1 /*
2  *  PowerPC version
3  *    Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4  *
5  *  Derived from "arch/m68k/kernel/ptrace.c"
6  *  Copyright (C) 1994 by Hamish Macdonald
7  *  Taken from linux/kernel/ptrace.c and modified for M680x0.
8  *  linux/kernel/ptrace.c is by Ross Biro 1/23/92, edited by Linus Torvalds
9  *
10  * Modified by Cort Dougan (cort@hq.fsmlabs.com)
11  * and Paul Mackerras (paulus@samba.org).
12  *
13  * This file is subject to the terms and conditions of the GNU General
14  * Public License.  See the file README.legal in the main directory of
15  * this archive for more details.
16  */
17 
18 #include <linux/regset.h>
19 #include <linux/tracehook.h>
20 #include <linux/audit.h>
21 #include <linux/context_tracking.h>
22 #include <linux/syscalls.h>
23 
24 #include <asm/switch_to.h>
25 #include <asm/asm-prototypes.h>
26 #include <asm/debug.h>
27 
28 #define CREATE_TRACE_POINTS
29 #include <trace/events/syscalls.h>
30 
31 #include "ptrace-decl.h"
32 
33 /*
34  * Called by kernel/ptrace.c when detaching..
35  *
36  * Make sure single step bits etc are not set.
37  */
38 void ptrace_disable(struct task_struct *child)
39 {
40 	/* make sure the single step bit is not set. */
41 	user_disable_single_step(child);
42 }
43 
44 long arch_ptrace(struct task_struct *child, long request,
45 		 unsigned long addr, unsigned long data)
46 {
47 	int ret = -EPERM;
48 	void __user *datavp = (void __user *) data;
49 	unsigned long __user *datalp = datavp;
50 
51 	switch (request) {
52 	/* read the word at location addr in the USER area. */
53 	case PTRACE_PEEKUSR: {
54 		unsigned long index, tmp;
55 
56 		ret = -EIO;
57 		/* convert to index and check */
58 		index = addr / sizeof(long);
59 		if ((addr & (sizeof(long) - 1)) || !child->thread.regs)
60 			break;
61 
62 		if (index < PT_FPR0)
63 			ret = ptrace_get_reg(child, (int) index, &tmp);
64 		else
65 			ret = ptrace_get_fpr(child, index, &tmp);
66 
67 		if (ret)
68 			break;
69 		ret = put_user(tmp, datalp);
70 		break;
71 	}
72 
73 	/* write the word at location addr in the USER area */
74 	case PTRACE_POKEUSR: {
75 		unsigned long index;
76 
77 		ret = -EIO;
78 		/* convert to index and check */
79 		index = addr / sizeof(long);
80 		if ((addr & (sizeof(long) - 1)) || !child->thread.regs)
81 			break;
82 
83 		if (index < PT_FPR0)
84 			ret = ptrace_put_reg(child, index, data);
85 		else
86 			ret = ptrace_put_fpr(child, index, data);
87 		break;
88 	}
89 
90 	case PPC_PTRACE_GETHWDBGINFO: {
91 		struct ppc_debug_info dbginfo;
92 
93 		ppc_gethwdinfo(&dbginfo);
94 
95 		if (copy_to_user(datavp, &dbginfo,
96 				 sizeof(struct ppc_debug_info)))
97 			return -EFAULT;
98 		return 0;
99 	}
100 
101 	case PPC_PTRACE_SETHWDEBUG: {
102 		struct ppc_hw_breakpoint bp_info;
103 
104 		if (copy_from_user(&bp_info, datavp,
105 				   sizeof(struct ppc_hw_breakpoint)))
106 			return -EFAULT;
107 		return ppc_set_hwdebug(child, &bp_info);
108 	}
109 
110 	case PPC_PTRACE_DELHWDEBUG: {
111 		ret = ppc_del_hwdebug(child, data);
112 		break;
113 	}
114 
115 	case PTRACE_GET_DEBUGREG:
116 		ret = ptrace_get_debugreg(child, addr, datalp);
117 		break;
118 
119 	case PTRACE_SET_DEBUGREG:
120 		ret = ptrace_set_debugreg(child, addr, data);
121 		break;
122 
123 #ifdef CONFIG_PPC64
124 	case PTRACE_GETREGS64:
125 #endif
126 	case PTRACE_GETREGS:	/* Get all pt_regs from the child. */
127 		return copy_regset_to_user(child, &user_ppc_native_view,
128 					   REGSET_GPR,
129 					   0, sizeof(struct user_pt_regs),
130 					   datavp);
131 
132 #ifdef CONFIG_PPC64
133 	case PTRACE_SETREGS64:
134 #endif
135 	case PTRACE_SETREGS:	/* Set all gp regs in the child. */
136 		return copy_regset_from_user(child, &user_ppc_native_view,
137 					     REGSET_GPR,
138 					     0, sizeof(struct user_pt_regs),
139 					     datavp);
140 
141 	case PTRACE_GETFPREGS: /* Get the child FPU state (FPR0...31 + FPSCR) */
142 		return copy_regset_to_user(child, &user_ppc_native_view,
143 					   REGSET_FPR,
144 					   0, sizeof(elf_fpregset_t),
145 					   datavp);
146 
147 	case PTRACE_SETFPREGS: /* Set the child FPU state (FPR0...31 + FPSCR) */
148 		return copy_regset_from_user(child, &user_ppc_native_view,
149 					     REGSET_FPR,
150 					     0, sizeof(elf_fpregset_t),
151 					     datavp);
152 
153 #ifdef CONFIG_ALTIVEC
154 	case PTRACE_GETVRREGS:
155 		return copy_regset_to_user(child, &user_ppc_native_view,
156 					   REGSET_VMX,
157 					   0, (33 * sizeof(vector128) +
158 					       sizeof(u32)),
159 					   datavp);
160 
161 	case PTRACE_SETVRREGS:
162 		return copy_regset_from_user(child, &user_ppc_native_view,
163 					     REGSET_VMX,
164 					     0, (33 * sizeof(vector128) +
165 						 sizeof(u32)),
166 					     datavp);
167 #endif
168 #ifdef CONFIG_VSX
169 	case PTRACE_GETVSRREGS:
170 		return copy_regset_to_user(child, &user_ppc_native_view,
171 					   REGSET_VSX,
172 					   0, 32 * sizeof(double),
173 					   datavp);
174 
175 	case PTRACE_SETVSRREGS:
176 		return copy_regset_from_user(child, &user_ppc_native_view,
177 					     REGSET_VSX,
178 					     0, 32 * sizeof(double),
179 					     datavp);
180 #endif
181 #ifdef CONFIG_SPE
182 	case PTRACE_GETEVRREGS:
183 		/* Get the child spe register state. */
184 		return copy_regset_to_user(child, &user_ppc_native_view,
185 					   REGSET_SPE, 0, 35 * sizeof(u32),
186 					   datavp);
187 
188 	case PTRACE_SETEVRREGS:
189 		/* Set the child spe register state. */
190 		return copy_regset_from_user(child, &user_ppc_native_view,
191 					     REGSET_SPE, 0, 35 * sizeof(u32),
192 					     datavp);
193 #endif
194 
195 	default:
196 		ret = ptrace_request(child, request, addr, data);
197 		break;
198 	}
199 	return ret;
200 }
201 
202 #ifdef CONFIG_SECCOMP
203 static int do_seccomp(struct pt_regs *regs)
204 {
205 	if (!test_thread_flag(TIF_SECCOMP))
206 		return 0;
207 
208 	/*
209 	 * The ABI we present to seccomp tracers is that r3 contains
210 	 * the syscall return value and orig_gpr3 contains the first
211 	 * syscall parameter. This is different to the ptrace ABI where
212 	 * both r3 and orig_gpr3 contain the first syscall parameter.
213 	 */
214 	regs->gpr[3] = -ENOSYS;
215 
216 	/*
217 	 * We use the __ version here because we have already checked
218 	 * TIF_SECCOMP. If this fails, there is nothing left to do, we
219 	 * have already loaded -ENOSYS into r3, or seccomp has put
220 	 * something else in r3 (via SECCOMP_RET_ERRNO/TRACE).
221 	 */
222 	if (__secure_computing(NULL))
223 		return -1;
224 
225 	/*
226 	 * The syscall was allowed by seccomp, restore the register
227 	 * state to what audit expects.
228 	 * Note that we use orig_gpr3, which means a seccomp tracer can
229 	 * modify the first syscall parameter (in orig_gpr3) and also
230 	 * allow the syscall to proceed.
231 	 */
232 	regs->gpr[3] = regs->orig_gpr3;
233 
234 	return 0;
235 }
236 #else
237 static inline int do_seccomp(struct pt_regs *regs) { return 0; }
238 #endif /* CONFIG_SECCOMP */
239 
240 /**
241  * do_syscall_trace_enter() - Do syscall tracing on kernel entry.
242  * @regs: the pt_regs of the task to trace (current)
243  *
244  * Performs various types of tracing on syscall entry. This includes seccomp,
245  * ptrace, syscall tracepoints and audit.
246  *
247  * The pt_regs are potentially visible to userspace via ptrace, so their
248  * contents is ABI.
249  *
250  * One or more of the tracers may modify the contents of pt_regs, in particular
251  * to modify arguments or even the syscall number itself.
252  *
253  * It's also possible that a tracer can choose to reject the system call. In
254  * that case this function will return an illegal syscall number, and will put
255  * an appropriate return value in regs->r3.
256  *
257  * Return: the (possibly changed) syscall number.
258  */
259 long do_syscall_trace_enter(struct pt_regs *regs)
260 {
261 	u32 flags;
262 
263 	flags = read_thread_flags() & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE);
264 
265 	if (flags) {
266 		int rc = tracehook_report_syscall_entry(regs);
267 
268 		if (unlikely(flags & _TIF_SYSCALL_EMU)) {
269 			/*
270 			 * A nonzero return code from
271 			 * tracehook_report_syscall_entry() tells us to prevent
272 			 * the syscall execution, but we are not going to
273 			 * execute it anyway.
274 			 *
275 			 * Returning -1 will skip the syscall execution. We want
276 			 * to avoid clobbering any registers, so we don't goto
277 			 * the skip label below.
278 			 */
279 			return -1;
280 		}
281 
282 		if (rc) {
283 			/*
284 			 * The tracer decided to abort the syscall. Note that
285 			 * the tracer may also just change regs->gpr[0] to an
286 			 * invalid syscall number, that is handled below on the
287 			 * exit path.
288 			 */
289 			goto skip;
290 		}
291 	}
292 
293 	/* Run seccomp after ptrace; allow it to set gpr[3]. */
294 	if (do_seccomp(regs))
295 		return -1;
296 
297 	/* Avoid trace and audit when syscall is invalid. */
298 	if (regs->gpr[0] >= NR_syscalls)
299 		goto skip;
300 
301 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
302 		trace_sys_enter(regs, regs->gpr[0]);
303 
304 	if (!is_32bit_task())
305 		audit_syscall_entry(regs->gpr[0], regs->gpr[3], regs->gpr[4],
306 				    regs->gpr[5], regs->gpr[6]);
307 	else
308 		audit_syscall_entry(regs->gpr[0],
309 				    regs->gpr[3] & 0xffffffff,
310 				    regs->gpr[4] & 0xffffffff,
311 				    regs->gpr[5] & 0xffffffff,
312 				    regs->gpr[6] & 0xffffffff);
313 
314 	/* Return the possibly modified but valid syscall number */
315 	return regs->gpr[0];
316 
317 skip:
318 	/*
319 	 * If we are aborting explicitly, or if the syscall number is
320 	 * now invalid, set the return value to -ENOSYS.
321 	 */
322 	regs->gpr[3] = -ENOSYS;
323 	return -1;
324 }
325 
326 void do_syscall_trace_leave(struct pt_regs *regs)
327 {
328 	int step;
329 
330 	audit_syscall_exit(regs);
331 
332 	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
333 		trace_sys_exit(regs, regs->result);
334 
335 	step = test_thread_flag(TIF_SINGLESTEP);
336 	if (step || test_thread_flag(TIF_SYSCALL_TRACE))
337 		tracehook_report_syscall_exit(regs, step);
338 }
339 
340 void __init pt_regs_check(void);
341 
342 /*
343  * Dummy function, its purpose is to break the build if struct pt_regs and
344  * struct user_pt_regs don't match.
345  */
346 void __init pt_regs_check(void)
347 {
348 	BUILD_BUG_ON(offsetof(struct pt_regs, gpr) !=
349 		     offsetof(struct user_pt_regs, gpr));
350 	BUILD_BUG_ON(offsetof(struct pt_regs, nip) !=
351 		     offsetof(struct user_pt_regs, nip));
352 	BUILD_BUG_ON(offsetof(struct pt_regs, msr) !=
353 		     offsetof(struct user_pt_regs, msr));
354 	BUILD_BUG_ON(offsetof(struct pt_regs, orig_gpr3) !=
355 		     offsetof(struct user_pt_regs, orig_gpr3));
356 	BUILD_BUG_ON(offsetof(struct pt_regs, ctr) !=
357 		     offsetof(struct user_pt_regs, ctr));
358 	BUILD_BUG_ON(offsetof(struct pt_regs, link) !=
359 		     offsetof(struct user_pt_regs, link));
360 	BUILD_BUG_ON(offsetof(struct pt_regs, xer) !=
361 		     offsetof(struct user_pt_regs, xer));
362 	BUILD_BUG_ON(offsetof(struct pt_regs, ccr) !=
363 		     offsetof(struct user_pt_regs, ccr));
364 #ifdef __powerpc64__
365 	BUILD_BUG_ON(offsetof(struct pt_regs, softe) !=
366 		     offsetof(struct user_pt_regs, softe));
367 #else
368 	BUILD_BUG_ON(offsetof(struct pt_regs, mq) !=
369 		     offsetof(struct user_pt_regs, mq));
370 #endif
371 	BUILD_BUG_ON(offsetof(struct pt_regs, trap) !=
372 		     offsetof(struct user_pt_regs, trap));
373 	BUILD_BUG_ON(offsetof(struct pt_regs, dar) !=
374 		     offsetof(struct user_pt_regs, dar));
375 	BUILD_BUG_ON(offsetof(struct pt_regs, dear) !=
376 		     offsetof(struct user_pt_regs, dar));
377 	BUILD_BUG_ON(offsetof(struct pt_regs, dsisr) !=
378 		     offsetof(struct user_pt_regs, dsisr));
379 	BUILD_BUG_ON(offsetof(struct pt_regs, esr) !=
380 		     offsetof(struct user_pt_regs, dsisr));
381 	BUILD_BUG_ON(offsetof(struct pt_regs, result) !=
382 		     offsetof(struct user_pt_regs, result));
383 
384 	BUILD_BUG_ON(sizeof(struct user_pt_regs) > sizeof(struct pt_regs));
385 
386 	// Now check that the pt_regs offsets match the uapi #defines
387 	#define CHECK_REG(_pt, _reg) \
388 		BUILD_BUG_ON(_pt != (offsetof(struct user_pt_regs, _reg) / \
389 				     sizeof(unsigned long)));
390 
391 	CHECK_REG(PT_R0,  gpr[0]);
392 	CHECK_REG(PT_R1,  gpr[1]);
393 	CHECK_REG(PT_R2,  gpr[2]);
394 	CHECK_REG(PT_R3,  gpr[3]);
395 	CHECK_REG(PT_R4,  gpr[4]);
396 	CHECK_REG(PT_R5,  gpr[5]);
397 	CHECK_REG(PT_R6,  gpr[6]);
398 	CHECK_REG(PT_R7,  gpr[7]);
399 	CHECK_REG(PT_R8,  gpr[8]);
400 	CHECK_REG(PT_R9,  gpr[9]);
401 	CHECK_REG(PT_R10, gpr[10]);
402 	CHECK_REG(PT_R11, gpr[11]);
403 	CHECK_REG(PT_R12, gpr[12]);
404 	CHECK_REG(PT_R13, gpr[13]);
405 	CHECK_REG(PT_R14, gpr[14]);
406 	CHECK_REG(PT_R15, gpr[15]);
407 	CHECK_REG(PT_R16, gpr[16]);
408 	CHECK_REG(PT_R17, gpr[17]);
409 	CHECK_REG(PT_R18, gpr[18]);
410 	CHECK_REG(PT_R19, gpr[19]);
411 	CHECK_REG(PT_R20, gpr[20]);
412 	CHECK_REG(PT_R21, gpr[21]);
413 	CHECK_REG(PT_R22, gpr[22]);
414 	CHECK_REG(PT_R23, gpr[23]);
415 	CHECK_REG(PT_R24, gpr[24]);
416 	CHECK_REG(PT_R25, gpr[25]);
417 	CHECK_REG(PT_R26, gpr[26]);
418 	CHECK_REG(PT_R27, gpr[27]);
419 	CHECK_REG(PT_R28, gpr[28]);
420 	CHECK_REG(PT_R29, gpr[29]);
421 	CHECK_REG(PT_R30, gpr[30]);
422 	CHECK_REG(PT_R31, gpr[31]);
423 	CHECK_REG(PT_NIP, nip);
424 	CHECK_REG(PT_MSR, msr);
425 	CHECK_REG(PT_ORIG_R3, orig_gpr3);
426 	CHECK_REG(PT_CTR, ctr);
427 	CHECK_REG(PT_LNK, link);
428 	CHECK_REG(PT_XER, xer);
429 	CHECK_REG(PT_CCR, ccr);
430 #ifdef CONFIG_PPC64
431 	CHECK_REG(PT_SOFTE, softe);
432 #else
433 	CHECK_REG(PT_MQ, mq);
434 #endif
435 	CHECK_REG(PT_TRAP, trap);
436 	CHECK_REG(PT_DAR, dar);
437 	CHECK_REG(PT_DSISR, dsisr);
438 	CHECK_REG(PT_RESULT, result);
439 	#undef CHECK_REG
440 
441 	BUILD_BUG_ON(PT_REGS_COUNT != sizeof(struct user_pt_regs) / sizeof(unsigned long));
442 
443 	/*
444 	 * PT_DSCR isn't a real reg, but it's important that it doesn't overlap the
445 	 * real registers.
446 	 */
447 	BUILD_BUG_ON(PT_DSCR < sizeof(struct user_pt_regs) / sizeof(unsigned long));
448 }
449