x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
[linux-2.6-block.git] / arch / x86 / kernel / ptrace.c
1 // SPDX-License-Identifier: GPL-2.0-only
2 /* By Ross Biro 1/23/92 */
3 /*
4  * Pentium III FXSR, SSE support
5  *      Gareth Hughes <gareth@valinux.com>, May 2000
6  */
7
8 #include <linux/kernel.h>
9 #include <linux/sched.h>
10 #include <linux/sched/task_stack.h>
11 #include <linux/mm.h>
12 #include <linux/smp.h>
13 #include <linux/errno.h>
14 #include <linux/slab.h>
15 #include <linux/ptrace.h>
16 #include <linux/tracehook.h>
17 #include <linux/user.h>
18 #include <linux/elf.h>
19 #include <linux/security.h>
20 #include <linux/audit.h>
21 #include <linux/seccomp.h>
22 #include <linux/signal.h>
23 #include <linux/perf_event.h>
24 #include <linux/hw_breakpoint.h>
25 #include <linux/rcupdate.h>
26 #include <linux/export.h>
27 #include <linux/context_tracking.h>
28 #include <linux/nospec.h>
29
30 #include <linux/uaccess.h>
31 #include <asm/pgtable.h>
32 #include <asm/processor.h>
33 #include <asm/fpu/internal.h>
34 #include <asm/fpu/signal.h>
35 #include <asm/fpu/regset.h>
36 #include <asm/debugreg.h>
37 #include <asm/ldt.h>
38 #include <asm/desc.h>
39 #include <asm/prctl.h>
40 #include <asm/proto.h>
41 #include <asm/hw_breakpoint.h>
42 #include <asm/traps.h>
43 #include <asm/syscall.h>
44 #include <asm/fsgsbase.h>
45
46 #include "tls.h"
47
48 enum x86_regset {
49         REGSET_GENERAL,
50         REGSET_FP,
51         REGSET_XFP,
52         REGSET_IOPERM64 = REGSET_XFP,
53         REGSET_XSTATE,
54         REGSET_TLS,
55         REGSET_IOPERM32,
56 };
57
58 struct pt_regs_offset {
59         const char *name;
60         int offset;
61 };
62
63 #define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)}
64 #define REG_OFFSET_END {.name = NULL, .offset = 0}
65
66 static const struct pt_regs_offset regoffset_table[] = {
67 #ifdef CONFIG_X86_64
68         REG_OFFSET_NAME(r15),
69         REG_OFFSET_NAME(r14),
70         REG_OFFSET_NAME(r13),
71         REG_OFFSET_NAME(r12),
72         REG_OFFSET_NAME(r11),
73         REG_OFFSET_NAME(r10),
74         REG_OFFSET_NAME(r9),
75         REG_OFFSET_NAME(r8),
76 #endif
77         REG_OFFSET_NAME(bx),
78         REG_OFFSET_NAME(cx),
79         REG_OFFSET_NAME(dx),
80         REG_OFFSET_NAME(si),
81         REG_OFFSET_NAME(di),
82         REG_OFFSET_NAME(bp),
83         REG_OFFSET_NAME(ax),
84 #ifdef CONFIG_X86_32
85         REG_OFFSET_NAME(ds),
86         REG_OFFSET_NAME(es),
87         REG_OFFSET_NAME(fs),
88         REG_OFFSET_NAME(gs),
89 #endif
90         REG_OFFSET_NAME(orig_ax),
91         REG_OFFSET_NAME(ip),
92         REG_OFFSET_NAME(cs),
93         REG_OFFSET_NAME(flags),
94         REG_OFFSET_NAME(sp),
95         REG_OFFSET_NAME(ss),
96         REG_OFFSET_END,
97 };
98
99 /**
100  * regs_query_register_offset() - query register offset from its name
101  * @name:       the name of a register
102  *
103  * regs_query_register_offset() returns the offset of a register in struct
104  * pt_regs from its name. If the name is invalid, this returns -EINVAL;
105  */
106 int regs_query_register_offset(const char *name)
107 {
108         const struct pt_regs_offset *roff;
109         for (roff = regoffset_table; roff->name != NULL; roff++)
110                 if (!strcmp(roff->name, name))
111                         return roff->offset;
112         return -EINVAL;
113 }
114
115 /**
116  * regs_query_register_name() - query register name from its offset
117  * @offset:     the offset of a register in struct pt_regs.
118  *
119  * regs_query_register_name() returns the name of a register from its
120  * offset in struct pt_regs. If the @offset is invalid, this returns NULL;
121  */
122 const char *regs_query_register_name(unsigned int offset)
123 {
124         const struct pt_regs_offset *roff;
125         for (roff = regoffset_table; roff->name != NULL; roff++)
126                 if (roff->offset == offset)
127                         return roff->name;
128         return NULL;
129 }
130
131 /*
132  * does not yet catch signals sent when the child dies.
133  * in exit.c or in signal.c.
134  */
135
136 /*
137  * Determines which flags the user has access to [1 = access, 0 = no access].
138  */
139 #define FLAG_MASK_32            ((unsigned long)                        \
140                                  (X86_EFLAGS_CF | X86_EFLAGS_PF |       \
141                                   X86_EFLAGS_AF | X86_EFLAGS_ZF |       \
142                                   X86_EFLAGS_SF | X86_EFLAGS_TF |       \
143                                   X86_EFLAGS_DF | X86_EFLAGS_OF |       \
144                                   X86_EFLAGS_RF | X86_EFLAGS_AC))
145
146 /*
147  * Determines whether a value may be installed in a segment register.
148  */
149 static inline bool invalid_selector(u16 value)
150 {
151         return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL);
152 }
153
154 #ifdef CONFIG_X86_32
155
156 #define FLAG_MASK               FLAG_MASK_32
157
158 /*
159  * X86_32 CPUs don't save ss and esp if the CPU is already in kernel mode
160  * when it traps.  The previous stack will be directly underneath the saved
161  * registers, and 'sp/ss' won't even have been saved. Thus the '&regs->sp'.
162  *
163  * Now, if the stack is empty, '&regs->sp' is out of range. In this
164  * case we try to take the previous stack. To always return a non-null
165  * stack pointer we fall back to regs as stack if no previous stack
166  * exists.
167  *
168  * This is valid only for kernel mode traps.
169  */
170 unsigned long kernel_stack_pointer(struct pt_regs *regs)
171 {
172         unsigned long context = (unsigned long)regs & ~(THREAD_SIZE - 1);
173         unsigned long sp = (unsigned long)&regs->sp;
174         u32 *prev_esp;
175
176         if (context == (sp & ~(THREAD_SIZE - 1)))
177                 return sp;
178
179         prev_esp = (u32 *)(context);
180         if (*prev_esp)
181                 return (unsigned long)*prev_esp;
182
183         return (unsigned long)regs;
184 }
185 EXPORT_SYMBOL_GPL(kernel_stack_pointer);
186
187 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
188 {
189         BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
190         return &regs->bx + (regno >> 2);
191 }
192
193 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
194 {
195         /*
196          * Returning the value truncates it to 16 bits.
197          */
198         unsigned int retval;
199         if (offset != offsetof(struct user_regs_struct, gs))
200                 retval = *pt_regs_access(task_pt_regs(task), offset);
201         else {
202                 if (task == current)
203                         retval = get_user_gs(task_pt_regs(task));
204                 else
205                         retval = task_user_gs(task);
206         }
207         return retval;
208 }
209
210 static int set_segment_reg(struct task_struct *task,
211                            unsigned long offset, u16 value)
212 {
213         /*
214          * The value argument was already truncated to 16 bits.
215          */
216         if (invalid_selector(value))
217                 return -EIO;
218
219         /*
220          * For %cs and %ss we cannot permit a null selector.
221          * We can permit a bogus selector as long as it has USER_RPL.
222          * Null selectors are fine for other segment registers, but
223          * we will never get back to user mode with invalid %cs or %ss
224          * and will take the trap in iret instead.  Much code relies
225          * on user_mode() to distinguish a user trap frame (which can
226          * safely use invalid selectors) from a kernel trap frame.
227          */
228         switch (offset) {
229         case offsetof(struct user_regs_struct, cs):
230         case offsetof(struct user_regs_struct, ss):
231                 if (unlikely(value == 0))
232                         return -EIO;
233
234         default:
235                 *pt_regs_access(task_pt_regs(task), offset) = value;
236                 break;
237
238         case offsetof(struct user_regs_struct, gs):
239                 if (task == current)
240                         set_user_gs(task_pt_regs(task), value);
241                 else
242                         task_user_gs(task) = value;
243         }
244
245         return 0;
246 }
247
248 #else  /* CONFIG_X86_64 */
249
250 #define FLAG_MASK               (FLAG_MASK_32 | X86_EFLAGS_NT)
251
252 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
253 {
254         BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
255         return &regs->r15 + (offset / sizeof(regs->r15));
256 }
257
258 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
259 {
260         /*
261          * Returning the value truncates it to 16 bits.
262          */
263         unsigned int seg;
264
265         switch (offset) {
266         case offsetof(struct user_regs_struct, fs):
267                 if (task == current) {
268                         /* Older gas can't assemble movq %?s,%r?? */
269                         asm("movl %%fs,%0" : "=r" (seg));
270                         return seg;
271                 }
272                 return task->thread.fsindex;
273         case offsetof(struct user_regs_struct, gs):
274                 if (task == current) {
275                         asm("movl %%gs,%0" : "=r" (seg));
276                         return seg;
277                 }
278                 return task->thread.gsindex;
279         case offsetof(struct user_regs_struct, ds):
280                 if (task == current) {
281                         asm("movl %%ds,%0" : "=r" (seg));
282                         return seg;
283                 }
284                 return task->thread.ds;
285         case offsetof(struct user_regs_struct, es):
286                 if (task == current) {
287                         asm("movl %%es,%0" : "=r" (seg));
288                         return seg;
289                 }
290                 return task->thread.es;
291
292         case offsetof(struct user_regs_struct, cs):
293         case offsetof(struct user_regs_struct, ss):
294                 break;
295         }
296         return *pt_regs_access(task_pt_regs(task), offset);
297 }
298
299 static int set_segment_reg(struct task_struct *task,
300                            unsigned long offset, u16 value)
301 {
302         /*
303          * The value argument was already truncated to 16 bits.
304          */
305         if (invalid_selector(value))
306                 return -EIO;
307
308         switch (offset) {
309         case offsetof(struct user_regs_struct,fs):
310                 task->thread.fsindex = value;
311                 if (task == current)
312                         loadsegment(fs, task->thread.fsindex);
313                 break;
314         case offsetof(struct user_regs_struct,gs):
315                 task->thread.gsindex = value;
316                 if (task == current)
317                         load_gs_index(task->thread.gsindex);
318                 break;
319         case offsetof(struct user_regs_struct,ds):
320                 task->thread.ds = value;
321                 if (task == current)
322                         loadsegment(ds, task->thread.ds);
323                 break;
324         case offsetof(struct user_regs_struct,es):
325                 task->thread.es = value;
326                 if (task == current)
327                         loadsegment(es, task->thread.es);
328                 break;
329
330                 /*
331                  * Can't actually change these in 64-bit mode.
332                  */
333         case offsetof(struct user_regs_struct,cs):
334                 if (unlikely(value == 0))
335                         return -EIO;
336                 task_pt_regs(task)->cs = value;
337                 break;
338         case offsetof(struct user_regs_struct,ss):
339                 if (unlikely(value == 0))
340                         return -EIO;
341                 task_pt_regs(task)->ss = value;
342                 break;
343         }
344
345         return 0;
346 }
347
348 #endif  /* CONFIG_X86_32 */
349
350 static unsigned long get_flags(struct task_struct *task)
351 {
352         unsigned long retval = task_pt_regs(task)->flags;
353
354         /*
355          * If the debugger set TF, hide it from the readout.
356          */
357         if (test_tsk_thread_flag(task, TIF_FORCED_TF))
358                 retval &= ~X86_EFLAGS_TF;
359
360         return retval;
361 }
362
363 static int set_flags(struct task_struct *task, unsigned long value)
364 {
365         struct pt_regs *regs = task_pt_regs(task);
366
367         /*
368          * If the user value contains TF, mark that
369          * it was not "us" (the debugger) that set it.
370          * If not, make sure it stays set if we had.
371          */
372         if (value & X86_EFLAGS_TF)
373                 clear_tsk_thread_flag(task, TIF_FORCED_TF);
374         else if (test_tsk_thread_flag(task, TIF_FORCED_TF))
375                 value |= X86_EFLAGS_TF;
376
377         regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK);
378
379         return 0;
380 }
381
382 static int putreg(struct task_struct *child,
383                   unsigned long offset, unsigned long value)
384 {
385         switch (offset) {
386         case offsetof(struct user_regs_struct, cs):
387         case offsetof(struct user_regs_struct, ds):
388         case offsetof(struct user_regs_struct, es):
389         case offsetof(struct user_regs_struct, fs):
390         case offsetof(struct user_regs_struct, gs):
391         case offsetof(struct user_regs_struct, ss):
392                 return set_segment_reg(child, offset, value);
393
394         case offsetof(struct user_regs_struct, flags):
395                 return set_flags(child, value);
396
397 #ifdef CONFIG_X86_64
398         case offsetof(struct user_regs_struct,fs_base):
399                 if (value >= TASK_SIZE_MAX)
400                         return -EIO;
401                 /*
402                  * When changing the FS base, use do_arch_prctl_64()
403                  * to set the index to zero and to set the base
404                  * as requested.
405                  */
406                 if (child->thread.fsbase != value)
407                         return do_arch_prctl_64(child, ARCH_SET_FS, value);
408                 return 0;
409         case offsetof(struct user_regs_struct,gs_base):
410                 /*
411                  * Exactly the same here as the %fs handling above.
412                  */
413                 if (value >= TASK_SIZE_MAX)
414                         return -EIO;
415                 if (child->thread.gsbase != value)
416                         return do_arch_prctl_64(child, ARCH_SET_GS, value);
417                 return 0;
418 #endif
419         }
420
421         *pt_regs_access(task_pt_regs(child), offset) = value;
422         return 0;
423 }
424
425 static unsigned long getreg(struct task_struct *task, unsigned long offset)
426 {
427         switch (offset) {
428         case offsetof(struct user_regs_struct, cs):
429         case offsetof(struct user_regs_struct, ds):
430         case offsetof(struct user_regs_struct, es):
431         case offsetof(struct user_regs_struct, fs):
432         case offsetof(struct user_regs_struct, gs):
433         case offsetof(struct user_regs_struct, ss):
434                 return get_segment_reg(task, offset);
435
436         case offsetof(struct user_regs_struct, flags):
437                 return get_flags(task);
438
439 #ifdef CONFIG_X86_64
440         case offsetof(struct user_regs_struct, fs_base):
441                 return x86_fsbase_read_task(task);
442         case offsetof(struct user_regs_struct, gs_base):
443                 return x86_gsbase_read_task(task);
444 #endif
445         }
446
447         return *pt_regs_access(task_pt_regs(task), offset);
448 }
449
450 static int genregs_get(struct task_struct *target,
451                        const struct user_regset *regset,
452                        unsigned int pos, unsigned int count,
453                        void *kbuf, void __user *ubuf)
454 {
455         if (kbuf) {
456                 unsigned long *k = kbuf;
457                 while (count >= sizeof(*k)) {
458                         *k++ = getreg(target, pos);
459                         count -= sizeof(*k);
460                         pos += sizeof(*k);
461                 }
462         } else {
463                 unsigned long __user *u = ubuf;
464                 while (count >= sizeof(*u)) {
465                         if (__put_user(getreg(target, pos), u++))
466                                 return -EFAULT;
467                         count -= sizeof(*u);
468                         pos += sizeof(*u);
469                 }
470         }
471
472         return 0;
473 }
474
475 static int genregs_set(struct task_struct *target,
476                        const struct user_regset *regset,
477                        unsigned int pos, unsigned int count,
478                        const void *kbuf, const void __user *ubuf)
479 {
480         int ret = 0;
481         if (kbuf) {
482                 const unsigned long *k = kbuf;
483                 while (count >= sizeof(*k) && !ret) {
484                         ret = putreg(target, pos, *k++);
485                         count -= sizeof(*k);
486                         pos += sizeof(*k);
487                 }
488         } else {
489                 const unsigned long  __user *u = ubuf;
490                 while (count >= sizeof(*u) && !ret) {
491                         unsigned long word;
492                         ret = __get_user(word, u++);
493                         if (ret)
494                                 break;
495                         ret = putreg(target, pos, word);
496                         count -= sizeof(*u);
497                         pos += sizeof(*u);
498                 }
499         }
500         return ret;
501 }
502
503 static void ptrace_triggered(struct perf_event *bp,
504                              struct perf_sample_data *data,
505                              struct pt_regs *regs)
506 {
507         int i;
508         struct thread_struct *thread = &(current->thread);
509
510         /*
511          * Store in the virtual DR6 register the fact that the breakpoint
512          * was hit so the thread's debugger will see it.
513          */
514         for (i = 0; i < HBP_NUM; i++) {
515                 if (thread->ptrace_bps[i] == bp)
516                         break;
517         }
518
519         thread->debugreg6 |= (DR_TRAP0 << i);
520 }
521
522 /*
523  * Walk through every ptrace breakpoints for this thread and
524  * build the dr7 value on top of their attributes.
525  *
526  */
527 static unsigned long ptrace_get_dr7(struct perf_event *bp[])
528 {
529         int i;
530         int dr7 = 0;
531         struct arch_hw_breakpoint *info;
532
533         for (i = 0; i < HBP_NUM; i++) {
534                 if (bp[i] && !bp[i]->attr.disabled) {
535                         info = counter_arch_bp(bp[i]);
536                         dr7 |= encode_dr7(i, info->len, info->type);
537                 }
538         }
539
540         return dr7;
541 }
542
543 static int ptrace_fill_bp_fields(struct perf_event_attr *attr,
544                                         int len, int type, bool disabled)
545 {
546         int err, bp_len, bp_type;
547
548         err = arch_bp_generic_fields(len, type, &bp_len, &bp_type);
549         if (!err) {
550                 attr->bp_len = bp_len;
551                 attr->bp_type = bp_type;
552                 attr->disabled = disabled;
553         }
554
555         return err;
556 }
557
558 static struct perf_event *
559 ptrace_register_breakpoint(struct task_struct *tsk, int len, int type,
560                                 unsigned long addr, bool disabled)
561 {
562         struct perf_event_attr attr;
563         int err;
564
565         ptrace_breakpoint_init(&attr);
566         attr.bp_addr = addr;
567
568         err = ptrace_fill_bp_fields(&attr, len, type, disabled);
569         if (err)
570                 return ERR_PTR(err);
571
572         return register_user_hw_breakpoint(&attr, ptrace_triggered,
573                                                  NULL, tsk);
574 }
575
576 static int ptrace_modify_breakpoint(struct perf_event *bp, int len, int type,
577                                         int disabled)
578 {
579         struct perf_event_attr attr = bp->attr;
580         int err;
581
582         err = ptrace_fill_bp_fields(&attr, len, type, disabled);
583         if (err)
584                 return err;
585
586         return modify_user_hw_breakpoint(bp, &attr);
587 }
588
589 /*
590  * Handle ptrace writes to debug register 7.
591  */
592 static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data)
593 {
594         struct thread_struct *thread = &tsk->thread;
595         unsigned long old_dr7;
596         bool second_pass = false;
597         int i, rc, ret = 0;
598
599         data &= ~DR_CONTROL_RESERVED;
600         old_dr7 = ptrace_get_dr7(thread->ptrace_bps);
601
602 restore:
603         rc = 0;
604         for (i = 0; i < HBP_NUM; i++) {
605                 unsigned len, type;
606                 bool disabled = !decode_dr7(data, i, &len, &type);
607                 struct perf_event *bp = thread->ptrace_bps[i];
608
609                 if (!bp) {
610                         if (disabled)
611                                 continue;
612
613                         bp = ptrace_register_breakpoint(tsk,
614                                         len, type, 0, disabled);
615                         if (IS_ERR(bp)) {
616                                 rc = PTR_ERR(bp);
617                                 break;
618                         }
619
620                         thread->ptrace_bps[i] = bp;
621                         continue;
622                 }
623
624                 rc = ptrace_modify_breakpoint(bp, len, type, disabled);
625                 if (rc)
626                         break;
627         }
628
629         /* Restore if the first pass failed, second_pass shouldn't fail. */
630         if (rc && !WARN_ON(second_pass)) {
631                 ret = rc;
632                 data = old_dr7;
633                 second_pass = true;
634                 goto restore;
635         }
636
637         return ret;
638 }
639
640 /*
641  * Handle PTRACE_PEEKUSR calls for the debug register area.
642  */
643 static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
644 {
645         struct thread_struct *thread = &tsk->thread;
646         unsigned long val = 0;
647         int index = n;
648
649         if (n < HBP_NUM) {
650                 index = array_index_nospec(index, HBP_NUM);
651                 struct perf_event *bp = thread->ptrace_bps[index];
652
653                 if (bp)
654                         val = bp->hw.info.address;
655         } else if (n == 6) {
656                 val = thread->debugreg6;
657         } else if (n == 7) {
658                 val = thread->ptrace_dr7;
659         }
660         return val;
661 }
662
663 static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
664                                       unsigned long addr)
665 {
666         struct thread_struct *t = &tsk->thread;
667         struct perf_event *bp = t->ptrace_bps[nr];
668         int err = 0;
669
670         if (!bp) {
671                 /*
672                  * Put stub len and type to create an inactive but correct bp.
673                  *
674                  * CHECKME: the previous code returned -EIO if the addr wasn't
675                  * a valid task virtual addr. The new one will return -EINVAL in
676                  *  this case.
677                  * -EINVAL may be what we want for in-kernel breakpoints users,
678                  * but -EIO looks better for ptrace, since we refuse a register
679                  * writing for the user. And anyway this is the previous
680                  * behaviour.
681                  */
682                 bp = ptrace_register_breakpoint(tsk,
683                                 X86_BREAKPOINT_LEN_1, X86_BREAKPOINT_WRITE,
684                                 addr, true);
685                 if (IS_ERR(bp))
686                         err = PTR_ERR(bp);
687                 else
688                         t->ptrace_bps[nr] = bp;
689         } else {
690                 struct perf_event_attr attr = bp->attr;
691
692                 attr.bp_addr = addr;
693                 err = modify_user_hw_breakpoint(bp, &attr);
694         }
695
696         return err;
697 }
698
699 /*
700  * Handle PTRACE_POKEUSR calls for the debug register area.
701  */
702 static int ptrace_set_debugreg(struct task_struct *tsk, int n,
703                                unsigned long val)
704 {
705         struct thread_struct *thread = &tsk->thread;
706         /* There are no DR4 or DR5 registers */
707         int rc = -EIO;
708
709         if (n < HBP_NUM) {
710                 rc = ptrace_set_breakpoint_addr(tsk, n, val);
711         } else if (n == 6) {
712                 thread->debugreg6 = val;
713                 rc = 0;
714         } else if (n == 7) {
715                 rc = ptrace_write_dr7(tsk, val);
716                 if (!rc)
717                         thread->ptrace_dr7 = val;
718         }
719         return rc;
720 }
721
722 /*
723  * These access the current or another (stopped) task's io permission
724  * bitmap for debugging or core dump.
725  */
726 static int ioperm_active(struct task_struct *target,
727                          const struct user_regset *regset)
728 {
729         return target->thread.io_bitmap_max / regset->size;
730 }
731
732 static int ioperm_get(struct task_struct *target,
733                       const struct user_regset *regset,
734                       unsigned int pos, unsigned int count,
735                       void *kbuf, void __user *ubuf)
736 {
737         if (!target->thread.io_bitmap_ptr)
738                 return -ENXIO;
739
740         return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
741                                    target->thread.io_bitmap_ptr,
742                                    0, IO_BITMAP_BYTES);
743 }
744
745 /*
746  * Called by kernel/ptrace.c when detaching..
747  *
748  * Make sure the single step bit is not set.
749  */
750 void ptrace_disable(struct task_struct *child)
751 {
752         user_disable_single_step(child);
753 #ifdef TIF_SYSCALL_EMU
754         clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
755 #endif
756 }
757
758 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
759 static const struct user_regset_view user_x86_32_view; /* Initialized below. */
760 #endif
761
762 long arch_ptrace(struct task_struct *child, long request,
763                  unsigned long addr, unsigned long data)
764 {
765         int ret;
766         unsigned long __user *datap = (unsigned long __user *)data;
767
768         switch (request) {
769         /* read the word at location addr in the USER area. */
770         case PTRACE_PEEKUSR: {
771                 unsigned long tmp;
772
773                 ret = -EIO;
774                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
775                         break;
776
777                 tmp = 0;  /* Default return condition */
778                 if (addr < sizeof(struct user_regs_struct))
779                         tmp = getreg(child, addr);
780                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
781                          addr <= offsetof(struct user, u_debugreg[7])) {
782                         addr -= offsetof(struct user, u_debugreg[0]);
783                         tmp = ptrace_get_debugreg(child, addr / sizeof(data));
784                 }
785                 ret = put_user(tmp, datap);
786                 break;
787         }
788
789         case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
790                 ret = -EIO;
791                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
792                         break;
793
794                 if (addr < sizeof(struct user_regs_struct))
795                         ret = putreg(child, addr, data);
796                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
797                          addr <= offsetof(struct user, u_debugreg[7])) {
798                         addr -= offsetof(struct user, u_debugreg[0]);
799                         ret = ptrace_set_debugreg(child,
800                                                   addr / sizeof(data), data);
801                 }
802                 break;
803
804         case PTRACE_GETREGS:    /* Get all gp regs from the child. */
805                 return copy_regset_to_user(child,
806                                            task_user_regset_view(current),
807                                            REGSET_GENERAL,
808                                            0, sizeof(struct user_regs_struct),
809                                            datap);
810
811         case PTRACE_SETREGS:    /* Set all gp regs in the child. */
812                 return copy_regset_from_user(child,
813                                              task_user_regset_view(current),
814                                              REGSET_GENERAL,
815                                              0, sizeof(struct user_regs_struct),
816                                              datap);
817
818         case PTRACE_GETFPREGS:  /* Get the child FPU state. */
819                 return copy_regset_to_user(child,
820                                            task_user_regset_view(current),
821                                            REGSET_FP,
822                                            0, sizeof(struct user_i387_struct),
823                                            datap);
824
825         case PTRACE_SETFPREGS:  /* Set the child FPU state. */
826                 return copy_regset_from_user(child,
827                                              task_user_regset_view(current),
828                                              REGSET_FP,
829                                              0, sizeof(struct user_i387_struct),
830                                              datap);
831
832 #ifdef CONFIG_X86_32
833         case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
834                 return copy_regset_to_user(child, &user_x86_32_view,
835                                            REGSET_XFP,
836                                            0, sizeof(struct user_fxsr_struct),
837                                            datap) ? -EIO : 0;
838
839         case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
840                 return copy_regset_from_user(child, &user_x86_32_view,
841                                              REGSET_XFP,
842                                              0, sizeof(struct user_fxsr_struct),
843                                              datap) ? -EIO : 0;
844 #endif
845
846 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
847         case PTRACE_GET_THREAD_AREA:
848                 if ((int) addr < 0)
849                         return -EIO;
850                 ret = do_get_thread_area(child, addr,
851                                         (struct user_desc __user *)data);
852                 break;
853
854         case PTRACE_SET_THREAD_AREA:
855                 if ((int) addr < 0)
856                         return -EIO;
857                 ret = do_set_thread_area(child, addr,
858                                         (struct user_desc __user *)data, 0);
859                 break;
860 #endif
861
862 #ifdef CONFIG_X86_64
863                 /* normal 64bit interface to access TLS data.
864                    Works just like arch_prctl, except that the arguments
865                    are reversed. */
866         case PTRACE_ARCH_PRCTL:
867                 ret = do_arch_prctl_64(child, data, addr);
868                 break;
869 #endif
870
871         default:
872                 ret = ptrace_request(child, request, addr, data);
873                 break;
874         }
875
876         return ret;
877 }
878
879 #ifdef CONFIG_IA32_EMULATION
880
881 #include <linux/compat.h>
882 #include <linux/syscalls.h>
883 #include <asm/ia32.h>
884 #include <asm/user32.h>
885
886 #define R32(l,q)                                                        \
887         case offsetof(struct user32, regs.l):                           \
888                 regs->q = value; break
889
890 #define SEG32(rs)                                                       \
891         case offsetof(struct user32, regs.rs):                          \
892                 return set_segment_reg(child,                           \
893                                        offsetof(struct user_regs_struct, rs), \
894                                        value);                          \
895                 break
896
897 static int putreg32(struct task_struct *child, unsigned regno, u32 value)
898 {
899         struct pt_regs *regs = task_pt_regs(child);
900
901         switch (regno) {
902
903         SEG32(cs);
904         SEG32(ds);
905         SEG32(es);
906         SEG32(fs);
907         SEG32(gs);
908         SEG32(ss);
909
910         R32(ebx, bx);
911         R32(ecx, cx);
912         R32(edx, dx);
913         R32(edi, di);
914         R32(esi, si);
915         R32(ebp, bp);
916         R32(eax, ax);
917         R32(eip, ip);
918         R32(esp, sp);
919
920         case offsetof(struct user32, regs.orig_eax):
921                 /*
922                  * Warning: bizarre corner case fixup here.  A 32-bit
923                  * debugger setting orig_eax to -1 wants to disable
924                  * syscall restart.  Make sure that the syscall
925                  * restart code sign-extends orig_ax.  Also make sure
926                  * we interpret the -ERESTART* codes correctly if
927                  * loaded into regs->ax in case the task is not
928                  * actually still sitting at the exit from a 32-bit
929                  * syscall with TS_COMPAT still set.
930                  */
931                 regs->orig_ax = value;
932                 if (syscall_get_nr(child, regs) >= 0)
933                         child->thread_info.status |= TS_I386_REGS_POKED;
934                 break;
935
936         case offsetof(struct user32, regs.eflags):
937                 return set_flags(child, value);
938
939         case offsetof(struct user32, u_debugreg[0]) ...
940                 offsetof(struct user32, u_debugreg[7]):
941                 regno -= offsetof(struct user32, u_debugreg[0]);
942                 return ptrace_set_debugreg(child, regno / 4, value);
943
944         default:
945                 if (regno > sizeof(struct user32) || (regno & 3))
946                         return -EIO;
947
948                 /*
949                  * Other dummy fields in the virtual user structure
950                  * are ignored
951                  */
952                 break;
953         }
954         return 0;
955 }
956
957 #undef R32
958 #undef SEG32
959
960 #define R32(l,q)                                                        \
961         case offsetof(struct user32, regs.l):                           \
962                 *val = regs->q; break
963
964 #define SEG32(rs)                                                       \
965         case offsetof(struct user32, regs.rs):                          \
966                 *val = get_segment_reg(child,                           \
967                                        offsetof(struct user_regs_struct, rs)); \
968                 break
969
970 static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
971 {
972         struct pt_regs *regs = task_pt_regs(child);
973
974         switch (regno) {
975
976         SEG32(ds);
977         SEG32(es);
978         SEG32(fs);
979         SEG32(gs);
980
981         R32(cs, cs);
982         R32(ss, ss);
983         R32(ebx, bx);
984         R32(ecx, cx);
985         R32(edx, dx);
986         R32(edi, di);
987         R32(esi, si);
988         R32(ebp, bp);
989         R32(eax, ax);
990         R32(orig_eax, orig_ax);
991         R32(eip, ip);
992         R32(esp, sp);
993
994         case offsetof(struct user32, regs.eflags):
995                 *val = get_flags(child);
996                 break;
997
998         case offsetof(struct user32, u_debugreg[0]) ...
999                 offsetof(struct user32, u_debugreg[7]):
1000                 regno -= offsetof(struct user32, u_debugreg[0]);
1001                 *val = ptrace_get_debugreg(child, regno / 4);
1002                 break;
1003
1004         default:
1005                 if (regno > sizeof(struct user32) || (regno & 3))
1006                         return -EIO;
1007
1008                 /*
1009                  * Other dummy fields in the virtual user structure
1010                  * are ignored
1011                  */
1012                 *val = 0;
1013                 break;
1014         }
1015         return 0;
1016 }
1017
1018 #undef R32
1019 #undef SEG32
1020
1021 static int genregs32_get(struct task_struct *target,
1022                          const struct user_regset *regset,
1023                          unsigned int pos, unsigned int count,
1024                          void *kbuf, void __user *ubuf)
1025 {
1026         if (kbuf) {
1027                 compat_ulong_t *k = kbuf;
1028                 while (count >= sizeof(*k)) {
1029                         getreg32(target, pos, k++);
1030                         count -= sizeof(*k);
1031                         pos += sizeof(*k);
1032                 }
1033         } else {
1034                 compat_ulong_t __user *u = ubuf;
1035                 while (count >= sizeof(*u)) {
1036                         compat_ulong_t word;
1037                         getreg32(target, pos, &word);
1038                         if (__put_user(word, u++))
1039                                 return -EFAULT;
1040                         count -= sizeof(*u);
1041                         pos += sizeof(*u);
1042                 }
1043         }
1044
1045         return 0;
1046 }
1047
1048 static int genregs32_set(struct task_struct *target,
1049                          const struct user_regset *regset,
1050                          unsigned int pos, unsigned int count,
1051                          const void *kbuf, const void __user *ubuf)
1052 {
1053         int ret = 0;
1054         if (kbuf) {
1055                 const compat_ulong_t *k = kbuf;
1056                 while (count >= sizeof(*k) && !ret) {
1057                         ret = putreg32(target, pos, *k++);
1058                         count -= sizeof(*k);
1059                         pos += sizeof(*k);
1060                 }
1061         } else {
1062                 const compat_ulong_t __user *u = ubuf;
1063                 while (count >= sizeof(*u) && !ret) {
1064                         compat_ulong_t word;
1065                         ret = __get_user(word, u++);
1066                         if (ret)
1067                                 break;
1068                         ret = putreg32(target, pos, word);
1069                         count -= sizeof(*u);
1070                         pos += sizeof(*u);
1071                 }
1072         }
1073         return ret;
1074 }
1075
1076 static long ia32_arch_ptrace(struct task_struct *child, compat_long_t request,
1077                              compat_ulong_t caddr, compat_ulong_t cdata)
1078 {
1079         unsigned long addr = caddr;
1080         unsigned long data = cdata;
1081         void __user *datap = compat_ptr(data);
1082         int ret;
1083         __u32 val;
1084
1085         switch (request) {
1086         case PTRACE_PEEKUSR:
1087                 ret = getreg32(child, addr, &val);
1088                 if (ret == 0)
1089                         ret = put_user(val, (__u32 __user *)datap);
1090                 break;
1091
1092         case PTRACE_POKEUSR:
1093                 ret = putreg32(child, addr, data);
1094                 break;
1095
1096         case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1097                 return copy_regset_to_user(child, &user_x86_32_view,
1098                                            REGSET_GENERAL,
1099                                            0, sizeof(struct user_regs_struct32),
1100                                            datap);
1101
1102         case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1103                 return copy_regset_from_user(child, &user_x86_32_view,
1104                                              REGSET_GENERAL, 0,
1105                                              sizeof(struct user_regs_struct32),
1106                                              datap);
1107
1108         case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1109                 return copy_regset_to_user(child, &user_x86_32_view,
1110                                            REGSET_FP, 0,
1111                                            sizeof(struct user_i387_ia32_struct),
1112                                            datap);
1113
1114         case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1115                 return copy_regset_from_user(
1116                         child, &user_x86_32_view, REGSET_FP,
1117                         0, sizeof(struct user_i387_ia32_struct), datap);
1118
1119         case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
1120                 return copy_regset_to_user(child, &user_x86_32_view,
1121                                            REGSET_XFP, 0,
1122                                            sizeof(struct user32_fxsr_struct),
1123                                            datap);
1124
1125         case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
1126                 return copy_regset_from_user(child, &user_x86_32_view,
1127                                              REGSET_XFP, 0,
1128                                              sizeof(struct user32_fxsr_struct),
1129                                              datap);
1130
1131         case PTRACE_GET_THREAD_AREA:
1132         case PTRACE_SET_THREAD_AREA:
1133                 return arch_ptrace(child, request, addr, data);
1134
1135         default:
1136                 return compat_ptrace_request(child, request, addr, data);
1137         }
1138
1139         return ret;
1140 }
1141 #endif /* CONFIG_IA32_EMULATION */
1142
1143 #ifdef CONFIG_X86_X32_ABI
1144 static long x32_arch_ptrace(struct task_struct *child,
1145                             compat_long_t request, compat_ulong_t caddr,
1146                             compat_ulong_t cdata)
1147 {
1148         unsigned long addr = caddr;
1149         unsigned long data = cdata;
1150         void __user *datap = compat_ptr(data);
1151         int ret;
1152
1153         switch (request) {
1154         /* Read 32bits at location addr in the USER area.  Only allow
1155            to return the lower 32bits of segment and debug registers.  */
1156         case PTRACE_PEEKUSR: {
1157                 u32 tmp;
1158
1159                 ret = -EIO;
1160                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1161                     addr < offsetof(struct user_regs_struct, cs))
1162                         break;
1163
1164                 tmp = 0;  /* Default return condition */
1165                 if (addr < sizeof(struct user_regs_struct))
1166                         tmp = getreg(child, addr);
1167                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1168                          addr <= offsetof(struct user, u_debugreg[7])) {
1169                         addr -= offsetof(struct user, u_debugreg[0]);
1170                         tmp = ptrace_get_debugreg(child, addr / sizeof(data));
1171                 }
1172                 ret = put_user(tmp, (__u32 __user *)datap);
1173                 break;
1174         }
1175
1176         /* Write the word at location addr in the USER area.  Only allow
1177            to update segment and debug registers with the upper 32bits
1178            zero-extended. */
1179         case PTRACE_POKEUSR:
1180                 ret = -EIO;
1181                 if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1182                     addr < offsetof(struct user_regs_struct, cs))
1183                         break;
1184
1185                 if (addr < sizeof(struct user_regs_struct))
1186                         ret = putreg(child, addr, data);
1187                 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1188                          addr <= offsetof(struct user, u_debugreg[7])) {
1189                         addr -= offsetof(struct user, u_debugreg[0]);
1190                         ret = ptrace_set_debugreg(child,
1191                                                   addr / sizeof(data), data);
1192                 }
1193                 break;
1194
1195         case PTRACE_GETREGS:    /* Get all gp regs from the child. */
1196                 return copy_regset_to_user(child,
1197                                            task_user_regset_view(current),
1198                                            REGSET_GENERAL,
1199                                            0, sizeof(struct user_regs_struct),
1200                                            datap);
1201
1202         case PTRACE_SETREGS:    /* Set all gp regs in the child. */
1203                 return copy_regset_from_user(child,
1204                                              task_user_regset_view(current),
1205                                              REGSET_GENERAL,
1206                                              0, sizeof(struct user_regs_struct),
1207                                              datap);
1208
1209         case PTRACE_GETFPREGS:  /* Get the child FPU state. */
1210                 return copy_regset_to_user(child,
1211                                            task_user_regset_view(current),
1212                                            REGSET_FP,
1213                                            0, sizeof(struct user_i387_struct),
1214                                            datap);
1215
1216         case PTRACE_SETFPREGS:  /* Set the child FPU state. */
1217                 return copy_regset_from_user(child,
1218                                              task_user_regset_view(current),
1219                                              REGSET_FP,
1220                                              0, sizeof(struct user_i387_struct),
1221                                              datap);
1222
1223         default:
1224                 return compat_ptrace_request(child, request, addr, data);
1225         }
1226
1227         return ret;
1228 }
1229 #endif
1230
1231 #ifdef CONFIG_COMPAT
1232 long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1233                         compat_ulong_t caddr, compat_ulong_t cdata)
1234 {
1235 #ifdef CONFIG_X86_X32_ABI
1236         if (!in_ia32_syscall())
1237                 return x32_arch_ptrace(child, request, caddr, cdata);
1238 #endif
1239 #ifdef CONFIG_IA32_EMULATION
1240         return ia32_arch_ptrace(child, request, caddr, cdata);
1241 #else
1242         return 0;
1243 #endif
1244 }
1245 #endif  /* CONFIG_COMPAT */
1246
1247 #ifdef CONFIG_X86_64
1248
1249 static struct user_regset x86_64_regsets[] __ro_after_init = {
1250         [REGSET_GENERAL] = {
1251                 .core_note_type = NT_PRSTATUS,
1252                 .n = sizeof(struct user_regs_struct) / sizeof(long),
1253                 .size = sizeof(long), .align = sizeof(long),
1254                 .get = genregs_get, .set = genregs_set
1255         },
1256         [REGSET_FP] = {
1257                 .core_note_type = NT_PRFPREG,
1258                 .n = sizeof(struct user_i387_struct) / sizeof(long),
1259                 .size = sizeof(long), .align = sizeof(long),
1260                 .active = regset_xregset_fpregs_active, .get = xfpregs_get, .set = xfpregs_set
1261         },
1262         [REGSET_XSTATE] = {
1263                 .core_note_type = NT_X86_XSTATE,
1264                 .size = sizeof(u64), .align = sizeof(u64),
1265                 .active = xstateregs_active, .get = xstateregs_get,
1266                 .set = xstateregs_set
1267         },
1268         [REGSET_IOPERM64] = {
1269                 .core_note_type = NT_386_IOPERM,
1270                 .n = IO_BITMAP_LONGS,
1271                 .size = sizeof(long), .align = sizeof(long),
1272                 .active = ioperm_active, .get = ioperm_get
1273         },
1274 };
1275
1276 static const struct user_regset_view user_x86_64_view = {
1277         .name = "x86_64", .e_machine = EM_X86_64,
1278         .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets)
1279 };
1280
1281 #else  /* CONFIG_X86_32 */
1282
1283 #define user_regs_struct32      user_regs_struct
1284 #define genregs32_get           genregs_get
1285 #define genregs32_set           genregs_set
1286
1287 #endif  /* CONFIG_X86_64 */
1288
1289 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1290 static struct user_regset x86_32_regsets[] __ro_after_init = {
1291         [REGSET_GENERAL] = {
1292                 .core_note_type = NT_PRSTATUS,
1293                 .n = sizeof(struct user_regs_struct32) / sizeof(u32),
1294                 .size = sizeof(u32), .align = sizeof(u32),
1295                 .get = genregs32_get, .set = genregs32_set
1296         },
1297         [REGSET_FP] = {
1298                 .core_note_type = NT_PRFPREG,
1299                 .n = sizeof(struct user_i387_ia32_struct) / sizeof(u32),
1300                 .size = sizeof(u32), .align = sizeof(u32),
1301                 .active = regset_fpregs_active, .get = fpregs_get, .set = fpregs_set
1302         },
1303         [REGSET_XFP] = {
1304                 .core_note_type = NT_PRXFPREG,
1305                 .n = sizeof(struct user32_fxsr_struct) / sizeof(u32),
1306                 .size = sizeof(u32), .align = sizeof(u32),
1307                 .active = regset_xregset_fpregs_active, .get = xfpregs_get, .set = xfpregs_set
1308         },
1309         [REGSET_XSTATE] = {
1310                 .core_note_type = NT_X86_XSTATE,
1311                 .size = sizeof(u64), .align = sizeof(u64),
1312                 .active = xstateregs_active, .get = xstateregs_get,
1313                 .set = xstateregs_set
1314         },
1315         [REGSET_TLS] = {
1316                 .core_note_type = NT_386_TLS,
1317                 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN,
1318                 .size = sizeof(struct user_desc),
1319                 .align = sizeof(struct user_desc),
1320                 .active = regset_tls_active,
1321                 .get = regset_tls_get, .set = regset_tls_set
1322         },
1323         [REGSET_IOPERM32] = {
1324                 .core_note_type = NT_386_IOPERM,
1325                 .n = IO_BITMAP_BYTES / sizeof(u32),
1326                 .size = sizeof(u32), .align = sizeof(u32),
1327                 .active = ioperm_active, .get = ioperm_get
1328         },
1329 };
1330
1331 static const struct user_regset_view user_x86_32_view = {
1332         .name = "i386", .e_machine = EM_386,
1333         .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets)
1334 };
1335 #endif
1336
1337 /*
1338  * This represents bytes 464..511 in the memory layout exported through
1339  * the REGSET_XSTATE interface.
1340  */
1341 u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
1342
1343 void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
1344 {
1345 #ifdef CONFIG_X86_64
1346         x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1347 #endif
1348 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1349         x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1350 #endif
1351         xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
1352 }
1353
1354 const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1355 {
1356 #ifdef CONFIG_IA32_EMULATION
1357         if (!user_64bit_mode(task_pt_regs(task)))
1358 #endif
1359 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1360                 return &user_x86_32_view;
1361 #endif
1362 #ifdef CONFIG_X86_64
1363         return &user_x86_64_view;
1364 #endif
1365 }
1366
1367 void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
1368                                          int error_code, int si_code)
1369 {
1370         tsk->thread.trap_nr = X86_TRAP_DB;
1371         tsk->thread.error_code = error_code;
1372
1373         /* Send us the fake SIGTRAP */
1374         force_sig_fault(SIGTRAP, si_code,
1375                         user_mode(regs) ? (void __user *)regs->ip : NULL, tsk);
1376 }
1377
1378 void user_single_step_report(struct pt_regs *regs)
1379 {
1380         send_sigtrap(current, regs, 0, TRAP_BRKPT);
1381 }