2 * Copyright (c) 1994, Sean Eric Fagan
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by Sean Eric Fagan.
16 * 4. The name of the author may not be used to endorse or promote products
17 * derived from this software without specific prior written permission.
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * $FreeBSD: src/sys/kern/sys_process.c,v 1.51.2.6 2003/01/08 03:06:45 kan Exp $
32 * $DragonFly: src/sys/kern/sys_process.c,v 1.19 2005/11/21 21:59:50 dillon Exp $
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/sysproto.h>
39 #include <sys/vnode.h>
40 #include <sys/ptrace.h>
42 #include <machine/reg.h>
46 #include <vm/vm_map.h>
47 #include <vm/vm_page.h>
50 #include <vfs/procfs/procfs.h>
51 #include <sys/thread2.h>
53 /* use the equivalent procfs code */
56 pread (struct proc
*procp
, unsigned int addr
, unsigned int *retval
) {
61 int page_offset
; /* offset into page */
62 vm_offset_t pageno
; /* page number */
63 vm_map_entry_t out_entry
;
68 /* Map page into kernel space */
70 map
= &procp
->p_vmspace
->vm_map
;
72 page_offset
= addr
- trunc_page(addr
);
73 pageno
= trunc_page(addr
);
76 rv
= vm_map_lookup (&tmap
, pageno
, VM_PROT_READ
, &out_entry
,
77 &object
, &pindex
, &out_prot
, &wired
);
79 if (rv
!= KERN_SUCCESS
)
82 vm_map_lookup_done (tmap
, out_entry
, 0);
84 /* Find space in kernel_map for the page we're interested in */
85 rv
= vm_map_find (kernel_map
, object
, IDX_TO_OFF(pindex
),
86 &kva
, PAGE_SIZE
, 0, VM_PROT_ALL
, VM_PROT_ALL
, 0);
89 vm_object_reference (object
);
91 rv
= vm_map_wire (kernel_map
, kva
, kva
+ PAGE_SIZE
, 0);
94 bcopy ((caddr_t
)kva
+ page_offset
,
95 retval
, sizeof *retval
);
97 vm_map_remove (kernel_map
, kva
, kva
+ PAGE_SIZE
);
104 pwrite (struct proc
*procp
, unsigned int addr
, unsigned int datum
) {
109 int page_offset
; /* offset into page */
110 vm_offset_t pageno
; /* page number */
111 vm_map_entry_t out_entry
;
115 boolean_t fix_prot
= 0;
117 /* Map page into kernel space */
119 map
= &procp
->p_vmspace
->vm_map
;
121 page_offset
= addr
- trunc_page(addr
);
122 pageno
= trunc_page(addr
);
125 * Check the permissions for the area we're interested in.
128 if (vm_map_check_protection (map
, pageno
, pageno
+ PAGE_SIZE
,
129 VM_PROT_WRITE
) == FALSE
) {
131 * If the page was not writable, we make it so.
132 * XXX It is possible a page may *not* be read/executable,
133 * if a process changes that!
136 /* The page isn't writable, so let's try making it so... */
137 if ((rv
= vm_map_protect (map
, pageno
, pageno
+ PAGE_SIZE
,
138 VM_PROT_ALL
, 0)) != KERN_SUCCESS
)
139 return EFAULT
; /* I guess... */
143 * Now we need to get the page. out_entry, out_prot, wired, and
144 * single_use aren't used. One would think the vm code would be
145 * a *bit* nicer... We use tmap because vm_map_lookup() can
146 * change the map argument.
150 rv
= vm_map_lookup (&tmap
, pageno
, VM_PROT_WRITE
, &out_entry
,
151 &object
, &pindex
, &out_prot
, &wired
);
152 if (rv
!= KERN_SUCCESS
) {
157 * Okay, we've got the page. Let's release tmap.
160 vm_map_lookup_done (tmap
, out_entry
, 0);
163 * Fault the page in...
166 rv
= vm_fault(map
, pageno
, VM_PROT_WRITE
|VM_PROT_READ
, FALSE
);
167 if (rv
!= KERN_SUCCESS
)
170 /* Find space in kernel_map for the page we're interested in */
171 rv
= vm_map_find (kernel_map
, object
, IDX_TO_OFF(pindex
),
173 VM_PROT_ALL
, VM_PROT_ALL
, 0);
175 vm_object_reference (object
);
177 rv
= vm_map_wire (kernel_map
, kva
, kva
+ PAGE_SIZE
, 0);
179 bcopy (&datum
, (caddr_t
)kva
+ page_offset
, sizeof datum
);
181 vm_map_remove (kernel_map
, kva
, kva
+ PAGE_SIZE
);
185 vm_map_protect (map
, pageno
, pageno
+ PAGE_SIZE
,
186 VM_PROT_READ
|VM_PROT_EXECUTE
, 0);
192 * Process debugging system call.
195 ptrace(struct ptrace_args
*uap
)
197 struct proc
*p
= curproc
;
200 * XXX this obfuscation is to reduce stack usage, but the register
201 * structs may be too large to put on the stack anyway.
204 struct ptrace_io_desc piod
;
221 error
= copyin(uap
->addr
, &r
.reg
, sizeof r
.reg
);
224 error
= copyin(uap
->addr
, &r
.fpreg
, sizeof r
.fpreg
);
228 error
= copyin(uap
->addr
, &r
.dbreg
, sizeof r
.dbreg
);
232 error
= copyin(uap
->addr
, &r
.piod
, sizeof r
.piod
);
240 error
= kern_ptrace(p
, uap
->req
, uap
->pid
, addr
, uap
->data
,
241 &uap
->sysmsg_result
);
247 (void)copyout(&r
.piod
, uap
->addr
, sizeof r
.piod
);
250 error
= copyout(&r
.reg
, uap
->addr
, sizeof r
.reg
);
253 error
= copyout(&r
.fpreg
, uap
->addr
, sizeof r
.fpreg
);
257 error
= copyout(&r
.dbreg
, uap
->addr
, sizeof r
.dbreg
);
266 kern_ptrace(struct proc
*curp
, int req
, pid_t pid
, void *addr
, int data
, int *res
)
271 struct ptrace_io_desc
*piod
;
276 if (req
== PT_TRACE_ME
) {
279 if ((p
= pfind(pid
)) == NULL
)
282 if (!PRISON_CHECK(curp
->p_ucred
, p
->p_ucred
))
285 /* Can't trace a process that's currently exec'ing. */
286 if ((p
->p_flag
& P_INEXEC
) != 0)
299 if (p
->p_pid
== curp
->p_pid
)
303 if (p
->p_flag
& P_TRACED
)
306 if (curp
->p_flag
& P_TRACED
)
307 for (pp
= curp
->p_pptr
; pp
!= NULL
; pp
= pp
->p_pptr
)
311 /* not owned by you, has done setuid (unless you're root) */
312 if ((p
->p_ucred
->cr_ruid
!= curp
->p_ucred
->cr_ruid
) ||
313 (p
->p_flag
& P_SUGID
)) {
314 if ((error
= suser(curp
->p_thread
)) != 0)
318 /* can't trace init when securelevel > 0 */
319 if (securelevel
> 0 && p
->p_pid
== 1)
352 /* not being traced... */
353 if ((p
->p_flag
& P_TRACED
) == 0)
356 /* not being traced by YOU */
357 if (p
->p_pptr
!= curp
)
360 /* not currently stopped */
361 if ((p
->p_flag
& P_STOPPED
) == 0 ||
362 (p
->p_flag
& P_WAITED
) == 0) {
375 * Single step fixup ala procfs
381 * Actually do the requests
388 /* set my trace flag and "owner" so it can read/write me */
389 p
->p_flag
|= P_TRACED
;
390 p
->p_oppid
= p
->p_pptr
->p_pid
;
394 /* security check done above */
395 p
->p_flag
|= P_TRACED
;
396 p
->p_oppid
= p
->p_pptr
->p_pid
;
397 if (p
->p_pptr
!= curp
)
398 proc_reparent(p
, curp
);
400 goto sendsig
; /* in PT_CONTINUE below */
405 /* Zero means do not send any signal */
406 if (data
< 0 || data
> _SIG_MAXSIG
)
411 if (req
== PT_STEP
) {
412 if ((error
= ptrace_single_step (&p
->p_lwp
))) {
418 if (addr
!= (void *)1) {
419 if ((error
= ptrace_set_pc (p
,
420 (u_long
)(uintfptr_t
)addr
))) {
427 if (req
== PT_DETACH
) {
428 /* reset process parent */
429 if (p
->p_oppid
!= p
->p_pptr
->p_pid
) {
432 pp
= pfind(p
->p_oppid
);
433 proc_reparent(p
, pp
? pp
: initproc
);
436 p
->p_flag
&= ~(P_TRACED
| P_WAITED
);
439 /* should we send SIGCHLD? */
444 * Deliver or queue signal. If the process is stopped
445 * force it to SRUN again.
448 if (p
->p_flag
& P_STOPPED
) {
450 p
->p_flag
|= P_BREAKTSLEEP
;
465 * NOTE! uio_offset represents the offset in the target
466 * process. The iov is in the current process (the guy
467 * making the ptrace call) so uio_td must be the current
468 * process (though for a SYSSPACE transfer it doesn't
472 /* write = 0 set above */
473 iov
.iov_base
= write
? (caddr_t
)&data
: (caddr_t
)&tmp
;
474 iov
.iov_len
= sizeof(int);
477 uio
.uio_offset
= (off_t
)(uintptr_t)addr
;
478 uio
.uio_resid
= sizeof(int);
479 uio
.uio_segflg
= UIO_SYSSPACE
;
480 uio
.uio_rw
= write
? UIO_WRITE
: UIO_READ
;
481 uio
.uio_td
= curp
->p_thread
;
482 error
= procfs_domem(curp
, p
, NULL
, &uio
);
483 if (uio
.uio_resid
!= 0) {
485 * XXX procfs_domem() doesn't currently return ENOSPC,
486 * so I think write() can bogusly return 0.
487 * XXX what happens for short writes? We don't want
488 * to write partial data.
489 * XXX procfs_domem() returns EPERM for other invalid
490 * addresses. Convert this to EINVAL. Does this
491 * clobber returns of EPERM for other reasons?
493 if (error
== 0 || error
== ENOSPC
|| error
== EPERM
)
494 error
= EINVAL
; /* EOF */
502 * NOTE! uio_offset represents the offset in the target
503 * process. The iov is in the current process (the guy
504 * making the ptrace call) so uio_td must be the current
508 iov
.iov_base
= piod
->piod_addr
;
509 iov
.iov_len
= piod
->piod_len
;
512 uio
.uio_offset
= (off_t
)(uintptr_t)piod
->piod_offs
;
513 uio
.uio_resid
= piod
->piod_len
;
514 uio
.uio_segflg
= UIO_USERSPACE
;
515 uio
.uio_td
= curp
->p_thread
;
516 switch (piod
->piod_op
) {
519 uio
.uio_rw
= UIO_READ
;
523 uio
.uio_rw
= UIO_WRITE
;
528 error
= procfs_domem(curp
, p
, NULL
, &uio
);
529 piod
->piod_len
-= uio
.uio_resid
;
534 goto sendsig
; /* in PT_CONTINUE above */
540 #endif /* PT_SETREGS */
543 /* write = 0 above */
544 #endif /* PT_SETREGS */
545 #if defined(PT_SETREGS) || defined(PT_GETREGS)
546 if (!procfs_validregs(p
)) /* no P_SYSTEM procs please */
550 iov
.iov_len
= sizeof(struct reg
);
554 uio
.uio_resid
= sizeof(struct reg
);
555 uio
.uio_segflg
= UIO_SYSSPACE
;
556 uio
.uio_rw
= write
? UIO_WRITE
: UIO_READ
;
557 uio
.uio_td
= curp
->p_thread
;
558 return (procfs_doregs(curp
, p
, NULL
, &uio
));
560 #endif /* defined(PT_SETREGS) || defined(PT_GETREGS) */
566 #endif /* PT_SETFPREGS */
569 /* write = 0 above */
570 #endif /* PT_SETFPREGS */
571 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
572 if (!procfs_validfpregs(p
)) /* no P_SYSTEM procs please */
576 iov
.iov_len
= sizeof(struct fpreg
);
580 uio
.uio_resid
= sizeof(struct fpreg
);
581 uio
.uio_segflg
= UIO_SYSSPACE
;
582 uio
.uio_rw
= write
? UIO_WRITE
: UIO_READ
;
583 uio
.uio_td
= curp
->p_thread
;
584 return (procfs_dofpregs(curp
, p
, NULL
, &uio
));
586 #endif /* defined(PT_SETFPREGS) || defined(PT_GETFPREGS) */
592 #endif /* PT_SETDBREGS */
595 /* write = 0 above */
596 #endif /* PT_SETDBREGS */
597 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
598 if (!procfs_validdbregs(p
)) /* no P_SYSTEM procs please */
602 iov
.iov_len
= sizeof(struct dbreg
);
606 uio
.uio_resid
= sizeof(struct dbreg
);
607 uio
.uio_segflg
= UIO_SYSSPACE
;
608 uio
.uio_rw
= write
? UIO_WRITE
: UIO_READ
;
609 uio
.uio_td
= curp
->p_thread
;
610 return (procfs_dodbregs(curp
, p
, NULL
, &uio
));
612 #endif /* defined(PT_SETDBREGS) || defined(PT_GETDBREGS) */
631 * Stop a process because of a procfs event. Stay stopped until p->p_step
632 * is cleared (cleared by PIOCCONT in procfs).
637 stopevent(struct proc
*p
, unsigned int event
, unsigned int val
)
643 wakeup(&p
->p_stype
); /* Wake up any PIOCWAIT'ing procs */
645 p
->p_stype
= event
; /* Which event caused the stop? */
646 tsleep(&p
->p_step
, 0, "stopevent", 0);