blob: 285a82d491efb9730adc4f8c6530a6fc72384340 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/* ptrace.c */
2/* By Ross Biro 1/23/92 */
3/* edited by Linus Torvalds */
4/* mangled further by Bob Manson (manson@santafe.edu) */
5/* more mutilation by David Mosberger (davidm@azstarnet.com) */
6
7#include <linux/kernel.h>
8#include <linux/sched.h>
Ingo Molnar68db0cf2017-02-08 18:51:37 +01009#include <linux/sched/task_stack.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010#include <linux/mm.h>
11#include <linux/smp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/errno.h>
13#include <linux/ptrace.h>
14#include <linux/user.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070015#include <linux/security.h>
Jesper Juhl7ed20e12005-05-01 08:59:14 -070016#include <linux/signal.h>
Al Viro12f79be2012-05-26 21:44:21 -040017#include <linux/tracehook.h>
蔡正龙a9302e82013-12-20 10:04:10 +080018#include <linux/audit.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070019
Linus Torvalds7c0f6ba2016-12-24 11:46:01 -080020#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070021#include <asm/pgtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070022#include <asm/fpu.h>
23
24#include "proto.h"
25
26#define DEBUG DBG_MEM
27#undef DEBUG
28
29#ifdef DEBUG
30enum {
31 DBG_MEM = (1<<0),
32 DBG_BPT = (1<<1),
33 DBG_MEM_ALL = (1<<2)
34};
35#define DBG(fac,args) {if ((fac) & DEBUG) printk args;}
36#else
37#define DBG(fac,args)
38#endif
39
40#define BREAKINST 0x00000080 /* call_pal bpt */
41
42/*
43 * does not yet catch signals sent when the child dies.
44 * in exit.c or in signal.c.
45 */
46
47/*
48 * Processes always block with the following stack-layout:
49 *
50 * +================================+ <---- task + 2*PAGE_SIZE
51 * | PALcode saved frame (ps, pc, | ^
52 * | gp, a0, a1, a2) | |
53 * +================================+ | struct pt_regs
54 * | | |
55 * | frame generated by SAVE_ALL | |
56 * | | v
57 * +================================+
58 * | | ^
59 * | frame saved by do_switch_stack | | struct switch_stack
60 * | | v
61 * +================================+
62 */
63
64/*
65 * The following table maps a register index into the stack offset at
66 * which the register is saved. Register indices are 0-31 for integer
67 * regs, 32-63 for fp regs, and 64 for the pc. Notice that sp and
68 * zero have no stack-slot and need to be treated specially (see
69 * get_reg/put_reg below).
70 */
71enum {
72 REG_R0 = 0, REG_F0 = 32, REG_FPCR = 63, REG_PC = 64
73};
74
akpm@osdl.orge52f4ca2006-01-12 01:05:37 -080075#define PT_REG(reg) \
76 (PAGE_SIZE*2 - sizeof(struct pt_regs) + offsetof(struct pt_regs, reg))
77
78#define SW_REG(reg) \
79 (PAGE_SIZE*2 - sizeof(struct pt_regs) - sizeof(struct switch_stack) \
80 + offsetof(struct switch_stack, reg))
81
Linus Torvalds1da177e2005-04-16 15:20:36 -070082static int regoff[] = {
83 PT_REG( r0), PT_REG( r1), PT_REG( r2), PT_REG( r3),
84 PT_REG( r4), PT_REG( r5), PT_REG( r6), PT_REG( r7),
85 PT_REG( r8), SW_REG( r9), SW_REG( r10), SW_REG( r11),
86 SW_REG( r12), SW_REG( r13), SW_REG( r14), SW_REG( r15),
87 PT_REG( r16), PT_REG( r17), PT_REG( r18), PT_REG( r19),
88 PT_REG( r20), PT_REG( r21), PT_REG( r22), PT_REG( r23),
89 PT_REG( r24), PT_REG( r25), PT_REG( r26), PT_REG( r27),
90 PT_REG( r28), PT_REG( gp), -1, -1,
91 SW_REG(fp[ 0]), SW_REG(fp[ 1]), SW_REG(fp[ 2]), SW_REG(fp[ 3]),
92 SW_REG(fp[ 4]), SW_REG(fp[ 5]), SW_REG(fp[ 6]), SW_REG(fp[ 7]),
93 SW_REG(fp[ 8]), SW_REG(fp[ 9]), SW_REG(fp[10]), SW_REG(fp[11]),
94 SW_REG(fp[12]), SW_REG(fp[13]), SW_REG(fp[14]), SW_REG(fp[15]),
95 SW_REG(fp[16]), SW_REG(fp[17]), SW_REG(fp[18]), SW_REG(fp[19]),
96 SW_REG(fp[20]), SW_REG(fp[21]), SW_REG(fp[22]), SW_REG(fp[23]),
97 SW_REG(fp[24]), SW_REG(fp[25]), SW_REG(fp[26]), SW_REG(fp[27]),
98 SW_REG(fp[28]), SW_REG(fp[29]), SW_REG(fp[30]), SW_REG(fp[31]),
99 PT_REG( pc)
100};
101
102static unsigned long zero;
103
104/*
105 * Get address of register REGNO in task TASK.
106 */
107static unsigned long *
108get_reg_addr(struct task_struct * task, unsigned long regno)
109{
110 unsigned long *addr;
111
112 if (regno == 30) {
Al Viro37bfbaf2006-01-12 01:05:36 -0800113 addr = &task_thread_info(task)->pcb.usp;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700114 } else if (regno == 65) {
Al Viro37bfbaf2006-01-12 01:05:36 -0800115 addr = &task_thread_info(task)->pcb.unique;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 } else if (regno == 31 || regno > 65) {
117 zero = 0;
118 addr = &zero;
119 } else {
Al Viro27f45132006-01-12 01:05:36 -0800120 addr = task_stack_page(task) + regoff[regno];
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121 }
122 return addr;
123}
124
125/*
126 * Get contents of register REGNO in task TASK.
127 */
128static unsigned long
129get_reg(struct task_struct * task, unsigned long regno)
130{
131 /* Special hack for fpcr -- combine hardware and software bits. */
132 if (regno == 63) {
133 unsigned long fpcr = *get_reg_addr(task, regno);
134 unsigned long swcr
Al Viro37bfbaf2006-01-12 01:05:36 -0800135 = task_thread_info(task)->ieee_state & IEEE_SW_MASK;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136 swcr = swcr_update_status(swcr, fpcr);
137 return fpcr | swcr;
138 }
139 return *get_reg_addr(task, regno);
140}
141
142/*
143 * Write contents of register REGNO in task TASK.
144 */
145static int
146put_reg(struct task_struct *task, unsigned long regno, unsigned long data)
147{
148 if (regno == 63) {
Al Viro37bfbaf2006-01-12 01:05:36 -0800149 task_thread_info(task)->ieee_state
150 = ((task_thread_info(task)->ieee_state & ~IEEE_SW_MASK)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700151 | (data & IEEE_SW_MASK));
152 data = (data & FPCR_DYN_MASK) | ieee_swcr_to_fpcr(data);
153 }
154 *get_reg_addr(task, regno) = data;
155 return 0;
156}
157
158static inline int
159read_int(struct task_struct *task, unsigned long addr, int * data)
160{
Lorenzo Stoakesf307ab62016-10-13 01:20:20 +0100161 int copied = access_process_vm(task, addr, data, sizeof(int),
162 FOLL_FORCE);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700163 return (copied == sizeof(int)) ? 0 : -EIO;
164}
165
166static inline int
167write_int(struct task_struct *task, unsigned long addr, int data)
168{
Lorenzo Stoakesf307ab62016-10-13 01:20:20 +0100169 int copied = access_process_vm(task, addr, &data, sizeof(int),
170 FOLL_FORCE | FOLL_WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700171 return (copied == sizeof(int)) ? 0 : -EIO;
172}
173
174/*
175 * Set breakpoint.
176 */
177int
178ptrace_set_bpt(struct task_struct * child)
179{
180 int displ, i, res, reg_b, nsaved = 0;
181 unsigned int insn, op_code;
182 unsigned long pc;
183
184 pc = get_reg(child, REG_PC);
185 res = read_int(child, pc, (int *) &insn);
186 if (res < 0)
187 return res;
188
189 op_code = insn >> 26;
190 if (op_code >= 0x30) {
191 /*
192 * It's a branch: instead of trying to figure out
193 * whether the branch will be taken or not, we'll put
194 * a breakpoint at either location. This is simpler,
195 * more reliable, and probably not a whole lot slower
196 * than the alternative approach of emulating the
197 * branch (emulation can be tricky for fp branches).
198 */
199 displ = ((s32)(insn << 11)) >> 9;
Al Viro37bfbaf2006-01-12 01:05:36 -0800200 task_thread_info(child)->bpt_addr[nsaved++] = pc + 4;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700201 if (displ) /* guard against unoptimized code */
Al Viro37bfbaf2006-01-12 01:05:36 -0800202 task_thread_info(child)->bpt_addr[nsaved++]
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203 = pc + 4 + displ;
204 DBG(DBG_BPT, ("execing branch\n"));
205 } else if (op_code == 0x1a) {
206 reg_b = (insn >> 16) & 0x1f;
Al Viro37bfbaf2006-01-12 01:05:36 -0800207 task_thread_info(child)->bpt_addr[nsaved++] = get_reg(child, reg_b);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208 DBG(DBG_BPT, ("execing jump\n"));
209 } else {
Al Viro37bfbaf2006-01-12 01:05:36 -0800210 task_thread_info(child)->bpt_addr[nsaved++] = pc + 4;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700211 DBG(DBG_BPT, ("execing normal insn\n"));
212 }
213
214 /* install breakpoints: */
215 for (i = 0; i < nsaved; ++i) {
Al Viro37bfbaf2006-01-12 01:05:36 -0800216 res = read_int(child, task_thread_info(child)->bpt_addr[i],
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 (int *) &insn);
218 if (res < 0)
219 return res;
Al Viro37bfbaf2006-01-12 01:05:36 -0800220 task_thread_info(child)->bpt_insn[i] = insn;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 DBG(DBG_BPT, (" -> next_pc=%lx\n",
Al Viro37bfbaf2006-01-12 01:05:36 -0800222 task_thread_info(child)->bpt_addr[i]));
223 res = write_int(child, task_thread_info(child)->bpt_addr[i],
Linus Torvalds1da177e2005-04-16 15:20:36 -0700224 BREAKINST);
225 if (res < 0)
226 return res;
227 }
Al Viro37bfbaf2006-01-12 01:05:36 -0800228 task_thread_info(child)->bpt_nsaved = nsaved;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700229 return 0;
230}
231
232/*
233 * Ensure no single-step breakpoint is pending. Returns non-zero
234 * value if child was being single-stepped.
235 */
236int
237ptrace_cancel_bpt(struct task_struct * child)
238{
Al Viro37bfbaf2006-01-12 01:05:36 -0800239 int i, nsaved = task_thread_info(child)->bpt_nsaved;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700240
Al Viro37bfbaf2006-01-12 01:05:36 -0800241 task_thread_info(child)->bpt_nsaved = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242
243 if (nsaved > 2) {
244 printk("ptrace_cancel_bpt: bogus nsaved: %d!\n", nsaved);
245 nsaved = 2;
246 }
247
248 for (i = 0; i < nsaved; ++i) {
Al Viro37bfbaf2006-01-12 01:05:36 -0800249 write_int(child, task_thread_info(child)->bpt_addr[i],
250 task_thread_info(child)->bpt_insn[i]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251 }
252 return (nsaved != 0);
253}
254
Christoph Hellwigfd341ab2010-03-10 15:22:47 -0800255void user_enable_single_step(struct task_struct *child)
256{
257 /* Mark single stepping. */
258 task_thread_info(child)->bpt_nsaved = -1;
259}
260
261void user_disable_single_step(struct task_struct *child)
262{
263 ptrace_cancel_bpt(child);
264}
265
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266/*
267 * Called by kernel/ptrace.c when detaching..
268 *
269 * Make sure the single step bit is not set.
270 */
271void ptrace_disable(struct task_struct *child)
272{
Christoph Hellwigfd341ab2010-03-10 15:22:47 -0800273 user_disable_single_step(child);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700274}
275
Namhyung Kim9b05a692010-10-27 15:33:47 -0700276long arch_ptrace(struct task_struct *child, long request,
277 unsigned long addr, unsigned long data)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700278{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700279 unsigned long tmp;
280 size_t copied;
281 long ret;
282
Linus Torvalds1da177e2005-04-16 15:20:36 -0700283 switch (request) {
284 /* When I and D space are separate, these will need to be fixed. */
285 case PTRACE_PEEKTEXT: /* read word at location addr. */
286 case PTRACE_PEEKDATA:
Eric W. Biederman84d77d32016-11-22 12:06:50 -0600287 copied = ptrace_access_vm(child, addr, &tmp, sizeof(tmp),
Lorenzo Stoakesf307ab62016-10-13 01:20:20 +0100288 FOLL_FORCE);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700289 ret = -EIO;
290 if (copied != sizeof(tmp))
291 break;
292
Christoph Hellwiga5f833f2007-10-16 01:26:34 -0700293 force_successful_syscall_return();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700294 ret = tmp;
295 break;
296
297 /* Read register number ADDR. */
298 case PTRACE_PEEKUSR:
Christoph Hellwiga5f833f2007-10-16 01:26:34 -0700299 force_successful_syscall_return();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700300 ret = get_reg(child, addr);
Namhyung Kim9b05a692010-10-27 15:33:47 -0700301 DBG(DBG_MEM, ("peek $%lu->%#lx\n", addr, ret));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700302 break;
303
304 /* When I and D space are separate, this will have to be fixed. */
305 case PTRACE_POKETEXT: /* write the word at location addr. */
306 case PTRACE_POKEDATA:
Alexey Dobriyanf284ce72007-07-17 04:03:44 -0700307 ret = generic_ptrace_pokedata(child, addr, data);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700308 break;
309
310 case PTRACE_POKEUSR: /* write the specified register */
Namhyung Kim9b05a692010-10-27 15:33:47 -0700311 DBG(DBG_MEM, ("poke $%lu<-%#lx\n", addr, data));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700312 ret = put_reg(child, addr, data);
313 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700314 default:
315 ret = ptrace_request(child, request, addr, data);
Christoph Hellwiga5f833f2007-10-16 01:26:34 -0700316 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700317 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700318 return ret;
319}
320
Al Viro12f79be2012-05-26 21:44:21 -0400321asmlinkage unsigned long syscall_trace_enter(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700322{
Al Viro12f79be2012-05-26 21:44:21 -0400323 unsigned long ret = 0;
蔡正龙a9302e82013-12-20 10:04:10 +0800324 struct pt_regs *regs = current_pt_regs();
Al Viro12f79be2012-05-26 21:44:21 -0400325 if (test_thread_flag(TIF_SYSCALL_TRACE) &&
326 tracehook_report_syscall_entry(current_pt_regs()))
327 ret = -1UL;
Eric Paris91397402014-03-11 13:29:28 -0400328 audit_syscall_entry(regs->r0, regs->r16, regs->r17, regs->r18, regs->r19);
Al Viro12f79be2012-05-26 21:44:21 -0400329 return ret ?: current_pt_regs()->r0;
330}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700331
Al Viro12f79be2012-05-26 21:44:21 -0400332asmlinkage void
333syscall_trace_leave(void)
334{
蔡正龙a9302e82013-12-20 10:04:10 +0800335 audit_syscall_exit(current_pt_regs());
Al Viro12f79be2012-05-26 21:44:21 -0400336 if (test_thread_flag(TIF_SYSCALL_TRACE))
337 tracehook_report_syscall_exit(current_pt_regs(), 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338}