sys_ptrace_common.c revision 1.10
1 /* $NetBSD: sys_ptrace_common.c,v 1.10 2017/01/14 06:36:52 kamil Exp $ */ 2 3 /*- 4 * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Andrew Doran. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /*- 33 * Copyright (c) 1982, 1986, 1989, 1993 34 * The Regents of the University of California. All rights reserved. 35 * (c) UNIX System Laboratories, Inc. 36 * All or some portions of this file are derived from material licensed 37 * to the University of California by American Telephone and Telegraph 38 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 39 * the permission of UNIX System Laboratories, Inc. 40 * 41 * This code is derived from software contributed to Berkeley by 42 * Jan-Simon Pendry. 43 * 44 * Redistribution and use in source and binary forms, with or without 45 * modification, are permitted provided that the following conditions 46 * are met: 47 * 1. Redistributions of source code must retain the above copyright 48 * notice, this list of conditions and the following disclaimer. 49 * 2. Redistributions in binary form must reproduce the above copyright 50 * notice, this list of conditions and the following disclaimer in the 51 * documentation and/or other materials provided with the distribution. 52 * 3. Neither the name of the University nor the names of its contributors 53 * may be used to endorse or promote products derived from this software 54 * without specific prior written permission. 55 * 56 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 57 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 58 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 59 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 60 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 61 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 62 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 63 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 64 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 65 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 66 * SUCH DAMAGE. 67 * 68 * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93 69 */ 70 71 /*- 72 * Copyright (c) 1993 Jan-Simon Pendry. 73 * Copyright (c) 1994 Christopher G. Demetriou. All rights reserved. 74 * 75 * This code is derived from software contributed to Berkeley by 76 * Jan-Simon Pendry. 77 * 78 * Redistribution and use in source and binary forms, with or without 79 * modification, are permitted provided that the following conditions 80 * are met: 81 * 1. Redistributions of source code must retain the above copyright 82 * notice, this list of conditions and the following disclaimer. 83 * 2. Redistributions in binary form must reproduce the above copyright 84 * notice, this list of conditions and the following disclaimer in the 85 * documentation and/or other materials provided with the distribution. 86 * 3. All advertising materials mentioning features or use of this software 87 * must display the following acknowledgement: 88 * This product includes software developed by the University of 89 * California, Berkeley and its contributors. 90 * 4. Neither the name of the University nor the names of its contributors 91 * may be used to endorse or promote products derived from this software 92 * without specific prior written permission. 93 * 94 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 95 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 96 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 97 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 98 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 99 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 100 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 101 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 102 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 103 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 104 * SUCH DAMAGE. 105 * 106 * from: @(#)sys_process.c 8.1 (Berkeley) 6/10/93 107 */ 108 109 /* 110 * References: 111 * (1) Bach's "The Design of the UNIX Operating System", 112 * (2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution, 113 * (3) the "4.4BSD Programmer's Reference Manual" published 114 * by USENIX and O'Reilly & Associates. 115 * The 4.4BSD PRM does a reasonably good job of documenting what the various 116 * ptrace() requests should actually do, and its text is quoted several times 117 * in this file. 118 */ 119 120 #include <sys/cdefs.h> 121 __KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.10 2017/01/14 06:36:52 kamil Exp $"); 122 123 #ifdef _KERNEL_OPT 124 #include "opt_ptrace.h" 125 #include "opt_ktrace.h" 126 #include "opt_pax.h" 127 #endif 128 129 #include <sys/param.h> 130 #include <sys/systm.h> 131 #include <sys/proc.h> 132 #include <sys/errno.h> 133 #include <sys/exec.h> 134 #include <sys/pax.h> 135 #include <sys/ptrace.h> 136 #include <sys/uio.h> 137 #include <sys/ras.h> 138 #include <sys/kmem.h> 139 #include <sys/kauth.h> 140 #include <sys/mount.h> 141 #include <sys/syscallargs.h> 142 #include <sys/module.h> 143 #include <sys/condvar.h> 144 #include <sys/mutex.h> 145 146 #include <uvm/uvm_extern.h> 147 148 #include <machine/reg.h> 149 150 #ifdef PTRACE 151 152 # ifdef DEBUG 153 # define DPRINTF(a) uprintf a 154 # else 155 # define DPRINTF(a) 156 # endif 157 158 static kauth_listener_t ptrace_listener; 159 static int process_auxv_offset(struct proc *, struct uio *); 160 161 #if 0 162 static int ptrace_cbref; 163 static kmutex_t ptrace_mtx; 164 static kcondvar_t ptrace_cv; 165 #endif 166 167 static int 168 ptrace_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 169 void *arg0, void *arg1, void *arg2, void *arg3) 170 { 171 struct proc *p; 172 int result; 173 174 result = KAUTH_RESULT_DEFER; 175 p = arg0; 176 177 #if 0 178 mutex_enter(&ptrace_mtx); 179 ptrace_cbref++; 180 mutex_exit(&ptrace_mtx); 181 #endif 182 if (action != KAUTH_PROCESS_PTRACE) 183 goto out; 184 185 switch ((u_long)arg1) { 186 case PT_TRACE_ME: 187 case PT_ATTACH: 188 case PT_WRITE_I: 189 case PT_WRITE_D: 190 case PT_READ_I: 191 case PT_READ_D: 192 case PT_IO: 193 #ifdef PT_GETREGS 194 case PT_GETREGS: 195 #endif 196 #ifdef PT_SETREGS 197 case PT_SETREGS: 198 #endif 199 #ifdef PT_GETFPREGS 200 case PT_GETFPREGS: 201 #endif 202 #ifdef PT_SETFPREGS 203 case PT_SETFPREGS: 204 #endif 205 #ifdef __HAVE_PTRACE_WATCHPOINTS 206 case PT_READ_WATCHPOINT: 207 case PT_WRITE_WATCHPOINT: 208 case PT_COUNT_WATCHPOINTS: 209 #endif 210 case PT_SET_EVENT_MASK: 211 case PT_GET_EVENT_MASK: 212 case PT_GET_PROCESS_STATE: 213 case PT_SET_SIGINFO: 214 case PT_GET_SIGINFO: 215 #ifdef __HAVE_PTRACE_MACHDEP 216 PTRACE_MACHDEP_REQUEST_CASES 217 #endif 218 if (kauth_cred_getuid(cred) != kauth_cred_getuid(p->p_cred) || 219 ISSET(p->p_flag, PK_SUGID)) { 220 break; 221 } 222 223 result = KAUTH_RESULT_ALLOW; 224 225 break; 226 227 #ifdef PT_STEP 228 case PT_STEP: 229 #endif 230 case PT_CONTINUE: 231 case PT_KILL: 232 case PT_DETACH: 233 case PT_LWPINFO: 234 case PT_SYSCALL: 235 case PT_SYSCALLEMU: 236 case PT_DUMPCORE: 237 result = KAUTH_RESULT_ALLOW; 238 break; 239 240 default: 241 break; 242 } 243 244 out: 245 #if 0 246 mutex_enter(&ptrace_mtx); 247 if (--ptrace_cbref == 0) 248 cv_broadcast(&ptrace_cv); 249 mutex_exit(&ptrace_mtx); 250 #endif 251 252 return result; 253 } 254 255 int 256 ptrace_init(void) 257 { 258 259 #if 0 260 mutex_init(&ptrace_mtx, MUTEX_DEFAULT, IPL_NONE); 261 cv_init(&ptrace_cv, "ptracecb"); 262 ptrace_cbref = 0; 263 #endif 264 ptrace_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS, 265 ptrace_listener_cb, NULL); 266 return 0; 267 } 268 269 int 270 ptrace_fini(void) 271 { 272 273 kauth_unlisten_scope(ptrace_listener); 274 275 #if 0 276 /* Make sure no-one is executing our kauth listener */ 277 278 mutex_enter(&ptrace_mtx); 279 while (ptrace_cbref != 0) 280 cv_wait(&ptrace_cv, &ptrace_mtx); 281 mutex_exit(&ptrace_mtx); 282 mutex_destroy(&ptrace_mtx); 283 cv_destroy(&ptrace_cv); 284 #endif 285 286 return 0; 287 } 288 289 int 290 do_ptrace(struct ptrace_methods *ptm, struct lwp *l, int req, pid_t pid, 291 void *addr, int data, register_t *retval) 292 { 293 struct proc *p = l->l_proc; 294 struct lwp *lt; 295 #ifdef PT_STEP 296 struct lwp *lt2; 297 #endif 298 struct proc *t; /* target process */ 299 struct uio uio; 300 struct iovec iov; 301 struct ptrace_io_desc piod; 302 struct ptrace_event pe; 303 struct ptrace_state ps; 304 struct ptrace_lwpinfo pl; 305 struct ptrace_siginfo psi; 306 #ifdef __HAVE_PTRACE_WATCHPOINTS 307 struct ptrace_watchpoint pw; 308 #endif 309 struct vmspace *vm; 310 int error, write, tmp, pheld; 311 int signo = 0; 312 int resume_all; 313 ksiginfo_t ksi; 314 char *path; 315 int len = 0; 316 error = 0; 317 318 /* 319 * If attaching or detaching, we need to get a write hold on the 320 * proclist lock so that we can re-parent the target process. 321 */ 322 mutex_enter(proc_lock); 323 324 /* "A foolish consistency..." XXX */ 325 if (req == PT_TRACE_ME) { 326 t = p; 327 mutex_enter(t->p_lock); 328 } else { 329 /* Find the process we're supposed to be operating on. */ 330 t = proc_find(pid); 331 if (t == NULL) { 332 mutex_exit(proc_lock); 333 return ESRCH; 334 } 335 336 /* XXX-elad */ 337 mutex_enter(t->p_lock); 338 error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE, 339 t, KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL); 340 if (error) { 341 mutex_exit(proc_lock); 342 mutex_exit(t->p_lock); 343 return ESRCH; 344 } 345 } 346 347 /* 348 * Grab a reference on the process to prevent it from execing or 349 * exiting. 350 */ 351 if (!rw_tryenter(&t->p_reflock, RW_READER)) { 352 mutex_exit(proc_lock); 353 mutex_exit(t->p_lock); 354 return EBUSY; 355 } 356 357 /* Make sure we can operate on it. */ 358 switch (req) { 359 case PT_TRACE_ME: 360 /* Saying that you're being traced is always legal. */ 361 break; 362 363 case PT_ATTACH: 364 /* 365 * You can't attach to a process if: 366 * (1) it's the process that's doing the attaching, 367 */ 368 if (t->p_pid == p->p_pid) { 369 error = EINVAL; 370 break; 371 } 372 373 /* 374 * (2) it's a system process 375 */ 376 if (t->p_flag & PK_SYSTEM) { 377 error = EPERM; 378 break; 379 } 380 381 /* 382 * (3) it's already being traced, or 383 */ 384 if (ISSET(t->p_slflag, PSL_TRACED)) { 385 error = EBUSY; 386 break; 387 } 388 389 /* 390 * (4) the tracer is chrooted, and its root directory is 391 * not at or above the root directory of the tracee 392 */ 393 mutex_exit(t->p_lock); /* XXXSMP */ 394 tmp = proc_isunder(t, l); 395 mutex_enter(t->p_lock); /* XXXSMP */ 396 if (!tmp) { 397 error = EPERM; 398 break; 399 } 400 break; 401 402 case PT_READ_I: 403 case PT_READ_D: 404 case PT_WRITE_I: 405 case PT_WRITE_D: 406 case PT_IO: 407 #ifdef PT_GETREGS 408 case PT_GETREGS: 409 #endif 410 #ifdef PT_SETREGS 411 case PT_SETREGS: 412 #endif 413 #ifdef PT_GETFPREGS 414 case PT_GETFPREGS: 415 #endif 416 #ifdef PT_SETFPREGS 417 case PT_SETFPREGS: 418 #endif 419 #ifdef __HAVE_PTRACE_WATCHPOINTS 420 case PT_READ_WATCHPOINT: 421 case PT_WRITE_WATCHPOINT: 422 case PT_COUNT_WATCHPOINTS: 423 #endif 424 #ifdef __HAVE_PTRACE_MACHDEP 425 PTRACE_MACHDEP_REQUEST_CASES 426 #endif 427 /* 428 * You can't read/write the memory or registers of a process 429 * if the tracer is chrooted, and its root directory is not at 430 * or above the root directory of the tracee. 431 */ 432 mutex_exit(t->p_lock); /* XXXSMP */ 433 tmp = proc_isunder(t, l); 434 mutex_enter(t->p_lock); /* XXXSMP */ 435 if (!tmp) { 436 error = EPERM; 437 break; 438 } 439 /*FALLTHROUGH*/ 440 441 case PT_CONTINUE: 442 case PT_KILL: 443 case PT_DETACH: 444 case PT_LWPINFO: 445 case PT_SYSCALL: 446 case PT_SYSCALLEMU: 447 case PT_DUMPCORE: 448 #ifdef PT_STEP 449 case PT_STEP: 450 #endif 451 case PT_SET_EVENT_MASK: 452 case PT_GET_EVENT_MASK: 453 case PT_GET_PROCESS_STATE: 454 case PT_SET_SIGINFO: 455 case PT_GET_SIGINFO: 456 /* 457 * You can't do what you want to the process if: 458 * (1) It's not being traced at all, 459 */ 460 if (!ISSET(t->p_slflag, PSL_TRACED)) { 461 error = EPERM; 462 break; 463 } 464 465 /* 466 * (2) it's being traced by procfs (which has 467 * different signal delivery semantics), 468 */ 469 if (ISSET(t->p_slflag, PSL_FSTRACE)) { 470 DPRINTF(("file system traced\n")); 471 error = EBUSY; 472 break; 473 } 474 475 /* 476 * (3) it's not being traced by _you_, or 477 */ 478 if (t->p_pptr != p) { 479 DPRINTF(("parent %d != %d\n", t->p_pptr->p_pid, 480 p->p_pid)); 481 error = EBUSY; 482 break; 483 } 484 485 /* 486 * (4) it's not currently stopped. 487 */ 488 if (t->p_stat != SSTOP || !t->p_waited /* XXXSMP */) { 489 DPRINTF(("stat %d flag %d\n", t->p_stat, 490 !t->p_waited)); 491 error = EBUSY; 492 break; 493 } 494 break; 495 496 default: /* It was not a legal request. */ 497 error = EINVAL; 498 break; 499 } 500 501 if (error == 0) { 502 error = kauth_authorize_process(l->l_cred, 503 KAUTH_PROCESS_PTRACE, t, KAUTH_ARG(req), 504 NULL, NULL); 505 } 506 if (error == 0) { 507 lt = lwp_find_first(t); 508 if (lt == NULL) 509 error = ESRCH; 510 } 511 512 if (error != 0) { 513 mutex_exit(proc_lock); 514 mutex_exit(t->p_lock); 515 rw_exit(&t->p_reflock); 516 return error; 517 } 518 519 /* Do single-step fixup if needed. */ 520 FIX_SSTEP(t); 521 KASSERT(lt != NULL); 522 lwp_addref(lt); 523 524 /* 525 * Which locks do we need held? XXX Ugly. 526 */ 527 switch (req) { 528 #ifdef PT_STEP 529 case PT_STEP: 530 #endif 531 case PT_CONTINUE: 532 case PT_DETACH: 533 case PT_KILL: 534 case PT_SYSCALL: 535 case PT_SYSCALLEMU: 536 case PT_ATTACH: 537 case PT_TRACE_ME: 538 pheld = 1; 539 break; 540 default: 541 mutex_exit(proc_lock); 542 mutex_exit(t->p_lock); 543 pheld = 0; 544 break; 545 } 546 547 /* Now do the operation. */ 548 write = 0; 549 *retval = 0; 550 tmp = 0; 551 resume_all = 1; 552 553 switch (req) { 554 case PT_TRACE_ME: 555 /* Just set the trace flag. */ 556 SET(t->p_slflag, PSL_TRACED); 557 t->p_opptr = t->p_pptr; 558 break; 559 560 case PT_WRITE_I: /* XXX no separate I and D spaces */ 561 case PT_WRITE_D: 562 #if defined(__HAVE_RAS) 563 /* 564 * Can't write to a RAS 565 */ 566 if (ras_lookup(t, addr) != (void *)-1) { 567 error = EACCES; 568 break; 569 } 570 #endif 571 write = 1; 572 tmp = data; 573 /* FALLTHROUGH */ 574 575 case PT_READ_I: /* XXX no separate I and D spaces */ 576 case PT_READ_D: 577 /* write = 0 done above. */ 578 iov.iov_base = (void *)&tmp; 579 iov.iov_len = sizeof(tmp); 580 uio.uio_iov = &iov; 581 uio.uio_iovcnt = 1; 582 uio.uio_offset = (off_t)(unsigned long)addr; 583 uio.uio_resid = sizeof(tmp); 584 uio.uio_rw = write ? UIO_WRITE : UIO_READ; 585 UIO_SETUP_SYSSPACE(&uio); 586 587 error = process_domem(l, lt, &uio); 588 if (!write) 589 *retval = tmp; 590 break; 591 592 case PT_IO: 593 error = ptm->ptm_copyinpiod(&piod, addr); 594 if (error) 595 break; 596 597 iov.iov_base = piod.piod_addr; 598 iov.iov_len = piod.piod_len; 599 uio.uio_iov = &iov; 600 uio.uio_iovcnt = 1; 601 uio.uio_offset = (off_t)(unsigned long)piod.piod_offs; 602 uio.uio_resid = piod.piod_len; 603 604 switch (piod.piod_op) { 605 case PIOD_READ_D: 606 case PIOD_READ_I: 607 uio.uio_rw = UIO_READ; 608 break; 609 case PIOD_WRITE_D: 610 case PIOD_WRITE_I: 611 /* 612 * Can't write to a RAS 613 */ 614 if (ras_lookup(t, addr) != (void *)-1) { 615 return EACCES; 616 } 617 uio.uio_rw = UIO_WRITE; 618 break; 619 case PIOD_READ_AUXV: 620 req = PT_READ_D; 621 uio.uio_rw = UIO_READ; 622 tmp = t->p_execsw->es_arglen * PROC_PTRSZ(t); 623 if (uio.uio_offset > tmp) 624 return EIO; 625 if (uio.uio_resid > tmp - uio.uio_offset) 626 uio.uio_resid = tmp - uio.uio_offset; 627 piod.piod_len = iov.iov_len = uio.uio_resid; 628 error = process_auxv_offset(t, &uio); 629 if (error) 630 return error; 631 break; 632 default: 633 error = EINVAL; 634 break; 635 } 636 if (error) 637 break; 638 error = proc_vmspace_getref(l->l_proc, &vm); 639 if (error) 640 break; 641 uio.uio_vmspace = vm; 642 643 error = process_domem(l, lt, &uio); 644 piod.piod_len -= uio.uio_resid; 645 (void) ptm->ptm_copyoutpiod(&piod, addr); 646 647 uvmspace_free(vm); 648 break; 649 650 case PT_DUMPCORE: 651 if ((path = addr) != NULL) { 652 char *dst; 653 len = data; 654 655 if (len < 0 || len >= MAXPATHLEN) { 656 error = EINVAL; 657 break; 658 } 659 dst = kmem_alloc(len + 1, KM_SLEEP); 660 if ((error = copyin(path, dst, len)) != 0) { 661 kmem_free(dst, len + 1); 662 break; 663 } 664 path = dst; 665 path[len] = '\0'; 666 } 667 error = (*coredump_vec)(lt, path); 668 if (path) 669 kmem_free(path, len + 1); 670 break; 671 672 #ifdef PT_STEP 673 case PT_STEP: 674 /* 675 * From the 4.4BSD PRM: 676 * "Execution continues as in request PT_CONTINUE; however 677 * as soon as possible after execution of at least one 678 * instruction, execution stops again. [ ... ]" 679 */ 680 #endif 681 case PT_CONTINUE: 682 case PT_SYSCALL: 683 case PT_DETACH: 684 if (req == PT_SYSCALL) { 685 if (!ISSET(t->p_slflag, PSL_SYSCALL)) { 686 SET(t->p_slflag, PSL_SYSCALL); 687 #ifdef __HAVE_SYSCALL_INTERN 688 (*t->p_emul->e_syscall_intern)(t); 689 #endif 690 } 691 } else { 692 if (ISSET(t->p_slflag, PSL_SYSCALL)) { 693 CLR(t->p_slflag, PSL_SYSCALL); 694 #ifdef __HAVE_SYSCALL_INTERN 695 (*t->p_emul->e_syscall_intern)(t); 696 #endif 697 } 698 } 699 t->p_trace_enabled = trace_is_enabled(t); 700 701 /* 702 * Pick up the LWPID, if supplied. There are two cases: 703 * data < 0 : step or continue single thread, lwp = -data 704 * data > 0 in PT_STEP : step this thread, continue others 705 * For operations other than PT_STEP, data > 0 means 706 * data is the signo to deliver to the process. 707 */ 708 tmp = data; 709 if (tmp >= 0) { 710 #ifdef PT_STEP 711 if (req == PT_STEP) 712 signo = 0; 713 else 714 #endif 715 { 716 signo = tmp; 717 tmp = 0; /* don't search for LWP */ 718 } 719 } else 720 tmp = -tmp; 721 722 if (tmp > 0) { 723 if (req == PT_DETACH) { 724 error = EINVAL; 725 break; 726 } 727 lwp_delref2 (lt); 728 lt = lwp_find(t, tmp); 729 if (lt == NULL) { 730 error = ESRCH; 731 break; 732 } 733 lwp_addref(lt); 734 resume_all = 0; 735 signo = 0; 736 } 737 738 /* 739 * From the 4.4BSD PRM: 740 * "The data argument is taken as a signal number and the 741 * child's execution continues at location addr as if it 742 * incurred that signal. Normally the signal number will 743 * be either 0 to indicate that the signal that caused the 744 * stop should be ignored, or that value fetched out of 745 * the process's image indicating which signal caused 746 * the stop. If addr is (int *)1 then execution continues 747 * from where it stopped." 748 */ 749 750 /* Check that the data is a valid signal number or zero. */ 751 if (signo < 0 || signo >= NSIG) { 752 error = EINVAL; 753 break; 754 } 755 756 /* If the address parameter is not (int *)1, set the pc. */ 757 if ((int *)addr != (int *)1) { 758 error = process_set_pc(lt, addr); 759 if (error != 0) 760 break; 761 } 762 #ifdef PT_STEP 763 /* 764 * Arrange for a single-step, if that's requested and possible. 765 * More precisely, set the single step status as requested for 766 * the requested thread, and clear it for other threads. 767 */ 768 LIST_FOREACH(lt2, &t->p_lwps, l_sibling) { 769 if (lt != lt2) { 770 lwp_lock(lt2); 771 process_sstep(lt2, 0); 772 lwp_unlock(lt2); 773 } 774 } 775 error = process_sstep(lt, req == PT_STEP); 776 if (error) 777 break; 778 #endif 779 if (req == PT_DETACH) { 780 CLR(t->p_slflag, PSL_TRACED|PSL_FSTRACE|PSL_SYSCALL); 781 782 /* give process back to original parent or init */ 783 if (t->p_opptr != t->p_pptr) { 784 struct proc *pp = t->p_opptr; 785 proc_reparent(t, pp ? pp : initproc); 786 } 787 788 /* not being traced any more */ 789 t->p_opptr = NULL; 790 } 791 sendsig: 792 t->p_fpid = 0; 793 t->p_vfpid = 0; 794 t->p_vfpid_done = 0; 795 t->p_lwp_created = 0; 796 t->p_lwp_exited = 0; 797 /* Finally, deliver the requested signal (or none). */ 798 if (t->p_stat == SSTOP) { 799 /* 800 * Unstop the process. If it needs to take a 801 * signal, make all efforts to ensure that at 802 * an LWP runs to see it. 803 */ 804 t->p_xsig = signo; 805 if (resume_all) 806 proc_unstop(t); 807 else 808 lwp_unstop(lt); 809 } else if (t->p_sigctx.ps_faked) { 810 if (signo != t->p_sigctx.ps_info._signo) { 811 error = EINVAL; 812 break; 813 } 814 t->p_sigctx.ps_faked = false; 815 KSI_INIT_EMPTY(&ksi); 816 ksi.ksi_info = t->p_sigctx.ps_info; 817 ksi.ksi_lid = t->p_sigctx.ps_lwp; 818 kpsignal2(t, &ksi); 819 } else if (signo != 0) { 820 KSI_INIT_EMPTY(&ksi); 821 ksi.ksi_signo = signo; 822 kpsignal2(t, &ksi); 823 } 824 break; 825 826 case PT_SYSCALLEMU: 827 if (!ISSET(t->p_slflag, PSL_SYSCALL) || t->p_stat != SSTOP) { 828 error = EINVAL; 829 break; 830 } 831 SET(t->p_slflag, PSL_SYSCALLEMU); 832 break; 833 834 case PT_KILL: 835 /* just send the process a KILL signal. */ 836 signo = SIGKILL; 837 goto sendsig; /* in PT_CONTINUE, above. */ 838 839 case PT_ATTACH: 840 /* 841 * Go ahead and set the trace flag. 842 * Save the old parent (it's reset in 843 * _DETACH, and also in kern_exit.c:wait4() 844 * Reparent the process so that the tracing 845 * proc gets to see all the action. 846 * Stop the target. 847 */ 848 proc_changeparent(t, p); 849 signo = SIGSTOP; 850 goto sendsig; 851 852 case PT_GET_EVENT_MASK: 853 if (data != sizeof(pe)) { 854 DPRINTF(("ptrace(%d): %d != %zu\n", req, 855 data, sizeof(pe))); 856 error = EINVAL; 857 break; 858 } 859 memset(&pe, 0, sizeof(pe)); 860 pe.pe_set_event = ISSET(t->p_slflag, PSL_TRACEFORK) ? 861 PTRACE_FORK : 0; 862 pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK) ? 863 PTRACE_VFORK : 0; 864 pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK_DONE) ? 865 PTRACE_VFORK_DONE : 0; 866 pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_CREATE) ? 867 PTRACE_LWP_CREATE : 0; 868 pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_EXIT) ? 869 PTRACE_LWP_EXIT : 0; 870 error = copyout(&pe, addr, sizeof(pe)); 871 break; 872 873 case PT_SET_EVENT_MASK: 874 if (data != sizeof(pe)) { 875 DPRINTF(("ptrace(%d): %d != %zu\n", req, data, 876 sizeof(pe))); 877 error = EINVAL; 878 break; 879 } 880 if ((error = copyin(addr, &pe, sizeof(pe))) != 0) 881 return error; 882 if (pe.pe_set_event & PTRACE_FORK) 883 SET(t->p_slflag, PSL_TRACEFORK); 884 else 885 CLR(t->p_slflag, PSL_TRACEFORK); 886 #if notyet 887 if (pe.pe_set_event & PTRACE_VFORK) 888 SET(t->p_slflag, PSL_TRACEVFORK); 889 else 890 CLR(t->p_slflag, PSL_TRACEVFORK); 891 #else 892 if (pe.pe_set_event & PTRACE_VFORK) { 893 error = ENOTSUP; 894 break; 895 } 896 #endif 897 if (pe.pe_set_event & PTRACE_VFORK_DONE) 898 SET(t->p_slflag, PSL_TRACEVFORK_DONE); 899 else 900 CLR(t->p_slflag, PSL_TRACEVFORK_DONE); 901 if (pe.pe_set_event & PTRACE_LWP_CREATE) 902 SET(t->p_slflag, PSL_TRACELWP_CREATE); 903 else 904 CLR(t->p_slflag, PSL_TRACELWP_CREATE); 905 if (pe.pe_set_event & PTRACE_LWP_EXIT) 906 SET(t->p_slflag, PSL_TRACELWP_EXIT); 907 else 908 CLR(t->p_slflag, PSL_TRACELWP_EXIT); 909 break; 910 911 case PT_GET_PROCESS_STATE: 912 if (data != sizeof(ps)) { 913 DPRINTF(("ptrace(%d): %d != %zu\n", req, data, 914 sizeof(ps))); 915 error = EINVAL; 916 break; 917 } 918 memset(&ps, 0, sizeof(ps)); 919 if (t->p_fpid) { 920 ps.pe_report_event = PTRACE_FORK; 921 ps.pe_other_pid = t->p_fpid; 922 } else if (t->p_vfpid) { 923 ps.pe_report_event = PTRACE_VFORK; 924 ps.pe_other_pid = t->p_vfpid; 925 } else if (t->p_vfpid_done) { 926 ps.pe_report_event = PTRACE_VFORK_DONE; 927 ps.pe_other_pid = t->p_vfpid_done; 928 } else if (t->p_lwp_created) { 929 ps.pe_report_event = PTRACE_LWP_CREATE; 930 ps.pe_lwp = t->p_lwp_created; 931 } else if (t->p_lwp_exited) { 932 ps.pe_report_event = PTRACE_LWP_EXIT; 933 ps.pe_lwp = t->p_lwp_exited; 934 } 935 error = copyout(&ps, addr, sizeof(ps)); 936 break; 937 938 case PT_LWPINFO: 939 if (data != sizeof(pl)) { 940 DPRINTF(("ptrace(%d): %d != %zu\n", req, data, 941 sizeof(pl))); 942 error = EINVAL; 943 break; 944 } 945 error = copyin(addr, &pl, sizeof(pl)); 946 if (error) 947 break; 948 tmp = pl.pl_lwpid; 949 lwp_delref(lt); 950 mutex_enter(t->p_lock); 951 if (tmp == 0) 952 lt = lwp_find_first(t); 953 else { 954 lt = lwp_find(t, tmp); 955 if (lt == NULL) { 956 mutex_exit(t->p_lock); 957 error = ESRCH; 958 break; 959 } 960 lt = LIST_NEXT(lt, l_sibling); 961 } 962 while (lt != NULL && !lwp_alive(lt)) 963 lt = LIST_NEXT(lt, l_sibling); 964 pl.pl_lwpid = 0; 965 pl.pl_event = 0; 966 if (lt) { 967 lwp_addref(lt); 968 pl.pl_lwpid = lt->l_lid; 969 /* 970 * If we match the lwp, or it was sent to every lwp, 971 * we set PL_EVENT_SIGNAL. 972 * XXX: ps_lwp == 0 means everyone and noone, so 973 * check ps_signo too. 974 */ 975 if (lt->l_lid == t->p_sigctx.ps_lwp 976 || (t->p_sigctx.ps_lwp == 0 && 977 t->p_sigctx.ps_info._signo)) 978 pl.pl_event = PL_EVENT_SIGNAL; 979 } 980 mutex_exit(t->p_lock); 981 982 error = copyout(&pl, addr, sizeof(pl)); 983 break; 984 985 case PT_SET_SIGINFO: 986 if (data != sizeof(psi)) { 987 DPRINTF(("ptrace(%d): %d != %zu\n", req, data, 988 sizeof(psi))); 989 error = EINVAL; 990 break; 991 } 992 993 error = copyin(addr, &psi, sizeof(psi)); 994 if (error) 995 break; 996 997 /* Check that the data is a valid signal number or zero. */ 998 if (psi.psi_siginfo.si_signo < 0 || 999 psi.psi_siginfo.si_signo >= NSIG) { 1000 error = EINVAL; 1001 break; 1002 } 1003 1004 tmp = psi.psi_lwpid; 1005 if (tmp != 0) 1006 lwp_delref(lt); 1007 1008 mutex_enter(t->p_lock); 1009 1010 if (tmp != 0) { 1011 lt = lwp_find(t, tmp); 1012 if (lt == NULL) { 1013 mutex_exit(t->p_lock); 1014 error = ESRCH; 1015 break; 1016 } 1017 lwp_addref(lt); 1018 } 1019 1020 t->p_sigctx.ps_faked = true; 1021 t->p_sigctx.ps_info = psi.psi_siginfo._info; 1022 t->p_sigctx.ps_lwp = psi.psi_lwpid; 1023 mutex_exit(t->p_lock); 1024 break; 1025 1026 case PT_GET_SIGINFO: 1027 if (data != sizeof(psi)) { 1028 DPRINTF(("ptrace(%d): %d != %zu\n", req, data, 1029 sizeof(psi))); 1030 error = EINVAL; 1031 break; 1032 } 1033 mutex_enter(t->p_lock); 1034 psi.psi_siginfo._info = t->p_sigctx.ps_info; 1035 psi.psi_lwpid = t->p_sigctx.ps_lwp; 1036 mutex_exit(t->p_lock); 1037 1038 error = copyout(&psi, addr, sizeof(psi)); 1039 if (error) 1040 break; 1041 1042 break; 1043 1044 #ifdef PT_SETREGS 1045 case PT_SETREGS: 1046 write = 1; 1047 #endif 1048 #ifdef PT_GETREGS 1049 case PT_GETREGS: 1050 /* write = 0 done above. */ 1051 #endif 1052 #if defined(PT_SETREGS) || defined(PT_GETREGS) 1053 tmp = data; 1054 if (tmp != 0 && t->p_nlwps > 1) { 1055 lwp_delref(lt); 1056 mutex_enter(t->p_lock); 1057 lt = lwp_find(t, tmp); 1058 if (lt == NULL) { 1059 mutex_exit(t->p_lock); 1060 error = ESRCH; 1061 break; 1062 } 1063 lwp_addref(lt); 1064 mutex_exit(t->p_lock); 1065 } 1066 if (!process_validregs(lt)) 1067 error = EINVAL; 1068 else { 1069 error = proc_vmspace_getref(p, &vm); 1070 if (error) 1071 break; 1072 iov.iov_base = addr; 1073 iov.iov_len = PROC_REGSZ(p); 1074 uio.uio_iov = &iov; 1075 uio.uio_iovcnt = 1; 1076 uio.uio_offset = 0; 1077 uio.uio_resid = iov.iov_len; 1078 uio.uio_rw = write ? UIO_WRITE : UIO_READ; 1079 uio.uio_vmspace = vm; 1080 1081 error = ptm->ptm_doregs(l, lt, &uio); 1082 uvmspace_free(vm); 1083 } 1084 break; 1085 #endif 1086 1087 #ifdef PT_SETFPREGS 1088 case PT_SETFPREGS: 1089 write = 1; 1090 /*FALLTHROUGH*/ 1091 #endif 1092 #ifdef PT_GETFPREGS 1093 case PT_GETFPREGS: 1094 /* write = 0 done above. */ 1095 #endif 1096 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS) 1097 tmp = data; 1098 if (tmp != 0 && t->p_nlwps > 1) { 1099 lwp_delref(lt); 1100 mutex_enter(t->p_lock); 1101 lt = lwp_find(t, tmp); 1102 if (lt == NULL) { 1103 mutex_exit(t->p_lock); 1104 error = ESRCH; 1105 break; 1106 } 1107 lwp_addref(lt); 1108 mutex_exit(t->p_lock); 1109 } 1110 if (!process_validfpregs(lt)) 1111 error = EINVAL; 1112 else { 1113 error = proc_vmspace_getref(p, &vm); 1114 if (error) 1115 break; 1116 iov.iov_base = addr; 1117 iov.iov_len = PROC_FPREGSZ(p); 1118 uio.uio_iov = &iov; 1119 uio.uio_iovcnt = 1; 1120 uio.uio_offset = 0; 1121 uio.uio_resid = iov.iov_len; 1122 uio.uio_rw = write ? UIO_WRITE : UIO_READ; 1123 uio.uio_vmspace = vm; 1124 1125 error = ptm->ptm_dofpregs(l, lt, &uio); 1126 uvmspace_free(vm); 1127 } 1128 break; 1129 #endif 1130 1131 #ifdef __HAVE_PTRACE_WATCHPOINTS 1132 /* 1133 * The "write" variable is used as type of operation. 1134 * Possible values: 1135 * 0 - return the number of supported hardware watchpoints 1136 * 1 - set new watchpoint value 1137 * 2 - get existing watchpoint image 1138 */ 1139 case PT_WRITE_WATCHPOINT: 1140 write = 1; 1141 case PT_READ_WATCHPOINT: 1142 /* write = 0 done above */ 1143 1144 if (data != sizeof(pw)) { 1145 DPRINTF(("ptrace(%d): %d != %zu\n", req, 1146 data, sizeof(pe))); 1147 error = EINVAL; 1148 break; 1149 } 1150 error = copyin(addr, &pw, sizeof(pw)); 1151 if (error) 1152 break; 1153 tmp = pw.pw_lwpid; 1154 if (tmp != 0 && t->p_nlwps > 1) { 1155 lwp_delref(lt); 1156 mutex_enter(t->p_lock); 1157 lt = lwp_find(t, tmp); 1158 if (lt == NULL) { 1159 mutex_exit(t->p_lock); 1160 error = ESRCH; 1161 break; 1162 } 1163 lwp_addref(lt); 1164 mutex_exit(t->p_lock); 1165 } 1166 ++write; 1167 case PT_COUNT_WATCHPOINTS: 1168 if (!process_validwatchpoint(lt)) 1169 error = EINVAL; 1170 else { 1171 lwp_lock(lt); 1172 error = ptm->ptm_dowatchpoint(l, lt, write, &pw, addr, 1173 retval); 1174 lwp_unlock(lt); 1175 } 1176 break; 1177 #endif 1178 1179 #ifdef __HAVE_PTRACE_MACHDEP 1180 PTRACE_MACHDEP_REQUEST_CASES 1181 error = ptrace_machdep_dorequest(l, lt, req, addr, data); 1182 break; 1183 #endif 1184 } 1185 1186 if (pheld) { 1187 mutex_exit(t->p_lock); 1188 mutex_exit(proc_lock); 1189 } 1190 if (lt != NULL) 1191 lwp_delref(lt); 1192 rw_exit(&t->p_reflock); 1193 1194 return error; 1195 } 1196 1197 int 1198 process_doregs(struct lwp *curl /*tracer*/, 1199 struct lwp *l /*traced*/, 1200 struct uio *uio) 1201 { 1202 #if defined(PT_GETREGS) || defined(PT_SETREGS) 1203 int error; 1204 struct reg r; 1205 char *kv; 1206 int kl; 1207 1208 if (uio->uio_offset < 0 || uio->uio_offset > (off_t)sizeof(r)) 1209 return EINVAL; 1210 1211 kl = sizeof(r); 1212 kv = (char *)&r; 1213 1214 kv += uio->uio_offset; 1215 kl -= uio->uio_offset; 1216 if ((size_t)kl > uio->uio_resid) 1217 kl = uio->uio_resid; 1218 1219 error = process_read_regs(l, &r); 1220 if (error == 0) 1221 error = uiomove(kv, kl, uio); 1222 if (error == 0 && uio->uio_rw == UIO_WRITE) { 1223 if (l->l_stat != LSSTOP) 1224 error = EBUSY; 1225 else 1226 error = process_write_regs(l, &r); 1227 } 1228 1229 uio->uio_offset = 0; 1230 return error; 1231 #else 1232 return EINVAL; 1233 #endif 1234 } 1235 1236 int 1237 process_validregs(struct lwp *l) 1238 { 1239 1240 #if defined(PT_SETREGS) || defined(PT_GETREGS) 1241 return (l->l_flag & LW_SYSTEM) == 0; 1242 #else 1243 return 0; 1244 #endif 1245 } 1246 1247 int 1248 process_dofpregs(struct lwp *curl /*tracer*/, 1249 struct lwp *l /*traced*/, 1250 struct uio *uio) 1251 { 1252 #if defined(PT_GETFPREGS) || defined(PT_SETFPREGS) 1253 int error; 1254 struct fpreg r; 1255 char *kv; 1256 size_t kl; 1257 1258 if (uio->uio_offset < 0 || uio->uio_offset > (off_t)sizeof(r)) 1259 return EINVAL; 1260 1261 kl = sizeof(r); 1262 kv = (char *)&r; 1263 1264 kv += uio->uio_offset; 1265 kl -= uio->uio_offset; 1266 if (kl > uio->uio_resid) 1267 kl = uio->uio_resid; 1268 1269 error = process_read_fpregs(l, &r, &kl); 1270 if (error == 0) 1271 error = uiomove(kv, kl, uio); 1272 if (error == 0 && uio->uio_rw == UIO_WRITE) { 1273 if (l->l_stat != LSSTOP) 1274 error = EBUSY; 1275 else 1276 error = process_write_fpregs(l, &r, kl); 1277 } 1278 uio->uio_offset = 0; 1279 return error; 1280 #else 1281 return EINVAL; 1282 #endif 1283 } 1284 1285 int 1286 process_validfpregs(struct lwp *l) 1287 { 1288 1289 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS) 1290 return (l->l_flag & LW_SYSTEM) == 0; 1291 #else 1292 return 0; 1293 #endif 1294 } 1295 1296 static int 1297 process_auxv_offset(struct proc *p, struct uio *uio) 1298 { 1299 struct ps_strings pss; 1300 int error; 1301 off_t off = (off_t)p->p_psstrp; 1302 1303 if ((error = copyin_psstrings(p, &pss)) != 0) 1304 return error; 1305 1306 if (pss.ps_envstr == NULL) 1307 return EIO; 1308 1309 uio->uio_offset += (off_t)(vaddr_t)(pss.ps_envstr + pss.ps_nenvstr + 1); 1310 #ifdef __MACHINE_STACK_GROWS_UP 1311 if (uio->uio_offset < off) 1312 return EIO; 1313 #else 1314 if (uio->uio_offset > off) 1315 return EIO; 1316 if ((uio->uio_offset + uio->uio_resid) > off) 1317 uio->uio_resid = off - uio->uio_offset; 1318 #endif 1319 return 0; 1320 } 1321 1322 int 1323 process_dowatchpoint(struct lwp *curl /*tracer*/, struct lwp *l /*traced*/, 1324 int operation, struct ptrace_watchpoint *pw, void *addr, 1325 register_t *retval) 1326 { 1327 1328 #ifdef __HAVE_PTRACE_WATCHPOINTS 1329 int error; 1330 1331 KASSERT(operation >= 0); 1332 KASSERT(operation <= 2); 1333 1334 switch (operation) { 1335 case 0: 1336 return process_count_watchpoints(l, retval); 1337 case 1: 1338 error = process_read_watchpoint(l, pw); 1339 if (error) 1340 return error; 1341 return copyout(pw, addr, sizeof(*pw)); 1342 default: 1343 return process_write_watchpoint(l, pw); 1344 } 1345 #else 1346 return EINVAL; 1347 #endif 1348 } 1349 1350 int 1351 process_validwatchpoint(struct lwp *l) 1352 { 1353 1354 #ifdef __HAVE_PTRACE_WATCHPOINTS 1355 return (l->l_flag & LW_SYSTEM) == 0; 1356 #else 1357 return 0; 1358 #endif 1359 } 1360 #endif /* PTRACE */ 1361 1362 MODULE(MODULE_CLASS_EXEC, ptrace_common, ""); 1363 1364 static int 1365 ptrace_common_modcmd(modcmd_t cmd, void *arg) 1366 { 1367 int error; 1368 1369 switch (cmd) { 1370 case MODULE_CMD_INIT: 1371 error = ptrace_init(); 1372 break; 1373 case MODULE_CMD_FINI: 1374 error = ptrace_fini(); 1375 break; 1376 default: 1377 ptrace_hooks(); 1378 error = ENOTTY; 1379 break; 1380 } 1381 return error; 1382 } 1383
Indexes created Thu Sep 25 16:09:42 GMT 2025