1
2
3
4
5
6
7
8
9
10
11
12#include <linux/kernel.h>
13#include <linux/sched.h>
14#include <linux/mm.h>
15#include <linux/smp.h>
16#include <linux/ptrace.h>
17#include <linux/user.h>
18#include <linux/security.h>
19#include <linux/init.h>
20#include <linux/signal.h>
21#include <linux/uaccess.h>
22
23#include <asm/pgtable.h>
24#include <asm/system.h>
25#include <asm/traps.h>
26
27#include "ptrace.h"
28
29#define REG_PC 15
30#define REG_PSR 16
31
32
33
34
35
36#if 0
37
38
39
40#define BREAKINST_ARM 0xef9f0001
41#define BREAKINST_THUMB 0xdf00
42#else
43
44
45
46
47
48
49
50
51#define BREAKINST_ARM 0xe7f001f0
52#define BREAKINST_THUMB 0xde01
53#endif
54
55
56
57
58
59
60
61static inline long get_user_reg(struct task_struct *task, int offset)
62{
63 return task_pt_regs(task)->uregs[offset];
64}
65
66
67
68
69
70
71
72static inline int
73put_user_reg(struct task_struct *task, int offset, long data)
74{
75 struct pt_regs newregs, *regs = task_pt_regs(task);
76 int ret = -EINVAL;
77
78 newregs = *regs;
79 newregs.uregs[offset] = data;
80
81 if (valid_user_regs(&newregs)) {
82 regs->uregs[offset] = data;
83 ret = 0;
84 }
85
86 return ret;
87}
88
89static inline int
90read_u32(struct task_struct *task, unsigned long addr, u32 *res)
91{
92 int ret;
93
94 ret = access_process_vm(task, addr, res, sizeof(*res), 0);
95
96 return ret == sizeof(*res) ? 0 : -EIO;
97}
98
99static inline int
100read_instr(struct task_struct *task, unsigned long addr, u32 *res)
101{
102 int ret;
103
104 if (addr & 1) {
105 u16 val;
106 ret = access_process_vm(task, addr & ~1, &val, sizeof(val), 0);
107 ret = ret == sizeof(val) ? 0 : -EIO;
108 *res = val;
109 } else {
110 u32 val;
111 ret = access_process_vm(task, addr & ~3, &val, sizeof(val), 0);
112 ret = ret == sizeof(val) ? 0 : -EIO;
113 *res = val;
114 }
115 return ret;
116}
117
118
119
120
121static unsigned long
122ptrace_getrn(struct task_struct *child, unsigned long insn)
123{
124 unsigned int reg = (insn >> 16) & 15;
125 unsigned long val;
126
127 val = get_user_reg(child, reg);
128 if (reg == 15)
129 val += 8;
130
131 return val;
132}
133
134
135
136
137static unsigned long
138ptrace_getaluop2(struct task_struct *child, unsigned long insn)
139{
140 unsigned long val;
141 int shift;
142 int type;
143
144 if (insn & 1 << 25) {
145 val = insn & 255;
146 shift = (insn >> 8) & 15;
147 type = 3;
148 } else {
149 val = get_user_reg (child, insn & 15);
150
151 if (insn & (1 << 4))
152 shift = (int)get_user_reg (child, (insn >> 8) & 15);
153 else
154 shift = (insn >> 7) & 31;
155
156 type = (insn >> 5) & 3;
157 }
158
159 switch (type) {
160 case 0: val <<= shift; break;
161 case 1: val >>= shift; break;
162 case 2:
163 val = (((signed long)val) >> shift);
164 break;
165 case 3:
166 val = (val >> shift) | (val << (32 - shift));
167 break;
168 }
169 return val;
170}
171
172
173
174
175static unsigned long
176ptrace_getldrop2(struct task_struct *child, unsigned long insn)
177{
178 unsigned long val;
179 int shift;
180 int type;
181
182 val = get_user_reg(child, insn & 15);
183 shift = (insn >> 7) & 31;
184 type = (insn >> 5) & 3;
185
186 switch (type) {
187 case 0: val <<= shift; break;
188 case 1: val >>= shift; break;
189 case 2:
190 val = (((signed long)val) >> shift);
191 break;
192 case 3:
193 val = (val >> shift) | (val << (32 - shift));
194 break;
195 }
196 return val;
197}
198
199#define OP_MASK 0x01e00000
200#define OP_AND 0x00000000
201#define OP_EOR 0x00200000
202#define OP_SUB 0x00400000
203#define OP_RSB 0x00600000
204#define OP_ADD 0x00800000
205#define OP_ADC 0x00a00000
206#define OP_SBC 0x00c00000
207#define OP_RSC 0x00e00000
208#define OP_ORR 0x01800000
209#define OP_MOV 0x01a00000
210#define OP_BIC 0x01c00000
211#define OP_MVN 0x01e00000
212
213static unsigned long
214get_branch_address(struct task_struct *child, unsigned long pc, unsigned long insn)
215{
216 u32 alt = 0;
217
218 switch (insn & 0x0e000000) {
219 case 0x00000000:
220 case 0x02000000: {
221
222
223
224 long aluop1, aluop2, ccbit;
225
226 if ((insn & 0x0fffffd0) == 0x012fff10) {
227
228
229
230 alt = get_user_reg(child, insn & 15);
231 break;
232 }
233
234
235 if ((insn & 0xf000) != 0xf000)
236 break;
237
238 aluop1 = ptrace_getrn(child, insn);
239 aluop2 = ptrace_getaluop2(child, insn);
240 ccbit = get_user_reg(child, REG_PSR) & PSR_C_BIT ? 1 : 0;
241
242 switch (insn & OP_MASK) {
243 case OP_AND: alt = aluop1 & aluop2; break;
244 case OP_EOR: alt = aluop1 ^ aluop2; break;
245 case OP_SUB: alt = aluop1 - aluop2; break;
246 case OP_RSB: alt = aluop2 - aluop1; break;
247 case OP_ADD: alt = aluop1 + aluop2; break;
248 case OP_ADC: alt = aluop1 + aluop2 + ccbit; break;
249 case OP_SBC: alt = aluop1 - aluop2 + ccbit; break;
250 case OP_RSC: alt = aluop2 - aluop1 + ccbit; break;
251 case OP_ORR: alt = aluop1 | aluop2; break;
252 case OP_MOV: alt = aluop2; break;
253 case OP_BIC: alt = aluop1 & ~aluop2; break;
254 case OP_MVN: alt = ~aluop2; break;
255 }
256 break;
257 }
258
259 case 0x04000000:
260 case 0x06000000:
261
262
263
264 if ((insn & 0x0010f000) == 0x0010f000) {
265 unsigned long base;
266
267 base = ptrace_getrn(child, insn);
268 if (insn & 1 << 24) {
269 long aluop2;
270
271 if (insn & 0x02000000)
272 aluop2 = ptrace_getldrop2(child, insn);
273 else
274 aluop2 = insn & 0xfff;
275
276 if (insn & 1 << 23)
277 base += aluop2;
278 else
279 base -= aluop2;
280 }
281 read_u32(child, base, &alt);
282 }
283 break;
284
285 case 0x08000000:
286
287
288
289 if ((insn & 0x00108000) == 0x00108000) {
290 unsigned long base;
291 unsigned int nr_regs;
292
293 if (insn & (1 << 23)) {
294 nr_regs = hweight16(insn & 65535) << 2;
295
296 if (!(insn & (1 << 24)))
297 nr_regs -= 4;
298 } else {
299 if (insn & (1 << 24))
300 nr_regs = -4;
301 else
302 nr_regs = 0;
303 }
304
305 base = ptrace_getrn(child, insn);
306
307 read_u32(child, base + nr_regs, &alt);
308 break;
309 }
310 break;
311
312 case 0x0a000000: {
313
314
315
316 signed long displ;
317
318
319
320
321
322
323
324 displ = (insn & 0x00ffffff) << 8;
325 displ = (displ >> 6) + 8;
326 if (displ != 0 && displ != 4)
327 alt = pc + displ;
328 }
329 break;
330 }
331
332 return alt;
333}
334
335static int
336swap_insn(struct task_struct *task, unsigned long addr,
337 void *old_insn, void *new_insn, int size)
338{
339 int ret;
340
341 ret = access_process_vm(task, addr, old_insn, size, 0);
342 if (ret == size)
343 ret = access_process_vm(task, addr, new_insn, size, 1);
344 return ret;
345}
346
347static void
348add_breakpoint(struct task_struct *task, struct debug_info *dbg, unsigned long addr)
349{
350 int nr = dbg->nsaved;
351
352 if (nr < 2) {
353 u32 new_insn = BREAKINST_ARM;
354 int res;
355
356 res = swap_insn(task, addr, &dbg->bp[nr].insn, &new_insn, 4);
357
358 if (res == 4) {
359 dbg->bp[nr].address = addr;
360 dbg->nsaved += 1;
361 }
362 } else
363 printk(KERN_ERR "ptrace: too many breakpoints\n");
364}
365
366
367
368
369
370
371static void clear_breakpoint(struct task_struct *task, struct debug_entry *bp)
372{
373 unsigned long addr = bp->address;
374 union debug_insn old_insn;
375 int ret;
376
377 if (addr & 1) {
378 ret = swap_insn(task, addr & ~1, &old_insn.thumb,
379 &bp->insn.thumb, 2);
380
381 if (ret != 2 || old_insn.thumb != BREAKINST_THUMB)
382 printk(KERN_ERR "%s:%d: corrupted Thumb breakpoint at "
383 "0x%08lx (0x%04x)\n", task->comm,
384 task_pid_nr(task), addr, old_insn.thumb);
385 } else {
386 ret = swap_insn(task, addr & ~3, &old_insn.arm,
387 &bp->insn.arm, 4);
388
389 if (ret != 4 || old_insn.arm != BREAKINST_ARM)
390 printk(KERN_ERR "%s:%d: corrupted ARM breakpoint at "
391 "0x%08lx (0x%08x)\n", task->comm,
392 task_pid_nr(task), addr, old_insn.arm);
393 }
394}
395
396void ptrace_set_bpt(struct task_struct *child)
397{
398 struct pt_regs *regs;
399 unsigned long pc;
400 u32 insn;
401 int res;
402
403 regs = task_pt_regs(child);
404 pc = instruction_pointer(regs);
405
406 if (thumb_mode(regs)) {
407 printk(KERN_WARNING "ptrace: can't handle thumb mode\n");
408 return;
409 }
410
411 res = read_instr(child, pc, &insn);
412 if (!res) {
413 struct debug_info *dbg = &child->thread.debug;
414 unsigned long alt;
415
416 dbg->nsaved = 0;
417
418 alt = get_branch_address(child, pc, insn);
419 if (alt)
420 add_breakpoint(child, dbg, alt);
421
422
423
424
425
426
427
428
429
430
431 if (!alt || predicate(insn) != PREDICATE_ALWAYS)
432 add_breakpoint(child, dbg, pc + 4);
433 }
434}
435
436
437
438
439
440void ptrace_cancel_bpt(struct task_struct *child)
441{
442 int i, nsaved = child->thread.debug.nsaved;
443
444 child->thread.debug.nsaved = 0;
445
446 if (nsaved > 2) {
447 printk("ptrace_cancel_bpt: bogus nsaved: %d!\n", nsaved);
448 nsaved = 2;
449 }
450
451 for (i = 0; i < nsaved; i++)
452 clear_breakpoint(child, &child->thread.debug.bp[i]);
453}
454
455
456
457
458void ptrace_disable(struct task_struct *child)
459{
460 single_step_disable(child);
461}
462
463
464
465
466void ptrace_break(struct task_struct *tsk, struct pt_regs *regs)
467{
468 siginfo_t info;
469
470 ptrace_cancel_bpt(tsk);
471
472 info.si_signo = SIGTRAP;
473 info.si_errno = 0;
474 info.si_code = TRAP_BRKPT;
475 info.si_addr = (void __user *)instruction_pointer(regs);
476
477 force_sig_info(SIGTRAP, &info, tsk);
478}
479
480static int break_trap(struct pt_regs *regs, unsigned int instr)
481{
482 ptrace_break(current, regs);
483 return 0;
484}
485
486static struct undef_hook arm_break_hook = {
487 .instr_mask = 0x0fffffff,
488 .instr_val = 0x07f001f0,
489 .cpsr_mask = PSR_T_BIT,
490 .cpsr_val = 0,
491 .fn = break_trap,
492};
493
494static struct undef_hook thumb_break_hook = {
495 .instr_mask = 0xffff,
496 .instr_val = 0xde01,
497 .cpsr_mask = PSR_T_BIT,
498 .cpsr_val = PSR_T_BIT,
499 .fn = break_trap,
500};
501
502static int __init ptrace_break_init(void)
503{
504 register_undef_hook(&arm_break_hook);
505 register_undef_hook(&thumb_break_hook);
506 return 0;
507}
508
509core_initcall(ptrace_break_init);
510
511
512
513
514
515static int ptrace_read_user(struct task_struct *tsk, unsigned long off,
516 unsigned long __user *ret)
517{
518 unsigned long tmp;
519
520 if (off & 3 || off >= sizeof(struct user))
521 return -EIO;
522
523 tmp = 0;
524 if (off == PT_TEXT_ADDR)
525 tmp = tsk->mm->start_code;
526 else if (off == PT_DATA_ADDR)
527 tmp = tsk->mm->start_data;
528 else if (off == PT_TEXT_END_ADDR)
529 tmp = tsk->mm->end_code;
530 else if (off < sizeof(struct pt_regs))
531 tmp = get_user_reg(tsk, off >> 2);
532
533 return put_user(tmp, ret);
534}
535
536
537
538
539
540static int ptrace_write_user(struct task_struct *tsk, unsigned long off,
541 unsigned long val)
542{
543 if (off & 3 || off >= sizeof(struct user))
544 return -EIO;
545
546 if (off >= sizeof(struct pt_regs))
547 return 0;
548
549 return put_user_reg(tsk, off >> 2, val);
550}
551
552
553
554
555static int ptrace_getregs(struct task_struct *tsk, void __user *uregs)
556{
557 struct pt_regs *regs = task_pt_regs(tsk);
558
559 return copy_to_user(uregs, regs, sizeof(struct pt_regs)) ? -EFAULT : 0;
560}
561
562
563
564
565static int ptrace_setregs(struct task_struct *tsk, void __user *uregs)
566{
567 struct pt_regs newregs;
568 int ret;
569
570 ret = -EFAULT;
571 if (copy_from_user(&newregs, uregs, sizeof(struct pt_regs)) == 0) {
572 struct pt_regs *regs = task_pt_regs(tsk);
573
574 ret = -EINVAL;
575 if (valid_user_regs(&newregs)) {
576 *regs = newregs;
577 ret = 0;
578 }
579 }
580
581 return ret;
582}
583
584
585
586
587static int ptrace_getfpregs(struct task_struct *tsk, void __user *ufp)
588{
589 return copy_to_user(ufp, &task_thread_info(tsk)->fpstate,
590 sizeof(struct user_fp)) ? -EFAULT : 0;
591}
592
593
594
595
596static int ptrace_setfpregs(struct task_struct *tsk, void __user *ufp)
597{
598 struct thread_info *thread = task_thread_info(tsk);
599 thread->used_cp[1] = thread->used_cp[2] = 1;
600 return copy_from_user(&thread->fpstate, ufp,
601 sizeof(struct user_fp)) ? -EFAULT : 0;
602}
603
604#ifdef CONFIG_IWMMXT
605
606
607
608
609static int ptrace_getwmmxregs(struct task_struct *tsk, void __user *ufp)
610{
611 struct thread_info *thread = task_thread_info(tsk);
612
613 if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
614 return -ENODATA;
615 iwmmxt_task_disable(thread);
616 return copy_to_user(ufp, &thread->fpstate.iwmmxt, IWMMXT_SIZE)
617 ? -EFAULT : 0;
618}
619
620
621
622
623static int ptrace_setwmmxregs(struct task_struct *tsk, void __user *ufp)
624{
625 struct thread_info *thread = task_thread_info(tsk);
626
627 if (!test_ti_thread_flag(thread, TIF_USING_IWMMXT))
628 return -EACCES;
629 iwmmxt_task_release(thread);
630 return copy_from_user(&thread->fpstate.iwmmxt, ufp, IWMMXT_SIZE)
631 ? -EFAULT : 0;
632}
633
634#endif
635
636#ifdef CONFIG_CRUNCH
637
638
639
640static int ptrace_getcrunchregs(struct task_struct *tsk, void __user *ufp)
641{
642 struct thread_info *thread = task_thread_info(tsk);
643
644 crunch_task_disable(thread);
645 return copy_to_user(ufp, &thread->crunchstate, CRUNCH_SIZE)
646 ? -EFAULT : 0;
647}
648
649
650
651
652static int ptrace_setcrunchregs(struct task_struct *tsk, void __user *ufp)
653{
654 struct thread_info *thread = task_thread_info(tsk);
655
656 crunch_task_release(thread);
657 return copy_from_user(&thread->crunchstate, ufp, CRUNCH_SIZE)
658 ? -EFAULT : 0;
659}
660#endif
661
662#ifdef CONFIG_VFP
663
664
665
666static int ptrace_getvfpregs(struct task_struct *tsk, void __user *data)
667{
668 struct thread_info *thread = task_thread_info(tsk);
669 union vfp_state *vfp = &thread->vfpstate;
670 struct user_vfp __user *ufp = data;
671
672 vfp_sync_state(thread);
673
674
675 if (copy_to_user(&ufp->fpregs, &vfp->hard.fpregs,
676 sizeof(vfp->hard.fpregs)))
677 return -EFAULT;
678
679
680 if (put_user(vfp->hard.fpscr, &ufp->fpscr))
681 return -EFAULT;
682
683 return 0;
684}
685
686
687
688
689static int ptrace_setvfpregs(struct task_struct *tsk, void __user *data)
690{
691 struct thread_info *thread = task_thread_info(tsk);
692 union vfp_state *vfp = &thread->vfpstate;
693 struct user_vfp __user *ufp = data;
694
695 vfp_sync_state(thread);
696
697
698 if (copy_from_user(&vfp->hard.fpregs, &ufp->fpregs,
699 sizeof(vfp->hard.fpregs)))
700 return -EFAULT;
701
702
703 if (get_user(vfp->hard.fpscr, &ufp->fpscr))
704 return -EFAULT;
705
706 return 0;
707}
708#endif
709
710long arch_ptrace(struct task_struct *child, long request, long addr, long data)
711{
712 int ret;
713
714 switch (request) {
715
716
717
718 case PTRACE_PEEKTEXT:
719 case PTRACE_PEEKDATA:
720 ret = generic_ptrace_peekdata(child, addr, data);
721 break;
722
723 case PTRACE_PEEKUSR:
724 ret = ptrace_read_user(child, addr, (unsigned long __user *)data);
725 break;
726
727
728
729
730 case PTRACE_POKETEXT:
731 case PTRACE_POKEDATA:
732 ret = generic_ptrace_pokedata(child, addr, data);
733 break;
734
735 case PTRACE_POKEUSR:
736 ret = ptrace_write_user(child, addr, data);
737 break;
738
739
740
741
742 case PTRACE_SYSCALL:
743 case PTRACE_CONT:
744 ret = -EIO;
745 if (!valid_signal(data))
746 break;
747 if (request == PTRACE_SYSCALL)
748 set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
749 else
750 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
751 child->exit_code = data;
752 single_step_disable(child);
753 wake_up_process(child);
754 ret = 0;
755 break;
756
757
758
759
760
761
762 case PTRACE_KILL:
763 single_step_disable(child);
764 if (child->exit_state != EXIT_ZOMBIE) {
765 child->exit_code = SIGKILL;
766 wake_up_process(child);
767 }
768 ret = 0;
769 break;
770
771
772
773
774 case PTRACE_SINGLESTEP:
775 ret = -EIO;
776 if (!valid_signal(data))
777 break;
778 single_step_enable(child);
779 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
780 child->exit_code = data;
781
782 wake_up_process(child);
783 ret = 0;
784 break;
785
786 case PTRACE_GETREGS:
787 ret = ptrace_getregs(child, (void __user *)data);
788 break;
789
790 case PTRACE_SETREGS:
791 ret = ptrace_setregs(child, (void __user *)data);
792 break;
793
794 case PTRACE_GETFPREGS:
795 ret = ptrace_getfpregs(child, (void __user *)data);
796 break;
797
798 case PTRACE_SETFPREGS:
799 ret = ptrace_setfpregs(child, (void __user *)data);
800 break;
801
802#ifdef CONFIG_IWMMXT
803 case PTRACE_GETWMMXREGS:
804 ret = ptrace_getwmmxregs(child, (void __user *)data);
805 break;
806
807 case PTRACE_SETWMMXREGS:
808 ret = ptrace_setwmmxregs(child, (void __user *)data);
809 break;
810#endif
811
812 case PTRACE_GET_THREAD_AREA:
813 ret = put_user(task_thread_info(child)->tp_value,
814 (unsigned long __user *) data);
815 break;
816
817 case PTRACE_SET_SYSCALL:
818 task_thread_info(child)->syscall = data;
819 ret = 0;
820 break;
821
822#ifdef CONFIG_CRUNCH
823 case PTRACE_GETCRUNCHREGS:
824 ret = ptrace_getcrunchregs(child, (void __user *)data);
825 break;
826
827 case PTRACE_SETCRUNCHREGS:
828 ret = ptrace_setcrunchregs(child, (void __user *)data);
829 break;
830#endif
831
832#ifdef CONFIG_VFP
833 case PTRACE_GETVFPREGS:
834 ret = ptrace_getvfpregs(child, (void __user *)data);
835 break;
836
837 case PTRACE_SETVFPREGS:
838 ret = ptrace_setvfpregs(child, (void __user *)data);
839 break;
840#endif
841
842 default:
843 ret = ptrace_request(child, request, addr, data);
844 break;
845 }
846
847 return ret;
848}
849
850asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
851{
852 unsigned long ip;
853
854 if (!test_thread_flag(TIF_SYSCALL_TRACE))
855 return scno;
856 if (!(current->ptrace & PT_PTRACED))
857 return scno;
858
859
860
861
862
863 ip = regs->ARM_ip;
864 regs->ARM_ip = why;
865
866 current_thread_info()->syscall = scno;
867
868
869
870 ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
871 ? 0x80 : 0));
872
873
874
875
876
877 if (current->exit_code) {
878 send_sig(current->exit_code, current, 1);
879 current->exit_code = 0;
880 }
881 regs->ARM_ip = ip;
882
883 return current_thread_info()->syscall;
884}
885