• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  *  PowerPC version
3  *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4  *
5  *  Derived from "arch/m68k/kernel/ptrace.c"
6  *  Copyright (C) 1994 by Hamish Macdonald
7  *  Taken from linux/kernel/ptrace.c and modified for M680x0.
8  *  linux/kernel/ptrace.c is by Ross Biro 1/23/92, edited by Linus Torvalds
9  *
10  * Modified by Cort Dougan (cort@hq.fsmlabs.com)
11  * and Paul Mackerras (paulus@samba.org).
12  *
13  * This file is subject to the terms and conditions of the GNU General
14  * Public License.  See the file README.legal in the main directory of
15  * this archive for more details.
16  */
17 
18 #include <linux/regset.h>
19 #include <linux/tracehook.h>
20 #include <linux/audit.h>
21 #include <linux/context_tracking.h>
22 #include <linux/syscalls.h>
23 
24 #include <asm/switch_to.h>
25 #include <asm/asm-prototypes.h>
26 #include <asm/debug.h>
27 
28 #define CREATE_TRACE_POINTS
29 #include <trace/events/syscalls.h>
30 
31 #include "ptrace-decl.h"
32 
33 /*
34  * Called by kernel/ptrace.c when detaching..
35  *
36  * Make sure single step bits etc are not set.
37  */
ptrace_disable(struct task_struct * child)38 void ptrace_disable(struct task_struct *child)
39 {
40 	/* make sure the single step bit is not set. */
41 	user_disable_single_step(child);
42 }
43 
arch_ptrace(struct task_struct * child,long request,unsigned long addr,unsigned long data)44 long arch_ptrace(struct task_struct *child, long request,
45 		 unsigned long addr, unsigned long data)
46 {
47 	int ret = -EPERM;
48 	void __user *datavp = (void __user *) data;
49 	unsigned long __user *datalp = datavp;
50 
51 	switch (request) {
52 	/* read the word at location addr in the USER area. */
53 	case PTRACE_PEEKUSR: {
54 		unsigned long index, tmp;
55 
56 		ret = -EIO;
57 		/* convert to index and check */
58 #ifdef CONFIG_PPC32
59 		index = addr >> 2;
60 		if ((addr & 3) || (index > PT_FPSCR)
61 		    || (child->thread.regs == NULL))
62 #else
63 		index = addr >> 3;
64 		if ((addr & 7) || (index > PT_FPSCR))
65 #endif
66 			break;
67 
68 		CHECK_FULL_REGS(child->thread.regs);
69 		if (index < PT_FPR0) {
70 			ret = ptrace_get_reg(child, (int) index, &tmp);
71 			if (ret)
72 				break;
73 		} else {
74 			unsigned int fpidx = index - PT_FPR0;
75 
76 			flush_fp_to_thread(child);
77 			if (fpidx < (PT_FPSCR - PT_FPR0))
78 				if (IS_ENABLED(CONFIG_PPC32)) {
79 					// On 32-bit the index we are passed refers to 32-bit words
80 					tmp = ((u32 *)child->thread.fp_state.fpr)[fpidx];
81 				} else {
82 					memcpy(&tmp, &child->thread.TS_FPR(fpidx),
83 					       sizeof(long));
84 				}
85 			else
86 				tmp = child->thread.fp_state.fpscr;
87 		}
88 		ret = put_user(tmp, datalp);
89 		break;
90 	}
91 
92 	/* write the word at location addr in the USER area */
93 	case PTRACE_POKEUSR: {
94 		unsigned long index;
95 
96 		ret = -EIO;
97 		/* convert to index and check */
98 #ifdef CONFIG_PPC32
99 		index = addr >> 2;
100 		if ((addr & 3) || (index > PT_FPSCR)
101 		    || (child->thread.regs == NULL))
102 #else
103 		index = addr >> 3;
104 		if ((addr & 7) || (index > PT_FPSCR))
105 #endif
106 			break;
107 
108 		CHECK_FULL_REGS(child->thread.regs);
109 		if (index < PT_FPR0) {
110 			ret = ptrace_put_reg(child, index, data);
111 		} else {
112 			unsigned int fpidx = index - PT_FPR0;
113 
114 			flush_fp_to_thread(child);
115 			if (fpidx < (PT_FPSCR - PT_FPR0))
116 				if (IS_ENABLED(CONFIG_PPC32)) {
117 					// On 32-bit the index we are passed refers to 32-bit words
118 					((u32 *)child->thread.fp_state.fpr)[fpidx] = data;
119 				} else {
120 					memcpy(&child->thread.TS_FPR(fpidx), &data,
121 					       sizeof(long));
122 				}
123 			else
124 				child->thread.fp_state.fpscr = data;
125 			ret = 0;
126 		}
127 		break;
128 	}
129 
130 	case PPC_PTRACE_GETHWDBGINFO: {
131 		struct ppc_debug_info dbginfo;
132 
133 		ppc_gethwdinfo(&dbginfo);
134 
135 		if (copy_to_user(datavp, &dbginfo,
136 				 sizeof(struct ppc_debug_info)))
137 			return -EFAULT;
138 		return 0;
139 	}
140 
141 	case PPC_PTRACE_SETHWDEBUG: {
142 		struct ppc_hw_breakpoint bp_info;
143 
144 		if (copy_from_user(&bp_info, datavp,
145 				   sizeof(struct ppc_hw_breakpoint)))
146 			return -EFAULT;
147 		return ppc_set_hwdebug(child, &bp_info);
148 	}
149 
150 	case PPC_PTRACE_DELHWDEBUG: {
151 		ret = ppc_del_hwdebug(child, data);
152 		break;
153 	}
154 
155 	case PTRACE_GET_DEBUGREG:
156 		ret = ptrace_get_debugreg(child, addr, datalp);
157 		break;
158 
159 	case PTRACE_SET_DEBUGREG:
160 		ret = ptrace_set_debugreg(child, addr, data);
161 		break;
162 
163 #ifdef CONFIG_PPC64
164 	case PTRACE_GETREGS64:
165 #endif
166 	case PTRACE_GETREGS:	/* Get all pt_regs from the child. */
167 		return copy_regset_to_user(child, &user_ppc_native_view,
168 					   REGSET_GPR,
169 					   0, sizeof(struct user_pt_regs),
170 					   datavp);
171 
172 #ifdef CONFIG_PPC64
173 	case PTRACE_SETREGS64:
174 #endif
175 	case PTRACE_SETREGS:	/* Set all gp regs in the child. */
176 		return copy_regset_from_user(child, &user_ppc_native_view,
177 					     REGSET_GPR,
178 					     0, sizeof(struct user_pt_regs),
179 					     datavp);
180 
181 	case PTRACE_GETFPREGS: /* Get the child FPU state (FPR0...31 + FPSCR) */
182 		return copy_regset_to_user(child, &user_ppc_native_view,
183 					   REGSET_FPR,
184 					   0, sizeof(elf_fpregset_t),
185 					   datavp);
186 
187 	case PTRACE_SETFPREGS: /* Set the child FPU state (FPR0...31 + FPSCR) */
188 		return copy_regset_from_user(child, &user_ppc_native_view,
189 					     REGSET_FPR,
190 					     0, sizeof(elf_fpregset_t),
191 					     datavp);
192 
193 #ifdef CONFIG_ALTIVEC
194 	case PTRACE_GETVRREGS:
195 		return copy_regset_to_user(child, &user_ppc_native_view,
196 					   REGSET_VMX,
197 					   0, (33 * sizeof(vector128) +
198 					       sizeof(u32)),
199 					   datavp);
200 
201 	case PTRACE_SETVRREGS:
202 		return copy_regset_from_user(child, &user_ppc_native_view,
203 					     REGSET_VMX,
204 					     0, (33 * sizeof(vector128) +
205 						 sizeof(u32)),
206 					     datavp);
207 #endif
208 #ifdef CONFIG_VSX
209 	case PTRACE_GETVSRREGS:
210 		return copy_regset_to_user(child, &user_ppc_native_view,
211 					   REGSET_VSX,
212 					   0, 32 * sizeof(double),
213 					   datavp);
214 
215 	case PTRACE_SETVSRREGS:
216 		return copy_regset_from_user(child, &user_ppc_native_view,
217 					     REGSET_VSX,
218 					     0, 32 * sizeof(double),
219 					     datavp);
220 #endif
221 #ifdef CONFIG_SPE
222 	case PTRACE_GETEVRREGS:
223 		/* Get the child spe register state. */
224 		return copy_regset_to_user(child, &user_ppc_native_view,
225 					   REGSET_SPE, 0, 35 * sizeof(u32),
226 					   datavp);
227 
228 	case PTRACE_SETEVRREGS:
229 		/* Set the child spe register state. */
230 		return copy_regset_from_user(child, &user_ppc_native_view,
231 					     REGSET_SPE, 0, 35 * sizeof(u32),
232 					     datavp);
233 #endif
234 
235 	default:
236 		ret = ptrace_request(child, request, addr, data);
237 		break;
238 	}
239 	return ret;
240 }
241 
242 #ifdef CONFIG_SECCOMP
do_seccomp(struct pt_regs * regs)243 static int do_seccomp(struct pt_regs *regs)
244 {
245 	if (!test_thread_flag(TIF_SECCOMP))
246 		return 0;
247 
248 	/*
249 	 * The ABI we present to seccomp tracers is that r3 contains
250 	 * the syscall return value and orig_gpr3 contains the first
251 	 * syscall parameter. This is different to the ptrace ABI where
252 	 * both r3 and orig_gpr3 contain the first syscall parameter.
253 	 */
254 	regs->gpr[3] = -ENOSYS;
255 
256 	/*
257 	 * We use the __ version here because we have already checked
258 	 * TIF_SECCOMP. If this fails, there is nothing left to do, we
259 	 * have already loaded -ENOSYS into r3, or seccomp has put
260 	 * something else in r3 (via SECCOMP_RET_ERRNO/TRACE).
261 	 */
262 	if (__secure_computing(NULL))
263 		return -1;
264 
265 	/*
266 	 * The syscall was allowed by seccomp, restore the register
267 	 * state to what audit expects.
268 	 * Note that we use orig_gpr3, which means a seccomp tracer can
269 	 * modify the first syscall parameter (in orig_gpr3) and also
270 	 * allow the syscall to proceed.
271 	 */
272 	regs->gpr[3] = regs->orig_gpr3;
273 
274 	return 0;
275 }
276 #else
do_seccomp(struct pt_regs * regs)277 static inline int do_seccomp(struct pt_regs *regs) { return 0; }
278 #endif /* CONFIG_SECCOMP */
279 
280 /**
281  * do_syscall_trace_enter() - Do syscall tracing on kernel entry.
282  * @regs: the pt_regs of the task to trace (current)
283  *
284  * Performs various types of tracing on syscall entry. This includes seccomp,
285  * ptrace, syscall tracepoints and audit.
286  *
287  * The pt_regs are potentially visible to userspace via ptrace, so their
288  * contents is ABI.
289  *
290  * One or more of the tracers may modify the contents of pt_regs, in particular
291  * to modify arguments or even the syscall number itself.
292  *
293  * It's also possible that a tracer can choose to reject the system call. In
294  * that case this function will return an illegal syscall number, and will put
295  * an appropriate return value in regs->r3.
296  *
297  * Return: the (possibly changed) syscall number.
298  */
do_syscall_trace_enter(struct pt_regs * regs)299 long do_syscall_trace_enter(struct pt_regs *regs)
300 {
301 	u32 flags;
302 
303 	user_exit();
304 
305 	flags = READ_ONCE(current_thread_info()->flags) &
306 		(_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE);
307 
308 	if (flags) {
309 		int rc = tracehook_report_syscall_entry(regs);
310 
311 		if (unlikely(flags & _TIF_SYSCALL_EMU)) {
312 			/*
313 			 * A nonzero return code from
314 			 * tracehook_report_syscall_entry() tells us to prevent
315 			 * the syscall execution, but we are not going to
316 			 * execute it anyway.
317 			 *
318 			 * Returning -1 will skip the syscall execution. We want
319 			 * to avoid clobbering any registers, so we don't goto
320 			 * the skip label below.
321 			 */
322 			return -1;
323 		}
324 
325 		if (rc) {
326 			/*
327 			 * The tracer decided to abort the syscall. Note that
328 			 * the tracer may also just change regs->gpr[0] to an
329 			 * invalid syscall number, that is handled below on the
330 			 * exit path.
331 			 */
332 			goto skip;
333 		}
334 	}
335 
336 	/* Run seccomp after ptrace; allow it to set gpr[3]. */
337 	if (do_seccomp(regs))
338 		return -1;
339 
340 	/* Avoid trace and audit when syscall is invalid. */
341 	if (regs->gpr[0] >= NR_syscalls)
342 		goto skip;
343 
344 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
345 		trace_sys_enter(regs, regs->gpr[0]);
346 
347 	if (!is_32bit_task())
348 		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
349 				    regs->gpr[5], regs->gpr[6]);
350 	else
351 		audit_syscall_entry(regs->gpr[0],
352 				    regs->gpr[3] & 0xffffffff,
353 				    regs->gpr[4] & 0xffffffff,
354 				    regs->gpr[5] & 0xffffffff,
355 				    regs->gpr[6] & 0xffffffff);
356 
357 	/* Return the possibly modified but valid syscall number */
358 	return regs->gpr[0];
359 
360 skip:
361 	/*
362 	 * If we are aborting explicitly, or if the syscall number is
363 	 * now invalid, set the return value to -ENOSYS.
364 	 */
365 	regs->gpr[3] = -ENOSYS;
366 	return -1;
367 }
368 
do_syscall_trace_leave(struct pt_regs * regs)369 void do_syscall_trace_leave(struct pt_regs *regs)
370 {
371 	int step;
372 
373 	audit_syscall_exit(regs);
374 
375 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
376 		trace_sys_exit(regs, regs->result);
377 
378 	step = test_thread_flag(TIF_SINGLESTEP);
379 	if (step || test_thread_flag(TIF_SYSCALL_TRACE))
380 		tracehook_report_syscall_exit(regs, step);
381 
382 	user_enter();
383 }
384 
385 void __init pt_regs_check(void);
386 
387 /*
388  * Dummy function, its purpose is to break the build if struct pt_regs and
389  * struct user_pt_regs don't match.
390  */
pt_regs_check(void)391 void __init pt_regs_check(void)
392 {
393 	BUILD_BUG_ON(offsetof(struct pt_regs, gpr) !=
394 		     offsetof(struct user_pt_regs, gpr));
395 	BUILD_BUG_ON(offsetof(struct pt_regs, nip) !=
396 		     offsetof(struct user_pt_regs, nip));
397 	BUILD_BUG_ON(offsetof(struct pt_regs, msr) !=
398 		     offsetof(struct user_pt_regs, msr));
399 	BUILD_BUG_ON(offsetof(struct pt_regs, msr) !=
400 		     offsetof(struct user_pt_regs, msr));
401 	BUILD_BUG_ON(offsetof(struct pt_regs, orig_gpr3) !=
402 		     offsetof(struct user_pt_regs, orig_gpr3));
403 	BUILD_BUG_ON(offsetof(struct pt_regs, ctr) !=
404 		     offsetof(struct user_pt_regs, ctr));
405 	BUILD_BUG_ON(offsetof(struct pt_regs, link) !=
406 		     offsetof(struct user_pt_regs, link));
407 	BUILD_BUG_ON(offsetof(struct pt_regs, xer) !=
408 		     offsetof(struct user_pt_regs, xer));
409 	BUILD_BUG_ON(offsetof(struct pt_regs, ccr) !=
410 		     offsetof(struct user_pt_regs, ccr));
411 #ifdef __powerpc64__
412 	BUILD_BUG_ON(offsetof(struct pt_regs, softe) !=
413 		     offsetof(struct user_pt_regs, softe));
414 #else
415 	BUILD_BUG_ON(offsetof(struct pt_regs, mq) !=
416 		     offsetof(struct user_pt_regs, mq));
417 #endif
418 	BUILD_BUG_ON(offsetof(struct pt_regs, trap) !=
419 		     offsetof(struct user_pt_regs, trap));
420 	BUILD_BUG_ON(offsetof(struct pt_regs, dar) !=
421 		     offsetof(struct user_pt_regs, dar));
422 	BUILD_BUG_ON(offsetof(struct pt_regs, dsisr) !=
423 		     offsetof(struct user_pt_regs, dsisr));
424 	BUILD_BUG_ON(offsetof(struct pt_regs, result) !=
425 		     offsetof(struct user_pt_regs, result));
426 
427 	BUILD_BUG_ON(sizeof(struct user_pt_regs) > sizeof(struct pt_regs));
428 
429 	// Now check that the pt_regs offsets match the uapi #defines
430 	#define CHECK_REG(_pt, _reg) \
431 		BUILD_BUG_ON(_pt != (offsetof(struct user_pt_regs, _reg) / \
432 				     sizeof(unsigned long)));
433 
434 	CHECK_REG(PT_R0,  gpr[0]);
435 	CHECK_REG(PT_R1,  gpr[1]);
436 	CHECK_REG(PT_R2,  gpr[2]);
437 	CHECK_REG(PT_R3,  gpr[3]);
438 	CHECK_REG(PT_R4,  gpr[4]);
439 	CHECK_REG(PT_R5,  gpr[5]);
440 	CHECK_REG(PT_R6,  gpr[6]);
441 	CHECK_REG(PT_R7,  gpr[7]);
442 	CHECK_REG(PT_R8,  gpr[8]);
443 	CHECK_REG(PT_R9,  gpr[9]);
444 	CHECK_REG(PT_R10, gpr[10]);
445 	CHECK_REG(PT_R11, gpr[11]);
446 	CHECK_REG(PT_R12, gpr[12]);
447 	CHECK_REG(PT_R13, gpr[13]);
448 	CHECK_REG(PT_R14, gpr[14]);
449 	CHECK_REG(PT_R15, gpr[15]);
450 	CHECK_REG(PT_R16, gpr[16]);
451 	CHECK_REG(PT_R17, gpr[17]);
452 	CHECK_REG(PT_R18, gpr[18]);
453 	CHECK_REG(PT_R19, gpr[19]);
454 	CHECK_REG(PT_R20, gpr[20]);
455 	CHECK_REG(PT_R21, gpr[21]);
456 	CHECK_REG(PT_R22, gpr[22]);
457 	CHECK_REG(PT_R23, gpr[23]);
458 	CHECK_REG(PT_R24, gpr[24]);
459 	CHECK_REG(PT_R25, gpr[25]);
460 	CHECK_REG(PT_R26, gpr[26]);
461 	CHECK_REG(PT_R27, gpr[27]);
462 	CHECK_REG(PT_R28, gpr[28]);
463 	CHECK_REG(PT_R29, gpr[29]);
464 	CHECK_REG(PT_R30, gpr[30]);
465 	CHECK_REG(PT_R31, gpr[31]);
466 	CHECK_REG(PT_NIP, nip);
467 	CHECK_REG(PT_MSR, msr);
468 	CHECK_REG(PT_ORIG_R3, orig_gpr3);
469 	CHECK_REG(PT_CTR, ctr);
470 	CHECK_REG(PT_LNK, link);
471 	CHECK_REG(PT_XER, xer);
472 	CHECK_REG(PT_CCR, ccr);
473 #ifdef CONFIG_PPC64
474 	CHECK_REG(PT_SOFTE, softe);
475 #else
476 	CHECK_REG(PT_MQ, mq);
477 #endif
478 	CHECK_REG(PT_TRAP, trap);
479 	CHECK_REG(PT_DAR, dar);
480 	CHECK_REG(PT_DSISR, dsisr);
481 	CHECK_REG(PT_RESULT, result);
482 	#undef CHECK_REG
483 
484 	BUILD_BUG_ON(PT_REGS_COUNT != sizeof(struct user_pt_regs) / sizeof(unsigned long));
485 
486 	/*
487 	 * PT_DSCR isn't a real reg, but it's important that it doesn't overlap the
488 	 * real registers.
489 	 */
490 	BUILD_BUG_ON(PT_DSCR < sizeof(struct user_pt_regs) / sizeof(unsigned long));
491 
492 	// ptrace_get/put_fpr() rely on PPC32 and VSX being incompatible
493 	BUILD_BUG_ON(IS_ENABLED(CONFIG_PPC32) && IS_ENABLED(CONFIG_VSX));
494 }
495