Michael Schmitz <schmitzmic@xxxxxxxxx> writes:
m68k version of Eric's patch series 'alpha/ptrace: Improved
switch_stack handling'.
Registers d6, d7, a3-a6 are not saved on the stack by default
on every syscall entry by the m68k kernel. A separate switch
stack frame is pushed to save those registers as needed.
This leaves the majority of syscalls with only a subset of
registers on the stack, and access to unsaved registers in
those would expose or modify random stack addresses.
Patch 1 and 2 add a switch stack for all syscalls that were
found to need one to allow ptrace access to all registers
outside of syscall entry/exit tracing, as well as kernel
worker threads. This ought to protect against accidents.
Patch 3 adds safety checks and debug output to m68k get_reg()
and put_reg() functions. Any unsafe register access during
process tracing will be prevented and reported.
Suggestions for optimizations or improvements welcome!
Cheers,
Michael
Link: https://lore.kernel.org/r/<87pmwlek8d.fsf_-_@disp2133>
I have been digging into this some more and I have found one place
that I am having a challenge dealing with.
In arch/m68k/fpsp040/skeleton.S there is an assembly version of
copy_from_user that calls fpsp040_die when the bytes can not be read.
Now fpsp040_die is just:
/*
* This function is called if an error occur while accessing
* user-space from the fpsp040 code.
*/
asmlinkage void fpsp040_die(void)
{
do_exit(SIGSEGV);
}
The problem here is the instruction emulation performed in the fpsp040
code performs a very minimal saving of registers. I don't think even
the normal system call entry point registers that are saved are present
at that point.
Is there any chance you can help me figure out how to get a stack frame
with all of the registers present before fpsp040_die is called?
Eric
