1 /*
2  *  PowerPC version
3  *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4  *
5  *  Derived from "arch/m68k/kernel/ptrace.c"
6  *  Copyright (C) 1994 by Hamish Macdonald
7  *  Taken from linux/kernel/ptrace.c and modified for M680x0.
8  *  linux/kernel/ptrace.c is by Ross Biro 1/23/92, edited by Linus Torvalds
9  *
10  * Modified by Cort Dougan (cort@hq.fsmlabs.com)
11  * and Paul Mackerras (paulus@samba.org).
12  *
13  * This file is subject to the terms and conditions of the GNU General
14  * Public License.  See the file README.legal in the main directory of
15  * this archive for more details.
16  */
17 
18 #include <linux/regset.h>
19 #include <linux/tracehook.h>
20 #include <linux/audit.h>
21 #include <linux/context_tracking.h>
22 #include <linux/syscalls.h>
23 
24 #include <asm/switch_to.h>
25 #include <asm/asm-prototypes.h>
26 #include <asm/debug.h>
27 
28 #define CREATE_TRACE_POINTS
29 #include <trace/events/syscalls.h>
30 
31 #include "ptrace-decl.h"
32 
33 /*
34  * Called by kernel/ptrace.c when detaching..
35  *
36  * Make sure single step bits etc are not set.
37  */
38 void ptrace_disable(struct task_struct *child)
39 {
40 	/* make sure the single step bit is not set. */
41 	user_disable_single_step(child);
42 }
43 
44 long arch_ptrace(struct task_struct *child, long request,
45 		 unsigned long addr, unsigned long data)
46 {
47 	int ret = -EPERM;
48 	void __user *datavp = (void __user *) data;
49 	unsigned long __user *datalp = datavp;
50 
51 	switch (request) {
52 	/* read the word at location addr in the USER area. */
53 	case PTRACE_PEEKUSR: {
54 		unsigned long index, tmp;
55 
56 		ret = -EIO;
57 		/* convert to index and check */
58 		index = addr / sizeof(long);
59 		if ((addr & (sizeof(long) - 1)) || !child->thread.regs)
60 			break;
61 
62 		CHECK_FULL_REGS(child->thread.regs);
63 		if (index < PT_FPR0)
64 			ret = ptrace_get_reg(child, (int) index, &tmp);
65 		else
66 			ret = ptrace_get_fpr(child, index, &tmp);
67 
68 		if (ret)
69 			break;
70 		ret = put_user(tmp, datalp);
71 		break;
72 	}
73 
74 	/* write the word at location addr in the USER area */
75 	case PTRACE_POKEUSR: {
76 		unsigned long index;
77 
78 		ret = -EIO;
79 		/* convert to index and check */
80 		index = addr / sizeof(long);
81 		if ((addr & (sizeof(long) - 1)) || !child->thread.regs)
82 			break;
83 
84 		CHECK_FULL_REGS(child->thread.regs);
85 		if (index < PT_FPR0)
86 			ret = ptrace_put_reg(child, index, data);
87 		else
88 			ret = ptrace_put_fpr(child, index, data);
89 		break;
90 	}
91 
92 	case PPC_PTRACE_GETHWDBGINFO: {
93 		struct ppc_debug_info dbginfo;
94 
95 		ppc_gethwdinfo(&dbginfo);
96 
97 		if (copy_to_user(datavp, &dbginfo,
98 				 sizeof(struct ppc_debug_info)))
99 			return -EFAULT;
100 		return 0;
101 	}
102 
103 	case PPC_PTRACE_SETHWDEBUG: {
104 		struct ppc_hw_breakpoint bp_info;
105 
106 		if (copy_from_user(&bp_info, datavp,
107 				   sizeof(struct ppc_hw_breakpoint)))
108 			return -EFAULT;
109 		return ppc_set_hwdebug(child, &bp_info);
110 	}
111 
112 	case PPC_PTRACE_DELHWDEBUG: {
113 		ret = ppc_del_hwdebug(child, data);
114 		break;
115 	}
116 
117 	case PTRACE_GET_DEBUGREG:
118 		ret = ptrace_get_debugreg(child, addr, datalp);
119 		break;
120 
121 	case PTRACE_SET_DEBUGREG:
122 		ret = ptrace_set_debugreg(child, addr, data);
123 		break;
124 
125 #ifdef CONFIG_PPC64
126 	case PTRACE_GETREGS64:
127 #endif
128 	case PTRACE_GETREGS:	/* Get all pt_regs from the child. */
129 		return copy_regset_to_user(child, &user_ppc_native_view,
130 					   REGSET_GPR,
131 					   0, sizeof(struct user_pt_regs),
132 					   datavp);
133 
134 #ifdef CONFIG_PPC64
135 	case PTRACE_SETREGS64:
136 #endif
137 	case PTRACE_SETREGS:	/* Set all gp regs in the child. */
138 		return copy_regset_from_user(child, &user_ppc_native_view,
139 					     REGSET_GPR,
140 					     0, sizeof(struct user_pt_regs),
141 					     datavp);
142 
143 	case PTRACE_GETFPREGS: /* Get the child FPU state (FPR0...31 + FPSCR) */
144 		return copy_regset_to_user(child, &user_ppc_native_view,
145 					   REGSET_FPR,
146 					   0, sizeof(elf_fpregset_t),
147 					   datavp);
148 
149 	case PTRACE_SETFPREGS: /* Set the child FPU state (FPR0...31 + FPSCR) */
150 		return copy_regset_from_user(child, &user_ppc_native_view,
151 					     REGSET_FPR,
152 					     0, sizeof(elf_fpregset_t),
153 					     datavp);
154 
155 #ifdef CONFIG_ALTIVEC
156 	case PTRACE_GETVRREGS:
157 		return copy_regset_to_user(child, &user_ppc_native_view,
158 					   REGSET_VMX,
159 					   0, (33 * sizeof(vector128) +
160 					       sizeof(u32)),
161 					   datavp);
162 
163 	case PTRACE_SETVRREGS:
164 		return copy_regset_from_user(child, &user_ppc_native_view,
165 					     REGSET_VMX,
166 					     0, (33 * sizeof(vector128) +
167 						 sizeof(u32)),
168 					     datavp);
169 #endif
170 #ifdef CONFIG_VSX
171 	case PTRACE_GETVSRREGS:
172 		return copy_regset_to_user(child, &user_ppc_native_view,
173 					   REGSET_VSX,
174 					   0, 32 * sizeof(double),
175 					   datavp);
176 
177 	case PTRACE_SETVSRREGS:
178 		return copy_regset_from_user(child, &user_ppc_native_view,
179 					     REGSET_VSX,
180 					     0, 32 * sizeof(double),
181 					     datavp);
182 #endif
183 #ifdef CONFIG_SPE
184 	case PTRACE_GETEVRREGS:
185 		/* Get the child spe register state. */
186 		return copy_regset_to_user(child, &user_ppc_native_view,
187 					   REGSET_SPE, 0, 35 * sizeof(u32),
188 					   datavp);
189 
190 	case PTRACE_SETEVRREGS:
191 		/* Set the child spe register state. */
192 		return copy_regset_from_user(child, &user_ppc_native_view,
193 					     REGSET_SPE, 0, 35 * sizeof(u32),
194 					     datavp);
195 #endif
196 
197 	default:
198 		ret = ptrace_request(child, request, addr, data);
199 		break;
200 	}
201 	return ret;
202 }
203 
204 #ifdef CONFIG_SECCOMP
205 static int do_seccomp(struct pt_regs *regs)
206 {
207 	if (!test_thread_flag(TIF_SECCOMP))
208 		return 0;
209 
210 	/*
211 	 * The ABI we present to seccomp tracers is that r3 contains
212 	 * the syscall return value and orig_gpr3 contains the first
213 	 * syscall parameter. This is different to the ptrace ABI where
214 	 * both r3 and orig_gpr3 contain the first syscall parameter.
215 	 */
216 	regs->gpr[3] = -ENOSYS;
217 
218 	/*
219 	 * We use the __ version here because we have already checked
220 	 * TIF_SECCOMP. If this fails, there is nothing left to do, we
221 	 * have already loaded -ENOSYS into r3, or seccomp has put
222 	 * something else in r3 (via SECCOMP_RET_ERRNO/TRACE).
223 	 */
224 	if (__secure_computing(NULL))
225 		return -1;
226 
227 	/*
228 	 * The syscall was allowed by seccomp, restore the register
229 	 * state to what audit expects.
230 	 * Note that we use orig_gpr3, which means a seccomp tracer can
231 	 * modify the first syscall parameter (in orig_gpr3) and also
232 	 * allow the syscall to proceed.
233 	 */
234 	regs->gpr[3] = regs->orig_gpr3;
235 
236 	return 0;
237 }
238 #else
239 static inline int do_seccomp(struct pt_regs *regs) { return 0; }
240 #endif /* CONFIG_SECCOMP */
241 
242 /**
243  * do_syscall_trace_enter() - Do syscall tracing on kernel entry.
244  * @regs: the pt_regs of the task to trace (current)
245  *
246  * Performs various types of tracing on syscall entry. This includes seccomp,
247  * ptrace, syscall tracepoints and audit.
248  *
249  * The pt_regs are potentially visible to userspace via ptrace, so their
250  * contents is ABI.
251  *
252  * One or more of the tracers may modify the contents of pt_regs, in particular
253  * to modify arguments or even the syscall number itself.
254  *
255  * It's also possible that a tracer can choose to reject the system call. In
256  * that case this function will return an illegal syscall number, and will put
257  * an appropriate return value in regs->r3.
258  *
259  * Return: the (possibly changed) syscall number.
260  */
261 long do_syscall_trace_enter(struct pt_regs *regs)
262 {
263 	u32 flags;
264 
265 	flags = READ_ONCE(current_thread_info()->flags) &
266 		(_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE);
267 
268 	if (flags) {
269 		int rc = tracehook_report_syscall_entry(regs);
270 
271 		if (unlikely(flags & _TIF_SYSCALL_EMU)) {
272 			/*
273 			 * A nonzero return code from
274 			 * tracehook_report_syscall_entry() tells us to prevent
275 			 * the syscall execution, but we are not going to
276 			 * execute it anyway.
277 			 *
278 			 * Returning -1 will skip the syscall execution. We want
279 			 * to avoid clobbering any registers, so we don't goto
280 			 * the skip label below.
281 			 */
282 			return -1;
283 		}
284 
285 		if (rc) {
286 			/*
287 			 * The tracer decided to abort the syscall. Note that
288 			 * the tracer may also just change regs->gpr[0] to an
289 			 * invalid syscall number, that is handled below on the
290 			 * exit path.
291 			 */
292 			goto skip;
293 		}
294 	}
295 
296 	/* Run seccomp after ptrace; allow it to set gpr[3]. */
297 	if (do_seccomp(regs))
298 		return -1;
299 
300 	/* Avoid trace and audit when syscall is invalid. */
301 	if (regs->gpr[0] >= NR_syscalls)
302 		goto skip;
303 
304 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
305 		trace_sys_enter(regs, regs->gpr[0]);
306 
307 	if (!is_32bit_task())
308 		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
309 				    regs->gpr[5], regs->gpr[6]);
310 	else
311 		audit_syscall_entry(regs->gpr[0],
312 				    regs->gpr[3] & 0xffffffff,
313 				    regs->gpr[4] & 0xffffffff,
314 				    regs->gpr[5] & 0xffffffff,
315 				    regs->gpr[6] & 0xffffffff);
316 
317 	/* Return the possibly modified but valid syscall number */
318 	return regs->gpr[0];
319 
320 skip:
321 	/*
322 	 * If we are aborting explicitly, or if the syscall number is
323 	 * now invalid, set the return value to -ENOSYS.
324 	 */
325 	regs->gpr[3] = -ENOSYS;
326 	return -1;
327 }
328 
329 void do_syscall_trace_leave(struct pt_regs *regs)
330 {
331 	int step;
332 
333 	audit_syscall_exit(regs);
334 
335 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
336 		trace_sys_exit(regs, regs->result);
337 
338 	step = test_thread_flag(TIF_SINGLESTEP);
339 	if (step || test_thread_flag(TIF_SYSCALL_TRACE))
340 		tracehook_report_syscall_exit(regs, step);
341 }
342 
343 void __init pt_regs_check(void);
344 
345 /*
346  * Dummy function, its purpose is to break the build if struct pt_regs and
347  * struct user_pt_regs don't match.
348  */
349 void __init pt_regs_check(void)
350 {
351 	BUILD_BUG_ON(offsetof(struct pt_regs, gpr) !=
352 		     offsetof(struct user_pt_regs, gpr));
353 	BUILD_BUG_ON(offsetof(struct pt_regs, nip) !=
354 		     offsetof(struct user_pt_regs, nip));
355 	BUILD_BUG_ON(offsetof(struct pt_regs, msr) !=
356 		     offsetof(struct user_pt_regs, msr));
357 	BUILD_BUG_ON(offsetof(struct pt_regs, msr) !=
358 		     offsetof(struct user_pt_regs, msr));
359 	BUILD_BUG_ON(offsetof(struct pt_regs, orig_gpr3) !=
360 		     offsetof(struct user_pt_regs, orig_gpr3));
361 	BUILD_BUG_ON(offsetof(struct pt_regs, ctr) !=
362 		     offsetof(struct user_pt_regs, ctr));
363 	BUILD_BUG_ON(offsetof(struct pt_regs, link) !=
364 		     offsetof(struct user_pt_regs, link));
365 	BUILD_BUG_ON(offsetof(struct pt_regs, xer) !=
366 		     offsetof(struct user_pt_regs, xer));
367 	BUILD_BUG_ON(offsetof(struct pt_regs, ccr) !=
368 		     offsetof(struct user_pt_regs, ccr));
369 #ifdef __powerpc64__
370 	BUILD_BUG_ON(offsetof(struct pt_regs, softe) !=
371 		     offsetof(struct user_pt_regs, softe));
372 #else
373 	BUILD_BUG_ON(offsetof(struct pt_regs, mq) !=
374 		     offsetof(struct user_pt_regs, mq));
375 #endif
376 	BUILD_BUG_ON(offsetof(struct pt_regs, trap) !=
377 		     offsetof(struct user_pt_regs, trap));
378 	BUILD_BUG_ON(offsetof(struct pt_regs, dar) !=
379 		     offsetof(struct user_pt_regs, dar));
380 	BUILD_BUG_ON(offsetof(struct pt_regs, dsisr) !=
381 		     offsetof(struct user_pt_regs, dsisr));
382 	BUILD_BUG_ON(offsetof(struct pt_regs, result) !=
383 		     offsetof(struct user_pt_regs, result));
384 
385 	BUILD_BUG_ON(sizeof(struct user_pt_regs) > sizeof(struct pt_regs));
386 
387 	// Now check that the pt_regs offsets match the uapi #defines
388 	#define CHECK_REG(_pt, _reg) \
389 		BUILD_BUG_ON(_pt != (offsetof(struct user_pt_regs, _reg) / \
390 				     sizeof(unsigned long)));
391 
392 	CHECK_REG(PT_R0,  gpr[0]);
393 	CHECK_REG(PT_R1,  gpr[1]);
394 	CHECK_REG(PT_R2,  gpr[2]);
395 	CHECK_REG(PT_R3,  gpr[3]);
396 	CHECK_REG(PT_R4,  gpr[4]);
397 	CHECK_REG(PT_R5,  gpr[5]);
398 	CHECK_REG(PT_R6,  gpr[6]);
399 	CHECK_REG(PT_R7,  gpr[7]);
400 	CHECK_REG(PT_R8,  gpr[8]);
401 	CHECK_REG(PT_R9,  gpr[9]);
402 	CHECK_REG(PT_R10, gpr[10]);
403 	CHECK_REG(PT_R11, gpr[11]);
404 	CHECK_REG(PT_R12, gpr[12]);
405 	CHECK_REG(PT_R13, gpr[13]);
406 	CHECK_REG(PT_R14, gpr[14]);
407 	CHECK_REG(PT_R15, gpr[15]);
408 	CHECK_REG(PT_R16, gpr[16]);
409 	CHECK_REG(PT_R17, gpr[17]);
410 	CHECK_REG(PT_R18, gpr[18]);
411 	CHECK_REG(PT_R19, gpr[19]);
412 	CHECK_REG(PT_R20, gpr[20]);
413 	CHECK_REG(PT_R21, gpr[21]);
414 	CHECK_REG(PT_R22, gpr[22]);
415 	CHECK_REG(PT_R23, gpr[23]);
416 	CHECK_REG(PT_R24, gpr[24]);
417 	CHECK_REG(PT_R25, gpr[25]);
418 	CHECK_REG(PT_R26, gpr[26]);
419 	CHECK_REG(PT_R27, gpr[27]);
420 	CHECK_REG(PT_R28, gpr[28]);
421 	CHECK_REG(PT_R29, gpr[29]);
422 	CHECK_REG(PT_R30, gpr[30]);
423 	CHECK_REG(PT_R31, gpr[31]);
424 	CHECK_REG(PT_NIP, nip);
425 	CHECK_REG(PT_MSR, msr);
426 	CHECK_REG(PT_ORIG_R3, orig_gpr3);
427 	CHECK_REG(PT_CTR, ctr);
428 	CHECK_REG(PT_LNK, link);
429 	CHECK_REG(PT_XER, xer);
430 	CHECK_REG(PT_CCR, ccr);
431 #ifdef CONFIG_PPC64
432 	CHECK_REG(PT_SOFTE, softe);
433 #else
434 	CHECK_REG(PT_MQ, mq);
435 #endif
436 	CHECK_REG(PT_TRAP, trap);
437 	CHECK_REG(PT_DAR, dar);
438 	CHECK_REG(PT_DSISR, dsisr);
439 	CHECK_REG(PT_RESULT, result);
440 	#undef CHECK_REG
441 
442 	BUILD_BUG_ON(PT_REGS_COUNT != sizeof(struct user_pt_regs) / sizeof(unsigned long));
443 
444 	/*
445 	 * PT_DSCR isn't a real reg, but it's important that it doesn't overlap the
446 	 * real registers.
447 	 */
448 	BUILD_BUG_ON(PT_DSCR < sizeof(struct user_pt_regs) / sizeof(unsigned long));
449 }
450