arch/x86/kernel/ptrace.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /* By Ross Biro 1/23/92 */
   3 /*
   4  * Pentium III FXSR, SSE support
   5  *      Gareth Hughes <gareth@valinux.com>, May 2000
   6  */
   7
   8 #include <linux/kernel.h>
   9 #include <linux/sched.h>
  10 #include <linux/sched/task_stack.h>
  11 #include <linux/mm.h>
  12 #include <linux/smp.h>
  13 #include <linux/errno.h>
  14 #include <linux/slab.h>
  15 #include <linux/ptrace.h>
  16 #include <linux/tracehook.h>
  17 #include <linux/user.h>
  18 #include <linux/elf.h>
  19 #include <linux/security.h>
  20 #include <linux/audit.h>
  21 #include <linux/seccomp.h>
  22 #include <linux/signal.h>
  23 #include <linux/perf_event.h>
  24 #include <linux/hw_breakpoint.h>
  25 #include <linux/rcupdate.h>
  26 #include <linux/export.h>
  27 #include <linux/context_tracking.h>
  28 #include <linux/nospec.h>
  29
  30 #include <linux/uaccess.h>
  31 #include <asm/processor.h>
  32 #include <asm/fpu/internal.h>
  33 #include <asm/fpu/signal.h>
  34 #include <asm/fpu/regset.h>
  35 #include <asm/debugreg.h>
  36 #include <asm/ldt.h>
  37 #include <asm/desc.h>
  38 #include <asm/prctl.h>
  39 #include <asm/proto.h>
  40 #include <asm/hw_breakpoint.h>
  41 #include <asm/traps.h>
  42 #include <asm/syscall.h>
  43 #include <asm/fsgsbase.h>
  44 #include <asm/io_bitmap.h>
  45
  46 #include "tls.h"
  47
  48 enum x86_regset {
  49         REGSET_GENERAL,
  50         REGSET_FP,
  51         REGSET_XFP,
  52         REGSET_IOPERM64 = REGSET_XFP,
  53         REGSET_XSTATE,
  54         REGSET_TLS,
  55         REGSET_IOPERM32,
  56 };
  57
  58 struct pt_regs_offset {
  59         const char *name;
  60         int offset;
  61 };
  62
  63 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)}
  64 #define REG_OFFSET_END {.name = NULL, .offset = 0}
  65
  66 static const struct pt_regs_offset regoffset_table[] = {
  67 #ifdef CONFIG_X86_64
  68         REG_OFFSET_NAME(r15),
  69         REG_OFFSET_NAME(r14),
  70         REG_OFFSET_NAME(r13),
  71         REG_OFFSET_NAME(r12),
  72         REG_OFFSET_NAME(r11),
  73         REG_OFFSET_NAME(r10),
  74         REG_OFFSET_NAME(r9),
  75         REG_OFFSET_NAME(r8),
  76 #endif
  77         REG_OFFSET_NAME(bx),
  78         REG_OFFSET_NAME(cx),
  79         REG_OFFSET_NAME(dx),
  80         REG_OFFSET_NAME(si),
  81         REG_OFFSET_NAME(di),
  82         REG_OFFSET_NAME(bp),
  83         REG_OFFSET_NAME(ax),
  84 #ifdef CONFIG_X86_32
  85         REG_OFFSET_NAME(ds),
  86         REG_OFFSET_NAME(es),
  87         REG_OFFSET_NAME(fs),
  88         REG_OFFSET_NAME(gs),
  89 #endif
  90         REG_OFFSET_NAME(orig_ax),
  91         REG_OFFSET_NAME(ip),
  92         REG_OFFSET_NAME(cs),
  93         REG_OFFSET_NAME(flags),
  94         REG_OFFSET_NAME(sp),
  95         REG_OFFSET_NAME(ss),
  96         REG_OFFSET_END,
  97 };
  98
  99 /**
 100  * regs_query_register_offset() - query register offset from its name
 101  * @name:       the name of a register
 102  *
 103  * regs_query_register_offset() returns the offset of a register in struct
 104  * pt_regs from its name. If the name is invalid, this returns -EINVAL;
 105  */
 106 int regs_query_register_offset(const char *name)
 107 {
 108         const struct pt_regs_offset *roff;
 109         for (roff = regoffset_table; roff->name != NULL; roff++)
 110                 if (!strcmp(roff->name, name))
 111                         return roff->offset;
 112         return -EINVAL;
 113 }
 114
 115 /**
 116  * regs_query_register_name() - query register name from its offset
 117  * @offset:     the offset of a register in struct pt_regs.
 118  *
 119  * regs_query_register_name() returns the name of a register from its
 120  * offset in struct pt_regs. If the @offset is invalid, this returns NULL;
 121  */
 122 const char *regs_query_register_name(unsigned int offset)
 123 {
 124         const struct pt_regs_offset *roff;
 125         for (roff = regoffset_table; roff->name != NULL; roff++)
 126                 if (roff->offset == offset)
 127                         return roff->name;
 128         return NULL;
 129 }
 130
 131 /*
 132  * does not yet catch signals sent when the child dies.
 133  * in exit.c or in signal.c.
 134  */
 135
 136 /*
 137  * Determines which flags the user has access to [1 = access, 0 = no access].
 138  */
 139 #define FLAG_MASK_32            ((unsigned long)                        \
 140                                  (X86_EFLAGS_CF | X86_EFLAGS_PF |       \
 141                                   X86_EFLAGS_AF | X86_EFLAGS_ZF |       \
 142                                   X86_EFLAGS_SF | X86_EFLAGS_TF |       \
 143                                   X86_EFLAGS_DF | X86_EFLAGS_OF |       \
 144                                   X86_EFLAGS_RF | X86_EFLAGS_AC))
 145
 146 /*
 147  * Determines whether a value may be installed in a segment register.
 148  */
 149 static inline bool invalid_selector(u16 value)
 150 {
 151         return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL);
 152 }
 153
 154 #ifdef CONFIG_X86_32
 155
 156 #define FLAG_MASK               FLAG_MASK_32
 157
 158 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 159 {
 160         BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
 161         return &regs->bx + (regno >> 2);
 162 }
 163
 164 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 165 {
 166         /*
 167          * Returning the value truncates it to 16 bits.
 168          */
 169         unsigned int retval;
 170         if (offset != offsetof(struct user_regs_struct, gs))
 171                 retval = *pt_regs_access(task_pt_regs(task), offset);
 172         else {
 173                 if (task == current)
 174                         retval = get_user_gs(task_pt_regs(task));
 175                 else
 176                         retval = task_user_gs(task);
 177         }
 178         return retval;
 179 }
 180
 181 static int set_segment_reg(struct task_struct *task,
 182                            unsigned long offset, u16 value)
 183 {
 184         if (WARN_ON_ONCE(task == current))
 185                 return -EIO;
 186
 187         /*
 188          * The value argument was already truncated to 16 bits.
 189          */
 190         if (invalid_selector(value))
 191                 return -EIO;
 192
 193         /*
 194          * For %cs and %ss we cannot permit a null selector.
 195          * We can permit a bogus selector as long as it has USER_RPL.
 196          * Null selectors are fine for other segment registers, but
 197          * we will never get back to user mode with invalid %cs or %ss
 198          * and will take the trap in iret instead.  Much code relies
 199          * on user_mode() to distinguish a user trap frame (which can
 200          * safely use invalid selectors) from a kernel trap frame.
 201          */
 202         switch (offset) {
 203         case offsetof(struct user_regs_struct, cs):
 204         case offsetof(struct user_regs_struct, ss):
 205                 if (unlikely(value == 0))
 206                         return -EIO;
 207                 /* Else, fall through */
 208
 209         default:
 210                 *pt_regs_access(task_pt_regs(task), offset) = value;
 211                 break;
 212
 213         case offsetof(struct user_regs_struct, gs):
 214                 task_user_gs(task) = value;
 215         }
 216
 217         return 0;
 218 }
 219
 220 #else  /* CONFIG_X86_64 */
 221
 222 #define FLAG_MASK               (FLAG_MASK_32 | X86_EFLAGS_NT)
 223
 224 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
 225 {
 226         BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
 227         return &regs->r15 + (offset / sizeof(regs->r15));
 228 }
 229
 230 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 231 {
 232         /*
 233          * Returning the value truncates it to 16 bits.
 234          */
 235         unsigned int seg;
 236
 237         switch (offset) {
 238         case offsetof(struct user_regs_struct, fs):
 239                 if (task == current) {
 240                         /* Older gas can't assemble movq %?s,%r?? */
 241                         asm("movl %%fs,%0" : "=r" (seg));
 242                         return seg;
 243                 }
 244                 return task->thread.fsindex;
 245         case offsetof(struct user_regs_struct, gs):
 246                 if (task == current) {
 247                         asm("movl %%gs,%0" : "=r" (seg));
 248                         return seg;
 249                 }
 250                 return task->thread.gsindex;
 251         case offsetof(struct user_regs_struct, ds):
 252                 if (task == current) {
 253                         asm("movl %%ds,%0" : "=r" (seg));
 254                         return seg;
 255                 }
 256                 return task->thread.ds;
 257         case offsetof(struct user_regs_struct, es):
 258                 if (task == current) {
 259                         asm("movl %%es,%0" : "=r" (seg));
 260                         return seg;
 261                 }
 262                 return task->thread.es;
 263
 264         case offsetof(struct user_regs_struct, cs):
 265         case offsetof(struct user_regs_struct, ss):
 266                 break;
 267         }
 268         return *pt_regs_access(task_pt_regs(task), offset);
 269 }
 270
 271 static int set_segment_reg(struct task_struct *task,
 272                            unsigned long offset, u16 value)
 273 {
 274         if (WARN_ON_ONCE(task == current))
 275                 return -EIO;
 276
 277         /*
 278          * The value argument was already truncated to 16 bits.
 279          */
 280         if (invalid_selector(value))
 281                 return -EIO;
 282
 283         /*
 284          * Writes to FS and GS will change the stored selector.  Whether
 285          * this changes the segment base as well depends on whether
 286          * FSGSBASE is enabled.
 287          */
 288
 289         switch (offset) {
 290         case offsetof(struct user_regs_struct,fs):
 291                 task->thread.fsindex = value;
 292                 break;
 293         case offsetof(struct user_regs_struct,gs):
 294                 task->thread.gsindex = value;
 295                 break;
 296         case offsetof(struct user_regs_struct,ds):
 297                 task->thread.ds = value;
 298                 break;
 299         case offsetof(struct user_regs_struct,es):
 300                 task->thread.es = value;
 301                 break;
 302
 303                 /*
 304                  * Can't actually change these in 64-bit mode.
 305                  */
 306         case offsetof(struct user_regs_struct,cs):
 307                 if (unlikely(value == 0))
 308                         return -EIO;
 309                 task_pt_regs(task)->cs = value;
 310                 break;
 311         case offsetof(struct user_regs_struct,ss):
 312                 if (unlikely(value == 0))
 313                         return -EIO;
 314                 task_pt_regs(task)->ss = value;
 315                 break;
 316         }
 317
 318         return 0;
 319 }
 320
 321 #endif  /* CONFIG_X86_32 */
 322
 323 static unsigned long get_flags(struct task_struct *task)
 324 {
 325         unsigned long retval = task_pt_regs(task)->flags;
 326
 327         /*
 328          * If the debugger set TF, hide it from the readout.
 329          */
 330         if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 331                 retval &= ~X86_EFLAGS_TF;
 332
 333         return retval;
 334 }
 335
 336 static int set_flags(struct task_struct *task, unsigned long value)
 337 {
 338         struct pt_regs *regs = task_pt_regs(task);
 339
 340         /*
 341          * If the user value contains TF, mark that
 342          * it was not "us" (the debugger) that set it.
 343          * If not, make sure it stays set if we had.
 344          */
 345         if (value & X86_EFLAGS_TF)
 346                 clear_tsk_thread_flag(task, TIF_FORCED_TF);
 347         else if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 348                 value |= X86_EFLAGS_TF;
 349
 350         regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK);
 351
 352         return 0;
 353 }
 354
 355 static int putreg(struct task_struct *child,
 356                   unsigned long offset, unsigned long value)
 357 {
 358         switch (offset) {
 359         case offsetof(struct user_regs_struct, cs):
 360         case offsetof(struct user_regs_struct, ds):
 361         case offsetof(struct user_regs_struct, es):
 362         case offsetof(struct user_regs_struct, fs):
 363         case offsetof(struct user_regs_struct, gs):
 364         case offsetof(struct user_regs_struct, ss):
 365                 return set_segment_reg(child, offset, value);
 366
 367         case offsetof(struct user_regs_struct, flags):
 368                 return set_flags(child, value);
 369
 370 #ifdef CONFIG_X86_64
 371         case offsetof(struct user_regs_struct,fs_base):
 372                 if (value >= TASK_SIZE_MAX)
 373                         return -EIO;
 374                 x86_fsbase_write_task(child, value);
 375                 return 0;
 376         case offsetof(struct user_regs_struct,gs_base):
 377                 if (value >= TASK_SIZE_MAX)
 378                         return -EIO;
 379                 x86_gsbase_write_task(child, value);
 380                 return 0;
 381 #endif
 382         }
 383
 384         *pt_regs_access(task_pt_regs(child), offset) = value;
 385         return 0;
 386 }
 387
 388 static unsigned long getreg(struct task_struct *task, unsigned long offset)
 389 {
 390         switch (offset) {
 391         case offsetof(struct user_regs_struct, cs):
 392         case offsetof(struct user_regs_struct, ds):
 393         case offsetof(struct user_regs_struct, es):
 394         case offsetof(struct user_regs_struct, fs):
 395         case offsetof(struct user_regs_struct, gs):
 396         case offsetof(struct user_regs_struct, ss):
 397                 return get_segment_reg(task, offset);
 398
 399         case offsetof(struct user_regs_struct, flags):
 400                 return get_flags(task);
 401
 402 #ifdef CONFIG_X86_64
 403         case offsetof(struct user_regs_struct, fs_base):
 404                 return x86_fsbase_read_task(task);
 405         case offsetof(struct user_regs_struct, gs_base):
 406                 return x86_gsbase_read_task(task);
 407 #endif
 408         }
 409
 410         return *pt_regs_access(task_pt_regs(task), offset);
 411 }
 412
 413 static int genregs_get(struct task_struct *target,
 414                        const struct user_regset *regset,
 415                        struct membuf to)
 416 {
 417         int reg;
 418
 419         for (reg = 0; to.left; reg++)
 420                 membuf_store(&to, getreg(target, reg * sizeof(unsigned long)));
 421         return 0;
 422 }
 423
 424 static int genregs_set(struct task_struct *target,
 425                        const struct user_regset *regset,
 426                        unsigned int pos, unsigned int count,
 427                        const void *kbuf, const void __user *ubuf)
 428 {
 429         int ret = 0;
 430         if (kbuf) {
 431                 const unsigned long *k = kbuf;
 432                 while (count >= sizeof(*k) && !ret) {
 433                         ret = putreg(target, pos, *k++);
 434                         count -= sizeof(*k);
 435                         pos += sizeof(*k);
 436                 }
 437         } else {
 438                 const unsigned long  __user *u = ubuf;
 439                 while (count >= sizeof(*u) && !ret) {
 440                         unsigned long word;
 441                         ret = __get_user(word, u++);
 442                         if (ret)
 443                                 break;
 444                         ret = putreg(target, pos, word);
 445                         count -= sizeof(*u);
 446                         pos += sizeof(*u);
 447                 }
 448         }
 449         return ret;
 450 }
 451
 452 static void ptrace_triggered(struct perf_event *bp,
 453                              struct perf_sample_data *data,
 454                              struct pt_regs *regs)
 455 {
 456         int i;
 457         struct thread_struct *thread = &(current->thread);
 458
 459         /*
 460          * Store in the virtual DR6 register the fact that the breakpoint
 461          * was hit so the thread's debugger will see it.
 462          */
 463         for (i = 0; i < HBP_NUM; i++) {
 464                 if (thread->ptrace_bps[i] == bp)
 465                         break;
 466         }
 467
 468         thread->debugreg6 |= (DR_TRAP0 << i);
 469 }
 470
 471 /*
 472  * Walk through every ptrace breakpoints for this thread and
 473  * build the dr7 value on top of their attributes.
 474  *
 475  */
 476 static unsigned long ptrace_get_dr7(struct perf_event *bp[])
 477 {
 478         int i;
 479         int dr7 = 0;
 480         struct arch_hw_breakpoint *info;
 481
 482         for (i = 0; i < HBP_NUM; i++) {
 483                 if (bp[i] && !bp[i]->attr.disabled) {
 484                         info = counter_arch_bp(bp[i]);
 485                         dr7 |= encode_dr7(i, info->len, info->type);
 486                 }
 487         }
 488
 489         return dr7;
 490 }
 491
 492 static int ptrace_fill_bp_fields(struct perf_event_attr *attr,
 493                                         int len, int type, bool disabled)
 494 {
 495         int err, bp_len, bp_type;
 496
 497         err = arch_bp_generic_fields(len, type, &bp_len, &bp_type);
 498         if (!err) {
 499                 attr->bp_len = bp_len;
 500                 attr->bp_type = bp_type;
 501                 attr->disabled = disabled;
 502         }
 503
 504         return err;
 505 }
 506
 507 static struct perf_event *
 508 ptrace_register_breakpoint(struct task_struct *tsk, int len, int type,
 509                                 unsigned long addr, bool disabled)
 510 {
 511         struct perf_event_attr attr;
 512         int err;
 513
 514         ptrace_breakpoint_init(&attr);
 515         attr.bp_addr = addr;
 516
 517         err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 518         if (err)
 519                 return ERR_PTR(err);
 520
 521         return register_user_hw_breakpoint(&attr, ptrace_triggered,
 522                                                  NULL, tsk);
 523 }
 524
 525 static int ptrace_modify_breakpoint(struct perf_event *bp, int len, int type,
 526                                         int disabled)
 527 {
 528         struct perf_event_attr attr = bp->attr;
 529         int err;
 530
 531         err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 532         if (err)
 533                 return err;
 534
 535         return modify_user_hw_breakpoint(bp, &attr);
 536 }
 537
 538 /*
 539  * Handle ptrace writes to debug register 7.
 540  */
 541 static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data)
 542 {
 543         struct thread_struct *thread = &tsk->thread;
 544         unsigned long old_dr7;
 545         bool second_pass = false;
 546         int i, rc, ret = 0;
 547
 548         data &= ~DR_CONTROL_RESERVED;
 549         old_dr7 = ptrace_get_dr7(thread->ptrace_bps);
 550
 551 restore:
 552         rc = 0;
 553         for (i = 0; i < HBP_NUM; i++) {
 554                 unsigned len, type;
 555                 bool disabled = !decode_dr7(data, i, &len, &type);
 556                 struct perf_event *bp = thread->ptrace_bps[i];
 557
 558                 if (!bp) {
 559                         if (disabled)
 560                                 continue;
 561
 562                         bp = ptrace_register_breakpoint(tsk,
 563                                         len, type, 0, disabled);
 564                         if (IS_ERR(bp)) {
 565                                 rc = PTR_ERR(bp);
 566                                 break;
 567                         }
 568
 569                         thread->ptrace_bps[i] = bp;
 570                         continue;
 571                 }
 572
 573                 rc = ptrace_modify_breakpoint(bp, len, type, disabled);
 574                 if (rc)
 575                         break;
 576         }
 577
 578         /* Restore if the first pass failed, second_pass shouldn't fail. */
 579         if (rc && !WARN_ON(second_pass)) {
 580                 ret = rc;
 581                 data = old_dr7;
 582                 second_pass = true;
 583                 goto restore;
 584         }
 585
 586         return ret;
 587 }
 588
 589 /*
 590  * Handle PTRACE_PEEKUSR calls for the debug register area.
 591  */
 592 static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
 593 {
 594         struct thread_struct *thread = &tsk->thread;
 595         unsigned long val = 0;
 596
 597         if (n < HBP_NUM) {
 598                 int index = array_index_nospec(n, HBP_NUM);
 599                 struct perf_event *bp = thread->ptrace_bps[index];
 600
 601                 if (bp)
 602                         val = bp->hw.info.address;
 603         } else if (n == 6) {
 604                 val = thread->debugreg6;
 605         } else if (n == 7) {
 606                 val = thread->ptrace_dr7;
 607         }
 608         return val;
 609 }
 610
 611 static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
 612                                       unsigned long addr)
 613 {
 614         struct thread_struct *t = &tsk->thread;
 615         struct perf_event *bp = t->ptrace_bps[nr];
 616         int err = 0;
 617
 618         if (!bp) {
 619                 /*
 620                  * Put stub len and type to create an inactive but correct bp.
 621                  *
 622                  * CHECKME: the previous code returned -EIO if the addr wasn't
 623                  * a valid task virtual addr. The new one will return -EINVAL in
 624                  *  this case.
 625                  * -EINVAL may be what we want for in-kernel breakpoints users,
 626                  * but -EIO looks better for ptrace, since we refuse a register
 627                  * writing for the user. And anyway this is the previous
 628                  * behaviour.
 629                  */
 630                 bp = ptrace_register_breakpoint(tsk,
 631                                 X86_BREAKPOINT_LEN_1, X86_BREAKPOINT_WRITE,
 632                                 addr, true);
 633                 if (IS_ERR(bp))
 634                         err = PTR_ERR(bp);
 635                 else
 636                         t->ptrace_bps[nr] = bp;
 637         } else {
 638                 struct perf_event_attr attr = bp->attr;
 639
 640                 attr.bp_addr = addr;
 641                 err = modify_user_hw_breakpoint(bp, &attr);
 642         }
 643
 644         return err;
 645 }
 646
 647 /*
 648  * Handle PTRACE_POKEUSR calls for the debug register area.
 649  */
 650 static int ptrace_set_debugreg(struct task_struct *tsk, int n,
 651                                unsigned long val)
 652 {
 653         struct thread_struct *thread = &tsk->thread;
 654         /* There are no DR4 or DR5 registers */
 655         int rc = -EIO;
 656
 657         if (n < HBP_NUM) {
 658                 rc = ptrace_set_breakpoint_addr(tsk, n, val);
 659         } else if (n == 6) {
 660                 thread->debugreg6 = val;
 661                 rc = 0;
 662         } else if (n == 7) {
 663                 rc = ptrace_write_dr7(tsk, val);
 664                 if (!rc)
 665                         thread->ptrace_dr7 = val;
 666         }
 667         return rc;
 668 }
 669
 670 /*
 671  * These access the current or another (stopped) task's io permission
 672  * bitmap for debugging or core dump.
 673  */
 674 static int ioperm_active(struct task_struct *target,
 675                          const struct user_regset *regset)
 676 {
 677         struct io_bitmap *iobm = target->thread.io_bitmap;
 678
 679         return iobm ? DIV_ROUND_UP(iobm->max, regset->size) : 0;
 680 }
 681
 682 static int ioperm_get(struct task_struct *target,
 683                       const struct user_regset *regset,
 684                       struct membuf to)
 685 {
 686         struct io_bitmap *iobm = target->thread.io_bitmap;
 687
 688         if (!iobm)
 689                 return -ENXIO;
 690
 691         return membuf_write(&to, iobm->bitmap, IO_BITMAP_BYTES);
 692 }
 693
 694 /*
 695  * Called by kernel/ptrace.c when detaching..
 696  *
 697  * Make sure the single step bit is not set.
 698  */
 699 void ptrace_disable(struct task_struct *child)
 700 {
 701         user_disable_single_step(child);
 702 }
 703
 704 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 705 static const struct user_regset_view user_x86_32_view; /* Initialized below. */
 706 #endif
 707
 708 long arch_ptrace(struct task_struct *child, long request,
 709                  unsigned long addr, unsigned long data)
 710 {
 711         int ret;
 712         unsigned long __user *datap = (unsigned long __user *)data;
 713
 714         switch (request) {
 715         /* read the word at location addr in the USER area. */
 716         case PTRACE_PEEKUSR: {
 717                 unsigned long tmp;
 718
 719                 ret = -EIO;
 720                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 721                         break;
 722
 723                 tmp = 0;  /* Default return condition */
 724                 if (addr < sizeof(struct user_regs_struct))
 725                         tmp = getreg(child, addr);
 726                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 727                          addr <= offsetof(struct user, u_debugreg[7])) {
 728                         addr -= offsetof(struct user, u_debugreg[0]);
 729                         tmp = ptrace_get_debugreg(child, addr / sizeof(data));
 730                 }
 731                 ret = put_user(tmp, datap);
 732                 break;
 733         }
 734
 735         case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
 736                 ret = -EIO;
 737                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 738                         break;
 739
 740                 if (addr < sizeof(struct user_regs_struct))
 741                         ret = putreg(child, addr, data);
 742                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 743                          addr <= offsetof(struct user, u_debugreg[7])) {
 744                         addr -= offsetof(struct user, u_debugreg[0]);
 745                         ret = ptrace_set_debugreg(child,
 746                                                   addr / sizeof(data), data);
 747                 }
 748                 break;
 749
 750         case PTRACE_GETREGS:    /* Get all gp regs from the child. */
 751                 return copy_regset_to_user(child,
 752                                            task_user_regset_view(current),
 753                                            REGSET_GENERAL,
 754                                            0, sizeof(struct user_regs_struct),
 755                                            datap);
 756
 757         case PTRACE_SETREGS:    /* Set all gp regs in the child. */
 758                 return copy_regset_from_user(child,
 759                                              task_user_regset_view(current),
 760                                              REGSET_GENERAL,
 761                                              0, sizeof(struct user_regs_struct),
 762                                              datap);
 763
 764         case PTRACE_GETFPREGS:  /* Get the child FPU state. */
 765                 return copy_regset_to_user(child,
 766                                            task_user_regset_view(current),
 767                                            REGSET_FP,
 768                                            0, sizeof(struct user_i387_struct),
 769                                            datap);
 770
 771         case PTRACE_SETFPREGS:  /* Set the child FPU state. */
 772                 return copy_regset_from_user(child,
 773                                              task_user_regset_view(current),
 774                                              REGSET_FP,
 775                                              0, sizeof(struct user_i387_struct),
 776                                              datap);
 777
 778 #ifdef CONFIG_X86_32
 779         case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
 780                 return copy_regset_to_user(child, &user_x86_32_view,
 781                                            REGSET_XFP,
 782                                            0, sizeof(struct user_fxsr_struct),
 783                                            datap) ? -EIO : 0;
 784
 785         case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
 786                 return copy_regset_from_user(child, &user_x86_32_view,
 787                                              REGSET_XFP,
 788                                              0, sizeof(struct user_fxsr_struct),
 789                                              datap) ? -EIO : 0;
 790 #endif
 791
 792 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 793         case PTRACE_GET_THREAD_AREA:
 794                 if ((int) addr < 0)
 795                         return -EIO;
 796                 ret = do_get_thread_area(child, addr,
 797                                         (struct user_desc __user *)data);
 798                 break;
 799
 800         case PTRACE_SET_THREAD_AREA:
 801                 if ((int) addr < 0)
 802                         return -EIO;
 803                 ret = do_set_thread_area(child, addr,
 804                                         (struct user_desc __user *)data, 0);
 805                 break;
 806 #endif
 807
 808 #ifdef CONFIG_X86_64
 809                 /* normal 64bit interface to access TLS data.
 810                    Works just like arch_prctl, except that the arguments
 811                    are reversed. */
 812         case PTRACE_ARCH_PRCTL:
 813                 ret = do_arch_prctl_64(child, data, addr);
 814                 break;
 815 #endif
 816
 817         default:
 818                 ret = ptrace_request(child, request, addr, data);
 819                 break;
 820         }
 821
 822         return ret;
 823 }
 824
 825 #ifdef CONFIG_IA32_EMULATION
 826
 827 #include <linux/compat.h>
 828 #include <linux/syscalls.h>
 829 #include <asm/ia32.h>
 830 #include <asm/user32.h>
 831
 832 #define R32(l,q)                                                        \
 833         case offsetof(struct user32, regs.l):                           \
 834                 regs->q = value; break
 835
 836 #define SEG32(rs)                                                       \
 837         case offsetof(struct user32, regs.rs):                          \
 838                 return set_segment_reg(child,                           \
 839                                        offsetof(struct user_regs_struct, rs), \
 840                                        value);                          \
 841                 break
 842
 843 static int putreg32(struct task_struct *child, unsigned regno, u32 value)
 844 {
 845         struct pt_regs *regs = task_pt_regs(child);
 846         int ret;
 847
 848         switch (regno) {
 849
 850         SEG32(cs);
 851         SEG32(ds);
 852         SEG32(es);
 853
 854         /*
 855          * A 32-bit ptracer on a 64-bit kernel expects that writing
 856          * FS or GS will also update the base.  This is needed for
 857          * operations like PTRACE_SETREGS to fully restore a saved
 858          * CPU state.
 859          */
 860
 861         case offsetof(struct user32, regs.fs):
 862                 ret = set_segment_reg(child,
 863                                       offsetof(struct user_regs_struct, fs),
 864                                       value);
 865                 if (ret == 0)
 866                         child->thread.fsbase =
 867                                 x86_fsgsbase_read_task(child, value);
 868                 return ret;
 869
 870         case offsetof(struct user32, regs.gs):
 871                 ret = set_segment_reg(child,
 872                                       offsetof(struct user_regs_struct, gs),
 873                                       value);
 874                 if (ret == 0)
 875                         child->thread.gsbase =
 876                                 x86_fsgsbase_read_task(child, value);
 877                 return ret;
 878
 879         SEG32(ss);
 880
 881         R32(ebx, bx);
 882         R32(ecx, cx);
 883         R32(edx, dx);
 884         R32(edi, di);
 885         R32(esi, si);
 886         R32(ebp, bp);
 887         R32(eax, ax);
 888         R32(eip, ip);
 889         R32(esp, sp);
 890
 891         case offsetof(struct user32, regs.orig_eax):
 892                 /*
 893                  * Warning: bizarre corner case fixup here.  A 32-bit
 894                  * debugger setting orig_eax to -1 wants to disable
 895                  * syscall restart.  Make sure that the syscall
 896                  * restart code sign-extends orig_ax.  Also make sure
 897                  * we interpret the -ERESTART* codes correctly if
 898                  * loaded into regs->ax in case the task is not
 899                  * actually still sitting at the exit from a 32-bit
 900                  * syscall with TS_COMPAT still set.
 901                  */
 902                 regs->orig_ax = value;
 903                 if (syscall_get_nr(child, regs) >= 0)
 904                         child->thread_info.status |= TS_I386_REGS_POKED;
 905                 break;
 906
 907         case offsetof(struct user32, regs.eflags):
 908                 return set_flags(child, value);
 909
 910         case offsetof(struct user32, u_debugreg[0]) ...
 911                 offsetof(struct user32, u_debugreg[7]):
 912                 regno -= offsetof(struct user32, u_debugreg[0]);
 913                 return ptrace_set_debugreg(child, regno / 4, value);
 914
 915         default:
 916                 if (regno > sizeof(struct user32) || (regno & 3))
 917                         return -EIO;
 918
 919                 /*
 920                  * Other dummy fields in the virtual user structure
 921                  * are ignored
 922                  */
 923                 break;
 924         }
 925         return 0;
 926 }
 927
 928 #undef R32
 929 #undef SEG32
 930
 931 #define R32(l,q)                                                        \
 932         case offsetof(struct user32, regs.l):                           \
 933                 *val = regs->q; break
 934
 935 #define SEG32(rs)                                                       \
 936         case offsetof(struct user32, regs.rs):                          \
 937                 *val = get_segment_reg(child,                           \
 938                                        offsetof(struct user_regs_struct, rs)); \
 939                 break
 940
 941 static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
 942 {
 943         struct pt_regs *regs = task_pt_regs(child);
 944
 945         switch (regno) {
 946
 947         SEG32(ds);
 948         SEG32(es);
 949         SEG32(fs);
 950         SEG32(gs);
 951
 952         R32(cs, cs);
 953         R32(ss, ss);
 954         R32(ebx, bx);
 955         R32(ecx, cx);
 956         R32(edx, dx);
 957         R32(edi, di);
 958         R32(esi, si);
 959         R32(ebp, bp);
 960         R32(eax, ax);
 961         R32(orig_eax, orig_ax);
 962         R32(eip, ip);
 963         R32(esp, sp);
 964
 965         case offsetof(struct user32, regs.eflags):
 966                 *val = get_flags(child);
 967                 break;
 968
 969         case offsetof(struct user32, u_debugreg[0]) ...
 970                 offsetof(struct user32, u_debugreg[7]):
 971                 regno -= offsetof(struct user32, u_debugreg[0]);
 972                 *val = ptrace_get_debugreg(child, regno / 4);
 973                 break;
 974
 975         default:
 976                 if (regno > sizeof(struct user32) || (regno & 3))
 977                         return -EIO;
 978
 979                 /*
 980                  * Other dummy fields in the virtual user structure
 981                  * are ignored
 982                  */
 983                 *val = 0;
 984                 break;
 985         }
 986         return 0;
 987 }
 988
 989 #undef R32
 990 #undef SEG32
 991
 992 static int genregs32_get(struct task_struct *target,
 993                          const struct user_regset *regset,
 994                          struct membuf to)
 995 {
 996         int reg;
 997
 998         for (reg = 0; to.left; reg++) {
 999                 u32 val;
1000                 getreg32(target, reg * 4, &val);
1001                 membuf_store(&to, val);
1002         }
1003         return 0;
1004 }
1005
1006 static int genregs32_set(struct task_struct *target,
1007                          const struct user_regset *regset,
1008                          unsigned int pos, unsigned int count,
1009                          const void *kbuf, const void __user *ubuf)
1010 {
1011         int ret = 0;
1012         if (kbuf) {
1013                 const compat_ulong_t *k = kbuf;
1014                 while (count >= sizeof(*k) && !ret) {
1015                         ret = putreg32(target, pos, *k++);
1016                         count -= sizeof(*k);
1017                         pos += sizeof(*k);
1018                 }
1019         } else {
1020                 const compat_ulong_t __user *u = ubuf;
1021                 while (count >= sizeof(*u) && !ret) {
1022                         compat_ulong_t word;
1023                         ret = __get_user(word, u++);
1024                         if (ret)
1025                                 break;
1026                         ret = putreg32(target, pos, word);
1027                         count -= sizeof(*u);
1028                         pos += sizeof(*u);
1029                 }
1030         }
1031         return ret;
1032 }
1033
1034 static long ia32_arch_ptrace(struct task_struct *child, compat_long_t request,
1035                              compat_ulong_t caddr, compat_ulong_t cdata)
1036 {
1037         unsigned long addr = caddr;
1038         unsigned long data = cdata;
1039         void __user *datap = compat_ptr(data);
1040         int ret;
1041         __u32 val;
1042
1043         switch (request) {
1044         case PTRACE_PEEKUSR:
1045                 ret = getreg32(child, addr, &val);
1046                 if (ret == 0)
1047                         ret = put_user(val, (__u32 __user *)datap);
1048                 break;
1049
1050         case PTRACE_POKEUSR:
1051                 ret = putreg32(child, addr, data);
1052                 break;
1053
1054         case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1055                 return copy_regset_to_user(child, &user_x86_32_view,
1056                                            REGSET_GENERAL,
1057                                            0, sizeof(struct user_regs_struct32),
1058                                            datap);
1059
1060         case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1061                 return copy_regset_from_user(child, &user_x86_32_view,
1062                                              REGSET_GENERAL, 0,
1063                                              sizeof(struct user_regs_struct32),
1064                                              datap);
1065
1066         case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1067                 return copy_regset_to_user(child, &user_x86_32_view,
1068                                            REGSET_FP, 0,
1069                                            sizeof(struct user_i387_ia32_struct),
1070                                            datap);
1071
1072         case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1073                 return copy_regset_from_user(
1074                         child, &user_x86_32_view, REGSET_FP,
1075                         0, sizeof(struct user_i387_ia32_struct), datap);
1076
1077         case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
1078                 return copy_regset_to_user(child, &user_x86_32_view,
1079                                            REGSET_XFP, 0,
1080                                            sizeof(struct user32_fxsr_struct),
1081                                            datap);
1082
1083         case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
1084                 return copy_regset_from_user(child, &user_x86_32_view,
1085                                              REGSET_XFP, 0,
1086                                              sizeof(struct user32_fxsr_struct),
1087                                              datap);
1088
1089         case PTRACE_GET_THREAD_AREA:
1090         case PTRACE_SET_THREAD_AREA:
1091                 return arch_ptrace(child, request, addr, data);
1092
1093         default:
1094                 return compat_ptrace_request(child, request, addr, data);
1095         }
1096
1097         return ret;
1098 }
1099 #endif /* CONFIG_IA32_EMULATION */
1100
1101 #ifdef CONFIG_X86_X32_ABI
1102 static long x32_arch_ptrace(struct task_struct *child,
1103                             compat_long_t request, compat_ulong_t caddr,
1104                             compat_ulong_t cdata)
1105 {
1106         unsigned long addr = caddr;
1107         unsigned long data = cdata;
1108         void __user *datap = compat_ptr(data);
1109         int ret;
1110
1111         switch (request) {
1112         /* Read 32bits at location addr in the USER area.  Only allow
1113            to return the lower 32bits of segment and debug registers.  */
1114         case PTRACE_PEEKUSR: {
1115                 u32 tmp;
1116
1117                 ret = -EIO;
1118                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1119                     addr < offsetof(struct user_regs_struct, cs))
1120                         break;
1121
1122                 tmp = 0;  /* Default return condition */
1123                 if (addr < sizeof(struct user_regs_struct))
1124                         tmp = getreg(child, addr);
1125                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1126                          addr <= offsetof(struct user, u_debugreg[7])) {
1127                         addr -= offsetof(struct user, u_debugreg[0]);
1128                         tmp = ptrace_get_debugreg(child, addr / sizeof(data));
1129                 }
1130                 ret = put_user(tmp, (__u32 __user *)datap);
1131                 break;
1132         }
1133
1134         /* Write the word at location addr in the USER area.  Only allow
1135            to update segment and debug registers with the upper 32bits
1136            zero-extended. */
1137         case PTRACE_POKEUSR:
1138                 ret = -EIO;
1139                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1140                     addr < offsetof(struct user_regs_struct, cs))
1141                         break;
1142
1143                 if (addr < sizeof(struct user_regs_struct))
1144                         ret = putreg(child, addr, data);
1145                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1146                          addr <= offsetof(struct user, u_debugreg[7])) {
1147                         addr -= offsetof(struct user, u_debugreg[0]);
1148                         ret = ptrace_set_debugreg(child,
1149                                                   addr / sizeof(data), data);
1150                 }
1151                 break;
1152
1153         case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1154                 return copy_regset_to_user(child,
1155                                            task_user_regset_view(current),
1156                                            REGSET_GENERAL,
1157                                            0, sizeof(struct user_regs_struct),
1158                                            datap);
1159
1160         case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1161                 return copy_regset_from_user(child,
1162                                              task_user_regset_view(current),
1163                                              REGSET_GENERAL,
1164                                              0, sizeof(struct user_regs_struct),
1165                                              datap);
1166
1167         case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1168                 return copy_regset_to_user(child,
1169                                            task_user_regset_view(current),
1170                                            REGSET_FP,
1171                                            0, sizeof(struct user_i387_struct),
1172                                            datap);
1173
1174         case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1175                 return copy_regset_from_user(child,
1176                                              task_user_regset_view(current),
1177                                              REGSET_FP,
1178                                              0, sizeof(struct user_i387_struct),
1179                                              datap);
1180
1181         default:
1182                 return compat_ptrace_request(child, request, addr, data);
1183         }
1184
1185         return ret;
1186 }
1187 #endif
1188
1189 #ifdef CONFIG_COMPAT
1190 long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1191                         compat_ulong_t caddr, compat_ulong_t cdata)
1192 {
1193 #ifdef CONFIG_X86_X32_ABI
1194         if (!in_ia32_syscall())
1195                 return x32_arch_ptrace(child, request, caddr, cdata);
1196 #endif
1197 #ifdef CONFIG_IA32_EMULATION
1198         return ia32_arch_ptrace(child, request, caddr, cdata);
1199 #else
1200         return 0;
1201 #endif
1202 }
1203 #endif  /* CONFIG_COMPAT */
1204
1205 #ifdef CONFIG_X86_64
1206
1207 static struct user_regset x86_64_regsets[] __ro_after_init = {
1208         [REGSET_GENERAL] = {
1209                 .core_note_type = NT_PRSTATUS,
1210                 .n = sizeof(struct user_regs_struct) / sizeof(long),
1211                 .size = sizeof(long), .align = sizeof(long),
1212                 .regset_get = genregs_get, .set = genregs_set
1213         },
1214         [REGSET_FP] = {
1215                 .core_note_type = NT_PRFPREG,
1216                 .n = sizeof(struct user_i387_struct) / sizeof(long),
1217                 .size = sizeof(long), .align = sizeof(long),
1218                 .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
1219         },
1220         [REGSET_XSTATE] = {
1221                 .core_note_type = NT_X86_XSTATE,
1222                 .size = sizeof(u64), .align = sizeof(u64),
1223                 .active = xstateregs_active, .regset_get = xstateregs_get,
1224                 .set = xstateregs_set
1225         },
1226         [REGSET_IOPERM64] = {
1227                 .core_note_type = NT_386_IOPERM,
1228                 .n = IO_BITMAP_LONGS,
1229                 .size = sizeof(long), .align = sizeof(long),
1230                 .active = ioperm_active, .regset_get = ioperm_get
1231         },
1232 };
1233
1234 static const struct user_regset_view user_x86_64_view = {
1235         .name = "x86_64", .e_machine = EM_X86_64,
1236         .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets)
1237 };
1238
1239 #else  /* CONFIG_X86_32 */
1240
1241 #define user_regs_struct32      user_regs_struct
1242 #define genregs32_get           genregs_get
1243 #define genregs32_set           genregs_set
1244
1245 #endif  /* CONFIG_X86_64 */
1246
1247 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1248 static struct user_regset x86_32_regsets[] __ro_after_init = {
1249         [REGSET_GENERAL] = {
1250                 .core_note_type = NT_PRSTATUS,
1251                 .n = sizeof(struct user_regs_struct32) / sizeof(u32),
1252                 .size = sizeof(u32), .align = sizeof(u32),
1253                 .regset_get = genregs32_get, .set = genregs32_set
1254         },
1255         [REGSET_FP] = {
1256                 .core_note_type = NT_PRFPREG,
1257                 .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32),
1258                 .size = sizeof(u32), .align = sizeof(u32),
1259                 .active = regset_fpregs_active, .regset_get = fpregs_get, .set = fpregs_set
1260         },
1261         [REGSET_XFP] = {
1262                 .core_note_type = NT_PRXFPREG,
1263                 .n = sizeof(struct user32_fxsr_struct) / sizeof(u32),
1264                 .size = sizeof(u32), .align = sizeof(u32),
1265                 .active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
1266         },
1267         [REGSET_XSTATE] = {
1268                 .core_note_type = NT_X86_XSTATE,
1269                 .size = sizeof(u64), .align = sizeof(u64),
1270                 .active = xstateregs_active, .regset_get = xstateregs_get,
1271                 .set = xstateregs_set
1272         },
1273         [REGSET_TLS] = {
1274                 .core_note_type = NT_386_TLS,
1275                 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN,
1276                 .size = sizeof(struct user_desc),
1277                 .align = sizeof(struct user_desc),
1278                 .active = regset_tls_active,
1279                 .regset_get = regset_tls_get, .set = regset_tls_set
1280         },
1281         [REGSET_IOPERM32] = {
1282                 .core_note_type = NT_386_IOPERM,
1283                 .n = IO_BITMAP_BYTES / sizeof(u32),
1284                 .size = sizeof(u32), .align = sizeof(u32),
1285                 .active = ioperm_active, .regset_get = ioperm_get
1286         },
1287 };
1288
1289 static const struct user_regset_view user_x86_32_view = {
1290         .name = "i386", .e_machine = EM_386,
1291         .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets)
1292 };
1293 #endif
1294
1295 /*
1296  * This represents bytes 464..511 in the memory layout exported through
1297  * the REGSET_XSTATE interface.
1298  */
1299 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
1300
1301 void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
1302 {
1303 #ifdef CONFIG_X86_64
1304         x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1305 #endif
1306 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1307         x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1308 #endif
1309         xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
1310 }
1311
1312 const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1313 {
1314 #ifdef CONFIG_IA32_EMULATION
1315         if (!user_64bit_mode(task_pt_regs(task)))
1316 #endif
1317 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1318                 return &user_x86_32_view;
1319 #endif
1320 #ifdef CONFIG_X86_64
1321         return &user_x86_64_view;
1322 #endif
1323 }
1324
1325 void send_sigtrap(struct pt_regs *regs, int error_code, int si_code)
1326 {
1327         struct task_struct *tsk = current;
1328
1329         tsk->thread.trap_nr = X86_TRAP_DB;
1330         tsk->thread.error_code = error_code;
1331
1332         /* Send us the fake SIGTRAP */
1333         force_sig_fault(SIGTRAP, si_code,
1334                         user_mode(regs) ? (void __user *)regs->ip : NULL);
1335 }
1336
1337 void user_single_step_report(struct pt_regs *regs)
1338 {
1339         send_sigtrap(regs, 0, TRAP_BRKPT);
1340 }