Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* By Ross Biro 1/23/92 */ |
2 | /* | |
3 | * Pentium III FXSR, SSE support | |
4 | * Gareth Hughes <gareth@valinux.com>, May 2000 | |
5 | */ | |
6 | ||
7 | #include <linux/kernel.h> | |
8 | #include <linux/sched.h> | |
9 | #include <linux/mm.h> | |
10 | #include <linux/smp.h> | |
1da177e4 LT |
11 | #include <linux/errno.h> |
12 | #include <linux/ptrace.h> | |
13 | #include <linux/user.h> | |
14 | #include <linux/security.h> | |
15 | #include <linux/audit.h> | |
16 | #include <linux/seccomp.h> | |
7ed20e1a | 17 | #include <linux/signal.h> |
1da177e4 LT |
18 | |
19 | #include <asm/uaccess.h> | |
20 | #include <asm/pgtable.h> | |
21 | #include <asm/system.h> | |
22 | #include <asm/processor.h> | |
23 | #include <asm/i387.h> | |
24 | #include <asm/debugreg.h> | |
25 | #include <asm/ldt.h> | |
26 | #include <asm/desc.h> | |
27 | ||
28 | /* | |
29 | * does not yet catch signals sent when the child dies. | |
30 | * in exit.c or in signal.c. | |
31 | */ | |
32 | ||
9f155b98 CE |
33 | /* |
34 | * Determines which flags the user has access to [1 = access, 0 = no access]. | |
3c36c6aa | 35 | * Prohibits changing ID(21), VIP(20), VIF(19), VM(17), NT(14), IOPL(12-13), IF(9). |
9f155b98 CE |
36 | * Also masks reserved bits (31-22, 15, 5, 3, 1). |
37 | */ | |
3c36c6aa | 38 | #define FLAG_MASK 0x00050dd5 |
1da177e4 | 39 | |
1da177e4 LT |
40 | /* |
41 | * Offset of eflags on child stack.. | |
42 | */ | |
8701ea95 | 43 | #define EFL_OFFSET offsetof(struct pt_regs, eflags) |
1da177e4 LT |
44 | |
45 | static inline struct pt_regs *get_child_regs(struct task_struct *task) | |
46 | { | |
47 | void *stack_top = (void *)task->thread.esp0; | |
48 | return stack_top - sizeof(struct pt_regs); | |
49 | } | |
50 | ||
51 | /* | |
8701ea95 JF |
52 | * This routine will get a word off of the processes privileged stack. |
53 | * the offset is bytes into the pt_regs structure on the stack. | |
54 | * This routine assumes that all the privileged stacks are in our | |
1da177e4 LT |
55 | * data space. |
56 | */ | |
57 | static inline int get_stack_long(struct task_struct *task, int offset) | |
58 | { | |
59 | unsigned char *stack; | |
60 | ||
8701ea95 | 61 | stack = (unsigned char *)task->thread.esp0 - sizeof(struct pt_regs); |
1da177e4 LT |
62 | stack += offset; |
63 | return (*((int *)stack)); | |
64 | } | |
65 | ||
66 | /* | |
8701ea95 JF |
67 | * This routine will put a word on the processes privileged stack. |
68 | * the offset is bytes into the pt_regs structure on the stack. | |
69 | * This routine assumes that all the privileged stacks are in our | |
1da177e4 LT |
70 | * data space. |
71 | */ | |
72 | static inline int put_stack_long(struct task_struct *task, int offset, | |
73 | unsigned long data) | |
74 | { | |
75 | unsigned char * stack; | |
76 | ||
8701ea95 | 77 | stack = (unsigned char *)task->thread.esp0 - sizeof(struct pt_regs); |
1da177e4 LT |
78 | stack += offset; |
79 | *(unsigned long *) stack = data; | |
80 | return 0; | |
81 | } | |
82 | ||
83 | static int putreg(struct task_struct *child, | |
84 | unsigned long regno, unsigned long value) | |
85 | { | |
86 | switch (regno >> 2) { | |
464d1a78 | 87 | case GS: |
1da177e4 LT |
88 | if (value && (value & 3) != 3) |
89 | return -EIO; | |
464d1a78 | 90 | child->thread.gs = value; |
1da177e4 | 91 | return 0; |
1da177e4 LT |
92 | case DS: |
93 | case ES: | |
464d1a78 | 94 | case FS: |
1da177e4 LT |
95 | if (value && (value & 3) != 3) |
96 | return -EIO; | |
97 | value &= 0xffff; | |
98 | break; | |
99 | case SS: | |
100 | case CS: | |
101 | if ((value & 3) != 3) | |
102 | return -EIO; | |
103 | value &= 0xffff; | |
104 | break; | |
105 | case EFL: | |
106 | value &= FLAG_MASK; | |
e1f28773 RM |
107 | /* |
108 | * If the user value contains TF, mark that | |
109 | * it was not "us" (the debugger) that set it. | |
110 | * If not, make sure it stays set if we had. | |
111 | */ | |
112 | if (value & X86_EFLAGS_TF) | |
113 | clear_tsk_thread_flag(child, TIF_FORCED_TF); | |
114 | else if (test_tsk_thread_flag(child, TIF_FORCED_TF)) | |
115 | value |= X86_EFLAGS_TF; | |
1da177e4 LT |
116 | value |= get_stack_long(child, EFL_OFFSET) & ~FLAG_MASK; |
117 | break; | |
118 | } | |
464d1a78 | 119 | if (regno > FS*4) |
66e10a44 | 120 | regno -= 1*4; |
8701ea95 | 121 | put_stack_long(child, regno, value); |
1da177e4 LT |
122 | return 0; |
123 | } | |
124 | ||
125 | static unsigned long getreg(struct task_struct *child, | |
126 | unsigned long regno) | |
127 | { | |
128 | unsigned long retval = ~0UL; | |
129 | ||
130 | switch (regno >> 2) { | |
e1f28773 RM |
131 | case EFL: |
132 | /* | |
133 | * If the debugger set TF, hide it from the readout. | |
134 | */ | |
135 | retval = get_stack_long(child, EFL_OFFSET); | |
136 | if (test_tsk_thread_flag(child, TIF_FORCED_TF)) | |
137 | retval &= ~X86_EFLAGS_TF; | |
138 | break; | |
464d1a78 JF |
139 | case GS: |
140 | retval = child->thread.gs; | |
1da177e4 | 141 | break; |
1da177e4 LT |
142 | case DS: |
143 | case ES: | |
464d1a78 | 144 | case FS: |
1da177e4 LT |
145 | case SS: |
146 | case CS: | |
147 | retval = 0xffff; | |
148 | /* fall through */ | |
149 | default: | |
464d1a78 | 150 | if (regno > FS*4) |
66e10a44 | 151 | regno -= 1*4; |
1da177e4 LT |
152 | retval &= get_stack_long(child, regno); |
153 | } | |
154 | return retval; | |
155 | } | |
156 | ||
1da177e4 LT |
157 | /* |
158 | * Called by kernel/ptrace.c when detaching.. | |
159 | * | |
160 | * Make sure the single step bit is not set. | |
161 | */ | |
162 | void ptrace_disable(struct task_struct *child) | |
163 | { | |
7f232343 | 164 | user_disable_single_step(child); |
ab1c23c2 | 165 | clear_tsk_thread_flag(child, TIF_SYSCALL_EMU); |
1da177e4 LT |
166 | } |
167 | ||
481bed45 | 168 | long arch_ptrace(struct task_struct *child, long request, long addr, long data) |
1da177e4 | 169 | { |
1da177e4 LT |
170 | struct user * dummy = NULL; |
171 | int i, ret; | |
172 | unsigned long __user *datap = (unsigned long __user *)data; | |
173 | ||
1da177e4 LT |
174 | switch (request) { |
175 | /* when I and D space are separate, these will need to be fixed. */ | |
176 | case PTRACE_PEEKTEXT: /* read word at location addr. */ | |
76647323 AD |
177 | case PTRACE_PEEKDATA: |
178 | ret = generic_ptrace_peekdata(child, addr, data); | |
1da177e4 | 179 | break; |
1da177e4 LT |
180 | |
181 | /* read the word at location addr in the USER area. */ | |
182 | case PTRACE_PEEKUSR: { | |
183 | unsigned long tmp; | |
184 | ||
185 | ret = -EIO; | |
186 | if ((addr & 3) || addr < 0 || | |
187 | addr > sizeof(struct user) - 3) | |
188 | break; | |
189 | ||
190 | tmp = 0; /* Default return condition */ | |
191 | if(addr < FRAME_SIZE*sizeof(long)) | |
192 | tmp = getreg(child, addr); | |
193 | if(addr >= (long) &dummy->u_debugreg[0] && | |
194 | addr <= (long) &dummy->u_debugreg[7]){ | |
195 | addr -= (long) &dummy->u_debugreg[0]; | |
196 | addr = addr >> 2; | |
197 | tmp = child->thread.debugreg[addr]; | |
198 | } | |
199 | ret = put_user(tmp, datap); | |
200 | break; | |
201 | } | |
202 | ||
203 | /* when I and D space are separate, this will have to be fixed. */ | |
204 | case PTRACE_POKETEXT: /* write the word at location addr. */ | |
205 | case PTRACE_POKEDATA: | |
f284ce72 | 206 | ret = generic_ptrace_pokedata(child, addr, data); |
1da177e4 LT |
207 | break; |
208 | ||
209 | case PTRACE_POKEUSR: /* write the word at location addr in the USER area */ | |
210 | ret = -EIO; | |
211 | if ((addr & 3) || addr < 0 || | |
212 | addr > sizeof(struct user) - 3) | |
213 | break; | |
214 | ||
215 | if (addr < FRAME_SIZE*sizeof(long)) { | |
216 | ret = putreg(child, addr, data); | |
217 | break; | |
218 | } | |
219 | /* We need to be very careful here. We implicitly | |
220 | want to modify a portion of the task_struct, and we | |
221 | have to be selective about what portions we allow someone | |
222 | to modify. */ | |
223 | ||
224 | ret = -EIO; | |
225 | if(addr >= (long) &dummy->u_debugreg[0] && | |
226 | addr <= (long) &dummy->u_debugreg[7]){ | |
227 | ||
228 | if(addr == (long) &dummy->u_debugreg[4]) break; | |
229 | if(addr == (long) &dummy->u_debugreg[5]) break; | |
230 | if(addr < (long) &dummy->u_debugreg[4] && | |
231 | ((unsigned long) data) >= TASK_SIZE-3) break; | |
232 | ||
233 | /* Sanity-check data. Take one half-byte at once with | |
234 | * check = (val >> (16 + 4*i)) & 0xf. It contains the | |
235 | * R/Wi and LENi bits; bits 0 and 1 are R/Wi, and bits | |
236 | * 2 and 3 are LENi. Given a list of invalid values, | |
237 | * we do mask |= 1 << invalid_value, so that | |
238 | * (mask >> check) & 1 is a correct test for invalid | |
239 | * values. | |
240 | * | |
241 | * R/Wi contains the type of the breakpoint / | |
242 | * watchpoint, LENi contains the length of the watched | |
243 | * data in the watchpoint case. | |
244 | * | |
245 | * The invalid values are: | |
246 | * - LENi == 0x10 (undefined), so mask |= 0x0f00. | |
247 | * - R/Wi == 0x10 (break on I/O reads or writes), so | |
248 | * mask |= 0x4444. | |
249 | * - R/Wi == 0x00 && LENi != 0x00, so we have mask |= | |
250 | * 0x1110. | |
251 | * | |
252 | * Finally, mask = 0x0f00 | 0x4444 | 0x1110 == 0x5f54. | |
253 | * | |
254 | * See the Intel Manual "System Programming Guide", | |
255 | * 15.2.4 | |
256 | * | |
257 | * Note that LENi == 0x10 is defined on x86_64 in long | |
258 | * mode (i.e. even for 32-bit userspace software, but | |
259 | * 64-bit kernel), so the x86_64 mask value is 0x5454. | |
260 | * See the AMD manual no. 24593 (AMD64 System | |
261 | * Programming)*/ | |
262 | ||
263 | if(addr == (long) &dummy->u_debugreg[7]) { | |
264 | data &= ~DR_CONTROL_RESERVED; | |
265 | for(i=0; i<4; i++) | |
266 | if ((0x5f54 >> ((data >> (16 + 4*i)) & 0xf)) & 1) | |
267 | goto out_tsk; | |
b3cf2576 SE |
268 | if (data) |
269 | set_tsk_thread_flag(child, TIF_DEBUG); | |
270 | else | |
271 | clear_tsk_thread_flag(child, TIF_DEBUG); | |
1da177e4 | 272 | } |
1da177e4 LT |
273 | addr -= (long) &dummy->u_debugreg; |
274 | addr = addr >> 2; | |
275 | child->thread.debugreg[addr] = data; | |
276 | ret = 0; | |
277 | } | |
278 | break; | |
279 | ||
1da177e4 LT |
280 | case PTRACE_GETREGS: { /* Get all gp regs from the child. */ |
281 | if (!access_ok(VERIFY_WRITE, datap, FRAME_SIZE*sizeof(long))) { | |
282 | ret = -EIO; | |
283 | break; | |
284 | } | |
285 | for ( i = 0; i < FRAME_SIZE*sizeof(long); i += sizeof(long) ) { | |
286 | __put_user(getreg(child, i), datap); | |
287 | datap++; | |
288 | } | |
289 | ret = 0; | |
290 | break; | |
291 | } | |
292 | ||
293 | case PTRACE_SETREGS: { /* Set all gp regs in the child. */ | |
294 | unsigned long tmp; | |
295 | if (!access_ok(VERIFY_READ, datap, FRAME_SIZE*sizeof(long))) { | |
296 | ret = -EIO; | |
297 | break; | |
298 | } | |
299 | for ( i = 0; i < FRAME_SIZE*sizeof(long); i += sizeof(long) ) { | |
300 | __get_user(tmp, datap); | |
301 | putreg(child, i, tmp); | |
302 | datap++; | |
303 | } | |
304 | ret = 0; | |
305 | break; | |
306 | } | |
307 | ||
308 | case PTRACE_GETFPREGS: { /* Get the child FPU state. */ | |
309 | if (!access_ok(VERIFY_WRITE, datap, | |
310 | sizeof(struct user_i387_struct))) { | |
311 | ret = -EIO; | |
312 | break; | |
313 | } | |
314 | ret = 0; | |
315 | if (!tsk_used_math(child)) | |
316 | init_fpu(child); | |
317 | get_fpregs((struct user_i387_struct __user *)data, child); | |
318 | break; | |
319 | } | |
320 | ||
321 | case PTRACE_SETFPREGS: { /* Set the child FPU state. */ | |
322 | if (!access_ok(VERIFY_READ, datap, | |
323 | sizeof(struct user_i387_struct))) { | |
324 | ret = -EIO; | |
325 | break; | |
326 | } | |
327 | set_stopped_child_used_math(child); | |
328 | set_fpregs(child, (struct user_i387_struct __user *)data); | |
329 | ret = 0; | |
330 | break; | |
331 | } | |
332 | ||
333 | case PTRACE_GETFPXREGS: { /* Get the child extended FPU state. */ | |
334 | if (!access_ok(VERIFY_WRITE, datap, | |
335 | sizeof(struct user_fxsr_struct))) { | |
336 | ret = -EIO; | |
337 | break; | |
338 | } | |
339 | if (!tsk_used_math(child)) | |
340 | init_fpu(child); | |
341 | ret = get_fpxregs((struct user_fxsr_struct __user *)data, child); | |
342 | break; | |
343 | } | |
344 | ||
345 | case PTRACE_SETFPXREGS: { /* Set the child extended FPU state. */ | |
346 | if (!access_ok(VERIFY_READ, datap, | |
347 | sizeof(struct user_fxsr_struct))) { | |
348 | ret = -EIO; | |
349 | break; | |
350 | } | |
351 | set_stopped_child_used_math(child); | |
352 | ret = set_fpxregs(child, (struct user_fxsr_struct __user *)data); | |
353 | break; | |
354 | } | |
355 | ||
356 | case PTRACE_GET_THREAD_AREA: | |
efd1ca52 RM |
357 | if (addr < 0) |
358 | return -EIO; | |
359 | ret = do_get_thread_area(child, addr, | |
360 | (struct user_desc __user *) data); | |
1da177e4 LT |
361 | break; |
362 | ||
363 | case PTRACE_SET_THREAD_AREA: | |
efd1ca52 RM |
364 | if (addr < 0) |
365 | return -EIO; | |
366 | ret = do_set_thread_area(child, addr, | |
367 | (struct user_desc __user *) data, 0); | |
1da177e4 LT |
368 | break; |
369 | ||
370 | default: | |
371 | ret = ptrace_request(child, request, addr, data); | |
372 | break; | |
373 | } | |
481bed45 | 374 | out_tsk: |
1da177e4 LT |
375 | return ret; |
376 | } | |
377 | ||
378 | void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code) | |
379 | { | |
380 | struct siginfo info; | |
381 | ||
382 | tsk->thread.trap_no = 1; | |
383 | tsk->thread.error_code = error_code; | |
384 | ||
385 | memset(&info, 0, sizeof(info)); | |
386 | info.si_signo = SIGTRAP; | |
387 | info.si_code = TRAP_BRKPT; | |
388 | ||
389 | /* User-mode eip? */ | |
fa1e1bdf | 390 | info.si_addr = user_mode_vm(regs) ? (void __user *) regs->eip : NULL; |
1da177e4 | 391 | |
27b46d76 | 392 | /* Send us the fake SIGTRAP */ |
1da177e4 LT |
393 | force_sig_info(SIGTRAP, &info, tsk); |
394 | } | |
395 | ||
396 | /* notification of system call entry/exit | |
397 | * - triggered by current->work.syscall_trace | |
398 | */ | |
399 | __attribute__((regparm(3))) | |
ed75e8d5 | 400 | int do_syscall_trace(struct pt_regs *regs, int entryexit) |
1da177e4 | 401 | { |
4c7fc722 AA |
402 | int is_sysemu = test_thread_flag(TIF_SYSCALL_EMU); |
403 | /* | |
404 | * With TIF_SYSCALL_EMU set we want to ignore TIF_SINGLESTEP for syscall | |
405 | * interception | |
406 | */ | |
1b38f006 | 407 | int is_singlestep = !is_sysemu && test_thread_flag(TIF_SINGLESTEP); |
4c7fc722 | 408 | int ret = 0; |
1b38f006 | 409 | |
1da177e4 | 410 | /* do the secure computing check first */ |
4c7fc722 AA |
411 | if (!entryexit) |
412 | secure_computing(regs->orig_eax); | |
1da177e4 | 413 | |
ab1c23c2 BS |
414 | if (unlikely(current->audit_context)) { |
415 | if (entryexit) | |
5411be59 | 416 | audit_syscall_exit(AUDITSC_RESULT(regs->eax), |
4c7fc722 | 417 | regs->eax); |
ab1c23c2 BS |
418 | /* Debug traps, when using PTRACE_SINGLESTEP, must be sent only |
419 | * on the syscall exit path. Normally, when TIF_SYSCALL_AUDIT is | |
420 | * not used, entry.S will call us only on syscall exit, not | |
421 | * entry; so when TIF_SYSCALL_AUDIT is used we must avoid | |
422 | * calling send_sigtrap() on syscall entry. | |
423 | * | |
424 | * Note that when PTRACE_SYSEMU_SINGLESTEP is used, | |
425 | * is_singlestep is false, despite his name, so we will still do | |
426 | * the correct thing. | |
427 | */ | |
428 | else if (is_singlestep) | |
429 | goto out; | |
430 | } | |
1da177e4 LT |
431 | |
432 | if (!(current->ptrace & PT_PTRACED)) | |
2fd6f58b | 433 | goto out; |
1da177e4 | 434 | |
1b38f006 BS |
435 | /* If a process stops on the 1st tracepoint with SYSCALL_TRACE |
436 | * and then is resumed with SYSEMU_SINGLESTEP, it will come in | |
437 | * here. We have to check this and return */ | |
438 | if (is_sysemu && entryexit) | |
439 | return 0; | |
ed75e8d5 | 440 | |
1da177e4 | 441 | /* Fake a debug trap */ |
c8c86cec | 442 | if (is_singlestep) |
1da177e4 LT |
443 | send_sigtrap(current, regs, 0); |
444 | ||
c8c86cec | 445 | if (!test_thread_flag(TIF_SYSCALL_TRACE) && !is_sysemu) |
2fd6f58b | 446 | goto out; |
1da177e4 LT |
447 | |
448 | /* the 0x80 provides a way for the tracing parent to distinguish | |
449 | between a syscall stop and SIGTRAP delivery */ | |
ed75e8d5 | 450 | /* Note that the debugger could change the result of test_thread_flag!*/ |
4c7fc722 | 451 | ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) ? 0x80:0)); |
1da177e4 LT |
452 | |
453 | /* | |
454 | * this isn't the same as continuing with a signal, but it will do | |
455 | * for normal use. strace only continues with a signal if the | |
456 | * stopping signal is not SIGTRAP. -brl | |
457 | */ | |
458 | if (current->exit_code) { | |
459 | send_sig(current->exit_code, current, 1); | |
460 | current->exit_code = 0; | |
461 | } | |
ed75e8d5 | 462 | ret = is_sysemu; |
4c7fc722 | 463 | out: |
2fd6f58b | 464 | if (unlikely(current->audit_context) && !entryexit) |
5411be59 | 465 | audit_syscall_entry(AUDIT_ARCH_I386, regs->orig_eax, |
2fd6f58b | 466 | regs->ebx, regs->ecx, regs->edx, regs->esi); |
c8c86cec BS |
467 | if (ret == 0) |
468 | return 0; | |
469 | ||
1b38f006 | 470 | regs->orig_eax = -1; /* force skip of syscall restarting */ |
c8c86cec | 471 | if (unlikely(current->audit_context)) |
5411be59 | 472 | audit_syscall_exit(AUDITSC_RESULT(regs->eax), regs->eax); |
c8c86cec | 473 | return 1; |
1da177e4 | 474 | } |