1 /*-
2 * SPDX-License-Identifier: BSD-4-Clause
3 *
4 * Copyright (c) 1994, Sean Eric Fagan
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Sean Eric Fagan.
18 * 4. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include <sys/systm.h>
35 #include <sys/capsicum.h>
36 #include <sys/filedesc.h>
37 #include <sys/imgact.h>
38 #include <sys/ktr.h>
39 #include <sys/limits.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mman.h>
43 #include <sys/mutex.h>
44 #include <sys/priv.h>
45 #include <sys/proc.h>
46 #include <sys/procdesc.h>
47 #include <sys/ptrace.h>
48 #include <sys/reg.h>
49 #include <sys/rwlock.h>
50 #include <sys/signalvar.h>
51 #include <sys/sleepqueue.h>
52 #include <sys/sx.h>
53 #include <sys/syscallsubr.h>
54 #include <sys/sysctl.h>
55 #include <sys/sysent.h>
56 #include <sys/sysproto.h>
57 #include <sys/vnode.h>
58
59 #include <security/audit/audit.h>
60
61 #include <vm/vm.h>
62 #include <vm/pmap.h>
63 #include <vm/vm_extern.h>
64 #include <vm/vm_map.h>
65 #include <vm/vm_kern.h>
66 #include <vm/vm_object.h>
67 #include <vm/vm_page.h>
68 #include <vm/vm_param.h>
69
70 #ifdef COMPAT_FREEBSD32
71 #include <sys/procfs.h>
72 #endif
73
74 bool allow_ptrace_in_cap_mode = true;
75 SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace_in_cap_mode, CTLFLAG_RWTUN,
76 &allow_ptrace_in_cap_mode, 0,
77 "Allow ptrace(2) in capability mode");
78
79 /* Assert it's safe to unlock a process, e.g. to allocate working memory */
80 #define PROC_ASSERT_TRACEREQ(p) MPASS(((p)->p_flag2 & P2_PTRACEREQ) != 0)
81
82 /*
83 * Functions implemented below:
84 *
85 * proc_read_regs(proc, regs)
86 * Get the current user-visible register set from the process
87 * and copy it into the regs structure (<machine/reg.h>).
88 * The process is stopped at the time read_regs is called.
89 *
90 * proc_write_regs(proc, regs)
91 * Update the current register set from the passed in regs
92 * structure. Take care to avoid clobbering special CPU
93 * registers or privileged bits in the PSL.
94 * Depending on the architecture this may have fix-up work to do,
95 * especially if the IAR or PCW are modified.
96 * The process is stopped at the time write_regs is called.
97 *
98 * proc_read_fpregs, proc_write_fpregs
99 * deal with the floating point register set, otherwise as above.
100 *
101 * proc_read_dbregs, proc_write_dbregs
102 * deal with the processor debug register set, otherwise as above.
103 *
104 * proc_sstep(proc)
105 * Arrange for the process to trap after executing a single instruction.
106 */
107
108 int
proc_read_regs(struct thread * td,struct reg * regs)109 proc_read_regs(struct thread *td, struct reg *regs)
110 {
111 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
112 return (fill_regs(td, regs));
113 }
114
115 int
proc_write_regs(struct thread * td,struct reg * regs)116 proc_write_regs(struct thread *td, struct reg *regs)
117 {
118 int error;
119
120 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
121 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
122 if (error != 0)
123 return (error);
124 return (set_regs(td, regs));
125 }
126
127 int
proc_read_dbregs(struct thread * td,struct dbreg * dbregs)128 proc_read_dbregs(struct thread *td, struct dbreg *dbregs)
129 {
130 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
131 return (fill_dbregs(td, dbregs));
132 }
133
134 int
proc_write_dbregs(struct thread * td,struct dbreg * dbregs)135 proc_write_dbregs(struct thread *td, struct dbreg *dbregs)
136 {
137 int error;
138
139 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
140 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
141 if (error != 0)
142 return (error);
143 return (set_dbregs(td, dbregs));
144 }
145
146 /*
147 * Ptrace doesn't support fpregs at all, and there are no security holes
148 * or translations for fpregs, so we can just copy them.
149 */
150 int
proc_read_fpregs(struct thread * td,struct fpreg * fpregs)151 proc_read_fpregs(struct thread *td, struct fpreg *fpregs)
152 {
153 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
154 return (fill_fpregs(td, fpregs));
155 }
156
157 int
proc_write_fpregs(struct thread * td,struct fpreg * fpregs)158 proc_write_fpregs(struct thread *td, struct fpreg *fpregs)
159 {
160 int error;
161
162 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
163 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
164 if (error != 0)
165 return (error);
166 return (set_fpregs(td, fpregs));
167 }
168
169 static struct regset *
proc_find_regset(struct thread * td,int note)170 proc_find_regset(struct thread *td, int note)
171 {
172 struct regset **regsetp, **regset_end, *regset;
173 struct sysentvec *sv;
174
175 sv = td->td_proc->p_sysent;
176 regsetp = sv->sv_regset_begin;
177 if (regsetp == NULL)
178 return (NULL);
179 regset_end = sv->sv_regset_end;
180 MPASS(regset_end != NULL);
181 for (; regsetp < regset_end; regsetp++) {
182 regset = *regsetp;
183 if (regset->note != note)
184 continue;
185
186 return (regset);
187 }
188
189 return (NULL);
190 }
191
192 static int
proc_read_regset(struct thread * td,int note,struct iovec * iov)193 proc_read_regset(struct thread *td, int note, struct iovec *iov)
194 {
195 struct regset *regset;
196 struct proc *p;
197 void *buf;
198 size_t size;
199 int error;
200
201 regset = proc_find_regset(td, note);
202 if (regset == NULL)
203 return (EINVAL);
204
205 if (regset->get == NULL)
206 return (EINVAL);
207
208 size = regset->size;
209 /*
210 * The regset is dynamically sized, e.g. the size could change
211 * depending on the hardware, or may have a per-thread size.
212 */
213 if (size == 0) {
214 if (!regset->get(regset, td, NULL, &size))
215 return (EINVAL);
216 }
217
218 if (iov->iov_base == NULL) {
219 iov->iov_len = size;
220 if (iov->iov_len == 0)
221 return (EINVAL);
222
223 return (0);
224 }
225
226 /* The length is wrong, return an error */
227 if (iov->iov_len != size)
228 return (EINVAL);
229
230 error = 0;
231 p = td->td_proc;
232
233 /* Drop the proc lock while allocating the temp buffer */
234 PROC_ASSERT_TRACEREQ(p);
235 PROC_UNLOCK(p);
236 buf = malloc(size, M_TEMP, M_WAITOK);
237 PROC_LOCK(p);
238
239 if (!regset->get(regset, td, buf, &size)) {
240 error = EINVAL;
241 } else {
242 KASSERT(size == regset->size || regset->size == 0,
243 ("%s: Getter function changed the size", __func__));
244
245 iov->iov_len = size;
246 PROC_UNLOCK(p);
247 error = copyout(buf, iov->iov_base, size);
248 PROC_LOCK(p);
249 }
250
251 free(buf, M_TEMP);
252
253 return (error);
254 }
255
256 static int
proc_write_regset(struct thread * td,int note,struct iovec * iov)257 proc_write_regset(struct thread *td, int note, struct iovec *iov)
258 {
259 struct regset *regset;
260 struct proc *p;
261 void *buf;
262 size_t size;
263 int error;
264
265 regset = proc_find_regset(td, note);
266 if (regset == NULL)
267 return (EINVAL);
268
269 size = regset->size;
270 /*
271 * The regset is dynamically sized, e.g. the size could change
272 * depending on the hardware, or may have a per-thread size.
273 */
274 if (size == 0) {
275 if (!regset->get(regset, td, NULL, &size))
276 return (EINVAL);
277 }
278
279 /* The length is wrong, return an error */
280 if (iov->iov_len != size)
281 return (EINVAL);
282
283 if (regset->set == NULL)
284 return (EINVAL);
285
286 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
287 if (error != 0)
288 return (error);
289
290 p = td->td_proc;
291
292 /* Drop the proc lock while allocating the temp buffer */
293 PROC_ASSERT_TRACEREQ(p);
294 PROC_UNLOCK(p);
295 buf = malloc(size, M_TEMP, M_WAITOK);
296 error = copyin(iov->iov_base, buf, size);
297 PROC_LOCK(p);
298
299 if (error == 0) {
300 if (!regset->set(regset, td, buf, size)) {
301 error = EINVAL;
302 }
303 }
304
305 free(buf, M_TEMP);
306
307 return (error);
308 }
309
310 #ifdef COMPAT_FREEBSD32
311 /* For 32 bit binaries, we need to expose the 32 bit regs layouts. */
312 int
proc_read_regs32(struct thread * td,struct reg32 * regs32)313 proc_read_regs32(struct thread *td, struct reg32 *regs32)
314 {
315 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
316 return (fill_regs32(td, regs32));
317 }
318
319 int
proc_write_regs32(struct thread * td,struct reg32 * regs32)320 proc_write_regs32(struct thread *td, struct reg32 *regs32)
321 {
322 int error;
323
324 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
325 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
326 if (error != 0)
327 return (error);
328 return (set_regs32(td, regs32));
329 }
330
331 int
proc_read_dbregs32(struct thread * td,struct dbreg32 * dbregs32)332 proc_read_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
333 {
334 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
335 return (fill_dbregs32(td, dbregs32));
336 }
337
338 int
proc_write_dbregs32(struct thread * td,struct dbreg32 * dbregs32)339 proc_write_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
340 {
341 int error;
342
343 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
344 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
345 if (error != 0)
346 return (error);
347 return (set_dbregs32(td, dbregs32));
348 }
349
350 int
proc_read_fpregs32(struct thread * td,struct fpreg32 * fpregs32)351 proc_read_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
352 {
353 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
354 return (fill_fpregs32(td, fpregs32));
355 }
356
357 int
proc_write_fpregs32(struct thread * td,struct fpreg32 * fpregs32)358 proc_write_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
359 {
360 int error;
361
362 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
363 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
364 if (error != 0)
365 return (error);
366 return (set_fpregs32(td, fpregs32));
367 }
368 #endif
369
370 int
proc_sstep(struct thread * td)371 proc_sstep(struct thread *td)
372 {
373 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
374 return (ptrace_single_step(td));
375 }
376
377 static int
proc_vmspace_check_access(struct thread * td,struct proc * p,int flags)378 proc_vmspace_check_access(struct thread *td, struct proc *p, int flags)
379 {
380 PROC_ASSERT_HELD(p);
381 if ((flags & PRVM_CHECK_DEBUG) != 0)
382 return (p_candebug(td, p));
383 if ((flags & PRVM_CHECK_VISIBILITY) != 0)
384 return (p_cansee(td, p));
385 return (0);
386 }
387
388 int
proc_vmspace_ref(struct thread * td,struct proc * p,int flags,struct vmspace ** vmp)389 proc_vmspace_ref(struct thread *td, struct proc *p, int flags,
390 struct vmspace **vmp)
391 {
392 struct vmspace *vm;
393 int error;
394
395 MPASS((flags & ~(PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY |
396 PRVM_CHECK_DEBUG)) == 0);
397 MPASS((flags & (PRVM_CHECK_VISIBILITY | PRVM_CHECK_DEBUG)) !=
398 (PRVM_CHECK_VISIBILITY | PRVM_CHECK_DEBUG));
399
400 PROC_LOCK(p);
401 if (p != td->td_proc) {
402 PROC_ASSERT_HELD(p);
403
404 /*
405 * Make sure that the vmspace doesn't switch out from
406 * under us.
407 */
408 if ((flags & PRVM_BLOCK_EXEC) != 0) {
409 for (;;) {
410 if (!execve_block(td, p)) {
411 PROC_LOCK(p);
412 continue;
413 }
414 error = proc_vmspace_check_access(td, p, flags);
415 if (error != 0) {
416 execve_unblock(td, p);
417 PROC_UNLOCK(p);
418 return (error);
419 }
420 break;
421 }
422 } else {
423 error = proc_vmspace_check_access(td, p, flags);
424 if (error != 0) {
425 PROC_UNLOCK(p);
426 return (error);
427 }
428 }
429 }
430 vm = vmspace_acquire_ref(p);
431 if (vm == NULL) {
432 if (p != td->td_proc && (flags & PRVM_BLOCK_EXEC) != 0)
433 execve_unblock(td, p);
434 PROC_UNLOCK(p);
435 return (ESRCH);
436 }
437 PROC_UNLOCK(p);
438 *vmp = vm;
439 return (0);
440 }
441
442 void
proc_vmspace_unref(struct thread * td,struct proc * p,int flags,struct vmspace * vm)443 proc_vmspace_unref(struct thread *td, struct proc *p, int flags,
444 struct vmspace *vm)
445 {
446 vmspace_free(vm);
447 if (p != td->td_proc && (flags & PRVM_BLOCK_EXEC) != 0) {
448 PROC_LOCK(p);
449 PROC_ASSERT_HELD(p);
450 execve_unblock(td, p);
451 PROC_UNLOCK(p);
452 }
453 }
454
455 static int
vmspace_rwmem(struct vmspace * vm,struct uio * uio)456 vmspace_rwmem(struct vmspace *vm, struct uio *uio)
457 {
458 vm_map_t map;
459 vm_offset_t pageno; /* page number */
460 vm_prot_t reqprot;
461 ssize_t orig_resid;
462 int error, fault_flags, page_offset, writing;
463
464 map = &vm->vm_map;
465
466 /*
467 * If we are writing, then we request vm_fault() to create a private
468 * copy of each page. Since these copies will not be writeable by the
469 * process, we must explicitly request that they be dirtied.
470 */
471 writing = uio->uio_rw == UIO_WRITE;
472 reqprot = writing ? VM_PROT_COPY | VM_PROT_READ : VM_PROT_READ;
473 fault_flags = writing ? VM_FAULT_DIRTY : VM_FAULT_NORMAL;
474
475 orig_resid = uio->uio_resid;
476
477 if (writing) {
478 error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
479 if (error != 0)
480 return (error);
481 }
482
483 /*
484 * Only map in one page at a time. We don't have to, but it
485 * makes things easier. This way is trivial - right?
486 */
487 do {
488 vm_offset_t uva;
489 u_int len;
490 vm_page_t m;
491
492 uva = (vm_offset_t)uio->uio_offset;
493
494 /*
495 * Get the page number of this segment.
496 */
497 pageno = trunc_page(uva);
498 page_offset = uva - pageno;
499
500 /*
501 * How many bytes to copy
502 */
503 len = MIN(PAGE_SIZE - page_offset, uio->uio_resid);
504
505 /*
506 * Fault and hold the page on behalf of the process.
507 */
508 error = vm_fault(map, pageno, reqprot, fault_flags, &m);
509 if (error != KERN_SUCCESS) {
510 if (error == KERN_RESOURCE_SHORTAGE)
511 error = ENOMEM;
512 else
513 error = EFAULT;
514 break;
515 }
516
517 /*
518 * Now do the i/o move.
519 */
520 error = uiomove_fromphys(&m, page_offset, len, uio);
521
522 /* Make the I-cache coherent for breakpoints. */
523 if (writing && error == 0) {
524 vm_map_lock_read(map);
525 if (vm_map_check_protection(map, pageno, pageno +
526 PAGE_SIZE, VM_PROT_EXECUTE))
527 vm_sync_icache(map, uva, len);
528 vm_map_unlock_read(map);
529 }
530
531 /*
532 * Release the page.
533 */
534 vm_page_unwire(m, PQ_ACTIVE);
535
536 } while (error == 0 && uio->uio_resid > 0);
537 return (uio->uio_resid == orig_resid ? error : 0);
538 }
539
540 int
proc_rwmem(struct proc * p,struct uio * uio,int flags)541 proc_rwmem(struct proc *p, struct uio *uio, int flags)
542 {
543 struct vmspace *vm;
544 struct thread *td;
545 int error;
546
547 td = curthread;
548 error = proc_vmspace_ref(td, p, flags, &vm);
549 if (error != 0)
550 return (error);
551 error = vmspace_rwmem(vm, uio);
552 proc_vmspace_unref(td, p, flags, vm);
553 return (error);
554 }
555
556 ssize_t
vmspace_iop(struct thread * td,struct vmspace * vm,vm_offset_t va,void * buf,size_t len,enum uio_rw rw)557 vmspace_iop(struct thread *td, struct vmspace *vm, vm_offset_t va, void *buf,
558 size_t len, enum uio_rw rw)
559 {
560 struct iovec iov;
561 struct uio uio;
562 ssize_t slen;
563 int error;
564
565 MPASS(len < SSIZE_MAX);
566 slen = (ssize_t)len;
567
568 iov.iov_base = (caddr_t)buf;
569 iov.iov_len = len;
570 uio.uio_iov = &iov;
571 uio.uio_iovcnt = 1;
572 uio.uio_offset = va;
573 uio.uio_resid = slen;
574 uio.uio_segflg = UIO_SYSSPACE;
575 uio.uio_rw = rw;
576 uio.uio_td = td;
577 error = vmspace_rwmem(vm, &uio);
578 if (error != 0 || uio.uio_resid == slen)
579 return (-1);
580 return (slen - uio.uio_resid);
581 }
582
583 ssize_t
proc_readmem(struct thread * td,struct proc * p,vm_offset_t va,void * buf,size_t len)584 proc_readmem(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
585 size_t len)
586 {
587
588 return (vmspace_iop(td, p->p_vmspace, va, buf, len, UIO_READ));
589 }
590
591 ssize_t
proc_writemem(struct thread * td,struct proc * p,vm_offset_t va,void * buf,size_t len)592 proc_writemem(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
593 size_t len)
594 {
595
596 return (vmspace_iop(td, p->p_vmspace, va, buf, len, UIO_WRITE));
597 }
598
599 static int
ptrace_vm_entry(struct thread * td,struct proc * p,struct ptrace_vm_entry * pve)600 ptrace_vm_entry(struct thread *td, struct proc *p, struct ptrace_vm_entry *pve)
601 {
602 struct vattr vattr;
603 vm_map_t map;
604 vm_map_entry_t entry;
605 vm_object_t obj, tobj, lobj;
606 struct vmspace *vm;
607 struct vnode *vp;
608 char *freepath, *fullpath;
609 u_int pathlen;
610 int error, index;
611
612 error = 0;
613 obj = NULL;
614
615 vm = vmspace_acquire_ref(p);
616 map = &vm->vm_map;
617 vm_map_lock_read(map);
618
619 do {
620 KASSERT((map->header.eflags & MAP_ENTRY_IS_SUB_MAP) == 0,
621 ("Submap in map header"));
622 index = 0;
623 VM_MAP_ENTRY_FOREACH(entry, map) {
624 if (index >= pve->pve_entry &&
625 (entry->eflags & MAP_ENTRY_IS_SUB_MAP) == 0)
626 break;
627 index++;
628 }
629 if (index < pve->pve_entry) {
630 error = EINVAL;
631 break;
632 }
633 if (entry == &map->header) {
634 error = ENOENT;
635 break;
636 }
637
638 /* We got an entry. */
639 pve->pve_entry = index + 1;
640 pve->pve_timestamp = map->timestamp;
641 pve->pve_start = entry->start;
642 pve->pve_end = entry->end - 1;
643 pve->pve_offset = entry->offset;
644 pve->pve_prot = entry->protection |
645 PROT_MAX(entry->max_protection);
646
647 /* Backing object's path needed? */
648 if (pve->pve_pathlen == 0)
649 break;
650
651 pathlen = pve->pve_pathlen;
652 pve->pve_pathlen = 0;
653
654 obj = entry->object.vm_object;
655 if (obj != NULL)
656 VM_OBJECT_RLOCK(obj);
657 } while (0);
658
659 vm_map_unlock_read(map);
660
661 pve->pve_fsid = VNOVAL;
662 pve->pve_fileid = VNOVAL;
663
664 if (error == 0 && obj != NULL) {
665 lobj = obj;
666 for (tobj = obj; tobj != NULL; tobj = tobj->backing_object) {
667 if (tobj != obj)
668 VM_OBJECT_RLOCK(tobj);
669 if (lobj != obj)
670 VM_OBJECT_RUNLOCK(lobj);
671 lobj = tobj;
672 pve->pve_offset += tobj->backing_object_offset;
673 }
674 vp = vm_object_vnode(lobj);
675 if (vp != NULL)
676 vref(vp);
677 if (lobj != obj)
678 VM_OBJECT_RUNLOCK(lobj);
679 VM_OBJECT_RUNLOCK(obj);
680
681 if (vp != NULL) {
682 freepath = NULL;
683 fullpath = NULL;
684 vn_fullpath(vp, &fullpath, &freepath);
685 vn_lock(vp, LK_SHARED | LK_RETRY);
686 if (VOP_GETATTR(vp, &vattr, td->td_ucred) == 0) {
687 pve->pve_fileid = vattr.va_fileid;
688 pve->pve_fsid = vattr.va_fsid;
689 }
690 vput(vp);
691
692 if (fullpath != NULL) {
693 pve->pve_pathlen = strlen(fullpath) + 1;
694 if (pve->pve_pathlen <= pathlen) {
695 error = copyout(fullpath, pve->pve_path,
696 pve->pve_pathlen);
697 } else
698 error = ENAMETOOLONG;
699 }
700 if (freepath != NULL)
701 free(freepath, M_TEMP);
702 }
703 }
704 vmspace_free(vm);
705 if (error == 0)
706 CTR3(KTR_PTRACE, "PT_VM_ENTRY: pid %d, entry %d, start %p",
707 p->p_pid, pve->pve_entry, pve->pve_start);
708
709 return (error);
710 }
711
712 static int
ptrace_check_allowed(struct thread * td,int req,bool pd_mode,pid_t pid)713 ptrace_check_allowed(struct thread *td, int req, bool pd_mode, pid_t pid)
714 {
715 if (!allow_ptrace)
716 return (ENOSYS);
717 if (!IN_CAPABILITY_MODE(td))
718 return (0);
719 if (!allow_ptrace_in_cap_mode)
720 return (ECAPMODE);
721 if (pd_mode)
722 return (0);
723 if (req == PT_TRACE_ME)
724 return (0);
725 if (req == PT_GET_CHILDREN && pid == td->td_proc->p_pid)
726 return (0);
727 if (req == PT_CLEARSTEP && pid == td->td_tid)
728 return (0);
729 return (ECAPMODE);
730 }
731
732 /*
733 * Process debugging system call.
734 */
735 #ifndef _SYS_SYSPROTO_H_
736 struct ptrace_args {
737 int req;
738 pid_t pid;
739 caddr_t addr;
740 int data;
741 };
742 #endif
743
744 static int
ptrace_useraction(struct thread * td,int req,bool pd_mode,pid_t pid,int pfd,lwpid_t lwpid,void * uaddr,int udata)745 ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd,
746 lwpid_t lwpid, void *uaddr, int udata)
747 {
748 /*
749 * XXX this obfuscation is to reduce stack usage, but the register
750 * structs may be too large to put on the stack anyway.
751 */
752 union {
753 struct ptrace_io_desc piod;
754 struct ptrace_lwpinfo pl;
755 struct ptrace_vm_entry pve;
756 struct ptrace_coredump pc;
757 struct ptrace_sc_remote sr;
758 struct dbreg dbreg;
759 struct fpreg fpreg;
760 struct reg reg;
761 struct iovec vec;
762 syscallarg_t args[nitems(td->td_sa.args)];
763 struct ptrace_sc_ret psr;
764 int ptevents;
765 struct ptrace_child *children;
766 char sv_name[32];
767 } r;
768 syscallarg_t pscr_args[nitems(td->td_sa.args)];
769 void *addr;
770 int error, data;
771
772 error = ptrace_check_allowed(td, req, pd_mode, pid);
773 if (error != 0)
774 return (error);
775
776 addr = &r;
777 switch (req) {
778 case PT_GET_EVENT_MASK:
779 case PT_LWPINFO:
780 case PT_GET_SC_ARGS:
781 case PT_GET_SC_RET:
782 break;
783 case PT_SET_SC_RET:
784 error = udata != sizeof(r.psr) ? EINVAL :
785 copyin(uaddr, &r.psr, sizeof(r.psr));
786 break;
787 case PT_GETREGS:
788 bzero(&r.reg, sizeof(r.reg));
789 break;
790 case PT_GETFPREGS:
791 bzero(&r.fpreg, sizeof(r.fpreg));
792 break;
793 case PT_GETDBREGS:
794 bzero(&r.dbreg, sizeof(r.dbreg));
795 break;
796 case PT_GETREGSET:
797 case PT_SETREGSET:
798 error = copyin(uaddr, &r.vec, sizeof(r.vec));
799 break;
800 case PT_SETREGS:
801 error = copyin(uaddr, &r.reg, sizeof(r.reg));
802 break;
803 case PT_SETFPREGS:
804 error = copyin(uaddr, &r.fpreg, sizeof(r.fpreg));
805 break;
806 case PT_SETDBREGS:
807 error = copyin(uaddr, &r.dbreg, sizeof(r.dbreg));
808 break;
809 case PT_SET_EVENT_MASK:
810 error = udata != sizeof(r.ptevents) ? EINVAL :
811 copyin(uaddr, &r.ptevents, udata);
812 break;
813 case PT_IO:
814 error = copyin(uaddr, &r.piod, sizeof(r.piod));
815 break;
816 case PT_VM_ENTRY:
817 error = copyin(uaddr, &r.pve, sizeof(r.pve));
818 break;
819 case PT_COREDUMP:
820 error = udata != sizeof(r.pc) ? EINVAL :
821 copyin(uaddr, &r.pc, udata);
822 break;
823 case PT_SC_REMOTE:
824 error = udata != sizeof(r.sr) ? EINVAL :
825 copyin(uaddr, &r.sr, udata);
826 if (error != 0)
827 break;
828 if (r.sr.pscr_nargs > nitems(td->td_sa.args)) {
829 error = EINVAL;
830 break;
831 }
832 error = copyin(r.sr.pscr_args, pscr_args,
833 sizeof(u_long) * r.sr.pscr_nargs);
834 if (error != 0)
835 break;
836 r.sr.pscr_args = pscr_args;
837 break;
838 case PT_GET_CHILDREN:
839 if (uaddr == NULL)
840 addr = NULL;
841 else if (udata < 0)
842 error = EINVAL;
843 else
844 addr = &r.children;
845 break;
846 case PT_GET_ABI_NAME:
847 if (udata < 0) {
848 error = EINVAL;
849 break;
850 }
851 data = udata;
852 udata = sizeof(r.sv_name);
853 break;
854 case PTINTERNAL_FIRST ... PTINTERNAL_LAST:
855 error = EINVAL;
856 break;
857 default:
858 addr = uaddr;
859 break;
860 }
861 if (error != 0)
862 return (error);
863
864 error = ptrace_action(td, req, pd_mode, pid, pfd, lwpid, addr, udata);
865 if (error != 0)
866 return (error);
867
868 switch (req) {
869 case PT_VM_ENTRY:
870 error = copyout(&r.pve, uaddr, sizeof(r.pve));
871 break;
872 case PT_IO:
873 error = copyout(&r.piod, uaddr, sizeof(r.piod));
874 break;
875 case PT_GETREGS:
876 error = copyout(&r.reg, uaddr, sizeof(r.reg));
877 break;
878 case PT_GETFPREGS:
879 error = copyout(&r.fpreg, uaddr, sizeof(r.fpreg));
880 break;
881 case PT_GETDBREGS:
882 error = copyout(&r.dbreg, uaddr, sizeof(r.dbreg));
883 break;
884 case PT_GETREGSET:
885 error = copyout(&r.vec, uaddr, sizeof(r.vec));
886 break;
887 case PT_GET_EVENT_MASK:
888 /* NB: The size in uap->data is validated in ptraceimpl(). */
889 error = copyout(&r.ptevents, uaddr, udata);
890 break;
891 case PT_LWPINFO:
892 /* NB: The size in uap->data is validated in ptraceimpl(). */
893 error = copyout(&r.pl, uaddr, udata);
894 break;
895 case PT_GET_SC_ARGS:
896 error = copyout(r.args, uaddr, MIN(udata, sizeof(r.args)));
897 break;
898 case PT_GET_SC_RET:
899 error = copyout(&r.psr, uaddr, MIN(udata, sizeof(r.psr)));
900 break;
901 case PT_SC_REMOTE:
902 error = copyout(&r.sr.pscr_ret, (char *)uaddr +
903 offsetof(struct ptrace_sc_remote, pscr_ret),
904 sizeof(r.sr.pscr_ret));
905 break;
906 case PT_GET_CHILDREN:
907 if (uaddr != NULL) {
908 error = copyout(r.children, uaddr,
909 td->td_retval[0] * sizeof(struct ptrace_child));
910 free(r.children, M_TEMP);
911 }
912 break;
913 case PT_GET_ABI_NAME:
914 error = data <= strlen(r.sv_name) ? ENOMEM :
915 copyout(&r.sv_name, uaddr, strlen(r.sv_name) + 1);
916 break;
917 }
918
919 return (error);
920 }
921
922 #ifdef COMPAT_FREEBSD32
923 /*
924 * PROC_READ(regs, td2, addr);
925 * becomes either:
926 * proc_read_regs(td2, addr);
927 * or
928 * proc_read_regs32(td2, addr);
929 * .. except this is done at runtime. There is an additional
930 * complication in that PROC_WRITE disallows 32 bit consumers
931 * from writing to 64 bit address space targets.
932 */
933 #define PROC_READ(w, t, a) wrap32 ? \
934 proc_read_ ## w ## 32(t, a) : \
935 proc_read_ ## w (t, a)
936 #define PROC_WRITE(w, t, a) wrap32 ? \
937 (safe ? proc_write_ ## w ## 32(t, a) : EINVAL ) : \
938 proc_write_ ## w (t, a)
939 #else
940 #define PROC_READ(w, t, a) proc_read_ ## w (t, a)
941 #define PROC_WRITE(w, t, a) proc_write_ ## w (t, a)
942 #endif
943
944 void
proc_set_traced(struct proc * p,bool stop)945 proc_set_traced(struct proc *p, bool stop)
946 {
947
948 sx_assert(&proctree_lock, SX_XLOCKED);
949 PROC_LOCK_ASSERT(p, MA_OWNED);
950 p->p_flag |= P_TRACED;
951 if (stop)
952 p->p_flag2 |= P2_PTRACE_FSTP;
953 p->p_ptevents = PTRACE_DEFAULT;
954 }
955
956 void
ptrace_unsuspend(struct proc * p)957 ptrace_unsuspend(struct proc *p)
958 {
959 PROC_LOCK_ASSERT(p, MA_OWNED);
960
961 PROC_SLOCK(p);
962 p->p_flag &= ~(P_STOPPED_TRACE | P_STOPPED_SIG | P_WAITED);
963 thread_unsuspend(p);
964 PROC_SUNLOCK(p);
965 itimer_proc_continue(p);
966 kqtimer_proc_continue(p);
967 }
968
969 static int
proc_can_ptrace1(struct thread * td,struct proc * p)970 proc_can_ptrace1(struct thread *td, struct proc *p)
971 {
972 int error;
973
974 PROC_LOCK_ASSERT(p, MA_OWNED);
975
976 if ((p->p_flag & P_WEXIT) != 0)
977 return (ESRCH);
978 if ((error = p_cansee(td, p)) != 0)
979 return (error);
980 if ((error = p_candebug(td, p)) != 0)
981 return (error);
982 return (0);
983 }
984
985 static int
proc_can_ptrace(struct thread * td,struct proc * p)986 proc_can_ptrace(struct thread *td, struct proc *p)
987 {
988 int error;
989
990 PROC_LOCK_ASSERT(p, MA_OWNED);
991
992 if ((error = proc_can_ptrace1(td, p)) != 0)
993 return (error);
994
995 /* not being traced... */
996 if ((p->p_flag & P_TRACED) == 0)
997 return (EPERM);
998
999 /* not being traced by YOU */
1000 if (p->p_pptr != td->td_proc)
1001 return (EBUSY);
1002
1003 /* not currently stopped */
1004 if ((p->p_flag & P_STOPPED_TRACE) == 0 ||
1005 p->p_suspcount != p->p_numthreads ||
1006 (p->p_flag & P_WAITED) == 0)
1007 return (EBUSY);
1008
1009 return (0);
1010 }
1011
1012 static int
ptrace_count_children(struct thread * td,struct proc * p,bool count_everything)1013 ptrace_count_children(struct thread *td, struct proc *p, bool count_everything)
1014 {
1015 struct proc *pp;
1016 int error, num;
1017
1018 sx_assert(&proctree_lock, SX_LOCKED);
1019 num = 0;
1020 LIST_FOREACH(pp, &p->p_children, p_sibling) {
1021 if (count_everything) {
1022 error = 0;
1023 } else {
1024 PROC_LOCK(pp);
1025 error = p_cansee(td, pp);
1026 PROC_UNLOCK(pp);
1027 }
1028 if (error != 0)
1029 continue;
1030 num++;
1031 }
1032 LIST_FOREACH(pp, &p->p_orphans, p_orphan) {
1033 if (count_everything) {
1034 error = 0;
1035 } else {
1036 PROC_LOCK(pp);
1037 error = p_cansee(td, pp);
1038 PROC_UNLOCK(pp);
1039 }
1040 if (error != 0)
1041 continue;
1042 num++;
1043 }
1044 return (num);
1045 }
1046
1047 static bool
ptrace_report_child(struct thread * td,struct proc * p,struct proc * pp,struct ptrace_child * ptc)1048 ptrace_report_child(struct thread *td, struct proc *p, struct proc *pp,
1049 struct ptrace_child *ptc)
1050 {
1051 sx_assert(&proctree_lock, SX_LOCKED);
1052
1053 PROC_LOCK(pp);
1054 if (p_cansee(td, pp) != 0) {
1055 PROC_UNLOCK(pp);
1056 return (false);
1057 }
1058 ptc->pid = pp->p_pid;
1059 if ((pp->p_flag & P_TRACED) != 0) {
1060 ptc->flags |= PTCHLD_TRACED;
1061 if (pp->p_pptr == td->td_proc)
1062 ptc->flags |= PTCHLD_TRACED_BY_ME;
1063 }
1064 if ((pp->p_flag & P_WEXIT) != 0)
1065 ptc->flags |= PTCHLD_EXITED;
1066 PROC_UNLOCK(pp);
1067 return (true);
1068 }
1069
1070 static struct thread *
ptrace_sel_coredump_thread(struct proc * p)1071 ptrace_sel_coredump_thread(struct proc *p)
1072 {
1073 struct thread *td2;
1074
1075 PROC_LOCK_ASSERT(p, MA_OWNED);
1076 MPASS((p->p_flag & P_STOPPED_TRACE) != 0);
1077
1078 FOREACH_THREAD_IN_PROC(p, td2) {
1079 if ((td2->td_dbgflags & TDB_SSWITCH) != 0)
1080 return (td2);
1081 }
1082 return (NULL);
1083 }
1084
1085 int
ptrace_action(struct thread * td,int req,bool pd_mode,pid_t pid,int pfd,lwpid_t lwpid,void * addr,int data)1086 ptrace_action(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd,
1087 lwpid_t lwpid, void *addr, int data)
1088 {
1089 struct iovec iov;
1090 struct uio uio;
1091 struct proc *curp, *p, *pp;
1092 struct thread *td2 = NULL, *td3;
1093 struct ptrace_io_desc *piod = NULL;
1094 struct ptrace_lwpinfo *pl;
1095 struct ptrace_sc_ret *psr;
1096 struct ptrace_sc_remote *pscr;
1097 struct file *fp;
1098 struct ptrace_coredump *pc;
1099 struct thr_coredump_req *tcq;
1100 struct thr_syscall_req *tsr;
1101 struct file *pfp;
1102 struct ptrace_child *children, *ptc;
1103 int error, num, num1, tmp;
1104 lwpid_t tid = 0, *buf;
1105 #ifdef COMPAT_FREEBSD32
1106 int wrap32 = 0, safe = 0;
1107 #endif
1108 bool need_can_ptrace, proctree_locked, p2_req_set;
1109
1110 curp = td->td_proc;
1111 proctree_locked = false;
1112 p2_req_set = false;
1113 pfp = NULL;
1114
1115 /* Lock proctree before locking the process. */
1116 switch (req) {
1117 case PT_TRACE_ME:
1118 case PT_ATTACH:
1119 case PT_STEP:
1120 case PT_CONTINUE:
1121 case PT_TO_SCE:
1122 case PT_TO_SCX:
1123 case PT_SYSCALL:
1124 case PT_FOLLOW_FORK:
1125 case PT_LWP_EVENTS:
1126 case PT_GET_EVENT_MASK:
1127 case PT_SET_EVENT_MASK:
1128 case PT_DETACH:
1129 case PT_GET_SC_ARGS:
1130 case PT_GET_CHILDREN:
1131 sx_xlock(&proctree_lock);
1132 proctree_locked = true;
1133 break;
1134 default:
1135 break;
1136 }
1137
1138 if (req == PT_TRACE_ME) {
1139 p = td->td_proc;
1140 PROC_LOCK(p);
1141 } else if (pd_mode) {
1142 if (!proctree_locked)
1143 sx_slock(&proctree_lock);
1144 error = fget_procdesc(td, pfd, &cap_ptrace_rights, EINVAL,
1145 &pfp, NULL, &p);
1146 if (!proctree_locked)
1147 sx_sunlock(&proctree_lock);
1148 if (error != 0)
1149 goto fail_proctree;
1150 pid = p->p_pid;
1151 if (lwpid != -1) {
1152 FOREACH_THREAD_IN_PROC(p, td2) {
1153 if (td2->td_tid == lwpid)
1154 break;
1155 }
1156 if (td2 == NULL) {
1157 PROC_UNLOCK(p);
1158 error = ESRCH;
1159 goto fail_proctree;
1160 }
1161 tid = td2->td_tid;
1162 }
1163 } else if (pid <= PID_MAX) {
1164 if ((p = pfind(pid)) == NULL) {
1165 error = ESRCH;
1166 goto fail_proctree;
1167 }
1168 } else {
1169 td2 = tdfind(pid, -1);
1170 if (td2 == NULL) {
1171 error = ESRCH;
1172 goto fail_proctree;
1173 }
1174 p = td2->td_proc;
1175 tid = pid;
1176 pid = p->p_pid;
1177 }
1178 AUDIT_ARG_PROCESS(p);
1179
1180 error = proc_can_ptrace1(td, p);
1181 if (error != 0)
1182 goto fail;
1183
1184 /*
1185 * System processes can't be debugged.
1186 */
1187 if ((p->p_flag & P_SYSTEM) != 0) {
1188 error = EINVAL;
1189 goto fail;
1190 }
1191
1192 if (tid == 0) {
1193 if ((p->p_flag & P_STOPPED_TRACE) != 0)
1194 td2 = p->p_xthread;
1195 if (td2 == NULL)
1196 td2 = FIRST_THREAD_IN_PROC(p);
1197 tid = td2->td_tid;
1198 }
1199
1200 #ifdef COMPAT_FREEBSD32
1201 /*
1202 * Test if we're a 32 bit client and what the target is.
1203 * Set the wrap controls accordingly.
1204 */
1205 if (SV_CURPROC_FLAG(SV_ILP32)) {
1206 if (SV_PROC_FLAG(td2->td_proc, SV_ILP32))
1207 safe = 1;
1208 wrap32 = 1;
1209 }
1210 #endif
1211 /*
1212 * Permissions check
1213 */
1214 need_can_ptrace = true;
1215 switch (req) {
1216 case PT_TRACE_ME:
1217 /*
1218 * Always legal, when there is a parent process which
1219 * could trace us. Otherwise, reject.
1220 */
1221 if ((p->p_flag & P_TRACED) != 0) {
1222 error = EBUSY;
1223 goto fail;
1224 }
1225 if (p->p_pptr == initproc) {
1226 error = EPERM;
1227 goto fail;
1228 }
1229 break;
1230
1231 case PT_ATTACH:
1232 /* Self */
1233 if (p == td->td_proc) {
1234 error = EINVAL;
1235 goto fail;
1236 }
1237
1238 /* Already traced */
1239 if (p->p_flag & P_TRACED) {
1240 error = EBUSY;
1241 goto fail;
1242 }
1243
1244 /* Can't trace an ancestor if you're being traced. */
1245 if (curp->p_flag & P_TRACED) {
1246 for (pp = curp->p_pptr; pp != NULL; pp = pp->p_pptr) {
1247 if (pp == p) {
1248 error = EINVAL;
1249 goto fail;
1250 }
1251 }
1252 }
1253
1254 /* OK */
1255 break;
1256
1257 default:
1258 /*
1259 * Allow thread to clear single step for itself.
1260 * PT_GET_CHILDREN on itself does not need P_TRACED.
1261 */
1262 if ((req == PT_CLEARSTEP && td->td_tid == tid) ||
1263 (req == PT_GET_CHILDREN && p == curp))
1264 need_can_ptrace = false;
1265
1266 /*
1267 * Check for ptrace eligibility before waiting for
1268 * holds to drain.
1269 */
1270 if (need_can_ptrace) {
1271 error = proc_can_ptrace(td, p);
1272 if (error != 0)
1273 goto fail;
1274 }
1275
1276 /*
1277 * Block parallel ptrace requests. Most important, do
1278 * not allow other thread in debugger to continue the
1279 * debuggee until coredump finished.
1280 */
1281 while ((p->p_flag2 & P2_PTRACEREQ) != 0) {
1282 if (proctree_locked)
1283 sx_xunlock(&proctree_lock);
1284 error = msleep(&p->p_flag2, &p->p_mtx, PPAUSE | PCATCH |
1285 (proctree_locked ? PDROP : 0), "pptrace", 0);
1286 if (proctree_locked) {
1287 sx_xlock(&proctree_lock);
1288 PROC_LOCK(p);
1289 }
1290 if (error == 0 && td2->td_proc != p)
1291 error = ESRCH;
1292 if (error == 0 && need_can_ptrace)
1293 error = proc_can_ptrace(td, p);
1294 if (error != 0)
1295 goto fail;
1296 }
1297
1298 /* Ok */
1299 break;
1300 }
1301
1302 /*
1303 * Keep this process around and request parallel ptrace()
1304 * request to wait until we finish this request.
1305 */
1306 MPASS((p->p_flag2 & P2_PTRACEREQ) == 0);
1307 p->p_flag2 |= P2_PTRACEREQ;
1308 p2_req_set = true;
1309 _PHOLD(p);
1310
1311 /*
1312 * Actually do the requests
1313 */
1314
1315 td->td_retval[0] = 0;
1316
1317 switch (req) {
1318 case PT_TRACE_ME:
1319 /* set my trace flag and "owner" so it can read/write me */
1320 proc_set_traced(p, false);
1321 if (p->p_flag & P_PPWAIT)
1322 p->p_flag |= P_PPTRACE;
1323 CTR1(KTR_PTRACE, "PT_TRACE_ME: pid %d", p->p_pid);
1324 break;
1325
1326 case PT_ATTACH:
1327 /* security check done above */
1328 /*
1329 * It would be nice if the tracing relationship was separate
1330 * from the parent relationship but that would require
1331 * another set of links in the proc struct or for "wait"
1332 * to scan the entire proc table. To make life easier,
1333 * we just re-parent the process we're trying to trace.
1334 * The old parent is remembered so we can put things back
1335 * on a "detach".
1336 */
1337 proc_set_traced(p, true);
1338 proc_reparent(p, td->td_proc, false);
1339 CTR2(KTR_PTRACE, "PT_ATTACH: pid %d, oppid %d", p->p_pid,
1340 p->p_oppid);
1341
1342 sx_xunlock(&proctree_lock);
1343 proctree_locked = false;
1344 MPASS(p->p_xthread == NULL);
1345 MPASS((p->p_flag & P_STOPPED_TRACE) == 0);
1346
1347 /*
1348 * If already stopped due to a stop signal, clear the
1349 * existing stop before triggering a traced SIGSTOP.
1350 */
1351 if ((p->p_flag & P_STOPPED_SIG) != 0) {
1352 PROC_SLOCK(p);
1353 p->p_flag &= ~(P_STOPPED_SIG | P_WAITED);
1354 thread_unsuspend(p);
1355 PROC_SUNLOCK(p);
1356 }
1357
1358 kern_psignal(p, SIGSTOP);
1359 break;
1360
1361 case PT_CLEARSTEP:
1362 CTR2(KTR_PTRACE, "PT_CLEARSTEP: tid %d (pid %d)", td2->td_tid,
1363 p->p_pid);
1364 error = ptrace_clear_single_step(td2);
1365 break;
1366
1367 case PT_SETSTEP:
1368 CTR2(KTR_PTRACE, "PT_SETSTEP: tid %d (pid %d)", td2->td_tid,
1369 p->p_pid);
1370 error = ptrace_single_step(td2);
1371 break;
1372
1373 case PT_SUSPEND:
1374 CTR2(KTR_PTRACE, "PT_SUSPEND: tid %d (pid %d)", td2->td_tid,
1375 p->p_pid);
1376 td2->td_dbgflags |= TDB_SUSPEND;
1377 ast_sched(td2, TDA_SUSPEND);
1378 break;
1379
1380 case PT_RESUME:
1381 CTR2(KTR_PTRACE, "PT_RESUME: tid %d (pid %d)", td2->td_tid,
1382 p->p_pid);
1383 td2->td_dbgflags &= ~TDB_SUSPEND;
1384 break;
1385
1386 case PT_FOLLOW_FORK:
1387 CTR3(KTR_PTRACE, "PT_FOLLOW_FORK: pid %d %s -> %s", p->p_pid,
1388 p->p_ptevents & PTRACE_FORK ? "enabled" : "disabled",
1389 data ? "enabled" : "disabled");
1390 if (data)
1391 p->p_ptevents |= PTRACE_FORK;
1392 else
1393 p->p_ptevents &= ~PTRACE_FORK;
1394 break;
1395
1396 case PT_LWP_EVENTS:
1397 CTR3(KTR_PTRACE, "PT_LWP_EVENTS: pid %d %s -> %s", p->p_pid,
1398 p->p_ptevents & PTRACE_LWP ? "enabled" : "disabled",
1399 data ? "enabled" : "disabled");
1400 if (data)
1401 p->p_ptevents |= PTRACE_LWP;
1402 else
1403 p->p_ptevents &= ~PTRACE_LWP;
1404 break;
1405
1406 case PT_GET_EVENT_MASK:
1407 if (data != sizeof(p->p_ptevents)) {
1408 error = EINVAL;
1409 break;
1410 }
1411 CTR2(KTR_PTRACE, "PT_GET_EVENT_MASK: pid %d mask %#x", p->p_pid,
1412 p->p_ptevents);
1413 *(int *)addr = p->p_ptevents;
1414 break;
1415
1416 case PT_SET_EVENT_MASK:
1417 if (data != sizeof(p->p_ptevents)) {
1418 error = EINVAL;
1419 break;
1420 }
1421 tmp = *(int *)addr;
1422 if ((tmp & ~(PTRACE_EXEC | PTRACE_SCE | PTRACE_SCX |
1423 PTRACE_FORK | PTRACE_LWP | PTRACE_VFORK)) != 0) {
1424 error = EINVAL;
1425 break;
1426 }
1427 CTR3(KTR_PTRACE, "PT_SET_EVENT_MASK: pid %d mask %#x -> %#x",
1428 p->p_pid, p->p_ptevents, tmp);
1429 p->p_ptevents = tmp;
1430 break;
1431
1432 case PT_GET_SC_ARGS:
1433 case PTLINUX_GET_SC_ARGS:
1434 CTR2(KTR_PTRACE, "%s: pid %d", req == PT_GET_SC_ARGS ?
1435 "PT_GET_SC_ARGS" : "PT_LINUX_GET_SC_ARGS", p->p_pid);
1436 if (((td2->td_dbgflags & (TDB_SCE | TDB_SCX)) == 0 &&
1437 td2->td_sa.code == 0)
1438 #ifdef COMPAT_FREEBSD32
1439 || (wrap32 && !safe)
1440 #endif
1441 ) {
1442 error = EINVAL;
1443 break;
1444 }
1445 if (req == PT_GET_SC_ARGS) {
1446 bzero(addr, sizeof(td2->td_sa.args));
1447 bcopy(td2->td_sa.args, addr, td2->td_sa.callp->sy_narg *
1448 sizeof(syscallarg_t));
1449 } else {
1450 /*
1451 * Emulate a Linux bug which which strace(1) depends on:
1452 * at initialization it tests whether ptrace works by
1453 * calling close(2), or some other single-argument
1454 * syscall, _with six arguments_, and then verifies
1455 * whether it can fetch them all using this API;
1456 * otherwise it bails out.
1457 */
1458 bcopy(td2->td_sa.args, addr, 6 * sizeof(syscallarg_t));
1459 }
1460 break;
1461
1462 case PT_GET_SC_RET:
1463 if ((td2->td_dbgflags & TDB_SCX) == 0
1464 #ifdef COMPAT_FREEBSD32
1465 || (wrap32 && !safe)
1466 #endif
1467 ) {
1468 error = EINVAL;
1469 break;
1470 }
1471 psr = addr;
1472 bzero(psr, sizeof(*psr));
1473 psr->sr_error = td2->td_errno;
1474 if (psr->sr_error == 0) {
1475 psr->sr_retval[0] = td2->td_retval[0];
1476 psr->sr_retval[1] = td2->td_retval[1];
1477 }
1478 CTR4(KTR_PTRACE,
1479 "PT_GET_SC_RET: pid %d error %d retval %#lx,%#lx",
1480 p->p_pid, psr->sr_error, psr->sr_retval[0],
1481 psr->sr_retval[1]);
1482 break;
1483
1484 case PT_SET_SC_RET:
1485 if ((td2->td_dbgflags & TDB_SCE) == 0
1486 #ifdef COMPAT_FREEBSD32
1487 || (wrap32 && !safe)
1488 #endif
1489 ) {
1490 error = EINVAL;
1491 break;
1492 }
1493 psr = addr;
1494 td2->td_errno = psr->sr_error;
1495 if (td2->td_errno == 0) {
1496 td2->td_retval[0] = psr->sr_retval[0];
1497 td2->td_retval[1] = psr->sr_retval[1];
1498 }
1499 td2->td_dbgflags |= TDB_SET_SC_RET;
1500 break;
1501
1502 case PT_STEP:
1503 case PT_CONTINUE:
1504 case PT_TO_SCE:
1505 case PT_TO_SCX:
1506 case PT_SYSCALL:
1507 case PT_DETACH:
1508 /* Zero means do not send any signal */
1509 if (data < 0 || data > _SIG_MAXSIG) {
1510 error = EINVAL;
1511 break;
1512 }
1513
1514 switch (req) {
1515 case PT_STEP:
1516 CTR3(KTR_PTRACE, "PT_STEP: tid %d (pid %d), sig = %d",
1517 td2->td_tid, p->p_pid, data);
1518 error = ptrace_single_step(td2);
1519 if (error != 0)
1520 goto out;
1521 break;
1522 case PT_CONTINUE:
1523 case PT_TO_SCE:
1524 case PT_TO_SCX:
1525 case PT_SYSCALL:
1526 if (addr != (void *)1) {
1527 error = ptrace_set_pc(td2,
1528 (u_long)(uintfptr_t)addr);
1529 if (error != 0)
1530 goto out;
1531 td2->td_dbgflags |= TDB_USERWR;
1532 }
1533 switch (req) {
1534 case PT_TO_SCE:
1535 p->p_ptevents |= PTRACE_SCE;
1536 CTR4(KTR_PTRACE,
1537 "PT_TO_SCE: pid %d, events = %#x, PC = %#lx, sig = %d",
1538 p->p_pid, p->p_ptevents,
1539 (u_long)(uintfptr_t)addr, data);
1540 break;
1541 case PT_TO_SCX:
1542 p->p_ptevents |= PTRACE_SCX;
1543 CTR4(KTR_PTRACE,
1544 "PT_TO_SCX: pid %d, events = %#x, PC = %#lx, sig = %d",
1545 p->p_pid, p->p_ptevents,
1546 (u_long)(uintfptr_t)addr, data);
1547 break;
1548 case PT_SYSCALL:
1549 p->p_ptevents |= PTRACE_SYSCALL;
1550 CTR4(KTR_PTRACE,
1551 "PT_SYSCALL: pid %d, events = %#x, PC = %#lx, sig = %d",
1552 p->p_pid, p->p_ptevents,
1553 (u_long)(uintfptr_t)addr, data);
1554 break;
1555 case PT_CONTINUE:
1556 CTR3(KTR_PTRACE,
1557 "PT_CONTINUE: pid %d, PC = %#lx, sig = %d",
1558 p->p_pid, (u_long)(uintfptr_t)addr, data);
1559 break;
1560 }
1561 break;
1562 case PT_DETACH:
1563 /*
1564 * Clear P_TRACED before reparenting
1565 * a detached process back to its original
1566 * parent. Otherwise the debugee will be set
1567 * as an orphan of the debugger.
1568 */
1569 p->p_flag &= ~(P_TRACED | P_WAITED);
1570
1571 /*
1572 * Reset the process parent.
1573 */
1574 if (p->p_oppid != p->p_pptr->p_pid) {
1575 PROC_LOCK(p->p_pptr);
1576 sigqueue_take(p->p_ksi);
1577 PROC_UNLOCK(p->p_pptr);
1578
1579 pp = proc_realparent(p);
1580 proc_reparent(p, pp, false);
1581 if (pp == initproc)
1582 p->p_sigparent = SIGCHLD;
1583 CTR3(KTR_PTRACE,
1584 "PT_DETACH: pid %d reparented to pid %d, sig %d",
1585 p->p_pid, pp->p_pid, data);
1586 } else {
1587 CTR2(KTR_PTRACE, "PT_DETACH: pid %d, sig %d",
1588 p->p_pid, data);
1589 }
1590
1591 p->p_ptevents = 0;
1592 FOREACH_THREAD_IN_PROC(p, td3) {
1593 if ((td3->td_dbgflags & TDB_FSTP) != 0) {
1594 sigqueue_delete(&td3->td_sigqueue,
1595 SIGSTOP);
1596 }
1597 td3->td_dbgflags &= ~(TDB_XSIG | TDB_FSTP |
1598 TDB_SUSPEND | TDB_BORN);
1599 }
1600
1601 if ((p->p_flag2 & P2_PTRACE_FSTP) != 0) {
1602 sigqueue_delete(&p->p_sigqueue, SIGSTOP);
1603 p->p_flag2 &= ~P2_PTRACE_FSTP;
1604 }
1605
1606 /*
1607 * Send SIGCHLD and wakeup the parent as needed. It
1608 * may be the case that they had stopped the child
1609 * before it got ptraced, and now they're in the middle
1610 * of a wait(2) for it to continue.
1611 */
1612 PROC_LOCK(p->p_pptr);
1613 childproc_continued(p);
1614 PROC_UNLOCK(p->p_pptr);
1615 break;
1616 }
1617
1618 sx_xunlock(&proctree_lock);
1619 proctree_locked = false;
1620
1621 sendsig:
1622 MPASS(!proctree_locked);
1623
1624 /*
1625 * Clear the pending event for the thread that just
1626 * reported its event (p_xthread), if any. This may
1627 * not be the thread passed to PT_CONTINUE, PT_STEP,
1628 * etc. if the debugger is resuming a different
1629 * thread. There might be no reporting thread if
1630 * the process was just attached.
1631 *
1632 * Deliver any pending signal via the reporting thread.
1633 */
1634 if (p->p_xthread != NULL) {
1635 p->p_xthread->td_dbgflags &= ~TDB_XSIG;
1636 p->p_xthread->td_xsig = data;
1637 p->p_xthread = NULL;
1638 }
1639 p->p_xsig = data;
1640
1641 /*
1642 * P_WKILLED is insurance that a PT_KILL/SIGKILL
1643 * always works immediately, even if another thread is
1644 * unsuspended first and attempts to handle a
1645 * different signal or if the POSIX.1b style signal
1646 * queue cannot accommodate any new signals.
1647 */
1648 if (data == SIGKILL)
1649 proc_wkilled(p);
1650
1651 /*
1652 * If the PT_CONTINUE-like operation is attempted on
1653 * the thread on sleepq, this is possible only after
1654 * the transparent PT_ATTACH. In this case, if the
1655 * caller modified the thread state, e.g. by writing
1656 * register file or specifying the pc, make the thread
1657 * xstopped by waking it up.
1658 */
1659 if ((td2->td_dbgflags & TDB_USERWR) != 0 &&
1660 pt_attach_transparent) {
1661 thread_lock(td2);
1662 if (TD_ON_SLEEPQ(td2) &&
1663 (td2->td_flags & TDF_SINTR) != 0) {
1664 td2->td_dbgflags &= ~TDB_USERWR;
1665 sleepq_abort(td2, EINTR);
1666 } else {
1667 thread_unlock(td2);
1668 }
1669 }
1670
1671 /*
1672 * Unsuspend all threads. To leave a thread
1673 * suspended, use PT_SUSPEND to suspend it before
1674 * continuing the process.
1675 */
1676 ptrace_unsuspend(p);
1677 break;
1678
1679 case PT_WRITE_I:
1680 case PT_WRITE_D:
1681 td2->td_dbgflags |= TDB_USERWR;
1682 PROC_UNLOCK(p);
1683 error = 0;
1684 if (proc_writemem(td, p, (off_t)(uintptr_t)addr, &data,
1685 sizeof(int)) != sizeof(int))
1686 error = ENOMEM;
1687 else
1688 CTR3(KTR_PTRACE, "PT_WRITE: pid %d: %p <= %#x",
1689 p->p_pid, addr, data);
1690 PROC_LOCK(p);
1691 break;
1692
1693 case PT_READ_I:
1694 case PT_READ_D:
1695 PROC_UNLOCK(p);
1696 error = tmp = 0;
1697 if (proc_readmem(td, p, (off_t)(uintptr_t)addr, &tmp,
1698 sizeof(int)) != sizeof(int))
1699 error = ENOMEM;
1700 else
1701 CTR3(KTR_PTRACE, "PT_READ: pid %d: %p >= %#x",
1702 p->p_pid, addr, tmp);
1703 td->td_retval[0] = tmp;
1704 PROC_LOCK(p);
1705 break;
1706
1707 case PT_IO:
1708 piod = addr;
1709 if (piod->piod_len > SSIZE_MAX) {
1710 error = EINVAL;
1711 goto out;
1712 }
1713 iov.iov_base = piod->piod_addr;
1714 iov.iov_len = piod->piod_len;
1715 uio.uio_offset = (off_t)(uintptr_t)piod->piod_offs;
1716 uio.uio_resid = piod->piod_len;
1717 uio.uio_iov = &iov;
1718 uio.uio_iovcnt = 1;
1719 uio.uio_segflg = UIO_USERSPACE;
1720 uio.uio_td = td;
1721 switch (piod->piod_op) {
1722 case PIOD_READ_D:
1723 case PIOD_READ_I:
1724 CTR3(KTR_PTRACE, "PT_IO: pid %d: READ (%p, %#x)",
1725 p->p_pid, (uintptr_t)uio.uio_offset, uio.uio_resid);
1726 uio.uio_rw = UIO_READ;
1727 break;
1728 case PIOD_WRITE_D:
1729 case PIOD_WRITE_I:
1730 CTR3(KTR_PTRACE, "PT_IO: pid %d: WRITE (%p, %#x)",
1731 p->p_pid, (uintptr_t)uio.uio_offset, uio.uio_resid);
1732 td2->td_dbgflags |= TDB_USERWR;
1733 uio.uio_rw = UIO_WRITE;
1734 break;
1735 default:
1736 error = EINVAL;
1737 goto out;
1738 }
1739 PROC_UNLOCK(p);
1740 error = proc_rwmem(p, &uio, 0);
1741 piod->piod_len -= uio.uio_resid;
1742 PROC_LOCK(p);
1743 break;
1744
1745 case PT_KILL:
1746 CTR1(KTR_PTRACE, "PT_KILL: pid %d", p->p_pid);
1747 data = SIGKILL;
1748 goto sendsig; /* in PT_CONTINUE above */
1749
1750 case PT_SETREGS:
1751 CTR2(KTR_PTRACE, "PT_SETREGS: tid %d (pid %d)", td2->td_tid,
1752 p->p_pid);
1753 td2->td_dbgflags |= TDB_USERWR;
1754 error = PROC_WRITE(regs, td2, addr);
1755 break;
1756
1757 case PT_GETREGS:
1758 CTR2(KTR_PTRACE, "PT_GETREGS: tid %d (pid %d)", td2->td_tid,
1759 p->p_pid);
1760 error = PROC_READ(regs, td2, addr);
1761 break;
1762
1763 case PT_SETFPREGS:
1764 CTR2(KTR_PTRACE, "PT_SETFPREGS: tid %d (pid %d)", td2->td_tid,
1765 p->p_pid);
1766 td2->td_dbgflags |= TDB_USERWR;
1767 error = PROC_WRITE(fpregs, td2, addr);
1768 break;
1769
1770 case PT_GETFPREGS:
1771 CTR2(KTR_PTRACE, "PT_GETFPREGS: tid %d (pid %d)", td2->td_tid,
1772 p->p_pid);
1773 error = PROC_READ(fpregs, td2, addr);
1774 break;
1775
1776 case PT_SETDBREGS:
1777 CTR2(KTR_PTRACE, "PT_SETDBREGS: tid %d (pid %d)", td2->td_tid,
1778 p->p_pid);
1779 td2->td_dbgflags |= TDB_USERWR;
1780 error = PROC_WRITE(dbregs, td2, addr);
1781 break;
1782
1783 case PT_GETDBREGS:
1784 CTR2(KTR_PTRACE, "PT_GETDBREGS: tid %d (pid %d)", td2->td_tid,
1785 p->p_pid);
1786 error = PROC_READ(dbregs, td2, addr);
1787 break;
1788
1789 case PT_SETREGSET:
1790 CTR2(KTR_PTRACE, "PT_SETREGSET: tid %d (pid %d)", td2->td_tid,
1791 p->p_pid);
1792 error = proc_write_regset(td2, data, addr);
1793 break;
1794
1795 case PT_GETREGSET:
1796 CTR2(KTR_PTRACE, "PT_GETREGSET: tid %d (pid %d)", td2->td_tid,
1797 p->p_pid);
1798 error = proc_read_regset(td2, data, addr);
1799 break;
1800
1801 case PT_LWPINFO:
1802 if (data <= 0 || data > sizeof(*pl)) {
1803 error = EINVAL;
1804 break;
1805 }
1806 pl = addr;
1807 bzero(pl, sizeof(*pl));
1808 pl->pl_lwpid = td2->td_tid;
1809 pl->pl_event = PL_EVENT_NONE;
1810 pl->pl_flags = 0;
1811 if (td2->td_dbgflags & TDB_XSIG) {
1812 pl->pl_event = PL_EVENT_SIGNAL;
1813 if (td2->td_si.si_signo != 0 &&
1814 data >= offsetof(struct ptrace_lwpinfo, pl_siginfo)
1815 + sizeof(pl->pl_siginfo)){
1816 pl->pl_flags |= PL_FLAG_SI;
1817 pl->pl_siginfo = td2->td_si;
1818 }
1819 }
1820 if (td2->td_dbgflags & TDB_SCE)
1821 pl->pl_flags |= PL_FLAG_SCE;
1822 else if (td2->td_dbgflags & TDB_SCX)
1823 pl->pl_flags |= PL_FLAG_SCX;
1824 if (td2->td_dbgflags & TDB_EXEC)
1825 pl->pl_flags |= PL_FLAG_EXEC;
1826 if (td2->td_dbgflags & TDB_FORK) {
1827 pl->pl_flags |= PL_FLAG_FORKED;
1828 pl->pl_child_pid = td2->td_dbg_forked;
1829 if (td2->td_dbgflags & TDB_VFORK)
1830 pl->pl_flags |= PL_FLAG_VFORKED;
1831 } else if ((td2->td_dbgflags & (TDB_SCX | TDB_VFORK)) ==
1832 TDB_VFORK)
1833 pl->pl_flags |= PL_FLAG_VFORK_DONE;
1834 if (td2->td_dbgflags & TDB_CHILD)
1835 pl->pl_flags |= PL_FLAG_CHILD;
1836 if (td2->td_dbgflags & TDB_BORN)
1837 pl->pl_flags |= PL_FLAG_BORN;
1838 if (td2->td_dbgflags & TDB_EXIT)
1839 pl->pl_flags |= PL_FLAG_EXITED;
1840 pl->pl_sigmask = td2->td_sigmask;
1841 pl->pl_siglist = td2->td_siglist;
1842 strcpy(pl->pl_tdname, td2->td_name);
1843 if (td2->td_sa.code != 0) {
1844 pl->pl_syscall_code = td2->td_sa.code;
1845 pl->pl_syscall_narg = td2->td_sa.callp->sy_narg;
1846 }
1847 CTR6(KTR_PTRACE,
1848 "PT_LWPINFO: tid %d (pid %d) event %d flags %#x child pid %d syscall %d",
1849 td2->td_tid, p->p_pid, pl->pl_event, pl->pl_flags,
1850 pl->pl_child_pid, pl->pl_syscall_code);
1851 break;
1852
1853 case PT_GETNUMLWPS:
1854 CTR2(KTR_PTRACE, "PT_GETNUMLWPS: pid %d: %d threads", p->p_pid,
1855 p->p_numthreads);
1856 td->td_retval[0] = p->p_numthreads;
1857 break;
1858
1859 case PT_GETLWPLIST:
1860 CTR3(KTR_PTRACE, "PT_GETLWPLIST: pid %d: data %d, actual %d",
1861 p->p_pid, data, p->p_numthreads);
1862 if (data <= 0) {
1863 error = EINVAL;
1864 break;
1865 }
1866 num = imin(p->p_numthreads, data);
1867 PROC_UNLOCK(p);
1868 buf = malloc(num * sizeof(lwpid_t), M_TEMP, M_WAITOK);
1869 tmp = 0;
1870 PROC_LOCK(p);
1871 FOREACH_THREAD_IN_PROC(p, td2) {
1872 if (tmp >= num)
1873 break;
1874 buf[tmp++] = td2->td_tid;
1875 }
1876 PROC_UNLOCK(p);
1877 error = copyout(buf, addr, tmp * sizeof(lwpid_t));
1878 free(buf, M_TEMP);
1879 if (!error)
1880 td->td_retval[0] = tmp;
1881 PROC_LOCK(p);
1882 break;
1883
1884 case PT_VM_TIMESTAMP:
1885 CTR2(KTR_PTRACE, "PT_VM_TIMESTAMP: pid %d: timestamp %d",
1886 p->p_pid, p->p_vmspace->vm_map.timestamp);
1887 td->td_retval[0] = p->p_vmspace->vm_map.timestamp;
1888 break;
1889
1890 case PT_VM_ENTRY:
1891 PROC_UNLOCK(p);
1892 error = ptrace_vm_entry(td, p, addr);
1893 PROC_LOCK(p);
1894 break;
1895
1896 case PT_COREDUMP:
1897 pc = addr;
1898 CTR2(KTR_PTRACE, "PT_COREDUMP: pid %d, fd %d",
1899 p->p_pid, pc->pc_fd);
1900
1901 if ((pc->pc_flags & ~(PC_COMPRESS | PC_ALL)) != 0) {
1902 error = EINVAL;
1903 break;
1904 }
1905 PROC_UNLOCK(p);
1906
1907 tcq = malloc(sizeof(*tcq), M_TEMP, M_WAITOK | M_ZERO);
1908 fp = NULL;
1909 error = fget_write(td, pc->pc_fd, &cap_write_rights, &fp);
1910 if (error != 0)
1911 goto coredump_cleanup_nofp;
1912 if (fp->f_type != DTYPE_VNODE || fp->f_vnode->v_type != VREG) {
1913 error = EPIPE;
1914 goto coredump_cleanup;
1915 }
1916
1917 PROC_LOCK(p);
1918 error = proc_can_ptrace(td, p);
1919 if (error != 0)
1920 goto coredump_cleanup_locked;
1921
1922 td2 = ptrace_sel_coredump_thread(p);
1923 if (td2 == NULL) {
1924 error = EBUSY;
1925 goto coredump_cleanup_locked;
1926 }
1927 KASSERT((td2->td_dbgflags & (TDB_COREDUMPREQ |
1928 TDB_SCREMOTEREQ)) == 0,
1929 ("proc %d tid %d req coredump", p->p_pid, td2->td_tid));
1930
1931 tcq->tc_vp = fp->f_vnode;
1932 tcq->tc_limit = pc->pc_limit == 0 ? OFF_MAX : pc->pc_limit;
1933 tcq->tc_flags = SVC_PT_COREDUMP;
1934 if ((pc->pc_flags & PC_COMPRESS) == 0)
1935 tcq->tc_flags |= SVC_NOCOMPRESS;
1936 if ((pc->pc_flags & PC_ALL) != 0)
1937 tcq->tc_flags |= SVC_ALL;
1938 td2->td_remotereq = tcq;
1939 td2->td_dbgflags |= TDB_COREDUMPREQ;
1940 thread_run_flash(td2);
1941 while ((td2->td_dbgflags & TDB_COREDUMPREQ) != 0)
1942 msleep(p, &p->p_mtx, PPAUSE, "crdmp", 0);
1943 error = tcq->tc_error;
1944 coredump_cleanup_locked:
1945 PROC_UNLOCK(p);
1946 coredump_cleanup:
1947 fdrop(fp, td);
1948 coredump_cleanup_nofp:
1949 free(tcq, M_TEMP);
1950 PROC_LOCK(p);
1951 break;
1952
1953 case PT_SC_REMOTE:
1954 pscr = addr;
1955 CTR2(KTR_PTRACE, "PT_SC_REMOTE: pid %d, syscall %d",
1956 p->p_pid, pscr->pscr_syscall);
1957 if ((td2->td_dbgflags & TDB_BOUNDARY) == 0) {
1958 error = EBUSY;
1959 break;
1960 }
1961 PROC_UNLOCK(p);
1962 MPASS(pscr->pscr_nargs <= nitems(td->td_sa.args));
1963
1964 tsr = malloc(sizeof(struct thr_syscall_req), M_TEMP,
1965 M_WAITOK | M_ZERO);
1966
1967 tsr->ts_sa.code = pscr->pscr_syscall;
1968 tsr->ts_nargs = pscr->pscr_nargs;
1969 memcpy(&tsr->ts_sa.args, pscr->pscr_args,
1970 sizeof(syscallarg_t) * tsr->ts_nargs);
1971
1972 PROC_LOCK(p);
1973 error = proc_can_ptrace(td, p);
1974 if (error != 0) {
1975 free(tsr, M_TEMP);
1976 break;
1977 }
1978 if (td2->td_proc != p) {
1979 free(tsr, M_TEMP);
1980 error = ESRCH;
1981 break;
1982 }
1983 KASSERT((td2->td_dbgflags & (TDB_COREDUMPREQ |
1984 TDB_SCREMOTEREQ)) == 0,
1985 ("proc %d tid %d req coredump", p->p_pid, td2->td_tid));
1986
1987 td2->td_remotereq = tsr;
1988 td2->td_dbgflags |= TDB_SCREMOTEREQ;
1989 thread_run_flash(td2);
1990 while ((td2->td_dbgflags & TDB_SCREMOTEREQ) != 0)
1991 msleep(p, &p->p_mtx, PPAUSE, "pscrx", 0);
1992 error = 0;
1993 memcpy(&pscr->pscr_ret, &tsr->ts_ret, sizeof(tsr->ts_ret));
1994 free(tsr, M_TEMP);
1995 break;
1996
1997 case PT_GET_CHILDREN:
1998 PROC_UNLOCK(p);
1999 get_children_repeat:
2000 /*
2001 * If addr != NULL, we should ignore p_cansee() to
2002 * allocate enough space for the children array,
2003 * because the process is allowed to change visibility
2004 * between loops. But do not count children which
2005 * we cannot see when only returning the count, to
2006 * avoid a leak of information.
2007 */
2008 num = ptrace_count_children(td, p, addr != NULL);
2009
2010 if (addr == NULL) {
2011 td->td_retval[0] = num;
2012 PROC_LOCK(p);
2013 break;
2014 }
2015 if (data < num * sizeof(struct ptrace_child)) {
2016 error = ENOMEM;
2017 PROC_LOCK(p);
2018 break;
2019 }
2020 sx_xunlock(&proctree_lock);
2021 children = mallocarray(num, sizeof(struct ptrace_child),
2022 M_TEMP, M_WAITOK | M_ZERO);
2023 sx_xlock(&proctree_lock);
2024 num1 = ptrace_count_children(td, p, true);
2025 if (num1 > num) {
2026 free(children, M_TEMP);
2027 goto get_children_repeat;
2028 }
2029 num = num1;
2030 num1 = 0;
2031 LIST_FOREACH(pp, &p->p_children, p_sibling) {
2032 MPASS(num1 < num);
2033 ptc = &children[num1];
2034 if (ptrace_report_child(td, p, pp, ptc))
2035 num1++;
2036 }
2037 LIST_FOREACH(pp, &p->p_orphans, p_orphan) {
2038 MPASS(num1 < num);
2039 ptc = &children[num1];
2040 if (ptrace_report_child(td, p, pp, ptc)) {
2041 num1++;
2042 ptc->flags |= PTCHLD_ORPHAN;
2043 }
2044 }
2045 *(struct ptrace_child **)addr = children;
2046 td->td_retval[0] = num1;
2047 PROC_LOCK(p);
2048 break;
2049
2050 case PT_GET_ABI_NAME:
2051 if (strlcpy(addr, p->p_sysent->sv_name, data) >= data)
2052 error = ENOMEM;
2053 break;
2054
2055 default:
2056 #ifdef __HAVE_PTRACE_MACHDEP
2057 if (req >= PT_FIRSTMACH) {
2058 PROC_UNLOCK(p);
2059 error = cpu_ptrace(td2, req, addr, data);
2060 PROC_LOCK(p);
2061 } else
2062 #endif
2063 /* Unknown request. */
2064 error = EINVAL;
2065 break;
2066 }
2067 out:
2068 /* Drop our hold on this process now that the request has completed. */
2069 _PRELE(p);
2070 fail:
2071 if (p2_req_set) {
2072 if ((p->p_flag2 & P2_PTRACEREQ) != 0)
2073 wakeup(&p->p_flag2);
2074 p->p_flag2 &= ~P2_PTRACEREQ;
2075 }
2076 PROC_UNLOCK(p);
2077 fail_proctree:
2078 if (proctree_locked)
2079 sx_xunlock(&proctree_lock);
2080 if (pfp != NULL)
2081 fdrop(pfp, td);
2082 return (error);
2083 }
2084 #undef PROC_READ
2085 #undef PROC_WRITE
2086
2087 int
kern_ptrace(struct thread * td,int req,pid_t pid,void * addr,int data)2088 kern_ptrace(struct thread *td, int req, pid_t pid, void *addr, int data)
2089 {
2090 return (ptrace_action(td, req, false, pid, -1, -1, addr, data));
2091 }
2092
2093 int
sys_ptrace(struct thread * td,struct ptrace_args * uap)2094 sys_ptrace(struct thread *td, struct ptrace_args *uap)
2095 {
2096 int error;
2097
2098 AUDIT_ARG_PID(uap->pid);
2099 AUDIT_ARG_CMD(uap->req);
2100 AUDIT_ARG_VALUE(uap->data);
2101
2102 error = ptrace_useraction(td, uap->req, false, uap->pid, -1, -1,
2103 uap->addr, uap->data);
2104 return (error);
2105 }
2106
2107 int
sys_pdptrace(struct thread * td,struct pdptrace_args * uap)2108 sys_pdptrace(struct thread *td, struct pdptrace_args *uap)
2109 {
2110 int error;
2111
2112 AUDIT_ARG_FD(uap->pfd);
2113 AUDIT_ARG_CMD(uap->req);
2114 AUDIT_ARG_VALUE(uap->data);
2115
2116 error = ptrace_useraction(td, uap->req, true, -1, uap->pfd, uap->lwpid,
2117 uap->addr, uap->data);
2118 return (error);
2119 }
2120