arch/x86/kernel/ptrace_64.c

   1 /* By Ross Biro 1/23/92 */
   2 /*
   3  * Pentium III FXSR, SSE support
   4  *      Gareth Hughes <gareth@valinux.com>, May 2000
   5  *
   6  * x86-64 port 2000-2002 Andi Kleen
   7  */
   8
   9 #include <linux/kernel.h>
  10 #include <linux/sched.h>
  11 #include <linux/mm.h>
  12 #include <linux/smp.h>
  13 #include <linux/errno.h>
  14 #include <linux/ptrace.h>
  15 #include <linux/user.h>
  16 #include <linux/security.h>
  17 #include <linux/audit.h>
  18 #include <linux/seccomp.h>
  19 #include <linux/signal.h>
  20
  21 #include <asm/uaccess.h>
  22 #include <asm/pgtable.h>
  23 #include <asm/system.h>
  24 #include <asm/processor.h>
  25 #include <asm/prctl.h>
  26 #include <asm/i387.h>
  27 #include <asm/debugreg.h>
  28 #include <asm/ldt.h>
  29 #include <asm/desc.h>
  30 #include <asm/proto.h>
  31 #include <asm/ia32.h>
  32
  33 /*
  34  * does not yet catch signals sent when the child dies.
  35  * in exit.c or in signal.c.
  36  */
  37
  38 /*
  39  * Determines which flags the user has access to [1 = access, 0 = no access].
  40  * Prohibits changing ID(21), VIP(20), VIF(19), VM(17), IOPL(12-13), IF(9).
  41  * Also masks reserved bits (63-22, 15, 5, 3, 1).
  42  */
  43 #define FLAG_MASK 0x54dd5UL
  44
  45 /*
  46  * Called by kernel/ptrace.c when detaching..
  47  *
  48  * Make sure the single step bit is not set.
  49  */
  50 void ptrace_disable(struct task_struct *child)
  51 {
  52         user_disable_single_step(child);
  53 }
  54
  55 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
  56 {
  57         BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
  58         return &regs->r15 + (offset / sizeof(regs->r15));
  59 }
  60
  61 static int putreg(struct task_struct *child,
  62         unsigned long regno, unsigned long value)
  63 {
  64         struct pt_regs *regs = task_pt_regs(child);
  65         switch (regno) {
  66         case offsetof(struct user_regs_struct,fs):
  67                 if (value && (value & 3) != 3)
  68                         return -EIO;
  69                 child->thread.fsindex = value & 0xffff;
  70                 if (child == current)
  71                         loadsegment(fs, child->thread.fsindex);
  72                 return 0;
  73         case offsetof(struct user_regs_struct,gs):
  74                 if (value && (value & 3) != 3)
  75                         return -EIO;
  76                 child->thread.gsindex = value & 0xffff;
  77                 if (child == current)
  78                         load_gs_index(child->thread.gsindex);
  79                 return 0;
  80         case offsetof(struct user_regs_struct,ds):
  81                 if (value && (value & 3) != 3)
  82                         return -EIO;
  83                 child->thread.ds = value & 0xffff;
  84                 if (child == current)
  85                         loadsegment(ds, child->thread.ds);
  86                 return 0;
  87         case offsetof(struct user_regs_struct,es):
  88                 if (value && (value & 3) != 3)
  89                         return -EIO;
  90                 child->thread.es = value & 0xffff;
  91                 if (child == current)
  92                         loadsegment(es, child->thread.es);
  93                 return 0;
  94         case offsetof(struct user_regs_struct,ss):
  95                 if ((value & 3) != 3)
  96                         return -EIO;
  97                 value &= 0xffff;
  98                 return 0;
  99         case offsetof(struct user_regs_struct,fs_base):
 100                 if (value >= TASK_SIZE_OF(child))
 101                         return -EIO;
 102                 /*
 103                  * When changing the segment base, use do_arch_prctl
 104                  * to set either thread.fs or thread.fsindex and the
 105                  * corresponding GDT slot.
 106                  */
 107                 if (child->thread.fs != value)
 108                         return do_arch_prctl(child, ARCH_SET_FS, value);
 109                 return 0;
 110         case offsetof(struct user_regs_struct,gs_base):
 111                 /*
 112                  * Exactly the same here as the %fs handling above.
 113                  */
 114                 if (value >= TASK_SIZE_OF(child))
 115                         return -EIO;
 116                 if (child->thread.gs != value)
 117                         return do_arch_prctl(child, ARCH_SET_GS, value);
 118                 return 0;
 119         case offsetof(struct user_regs_struct,flags):
 120                 value &= FLAG_MASK;
 121                 /*
 122                  * If the user value contains TF, mark that
 123                  * it was not "us" (the debugger) that set it.
 124                  * If not, make sure it stays set if we had.
 125                  */
 126                 if (value & X86_EFLAGS_TF)
 127                         clear_tsk_thread_flag(child, TIF_FORCED_TF);
 128                 else if (test_tsk_thread_flag(child, TIF_FORCED_TF))
 129                         value |= X86_EFLAGS_TF;
 130                 value |= regs->flags & ~FLAG_MASK;
 131                 break;
 132         case offsetof(struct user_regs_struct,cs):
 133                 if ((value & 3) != 3)
 134                         return -EIO;
 135                 value &= 0xffff;
 136                 break;
 137         }
 138         *pt_regs_access(regs, regno) = value;
 139         return 0;
 140 }
 141
 142 static unsigned long getreg(struct task_struct *child, unsigned long regno)
 143 {
 144         struct pt_regs *regs = task_pt_regs(child);
 145         unsigned long val;
 146         unsigned int seg;
 147         switch (regno) {
 148         case offsetof(struct user_regs_struct, fs):
 149                 if (child == current) {
 150                         /* Older gas can't assemble movq %?s,%r?? */
 151                         asm("movl %%fs,%0" : "=r" (seg));
 152                         return seg;
 153                 }
 154                 return child->thread.fsindex;
 155         case offsetof(struct user_regs_struct, gs):
 156                 if (child == current) {
 157                         asm("movl %%gs,%0" : "=r" (seg));
 158                         return seg;
 159                 }
 160                 return child->thread.gsindex;
 161         case offsetof(struct user_regs_struct, ds):
 162                 if (child == current) {
 163                         asm("movl %%ds,%0" : "=r" (seg));
 164                         return seg;
 165                 }
 166                 return child->thread.ds;
 167         case offsetof(struct user_regs_struct, es):
 168                 if (child == current) {
 169                         asm("movl %%es,%0" : "=r" (seg));
 170                         return seg;
 171                 }
 172                 return child->thread.es;
 173         case offsetof(struct user_regs_struct, fs_base):
 174                 /*
 175                  * do_arch_prctl may have used a GDT slot instead of
 176                  * the MSR.  To userland, it appears the same either
 177                  * way, except the %fs segment selector might not be 0.
 178                  */
 179                 if (child->thread.fs != 0)
 180                         return child->thread.fs;
 181                 seg = child->thread.fsindex;
 182                 if (child == current)
 183                         asm("movl %%fs,%0" : "=r" (seg));
 184                 if (seg != FS_TLS_SEL)
 185                         return 0;
 186                 return get_desc_base(&child->thread.tls_array[FS_TLS]);
 187         case offsetof(struct user_regs_struct, gs_base):
 188                 /*
 189                  * Exactly the same here as the %fs handling above.
 190                  */
 191                 if (child->thread.gs != 0)
 192                         return child->thread.gs;
 193                 seg = child->thread.gsindex;
 194                 if (child == current)
 195                         asm("movl %%gs,%0" : "=r" (seg));
 196                 if (seg != GS_TLS_SEL)
 197                         return 0;
 198                 return get_desc_base(&child->thread.tls_array[GS_TLS]);
 199         case offsetof(struct user_regs_struct, flags):
 200                 /*
 201                  * If the debugger set TF, hide it from the readout.
 202                  */
 203                 val = regs->flags;
 204                 if (test_tsk_thread_flag(child, TIF_IA32))
 205                         val &= 0xffffffff;
 206                 if (test_tsk_thread_flag(child, TIF_FORCED_TF))
 207                         val &= ~X86_EFLAGS_TF;
 208                 return val;
 209         default:
 210                 val = *pt_regs_access(regs, regno);
 211                 if (test_tsk_thread_flag(child, TIF_IA32))
 212                         val &= 0xffffffff;
 213                 return val;
 214         }
 215
 216 }
 217
 218 unsigned long ptrace_get_debugreg(struct task_struct *child, int n)
 219 {
 220         switch (n) {
 221         case 0:         return child->thread.debugreg0;
 222         case 1:         return child->thread.debugreg1;
 223         case 2:         return child->thread.debugreg2;
 224         case 3:         return child->thread.debugreg3;
 225         case 6:         return child->thread.debugreg6;
 226         case 7:         return child->thread.debugreg7;
 227         }
 228         return 0;
 229 }
 230
 231 int ptrace_set_debugreg(struct task_struct *child, int n, unsigned long data)
 232 {
 233         int i;
 234
 235         if (n < 4) {
 236                 int dsize = test_tsk_thread_flag(child, TIF_IA32) ? 3 : 7;
 237                 if (unlikely(data >= TASK_SIZE_OF(child) - dsize))
 238                         return -EIO;
 239         }
 240
 241         switch (n) {
 242         case 0:         child->thread.debugreg0 = data; break;
 243         case 1:         child->thread.debugreg1 = data; break;
 244         case 2:         child->thread.debugreg2 = data; break;
 245         case 3:         child->thread.debugreg3 = data; break;
 246
 247         case 6:
 248                 if (data >> 32)
 249                         return -EIO;
 250                 child->thread.debugreg6 = data;
 251                 break;
 252
 253         case 7:
 254                 /*
 255                  * See ptrace_32.c for an explanation of this awkward check.
 256                  */
 257                 data &= ~DR_CONTROL_RESERVED;
 258                 for (i = 0; i < 4; i++)
 259                         if ((0x5554 >> ((data >> (16 + 4*i)) & 0xf)) & 1)
 260                                 return -EIO;
 261                 child->thread.debugreg7 = data;
 262                 if (data)
 263                         set_tsk_thread_flag(child, TIF_DEBUG);
 264                 else
 265                         clear_tsk_thread_flag(child, TIF_DEBUG);
 266                 break;
 267         }
 268
 269         return 0;
 270 }
 271
 272 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 273 {
 274         long ret;
 275         unsigned ui;
 276
 277         switch (request) {
 278         /* when I and D space are separate, these will need to be fixed. */
 279         case PTRACE_PEEKTEXT: /* read word at location addr. */
 280         case PTRACE_PEEKDATA:
 281                 ret = generic_ptrace_peekdata(child, addr, data);
 282                 break;
 283
 284         /* read the word at location addr in the USER area. */
 285         case PTRACE_PEEKUSR: {
 286                 unsigned long tmp;
 287
 288                 ret = -EIO;
 289                 if ((addr & 7) ||
 290                     addr > sizeof(struct user) - 7)
 291                         break;
 292
 293                 tmp = 0;
 294                 if (addr < sizeof(struct user_regs_struct))
 295                         tmp = getreg(child, addr);
 296                 else if (addr >= offsetof(struct user, u_debugreg[0])) {
 297                         addr -= offsetof(struct user, u_debugreg[0]);
 298                         tmp = ptrace_get_debugreg(child, addr / sizeof(long));
 299                 }
 300
 301                 ret = put_user(tmp,(unsigned long __user *) data);
 302                 break;
 303         }
 304
 305         /* when I and D space are separate, this will have to be fixed. */
 306         case PTRACE_POKETEXT: /* write the word at location addr. */
 307         case PTRACE_POKEDATA:
 308                 ret = generic_ptrace_pokedata(child, addr, data);
 309                 break;
 310
 311         case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
 312                 ret = -EIO;
 313                 if ((addr & 7) ||
 314                     addr > sizeof(struct user) - 7)
 315                         break;
 316
 317                 if (addr < sizeof(struct user_regs_struct))
 318                         ret = putreg(child, addr, data);
 319                 else if (addr >= offsetof(struct user, u_debugreg[0])) {
 320                         addr -= offsetof(struct user, u_debugreg[0]);
 321                         ret = ptrace_set_debugreg(child,
 322                                                   addr / sizeof(long), data);
 323                 }
 324                 break;
 325
 326 #ifdef CONFIG_IA32_EMULATION
 327                 /* This makes only sense with 32bit programs. Allow a
 328                    64bit debugger to fully examine them too. Better
 329                    don't use it against 64bit processes, use
 330                    PTRACE_ARCH_PRCTL instead. */
 331         case PTRACE_GET_THREAD_AREA:
 332                 if (addr < 0)
 333                         return -EIO;
 334                 ret = do_get_thread_area(child, addr,
 335                                          (struct user_desc __user *) data);
 336
 337                 break;
 338         case PTRACE_SET_THREAD_AREA:
 339                 if (addr < 0)
 340                         return -EIO;
 341                 ret = do_set_thread_area(child, addr,
 342                                          (struct user_desc __user *) data, 0);
 343                 break;
 344 #endif
 345                 /* normal 64bit interface to access TLS data.
 346                    Works just like arch_prctl, except that the arguments
 347                    are reversed. */
 348         case PTRACE_ARCH_PRCTL:
 349                 ret = do_arch_prctl(child, data, addr);
 350                 break;
 351
 352         case PTRACE_GETREGS: { /* Get all gp regs from the child. */
 353                 if (!access_ok(VERIFY_WRITE, (unsigned __user *)data,
 354                                sizeof(struct user_regs_struct))) {
 355                         ret = -EIO;
 356                         break;
 357                 }
 358                 ret = 0;
 359                 for (ui = 0; ui < sizeof(struct user_regs_struct); ui += sizeof(long)) {
 360                         ret |= __put_user(getreg(child, ui),(unsigned long __user *) data);
 361                         data += sizeof(long);
 362                 }
 363                 break;
 364         }
 365
 366         case PTRACE_SETREGS: { /* Set all gp regs in the child. */
 367                 unsigned long tmp;
 368                 if (!access_ok(VERIFY_READ, (unsigned __user *)data,
 369                                sizeof(struct user_regs_struct))) {
 370                         ret = -EIO;
 371                         break;
 372                 }
 373                 ret = 0;
 374                 for (ui = 0; ui < sizeof(struct user_regs_struct); ui += sizeof(long)) {
 375                         ret = __get_user(tmp, (unsigned long __user *) data);
 376                         if (ret)
 377                                 break;
 378                         ret = putreg(child, ui, tmp);
 379                         if (ret)
 380                                 break;
 381                         data += sizeof(long);
 382                 }
 383                 break;
 384         }
 385
 386         case PTRACE_GETFPREGS: { /* Get the child extended FPU state. */
 387                 if (!access_ok(VERIFY_WRITE, (unsigned __user *)data,
 388                                sizeof(struct user_i387_struct))) {
 389                         ret = -EIO;
 390                         break;
 391                 }
 392                 ret = get_fpregs((struct user_i387_struct __user *)data, child);
 393                 break;
 394         }
 395
 396         case PTRACE_SETFPREGS: { /* Set the child extended FPU state. */
 397                 if (!access_ok(VERIFY_READ, (unsigned __user *)data,
 398                                sizeof(struct user_i387_struct))) {
 399                         ret = -EIO;
 400                         break;
 401                 }
 402                 set_stopped_child_used_math(child);
 403                 ret = set_fpregs(child, (struct user_i387_struct __user *)data);
 404                 break;
 405         }
 406
 407         default:
 408                 ret = ptrace_request(child, request, addr, data);
 409                 break;
 410         }
 411         return ret;
 412 }
 413
 414 static void syscall_trace(struct pt_regs *regs)
 415 {
 416
 417 #if 0
 418         printk("trace %s ip %lx sp %lx ax %d origrax %d caller %lx tiflags %x ptrace %x\n",
 419                current->comm,
 420                regs->ip, regs->sp, regs->ax, regs->orig_ax, __builtin_return_address(0),
 421                current_thread_info()->flags, current->ptrace);
 422 #endif
 423
 424         ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
 425                                 ? 0x80 : 0));
 426         /*
 427          * this isn't the same as continuing with a signal, but it will do
 428          * for normal use.  strace only continues with a signal if the
 429          * stopping signal is not SIGTRAP.  -brl
 430          */
 431         if (current->exit_code) {
 432                 send_sig(current->exit_code, current, 1);
 433                 current->exit_code = 0;
 434         }
 435 }
 436
 437 asmlinkage void syscall_trace_enter(struct pt_regs *regs)
 438 {
 439         /* do the secure computing check first */
 440         secure_computing(regs->orig_ax);
 441
 442         if (test_thread_flag(TIF_SYSCALL_TRACE)
 443             && (current->ptrace & PT_PTRACED))
 444                 syscall_trace(regs);
 445
 446         if (unlikely(current->audit_context)) {
 447                 if (test_thread_flag(TIF_IA32)) {
 448                         audit_syscall_entry(AUDIT_ARCH_I386,
 449                                             regs->orig_ax,
 450                                             regs->bx, regs->cx,
 451                                             regs->dx, regs->si);
 452                 } else {
 453                         audit_syscall_entry(AUDIT_ARCH_X86_64,
 454                                             regs->orig_ax,
 455                                             regs->di, regs->si,
 456                                             regs->dx, regs->r10);
 457                 }
 458         }
 459 }
 460
 461 asmlinkage void syscall_trace_leave(struct pt_regs *regs)
 462 {
 463         if (unlikely(current->audit_context))
 464                 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
 465
 466         if ((test_thread_flag(TIF_SYSCALL_TRACE)
 467              || test_thread_flag(TIF_SINGLESTEP))
 468             && (current->ptrace & PT_PTRACED))
 469                 syscall_trace(regs);
 470 }