1// SPDX-License-Identifier: GPL-2.0-only
   2/* By Ross Biro 1/23/92 */
   3/*
   4 * Pentium III FXSR, SSE support
   5 *	Gareth Hughes <gareth@valinux.com>, May 2000
   6 */
   7
   8#include <linux/kernel.h>
   9#include <linux/sched.h>
  10#include <linux/sched/task_stack.h>
  11#include <linux/mm.h>
  12#include <linux/smp.h>
  13#include <linux/errno.h>
  14#include <linux/slab.h>
  15#include <linux/ptrace.h>
  16#include <linux/tracehook.h>
  17#include <linux/user.h>
  18#include <linux/elf.h>
  19#include <linux/security.h>
  20#include <linux/audit.h>
  21#include <linux/seccomp.h>
  22#include <linux/signal.h>
  23#include <linux/perf_event.h>
  24#include <linux/hw_breakpoint.h>
  25#include <linux/rcupdate.h>
  26#include <linux/export.h>
  27#include <linux/context_tracking.h>
  28#include <linux/nospec.h>
  29
  30#include <linux/uaccess.h>
  31#include <asm/processor.h>
  32#include <asm/fpu/internal.h>
  33#include <asm/fpu/signal.h>
  34#include <asm/fpu/regset.h>
  35#include <asm/debugreg.h>
  36#include <asm/ldt.h>
  37#include <asm/desc.h>
  38#include <asm/prctl.h>
  39#include <asm/proto.h>
  40#include <asm/hw_breakpoint.h>
  41#include <asm/traps.h>
  42#include <asm/syscall.h>
  43#include <asm/fsgsbase.h>
  44#include <asm/io_bitmap.h>
  45
  46#include "tls.h"
  47
  48enum x86_regset {
  49	REGSET_GENERAL,
  50	REGSET_FP,
  51	REGSET_XFP,
  52	REGSET_IOPERM64 = REGSET_XFP,
  53	REGSET_XSTATE,
  54	REGSET_TLS,
  55	REGSET_IOPERM32,
  56};
  57
  58struct pt_regs_offset {
  59	const char *name;
  60	int offset;
  61};
  62
  63#define REG_OFFSET_NAME(r) {.name = #r, .offset = offsetof(struct pt_regs, r)}
  64#define REG_OFFSET_END {.name = NULL, .offset = 0}
  65
  66static const struct pt_regs_offset regoffset_table[] = {
  67#ifdef CONFIG_X86_64
  68	REG_OFFSET_NAME(r15),
  69	REG_OFFSET_NAME(r14),
  70	REG_OFFSET_NAME(r13),
  71	REG_OFFSET_NAME(r12),
  72	REG_OFFSET_NAME(r11),
  73	REG_OFFSET_NAME(r10),
  74	REG_OFFSET_NAME(r9),
  75	REG_OFFSET_NAME(r8),
  76#endif
  77	REG_OFFSET_NAME(bx),
  78	REG_OFFSET_NAME(cx),
  79	REG_OFFSET_NAME(dx),
  80	REG_OFFSET_NAME(si),
  81	REG_OFFSET_NAME(di),
  82	REG_OFFSET_NAME(bp),
  83	REG_OFFSET_NAME(ax),
  84#ifdef CONFIG_X86_32
  85	REG_OFFSET_NAME(ds),
  86	REG_OFFSET_NAME(es),
  87	REG_OFFSET_NAME(fs),
  88	REG_OFFSET_NAME(gs),
  89#endif
  90	REG_OFFSET_NAME(orig_ax),
  91	REG_OFFSET_NAME(ip),
  92	REG_OFFSET_NAME(cs),
  93	REG_OFFSET_NAME(flags),
  94	REG_OFFSET_NAME(sp),
  95	REG_OFFSET_NAME(ss),
  96	REG_OFFSET_END,
  97};
  98
  99/**
 100 * regs_query_register_offset() - query register offset from its name
 101 * @name:	the name of a register
 102 *
 103 * regs_query_register_offset() returns the offset of a register in struct
 104 * pt_regs from its name. If the name is invalid, this returns -EINVAL;
 105 */
 106int regs_query_register_offset(const char *name)
 107{
 108	const struct pt_regs_offset *roff;
 109	for (roff = regoffset_table; roff->name != NULL; roff++)
 110		if (!strcmp(roff->name, name))
 111			return roff->offset;
 112	return -EINVAL;
 113}
 114
 115/**
 116 * regs_query_register_name() - query register name from its offset
 117 * @offset:	the offset of a register in struct pt_regs.
 118 *
 119 * regs_query_register_name() returns the name of a register from its
 120 * offset in struct pt_regs. If the @offset is invalid, this returns NULL;
 121 */
 122const char *regs_query_register_name(unsigned int offset)
 123{
 124	const struct pt_regs_offset *roff;
 125	for (roff = regoffset_table; roff->name != NULL; roff++)
 126		if (roff->offset == offset)
 127			return roff->name;
 128	return NULL;
 129}
 130
 131/*
 132 * does not yet catch signals sent when the child dies.
 133 * in exit.c or in signal.c.
 134 */
 135
 136/*
 137 * Determines which flags the user has access to [1 = access, 0 = no access].
 138 */
 139#define FLAG_MASK_32		((unsigned long)			\
 140				 (X86_EFLAGS_CF | X86_EFLAGS_PF |	\
 141				  X86_EFLAGS_AF | X86_EFLAGS_ZF |	\
 142				  X86_EFLAGS_SF | X86_EFLAGS_TF |	\
 143				  X86_EFLAGS_DF | X86_EFLAGS_OF |	\
 144				  X86_EFLAGS_RF | X86_EFLAGS_AC))
 145
 146/*
 147 * Determines whether a value may be installed in a segment register.
 148 */
 149static inline bool invalid_selector(u16 value)
 150{
 151	return unlikely(value != 0 && (value & SEGMENT_RPL_MASK) != USER_RPL);
 152}
 153
 154#ifdef CONFIG_X86_32
 155
 156#define FLAG_MASK		FLAG_MASK_32
 157
 158static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 159{
 160	BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
 161	return &regs->bx + (regno >> 2);
 162}
 163
 164static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 165{
 166	/*
 167	 * Returning the value truncates it to 16 bits.
 168	 */
 169	unsigned int retval;
 170	if (offset != offsetof(struct user_regs_struct, gs))
 171		retval = *pt_regs_access(task_pt_regs(task), offset);
 172	else {
 173		if (task == current)
 174			retval = get_user_gs(task_pt_regs(task));
 175		else
 176			retval = task_user_gs(task);
 177	}
 178	return retval;
 179}
 180
 181static int set_segment_reg(struct task_struct *task,
 182			   unsigned long offset, u16 value)
 183{
 184	if (WARN_ON_ONCE(task == current))
 185		return -EIO;
 186
 187	/*
 188	 * The value argument was already truncated to 16 bits.
 189	 */
 190	if (invalid_selector(value))
 191		return -EIO;
 192
 193	/*
 194	 * For %cs and %ss we cannot permit a null selector.
 195	 * We can permit a bogus selector as long as it has USER_RPL.
 196	 * Null selectors are fine for other segment registers, but
 197	 * we will never get back to user mode with invalid %cs or %ss
 198	 * and will take the trap in iret instead.  Much code relies
 199	 * on user_mode() to distinguish a user trap frame (which can
 200	 * safely use invalid selectors) from a kernel trap frame.
 201	 */
 202	switch (offset) {
 203	case offsetof(struct user_regs_struct, cs):
 204	case offsetof(struct user_regs_struct, ss):
 205		if (unlikely(value == 0))
 206			return -EIO;
 207		fallthrough;
 208
 209	default:
 210		*pt_regs_access(task_pt_regs(task), offset) = value;
 211		break;
 212
 213	case offsetof(struct user_regs_struct, gs):
 214		task_user_gs(task) = value;
 215	}
 216
 217	return 0;
 218}
 219
 220#else  /* CONFIG_X86_64 */
 221
 222#define FLAG_MASK		(FLAG_MASK_32 | X86_EFLAGS_NT)
 223
 224static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long offset)
 225{
 226	BUILD_BUG_ON(offsetof(struct pt_regs, r15) != 0);
 227	return &regs->r15 + (offset / sizeof(regs->r15));
 228}
 229
 230static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
 231{
 232	/*
 233	 * Returning the value truncates it to 16 bits.
 234	 */
 235	unsigned int seg;
 236
 237	switch (offset) {
 238	case offsetof(struct user_regs_struct, fs):
 239		if (task == current) {
 240			/* Older gas can't assemble movq %?s,%r?? */
 241			asm("movl %%fs,%0" : "=r" (seg));
 242			return seg;
 243		}
 244		return task->thread.fsindex;
 245	case offsetof(struct user_regs_struct, gs):
 246		if (task == current) {
 247			asm("movl %%gs,%0" : "=r" (seg));
 248			return seg;
 249		}
 250		return task->thread.gsindex;
 251	case offsetof(struct user_regs_struct, ds):
 252		if (task == current) {
 253			asm("movl %%ds,%0" : "=r" (seg));
 254			return seg;
 255		}
 256		return task->thread.ds;
 257	case offsetof(struct user_regs_struct, es):
 258		if (task == current) {
 259			asm("movl %%es,%0" : "=r" (seg));
 260			return seg;
 261		}
 262		return task->thread.es;
 263
 264	case offsetof(struct user_regs_struct, cs):
 265	case offsetof(struct user_regs_struct, ss):
 266		break;
 267	}
 268	return *pt_regs_access(task_pt_regs(task), offset);
 269}
 270
 271static int set_segment_reg(struct task_struct *task,
 272			   unsigned long offset, u16 value)
 273{
 274	if (WARN_ON_ONCE(task == current))
 275		return -EIO;
 276
 277	/*
 278	 * The value argument was already truncated to 16 bits.
 279	 */
 280	if (invalid_selector(value))
 281		return -EIO;
 282
 283	/*
 284	 * Writes to FS and GS will change the stored selector.  Whether
 285	 * this changes the segment base as well depends on whether
 286	 * FSGSBASE is enabled.
 287	 */
 288
 289	switch (offset) {
 290	case offsetof(struct user_regs_struct,fs):
 291		task->thread.fsindex = value;
 292		break;
 293	case offsetof(struct user_regs_struct,gs):
 294		task->thread.gsindex = value;
 295		break;
 296	case offsetof(struct user_regs_struct,ds):
 297		task->thread.ds = value;
 298		break;
 299	case offsetof(struct user_regs_struct,es):
 300		task->thread.es = value;
 301		break;
 302
 303		/*
 304		 * Can't actually change these in 64-bit mode.
 305		 */
 306	case offsetof(struct user_regs_struct,cs):
 307		if (unlikely(value == 0))
 308			return -EIO;
 309		task_pt_regs(task)->cs = value;
 310		break;
 311	case offsetof(struct user_regs_struct,ss):
 312		if (unlikely(value == 0))
 313			return -EIO;
 314		task_pt_regs(task)->ss = value;
 315		break;
 316	}
 317
 318	return 0;
 319}
 320
 321#endif	/* CONFIG_X86_32 */
 322
 323static unsigned long get_flags(struct task_struct *task)
 324{
 325	unsigned long retval = task_pt_regs(task)->flags;
 326
 327	/*
 328	 * If the debugger set TF, hide it from the readout.
 329	 */
 330	if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 331		retval &= ~X86_EFLAGS_TF;
 332
 333	return retval;
 334}
 335
 336static int set_flags(struct task_struct *task, unsigned long value)
 337{
 338	struct pt_regs *regs = task_pt_regs(task);
 339
 340	/*
 341	 * If the user value contains TF, mark that
 342	 * it was not "us" (the debugger) that set it.
 343	 * If not, make sure it stays set if we had.
 344	 */
 345	if (value & X86_EFLAGS_TF)
 346		clear_tsk_thread_flag(task, TIF_FORCED_TF);
 347	else if (test_tsk_thread_flag(task, TIF_FORCED_TF))
 348		value |= X86_EFLAGS_TF;
 349
 350	regs->flags = (regs->flags & ~FLAG_MASK) | (value & FLAG_MASK);
 351
 352	return 0;
 353}
 354
 355static int putreg(struct task_struct *child,
 356		  unsigned long offset, unsigned long value)
 357{
 358	switch (offset) {
 359	case offsetof(struct user_regs_struct, cs):
 360	case offsetof(struct user_regs_struct, ds):
 361	case offsetof(struct user_regs_struct, es):
 362	case offsetof(struct user_regs_struct, fs):
 363	case offsetof(struct user_regs_struct, gs):
 364	case offsetof(struct user_regs_struct, ss):
 365		return set_segment_reg(child, offset, value);
 366
 367	case offsetof(struct user_regs_struct, flags):
 368		return set_flags(child, value);
 369
 370#ifdef CONFIG_X86_64
 371	case offsetof(struct user_regs_struct,fs_base):
 372		if (value >= TASK_SIZE_MAX)
 373			return -EIO;
 374		x86_fsbase_write_task(child, value);
 375		return 0;
 376	case offsetof(struct user_regs_struct,gs_base):
 377		if (value >= TASK_SIZE_MAX)
 378			return -EIO;
 379		x86_gsbase_write_task(child, value);
 380		return 0;
 381#endif
 382	}
 383
 384	*pt_regs_access(task_pt_regs(child), offset) = value;
 385	return 0;
 386}
 387
 388static unsigned long getreg(struct task_struct *task, unsigned long offset)
 389{
 390	switch (offset) {
 391	case offsetof(struct user_regs_struct, cs):
 392	case offsetof(struct user_regs_struct, ds):
 393	case offsetof(struct user_regs_struct, es):
 394	case offsetof(struct user_regs_struct, fs):
 395	case offsetof(struct user_regs_struct, gs):
 396	case offsetof(struct user_regs_struct, ss):
 397		return get_segment_reg(task, offset);
 398
 399	case offsetof(struct user_regs_struct, flags):
 400		return get_flags(task);
 401
 402#ifdef CONFIG_X86_64
 403	case offsetof(struct user_regs_struct, fs_base):
 404		return x86_fsbase_read_task(task);
 405	case offsetof(struct user_regs_struct, gs_base):
 406		return x86_gsbase_read_task(task);
 407#endif
 408	}
 409
 410	return *pt_regs_access(task_pt_regs(task), offset);
 411}
 412
 413static int genregs_get(struct task_struct *target,
 414		       const struct user_regset *regset,
 415		       struct membuf to)
 416{
 417	int reg;
 418
 419	for (reg = 0; to.left; reg++)
 420		membuf_store(&to, getreg(target, reg * sizeof(unsigned long)));
 421	return 0;
 422}
 423
 424static int genregs_set(struct task_struct *target,
 425		       const struct user_regset *regset,
 426		       unsigned int pos, unsigned int count,
 427		       const void *kbuf, const void __user *ubuf)
 428{
 429	int ret = 0;
 430	if (kbuf) {
 431		const unsigned long *k = kbuf;
 432		while (count >= sizeof(*k) && !ret) {
 433			ret = putreg(target, pos, *k++);
 434			count -= sizeof(*k);
 435			pos += sizeof(*k);
 436		}
 437	} else {
 438		const unsigned long  __user *u = ubuf;
 439		while (count >= sizeof(*u) && !ret) {
 440			unsigned long word;
 441			ret = __get_user(word, u++);
 442			if (ret)
 443				break;
 444			ret = putreg(target, pos, word);
 445			count -= sizeof(*u);
 446			pos += sizeof(*u);
 447		}
 448	}
 449	return ret;
 450}
 451
 452static void ptrace_triggered(struct perf_event *bp,
 453			     struct perf_sample_data *data,
 454			     struct pt_regs *regs)
 455{
 456	int i;
 457	struct thread_struct *thread = &(current->thread);
 458
 459	/*
 460	 * Store in the virtual DR6 register the fact that the breakpoint
 461	 * was hit so the thread's debugger will see it.
 462	 */
 463	for (i = 0; i < HBP_NUM; i++) {
 464		if (thread->ptrace_bps[i] == bp)
 465			break;
 466	}
 467
 468	thread->virtual_dr6 |= (DR_TRAP0 << i);
 469}
 470
 471/*
 472 * Walk through every ptrace breakpoints for this thread and
 473 * build the dr7 value on top of their attributes.
 474 *
 475 */
 476static unsigned long ptrace_get_dr7(struct perf_event *bp[])
 477{
 478	int i;
 479	int dr7 = 0;
 480	struct arch_hw_breakpoint *info;
 481
 482	for (i = 0; i < HBP_NUM; i++) {
 483		if (bp[i] && !bp[i]->attr.disabled) {
 484			info = counter_arch_bp(bp[i]);
 485			dr7 |= encode_dr7(i, info->len, info->type);
 486		}
 487	}
 488
 489	return dr7;
 490}
 491
 492static int ptrace_fill_bp_fields(struct perf_event_attr *attr,
 493					int len, int type, bool disabled)
 494{
 495	int err, bp_len, bp_type;
 496
 497	err = arch_bp_generic_fields(len, type, &bp_len, &bp_type);
 498	if (!err) {
 499		attr->bp_len = bp_len;
 500		attr->bp_type = bp_type;
 501		attr->disabled = disabled;
 502	}
 503
 504	return err;
 505}
 506
 507static struct perf_event *
 508ptrace_register_breakpoint(struct task_struct *tsk, int len, int type,
 509				unsigned long addr, bool disabled)
 510{
 511	struct perf_event_attr attr;
 512	int err;
 513
 514	ptrace_breakpoint_init(&attr);
 515	attr.bp_addr = addr;
 516
 517	err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 518	if (err)
 519		return ERR_PTR(err);
 520
 521	return register_user_hw_breakpoint(&attr, ptrace_triggered,
 522						 NULL, tsk);
 523}
 524
 525static int ptrace_modify_breakpoint(struct perf_event *bp, int len, int type,
 526					int disabled)
 527{
 528	struct perf_event_attr attr = bp->attr;
 529	int err;
 530
 531	err = ptrace_fill_bp_fields(&attr, len, type, disabled);
 532	if (err)
 533		return err;
 534
 535	return modify_user_hw_breakpoint(bp, &attr);
 536}
 537
 538/*
 539 * Handle ptrace writes to debug register 7.
 540 */
 541static int ptrace_write_dr7(struct task_struct *tsk, unsigned long data)
 542{
 543	struct thread_struct *thread = &tsk->thread;
 544	unsigned long old_dr7;
 545	bool second_pass = false;
 546	int i, rc, ret = 0;
 547
 548	data &= ~DR_CONTROL_RESERVED;
 549	old_dr7 = ptrace_get_dr7(thread->ptrace_bps);
 550
 551restore:
 552	rc = 0;
 553	for (i = 0; i < HBP_NUM; i++) {
 554		unsigned len, type;
 555		bool disabled = !decode_dr7(data, i, &len, &type);
 556		struct perf_event *bp = thread->ptrace_bps[i];
 557
 558		if (!bp) {
 559			if (disabled)
 560				continue;
 561
 562			bp = ptrace_register_breakpoint(tsk,
 563					len, type, 0, disabled);
 564			if (IS_ERR(bp)) {
 565				rc = PTR_ERR(bp);
 566				break;
 567			}
 568
 569			thread->ptrace_bps[i] = bp;
 570			continue;
 571		}
 572
 573		rc = ptrace_modify_breakpoint(bp, len, type, disabled);
 574		if (rc)
 575			break;
 576	}
 577
 578	/* Restore if the first pass failed, second_pass shouldn't fail. */
 579	if (rc && !WARN_ON(second_pass)) {
 580		ret = rc;
 581		data = old_dr7;
 582		second_pass = true;
 583		goto restore;
 584	}
 585
 586	return ret;
 587}
 588
 589/*
 590 * Handle PTRACE_PEEKUSR calls for the debug register area.
 591 */
 592static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
 593{
 594	struct thread_struct *thread = &tsk->thread;
 595	unsigned long val = 0;
 596
 597	if (n < HBP_NUM) {
 598		int index = array_index_nospec(n, HBP_NUM);
 599		struct perf_event *bp = thread->ptrace_bps[index];
 600
 601		if (bp)
 602			val = bp->hw.info.address;
 603	} else if (n == 6) {
 604		val = thread->virtual_dr6 ^ DR6_RESERVED; /* Flip back to arch polarity */
 605	} else if (n == 7) {
 606		val = thread->ptrace_dr7;
 607	}
 608	return val;
 609}
 610
 611static int ptrace_set_breakpoint_addr(struct task_struct *tsk, int nr,
 612				      unsigned long addr)
 613{
 614	struct thread_struct *t = &tsk->thread;
 615	struct perf_event *bp = t->ptrace_bps[nr];
 616	int err = 0;
 617
 618	if (!bp) {
 619		/*
 620		 * Put stub len and type to create an inactive but correct bp.
 621		 *
 622		 * CHECKME: the previous code returned -EIO if the addr wasn't
 623		 * a valid task virtual addr. The new one will return -EINVAL in
 624		 *  this case.
 625		 * -EINVAL may be what we want for in-kernel breakpoints users,
 626		 * but -EIO looks better for ptrace, since we refuse a register
 627		 * writing for the user. And anyway this is the previous
 628		 * behaviour.
 629		 */
 630		bp = ptrace_register_breakpoint(tsk,
 631				X86_BREAKPOINT_LEN_1, X86_BREAKPOINT_WRITE,
 632				addr, true);
 633		if (IS_ERR(bp))
 634			err = PTR_ERR(bp);
 635		else
 636			t->ptrace_bps[nr] = bp;
 637	} else {
 638		struct perf_event_attr attr = bp->attr;
 639
 640		attr.bp_addr = addr;
 641		err = modify_user_hw_breakpoint(bp, &attr);
 642	}
 643
 644	return err;
 645}
 646
 647/*
 648 * Handle PTRACE_POKEUSR calls for the debug register area.
 649 */
 650static int ptrace_set_debugreg(struct task_struct *tsk, int n,
 651			       unsigned long val)
 652{
 653	struct thread_struct *thread = &tsk->thread;
 654	/* There are no DR4 or DR5 registers */
 655	int rc = -EIO;
 656
 657	if (n < HBP_NUM) {
 658		rc = ptrace_set_breakpoint_addr(tsk, n, val);
 659	} else if (n == 6) {
 660		thread->virtual_dr6 = val ^ DR6_RESERVED; /* Flip to positive polarity */
 661		rc = 0;
 662	} else if (n == 7) {
 663		rc = ptrace_write_dr7(tsk, val);
 664		if (!rc)
 665			thread->ptrace_dr7 = val;
 666	}
 667	return rc;
 668}
 669
 670/*
 671 * These access the current or another (stopped) task's io permission
 672 * bitmap for debugging or core dump.
 673 */
 674static int ioperm_active(struct task_struct *target,
 675			 const struct user_regset *regset)
 676{
 677	struct io_bitmap *iobm = target->thread.io_bitmap;
 678
 679	return iobm ? DIV_ROUND_UP(iobm->max, regset->size) : 0;
 680}
 681
 682static int ioperm_get(struct task_struct *target,
 683		      const struct user_regset *regset,
 684		      struct membuf to)
 685{
 686	struct io_bitmap *iobm = target->thread.io_bitmap;
 687
 688	if (!iobm)
 689		return -ENXIO;
 690
 691	return membuf_write(&to, iobm->bitmap, IO_BITMAP_BYTES);
 692}
 693
 694/*
 695 * Called by kernel/ptrace.c when detaching..
 696 *
 697 * Make sure the single step bit is not set.
 698 */
 699void ptrace_disable(struct task_struct *child)
 700{
 701	user_disable_single_step(child);
 702}
 703
 704#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 705static const struct user_regset_view user_x86_32_view; /* Initialized below. */
 706#endif
 707#ifdef CONFIG_X86_64
 708static const struct user_regset_view user_x86_64_view; /* Initialized below. */
 709#endif
 710
 711long arch_ptrace(struct task_struct *child, long request,
 712		 unsigned long addr, unsigned long data)
 713{
 714	int ret;
 715	unsigned long __user *datap = (unsigned long __user *)data;
 716
 717#ifdef CONFIG_X86_64
 718	/* This is native 64-bit ptrace() */
 719	const struct user_regset_view *regset_view = &user_x86_64_view;
 720#else
 721	/* This is native 32-bit ptrace() */
 722	const struct user_regset_view *regset_view = &user_x86_32_view;
 723#endif
 724
 725	switch (request) {
 726	/* read the word at location addr in the USER area. */
 727	case PTRACE_PEEKUSR: {
 728		unsigned long tmp;
 729
 730		ret = -EIO;
 731		if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 732			break;
 733
 734		tmp = 0;  /* Default return condition */
 735		if (addr < sizeof(struct user_regs_struct))
 736			tmp = getreg(child, addr);
 737		else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 738			 addr <= offsetof(struct user, u_debugreg[7])) {
 739			addr -= offsetof(struct user, u_debugreg[0]);
 740			tmp = ptrace_get_debugreg(child, addr / sizeof(data));
 741		}
 742		ret = put_user(tmp, datap);
 743		break;
 744	}
 745
 746	case PTRACE_POKEUSR: /* write the word at location addr in the USER area */
 747		ret = -EIO;
 748		if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user))
 749			break;
 750
 751		if (addr < sizeof(struct user_regs_struct))
 752			ret = putreg(child, addr, data);
 753		else if (addr >= offsetof(struct user, u_debugreg[0]) &&
 754			 addr <= offsetof(struct user, u_debugreg[7])) {
 755			addr -= offsetof(struct user, u_debugreg[0]);
 756			ret = ptrace_set_debugreg(child,
 757						  addr / sizeof(data), data);
 758		}
 759		break;
 760
 761	case PTRACE_GETREGS:	/* Get all gp regs from the child. */
 762		return copy_regset_to_user(child,
 763					   regset_view,
 764					   REGSET_GENERAL,
 765					   0, sizeof(struct user_regs_struct),
 766					   datap);
 767
 768	case PTRACE_SETREGS:	/* Set all gp regs in the child. */
 769		return copy_regset_from_user(child,
 770					     regset_view,
 771					     REGSET_GENERAL,
 772					     0, sizeof(struct user_regs_struct),
 773					     datap);
 774
 775	case PTRACE_GETFPREGS:	/* Get the child FPU state. */
 776		return copy_regset_to_user(child,
 777					   regset_view,
 778					   REGSET_FP,
 779					   0, sizeof(struct user_i387_struct),
 780					   datap);
 781
 782	case PTRACE_SETFPREGS:	/* Set the child FPU state. */
 783		return copy_regset_from_user(child,
 784					     regset_view,
 785					     REGSET_FP,
 786					     0, sizeof(struct user_i387_struct),
 787					     datap);
 788
 789#ifdef CONFIG_X86_32
 790	case PTRACE_GETFPXREGS:	/* Get the child extended FPU state. */
 791		return copy_regset_to_user(child, &user_x86_32_view,
 792					   REGSET_XFP,
 793					   0, sizeof(struct user_fxsr_struct),
 794					   datap) ? -EIO : 0;
 795
 796	case PTRACE_SETFPXREGS:	/* Set the child extended FPU state. */
 797		return copy_regset_from_user(child, &user_x86_32_view,
 798					     REGSET_XFP,
 799					     0, sizeof(struct user_fxsr_struct),
 800					     datap) ? -EIO : 0;
 801#endif
 802
 803#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
 804	case PTRACE_GET_THREAD_AREA:
 805		if ((int) addr < 0)
 806			return -EIO;
 807		ret = do_get_thread_area(child, addr,
 808					(struct user_desc __user *)data);
 809		break;
 810
 811	case PTRACE_SET_THREAD_AREA:
 812		if ((int) addr < 0)
 813			return -EIO;
 814		ret = do_set_thread_area(child, addr,
 815					(struct user_desc __user *)data, 0);
 816		break;
 817#endif
 818
 819#ifdef CONFIG_X86_64
 820		/* normal 64bit interface to access TLS data.
 821		   Works just like arch_prctl, except that the arguments
 822		   are reversed. */
 823	case PTRACE_ARCH_PRCTL:
 824		ret = do_arch_prctl_64(child, data, addr);
 825		break;
 826#endif
 827
 828	default:
 829		ret = ptrace_request(child, request, addr, data);
 830		break;
 831	}
 832
 833	return ret;
 834}
 835
 836#ifdef CONFIG_IA32_EMULATION
 837
 838#include <linux/compat.h>
 839#include <linux/syscalls.h>
 840#include <asm/ia32.h>
 841#include <asm/user32.h>
 842
 843#define R32(l,q)							\
 844	case offsetof(struct user32, regs.l):				\
 845		regs->q = value; break
 846
 847#define SEG32(rs)							\
 848	case offsetof(struct user32, regs.rs):				\
 849		return set_segment_reg(child,				\
 850				       offsetof(struct user_regs_struct, rs), \
 851				       value);				\
 852		break
 853
 854static int putreg32(struct task_struct *child, unsigned regno, u32 value)
 855{
 856	struct pt_regs *regs = task_pt_regs(child);
 857	int ret;
 858
 859	switch (regno) {
 860
 861	SEG32(cs);
 862	SEG32(ds);
 863	SEG32(es);
 864
 865	/*
 866	 * A 32-bit ptracer on a 64-bit kernel expects that writing
 867	 * FS or GS will also update the base.  This is needed for
 868	 * operations like PTRACE_SETREGS to fully restore a saved
 869	 * CPU state.
 870	 */
 871
 872	case offsetof(struct user32, regs.fs):
 873		ret = set_segment_reg(child,
 874				      offsetof(struct user_regs_struct, fs),
 875				      value);
 876		if (ret == 0)
 877			child->thread.fsbase =
 878				x86_fsgsbase_read_task(child, value);
 879		return ret;
 880
 881	case offsetof(struct user32, regs.gs):
 882		ret = set_segment_reg(child,
 883				      offsetof(struct user_regs_struct, gs),
 884				      value);
 885		if (ret == 0)
 886			child->thread.gsbase =
 887				x86_fsgsbase_read_task(child, value);
 888		return ret;
 889
 890	SEG32(ss);
 891
 892	R32(ebx, bx);
 893	R32(ecx, cx);
 894	R32(edx, dx);
 895	R32(edi, di);
 896	R32(esi, si);
 897	R32(ebp, bp);
 898	R32(eax, ax);
 899	R32(eip, ip);
 900	R32(esp, sp);
 901
 902	case offsetof(struct user32, regs.orig_eax):
 903		/*
 904		 * Warning: bizarre corner case fixup here.  A 32-bit
 905		 * debugger setting orig_eax to -1 wants to disable
 906		 * syscall restart.  Make sure that the syscall
 907		 * restart code sign-extends orig_ax.  Also make sure
 908		 * we interpret the -ERESTART* codes correctly if
 909		 * loaded into regs->ax in case the task is not
 910		 * actually still sitting at the exit from a 32-bit
 911		 * syscall with TS_COMPAT still set.
 912		 */
 913		regs->orig_ax = value;
 914		if (syscall_get_nr(child, regs) != -1)
 915			child->thread_info.status |= TS_I386_REGS_POKED;
 916		break;
 917
 918	case offsetof(struct user32, regs.eflags):
 919		return set_flags(child, value);
 920
 921	case offsetof(struct user32, u_debugreg[0]) ...
 922		offsetof(struct user32, u_debugreg[7]):
 923		regno -= offsetof(struct user32, u_debugreg[0]);
 924		return ptrace_set_debugreg(child, regno / 4, value);
 925
 926	default:
 927		if (regno > sizeof(struct user32) || (regno & 3))
 928			return -EIO;
 929
 930		/*
 931		 * Other dummy fields in the virtual user structure
 932		 * are ignored
 933		 */
 934		break;
 935	}
 936	return 0;
 937}
 938
 939#undef R32
 940#undef SEG32
 941
 942#define R32(l,q)							\
 943	case offsetof(struct user32, regs.l):				\
 944		*val = regs->q; break
 945
 946#define SEG32(rs)							\
 947	case offsetof(struct user32, regs.rs):				\
 948		*val = get_segment_reg(child,				\
 949				       offsetof(struct user_regs_struct, rs)); \
 950		break
 951
 952static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
 953{
 954	struct pt_regs *regs = task_pt_regs(child);
 955
 956	switch (regno) {
 957
 958	SEG32(ds);
 959	SEG32(es);
 960	SEG32(fs);
 961	SEG32(gs);
 962
 963	R32(cs, cs);
 964	R32(ss, ss);
 965	R32(ebx, bx);
 966	R32(ecx, cx);
 967	R32(edx, dx);
 968	R32(edi, di);
 969	R32(esi, si);
 970	R32(ebp, bp);
 971	R32(eax, ax);
 972	R32(orig_eax, orig_ax);
 973	R32(eip, ip);
 974	R32(esp, sp);
 975
 976	case offsetof(struct user32, regs.eflags):
 977		*val = get_flags(child);
 978		break;
 979
 980	case offsetof(struct user32, u_debugreg[0]) ...
 981		offsetof(struct user32, u_debugreg[7]):
 982		regno -= offsetof(struct user32, u_debugreg[0]);
 983		*val = ptrace_get_debugreg(child, regno / 4);
 984		break;
 985
 986	default:
 987		if (regno > sizeof(struct user32) || (regno & 3))
 988			return -EIO;
 989
 990		/*
 991		 * Other dummy fields in the virtual user structure
 992		 * are ignored
 993		 */
 994		*val = 0;
 995		break;
 996	}
 997	return 0;
 998}
 999
1000#undef R32
1001#undef SEG32
1002
1003static int genregs32_get(struct task_struct *target,
1004			 const struct user_regset *regset,
1005			 struct membuf to)
1006{
1007	int reg;
1008
1009	for (reg = 0; to.left; reg++) {
1010		u32 val;
1011		getreg32(target, reg * 4, &val);
1012		membuf_store(&to, val);
1013	}
1014	return 0;
1015}
1016
1017static int genregs32_set(struct task_struct *target,
1018			 const struct user_regset *regset,
1019			 unsigned int pos, unsigned int count,
1020			 const void *kbuf, const void __user *ubuf)
1021{
1022	int ret = 0;
1023	if (kbuf) {
1024		const compat_ulong_t *k = kbuf;
1025		while (count >= sizeof(*k) && !ret) {
1026			ret = putreg32(target, pos, *k++);
1027			count -= sizeof(*k);
1028			pos += sizeof(*k);
1029		}
1030	} else {
1031		const compat_ulong_t __user *u = ubuf;
1032		while (count >= sizeof(*u) && !ret) {
1033			compat_ulong_t word;
1034			ret = __get_user(word, u++);
1035			if (ret)
1036				break;
1037			ret = putreg32(target, pos, word);
1038			count -= sizeof(*u);
1039			pos += sizeof(*u);
1040		}
1041	}
1042	return ret;
1043}
1044
1045static long ia32_arch_ptrace(struct task_struct *child, compat_long_t request,
1046			     compat_ulong_t caddr, compat_ulong_t cdata)
1047{
1048	unsigned long addr = caddr;
1049	unsigned long data = cdata;
1050	void __user *datap = compat_ptr(data);
1051	int ret;
1052	__u32 val;
1053
1054	switch (request) {
1055	case PTRACE_PEEKUSR:
1056		ret = getreg32(child, addr, &val);
1057		if (ret == 0)
1058			ret = put_user(val, (__u32 __user *)datap);
1059		break;
1060
1061	case PTRACE_POKEUSR:
1062		ret = putreg32(child, addr, data);
1063		break;
1064
1065	case PTRACE_GETREGS:	/* Get all gp regs from the child. */
1066		return copy_regset_to_user(child, &user_x86_32_view,
1067					   REGSET_GENERAL,
1068					   0, sizeof(struct user_regs_struct32),
1069					   datap);
1070
1071	case PTRACE_SETREGS:	/* Set all gp regs in the child. */
1072		return copy_regset_from_user(child, &user_x86_32_view,
1073					     REGSET_GENERAL, 0,
1074					     sizeof(struct user_regs_struct32),
1075					     datap);
1076
1077	case PTRACE_GETFPREGS:	/* Get the child FPU state. */
1078		return copy_regset_to_user(child, &user_x86_32_view,
1079					   REGSET_FP, 0,
1080					   sizeof(struct user_i387_ia32_struct),
1081					   datap);
1082
1083	case PTRACE_SETFPREGS:	/* Set the child FPU state. */
1084		return copy_regset_from_user(
1085			child, &user_x86_32_view, REGSET_FP,
1086			0, sizeof(struct user_i387_ia32_struct), datap);
1087
1088	case PTRACE_GETFPXREGS:	/* Get the child extended FPU state. */
1089		return copy_regset_to_user(child, &user_x86_32_view,
1090					   REGSET_XFP, 0,
1091					   sizeof(struct user32_fxsr_struct),
1092					   datap);
1093
1094	case PTRACE_SETFPXREGS:	/* Set the child extended FPU state. */
1095		return copy_regset_from_user(child, &user_x86_32_view,
1096					     REGSET_XFP, 0,
1097					     sizeof(struct user32_fxsr_struct),
1098					     datap);
1099
1100	case PTRACE_GET_THREAD_AREA:
1101	case PTRACE_SET_THREAD_AREA:
1102		return arch_ptrace(child, request, addr, data);
1103
1104	default:
1105		return compat_ptrace_request(child, request, addr, data);
1106	}
1107
1108	return ret;
1109}
1110#endif /* CONFIG_IA32_EMULATION */
1111
1112#ifdef CONFIG_X86_X32_ABI
1113static long x32_arch_ptrace(struct task_struct *child,
1114			    compat_long_t request, compat_ulong_t caddr,
1115			    compat_ulong_t cdata)
1116{
1117	unsigned long addr = caddr;
1118	unsigned long data = cdata;
1119	void __user *datap = compat_ptr(data);
1120	int ret;
1121
1122	switch (request) {
1123	/* Read 32bits at location addr in the USER area.  Only allow
1124	   to return the lower 32bits of segment and debug registers.  */
1125	case PTRACE_PEEKUSR: {
1126		u32 tmp;
1127
1128		ret = -EIO;
1129		if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1130		    addr < offsetof(struct user_regs_struct, cs))
1131			break;
1132
1133		tmp = 0;  /* Default return condition */
1134		if (addr < sizeof(struct user_regs_struct))
1135			tmp = getreg(child, addr);
1136		else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1137			 addr <= offsetof(struct user, u_debugreg[7])) {
1138			addr -= offsetof(struct user, u_debugreg[0]);
1139			tmp = ptrace_get_debugreg(child, addr / sizeof(data));
1140		}
1141		ret = put_user(tmp, (__u32 __user *)datap);
1142		break;
1143	}
1144
1145	/* Write the word at location addr in the USER area.  Only allow
1146	   to update segment and debug registers with the upper 32bits
1147	   zero-extended. */
1148	case PTRACE_POKEUSR:
1149		ret = -EIO;
1150		if ((addr & (sizeof(data) - 1)) || addr >= sizeof(struct user) ||
1151		    addr < offsetof(struct user_regs_struct, cs))
1152			break;
1153
1154		if (addr < sizeof(struct user_regs_struct))
1155			ret = putreg(child, addr, data);
1156		else if (addr >= offsetof(struct user, u_debugreg[0]) &&
1157			 addr <= offsetof(struct user, u_debugreg[7])) {
1158			addr -= offsetof(struct user, u_debugreg[0]);
1159			ret = ptrace_set_debugreg(child,
1160						  addr / sizeof(data), data);
1161		}
1162		break;
1163
1164	case PTRACE_GETREGS:	/* Get all gp regs from the child. */
1165		return copy_regset_to_user(child,
1166					   &user_x86_64_view,
1167					   REGSET_GENERAL,
1168					   0, sizeof(struct user_regs_struct),
1169					   datap);
1170
1171	case PTRACE_SETREGS:	/* Set all gp regs in the child. */
1172		return copy_regset_from_user(child,
1173					     &user_x86_64_view,
1174					     REGSET_GENERAL,
1175					     0, sizeof(struct user_regs_struct),
1176					     datap);
1177
1178	case PTRACE_GETFPREGS:	/* Get the child FPU state. */
1179		return copy_regset_to_user(child,
1180					   &user_x86_64_view,
1181					   REGSET_FP,
1182					   0, sizeof(struct user_i387_struct),
1183					   datap);
1184
1185	case PTRACE_SETFPREGS:	/* Set the child FPU state. */
1186		return copy_regset_from_user(child,
1187					     &user_x86_64_view,
1188					     REGSET_FP,
1189					     0, sizeof(struct user_i387_struct),
1190					     datap);
1191
1192	default:
1193		return compat_ptrace_request(child, request, addr, data);
1194	}
1195
1196	return ret;
1197}
1198#endif
1199
1200#ifdef CONFIG_COMPAT
1201long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
1202			compat_ulong_t caddr, compat_ulong_t cdata)
1203{
1204#ifdef CONFIG_X86_X32_ABI
1205	if (!in_ia32_syscall())
1206		return x32_arch_ptrace(child, request, caddr, cdata);
1207#endif
1208#ifdef CONFIG_IA32_EMULATION
1209	return ia32_arch_ptrace(child, request, caddr, cdata);
1210#else
1211	return 0;
1212#endif
1213}
1214#endif	/* CONFIG_COMPAT */
1215
1216#ifdef CONFIG_X86_64
1217
1218static struct user_regset x86_64_regsets[] __ro_after_init = {
1219	[REGSET_GENERAL] = {
1220		.core_note_type = NT_PRSTATUS,
1221		.n = sizeof(struct user_regs_struct) / sizeof(long),
1222		.size = sizeof(long), .align = sizeof(long),
1223		.regset_get = genregs_get, .set = genregs_set
1224	},
1225	[REGSET_FP] = {
1226		.core_note_type = NT_PRFPREG,
1227		.n = sizeof(struct user_i387_struct) / sizeof(long),
1228		.size = sizeof(long), .align = sizeof(long),
1229		.active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
1230	},
1231	[REGSET_XSTATE] = {
1232		.core_note_type = NT_X86_XSTATE,
1233		.size = sizeof(u64), .align = sizeof(u64),
1234		.active = xstateregs_active, .regset_get = xstateregs_get,
1235		.set = xstateregs_set
1236	},
1237	[REGSET_IOPERM64] = {
1238		.core_note_type = NT_386_IOPERM,
1239		.n = IO_BITMAP_LONGS,
1240		.size = sizeof(long), .align = sizeof(long),
1241		.active = ioperm_active, .regset_get = ioperm_get
1242	},
1243};
1244
1245static const struct user_regset_view user_x86_64_view = {
1246	.name = "x86_64", .e_machine = EM_X86_64,
1247	.regsets = x86_64_regsets, .n = ARRAY_SIZE(x86_64_regsets)
1248};
1249
1250#else  /* CONFIG_X86_32 */
1251
1252#define user_regs_struct32	user_regs_struct
1253#define genregs32_get		genregs_get
1254#define genregs32_set		genregs_set
1255
1256#endif	/* CONFIG_X86_64 */
1257
1258#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1259static struct user_regset x86_32_regsets[] __ro_after_init = {
1260	[REGSET_GENERAL] = {
1261		.core_note_type = NT_PRSTATUS,
1262		.n = sizeof(struct user_regs_struct32) / sizeof(u32),
1263		.size = sizeof(u32), .align = sizeof(u32),
1264		.regset_get = genregs32_get, .set = genregs32_set
1265	},
1266	[REGSET_FP] = {
1267		.core_note_type = NT_PRFPREG,
1268		.n = sizeof(struct user_i387_ia32_struct) / sizeof(u32),
1269		.size = sizeof(u32), .align = sizeof(u32),
1270		.active = regset_fpregs_active, .regset_get = fpregs_get, .set = fpregs_set
1271	},
1272	[REGSET_XFP] = {
1273		.core_note_type = NT_PRXFPREG,
1274		.n = sizeof(struct user32_fxsr_struct) / sizeof(u32),
1275		.size = sizeof(u32), .align = sizeof(u32),
1276		.active = regset_xregset_fpregs_active, .regset_get = xfpregs_get, .set = xfpregs_set
1277	},
1278	[REGSET_XSTATE] = {
1279		.core_note_type = NT_X86_XSTATE,
1280		.size = sizeof(u64), .align = sizeof(u64),
1281		.active = xstateregs_active, .regset_get = xstateregs_get,
1282		.set = xstateregs_set
1283	},
1284	[REGSET_TLS] = {
1285		.core_note_type = NT_386_TLS,
1286		.n = GDT_ENTRY_TLS_ENTRIES, .bias = GDT_ENTRY_TLS_MIN,
1287		.size = sizeof(struct user_desc),
1288		.align = sizeof(struct user_desc),
1289		.active = regset_tls_active,
1290		.regset_get = regset_tls_get, .set = regset_tls_set
1291	},
1292	[REGSET_IOPERM32] = {
1293		.core_note_type = NT_386_IOPERM,
1294		.n = IO_BITMAP_BYTES / sizeof(u32),
1295		.size = sizeof(u32), .align = sizeof(u32),
1296		.active = ioperm_active, .regset_get = ioperm_get
1297	},
1298};
1299
1300static const struct user_regset_view user_x86_32_view = {
1301	.name = "i386", .e_machine = EM_386,
1302	.regsets = x86_32_regsets, .n = ARRAY_SIZE(x86_32_regsets)
1303};
1304#endif
1305
1306/*
1307 * This represents bytes 464..511 in the memory layout exported through
1308 * the REGSET_XSTATE interface.
1309 */
1310u64 xstate_fx_sw_bytes[USER_XSTATE_FX_SW_WORDS];
1311
1312void __init update_regset_xstate_info(unsigned int size, u64 xstate_mask)
1313{
1314#ifdef CONFIG_X86_64
1315	x86_64_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1316#endif
1317#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1318	x86_32_regsets[REGSET_XSTATE].n = size / sizeof(u64);
1319#endif
1320	xstate_fx_sw_bytes[USER_XSTATE_XCR0_WORD] = xstate_mask;
1321}
1322
1323/*
1324 * This is used by the core dump code to decide which regset to dump.  The
1325 * core dump code writes out the resulting .e_machine and the corresponding
1326 * regsets.  This is suboptimal if the task is messing around with its CS.L
1327 * field, but at worst the core dump will end up missing some information.
1328 *
1329 * Unfortunately, it is also used by the broken PTRACE_GETREGSET and
1330 * PTRACE_SETREGSET APIs.  These APIs look at the .regsets field but have
1331 * no way to make sure that the e_machine they use matches the caller's
1332 * expectations.  The result is that the data format returned by
1333 * PTRACE_GETREGSET depends on the returned CS field (and even the offset
1334 * of the returned CS field depends on its value!) and the data format
1335 * accepted by PTRACE_SETREGSET is determined by the old CS value.  The
1336 * upshot is that it is basically impossible to use these APIs correctly.
1337 *
1338 * The best way to fix it in the long run would probably be to add new
1339 * improved ptrace() APIs to read and write registers reliably, possibly by
1340 * allowing userspace to select the ELF e_machine variant that they expect.
1341 */
1342const struct user_regset_view *task_user_regset_view(struct task_struct *task)
1343{
1344#ifdef CONFIG_IA32_EMULATION
1345	if (!user_64bit_mode(task_pt_regs(task)))
1346#endif
1347#if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
1348		return &user_x86_32_view;
1349#endif
1350#ifdef CONFIG_X86_64
1351	return &user_x86_64_view;
1352#endif
1353}
1354
1355void send_sigtrap(struct pt_regs *regs, int error_code, int si_code)
1356{
1357	struct task_struct *tsk = current;
1358
1359	tsk->thread.trap_nr = X86_TRAP_DB;
1360	tsk->thread.error_code = error_code;
1361
1362	/* Send us the fake SIGTRAP */
1363	force_sig_fault(SIGTRAP, si_code,
1364			user_mode(regs) ? (void __user *)regs->ip : NULL);
1365}
1366
1367void user_single_step_report(struct pt_regs *regs)
1368{
1369	send_sigtrap(regs, 0, TRAP_BRKPT);
1370}