_gsbase_write_task(child, value); 380 return 0; 381#endif 382 } 383 384 *pt_regs_access(task_pt_regs(child), offset) = value; 385 return 0; 386} 387 388static unsigned long getreg(struct task_struct *task, unsigned long offset) 389{ 390 switch (offset) { 391 case offsetof(struct user_regs_struct, cs): 392 case offsetof(struct user_regs_struct, ds): 393 case offsetof(struct user_regs_struct, es): 394 case offsetof(struct user_regs_struct, fs): 395 case offsetof(struct user_regs_struct, gs): 396 case offsetof(struct user_regs_struct, ss): 397 return get_segment_reg(task, offset); 398 399 case offsetof(struct user_regs_struct, flags): 400 return get_flags(task); 401 402#ifdef CONFIG_X86_64 403 case offsetof(struct user_regs_struct, fs_base): 404 return x86_fsbase_read_task(task); 405 case offsetof(struct user_regs_struct, gs_base): 406 return x86_gsbase_read_task(task); 407#endif 408 } 409 410 return *pt_regs_access(task_pt_regs(task), offset); 411} 412 413static int genregs_get(struct task_struct *target, 414 const struct user_regset *regset, 415 struct membuf to) 416{ 417 int reg; 418 419 for (reg = 0; to.left; reg++) 420 membuf_store(&to, getreg(target, reg * sizeof(unsigned long))); 421 return 0; 422} 423 424static int genregs_set(struct task_struct *target, 425 const struct user_regset *regset, 426 unsigned int pos, unsigned int count, 427 const void *kbuf, const void __user *ubuf) 428{ 429 int ret = 0; 430 if (kbuf) { 431 const unsigned long *k = kbuf; 432 while (count >= sizeof(*k) && !ret) { 433 ret = putreg(target, pos, *k++); 434 count -= sizeof(*k); 435 pos += sizeof(*k); 436 } 437 } else { 438 const unsigned long __user *u = ubuf; 439 while (count >= sizeof(*u) && !ret) { 440 unsigned long word; 441 ret = __get_user(word, u++); 442 if (ret) 443 break; 444 ret = putreg(target, pos, word); 445 count -= sizeof(*u); 446 pos += sizeof(*u); 447 } 448 } 449 return ret; 450} 451 452static void ptrace_triggered(struct perf_event *bp, 453 struct perf_sample_data *data, 454 struct pt_regs *regs) 455{ 456 int i; 457 struct thread_struct *thread = &(current->thread); 458 459 /* 460 * Store in the virtual DR6 register the fact that the breakpoint 461 * was hit so the thread's debugger will see it. 462 */ 463 for (i = 0; i < HBP_NUM; i++) { 464 if (thread->ptrace_bps[i] == bp) 465 break; 466 } 467 468 thread->virtual_dr6 |= (DR_TRAP0 << i); 469} 470 471/* 472 * Walk through every ptrace breakpoints for this thread and 473 * build the dr7 value on top of their attributes. 474 * 475 */ 476static unsigned long ptrace_get_dr7(struct perf_event *bp[]) 477{ 478 int i; 479 int dr7 = 0; 480 struct arch_hw_breakpoint *info; 481 482 for (i = 0; i < HBP_NUM; i++) { 483 if (bp[i] && !bp[i]->attr.disabled) { 484 info = counter_arch_bp(bp[i]); 485 dr7 |= encode_dr7(i, info->len, info->type); 486 } 487 } 488 489 return dr7; 490} 491 492static int ptrace_fill_bp_fields(struct perf_event_attr *attr, 493 int len, int type, bool disabled) 494{ 495 int err, bp_len, bp_type; 496 497 err = arch_bp_generic_fields(len, type, &bp_len, &bp_type); 498 if (!err) { 499 attr->bp_len = bp_len; 500 attr->bp_type = bp_type; 501 attr->disabled = disabled; 502 } 503 504 return err; 505} 506 507static struct perf_event * 508ptrace_register_breakpoint(struct task_struct *tsk, int len, int type, 509 unsigned long addr, bool disabled) 510{ 511 struct perf_event_attr attr; 512 int err; 513 514 ptrace_breakpoint_init(&attr); 515 attr.bp_addr = addr; 516 517 err = ptrace_fill_bp_fields(&attr, len, type, disabled); 518 if (err) 519 return ERR_PTR(err); 520 521 return register_user_hw_breakpoint(&attr, ptrace_triggered, 522 NULL, tsk); 523} 524 525static int ptrace_modify_breakpoint(struct perf_event *bp, int len, int type, 526 int disabled) 527{ 528 struct perf_event_attr attr = bp->attr; 529 int err; 530 531 err = ptrace_fill_bp_fields(&attr, len, type, disabled); 532 if (err) 533 return err; 534 535 return modify_user_hw_breakpoint(bp, &attr); 536} 537 538/* 539 * Handle ptrace writes to debug register 7. 540 */ 541static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data) 542{ 543 struct thread_struct *thread = &tsk->thread; 544 unsigned long old_dr7; 545 bool second_pass = false; 546 int i, rc, ret = 0; 547 548 data &= ~DR_CONTROL_RESERVED; 549 old_dr7 = ptrace_get_dr7(thread->ptrace_bps); 550 551restore: 552 rc = 0; 553 for (i = 0; i < HBP_NUM; i++) { 554 unsigned len, type; 555 bool disabled = !decode_dr7(data, i, &len, &type); 556 struct perf_event *bp = thread->ptrace_bps[i]; 557 558 if (!bp) { 559 if (disabled) 560 continue; 561 562 bp = ptrace_register_breakpoint(tsk, 563 len, type, 0, disabled); 564 if (IS_ERR(bp)) { 565 rc = PTR_ERR(bp); 566 break; 567 } 568 569 thread->ptrace_bps[i] = bp; 570 continue; 571 } 572 573 rc = ptrace_modify_breakpoint(bp, len, type, disabled); 574 if (rc) 575 break; 576 } 577 578 /* Restore if the first pass failed, second_pass shouldn't fail. */ 579 if (rc && !WARN_ON(second_pass)) { 580 ret = rc; 581 data = old_dr7; 582 second_pass = true; 583 goto restore; 584 } 585 586 return ret; 587} 588 589/* 590 * Handle PTRACE_PEEKUSR calls for the debug register area. 591 */ 592static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n) 593{ 594 struct thread_struct *thread = &tsk->thread; 595 unsigned long val = 0; 596 597 if (n < HBP_NUM) { 598 int index = array_index_nospec(n, HBP_NUM); 599 struct perf_event *bp = thread->ptrace_bps[index]; 600 601 if (bp) 602 val = bp->hw.info.address; 603 } else if (n == 6) { 604 val = thread->virtual_dr6 ^ DR6_RESERVED; /* Flip back to arch polarity */ 605 } else if (n == 7) { 606 val = thread->ptrace_dr7; 607 } 608 return val; 609} 610 611static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr, 612 unsigned long addr) 613{ 614 struct thread_struct *t = &tsk->thread; 615 struct perf_event *bp = t->ptrace_bps[nr]; 616 int err = 0; 617 618 if (!bp) { 619 /* 620 * Put stub len and type to create an inactive but correct bp. 621 * 622 * CHECKME: the previous code returned -EIO if the addr wasn't 623 * a valid task virtual addr. The new one will return -EINVAL in 624 * this case. 625 * -EINVAL may be what we want for in-kernel breakpoints users, 626 * but -EIO looks better for ptrace, since we refuse a register 627 * writing for the user. And anyway this is the previous 628 * behaviour. 629 */ 630 bp = ptrace_register_breakpoint(tsk, 631 X86_BREAKPOINT_LEN_1, X86_BREAKPOINT_WRITE, 632 addr, true); 633 if (IS_ERR(bp)) 634 err = PTR_ERR(bp); 635 else 636 t->ptrace_bps[nr] = bp; 637 } else { 638 struct perf_event_attr attr = bp->attr; 639 640 attr.bp_addr = addr; 641 err = modify_user_hw_breakpoint(bp, &attr); 642 } 643 644 return err; 645} 646 647/* 648 * Handle PTRACE_POKEUSR calls for the debug register area. 649 */ 650static int ptrace_set_debugreg(struct task_struct *tsk, int n, 651 unsigned long val) 652{ 653 struct thread_struct *thread = &tsk->thread; 654 /* There are no DR4 or DR5 registers */ 655 int rc = -EIO; 656 657 if (n < HBP_NUM) { 658 rc = ptrace_set_breakpoint_addr(tsk, n, val); 659 } else if (n == 6) { 660 thread->virtual_dr6 = val ^ DR6_RESERVED; /* Flip to positive polarity */ 661 rc = 0; 662 } else if (n == 7) { 663 rc = ptrace_write_dr7(tsk, val); 664 if (!rc) 665 thread->ptrace_dr7 = val; 666 } 667 return rc; 668} 669 670/* 671 * These access the current or another (stopped) task's io permission 672 * bitmap for debugging or core dump. 673 */ 674static int ioperm_active(struct task_struct *target, 675 const struct user_regset *regset) 676{ 677 struct io_bitmap *iobm = target->thread.io_bitmap; 678 679 return iobm ? DIV_ROUND_UP(iobm->max, regset->size) : 0; 680} 681 682static int ioperm_get(struct task_struct *target, 683 const struct user_regset *regset, 684 struct membuf to) 685{ 686 struct io_bitmap *iobm = target->thread.io_bitmap; 687 688 if (!iobm) 689 return -ENXIO; 690 691 return membuf_write(&to, iobm->bitmap, IO_BITMAP_BYTES); 692} 693 694/* 695 * Called by kernel/ptrace.c when detaching.. 696 * 697 * Make sure the single step bit is not set. 698 */ 699void ptrace_disable(struct task_struct *child) 700{ 701 user_disable_single_step(child); 702} 703 704#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 705static const struct user_regset_view user_x86_32_view; /* Initialized below. */ 706#endif 707 708long arch_ptrace(struct task_struct *child, long request, 709 unsigned long addr, unsigned long data) 710{ 711 int ret; 712 unsigned long __user *datap = (unsigned long __user *)data; 713 714 switch (request) { 715 /* read the word at location addr in the USER area. */ 716 case PTRACE_PEEKUSR: { 717 unsigned long tmp; 718 719 ret = -EIO; 720 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user)) 721 break; 722 723 tmp = 0; /* Default return condition */ 724 if (addr < sizeof(struct user_regs_struct)) 725 tmp = getreg(child, addr); 726 else if (addr >= offsetof(struct user, u_debugreg[0]) && 727 addr <= offsetof(struct user, u_debugreg[7])) { 728 addr -= offsetof(struct user, u_debugreg[0]); 729 tmp = ptrace_get_debugreg(child, addr / sizeof(data)); 730 } 731 ret = put_user(tmp, datap); 732 break; 733 } 734 735 case PTRACE_POKEUSR: /* write the word at location addr in the USER area */ 736 ret = -EIO; 737 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user)) 738 break; 739 740 if (addr < sizeof(struct user_regs_struct)) 741 ret = putreg(child, addr, data); 742 else if (addr >= offsetof(struct user, u_debugreg[0]) && 743 addr <= offsetof(struct user, u_debugreg[7])) { 744 addr -= offsetof(struct user, u_debugreg[0]); 745 ret = ptrace_set_debugreg(child, 746 addr / sizeof(data), data); 747 } 748 break; 749 750 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 751 return copy_regset_to_user(child, 752 task_user_regset_view(current), 753 REGSET_GENERAL, 754 0, sizeof(struct user_regs_struct), 755 datap); 756 757 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 758 return copy_regset_from_user(child, 759 task_user_regset_view(current), 760 REGSET_GENERAL, 761 0, sizeof(struct user_regs_struct), 762 datap); 763 764 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 765 return copy_regset_to_user(child, 766 task_user_regset_view(current), 767 REGSET_FP, 768 0, sizeof(struct user_i387_struct), 769 datap); 770 771 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 772 return copy_regset_from_user(child, 773 task_user_regset_view(current), 774 REGSET_FP, 775 0, sizeof(struct user_i387_struct), 776 datap); 777 778#ifdef CONFIG_X86_32 779 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 780 return copy_regset_to_user(child, &user_x86_32_view, 781 REGSET_XFP, 782 0, sizeof(struct user_fxsr_struct), 783 datap) ? -EIO : 0; 784 785 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 786 return copy_regset_from_user(child, &user_x86_32_view, 787 REGSET_XFP, 788 0, sizeof(struct user_fxsr_struct), 789 datap) ? -EIO : 0; 790#endif 791 792#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 793 case PTRACE_GET_THREAD_AREA: 794 if ((int) addr < 0) 795 return -EIO; 796 ret = do_get_thread_area(child, addr, 797 (struct user_desc __user *)data); 798 break; 799 800 case PTRACE_SET_THREAD_AREA: 801 if ((int) addr < 0) 802 return -EIO; 803 ret = do_set_thread_area(child, addr, 804 (struct user_desc __user *)data, 0); 805 break; 806#endif 807 808#ifdef CONFIG_X86_64 809 /* normal 64bit interface to access TLS data. 810 Works just like arch_prctl, except that the arguments 811 are reversed. */ 812 case PTRACE_ARCH_PRCTL: 813 ret = do_arch_prctl_64(child, data, addr); 814 break; 815#endif 816 817 default: 818 ret = ptrace_request(child, request, addr, data); 819 break; 820 } 821 822 return ret; 823} 824 825#ifdef CONFIG_IA32_EMULATION 826 827#include <linux/compat.h> 828#include <linux/syscalls.h> 829#include <asm/ia32.h> 830#include <asm/user32.h> 831 832#define R32(l,q) \ 833 case offsetof(struct user32, regs.l): \ 834 regs->q = value; break 835 836#define SEG32(rs) \ 837 case offsetof(struct user32, regs.rs): \ 838 return set_segment_reg(child, \ 839 offsetof(struct user_regs_struct, rs), \ 840 value); \ 841 break 842 843static int putreg32(struct task_struct *child, unsigned regno, u32 value) 844{ 845 struct pt_regs *regs = task_pt_regs(child); 846 int ret; 847 848 switch (regno) { 849 850 SEG32(cs); 851 SEG32(ds); 852 SEG32(es); 853 854 /* 855 * A 32-bit ptracer on a 64-bit kernel expects that writing 856 * FS or GS will also update the base. This is needed for 857 * operations like PTRACE_SETREGS to fully restore a saved 858 * CPU state. 859 */ 860 861 case offsetof(struct user32, regs.fs): 862 ret = set_segment_reg(child, 863 offsetof(struct user_regs_struct, fs), 864 value); 865 if (ret == 0) 866 child->thread.fsbase = 867 x86_fsgsbase_read_task(child, value); 868 return ret; 869 870 case offsetof(struct user32, regs.gs): 871 ret = set_segment_reg(child, 872 offsetof(struct user_regs_struct, gs), 873 value); 874 if (ret == 0) 875 child->thread.gsbase = 876 x86_fsgsbase_read_task(child, value); 877 return ret; 878 879 SEG32(ss); 880 881 R32(ebx, bx); 882 R32(ecx, cx); 883 R32(edx, dx); 884 R32(edi, di); 885 R32(esi, si); 886 R32(ebp, bp); 887 R32(eax, ax); 888 R32(eip, ip); 889 R32(esp, sp); 890 891 case offsetof(struct user32, regs.orig_eax): 892 /* 893 * Warning: bizarre corner case fixup here. A 32-bit 894 * debugger setting orig_eax to -1 wants to disable 895 * syscall restart. Make sure that the syscall 896 * restart code sign-extends orig_ax. Also make sure 897 * we interpret the -ERESTART* codes correctly if 898 * loaded into regs->ax in case the task is not 899 * actually still sitting at the exit from a 32-bit 900 * syscall with TS_COMPAT still set. 901 */ 902 regs->orig_ax = value; 903 if (syscall_get_nr(child, regs) >= 0) 904 child->thread_info.status |= TS_I386_REGS_POKED; 905 break; 906 907 case offsetof(struct user32, regs.eflags): 908 return set_flags(child, value); 909 910 case offsetof(struct user32, u_debugreg[0]) ... 911 offsetof(struct user32, u_debugreg[7]): 912 regno -= offsetof(struct user32, u_debugreg[0]); 913 return ptrace_set_debugreg(child, regno / 4, value); 914 915 default: 916 if (regno > sizeof(struct user32) || (regno & 3)) 917 return -EIO; 918 919 /* 920 * Other dummy fields in the virtual user structure 921 * are ignored 922 */ 923 break; 924 } 925 return 0; 926} 927 928#undef R32 929#undef SEG32 930 931#define R32(l,q) \ 932 case offsetof(struct user32, regs.l): \ 933 *val = regs->q; break 934 935#define SEG32(rs) \ 936 case offsetof(struct user32, regs.rs): \ 937 *val = get_segment_reg(child, \ 938 offsetof(struct user_regs_struct, rs)); \ 939 break 940 941static int getreg32(struct task_struct *child, unsigned regno, u32 *val) 942{ 943 struct pt_regs *regs = task_pt_regs(child); 944 945 switch (regno) { 946 947 SEG32(ds); 948 SEG32(es); 949 SEG32(fs); 950 SEG32(gs); 951 952 R32(cs, cs); 953 R32(ss, ss); 954 R32(ebx, bx); 955 R32(ecx, cx); 956 R32(edx, dx); 957 R32(edi, di); 958 R32(esi, si); 959 R32(ebp, bp); 960 R32(eax, ax); 961 R32(orig_eax, orig_ax); 962 R32(eip, ip); 963 R32(esp, sp); 964 965 case offsetof(struct user32, regs.eflags): 966 *val = get_flags(child); 967 break; 968 969 case offsetof(struct user32, u_debugreg[0]) ... 970 offsetof(struct user32, u_debugreg[7]): 971 regno -= offsetof(struct user32, u_debugreg[0]); 972 *val = ptrace_get_debugreg(child, regno / 4); 973 break; 974 975 default: 976 if (regno > sizeof(struct user32) || (regno & 3)) 977 return -EIO; 978 979 /* 980 * Other dummy fields in the virtual user structure 981 * are ignored 982 */ 983 *val = 0; 984 break; 985 } 986 return 0; 987} 988 989#undef R32 990#undef SEG32 991 992static int genregs32_get(struct task_struct *target, 993 const struct user_regset *regset, 994 struct membuf to) 995{ 996 int reg; 997 998 for (reg = 0; to.left; reg++) { 999 u32 val; 1000 getreg32(target, reg * 4, &val); 1001 membuf_store(&to, val); 1002 } 1003 return 0; 1004} 1005 1006static int genregs32_set(struct task_struct *target, 1007 const struct user_regset *regset, 1008 unsigned int pos, unsigned int count, 1009 const void *kbuf, const void __user *ubuf) 1010{ 1011 int ret = 0; 1012 if (kbuf) { 1013 const compat_ulong_t *k = kbuf; 1014 while (count >= sizeof(*k) && !ret) { 1015 ret = putreg32(target, pos, *k++); 1016 count -= sizeof(*k); 1017 pos += sizeof(*k); 1018 } 1019 } else { 1020 const compat_ulong_t __user *u = ubuf; 1021 while (count >= sizeof(*u) && !ret) { 1022 compat_ulong_t word; 1023 ret = __get_user(word, u++); 1024 if (ret) 1025 break; 1026 ret = putreg32(target, pos, word); 1027 count -= sizeof(*u); 1028 pos += sizeof(*u); 1029 } 1030 } 1031 return ret; 1032} 1033 1034static long ia32_arch_ptrace(struct task_struct *child, compat_long_t request, 1035 compat_ulong_t caddr, compat_ulong_t cdata) 1036{ 1037 unsigned long addr = caddr; 1038 unsigned long data = cdata; 1039 void __user *datap = compat_ptr(data); 1040 int ret; 1041 __u32 val; 1042 1043 switch (request) { 1044 case PTRACE_PEEKUSR: 1045 ret = getreg32(child, addr, &val); 1046 if (ret == 0) 1047 ret = put_user(val, (__u32 __user *)datap); 1048 break; 1049 1050 case PTRACE_POKEUSR: 1051 ret = putreg32(child, addr, data); 1052 break; 1053 1054 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 1055 return copy_regset_to_user(child, &user_x86_32_view, 1056 REGSET_GENERAL, 1057 0, sizeof(struct user_regs_struct32), 1058 datap); 1059 1060 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 1061 return copy_regset_from_user(child, &user_x86_32_view, 1062 REGSET_GENERAL, 0, 1063 sizeof(struct user_regs_struct32), 1064 datap); 1065 1066 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 1067 return copy_regset_to_user(child, &user_x86_32_view, 1068 REGSET_FP, 0, 1069 sizeof(struct user_i387_ia32_struct), 1070 datap); 1071 1072 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 1073 return copy_regset_from_user( 1074 child, &user_x86_32_view, REGSET_FP, 1075 0, sizeof(struct user_i387_ia32_struct), datap); 1076 1077 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */ 1078 return copy_regset_to_user(child, &user_x86_32_view, 1079 REGSET_XFP, 0, 1080 sizeof(struct user32_fxsr_struct), 1081 datap); 1082 1083 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */ 1084 return copy_regset_from_user(child, &user_x86_32_view, 1085 REGSET_XFP, 0, 1086 sizeof(struct user32_fxsr_struct), 1087 datap); 1088 1089 case PTRACE_GET_THREAD_AREA: 1090 case PTRACE_SET_THREAD_AREA: 1091 return arch_ptrace(child, request, addr, data); 1092 1093 default: 1094 return compat_ptrace_request(child, request, addr, data); 1095 } 1096 1097 return ret; 1098} 1099#endif /* CONFIG_IA32_EMULATION */ 1100 1101#ifdef CONFIG_X86_X32_ABI 1102static long x32_arch_ptrace(struct task_struct *child, 1103 compat_long_t request, compat_ulong_t caddr, 1104 compat_ulong_t cdata) 1105{ 1106 unsigned long addr = caddr; 1107 unsigned long data = cdata; 1108 void __user *datap = compat_ptr(data); 1109 int ret; 1110 1111 switch (request) { 1112 /* Read 32bits at location addr in the USER area. Only allow 1113 to return the lower 32bits of segment and debug registers. */ 1114 case PTRACE_PEEKUSR: { 1115 u32 tmp; 1116 1117 ret = -EIO; 1118 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) || 1119 addr < offsetof(struct user_regs_struct, cs)) 1120 break; 1121 1122 tmp = 0; /* Default return condition */ 1123 if (addr < sizeof(struct user_regs_struct)) 1124 tmp = getreg(child, addr); 1125 else if (addr >= offsetof(struct user, u_debugreg[0]) && 1126 addr <= offsetof(struct user, u_debugreg[7])) { 1127 addr -= offsetof(struct user, u_debugreg[0]); 1128 tmp = ptrace_get_debugreg(child, addr / sizeof(data)); 1129 } 1130 ret = put_user(tmp, (__u32 __user *)datap); 1131 break; 1132 } 1133 1134 /* Write the word at location addr in the USER area. Only allow 1135 to update segment and debug registers with the upper 32bits 1136 zero-extended. */ 1137 case PTRACE_POKEUSR: 1138 ret = -EIO; 1139 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) || 1140 addr < offsetof(struct user_regs_struct, cs)) 1141 break; 1142 1143 if (addr < sizeof(struct user_regs_struct)) 1144 ret = putreg(child, addr, data); 1145 else if (addr >= offsetof(struct user, u_debugreg[0]) && 1146 addr <= offsetof(struct user, u_debugreg[7])) { 1147 addr -= offsetof(struct user, u_debugreg[0]); 1148 ret = ptrace_set_debugreg(child, 1149 addr / sizeof(data), data); 1150 } 1151 break; 1152 1153 case PTRACE_GETREGS: /* Get all gp regs from the child. */ 1154 return copy_regset_to_user(child, 1155 task_user_regset_view(current), 1156 REGSET_GENERAL, 1157 0, sizeof(struct user_regs_struct), 1158 datap); 1159 1160 case PTRACE_SETREGS: /* Set all gp regs in the child. */ 1161 return copy_regset_from_user(child, 1162 task_user_regset_view(current), 1163 REGSET_GENERAL, 1164 0, sizeof(struct user_regs_struct), 1165 datap); 1166 1167 case PTRACE_GETFPREGS: /* Get the child FPU state. */ 1168 return copy_regset_to_user(child, 1169 task_user_regset_view(current), 1170 REGSET_FP, 1171 0, sizeof(struct user_i387_struct), 1172 datap); 1173 1174 case PTRACE_SETFPREGS: /* Set the child FPU state. */ 1175 return copy_regset_from_user(child, 1176 task_user_regset_view(current), 1177 REGSET_FP, 1178 0, sizeof(struct user_i387_struct), 1179 datap); 1180 1181 default: 1182 return compat_ptrace_request(child, request, addr, data); 1183 } 1184 1185 return ret; 1186} 1187#endif 1188 1189#ifdef CONFIG_COMPAT 1190long compat_arch_ptrace(struct task_struct *child, compat_long_t request, 1191 compat_ulong_t caddr, compat_ulong_t cdata) 1192{ 1193#ifdef CONFIG_X86_X32_ABI 1194 if (!in_ia32_syscall()) 1195 return x32_arch_ptrace(child, request, caddr, cdata); 1196#endif 1197#ifdef CONFIG_IA32_EMULATION 1198 return ia32_arch_ptrace(child, request, caddr, cdata); 1199#else 1200 return 0; 1201#endif 1202} 1203#endif /* CONFIG_COMPAT */ 1204 1205#ifdef CONFIG_X86_64 1206 1207static struct user_regset x86_64_regsets[] __ro_after_init = { 1208 [REGSET_GENERAL] = { 1209 .core_note_type = NT_PRSTATUS, 1210 .n = sizeof(struct user_regs_struct) / sizeof(long), 1211 .size = sizeof(long), .align = sizeof(long), 1212 .regset_get = genregs_get, .set = genregs_set 1213 }, 1214 [REGSET_FP] = { 1215 .core_note_type = NT_PRFPREG, 1216 .n = sizeof(struct user_i387_struct) / sizeof(long), 1217 .size = sizeof(long), .align = sizeof(long), 1218 .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set 1219 }, 1220 [REGSET_XSTATE] = { 1221 .core_note_type = NT_X86_XSTATE, 1222 .size = sizeof(u64), .align = sizeof(u64), 1223 .active = xstateregs_active, .regset_get = xstateregs_get, 1224 .set = xstateregs_set 1225 }, 1226 [REGSET_IOPERM64] = { 1227 .core_note_type = NT_386_IOPERM, 1228 .n = IO_BITMAP_LONGS, 1229 .size = sizeof(long), .align = sizeof(long), 1230 .active = ioperm_active, .regset_get = ioperm_get 1231 }, 1232}; 1233 1234static const struct user_regset_view user_x86_64_view = { 1235 .name = "x86_64", .e_machine = EM_X86_64, 1236 .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets) 1237}; 1238 1239#else /* CONFIG_X86_32 */ 1240 1241#define user_regs_struct32 user_regs_struct 1242#define genregs32_get genregs_get 1243#define genregs32_set genregs_set 1244 1245#endif /* CONFIG_X86_64 */ 1246 1247#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1248static struct user_regset x86_32_regsets[] __ro_after_init = { 1249 [REGSET_GENERAL] = { 1250 .core_note_type = NT_PRSTATUS, 1251 .n = sizeof(struct user_regs_struct32) / sizeof(u32), 1252 .size = sizeof(u32), .align = sizeof(u32), 1253 .regset_get = genregs32_get, .set = genregs32_set 1254 }, 1255 [REGSET_FP] = { 1256 .core_note_type = NT_PRFPREG, 1257 .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32), 1258 .size = sizeof(u32), .align = sizeof(u32), 1259 .active = regset_fpregs_active, .regset_get = fpregs_get, .set = fpregs_set 1260 }, 1261 [REGSET_XFP] = { 1262 .core_note_type = NT_PRXFPREG, 1263 .n = sizeof(struct user32_fxsr_struct) / sizeof(u32), 1264 .size = sizeof(u32), .align = sizeof(u32), 1265 .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set 1266 }, 1267 [REGSET_XSTATE] = { 1268 .core_note_type = NT_X86_XSTATE, 1269 .size = sizeof(u64), .align = sizeof(u64), 1270 .active = xstateregs_active, .regset_get = xstateregs_get, 1271 .set = xstateregs_set 1272 }, 1273 [REGSET_TLS] = { 1274 .core_note_type = NT_386_TLS, 1275 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN, 1276 .size = sizeof(struct user_desc), 1277 .align = sizeof(struct user_desc), 1278 .active = regset_tls_active, 1279 .regset_get = regset_tls_get, .set = regset_tls_set 1280 }, 1281 [REGSET_IOPERM32] = { 1282 .core_note_type = NT_386_IOPERM, 1283 .n = IO_BITMAP_BYTES / sizeof(u32), 1284 .size = sizeof(u32), .align = sizeof(u32), 1285 .active = ioperm_active, .regset_get = ioperm_get 1286 }, 1287}; 1288 1289static const struct user_regset_view user_x86_32_view = { 1290 .name = "i386", .e_machine = EM_386, 1291 .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets) 1292}; 1293#endif 1294 1295/* 1296 * This represents bytes 464..511 in the memory layout exported through 1297 * the REGSET_XSTATE interface. 1298 */ 1299u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS]; 1300 1301void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask) 1302{ 1303#ifdef CONFIG_X86_64 1304 x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1305#endif 1306#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1307 x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64); 1308#endif 1309 xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask; 1310} 1311 1312const struct user_regset_view *task_user_regset_view(struct task_struct *task) 1313{ 1314#ifdef CONFIG_IA32_EMULATION 1315 if (!user_64bit_mode(task_pt_regs(task))) 1316#endif 1317#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION 1318 return &user_x86_32_view; 1319#endif 1320#ifdef CONFIG_X86_64 1321 return &user_x86_64_view; 1322#endif 1323} 1324 1325void send_sigtrap(struct pt_regs *regs, int error_code, int si_code) 1326{ 1327 struct task_struct *tsk = current; 1328 1329 tsk->thread.trap_nr = X86_TRAP_DB; 1330 tsk->thread.error_code = error_code; 1331 1332 /* Send us the fake SIGTRAP */ 1333 force_sig_fault(SIGTRAP, si_code, 1334 user_mode(regs) ? (void __user *)regs->ip : NULL); 1335} 1336 1337void user_single_step_report(struct pt_regs *regs) 1338{ 1339 send_sigtrap(regs, 0, TRAP_BRKPT); 1340} 1341