x86, ptrace: add buffer size checks
[linux-2.6/x86.git] / arch / x86 / kernel / ptrace.c
blobe19a91db9b351d3df8c3729390afb35e807040b5
1 /* By Ross Biro 1/23/92 */
2 /*
3 * Pentium III FXSR, SSE support
4 * Gareth Hughes <gareth@valinux.com>, May 2000
6 * BTS tracing
7 * Markus Metzger <markus.t.metzger@intel.com>, Dec 2007
8 */
10 #include <linux/kernel.h>
11 #include <linux/sched.h>
12 #include <linux/mm.h>
13 #include <linux/smp.h>
14 #include <linux/errno.h>
15 #include <linux/ptrace.h>
16 #include <linux/regset.h>
17 #include <linux/user.h>
18 #include <linux/elf.h>
19 #include <linux/security.h>
20 #include <linux/audit.h>
21 #include <linux/seccomp.h>
22 #include <linux/signal.h>
24 #include <asm/uaccess.h>
25 #include <asm/pgtable.h>
26 #include <asm/system.h>
27 #include <asm/processor.h>
28 #include <asm/i387.h>
29 #include <asm/debugreg.h>
30 #include <asm/ldt.h>
31 #include <asm/desc.h>
32 #include <asm/prctl.h>
33 #include <asm/proto.h>
34 #include <asm/ds.h>
36 #include "tls.h"
38 enum x86_regset {
39 REGSET_GENERAL,
40 REGSET_FP,
41 REGSET_XFP,
42 REGSET_TLS,
46 * does not yet catch signals sent when the child dies.
47 * in exit.c or in signal.c.
51 * Determines which flags the user has access to [1 = access, 0 = no access].
53 #define FLAG_MASK_32 ((unsigned long) \
54 (X86_EFLAGS_CF | X86_EFLAGS_PF | \
55 X86_EFLAGS_AF | X86_EFLAGS_ZF | \
56 X86_EFLAGS_SF | X86_EFLAGS_TF | \
57 X86_EFLAGS_DF | X86_EFLAGS_OF | \
58 X86_EFLAGS_RF | X86_EFLAGS_AC))
61 * Determines whether a value may be installed in a segment register.
63 static inline bool invalid_selector(u16 value)
65 return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL);
68 #ifdef CONFIG_X86_32
70 #define FLAG_MASK FLAG_MASK_32
72 static long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
74 BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
75 regno >>= 2;
76 if (regno > FS)
77 --regno;
78 return &regs->bx + regno;
81 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
84 * Returning the value truncates it to 16 bits.
86 unsigned int retval;
87 if (offset != offsetof(struct user_regs_struct, gs))
88 retval = *pt_regs_access(task_pt_regs(task), offset);
89 else {
90 retval = task->thread.gs;
91 if (task == current)
92 savesegment(gs, retval);
94 return retval;
97 static int set_segment_reg(struct task_struct *task,
98 unsigned long offset, u16 value)
101 * The value argument was already truncated to 16 bits.
103 if (invalid_selector(value))
104 return -EIO;
106 if (offset != offsetof(struct user_regs_struct, gs))
107 *pt_regs_access(task_pt_regs(task), offset) = value;
108 else {
109 task->thread.gs = value;
110 if (task == current)
112 * The user-mode %gs is not affected by
113 * kernel entry, so we must update the CPU.
115 loadsegment(gs, value);
118 return 0;
121 static unsigned long debugreg_addr_limit(struct task_struct *task)
123 return TASK_SIZE - 3;
126 #else /* CONFIG_X86_64 */
128 #define FLAG_MASK (FLAG_MASK_32 | X86_EFLAGS_NT)
130 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
132 BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
133 return &regs->r15 + (offset / sizeof(regs->r15));
136 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
139 * Returning the value truncates it to 16 bits.
141 unsigned int seg;
143 switch (offset) {
144 case offsetof(struct user_regs_struct, fs):
145 if (task == current) {
146 /* Older gas can't assemble movq %?s,%r?? */
147 asm("movl %%fs,%0" : "=r" (seg));
148 return seg;
150 return task->thread.fsindex;
151 case offsetof(struct user_regs_struct, gs):
152 if (task == current) {
153 asm("movl %%gs,%0" : "=r" (seg));
154 return seg;
156 return task->thread.gsindex;
157 case offsetof(struct user_regs_struct, ds):
158 if (task == current) {
159 asm("movl %%ds,%0" : "=r" (seg));
160 return seg;
162 return task->thread.ds;
163 case offsetof(struct user_regs_struct, es):
164 if (task == current) {
165 asm("movl %%es,%0" : "=r" (seg));
166 return seg;
168 return task->thread.es;
170 case offsetof(struct user_regs_struct, cs):
171 case offsetof(struct user_regs_struct, ss):
172 break;
174 return *pt_regs_access(task_pt_regs(task), offset);
177 static int set_segment_reg(struct task_struct *task,
178 unsigned long offset, u16 value)
181 * The value argument was already truncated to 16 bits.
183 if (invalid_selector(value))
184 return -EIO;
186 switch (offset) {
187 case offsetof(struct user_regs_struct,fs):
189 * If this is setting fs as for normal 64-bit use but
190 * setting fs_base has implicitly changed it, leave it.
192 if ((value == FS_TLS_SEL && task->thread.fsindex == 0 &&
193 task->thread.fs != 0) ||
194 (value == 0 && task->thread.fsindex == FS_TLS_SEL &&
195 task->thread.fs == 0))
196 break;
197 task->thread.fsindex = value;
198 if (task == current)
199 loadsegment(fs, task->thread.fsindex);
200 break;
201 case offsetof(struct user_regs_struct,gs):
203 * If this is setting gs as for normal 64-bit use but
204 * setting gs_base has implicitly changed it, leave it.
206 if ((value == GS_TLS_SEL && task->thread.gsindex == 0 &&
207 task->thread.gs != 0) ||
208 (value == 0 && task->thread.gsindex == GS_TLS_SEL &&
209 task->thread.gs == 0))
210 break;
211 task->thread.gsindex = value;
212 if (task == current)
213 load_gs_index(task->thread.gsindex);
214 break;
215 case offsetof(struct user_regs_struct,ds):
216 task->thread.ds = value;
217 if (task == current)
218 loadsegment(ds, task->thread.ds);
219 break;
220 case offsetof(struct user_regs_struct,es):
221 task->thread.es = value;
222 if (task == current)
223 loadsegment(es, task->thread.es);
224 break;
227 * Can't actually change these in 64-bit mode.
229 case offsetof(struct user_regs_struct,cs):
230 #ifdef CONFIG_IA32_EMULATION
231 if (test_tsk_thread_flag(task, TIF_IA32))
232 task_pt_regs(task)->cs = value;
233 #endif
234 break;
235 case offsetof(struct user_regs_struct,ss):
236 #ifdef CONFIG_IA32_EMULATION
237 if (test_tsk_thread_flag(task, TIF_IA32))
238 task_pt_regs(task)->ss = value;
239 #endif
240 break;
243 return 0;
246 static unsigned long debugreg_addr_limit(struct task_struct *task)
248 #ifdef CONFIG_IA32_EMULATION
249 if (test_tsk_thread_flag(task, TIF_IA32))
250 return IA32_PAGE_OFFSET - 3;
251 #endif
252 return TASK_SIZE64 - 7;
255 #endif /* CONFIG_X86_32 */
257 static unsigned long get_flags(struct task_struct *task)
259 unsigned long retval = task_pt_regs(task)->flags;
262 * If the debugger set TF, hide it from the readout.
264 if (test_tsk_thread_flag(task, TIF_FORCED_TF))
265 retval &= ~X86_EFLAGS_TF;
267 return retval;
270 static int set_flags(struct task_struct *task, unsigned long value)
272 struct pt_regs *regs = task_pt_regs(task);
275 * If the user value contains TF, mark that
276 * it was not "us" (the debugger) that set it.
277 * If not, make sure it stays set if we had.
279 if (value & X86_EFLAGS_TF)
280 clear_tsk_thread_flag(task, TIF_FORCED_TF);
281 else if (test_tsk_thread_flag(task, TIF_FORCED_TF))
282 value |= X86_EFLAGS_TF;
284 regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK);
286 return 0;
289 static int putreg(struct task_struct *child,
290 unsigned long offset, unsigned long value)
292 switch (offset) {
293 case offsetof(struct user_regs_struct, cs):
294 case offsetof(struct user_regs_struct, ds):
295 case offsetof(struct user_regs_struct, es):
296 case offsetof(struct user_regs_struct, fs):
297 case offsetof(struct user_regs_struct, gs):
298 case offsetof(struct user_regs_struct, ss):
299 return set_segment_reg(child, offset, value);
301 case offsetof(struct user_regs_struct, flags):
302 return set_flags(child, value);
304 #ifdef CONFIG_X86_64
305 case offsetof(struct user_regs_struct,fs_base):
306 if (value >= TASK_SIZE_OF(child))
307 return -EIO;
309 * When changing the segment base, use do_arch_prctl
310 * to set either thread.fs or thread.fsindex and the
311 * corresponding GDT slot.
313 if (child->thread.fs != value)
314 return do_arch_prctl(child, ARCH_SET_FS, value);
315 return 0;
316 case offsetof(struct user_regs_struct,gs_base):
318 * Exactly the same here as the %fs handling above.
320 if (value >= TASK_SIZE_OF(child))
321 return -EIO;
322 if (child->thread.gs != value)
323 return do_arch_prctl(child, ARCH_SET_GS, value);
324 return 0;
325 #endif
328 *pt_regs_access(task_pt_regs(child), offset) = value;
329 return 0;
332 static unsigned long getreg(struct task_struct *task, unsigned long offset)
334 switch (offset) {
335 case offsetof(struct user_regs_struct, cs):
336 case offsetof(struct user_regs_struct, ds):
337 case offsetof(struct user_regs_struct, es):
338 case offsetof(struct user_regs_struct, fs):
339 case offsetof(struct user_regs_struct, gs):
340 case offsetof(struct user_regs_struct, ss):
341 return get_segment_reg(task, offset);
343 case offsetof(struct user_regs_struct, flags):
344 return get_flags(task);
346 #ifdef CONFIG_X86_64
347 case offsetof(struct user_regs_struct, fs_base): {
349 * do_arch_prctl may have used a GDT slot instead of
350 * the MSR. To userland, it appears the same either
351 * way, except the %fs segment selector might not be 0.
353 unsigned int seg = task->thread.fsindex;
354 if (task->thread.fs != 0)
355 return task->thread.fs;
356 if (task == current)
357 asm("movl %%fs,%0" : "=r" (seg));
358 if (seg != FS_TLS_SEL)
359 return 0;
360 return get_desc_base(&task->thread.tls_array[FS_TLS]);
362 case offsetof(struct user_regs_struct, gs_base): {
364 * Exactly the same here as the %fs handling above.
366 unsigned int seg = task->thread.gsindex;
367 if (task->thread.gs != 0)
368 return task->thread.gs;
369 if (task == current)
370 asm("movl %%gs,%0" : "=r" (seg));
371 if (seg != GS_TLS_SEL)
372 return 0;
373 return get_desc_base(&task->thread.tls_array[GS_TLS]);
375 #endif
378 return *pt_regs_access(task_pt_regs(task), offset);
381 static int genregs_get(struct task_struct *target,
382 const struct user_regset *regset,
383 unsigned int pos, unsigned int count,
384 void *kbuf, void __user *ubuf)
386 if (kbuf) {
387 unsigned long *k = kbuf;
388 while (count > 0) {
389 *k++ = getreg(target, pos);
390 count -= sizeof(*k);
391 pos += sizeof(*k);
393 } else {
394 unsigned long __user *u = ubuf;
395 while (count > 0) {
396 if (__put_user(getreg(target, pos), u++))
397 return -EFAULT;
398 count -= sizeof(*u);
399 pos += sizeof(*u);
403 return 0;
406 static int genregs_set(struct task_struct *target,
407 const struct user_regset *regset,
408 unsigned int pos, unsigned int count,
409 const void *kbuf, const void __user *ubuf)
411 int ret = 0;
412 if (kbuf) {
413 const unsigned long *k = kbuf;
414 while (count > 0 && !ret) {
415 ret = putreg(target, pos, *k++);
416 count -= sizeof(*k);
417 pos += sizeof(*k);
419 } else {
420 const unsigned long __user *u = ubuf;
421 while (count > 0 && !ret) {
422 unsigned long word;
423 ret = __get_user(word, u++);
424 if (ret)
425 break;
426 ret = putreg(target, pos, word);
427 count -= sizeof(*u);
428 pos += sizeof(*u);
431 return ret;
435 * This function is trivial and will be inlined by the compiler.
436 * Having it separates the implementation details of debug
437 * registers from the interface details of ptrace.
439 static unsigned long ptrace_get_debugreg(struct task_struct *child, int n)
441 switch (n) {
442 case 0: return child->thread.debugreg0;
443 case 1: return child->thread.debugreg1;
444 case 2: return child->thread.debugreg2;
445 case 3: return child->thread.debugreg3;
446 case 6: return child->thread.debugreg6;
447 case 7: return child->thread.debugreg7;
449 return 0;
452 static int ptrace_set_debugreg(struct task_struct *child,
453 int n, unsigned long data)
455 int i;
457 if (unlikely(n == 4 || n == 5))
458 return -EIO;
460 if (n < 4 && unlikely(data >= debugreg_addr_limit(child)))
461 return -EIO;
463 switch (n) {
464 case 0: child->thread.debugreg0 = data; break;
465 case 1: child->thread.debugreg1 = data; break;
466 case 2: child->thread.debugreg2 = data; break;
467 case 3: child->thread.debugreg3 = data; break;
469 case 6:
470 if ((data & ~0xffffffffUL) != 0)
471 return -EIO;
472 child->thread.debugreg6 = data;
473 break;
475 case 7:
477 * Sanity-check data. Take one half-byte at once with
478 * check = (val >> (16 + 4*i)) & 0xf. It contains the
479 * R/Wi and LENi bits; bits 0 and 1 are R/Wi, and bits
480 * 2 and 3 are LENi. Given a list of invalid values,
481 * we do mask |= 1 << invalid_value, so that
482 * (mask >> check) & 1 is a correct test for invalid
483 * values.
485 * R/Wi contains the type of the breakpoint /
486 * watchpoint, LENi contains the length of the watched
487 * data in the watchpoint case.
489 * The invalid values are:
490 * - LENi == 0x10 (undefined), so mask |= 0x0f00. [32-bit]
491 * - R/Wi == 0x10 (break on I/O reads or writes), so
492 * mask |= 0x4444.
493 * - R/Wi == 0x00 && LENi != 0x00, so we have mask |=
494 * 0x1110.
496 * Finally, mask = 0x0f00 | 0x4444 | 0x1110 == 0x5f54.
498 * See the Intel Manual "System Programming Guide",
499 * 15.2.4
501 * Note that LENi == 0x10 is defined on x86_64 in long
502 * mode (i.e. even for 32-bit userspace software, but
503 * 64-bit kernel), so the x86_64 mask value is 0x5454.
504 * See the AMD manual no. 24593 (AMD64 System Programming)
506 #ifdef CONFIG_X86_32
507 #define DR7_MASK 0x5f54
508 #else
509 #define DR7_MASK 0x5554
510 #endif
511 data &= ~DR_CONTROL_RESERVED;
512 for (i = 0; i < 4; i++)
513 if ((DR7_MASK >> ((data >> (16 + 4*i)) & 0xf)) & 1)
514 return -EIO;
515 child->thread.debugreg7 = data;
516 if (data)
517 set_tsk_thread_flag(child, TIF_DEBUG);
518 else
519 clear_tsk_thread_flag(child, TIF_DEBUG);
520 break;
523 return 0;
526 static int ptrace_bts_get_size(struct task_struct *child)
528 if (!child->thread.ds_area_msr)
529 return -ENXIO;
531 return ds_get_bts_index((void *)child->thread.ds_area_msr);
534 static int ptrace_bts_read_record(struct task_struct *child,
535 long index,
536 struct bts_struct __user *out)
538 struct bts_struct ret;
539 int retval;
540 int bts_end;
541 int bts_index;
543 if (!child->thread.ds_area_msr)
544 return -ENXIO;
546 if (index < 0)
547 return -EINVAL;
549 bts_end = ds_get_bts_end((void *)child->thread.ds_area_msr);
550 if (bts_end <= index)
551 return -EINVAL;
553 /* translate the ptrace bts index into the ds bts index */
554 bts_index = ds_get_bts_index((void *)child->thread.ds_area_msr);
555 bts_index -= (index + 1);
556 if (bts_index < 0)
557 bts_index += bts_end;
559 retval = ds_read_bts((void *)child->thread.ds_area_msr,
560 bts_index, &ret);
561 if (retval < 0)
562 return retval;
564 if (copy_to_user(out, &ret, sizeof(ret)))
565 return -EFAULT;
567 return sizeof(ret);
570 static int ptrace_bts_write_record(struct task_struct *child,
571 const struct bts_struct *in)
573 int retval;
575 if (!child->thread.ds_area_msr)
576 return -ENXIO;
578 retval = ds_write_bts((void *)child->thread.ds_area_msr, in);
579 if (retval)
580 return retval;
582 return sizeof(*in);
585 static int ptrace_bts_clear(struct task_struct *child)
587 if (!child->thread.ds_area_msr)
588 return -ENXIO;
590 return ds_clear((void *)child->thread.ds_area_msr);
593 static int ptrace_bts_drain(struct task_struct *child,
594 long size,
595 struct bts_struct __user *out)
597 int end, i;
598 void *ds = (void *)child->thread.ds_area_msr;
600 if (!ds)
601 return -ENXIO;
603 end = ds_get_bts_index(ds);
604 if (end <= 0)
605 return end;
607 if (size < (end * sizeof(struct bts_struct)))
608 return -EIO;
610 for (i = 0; i < end; i++, out++) {
611 struct bts_struct ret;
612 int retval;
614 retval = ds_read_bts(ds, i, &ret);
615 if (retval < 0)
616 return retval;
618 if (copy_to_user(out, &ret, sizeof(ret)))
619 return -EFAULT;
622 ds_clear(ds);
624 return end;
627 static int ptrace_bts_realloc(struct task_struct *child,
628 int size, int reduce_size)
630 unsigned long rlim, vm;
631 int ret, old_size;
633 if (size < 0)
634 return -EINVAL;
636 old_size = ds_get_bts_size((void *)child->thread.ds_area_msr);
637 if (old_size < 0)
638 return old_size;
640 ret = ds_free((void **)&child->thread.ds_area_msr);
641 if (ret < 0)
642 goto out;
644 size >>= PAGE_SHIFT;
645 old_size >>= PAGE_SHIFT;
647 current->mm->total_vm -= old_size;
648 current->mm->locked_vm -= old_size;
650 if (size == 0)
651 goto out;
653 rlim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
654 vm = current->mm->total_vm + size;
655 if (rlim < vm) {
656 ret = -ENOMEM;
658 if (!reduce_size)
659 goto out;
661 size = rlim - current->mm->total_vm;
662 if (size <= 0)
663 goto out;
666 rlim = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
667 vm = current->mm->locked_vm + size;
668 if (rlim < vm) {
669 ret = -ENOMEM;
671 if (!reduce_size)
672 goto out;
674 size = rlim - current->mm->locked_vm;
675 if (size <= 0)
676 goto out;
679 ret = ds_allocate((void **)&child->thread.ds_area_msr,
680 size << PAGE_SHIFT);
681 if (ret < 0)
682 goto out;
684 current->mm->total_vm += size;
685 current->mm->locked_vm += size;
687 out:
688 if (child->thread.ds_area_msr)
689 set_tsk_thread_flag(child, TIF_DS_AREA_MSR);
690 else
691 clear_tsk_thread_flag(child, TIF_DS_AREA_MSR);
693 return ret;
696 static int ptrace_bts_config(struct task_struct *child,
697 long cfg_size,
698 const struct ptrace_bts_config __user *ucfg)
700 struct ptrace_bts_config cfg;
701 int bts_size, ret = 0;
702 void *ds;
704 if (cfg_size < sizeof(cfg))
705 return -EIO;
707 if (copy_from_user(&cfg, ucfg, sizeof(cfg)))
708 return -EFAULT;
710 if ((int)cfg.size < 0)
711 return -EINVAL;
713 bts_size = 0;
714 ds = (void *)child->thread.ds_area_msr;
715 if (ds) {
716 bts_size = ds_get_bts_size(ds);
717 if (bts_size < 0)
718 return bts_size;
720 cfg.size = PAGE_ALIGN(cfg.size);
722 if (bts_size != cfg.size) {
723 ret = ptrace_bts_realloc(child, cfg.size,
724 cfg.flags & PTRACE_BTS_O_CUT_SIZE);
725 if (ret < 0)
726 goto errout;
728 ds = (void *)child->thread.ds_area_msr;
731 if (cfg.flags & PTRACE_BTS_O_SIGNAL)
732 ret = ds_set_overflow(ds, DS_O_SIGNAL);
733 else
734 ret = ds_set_overflow(ds, DS_O_WRAP);
735 if (ret < 0)
736 goto errout;
738 if (cfg.flags & PTRACE_BTS_O_TRACE)
739 child->thread.debugctlmsr |= ds_debugctl_mask();
740 else
741 child->thread.debugctlmsr &= ~ds_debugctl_mask();
743 if (cfg.flags & PTRACE_BTS_O_SCHED)
744 set_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
745 else
746 clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
748 ret = sizeof(cfg);
750 out:
751 if (child->thread.debugctlmsr)
752 set_tsk_thread_flag(child, TIF_DEBUGCTLMSR);
753 else
754 clear_tsk_thread_flag(child, TIF_DEBUGCTLMSR);
756 return ret;
758 errout:
759 child->thread.debugctlmsr &= ~ds_debugctl_mask();
760 clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
761 goto out;
764 static int ptrace_bts_status(struct task_struct *child,
765 long cfg_size,
766 struct ptrace_bts_config __user *ucfg)
768 void *ds = (void *)child->thread.ds_area_msr;
769 struct ptrace_bts_config cfg;
771 if (cfg_size < sizeof(cfg))
772 return -EIO;
774 memset(&cfg, 0, sizeof(cfg));
776 if (ds) {
777 cfg.size = ds_get_bts_size(ds);
779 if (ds_get_overflow(ds) == DS_O_SIGNAL)
780 cfg.flags |= PTRACE_BTS_O_SIGNAL;
782 if (test_tsk_thread_flag(child, TIF_DEBUGCTLMSR) &&
783 child->thread.debugctlmsr & ds_debugctl_mask())
784 cfg.flags |= PTRACE_BTS_O_TRACE;
786 if (test_tsk_thread_flag(child, TIF_BTS_TRACE_TS))
787 cfg.flags |= PTRACE_BTS_O_SCHED;
790 if (copy_to_user(ucfg, &cfg, sizeof(cfg)))
791 return -EFAULT;
793 return sizeof(cfg);
796 void ptrace_bts_take_timestamp(struct task_struct *tsk,
797 enum bts_qualifier qualifier)
799 struct bts_struct rec = {
800 .qualifier = qualifier,
801 .variant.jiffies = jiffies_64
804 ptrace_bts_write_record(tsk, &rec);
808 * Called by kernel/ptrace.c when detaching..
810 * Make sure the single step bit is not set.
812 void ptrace_disable(struct task_struct *child)
814 user_disable_single_step(child);
815 #ifdef TIF_SYSCALL_EMU
816 clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
817 #endif
818 if (child->thread.ds_area_msr) {
819 ptrace_bts_realloc(child, 0, 0);
820 child->thread.debugctlmsr &= ~ds_debugctl_mask();
821 if (!child->thread.debugctlmsr)
822 clear_tsk_thread_flag(child, TIF_DEBUGCTLMSR);
823 clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
827 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
828 static const struct user_regset_view user_x86_32_view; /* Initialized below. */
829 #endif
831 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
833 int ret;
834 unsigned long __user *datap = (unsigned long __user *)data;
836 switch (request) {
837 /* read the word at location addr in the USER area. */
838 case PTRACE_PEEKUSR: {
839 unsigned long tmp;
841 ret = -EIO;
842 if ((addr & (sizeof(data) - 1)) || addr < 0 ||
843 addr >= sizeof(struct user))
844 break;
846 tmp = 0; /* Default return condition */
847 if (addr < sizeof(struct user_regs_struct))
848 tmp = getreg(child, addr);
849 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
850 addr <= offsetof(struct user, u_debugreg[7])) {
851 addr -= offsetof(struct user, u_debugreg[0]);
852 tmp = ptrace_get_debugreg(child, addr / sizeof(data));
854 ret = put_user(tmp, datap);
855 break;
858 case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
859 ret = -EIO;
860 if ((addr & (sizeof(data) - 1)) || addr < 0 ||
861 addr >= sizeof(struct user))
862 break;
864 if (addr < sizeof(struct user_regs_struct))
865 ret = putreg(child, addr, data);
866 else if (addr >= offsetof(struct user, u_debugreg[0]) &&
867 addr <= offsetof(struct user, u_debugreg[7])) {
868 addr -= offsetof(struct user, u_debugreg[0]);
869 ret = ptrace_set_debugreg(child,
870 addr / sizeof(data), data);
872 break;
874 case PTRACE_GETREGS: /* Get all gp regs from the child. */
875 return copy_regset_to_user(child,
876 task_user_regset_view(current),
877 REGSET_GENERAL,
878 0, sizeof(struct user_regs_struct),
879 datap);
881 case PTRACE_SETREGS: /* Set all gp regs in the child. */
882 return copy_regset_from_user(child,
883 task_user_regset_view(current),
884 REGSET_GENERAL,
885 0, sizeof(struct user_regs_struct),
886 datap);
888 case PTRACE_GETFPREGS: /* Get the child FPU state. */
889 return copy_regset_to_user(child,
890 task_user_regset_view(current),
891 REGSET_FP,
892 0, sizeof(struct user_i387_struct),
893 datap);
895 case PTRACE_SETFPREGS: /* Set the child FPU state. */
896 return copy_regset_from_user(child,
897 task_user_regset_view(current),
898 REGSET_FP,
899 0, sizeof(struct user_i387_struct),
900 datap);
902 #ifdef CONFIG_X86_32
903 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
904 return copy_regset_to_user(child, &user_x86_32_view,
905 REGSET_XFP,
906 0, sizeof(struct user_fxsr_struct),
907 datap);
909 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
910 return copy_regset_from_user(child, &user_x86_32_view,
911 REGSET_XFP,
912 0, sizeof(struct user_fxsr_struct),
913 datap);
914 #endif
916 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
917 case PTRACE_GET_THREAD_AREA:
918 if (addr < 0)
919 return -EIO;
920 ret = do_get_thread_area(child, addr,
921 (struct user_desc __user *) data);
922 break;
924 case PTRACE_SET_THREAD_AREA:
925 if (addr < 0)
926 return -EIO;
927 ret = do_set_thread_area(child, addr,
928 (struct user_desc __user *) data, 0);
929 break;
930 #endif
932 #ifdef CONFIG_X86_64
933 /* normal 64bit interface to access TLS data.
934 Works just like arch_prctl, except that the arguments
935 are reversed. */
936 case PTRACE_ARCH_PRCTL:
937 ret = do_arch_prctl(child, data, addr);
938 break;
939 #endif
941 case PTRACE_BTS_CONFIG:
942 ret = ptrace_bts_config
943 (child, data, (struct ptrace_bts_config __user *)addr);
944 break;
946 case PTRACE_BTS_STATUS:
947 ret = ptrace_bts_status
948 (child, data, (struct ptrace_bts_config __user *)addr);
949 break;
951 case PTRACE_BTS_SIZE:
952 ret = ptrace_bts_get_size(child);
953 break;
955 case PTRACE_BTS_GET:
956 ret = ptrace_bts_read_record
957 (child, data, (struct bts_struct __user *) addr);
958 break;
960 case PTRACE_BTS_CLEAR:
961 ret = ptrace_bts_clear(child);
962 break;
964 case PTRACE_BTS_DRAIN:
965 ret = ptrace_bts_drain
966 (child, data, (struct bts_struct __user *) addr);
967 break;
969 default:
970 ret = ptrace_request(child, request, addr, data);
971 break;
974 return ret;
977 #ifdef CONFIG_IA32_EMULATION
979 #include <linux/compat.h>
980 #include <linux/syscalls.h>
981 #include <asm/ia32.h>
982 #include <asm/user32.h>
984 #define R32(l,q) \
985 case offsetof(struct user32, regs.l): \
986 regs->q = value; break
988 #define SEG32(rs) \
989 case offsetof(struct user32, regs.rs): \
990 return set_segment_reg(child, \
991 offsetof(struct user_regs_struct, rs), \
992 value); \
993 break
995 static int putreg32(struct task_struct *child, unsigned regno, u32 value)
997 struct pt_regs *regs = task_pt_regs(child);
999 switch (regno) {
1001 SEG32(cs);
1002 SEG32(ds);
1003 SEG32(es);
1004 SEG32(fs);
1005 SEG32(gs);
1006 SEG32(ss);
1008 R32(ebx, bx);
1009 R32(ecx, cx);
1010 R32(edx, dx);
1011 R32(edi, di);
1012 R32(esi, si);
1013 R32(ebp, bp);
1014 R32(eax, ax);
1015 R32(orig_eax, orig_ax);
1016 R32(eip, ip);
1017 R32(esp, sp);
1019 case offsetof(struct user32, regs.eflags):
1020 return set_flags(child, value);
1022 case offsetof(struct user32, u_debugreg[0]) ...
1023 offsetof(struct user32, u_debugreg[7]):
1024 regno -= offsetof(struct user32, u_debugreg[0]);
1025 return ptrace_set_debugreg(child, regno / 4, value);
1027 default:
1028 if (regno > sizeof(struct user32) || (regno & 3))
1029 return -EIO;
1032 * Other dummy fields in the virtual user structure
1033 * are ignored
1035 break;
1037 return 0;
1040 #undef R32
1041 #undef SEG32
1043 #define R32(l,q) \
1044 case offsetof(struct user32, regs.l): \
1045 *val = regs->q; break
1047 #define SEG32(rs) \
1048 case offsetof(struct user32, regs.rs): \
1049 *val = get_segment_reg(child, \
1050 offsetof(struct user_regs_struct, rs)); \
1051 break
1053 static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
1055 struct pt_regs *regs = task_pt_regs(child);
1057 switch (regno) {
1059 SEG32(ds);
1060 SEG32(es);
1061 SEG32(fs);
1062 SEG32(gs);
1064 R32(cs, cs);
1065 R32(ss, ss);
1066 R32(ebx, bx);
1067 R32(ecx, cx);
1068 R32(edx, dx);
1069 R32(edi, di);
1070 R32(esi, si);
1071 R32(ebp, bp);
1072 R32(eax, ax);
1073 R32(orig_eax, orig_ax);
1074 R32(eip, ip);
1075 R32(esp, sp);
1077 case offsetof(struct user32, regs.eflags):
1078 *val = get_flags(child);
1079 break;
1081 case offsetof(struct user32, u_debugreg[0]) ...
1082 offsetof(struct user32, u_debugreg[7]):
1083 regno -= offsetof(struct user32, u_debugreg[0]);
1084 *val = ptrace_get_debugreg(child, regno / 4);
1085 break;
1087 default:
1088 if (regno > sizeof(struct user32) || (regno & 3))
1089 return -EIO;
1092 * Other dummy fields in the virtual user structure
1093 * are ignored
1095 *val = 0;
1096 break;
1098 return 0;
1101 #undef R32
1102 #undef SEG32
1104 static int genregs32_get(struct task_struct *target,
1105 const struct user_regset *regset,
1106 unsigned int pos, unsigned int count,
1107 void *kbuf, void __user *ubuf)
1109 if (kbuf) {
1110 compat_ulong_t *k = kbuf;
1111 while (count > 0) {
1112 getreg32(target, pos, k++);
1113 count -= sizeof(*k);
1114 pos += sizeof(*k);
1116 } else {
1117 compat_ulong_t __user *u = ubuf;
1118 while (count > 0) {
1119 compat_ulong_t word;
1120 getreg32(target, pos, &word);
1121 if (__put_user(word, u++))
1122 return -EFAULT;
1123 count -= sizeof(*u);
1124 pos += sizeof(*u);
1128 return 0;
1131 static int genregs32_set(struct task_struct *target,
1132 const struct user_regset *regset,
1133 unsigned int pos, unsigned int count,
1134 const void *kbuf, const void __user *ubuf)
1136 int ret = 0;
1137 if (kbuf) {
1138 const compat_ulong_t *k = kbuf;
1139 while (count > 0 && !ret) {
1140 ret = putreg(target, pos, *k++);
1141 count -= sizeof(*k);
1142 pos += sizeof(*k);
1144 } else {
1145 const compat_ulong_t __user *u = ubuf;
1146 while (count > 0 && !ret) {
1147 compat_ulong_t word;
1148 ret = __get_user(word, u++);
1149 if (ret)
1150 break;
1151 ret = putreg(target, pos, word);
1152 count -= sizeof(*u);
1153 pos += sizeof(*u);
1156 return ret;
1159 static long ptrace32_siginfo(unsigned request, u32 pid, u32 addr, u32 data)
1161 siginfo_t __user *si = compat_alloc_user_space(sizeof(siginfo_t));
1162 compat_siginfo_t __user *si32 = compat_ptr(data);
1163 siginfo_t ssi;
1164 int ret;
1166 if (request == PTRACE_SETSIGINFO) {
1167 memset(&ssi, 0, sizeof(siginfo_t));
1168 ret = copy_siginfo_from_user32(&ssi, si32);
1169 if (ret)
1170 return ret;
1171 if (copy_to_user(si, &ssi, sizeof(siginfo_t)))
1172 return -EFAULT;
1174 ret = sys_ptrace(request, pid, addr, (unsigned long)si);
1175 if (ret)
1176 return ret;
1177 if (request == PTRACE_GETSIGINFO) {
1178 if (copy_from_user(&ssi, si, sizeof(siginfo_t)))
1179 return -EFAULT;
1180 ret = copy_siginfo_to_user32(si32, &ssi);
1182 return ret;
1185 asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
1187 struct task_struct *child;
1188 struct pt_regs *childregs;
1189 void __user *datap = compat_ptr(data);
1190 int ret;
1191 __u32 val;
1193 switch (request) {
1194 case PTRACE_TRACEME:
1195 case PTRACE_ATTACH:
1196 case PTRACE_KILL:
1197 case PTRACE_CONT:
1198 case PTRACE_SINGLESTEP:
1199 case PTRACE_SINGLEBLOCK:
1200 case PTRACE_DETACH:
1201 case PTRACE_SYSCALL:
1202 case PTRACE_OLDSETOPTIONS:
1203 case PTRACE_SETOPTIONS:
1204 case PTRACE_SET_THREAD_AREA:
1205 case PTRACE_GET_THREAD_AREA:
1206 case PTRACE_BTS_CONFIG:
1207 case PTRACE_BTS_STATUS:
1208 case PTRACE_BTS_SIZE:
1209 case PTRACE_BTS_GET:
1210 case PTRACE_BTS_CLEAR:
1211 case PTRACE_BTS_DRAIN:
1212 return sys_ptrace(request, pid, addr, data);
1214 default:
1215 return -EINVAL;
1217 case PTRACE_PEEKTEXT:
1218 case PTRACE_PEEKDATA:
1219 case PTRACE_POKEDATA:
1220 case PTRACE_POKETEXT:
1221 case PTRACE_POKEUSR:
1222 case PTRACE_PEEKUSR:
1223 case PTRACE_GETREGS:
1224 case PTRACE_SETREGS:
1225 case PTRACE_SETFPREGS:
1226 case PTRACE_GETFPREGS:
1227 case PTRACE_SETFPXREGS:
1228 case PTRACE_GETFPXREGS:
1229 case PTRACE_GETEVENTMSG:
1230 break;
1232 case PTRACE_SETSIGINFO:
1233 case PTRACE_GETSIGINFO:
1234 return ptrace32_siginfo(request, pid, addr, data);
1237 child = ptrace_get_task_struct(pid);
1238 if (IS_ERR(child))
1239 return PTR_ERR(child);
1241 ret = ptrace_check_attach(child, request == PTRACE_KILL);
1242 if (ret < 0)
1243 goto out;
1245 childregs = task_pt_regs(child);
1247 switch (request) {
1248 case PTRACE_PEEKUSR:
1249 ret = getreg32(child, addr, &val);
1250 if (ret == 0)
1251 ret = put_user(val, (__u32 __user *)datap);
1252 break;
1254 case PTRACE_POKEUSR:
1255 ret = putreg32(child, addr, data);
1256 break;
1258 case PTRACE_GETREGS: /* Get all gp regs from the child. */
1259 return copy_regset_to_user(child, &user_x86_32_view,
1260 REGSET_GENERAL,
1261 0, sizeof(struct user_regs_struct32),
1262 datap);
1264 case PTRACE_SETREGS: /* Set all gp regs in the child. */
1265 return copy_regset_from_user(child, &user_x86_32_view,
1266 REGSET_GENERAL, 0,
1267 sizeof(struct user_regs_struct32),
1268 datap);
1270 case PTRACE_GETFPREGS: /* Get the child FPU state. */
1271 return copy_regset_to_user(child, &user_x86_32_view,
1272 REGSET_FP, 0,
1273 sizeof(struct user_i387_ia32_struct),
1274 datap);
1276 case PTRACE_SETFPREGS: /* Set the child FPU state. */
1277 return copy_regset_from_user(
1278 child, &user_x86_32_view, REGSET_FP,
1279 0, sizeof(struct user_i387_ia32_struct), datap);
1281 case PTRACE_GETFPXREGS: /* Get the child extended FPU state. */
1282 return copy_regset_to_user(child, &user_x86_32_view,
1283 REGSET_XFP, 0,
1284 sizeof(struct user32_fxsr_struct),
1285 datap);
1287 case PTRACE_SETFPXREGS: /* Set the child extended FPU state. */
1288 return copy_regset_from_user(child, &user_x86_32_view,
1289 REGSET_XFP, 0,
1290 sizeof(struct user32_fxsr_struct),
1291 datap);
1293 default:
1294 return compat_ptrace_request(child, request, addr, data);
1297 out:
1298 put_task_struct(child);
1299 return ret;
1302 #endif /* CONFIG_IA32_EMULATION */
1304 #ifdef CONFIG_X86_64
1306 static const struct user_regset x86_64_regsets[] = {
1307 [REGSET_GENERAL] = {
1308 .core_note_type = NT_PRSTATUS,
1309 .n = sizeof(struct user_regs_struct) / sizeof(long),
1310 .size = sizeof(long), .align = sizeof(long),
1311 .get = genregs_get, .set = genregs_set
1313 [REGSET_FP] = {
1314 .core_note_type = NT_PRFPREG,
1315 .n = sizeof(struct user_i387_struct) / sizeof(long),
1316 .size = sizeof(long), .align = sizeof(long),
1317 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set
1321 static const struct user_regset_view user_x86_64_view = {
1322 .name = "x86_64", .e_machine = EM_X86_64,
1323 .regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets)
1326 #else /* CONFIG_X86_32 */
1328 #define user_regs_struct32 user_regs_struct
1329 #define genregs32_get genregs_get
1330 #define genregs32_set genregs_set
1332 #endif /* CONFIG_X86_64 */
1334 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1335 static const struct user_regset x86_32_regsets[] = {
1336 [REGSET_GENERAL] = {
1337 .core_note_type = NT_PRSTATUS,
1338 .n = sizeof(struct user_regs_struct32) / sizeof(u32),
1339 .size = sizeof(u32), .align = sizeof(u32),
1340 .get = genregs32_get, .set = genregs32_set
1342 [REGSET_FP] = {
1343 .core_note_type = NT_PRFPREG,
1344 .n = sizeof(struct user_i387_struct) / sizeof(u32),
1345 .size = sizeof(u32), .align = sizeof(u32),
1346 .active = fpregs_active, .get = fpregs_get, .set = fpregs_set
1348 [REGSET_XFP] = {
1349 .core_note_type = NT_PRXFPREG,
1350 .n = sizeof(struct user_i387_struct) / sizeof(u32),
1351 .size = sizeof(u32), .align = sizeof(u32),
1352 .active = xfpregs_active, .get = xfpregs_get, .set = xfpregs_set
1354 [REGSET_TLS] = {
1355 .core_note_type = NT_386_TLS,
1356 .n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN,
1357 .size = sizeof(struct user_desc),
1358 .align = sizeof(struct user_desc),
1359 .active = regset_tls_active,
1360 .get = regset_tls_get, .set = regset_tls_set
1364 static const struct user_regset_view user_x86_32_view = {
1365 .name = "i386", .e_machine = EM_386,
1366 .regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets)
1368 #endif
1370 const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1372 #ifdef CONFIG_IA32_EMULATION
1373 if (test_tsk_thread_flag(task, TIF_IA32))
1374 #endif
1375 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1376 return &user_x86_32_view;
1377 #endif
1378 #ifdef CONFIG_X86_64
1379 return &user_x86_64_view;
1380 #endif
1383 #ifdef CONFIG_X86_32
1385 void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
1387 struct siginfo info;
1389 tsk->thread.trap_no = 1;
1390 tsk->thread.error_code = error_code;
1392 memset(&info, 0, sizeof(info));
1393 info.si_signo = SIGTRAP;
1394 info.si_code = TRAP_BRKPT;
1396 /* User-mode ip? */
1397 info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
1399 /* Send us the fake SIGTRAP */
1400 force_sig_info(SIGTRAP, &info, tsk);
1403 /* notification of system call entry/exit
1404 * - triggered by current->work.syscall_trace
1406 __attribute__((regparm(3)))
1407 int do_syscall_trace(struct pt_regs *regs, int entryexit)
1409 int is_sysemu = test_thread_flag(TIF_SYSCALL_EMU);
1411 * With TIF_SYSCALL_EMU set we want to ignore TIF_SINGLESTEP for syscall
1412 * interception
1414 int is_singlestep = !is_sysemu && test_thread_flag(TIF_SINGLESTEP);
1415 int ret = 0;
1417 /* do the secure computing check first */
1418 if (!entryexit)
1419 secure_computing(regs->orig_ax);
1421 if (unlikely(current->audit_context)) {
1422 if (entryexit)
1423 audit_syscall_exit(AUDITSC_RESULT(regs->ax),
1424 regs->ax);
1425 /* Debug traps, when using PTRACE_SINGLESTEP, must be sent only
1426 * on the syscall exit path. Normally, when TIF_SYSCALL_AUDIT is
1427 * not used, entry.S will call us only on syscall exit, not
1428 * entry; so when TIF_SYSCALL_AUDIT is used we must avoid
1429 * calling send_sigtrap() on syscall entry.
1431 * Note that when PTRACE_SYSEMU_SINGLESTEP is used,
1432 * is_singlestep is false, despite his name, so we will still do
1433 * the correct thing.
1435 else if (is_singlestep)
1436 goto out;
1439 if (!(current->ptrace & PT_PTRACED))
1440 goto out;
1442 /* If a process stops on the 1st tracepoint with SYSCALL_TRACE
1443 * and then is resumed with SYSEMU_SINGLESTEP, it will come in
1444 * here. We have to check this and return */
1445 if (is_sysemu && entryexit)
1446 return 0;
1448 /* Fake a debug trap */
1449 if (is_singlestep)
1450 send_sigtrap(current, regs, 0);
1452 if (!test_thread_flag(TIF_SYSCALL_TRACE) && !is_sysemu)
1453 goto out;
1455 /* the 0x80 provides a way for the tracing parent to distinguish
1456 between a syscall stop and SIGTRAP delivery */
1457 /* Note that the debugger could change the result of test_thread_flag!*/
1458 ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) ? 0x80:0));
1461 * this isn't the same as continuing with a signal, but it will do
1462 * for normal use. strace only continues with a signal if the
1463 * stopping signal is not SIGTRAP. -brl
1465 if (current->exit_code) {
1466 send_sig(current->exit_code, current, 1);
1467 current->exit_code = 0;
1469 ret = is_sysemu;
1470 out:
1471 if (unlikely(current->audit_context) && !entryexit)
1472 audit_syscall_entry(AUDIT_ARCH_I386, regs->orig_ax,
1473 regs->bx, regs->cx, regs->dx, regs->si);
1474 if (ret == 0)
1475 return 0;
1477 regs->orig_ax = -1; /* force skip of syscall restarting */
1478 if (unlikely(current->audit_context))
1479 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
1480 return 1;
1483 #else /* CONFIG_X86_64 */
1485 static void syscall_trace(struct pt_regs *regs)
1488 #if 0
1489 printk("trace %s ip %lx sp %lx ax %d origrax %d caller %lx tiflags %x ptrace %x\n",
1490 current->comm,
1491 regs->ip, regs->sp, regs->ax, regs->orig_ax, __builtin_return_address(0),
1492 current_thread_info()->flags, current->ptrace);
1493 #endif
1495 ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
1496 ? 0x80 : 0));
1498 * this isn't the same as continuing with a signal, but it will do
1499 * for normal use. strace only continues with a signal if the
1500 * stopping signal is not SIGTRAP. -brl
1502 if (current->exit_code) {
1503 send_sig(current->exit_code, current, 1);
1504 current->exit_code = 0;
1508 asmlinkage void syscall_trace_enter(struct pt_regs *regs)
1510 /* do the secure computing check first */
1511 secure_computing(regs->orig_ax);
1513 if (test_thread_flag(TIF_SYSCALL_TRACE)
1514 && (current->ptrace & PT_PTRACED))
1515 syscall_trace(regs);
1517 if (unlikely(current->audit_context)) {
1518 if (test_thread_flag(TIF_IA32)) {
1519 audit_syscall_entry(AUDIT_ARCH_I386,
1520 regs->orig_ax,
1521 regs->bx, regs->cx,
1522 regs->dx, regs->si);
1523 } else {
1524 audit_syscall_entry(AUDIT_ARCH_X86_64,
1525 regs->orig_ax,
1526 regs->di, regs->si,
1527 regs->dx, regs->r10);
1532 asmlinkage void syscall_trace_leave(struct pt_regs *regs)
1534 if (unlikely(current->audit_context))
1535 audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
1537 if ((test_thread_flag(TIF_SYSCALL_TRACE)
1538 || test_thread_flag(TIF_SINGLESTEP))
1539 && (current->ptrace & PT_PTRACED))
1540 syscall_trace(regs);
1543 #endif /* CONFIG_X86_32 */