| Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* ptrace.c */ | 
|  | 2 | /* By Ross Biro 1/23/92 */ | 
|  | 3 | /* edited by Linus Torvalds */ | 
|  | 4 | /* mangled further by Bob Manson (manson@santafe.edu) */ | 
|  | 5 | /* more mutilation by David Mosberger (davidm@azstarnet.com) */ | 
|  | 6 |  | 
|  | 7 | #include <linux/kernel.h> | 
|  | 8 | #include <linux/sched.h> | 
|  | 9 | #include <linux/mm.h> | 
|  | 10 | #include <linux/smp.h> | 
|  | 11 | #include <linux/smp_lock.h> | 
|  | 12 | #include <linux/errno.h> | 
|  | 13 | #include <linux/ptrace.h> | 
|  | 14 | #include <linux/user.h> | 
|  | 15 | #include <linux/slab.h> | 
|  | 16 | #include <linux/security.h> | 
| Jesper Juhl | 7ed20e1 | 2005-05-01 08:59:14 -0700 | [diff] [blame] | 17 | #include <linux/signal.h> | 
| Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 |  | 
|  | 19 | #include <asm/uaccess.h> | 
|  | 20 | #include <asm/pgtable.h> | 
|  | 21 | #include <asm/system.h> | 
|  | 22 | #include <asm/fpu.h> | 
|  | 23 |  | 
|  | 24 | #include "proto.h" | 
|  | 25 |  | 
|  | 26 | #define DEBUG	DBG_MEM | 
|  | 27 | #undef DEBUG | 
|  | 28 |  | 
|  | 29 | #ifdef DEBUG | 
|  | 30 | enum { | 
|  | 31 | DBG_MEM		= (1<<0), | 
|  | 32 | DBG_BPT		= (1<<1), | 
|  | 33 | DBG_MEM_ALL	= (1<<2) | 
|  | 34 | }; | 
|  | 35 | #define DBG(fac,args)	{if ((fac) & DEBUG) printk args;} | 
|  | 36 | #else | 
|  | 37 | #define DBG(fac,args) | 
|  | 38 | #endif | 
|  | 39 |  | 
|  | 40 | #define BREAKINST	0x00000080	/* call_pal bpt */ | 
|  | 41 |  | 
|  | 42 | /* | 
|  | 43 | * does not yet catch signals sent when the child dies. | 
|  | 44 | * in exit.c or in signal.c. | 
|  | 45 | */ | 
|  | 46 |  | 
|  | 47 | /* | 
|  | 48 | * Processes always block with the following stack-layout: | 
|  | 49 | * | 
|  | 50 | *  +================================+ <---- task + 2*PAGE_SIZE | 
|  | 51 | *  | PALcode saved frame (ps, pc,   | ^ | 
|  | 52 | *  | gp, a0, a1, a2)		     | | | 
|  | 53 | *  +================================+ | struct pt_regs | 
|  | 54 | *  |	        		     | | | 
|  | 55 | *  | frame generated by SAVE_ALL    | | | 
|  | 56 | *  |	        		     | v | 
|  | 57 | *  +================================+ | 
|  | 58 | *  |	        		     | ^ | 
|  | 59 | *  | frame saved by do_switch_stack | | struct switch_stack | 
|  | 60 | *  |	        		     | v | 
|  | 61 | *  +================================+ | 
|  | 62 | */ | 
|  | 63 |  | 
|  | 64 | /* | 
|  | 65 | * The following table maps a register index into the stack offset at | 
|  | 66 | * which the register is saved.  Register indices are 0-31 for integer | 
|  | 67 | * regs, 32-63 for fp regs, and 64 for the pc.  Notice that sp and | 
|  | 68 | * zero have no stack-slot and need to be treated specially (see | 
|  | 69 | * get_reg/put_reg below). | 
|  | 70 | */ | 
|  | 71 | enum { | 
|  | 72 | REG_R0 = 0, REG_F0 = 32, REG_FPCR = 63, REG_PC = 64 | 
|  | 73 | }; | 
|  | 74 |  | 
|  | 75 | static int regoff[] = { | 
|  | 76 | PT_REG(	   r0), PT_REG(	   r1), PT_REG(	   r2), PT_REG(	  r3), | 
|  | 77 | PT_REG(	   r4), PT_REG(	   r5), PT_REG(	   r6), PT_REG(	  r7), | 
|  | 78 | PT_REG(	   r8), SW_REG(	   r9), SW_REG(	  r10), SW_REG(	 r11), | 
|  | 79 | SW_REG(	  r12), SW_REG(	  r13), SW_REG(	  r14), SW_REG(	 r15), | 
|  | 80 | PT_REG(	  r16), PT_REG(	  r17), PT_REG(	  r18), PT_REG(	 r19), | 
|  | 81 | PT_REG(	  r20), PT_REG(	  r21), PT_REG(	  r22), PT_REG(	 r23), | 
|  | 82 | PT_REG(	  r24), PT_REG(	  r25), PT_REG(	  r26), PT_REG(	 r27), | 
|  | 83 | PT_REG(	  r28), PT_REG(	   gp),		   -1,		   -1, | 
|  | 84 | SW_REG(fp[ 0]), SW_REG(fp[ 1]), SW_REG(fp[ 2]), SW_REG(fp[ 3]), | 
|  | 85 | SW_REG(fp[ 4]), SW_REG(fp[ 5]), SW_REG(fp[ 6]), SW_REG(fp[ 7]), | 
|  | 86 | SW_REG(fp[ 8]), SW_REG(fp[ 9]), SW_REG(fp[10]), SW_REG(fp[11]), | 
|  | 87 | SW_REG(fp[12]), SW_REG(fp[13]), SW_REG(fp[14]), SW_REG(fp[15]), | 
|  | 88 | SW_REG(fp[16]), SW_REG(fp[17]), SW_REG(fp[18]), SW_REG(fp[19]), | 
|  | 89 | SW_REG(fp[20]), SW_REG(fp[21]), SW_REG(fp[22]), SW_REG(fp[23]), | 
|  | 90 | SW_REG(fp[24]), SW_REG(fp[25]), SW_REG(fp[26]), SW_REG(fp[27]), | 
|  | 91 | SW_REG(fp[28]), SW_REG(fp[29]), SW_REG(fp[30]), SW_REG(fp[31]), | 
|  | 92 | PT_REG(	   pc) | 
|  | 93 | }; | 
|  | 94 |  | 
|  | 95 | static unsigned long zero; | 
|  | 96 |  | 
|  | 97 | /* | 
|  | 98 | * Get address of register REGNO in task TASK. | 
|  | 99 | */ | 
|  | 100 | static unsigned long * | 
|  | 101 | get_reg_addr(struct task_struct * task, unsigned long regno) | 
|  | 102 | { | 
|  | 103 | unsigned long *addr; | 
|  | 104 |  | 
|  | 105 | if (regno == 30) { | 
|  | 106 | addr = &task->thread_info->pcb.usp; | 
|  | 107 | } else if (regno == 65) { | 
|  | 108 | addr = &task->thread_info->pcb.unique; | 
|  | 109 | } else if (regno == 31 || regno > 65) { | 
|  | 110 | zero = 0; | 
|  | 111 | addr = &zero; | 
|  | 112 | } else { | 
|  | 113 | addr = (void *)task->thread_info + regoff[regno]; | 
|  | 114 | } | 
|  | 115 | return addr; | 
|  | 116 | } | 
|  | 117 |  | 
|  | 118 | /* | 
|  | 119 | * Get contents of register REGNO in task TASK. | 
|  | 120 | */ | 
|  | 121 | static unsigned long | 
|  | 122 | get_reg(struct task_struct * task, unsigned long regno) | 
|  | 123 | { | 
|  | 124 | /* Special hack for fpcr -- combine hardware and software bits.  */ | 
|  | 125 | if (regno == 63) { | 
|  | 126 | unsigned long fpcr = *get_reg_addr(task, regno); | 
|  | 127 | unsigned long swcr | 
|  | 128 | = task->thread_info->ieee_state & IEEE_SW_MASK; | 
|  | 129 | swcr = swcr_update_status(swcr, fpcr); | 
|  | 130 | return fpcr | swcr; | 
|  | 131 | } | 
|  | 132 | return *get_reg_addr(task, regno); | 
|  | 133 | } | 
|  | 134 |  | 
|  | 135 | /* | 
|  | 136 | * Write contents of register REGNO in task TASK. | 
|  | 137 | */ | 
|  | 138 | static int | 
|  | 139 | put_reg(struct task_struct *task, unsigned long regno, unsigned long data) | 
|  | 140 | { | 
|  | 141 | if (regno == 63) { | 
|  | 142 | task->thread_info->ieee_state | 
|  | 143 | = ((task->thread_info->ieee_state & ~IEEE_SW_MASK) | 
|  | 144 | | (data & IEEE_SW_MASK)); | 
|  | 145 | data = (data & FPCR_DYN_MASK) | ieee_swcr_to_fpcr(data); | 
|  | 146 | } | 
|  | 147 | *get_reg_addr(task, regno) = data; | 
|  | 148 | return 0; | 
|  | 149 | } | 
|  | 150 |  | 
|  | 151 | static inline int | 
|  | 152 | read_int(struct task_struct *task, unsigned long addr, int * data) | 
|  | 153 | { | 
|  | 154 | int copied = access_process_vm(task, addr, data, sizeof(int), 0); | 
|  | 155 | return (copied == sizeof(int)) ? 0 : -EIO; | 
|  | 156 | } | 
|  | 157 |  | 
|  | 158 | static inline int | 
|  | 159 | write_int(struct task_struct *task, unsigned long addr, int data) | 
|  | 160 | { | 
|  | 161 | int copied = access_process_vm(task, addr, &data, sizeof(int), 1); | 
|  | 162 | return (copied == sizeof(int)) ? 0 : -EIO; | 
|  | 163 | } | 
|  | 164 |  | 
|  | 165 | /* | 
|  | 166 | * Set breakpoint. | 
|  | 167 | */ | 
|  | 168 | int | 
|  | 169 | ptrace_set_bpt(struct task_struct * child) | 
|  | 170 | { | 
|  | 171 | int displ, i, res, reg_b, nsaved = 0; | 
|  | 172 | unsigned int insn, op_code; | 
|  | 173 | unsigned long pc; | 
|  | 174 |  | 
|  | 175 | pc  = get_reg(child, REG_PC); | 
|  | 176 | res = read_int(child, pc, (int *) &insn); | 
|  | 177 | if (res < 0) | 
|  | 178 | return res; | 
|  | 179 |  | 
|  | 180 | op_code = insn >> 26; | 
|  | 181 | if (op_code >= 0x30) { | 
|  | 182 | /* | 
|  | 183 | * It's a branch: instead of trying to figure out | 
|  | 184 | * whether the branch will be taken or not, we'll put | 
|  | 185 | * a breakpoint at either location.  This is simpler, | 
|  | 186 | * more reliable, and probably not a whole lot slower | 
|  | 187 | * than the alternative approach of emulating the | 
|  | 188 | * branch (emulation can be tricky for fp branches). | 
|  | 189 | */ | 
|  | 190 | displ = ((s32)(insn << 11)) >> 9; | 
|  | 191 | child->thread_info->bpt_addr[nsaved++] = pc + 4; | 
|  | 192 | if (displ)		/* guard against unoptimized code */ | 
|  | 193 | child->thread_info->bpt_addr[nsaved++] | 
|  | 194 | = pc + 4 + displ; | 
|  | 195 | DBG(DBG_BPT, ("execing branch\n")); | 
|  | 196 | } else if (op_code == 0x1a) { | 
|  | 197 | reg_b = (insn >> 16) & 0x1f; | 
|  | 198 | child->thread_info->bpt_addr[nsaved++] = get_reg(child, reg_b); | 
|  | 199 | DBG(DBG_BPT, ("execing jump\n")); | 
|  | 200 | } else { | 
|  | 201 | child->thread_info->bpt_addr[nsaved++] = pc + 4; | 
|  | 202 | DBG(DBG_BPT, ("execing normal insn\n")); | 
|  | 203 | } | 
|  | 204 |  | 
|  | 205 | /* install breakpoints: */ | 
|  | 206 | for (i = 0; i < nsaved; ++i) { | 
|  | 207 | res = read_int(child, child->thread_info->bpt_addr[i], | 
|  | 208 | (int *) &insn); | 
|  | 209 | if (res < 0) | 
|  | 210 | return res; | 
|  | 211 | child->thread_info->bpt_insn[i] = insn; | 
|  | 212 | DBG(DBG_BPT, ("    -> next_pc=%lx\n", | 
|  | 213 | child->thread_info->bpt_addr[i])); | 
|  | 214 | res = write_int(child, child->thread_info->bpt_addr[i], | 
|  | 215 | BREAKINST); | 
|  | 216 | if (res < 0) | 
|  | 217 | return res; | 
|  | 218 | } | 
|  | 219 | child->thread_info->bpt_nsaved = nsaved; | 
|  | 220 | return 0; | 
|  | 221 | } | 
|  | 222 |  | 
|  | 223 | /* | 
|  | 224 | * Ensure no single-step breakpoint is pending.  Returns non-zero | 
|  | 225 | * value if child was being single-stepped. | 
|  | 226 | */ | 
|  | 227 | int | 
|  | 228 | ptrace_cancel_bpt(struct task_struct * child) | 
|  | 229 | { | 
|  | 230 | int i, nsaved = child->thread_info->bpt_nsaved; | 
|  | 231 |  | 
|  | 232 | child->thread_info->bpt_nsaved = 0; | 
|  | 233 |  | 
|  | 234 | if (nsaved > 2) { | 
|  | 235 | printk("ptrace_cancel_bpt: bogus nsaved: %d!\n", nsaved); | 
|  | 236 | nsaved = 2; | 
|  | 237 | } | 
|  | 238 |  | 
|  | 239 | for (i = 0; i < nsaved; ++i) { | 
|  | 240 | write_int(child, child->thread_info->bpt_addr[i], | 
|  | 241 | child->thread_info->bpt_insn[i]); | 
|  | 242 | } | 
|  | 243 | return (nsaved != 0); | 
|  | 244 | } | 
|  | 245 |  | 
|  | 246 | /* | 
|  | 247 | * Called by kernel/ptrace.c when detaching.. | 
|  | 248 | * | 
|  | 249 | * Make sure the single step bit is not set. | 
|  | 250 | */ | 
|  | 251 | void ptrace_disable(struct task_struct *child) | 
|  | 252 | { | 
|  | 253 | ptrace_cancel_bpt(child); | 
|  | 254 | } | 
|  | 255 |  | 
|  | 256 | asmlinkage long | 
|  | 257 | do_sys_ptrace(long request, long pid, long addr, long data, | 
|  | 258 | struct pt_regs *regs) | 
|  | 259 | { | 
|  | 260 | struct task_struct *child; | 
|  | 261 | unsigned long tmp; | 
|  | 262 | size_t copied; | 
|  | 263 | long ret; | 
|  | 264 |  | 
|  | 265 | lock_kernel(); | 
|  | 266 | DBG(DBG_MEM, ("request=%ld pid=%ld addr=0x%lx data=0x%lx\n", | 
|  | 267 | request, pid, addr, data)); | 
|  | 268 | ret = -EPERM; | 
|  | 269 | if (request == PTRACE_TRACEME) { | 
|  | 270 | /* are we already being traced? */ | 
|  | 271 | if (current->ptrace & PT_PTRACED) | 
|  | 272 | goto out_notsk; | 
|  | 273 | ret = security_ptrace(current->parent, current); | 
|  | 274 | if (ret) | 
|  | 275 | goto out_notsk; | 
|  | 276 | /* set the ptrace bit in the process ptrace flags. */ | 
|  | 277 | current->ptrace |= PT_PTRACED; | 
|  | 278 | ret = 0; | 
|  | 279 | goto out_notsk; | 
|  | 280 | } | 
|  | 281 | if (pid == 1)		/* you may not mess with init */ | 
|  | 282 | goto out_notsk; | 
|  | 283 |  | 
|  | 284 | ret = -ESRCH; | 
|  | 285 | read_lock(&tasklist_lock); | 
|  | 286 | child = find_task_by_pid(pid); | 
|  | 287 | if (child) | 
|  | 288 | get_task_struct(child); | 
|  | 289 | read_unlock(&tasklist_lock); | 
|  | 290 | if (!child) | 
|  | 291 | goto out_notsk; | 
|  | 292 |  | 
|  | 293 | if (request == PTRACE_ATTACH) { | 
|  | 294 | ret = ptrace_attach(child); | 
|  | 295 | goto out; | 
|  | 296 | } | 
|  | 297 |  | 
|  | 298 | ret = ptrace_check_attach(child, request == PTRACE_KILL); | 
|  | 299 | if (ret < 0) | 
|  | 300 | goto out; | 
|  | 301 |  | 
|  | 302 | switch (request) { | 
|  | 303 | /* When I and D space are separate, these will need to be fixed.  */ | 
|  | 304 | case PTRACE_PEEKTEXT: /* read word at location addr. */ | 
|  | 305 | case PTRACE_PEEKDATA: | 
|  | 306 | copied = access_process_vm(child, addr, &tmp, sizeof(tmp), 0); | 
|  | 307 | ret = -EIO; | 
|  | 308 | if (copied != sizeof(tmp)) | 
|  | 309 | break; | 
|  | 310 |  | 
|  | 311 | regs->r0 = 0;	/* special return: no errors */ | 
|  | 312 | ret = tmp; | 
|  | 313 | break; | 
|  | 314 |  | 
|  | 315 | /* Read register number ADDR. */ | 
|  | 316 | case PTRACE_PEEKUSR: | 
|  | 317 | regs->r0 = 0;	/* special return: no errors */ | 
|  | 318 | ret = get_reg(child, addr); | 
|  | 319 | DBG(DBG_MEM, ("peek $%ld->%#lx\n", addr, ret)); | 
|  | 320 | break; | 
|  | 321 |  | 
|  | 322 | /* When I and D space are separate, this will have to be fixed.  */ | 
|  | 323 | case PTRACE_POKETEXT: /* write the word at location addr. */ | 
|  | 324 | case PTRACE_POKEDATA: | 
|  | 325 | tmp = data; | 
|  | 326 | copied = access_process_vm(child, addr, &tmp, sizeof(tmp), 1); | 
|  | 327 | ret = (copied == sizeof(tmp)) ? 0 : -EIO; | 
|  | 328 | break; | 
|  | 329 |  | 
|  | 330 | case PTRACE_POKEUSR: /* write the specified register */ | 
|  | 331 | DBG(DBG_MEM, ("poke $%ld<-%#lx\n", addr, data)); | 
|  | 332 | ret = put_reg(child, addr, data); | 
|  | 333 | break; | 
|  | 334 |  | 
|  | 335 | case PTRACE_SYSCALL: | 
|  | 336 | /* continue and stop at next (return from) syscall */ | 
|  | 337 | case PTRACE_CONT:    /* restart after signal. */ | 
|  | 338 | ret = -EIO; | 
| Jesper Juhl | 7ed20e1 | 2005-05-01 08:59:14 -0700 | [diff] [blame] | 339 | if (!valid_signal(data)) | 
| Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 340 | break; | 
|  | 341 | if (request == PTRACE_SYSCALL) | 
|  | 342 | set_tsk_thread_flag(child, TIF_SYSCALL_TRACE); | 
|  | 343 | else | 
|  | 344 | clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); | 
|  | 345 | child->exit_code = data; | 
|  | 346 | /* make sure single-step breakpoint is gone. */ | 
|  | 347 | ptrace_cancel_bpt(child); | 
|  | 348 | wake_up_process(child); | 
|  | 349 | ret = 0; | 
|  | 350 | break; | 
|  | 351 |  | 
|  | 352 | /* | 
|  | 353 | * Make the child exit.  Best I can do is send it a sigkill. | 
|  | 354 | * perhaps it should be put in the status that it wants to | 
|  | 355 | * exit. | 
|  | 356 | */ | 
|  | 357 | case PTRACE_KILL: | 
|  | 358 | ret = 0; | 
|  | 359 | if (child->exit_state == EXIT_ZOMBIE) | 
|  | 360 | break; | 
|  | 361 | child->exit_code = SIGKILL; | 
|  | 362 | /* make sure single-step breakpoint is gone. */ | 
|  | 363 | ptrace_cancel_bpt(child); | 
|  | 364 | wake_up_process(child); | 
|  | 365 | goto out; | 
|  | 366 |  | 
|  | 367 | case PTRACE_SINGLESTEP:  /* execute single instruction. */ | 
|  | 368 | ret = -EIO; | 
| Jesper Juhl | 7ed20e1 | 2005-05-01 08:59:14 -0700 | [diff] [blame] | 369 | if (!valid_signal(data)) | 
| Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 370 | break; | 
|  | 371 | /* Mark single stepping.  */ | 
|  | 372 | child->thread_info->bpt_nsaved = -1; | 
|  | 373 | clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE); | 
|  | 374 | child->exit_code = data; | 
|  | 375 | wake_up_process(child); | 
|  | 376 | /* give it a chance to run. */ | 
|  | 377 | ret = 0; | 
|  | 378 | goto out; | 
|  | 379 |  | 
|  | 380 | case PTRACE_DETACH:	 /* detach a process that was attached. */ | 
|  | 381 | ret = ptrace_detach(child, data); | 
|  | 382 | goto out; | 
|  | 383 |  | 
|  | 384 | default: | 
|  | 385 | ret = ptrace_request(child, request, addr, data); | 
|  | 386 | goto out; | 
|  | 387 | } | 
|  | 388 | out: | 
|  | 389 | put_task_struct(child); | 
|  | 390 | out_notsk: | 
|  | 391 | unlock_kernel(); | 
|  | 392 | return ret; | 
|  | 393 | } | 
|  | 394 |  | 
|  | 395 | asmlinkage void | 
|  | 396 | syscall_trace(void) | 
|  | 397 | { | 
|  | 398 | if (!test_thread_flag(TIF_SYSCALL_TRACE)) | 
|  | 399 | return; | 
|  | 400 | if (!(current->ptrace & PT_PTRACED)) | 
|  | 401 | return; | 
|  | 402 | /* The 0x80 provides a way for the tracing parent to distinguish | 
|  | 403 | between a syscall stop and SIGTRAP delivery */ | 
|  | 404 | ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD) | 
|  | 405 | ? 0x80 : 0)); | 
|  | 406 |  | 
|  | 407 | /* | 
|  | 408 | * This isn't the same as continuing with a signal, but it will do | 
|  | 409 | * for normal use.  strace only continues with a signal if the | 
|  | 410 | * stopping signal is not SIGTRAP.  -brl | 
|  | 411 | */ | 
|  | 412 | if (current->exit_code) { | 
|  | 413 | send_sig(current->exit_code, current, 1); | 
|  | 414 | current->exit_code = 0; | 
|  | 415 | } | 
|  | 416 | } |