ptrace.c 9.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339
  1. // SPDX-License-Identifier: GPL-2.0
  2. /* ptrace.c */
  3. /* By Ross Biro 1/23/92 */
  4. /* edited by Linus Torvalds */
  5. /* mangled further by Bob Manson (manson@santafe.edu) */
  6. /* more mutilation by David Mosberger (davidm@azstarnet.com) */
  7. #include <linux/kernel.h>
  8. #include <linux/sched.h>
  9. #include <linux/sched/task_stack.h>
  10. #include <linux/mm.h>
  11. #include <linux/smp.h>
  12. #include <linux/errno.h>
  13. #include <linux/ptrace.h>
  14. #include <linux/user.h>
  15. #include <linux/security.h>
  16. #include <linux/signal.h>
  17. #include <linux/tracehook.h>
  18. #include <linux/audit.h>
  19. #include <linux/uaccess.h>
  20. #include <asm/pgtable.h>
  21. #include <asm/fpu.h>
  22. #include "proto.h"
  23. #define DEBUG DBG_MEM
  24. #undef DEBUG
  25. #ifdef DEBUG
  26. enum {
  27. DBG_MEM = (1<<0),
  28. DBG_BPT = (1<<1),
  29. DBG_MEM_ALL = (1<<2)
  30. };
  31. #define DBG(fac,args) {if ((fac) & DEBUG) printk args;}
  32. #else
  33. #define DBG(fac,args)
  34. #endif
  35. #define BREAKINST 0x00000080 /* call_pal bpt */
  36. /*
  37. * does not yet catch signals sent when the child dies.
  38. * in exit.c or in signal.c.
  39. */
  40. /*
  41. * Processes always block with the following stack-layout:
  42. *
  43. * +================================+ <---- task + 2*PAGE_SIZE
  44. * | PALcode saved frame (ps, pc, | ^
  45. * | gp, a0, a1, a2) | |
  46. * +================================+ | struct pt_regs
  47. * | | |
  48. * | frame generated by SAVE_ALL | |
  49. * | | v
  50. * +================================+
  51. * | | ^
  52. * | frame saved by do_switch_stack | | struct switch_stack
  53. * | | v
  54. * +================================+
  55. */
  56. /*
  57. * The following table maps a register index into the stack offset at
  58. * which the register is saved. Register indices are 0-31 for integer
  59. * regs, 32-63 for fp regs, and 64 for the pc. Notice that sp and
  60. * zero have no stack-slot and need to be treated specially (see
  61. * get_reg/put_reg below).
  62. */
  63. enum {
  64. REG_R0 = 0, REG_F0 = 32, REG_FPCR = 63, REG_PC = 64
  65. };
  66. #define PT_REG(reg) \
  67. (PAGE_SIZE*2 - sizeof(struct pt_regs) + offsetof(struct pt_regs, reg))
  68. #define SW_REG(reg) \
  69. (PAGE_SIZE*2 - sizeof(struct pt_regs) - sizeof(struct switch_stack) \
  70. + offsetof(struct switch_stack, reg))
  71. static int regoff[] = {
  72. PT_REG( r0), PT_REG( r1), PT_REG( r2), PT_REG( r3),
  73. PT_REG( r4), PT_REG( r5), PT_REG( r6), PT_REG( r7),
  74. PT_REG( r8), SW_REG( r9), SW_REG( r10), SW_REG( r11),
  75. SW_REG( r12), SW_REG( r13), SW_REG( r14), SW_REG( r15),
  76. PT_REG( r16), PT_REG( r17), PT_REG( r18), PT_REG( r19),
  77. PT_REG( r20), PT_REG( r21), PT_REG( r22), PT_REG( r23),
  78. PT_REG( r24), PT_REG( r25), PT_REG( r26), PT_REG( r27),
  79. PT_REG( r28), PT_REG( gp), -1, -1,
  80. SW_REG(fp[ 0]), SW_REG(fp[ 1]), SW_REG(fp[ 2]), SW_REG(fp[ 3]),
  81. SW_REG(fp[ 4]), SW_REG(fp[ 5]), SW_REG(fp[ 6]), SW_REG(fp[ 7]),
  82. SW_REG(fp[ 8]), SW_REG(fp[ 9]), SW_REG(fp[10]), SW_REG(fp[11]),
  83. SW_REG(fp[12]), SW_REG(fp[13]), SW_REG(fp[14]), SW_REG(fp[15]),
  84. SW_REG(fp[16]), SW_REG(fp[17]), SW_REG(fp[18]), SW_REG(fp[19]),
  85. SW_REG(fp[20]), SW_REG(fp[21]), SW_REG(fp[22]), SW_REG(fp[23]),
  86. SW_REG(fp[24]), SW_REG(fp[25]), SW_REG(fp[26]), SW_REG(fp[27]),
  87. SW_REG(fp[28]), SW_REG(fp[29]), SW_REG(fp[30]), SW_REG(fp[31]),
  88. PT_REG( pc)
  89. };
  90. static unsigned long zero;
  91. /*
  92. * Get address of register REGNO in task TASK.
  93. */
  94. static unsigned long *
  95. get_reg_addr(struct task_struct * task, unsigned long regno)
  96. {
  97. unsigned long *addr;
  98. if (regno == 30) {
  99. addr = &task_thread_info(task)->pcb.usp;
  100. } else if (regno == 65) {
  101. addr = &task_thread_info(task)->pcb.unique;
  102. } else if (regno == 31 || regno > 65) {
  103. zero = 0;
  104. addr = &zero;
  105. } else {
  106. addr = task_stack_page(task) + regoff[regno];
  107. }
  108. return addr;
  109. }
  110. /*
  111. * Get contents of register REGNO in task TASK.
  112. */
  113. static unsigned long
  114. get_reg(struct task_struct * task, unsigned long regno)
  115. {
  116. /* Special hack for fpcr -- combine hardware and software bits. */
  117. if (regno == 63) {
  118. unsigned long fpcr = *get_reg_addr(task, regno);
  119. unsigned long swcr
  120. = task_thread_info(task)->ieee_state & IEEE_SW_MASK;
  121. swcr = swcr_update_status(swcr, fpcr);
  122. return fpcr | swcr;
  123. }
  124. return *get_reg_addr(task, regno);
  125. }
  126. /*
  127. * Write contents of register REGNO in task TASK.
  128. */
  129. static int
  130. put_reg(struct task_struct *task, unsigned long regno, unsigned long data)
  131. {
  132. if (regno == 63) {
  133. task_thread_info(task)->ieee_state
  134. = ((task_thread_info(task)->ieee_state & ~IEEE_SW_MASK)
  135. | (data & IEEE_SW_MASK));
  136. data = (data & FPCR_DYN_MASK) | ieee_swcr_to_fpcr(data);
  137. }
  138. *get_reg_addr(task, regno) = data;
  139. return 0;
  140. }
  141. static inline int
  142. read_int(struct task_struct *task, unsigned long addr, int * data)
  143. {
  144. int copied = access_process_vm(task, addr, data, sizeof(int),
  145. FOLL_FORCE);
  146. return (copied == sizeof(int)) ? 0 : -EIO;
  147. }
  148. static inline int
  149. write_int(struct task_struct *task, unsigned long addr, int data)
  150. {
  151. int copied = access_process_vm(task, addr, &data, sizeof(int),
  152. FOLL_FORCE | FOLL_WRITE);
  153. return (copied == sizeof(int)) ? 0 : -EIO;
  154. }
  155. /*
  156. * Set breakpoint.
  157. */
  158. int
  159. ptrace_set_bpt(struct task_struct * child)
  160. {
  161. int displ, i, res, reg_b, nsaved = 0;
  162. unsigned int insn, op_code;
  163. unsigned long pc;
  164. pc = get_reg(child, REG_PC);
  165. res = read_int(child, pc, (int *) &insn);
  166. if (res < 0)
  167. return res;
  168. op_code = insn >> 26;
  169. if (op_code >= 0x30) {
  170. /*
  171. * It's a branch: instead of trying to figure out
  172. * whether the branch will be taken or not, we'll put
  173. * a breakpoint at either location. This is simpler,
  174. * more reliable, and probably not a whole lot slower
  175. * than the alternative approach of emulating the
  176. * branch (emulation can be tricky for fp branches).
  177. */
  178. displ = ((s32)(insn << 11)) >> 9;
  179. task_thread_info(child)->bpt_addr[nsaved++] = pc + 4;
  180. if (displ) /* guard against unoptimized code */
  181. task_thread_info(child)->bpt_addr[nsaved++]
  182. = pc + 4 + displ;
  183. DBG(DBG_BPT, ("execing branch\n"));
  184. } else if (op_code == 0x1a) {
  185. reg_b = (insn >> 16) & 0x1f;
  186. task_thread_info(child)->bpt_addr[nsaved++] = get_reg(child, reg_b);
  187. DBG(DBG_BPT, ("execing jump\n"));
  188. } else {
  189. task_thread_info(child)->bpt_addr[nsaved++] = pc + 4;
  190. DBG(DBG_BPT, ("execing normal insn\n"));
  191. }
  192. /* install breakpoints: */
  193. for (i = 0; i < nsaved; ++i) {
  194. res = read_int(child, task_thread_info(child)->bpt_addr[i],
  195. (int *) &insn);
  196. if (res < 0)
  197. return res;
  198. task_thread_info(child)->bpt_insn[i] = insn;
  199. DBG(DBG_BPT, (" -> next_pc=%lx\n",
  200. task_thread_info(child)->bpt_addr[i]));
  201. res = write_int(child, task_thread_info(child)->bpt_addr[i],
  202. BREAKINST);
  203. if (res < 0)
  204. return res;
  205. }
  206. task_thread_info(child)->bpt_nsaved = nsaved;
  207. return 0;
  208. }
  209. /*
  210. * Ensure no single-step breakpoint is pending. Returns non-zero
  211. * value if child was being single-stepped.
  212. */
  213. int
  214. ptrace_cancel_bpt(struct task_struct * child)
  215. {
  216. int i, nsaved = task_thread_info(child)->bpt_nsaved;
  217. task_thread_info(child)->bpt_nsaved = 0;
  218. if (nsaved > 2) {
  219. printk("ptrace_cancel_bpt: bogus nsaved: %d!\n", nsaved);
  220. nsaved = 2;
  221. }
  222. for (i = 0; i < nsaved; ++i) {
  223. write_int(child, task_thread_info(child)->bpt_addr[i],
  224. task_thread_info(child)->bpt_insn[i]);
  225. }
  226. return (nsaved != 0);
  227. }
  228. void user_enable_single_step(struct task_struct *child)
  229. {
  230. /* Mark single stepping. */
  231. task_thread_info(child)->bpt_nsaved = -1;
  232. }
  233. void user_disable_single_step(struct task_struct *child)
  234. {
  235. ptrace_cancel_bpt(child);
  236. }
  237. /*
  238. * Called by kernel/ptrace.c when detaching..
  239. *
  240. * Make sure the single step bit is not set.
  241. */
  242. void ptrace_disable(struct task_struct *child)
  243. {
  244. user_disable_single_step(child);
  245. }
  246. long arch_ptrace(struct task_struct *child, long request,
  247. unsigned long addr, unsigned long data)
  248. {
  249. unsigned long tmp;
  250. size_t copied;
  251. long ret;
  252. switch (request) {
  253. /* When I and D space are separate, these will need to be fixed. */
  254. case PTRACE_PEEKTEXT: /* read word at location addr. */
  255. case PTRACE_PEEKDATA:
  256. copied = ptrace_access_vm(child, addr, &tmp, sizeof(tmp),
  257. FOLL_FORCE);
  258. ret = -EIO;
  259. if (copied != sizeof(tmp))
  260. break;
  261. force_successful_syscall_return();
  262. ret = tmp;
  263. break;
  264. /* Read register number ADDR. */
  265. case PTRACE_PEEKUSR:
  266. force_successful_syscall_return();
  267. ret = get_reg(child, addr);
  268. DBG(DBG_MEM, ("peek $%lu->%#lx\n", addr, ret));
  269. break;
  270. /* When I and D space are separate, this will have to be fixed. */
  271. case PTRACE_POKETEXT: /* write the word at location addr. */
  272. case PTRACE_POKEDATA:
  273. ret = generic_ptrace_pokedata(child, addr, data);
  274. break;
  275. case PTRACE_POKEUSR: /* write the specified register */
  276. DBG(DBG_MEM, ("poke $%lu<-%#lx\n", addr, data));
  277. ret = put_reg(child, addr, data);
  278. break;
  279. default:
  280. ret = ptrace_request(child, request, addr, data);
  281. break;
  282. }
  283. return ret;
  284. }
  285. asmlinkage unsigned long syscall_trace_enter(void)
  286. {
  287. unsigned long ret = 0;
  288. struct pt_regs *regs = current_pt_regs();
  289. if (test_thread_flag(TIF_SYSCALL_TRACE) &&
  290. tracehook_report_syscall_entry(current_pt_regs()))
  291. ret = -1UL;
  292. audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
  293. return ret ?: current_pt_regs()->r0;
  294. }
  295. asmlinkage void
  296. syscall_trace_leave(void)
  297. {
  298. audit_syscall_exit(current_pt_regs());
  299. if (test_thread_flag(TIF_SYSCALL_TRACE))
  300. tracehook_report_syscall_exit(current_pt_regs(), 0);
  301. }