1 /*-
2 * SPDX-License-Identifier: BSD-4-Clause
3 *
4 * Copyright (c) 1994, Sean Eric Fagan
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Sean Eric Fagan.
18 * 4. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/ktr.h>
37 #include <sys/limits.h>
38 #include <sys/lock.h>
39 #include <sys/mman.h>
40 #include <sys/mutex.h>
41 #include <sys/reg.h>
42 #include <sys/sleepqueue.h>
43 #include <sys/syscallsubr.h>
44 #include <sys/sysent.h>
45 #include <sys/sysproto.h>
46 #include <sys/priv.h>
47 #include <sys/proc.h>
48 #include <sys/vnode.h>
49 #include <sys/ptrace.h>
50 #include <sys/rwlock.h>
51 #include <sys/sx.h>
52 #include <sys/malloc.h>
53 #include <sys/signalvar.h>
54 #include <sys/caprights.h>
55 #include <sys/filedesc.h>
56
57 #include <security/audit/audit.h>
58
59 #include <vm/vm.h>
60 #include <vm/pmap.h>
61 #include <vm/vm_extern.h>
62 #include <vm/vm_map.h>
63 #include <vm/vm_kern.h>
64 #include <vm/vm_object.h>
65 #include <vm/vm_page.h>
66 #include <vm/vm_param.h>
67
68 #ifdef COMPAT_FREEBSD32
69 #include <sys/procfs.h>
70 #endif
71
72 /* Assert it's safe to unlock a process, e.g. to allocate working memory */
73 #define PROC_ASSERT_TRACEREQ(p) MPASS(((p)->p_flag2 & P2_PTRACEREQ) != 0)
74
75 /*
76 * Functions implemented below:
77 *
78 * proc_read_regs(proc, regs)
79 * Get the current user-visible register set from the process
80 * and copy it into the regs structure (<machine/reg.h>).
81 * The process is stopped at the time read_regs is called.
82 *
83 * proc_write_regs(proc, regs)
84 * Update the current register set from the passed in regs
85 * structure. Take care to avoid clobbering special CPU
86 * registers or privileged bits in the PSL.
87 * Depending on the architecture this may have fix-up work to do,
88 * especially if the IAR or PCW are modified.
89 * The process is stopped at the time write_regs is called.
90 *
91 * proc_read_fpregs, proc_write_fpregs
92 * deal with the floating point register set, otherwise as above.
93 *
94 * proc_read_dbregs, proc_write_dbregs
95 * deal with the processor debug register set, otherwise as above.
96 *
97 * proc_sstep(proc)
98 * Arrange for the process to trap after executing a single instruction.
99 */
100
101 int
proc_read_regs(struct thread * td,struct reg * regs)102 proc_read_regs(struct thread *td, struct reg *regs)
103 {
104 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
105 return (fill_regs(td, regs));
106 }
107
108 int
proc_write_regs(struct thread * td,struct reg * regs)109 proc_write_regs(struct thread *td, struct reg *regs)
110 {
111 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
112 return (set_regs(td, regs));
113 }
114
115 int
proc_read_dbregs(struct thread * td,struct dbreg * dbregs)116 proc_read_dbregs(struct thread *td, struct dbreg *dbregs)
117 {
118 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
119 return (fill_dbregs(td, dbregs));
120 }
121
122 int
proc_write_dbregs(struct thread * td,struct dbreg * dbregs)123 proc_write_dbregs(struct thread *td, struct dbreg *dbregs)
124 {
125 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
126 return (set_dbregs(td, dbregs));
127 }
128
129 /*
130 * Ptrace doesn't support fpregs at all, and there are no security holes
131 * or translations for fpregs, so we can just copy them.
132 */
133 int
proc_read_fpregs(struct thread * td,struct fpreg * fpregs)134 proc_read_fpregs(struct thread *td, struct fpreg *fpregs)
135 {
136 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
137 return (fill_fpregs(td, fpregs));
138 }
139
140 int
proc_write_fpregs(struct thread * td,struct fpreg * fpregs)141 proc_write_fpregs(struct thread *td, struct fpreg *fpregs)
142 {
143 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
144 return (set_fpregs(td, fpregs));
145 }
146
147 static struct regset *
proc_find_regset(struct thread * td,int note)148 proc_find_regset(struct thread *td, int note)
149 {
150 struct regset **regsetp, **regset_end, *regset;
151 struct sysentvec *sv;
152
153 sv = td->td_proc->p_sysent;
154 regsetp = sv->sv_regset_begin;
155 if (regsetp == NULL)
156 return (NULL);
157 regset_end = sv->sv_regset_end;
158 MPASS(regset_end != NULL);
159 for (; regsetp < regset_end; regsetp++) {
160 regset = *regsetp;
161 if (regset->note != note)
162 continue;
163
164 return (regset);
165 }
166
167 return (NULL);
168 }
169
170 static int
proc_read_regset(struct thread * td,int note,struct iovec * iov)171 proc_read_regset(struct thread *td, int note, struct iovec *iov)
172 {
173 struct regset *regset;
174 struct proc *p;
175 void *buf;
176 size_t size;
177 int error;
178
179 regset = proc_find_regset(td, note);
180 if (regset == NULL)
181 return (EINVAL);
182
183 if (regset->get == NULL)
184 return (EINVAL);
185
186 size = regset->size;
187 /*
188 * The regset is dynamically sized, e.g. the size could change
189 * depending on the hardware, or may have a per-thread size.
190 */
191 if (size == 0) {
192 if (!regset->get(regset, td, NULL, &size))
193 return (EINVAL);
194 }
195
196 if (iov->iov_base == NULL) {
197 iov->iov_len = size;
198 if (iov->iov_len == 0)
199 return (EINVAL);
200
201 return (0);
202 }
203
204 /* The length is wrong, return an error */
205 if (iov->iov_len != size)
206 return (EINVAL);
207
208 error = 0;
209 p = td->td_proc;
210
211 /* Drop the proc lock while allocating the temp buffer */
212 PROC_ASSERT_TRACEREQ(p);
213 PROC_UNLOCK(p);
214 buf = malloc(size, M_TEMP, M_WAITOK);
215 PROC_LOCK(p);
216
217 if (!regset->get(regset, td, buf, &size)) {
218 error = EINVAL;
219 } else {
220 KASSERT(size == regset->size || regset->size == 0,
221 ("%s: Getter function changed the size", __func__));
222
223 iov->iov_len = size;
224 PROC_UNLOCK(p);
225 error = copyout(buf, iov->iov_base, size);
226 PROC_LOCK(p);
227 }
228
229 free(buf, M_TEMP);
230
231 return (error);
232 }
233
234 static int
proc_write_regset(struct thread * td,int note,struct iovec * iov)235 proc_write_regset(struct thread *td, int note, struct iovec *iov)
236 {
237 struct regset *regset;
238 struct proc *p;
239 void *buf;
240 size_t size;
241 int error;
242
243 regset = proc_find_regset(td, note);
244 if (regset == NULL)
245 return (EINVAL);
246
247 size = regset->size;
248 /*
249 * The regset is dynamically sized, e.g. the size could change
250 * depending on the hardware, or may have a per-thread size.
251 */
252 if (size == 0) {
253 if (!regset->get(regset, td, NULL, &size))
254 return (EINVAL);
255 }
256
257 /* The length is wrong, return an error */
258 if (iov->iov_len != size)
259 return (EINVAL);
260
261 if (regset->set == NULL)
262 return (EINVAL);
263
264 p = td->td_proc;
265
266 /* Drop the proc lock while allocating the temp buffer */
267 PROC_ASSERT_TRACEREQ(p);
268 PROC_UNLOCK(p);
269 buf = malloc(size, M_TEMP, M_WAITOK);
270 error = copyin(iov->iov_base, buf, size);
271 PROC_LOCK(p);
272
273 if (error == 0) {
274 if (!regset->set(regset, td, buf, size)) {
275 error = EINVAL;
276 }
277 }
278
279 free(buf, M_TEMP);
280
281 return (error);
282 }
283
284 #ifdef COMPAT_FREEBSD32
285 /* For 32 bit binaries, we need to expose the 32 bit regs layouts. */
286 int
proc_read_regs32(struct thread * td,struct reg32 * regs32)287 proc_read_regs32(struct thread *td, struct reg32 *regs32)
288 {
289 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
290 return (fill_regs32(td, regs32));
291 }
292
293 int
proc_write_regs32(struct thread * td,struct reg32 * regs32)294 proc_write_regs32(struct thread *td, struct reg32 *regs32)
295 {
296 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
297 return (set_regs32(td, regs32));
298 }
299
300 int
proc_read_dbregs32(struct thread * td,struct dbreg32 * dbregs32)301 proc_read_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
302 {
303 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
304 return (fill_dbregs32(td, dbregs32));
305 }
306
307 int
proc_write_dbregs32(struct thread * td,struct dbreg32 * dbregs32)308 proc_write_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
309 {
310 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
311 return (set_dbregs32(td, dbregs32));
312 }
313
314 int
proc_read_fpregs32(struct thread * td,struct fpreg32 * fpregs32)315 proc_read_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
316 {
317 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
318 return (fill_fpregs32(td, fpregs32));
319 }
320
321 int
proc_write_fpregs32(struct thread * td,struct fpreg32 * fpregs32)322 proc_write_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
323 {
324 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
325 return (set_fpregs32(td, fpregs32));
326 }
327 #endif
328
329 int
proc_sstep(struct thread * td)330 proc_sstep(struct thread *td)
331 {
332 PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
333 return (ptrace_single_step(td));
334 }
335
336 int
proc_rwmem(struct proc * p,struct uio * uio)337 proc_rwmem(struct proc *p, struct uio *uio)
338 {
339 vm_map_t map;
340 vm_offset_t pageno; /* page number */
341 vm_prot_t reqprot;
342 int error, fault_flags, page_offset, writing;
343
344 /*
345 * Make sure that the process' vmspace remains live.
346 */
347 if (p != curproc)
348 PROC_ASSERT_HELD(p);
349 PROC_LOCK_ASSERT(p, MA_NOTOWNED);
350
351 /*
352 * The map we want...
353 */
354 map = &p->p_vmspace->vm_map;
355
356 /*
357 * If we are writing, then we request vm_fault() to create a private
358 * copy of each page. Since these copies will not be writeable by the
359 * process, we must explicitly request that they be dirtied.
360 */
361 writing = uio->uio_rw == UIO_WRITE;
362 reqprot = writing ? VM_PROT_COPY | VM_PROT_READ : VM_PROT_READ;
363 fault_flags = writing ? VM_FAULT_DIRTY : VM_FAULT_NORMAL;
364
365 if (writing) {
366 error = priv_check_cred(p->p_ucred, PRIV_PROC_MEM_WRITE);
367 if (error)
368 return (error);
369 }
370
371 /*
372 * Only map in one page at a time. We don't have to, but it
373 * makes things easier. This way is trivial - right?
374 */
375 do {
376 vm_offset_t uva;
377 u_int len;
378 vm_page_t m;
379
380 uva = (vm_offset_t)uio->uio_offset;
381
382 /*
383 * Get the page number of this segment.
384 */
385 pageno = trunc_page(uva);
386 page_offset = uva - pageno;
387
388 /*
389 * How many bytes to copy
390 */
391 len = MIN(PAGE_SIZE - page_offset, uio->uio_resid);
392
393 /*
394 * Fault and hold the page on behalf of the process.
395 */
396 error = vm_fault(map, pageno, reqprot, fault_flags, &m);
397 if (error != KERN_SUCCESS) {
398 if (error == KERN_RESOURCE_SHORTAGE)
399 error = ENOMEM;
400 else
401 error = EFAULT;
402 break;
403 }
404
405 /*
406 * Now do the i/o move.
407 */
408 error = uiomove_fromphys(&m, page_offset, len, uio);
409
410 /* Make the I-cache coherent for breakpoints. */
411 if (writing && error == 0) {
412 vm_map_lock_read(map);
413 if (vm_map_check_protection(map, pageno, pageno +
414 PAGE_SIZE, VM_PROT_EXECUTE))
415 vm_sync_icache(map, uva, len);
416 vm_map_unlock_read(map);
417 }
418
419 /*
420 * Release the page.
421 */
422 vm_page_unwire(m, PQ_ACTIVE);
423
424 } while (error == 0 && uio->uio_resid > 0);
425
426 return (error);
427 }
428
429 static ssize_t
proc_iop(struct thread * td,struct proc * p,vm_offset_t va,void * buf,size_t len,enum uio_rw rw)430 proc_iop(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
431 size_t len, enum uio_rw rw)
432 {
433 struct iovec iov;
434 struct uio uio;
435 ssize_t slen;
436
437 MPASS(len < SSIZE_MAX);
438 slen = (ssize_t)len;
439
440 iov.iov_base = (caddr_t)buf;
441 iov.iov_len = len;
442 uio.uio_iov = &iov;
443 uio.uio_iovcnt = 1;
444 uio.uio_offset = va;
445 uio.uio_resid = slen;
446 uio.uio_segflg = UIO_SYSSPACE;
447 uio.uio_rw = rw;
448 uio.uio_td = td;
449 proc_rwmem(p, &uio);
450 if (uio.uio_resid == slen)
451 return (-1);
452 return (slen - uio.uio_resid);
453 }
454
455 ssize_t
proc_readmem(struct thread * td,struct proc * p,vm_offset_t va,void * buf,size_t len)456 proc_readmem(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
457 size_t len)
458 {
459
460 return (proc_iop(td, p, va, buf, len, UIO_READ));
461 }
462
463 ssize_t
proc_writemem(struct thread * td,struct proc * p,vm_offset_t va,void * buf,size_t len)464 proc_writemem(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
465 size_t len)
466 {
467
468 return (proc_iop(td, p, va, buf, len, UIO_WRITE));
469 }
470
471 static int
ptrace_vm_entry(struct thread * td,struct proc * p,struct ptrace_vm_entry * pve)472 ptrace_vm_entry(struct thread *td, struct proc *p, struct ptrace_vm_entry *pve)
473 {
474 struct vattr vattr;
475 vm_map_t map;
476 vm_map_entry_t entry;
477 vm_object_t obj, tobj, lobj;
478 struct vmspace *vm;
479 struct vnode *vp;
480 char *freepath, *fullpath;
481 u_int pathlen;
482 int error, index;
483
484 error = 0;
485 obj = NULL;
486
487 vm = vmspace_acquire_ref(p);
488 map = &vm->vm_map;
489 vm_map_lock_read(map);
490
491 do {
492 KASSERT((map->header.eflags & MAP_ENTRY_IS_SUB_MAP) == 0,
493 ("Submap in map header"));
494 index = 0;
495 VM_MAP_ENTRY_FOREACH(entry, map) {
496 if (index >= pve->pve_entry &&
497 (entry->eflags & MAP_ENTRY_IS_SUB_MAP) == 0)
498 break;
499 index++;
500 }
501 if (index < pve->pve_entry) {
502 error = EINVAL;
503 break;
504 }
505 if (entry == &map->header) {
506 error = ENOENT;
507 break;
508 }
509
510 /* We got an entry. */
511 pve->pve_entry = index + 1;
512 pve->pve_timestamp = map->timestamp;
513 pve->pve_start = entry->start;
514 pve->pve_end = entry->end - 1;
515 pve->pve_offset = entry->offset;
516 pve->pve_prot = entry->protection |
517 PROT_MAX(entry->max_protection);
518
519 /* Backing object's path needed? */
520 if (pve->pve_pathlen == 0)
521 break;
522
523 pathlen = pve->pve_pathlen;
524 pve->pve_pathlen = 0;
525
526 obj = entry->object.vm_object;
527 if (obj != NULL)
528 VM_OBJECT_RLOCK(obj);
529 } while (0);
530
531 vm_map_unlock_read(map);
532
533 pve->pve_fsid = VNOVAL;
534 pve->pve_fileid = VNOVAL;
535
536 if (error == 0 && obj != NULL) {
537 lobj = obj;
538 for (tobj = obj; tobj != NULL; tobj = tobj->backing_object) {
539 if (tobj != obj)
540 VM_OBJECT_RLOCK(tobj);
541 if (lobj != obj)
542 VM_OBJECT_RUNLOCK(lobj);
543 lobj = tobj;
544 pve->pve_offset += tobj->backing_object_offset;
545 }
546 vp = vm_object_vnode(lobj);
547 if (vp != NULL)
548 vref(vp);
549 if (lobj != obj)
550 VM_OBJECT_RUNLOCK(lobj);
551 VM_OBJECT_RUNLOCK(obj);
552
553 if (vp != NULL) {
554 freepath = NULL;
555 fullpath = NULL;
556 vn_fullpath(vp, &fullpath, &freepath);
557 vn_lock(vp, LK_SHARED | LK_RETRY);
558 if (VOP_GETATTR(vp, &vattr, td->td_ucred) == 0) {
559 pve->pve_fileid = vattr.va_fileid;
560 pve->pve_fsid = vattr.va_fsid;
561 }
562 vput(vp);
563
564 if (fullpath != NULL) {
565 pve->pve_pathlen = strlen(fullpath) + 1;
566 if (pve->pve_pathlen <= pathlen) {
567 error = copyout(fullpath, pve->pve_path,
568 pve->pve_pathlen);
569 } else
570 error = ENAMETOOLONG;
571 }
572 if (freepath != NULL)
573 free(freepath, M_TEMP);
574 }
575 }
576 vmspace_free(vm);
577 if (error == 0)
578 CTR3(KTR_PTRACE, "PT_VM_ENTRY: pid %d, entry %d, start %p",
579 p->p_pid, pve->pve_entry, pve->pve_start);
580
581 return (error);
582 }
583
584 /*
585 * Process debugging system call.
586 */
587 #ifndef _SYS_SYSPROTO_H_
588 struct ptrace_args {
589 int req;
590 pid_t pid;
591 caddr_t addr;
592 int data;
593 };
594 #endif
595
596 int
sys_ptrace(struct thread * td,struct ptrace_args * uap)597 sys_ptrace(struct thread *td, struct ptrace_args *uap)
598 {
599 /*
600 * XXX this obfuscation is to reduce stack usage, but the register
601 * structs may be too large to put on the stack anyway.
602 */
603 union {
604 struct ptrace_io_desc piod;
605 struct ptrace_lwpinfo pl;
606 struct ptrace_vm_entry pve;
607 struct ptrace_coredump pc;
608 struct ptrace_sc_remote sr;
609 struct dbreg dbreg;
610 struct fpreg fpreg;
611 struct reg reg;
612 struct iovec vec;
613 syscallarg_t args[nitems(td->td_sa.args)];
614 struct ptrace_sc_ret psr;
615 int ptevents;
616 } r;
617 syscallarg_t pscr_args[nitems(td->td_sa.args)];
618 void *addr;
619 int error;
620
621 if (!allow_ptrace)
622 return (ENOSYS);
623 error = 0;
624
625 AUDIT_ARG_PID(uap->pid);
626 AUDIT_ARG_CMD(uap->req);
627 AUDIT_ARG_VALUE(uap->data);
628 addr = &r;
629 switch (uap->req) {
630 case PT_GET_EVENT_MASK:
631 case PT_LWPINFO:
632 case PT_GET_SC_ARGS:
633 case PT_GET_SC_RET:
634 break;
635 case PT_GETREGS:
636 bzero(&r.reg, sizeof(r.reg));
637 break;
638 case PT_GETFPREGS:
639 bzero(&r.fpreg, sizeof(r.fpreg));
640 break;
641 case PT_GETDBREGS:
642 bzero(&r.dbreg, sizeof(r.dbreg));
643 break;
644 case PT_GETREGSET:
645 case PT_SETREGSET:
646 error = copyin(uap->addr, &r.vec, sizeof(r.vec));
647 break;
648 case PT_SETREGS:
649 error = copyin(uap->addr, &r.reg, sizeof(r.reg));
650 break;
651 case PT_SETFPREGS:
652 error = copyin(uap->addr, &r.fpreg, sizeof(r.fpreg));
653 break;
654 case PT_SETDBREGS:
655 error = copyin(uap->addr, &r.dbreg, sizeof(r.dbreg));
656 break;
657 case PT_SET_EVENT_MASK:
658 if (uap->data != sizeof(r.ptevents))
659 error = EINVAL;
660 else
661 error = copyin(uap->addr, &r.ptevents, uap->data);
662 break;
663 case PT_IO:
664 error = copyin(uap->addr, &r.piod, sizeof(r.piod));
665 break;
666 case PT_VM_ENTRY:
667 error = copyin(uap->addr, &r.pve, sizeof(r.pve));
668 break;
669 case PT_COREDUMP:
670 if (uap->data != sizeof(r.pc))
671 error = EINVAL;
672 else
673 error = copyin(uap->addr, &r.pc, uap->data);
674 break;
675 case PT_SC_REMOTE:
676 if (uap->data != sizeof(r.sr)) {
677 error = EINVAL;
678 break;
679 }
680 error = copyin(uap->addr, &r.sr, uap->data);
681 if (error != 0)
682 break;
683 if (r.sr.pscr_nargs > nitems(td->td_sa.args)) {
684 error = EINVAL;
685 break;
686 }
687 error = copyin(r.sr.pscr_args, pscr_args,
688 sizeof(u_long) * r.sr.pscr_nargs);
689 if (error != 0)
690 break;
691 r.sr.pscr_args = pscr_args;
692 break;
693 case PTINTERNAL_FIRST ... PTINTERNAL_LAST:
694 error = EINVAL;
695 break;
696 default:
697 addr = uap->addr;
698 break;
699 }
700 if (error)
701 return (error);
702
703 error = kern_ptrace(td, uap->req, uap->pid, addr, uap->data);
704 if (error)
705 return (error);
706
707 switch (uap->req) {
708 case PT_VM_ENTRY:
709 error = copyout(&r.pve, uap->addr, sizeof(r.pve));
710 break;
711 case PT_IO:
712 error = copyout(&r.piod, uap->addr, sizeof(r.piod));
713 break;
714 case PT_GETREGS:
715 error = copyout(&r.reg, uap->addr, sizeof(r.reg));
716 break;
717 case PT_GETFPREGS:
718 error = copyout(&r.fpreg, uap->addr, sizeof(r.fpreg));
719 break;
720 case PT_GETDBREGS:
721 error = copyout(&r.dbreg, uap->addr, sizeof(r.dbreg));
722 break;
723 case PT_GETREGSET:
724 error = copyout(&r.vec, uap->addr, sizeof(r.vec));
725 break;
726 case PT_GET_EVENT_MASK:
727 /* NB: The size in uap->data is validated in kern_ptrace(). */
728 error = copyout(&r.ptevents, uap->addr, uap->data);
729 break;
730 case PT_LWPINFO:
731 /* NB: The size in uap->data is validated in kern_ptrace(). */
732 error = copyout(&r.pl, uap->addr, uap->data);
733 break;
734 case PT_GET_SC_ARGS:
735 error = copyout(r.args, uap->addr, MIN(uap->data,
736 sizeof(r.args)));
737 break;
738 case PT_GET_SC_RET:
739 error = copyout(&r.psr, uap->addr, MIN(uap->data,
740 sizeof(r.psr)));
741 break;
742 case PT_SC_REMOTE:
743 error = copyout(&r.sr.pscr_ret, uap->addr +
744 offsetof(struct ptrace_sc_remote, pscr_ret),
745 sizeof(r.sr.pscr_ret));
746 break;
747 }
748
749 return (error);
750 }
751
752 #ifdef COMPAT_FREEBSD32
753 /*
754 * PROC_READ(regs, td2, addr);
755 * becomes either:
756 * proc_read_regs(td2, addr);
757 * or
758 * proc_read_regs32(td2, addr);
759 * .. except this is done at runtime. There is an additional
760 * complication in that PROC_WRITE disallows 32 bit consumers
761 * from writing to 64 bit address space targets.
762 */
763 #define PROC_READ(w, t, a) wrap32 ? \
764 proc_read_ ## w ## 32(t, a) : \
765 proc_read_ ## w (t, a)
766 #define PROC_WRITE(w, t, a) wrap32 ? \
767 (safe ? proc_write_ ## w ## 32(t, a) : EINVAL ) : \
768 proc_write_ ## w (t, a)
769 #else
770 #define PROC_READ(w, t, a) proc_read_ ## w (t, a)
771 #define PROC_WRITE(w, t, a) proc_write_ ## w (t, a)
772 #endif
773
774 void
proc_set_traced(struct proc * p,bool stop)775 proc_set_traced(struct proc *p, bool stop)
776 {
777
778 sx_assert(&proctree_lock, SX_XLOCKED);
779 PROC_LOCK_ASSERT(p, MA_OWNED);
780 p->p_flag |= P_TRACED;
781 if (stop)
782 p->p_flag2 |= P2_PTRACE_FSTP;
783 p->p_ptevents = PTRACE_DEFAULT;
784 }
785
786 void
ptrace_unsuspend(struct proc * p)787 ptrace_unsuspend(struct proc *p)
788 {
789 PROC_LOCK_ASSERT(p, MA_OWNED);
790
791 PROC_SLOCK(p);
792 p->p_flag &= ~(P_STOPPED_TRACE | P_STOPPED_SIG | P_WAITED);
793 thread_unsuspend(p);
794 PROC_SUNLOCK(p);
795 itimer_proc_continue(p);
796 kqtimer_proc_continue(p);
797 }
798
799 static int
proc_can_ptrace(struct thread * td,struct proc * p)800 proc_can_ptrace(struct thread *td, struct proc *p)
801 {
802 int error;
803
804 PROC_LOCK_ASSERT(p, MA_OWNED);
805
806 if ((p->p_flag & P_WEXIT) != 0)
807 return (ESRCH);
808
809 if ((error = p_cansee(td, p)) != 0)
810 return (error);
811 if ((error = p_candebug(td, p)) != 0)
812 return (error);
813
814 /* not being traced... */
815 if ((p->p_flag & P_TRACED) == 0)
816 return (EPERM);
817
818 /* not being traced by YOU */
819 if (p->p_pptr != td->td_proc)
820 return (EBUSY);
821
822 /* not currently stopped */
823 if ((p->p_flag & P_STOPPED_TRACE) == 0 ||
824 p->p_suspcount != p->p_numthreads ||
825 (p->p_flag & P_WAITED) == 0)
826 return (EBUSY);
827
828 return (0);
829 }
830
831 static struct thread *
ptrace_sel_coredump_thread(struct proc * p)832 ptrace_sel_coredump_thread(struct proc *p)
833 {
834 struct thread *td2;
835
836 PROC_LOCK_ASSERT(p, MA_OWNED);
837 MPASS((p->p_flag & P_STOPPED_TRACE) != 0);
838
839 FOREACH_THREAD_IN_PROC(p, td2) {
840 if ((td2->td_dbgflags & TDB_SSWITCH) != 0)
841 return (td2);
842 }
843 return (NULL);
844 }
845
846 int
kern_ptrace(struct thread * td,int req,pid_t pid,void * addr,int data)847 kern_ptrace(struct thread *td, int req, pid_t pid, void *addr, int data)
848 {
849 struct iovec iov;
850 struct uio uio;
851 struct proc *curp, *p, *pp;
852 struct thread *td2 = NULL, *td3;
853 struct ptrace_io_desc *piod = NULL;
854 struct ptrace_lwpinfo *pl;
855 struct ptrace_sc_ret *psr;
856 struct ptrace_sc_remote *pscr;
857 struct file *fp;
858 struct ptrace_coredump *pc;
859 struct thr_coredump_req *tcq;
860 struct thr_syscall_req *tsr;
861 int error, num, tmp;
862 lwpid_t tid = 0, *buf;
863 #ifdef COMPAT_FREEBSD32
864 int wrap32 = 0, safe = 0;
865 #endif
866 bool proctree_locked, p2_req_set;
867
868 curp = td->td_proc;
869 proctree_locked = false;
870 p2_req_set = false;
871
872 /* Lock proctree before locking the process. */
873 switch (req) {
874 case PT_TRACE_ME:
875 case PT_ATTACH:
876 case PT_STEP:
877 case PT_CONTINUE:
878 case PT_TO_SCE:
879 case PT_TO_SCX:
880 case PT_SYSCALL:
881 case PT_FOLLOW_FORK:
882 case PT_LWP_EVENTS:
883 case PT_GET_EVENT_MASK:
884 case PT_SET_EVENT_MASK:
885 case PT_DETACH:
886 case PT_GET_SC_ARGS:
887 sx_xlock(&proctree_lock);
888 proctree_locked = true;
889 break;
890 default:
891 break;
892 }
893
894 if (req == PT_TRACE_ME) {
895 p = td->td_proc;
896 PROC_LOCK(p);
897 } else {
898 if (pid <= PID_MAX) {
899 if ((p = pfind(pid)) == NULL) {
900 if (proctree_locked)
901 sx_xunlock(&proctree_lock);
902 return (ESRCH);
903 }
904 } else {
905 td2 = tdfind(pid, -1);
906 if (td2 == NULL) {
907 if (proctree_locked)
908 sx_xunlock(&proctree_lock);
909 return (ESRCH);
910 }
911 p = td2->td_proc;
912 tid = pid;
913 pid = p->p_pid;
914 }
915 }
916 AUDIT_ARG_PROCESS(p);
917
918 if ((p->p_flag & P_WEXIT) != 0) {
919 error = ESRCH;
920 goto fail;
921 }
922 if ((error = p_cansee(td, p)) != 0)
923 goto fail;
924
925 if ((error = p_candebug(td, p)) != 0)
926 goto fail;
927
928 /*
929 * System processes can't be debugged.
930 */
931 if ((p->p_flag & P_SYSTEM) != 0) {
932 error = EINVAL;
933 goto fail;
934 }
935
936 if (tid == 0) {
937 if ((p->p_flag & P_STOPPED_TRACE) != 0)
938 td2 = p->p_xthread;
939 if (td2 == NULL)
940 td2 = FIRST_THREAD_IN_PROC(p);
941 tid = td2->td_tid;
942 }
943
944 #ifdef COMPAT_FREEBSD32
945 /*
946 * Test if we're a 32 bit client and what the target is.
947 * Set the wrap controls accordingly.
948 */
949 if (SV_CURPROC_FLAG(SV_ILP32)) {
950 if (SV_PROC_FLAG(td2->td_proc, SV_ILP32))
951 safe = 1;
952 wrap32 = 1;
953 }
954 #endif
955 /*
956 * Permissions check
957 */
958 switch (req) {
959 case PT_TRACE_ME:
960 /*
961 * Always legal, when there is a parent process which
962 * could trace us. Otherwise, reject.
963 */
964 if ((p->p_flag & P_TRACED) != 0) {
965 error = EBUSY;
966 goto fail;
967 }
968 if (p->p_pptr == initproc) {
969 error = EPERM;
970 goto fail;
971 }
972 break;
973
974 case PT_ATTACH:
975 /* Self */
976 if (p == td->td_proc) {
977 error = EINVAL;
978 goto fail;
979 }
980
981 /* Already traced */
982 if (p->p_flag & P_TRACED) {
983 error = EBUSY;
984 goto fail;
985 }
986
987 /* Can't trace an ancestor if you're being traced. */
988 if (curp->p_flag & P_TRACED) {
989 for (pp = curp->p_pptr; pp != NULL; pp = pp->p_pptr) {
990 if (pp == p) {
991 error = EINVAL;
992 goto fail;
993 }
994 }
995 }
996
997 /* OK */
998 break;
999
1000 case PT_CLEARSTEP:
1001 /* Allow thread to clear single step for itself */
1002 if (td->td_tid == tid)
1003 break;
1004
1005 /* FALLTHROUGH */
1006 default:
1007 /*
1008 * Check for ptrace eligibility before waiting for
1009 * holds to drain.
1010 */
1011 error = proc_can_ptrace(td, p);
1012 if (error != 0)
1013 goto fail;
1014
1015 /*
1016 * Block parallel ptrace requests. Most important, do
1017 * not allow other thread in debugger to continue the
1018 * debuggee until coredump finished.
1019 */
1020 while ((p->p_flag2 & P2_PTRACEREQ) != 0) {
1021 if (proctree_locked)
1022 sx_xunlock(&proctree_lock);
1023 error = msleep(&p->p_flag2, &p->p_mtx, PPAUSE | PCATCH |
1024 (proctree_locked ? PDROP : 0), "pptrace", 0);
1025 if (proctree_locked) {
1026 sx_xlock(&proctree_lock);
1027 PROC_LOCK(p);
1028 }
1029 if (error == 0 && td2->td_proc != p)
1030 error = ESRCH;
1031 if (error == 0)
1032 error = proc_can_ptrace(td, p);
1033 if (error != 0)
1034 goto fail;
1035 }
1036
1037 /* Ok */
1038 break;
1039 }
1040
1041 /*
1042 * Keep this process around and request parallel ptrace()
1043 * request to wait until we finish this request.
1044 */
1045 MPASS((p->p_flag2 & P2_PTRACEREQ) == 0);
1046 p->p_flag2 |= P2_PTRACEREQ;
1047 p2_req_set = true;
1048 _PHOLD(p);
1049
1050 /*
1051 * Actually do the requests
1052 */
1053
1054 td->td_retval[0] = 0;
1055
1056 switch (req) {
1057 case PT_TRACE_ME:
1058 /* set my trace flag and "owner" so it can read/write me */
1059 proc_set_traced(p, false);
1060 if (p->p_flag & P_PPWAIT)
1061 p->p_flag |= P_PPTRACE;
1062 CTR1(KTR_PTRACE, "PT_TRACE_ME: pid %d", p->p_pid);
1063 break;
1064
1065 case PT_ATTACH:
1066 /* security check done above */
1067 /*
1068 * It would be nice if the tracing relationship was separate
1069 * from the parent relationship but that would require
1070 * another set of links in the proc struct or for "wait"
1071 * to scan the entire proc table. To make life easier,
1072 * we just re-parent the process we're trying to trace.
1073 * The old parent is remembered so we can put things back
1074 * on a "detach".
1075 */
1076 proc_set_traced(p, true);
1077 proc_reparent(p, td->td_proc, false);
1078 CTR2(KTR_PTRACE, "PT_ATTACH: pid %d, oppid %d", p->p_pid,
1079 p->p_oppid);
1080
1081 sx_xunlock(&proctree_lock);
1082 proctree_locked = false;
1083 MPASS(p->p_xthread == NULL);
1084 MPASS((p->p_flag & P_STOPPED_TRACE) == 0);
1085
1086 /*
1087 * If already stopped due to a stop signal, clear the
1088 * existing stop before triggering a traced SIGSTOP.
1089 */
1090 if ((p->p_flag & P_STOPPED_SIG) != 0) {
1091 PROC_SLOCK(p);
1092 p->p_flag &= ~(P_STOPPED_SIG | P_WAITED);
1093 thread_unsuspend(p);
1094 PROC_SUNLOCK(p);
1095 }
1096
1097 kern_psignal(p, SIGSTOP);
1098 break;
1099
1100 case PT_CLEARSTEP:
1101 CTR2(KTR_PTRACE, "PT_CLEARSTEP: tid %d (pid %d)", td2->td_tid,
1102 p->p_pid);
1103 error = ptrace_clear_single_step(td2);
1104 break;
1105
1106 case PT_SETSTEP:
1107 CTR2(KTR_PTRACE, "PT_SETSTEP: tid %d (pid %d)", td2->td_tid,
1108 p->p_pid);
1109 error = ptrace_single_step(td2);
1110 break;
1111
1112 case PT_SUSPEND:
1113 CTR2(KTR_PTRACE, "PT_SUSPEND: tid %d (pid %d)", td2->td_tid,
1114 p->p_pid);
1115 td2->td_dbgflags |= TDB_SUSPEND;
1116 ast_sched(td2, TDA_SUSPEND);
1117 break;
1118
1119 case PT_RESUME:
1120 CTR2(KTR_PTRACE, "PT_RESUME: tid %d (pid %d)", td2->td_tid,
1121 p->p_pid);
1122 td2->td_dbgflags &= ~TDB_SUSPEND;
1123 break;
1124
1125 case PT_FOLLOW_FORK:
1126 CTR3(KTR_PTRACE, "PT_FOLLOW_FORK: pid %d %s -> %s", p->p_pid,
1127 p->p_ptevents & PTRACE_FORK ? "enabled" : "disabled",
1128 data ? "enabled" : "disabled");
1129 if (data)
1130 p->p_ptevents |= PTRACE_FORK;
1131 else
1132 p->p_ptevents &= ~PTRACE_FORK;
1133 break;
1134
1135 case PT_LWP_EVENTS:
1136 CTR3(KTR_PTRACE, "PT_LWP_EVENTS: pid %d %s -> %s", p->p_pid,
1137 p->p_ptevents & PTRACE_LWP ? "enabled" : "disabled",
1138 data ? "enabled" : "disabled");
1139 if (data)
1140 p->p_ptevents |= PTRACE_LWP;
1141 else
1142 p->p_ptevents &= ~PTRACE_LWP;
1143 break;
1144
1145 case PT_GET_EVENT_MASK:
1146 if (data != sizeof(p->p_ptevents)) {
1147 error = EINVAL;
1148 break;
1149 }
1150 CTR2(KTR_PTRACE, "PT_GET_EVENT_MASK: pid %d mask %#x", p->p_pid,
1151 p->p_ptevents);
1152 *(int *)addr = p->p_ptevents;
1153 break;
1154
1155 case PT_SET_EVENT_MASK:
1156 if (data != sizeof(p->p_ptevents)) {
1157 error = EINVAL;
1158 break;
1159 }
1160 tmp = *(int *)addr;
1161 if ((tmp & ~(PTRACE_EXEC | PTRACE_SCE | PTRACE_SCX |
1162 PTRACE_FORK | PTRACE_LWP | PTRACE_VFORK)) != 0) {
1163 error = EINVAL;
1164 break;
1165 }
1166 CTR3(KTR_PTRACE, "PT_SET_EVENT_MASK: pid %d mask %#x -> %#x",
1167 p->p_pid, p->p_ptevents, tmp);
1168 p->p_ptevents = tmp;
1169 break;
1170
1171 case PT_GET_SC_ARGS:
1172 case PTLINUX_GET_SC_ARGS:
1173 CTR2(KTR_PTRACE, "%s: pid %d", req == PT_GET_SC_ARGS ?
1174 "PT_GET_SC_ARGS" : "PT_LINUX_GET_SC_ARGS", p->p_pid);
1175 if (((td2->td_dbgflags & (TDB_SCE | TDB_SCX)) == 0 &&
1176 td2->td_sa.code == 0)
1177 #ifdef COMPAT_FREEBSD32
1178 || (wrap32 && !safe)
1179 #endif
1180 ) {
1181 error = EINVAL;
1182 break;
1183 }
1184 if (req == PT_GET_SC_ARGS) {
1185 bzero(addr, sizeof(td2->td_sa.args));
1186 bcopy(td2->td_sa.args, addr, td2->td_sa.callp->sy_narg *
1187 sizeof(syscallarg_t));
1188 } else {
1189 /*
1190 * Emulate a Linux bug which which strace(1) depends on:
1191 * at initialization it tests whether ptrace works by
1192 * calling close(2), or some other single-argument
1193 * syscall, _with six arguments_, and then verifies
1194 * whether it can fetch them all using this API;
1195 * otherwise it bails out.
1196 */
1197 bcopy(td2->td_sa.args, addr, 6 * sizeof(syscallarg_t));
1198 }
1199 break;
1200
1201 case PT_GET_SC_RET:
1202 if ((td2->td_dbgflags & (TDB_SCX)) == 0
1203 #ifdef COMPAT_FREEBSD32
1204 || (wrap32 && !safe)
1205 #endif
1206 ) {
1207 error = EINVAL;
1208 break;
1209 }
1210 psr = addr;
1211 bzero(psr, sizeof(*psr));
1212 psr->sr_error = td2->td_errno;
1213 if (psr->sr_error == 0) {
1214 psr->sr_retval[0] = td2->td_retval[0];
1215 psr->sr_retval[1] = td2->td_retval[1];
1216 }
1217 CTR4(KTR_PTRACE,
1218 "PT_GET_SC_RET: pid %d error %d retval %#lx,%#lx",
1219 p->p_pid, psr->sr_error, psr->sr_retval[0],
1220 psr->sr_retval[1]);
1221 break;
1222
1223 case PT_STEP:
1224 case PT_CONTINUE:
1225 case PT_TO_SCE:
1226 case PT_TO_SCX:
1227 case PT_SYSCALL:
1228 case PT_DETACH:
1229 /* Zero means do not send any signal */
1230 if (data < 0 || data > _SIG_MAXSIG) {
1231 error = EINVAL;
1232 break;
1233 }
1234
1235 switch (req) {
1236 case PT_STEP:
1237 CTR3(KTR_PTRACE, "PT_STEP: tid %d (pid %d), sig = %d",
1238 td2->td_tid, p->p_pid, data);
1239 error = ptrace_single_step(td2);
1240 if (error)
1241 goto out;
1242 break;
1243 case PT_CONTINUE:
1244 case PT_TO_SCE:
1245 case PT_TO_SCX:
1246 case PT_SYSCALL:
1247 if (addr != (void *)1) {
1248 error = ptrace_set_pc(td2,
1249 (u_long)(uintfptr_t)addr);
1250 if (error)
1251 goto out;
1252 td2->td_dbgflags |= TDB_USERWR;
1253 }
1254 switch (req) {
1255 case PT_TO_SCE:
1256 p->p_ptevents |= PTRACE_SCE;
1257 CTR4(KTR_PTRACE,
1258 "PT_TO_SCE: pid %d, events = %#x, PC = %#lx, sig = %d",
1259 p->p_pid, p->p_ptevents,
1260 (u_long)(uintfptr_t)addr, data);
1261 break;
1262 case PT_TO_SCX:
1263 p->p_ptevents |= PTRACE_SCX;
1264 CTR4(KTR_PTRACE,
1265 "PT_TO_SCX: pid %d, events = %#x, PC = %#lx, sig = %d",
1266 p->p_pid, p->p_ptevents,
1267 (u_long)(uintfptr_t)addr, data);
1268 break;
1269 case PT_SYSCALL:
1270 p->p_ptevents |= PTRACE_SYSCALL;
1271 CTR4(KTR_PTRACE,
1272 "PT_SYSCALL: pid %d, events = %#x, PC = %#lx, sig = %d",
1273 p->p_pid, p->p_ptevents,
1274 (u_long)(uintfptr_t)addr, data);
1275 break;
1276 case PT_CONTINUE:
1277 CTR3(KTR_PTRACE,
1278 "PT_CONTINUE: pid %d, PC = %#lx, sig = %d",
1279 p->p_pid, (u_long)(uintfptr_t)addr, data);
1280 break;
1281 }
1282 break;
1283 case PT_DETACH:
1284 /*
1285 * Clear P_TRACED before reparenting
1286 * a detached process back to its original
1287 * parent. Otherwise the debugee will be set
1288 * as an orphan of the debugger.
1289 */
1290 p->p_flag &= ~(P_TRACED | P_WAITED);
1291
1292 /*
1293 * Reset the process parent.
1294 */
1295 if (p->p_oppid != p->p_pptr->p_pid) {
1296 PROC_LOCK(p->p_pptr);
1297 sigqueue_take(p->p_ksi);
1298 PROC_UNLOCK(p->p_pptr);
1299
1300 pp = proc_realparent(p);
1301 proc_reparent(p, pp, false);
1302 if (pp == initproc)
1303 p->p_sigparent = SIGCHLD;
1304 CTR3(KTR_PTRACE,
1305 "PT_DETACH: pid %d reparented to pid %d, sig %d",
1306 p->p_pid, pp->p_pid, data);
1307 } else {
1308 CTR2(KTR_PTRACE, "PT_DETACH: pid %d, sig %d",
1309 p->p_pid, data);
1310 }
1311
1312 p->p_ptevents = 0;
1313 FOREACH_THREAD_IN_PROC(p, td3) {
1314 if ((td3->td_dbgflags & TDB_FSTP) != 0) {
1315 sigqueue_delete(&td3->td_sigqueue,
1316 SIGSTOP);
1317 }
1318 td3->td_dbgflags &= ~(TDB_XSIG | TDB_FSTP |
1319 TDB_SUSPEND | TDB_BORN);
1320 }
1321
1322 if ((p->p_flag2 & P2_PTRACE_FSTP) != 0) {
1323 sigqueue_delete(&p->p_sigqueue, SIGSTOP);
1324 p->p_flag2 &= ~P2_PTRACE_FSTP;
1325 }
1326
1327 /*
1328 * Send SIGCHLD and wakeup the parent as needed. It
1329 * may be the case that they had stopped the child
1330 * before it got ptraced, and now they're in the middle
1331 * of a wait(2) for it to continue.
1332 */
1333 PROC_LOCK(p->p_pptr);
1334 childproc_continued(p);
1335 PROC_UNLOCK(p->p_pptr);
1336 break;
1337 }
1338
1339 sx_xunlock(&proctree_lock);
1340 proctree_locked = false;
1341
1342 sendsig:
1343 MPASS(!proctree_locked);
1344
1345 /*
1346 * Clear the pending event for the thread that just
1347 * reported its event (p_xthread), if any. This may
1348 * not be the thread passed to PT_CONTINUE, PT_STEP,
1349 * etc. if the debugger is resuming a different
1350 * thread. There might be no reporting thread if
1351 * the process was just attached.
1352 *
1353 * Deliver any pending signal via the reporting thread.
1354 */
1355 if (p->p_xthread != NULL) {
1356 p->p_xthread->td_dbgflags &= ~TDB_XSIG;
1357 p->p_xthread->td_xsig = data;
1358 p->p_xthread = NULL;
1359 }
1360 p->p_xsig = data;
1361
1362 /*
1363 * P_WKILLED is insurance that a PT_KILL/SIGKILL
1364 * always works immediately, even if another thread is
1365 * unsuspended first and attempts to handle a
1366 * different signal or if the POSIX.1b style signal
1367 * queue cannot accommodate any new signals.
1368 */
1369 if (data == SIGKILL)
1370 proc_wkilled(p);
1371
1372 /*
1373 * If the PT_CONTINUE-like operation is attempted on
1374 * the thread on sleepq, this is possible only after
1375 * the transparent PT_ATTACH. In this case, if the
1376 * caller modified the thread state, e.g. by writing
1377 * register file or specifying the pc, make the thread
1378 * xstopped by waking it up.
1379 */
1380 if ((td2->td_dbgflags & TDB_USERWR) != 0) {
1381 if (pt_attach_transparent) {
1382 thread_lock(td2);
1383 if (TD_ON_SLEEPQ(td2) &&
1384 (td2->td_flags & TDF_SINTR) != 0) {
1385 sleepq_abort(td2, EINTR);
1386 } else {
1387 thread_unlock(td2);
1388 }
1389 }
1390 td2->td_dbgflags &= ~TDB_USERWR;
1391 }
1392
1393 /*
1394 * Unsuspend all threads. To leave a thread
1395 * suspended, use PT_SUSPEND to suspend it before
1396 * continuing the process.
1397 */
1398 ptrace_unsuspend(p);
1399 break;
1400
1401 case PT_WRITE_I:
1402 case PT_WRITE_D:
1403 td2->td_dbgflags |= TDB_USERWR;
1404 PROC_UNLOCK(p);
1405 error = 0;
1406 if (proc_writemem(td, p, (off_t)(uintptr_t)addr, &data,
1407 sizeof(int)) != sizeof(int))
1408 error = ENOMEM;
1409 else
1410 CTR3(KTR_PTRACE, "PT_WRITE: pid %d: %p <= %#x",
1411 p->p_pid, addr, data);
1412 PROC_LOCK(p);
1413 break;
1414
1415 case PT_READ_I:
1416 case PT_READ_D:
1417 PROC_UNLOCK(p);
1418 error = tmp = 0;
1419 if (proc_readmem(td, p, (off_t)(uintptr_t)addr, &tmp,
1420 sizeof(int)) != sizeof(int))
1421 error = ENOMEM;
1422 else
1423 CTR3(KTR_PTRACE, "PT_READ: pid %d: %p >= %#x",
1424 p->p_pid, addr, tmp);
1425 td->td_retval[0] = tmp;
1426 PROC_LOCK(p);
1427 break;
1428
1429 case PT_IO:
1430 piod = addr;
1431 if (piod->piod_len > SSIZE_MAX) {
1432 error = EINVAL;
1433 goto out;
1434 }
1435 iov.iov_base = piod->piod_addr;
1436 iov.iov_len = piod->piod_len;
1437 uio.uio_offset = (off_t)(uintptr_t)piod->piod_offs;
1438 uio.uio_resid = piod->piod_len;
1439 uio.uio_iov = &iov;
1440 uio.uio_iovcnt = 1;
1441 uio.uio_segflg = UIO_USERSPACE;
1442 uio.uio_td = td;
1443 switch (piod->piod_op) {
1444 case PIOD_READ_D:
1445 case PIOD_READ_I:
1446 CTR3(KTR_PTRACE, "PT_IO: pid %d: READ (%p, %#x)",
1447 p->p_pid, (uintptr_t)uio.uio_offset, uio.uio_resid);
1448 uio.uio_rw = UIO_READ;
1449 break;
1450 case PIOD_WRITE_D:
1451 case PIOD_WRITE_I:
1452 CTR3(KTR_PTRACE, "PT_IO: pid %d: WRITE (%p, %#x)",
1453 p->p_pid, (uintptr_t)uio.uio_offset, uio.uio_resid);
1454 td2->td_dbgflags |= TDB_USERWR;
1455 uio.uio_rw = UIO_WRITE;
1456 break;
1457 default:
1458 error = EINVAL;
1459 goto out;
1460 }
1461 PROC_UNLOCK(p);
1462 error = proc_rwmem(p, &uio);
1463 piod->piod_len -= uio.uio_resid;
1464 PROC_LOCK(p);
1465 break;
1466
1467 case PT_KILL:
1468 CTR1(KTR_PTRACE, "PT_KILL: pid %d", p->p_pid);
1469 data = SIGKILL;
1470 goto sendsig; /* in PT_CONTINUE above */
1471
1472 case PT_SETREGS:
1473 CTR2(KTR_PTRACE, "PT_SETREGS: tid %d (pid %d)", td2->td_tid,
1474 p->p_pid);
1475 td2->td_dbgflags |= TDB_USERWR;
1476 error = PROC_WRITE(regs, td2, addr);
1477 break;
1478
1479 case PT_GETREGS:
1480 CTR2(KTR_PTRACE, "PT_GETREGS: tid %d (pid %d)", td2->td_tid,
1481 p->p_pid);
1482 error = PROC_READ(regs, td2, addr);
1483 break;
1484
1485 case PT_SETFPREGS:
1486 CTR2(KTR_PTRACE, "PT_SETFPREGS: tid %d (pid %d)", td2->td_tid,
1487 p->p_pid);
1488 td2->td_dbgflags |= TDB_USERWR;
1489 error = PROC_WRITE(fpregs, td2, addr);
1490 break;
1491
1492 case PT_GETFPREGS:
1493 CTR2(KTR_PTRACE, "PT_GETFPREGS: tid %d (pid %d)", td2->td_tid,
1494 p->p_pid);
1495 error = PROC_READ(fpregs, td2, addr);
1496 break;
1497
1498 case PT_SETDBREGS:
1499 CTR2(KTR_PTRACE, "PT_SETDBREGS: tid %d (pid %d)", td2->td_tid,
1500 p->p_pid);
1501 td2->td_dbgflags |= TDB_USERWR;
1502 error = PROC_WRITE(dbregs, td2, addr);
1503 break;
1504
1505 case PT_GETDBREGS:
1506 CTR2(KTR_PTRACE, "PT_GETDBREGS: tid %d (pid %d)", td2->td_tid,
1507 p->p_pid);
1508 error = PROC_READ(dbregs, td2, addr);
1509 break;
1510
1511 case PT_SETREGSET:
1512 CTR2(KTR_PTRACE, "PT_SETREGSET: tid %d (pid %d)", td2->td_tid,
1513 p->p_pid);
1514 error = proc_write_regset(td2, data, addr);
1515 break;
1516
1517 case PT_GETREGSET:
1518 CTR2(KTR_PTRACE, "PT_GETREGSET: tid %d (pid %d)", td2->td_tid,
1519 p->p_pid);
1520 error = proc_read_regset(td2, data, addr);
1521 break;
1522
1523 case PT_LWPINFO:
1524 if (data <= 0 || data > sizeof(*pl)) {
1525 error = EINVAL;
1526 break;
1527 }
1528 pl = addr;
1529 bzero(pl, sizeof(*pl));
1530 pl->pl_lwpid = td2->td_tid;
1531 pl->pl_event = PL_EVENT_NONE;
1532 pl->pl_flags = 0;
1533 if (td2->td_dbgflags & TDB_XSIG) {
1534 pl->pl_event = PL_EVENT_SIGNAL;
1535 if (td2->td_si.si_signo != 0 &&
1536 data >= offsetof(struct ptrace_lwpinfo, pl_siginfo)
1537 + sizeof(pl->pl_siginfo)){
1538 pl->pl_flags |= PL_FLAG_SI;
1539 pl->pl_siginfo = td2->td_si;
1540 }
1541 }
1542 if (td2->td_dbgflags & TDB_SCE)
1543 pl->pl_flags |= PL_FLAG_SCE;
1544 else if (td2->td_dbgflags & TDB_SCX)
1545 pl->pl_flags |= PL_FLAG_SCX;
1546 if (td2->td_dbgflags & TDB_EXEC)
1547 pl->pl_flags |= PL_FLAG_EXEC;
1548 if (td2->td_dbgflags & TDB_FORK) {
1549 pl->pl_flags |= PL_FLAG_FORKED;
1550 pl->pl_child_pid = td2->td_dbg_forked;
1551 if (td2->td_dbgflags & TDB_VFORK)
1552 pl->pl_flags |= PL_FLAG_VFORKED;
1553 } else if ((td2->td_dbgflags & (TDB_SCX | TDB_VFORK)) ==
1554 TDB_VFORK)
1555 pl->pl_flags |= PL_FLAG_VFORK_DONE;
1556 if (td2->td_dbgflags & TDB_CHILD)
1557 pl->pl_flags |= PL_FLAG_CHILD;
1558 if (td2->td_dbgflags & TDB_BORN)
1559 pl->pl_flags |= PL_FLAG_BORN;
1560 if (td2->td_dbgflags & TDB_EXIT)
1561 pl->pl_flags |= PL_FLAG_EXITED;
1562 pl->pl_sigmask = td2->td_sigmask;
1563 pl->pl_siglist = td2->td_siglist;
1564 strcpy(pl->pl_tdname, td2->td_name);
1565 if (td2->td_sa.code != 0) {
1566 pl->pl_syscall_code = td2->td_sa.code;
1567 pl->pl_syscall_narg = td2->td_sa.callp->sy_narg;
1568 }
1569 CTR6(KTR_PTRACE,
1570 "PT_LWPINFO: tid %d (pid %d) event %d flags %#x child pid %d syscall %d",
1571 td2->td_tid, p->p_pid, pl->pl_event, pl->pl_flags,
1572 pl->pl_child_pid, pl->pl_syscall_code);
1573 break;
1574
1575 case PT_GETNUMLWPS:
1576 CTR2(KTR_PTRACE, "PT_GETNUMLWPS: pid %d: %d threads", p->p_pid,
1577 p->p_numthreads);
1578 td->td_retval[0] = p->p_numthreads;
1579 break;
1580
1581 case PT_GETLWPLIST:
1582 CTR3(KTR_PTRACE, "PT_GETLWPLIST: pid %d: data %d, actual %d",
1583 p->p_pid, data, p->p_numthreads);
1584 if (data <= 0) {
1585 error = EINVAL;
1586 break;
1587 }
1588 num = imin(p->p_numthreads, data);
1589 PROC_UNLOCK(p);
1590 buf = malloc(num * sizeof(lwpid_t), M_TEMP, M_WAITOK);
1591 tmp = 0;
1592 PROC_LOCK(p);
1593 FOREACH_THREAD_IN_PROC(p, td2) {
1594 if (tmp >= num)
1595 break;
1596 buf[tmp++] = td2->td_tid;
1597 }
1598 PROC_UNLOCK(p);
1599 error = copyout(buf, addr, tmp * sizeof(lwpid_t));
1600 free(buf, M_TEMP);
1601 if (!error)
1602 td->td_retval[0] = tmp;
1603 PROC_LOCK(p);
1604 break;
1605
1606 case PT_VM_TIMESTAMP:
1607 CTR2(KTR_PTRACE, "PT_VM_TIMESTAMP: pid %d: timestamp %d",
1608 p->p_pid, p->p_vmspace->vm_map.timestamp);
1609 td->td_retval[0] = p->p_vmspace->vm_map.timestamp;
1610 break;
1611
1612 case PT_VM_ENTRY:
1613 PROC_UNLOCK(p);
1614 error = ptrace_vm_entry(td, p, addr);
1615 PROC_LOCK(p);
1616 break;
1617
1618 case PT_COREDUMP:
1619 pc = addr;
1620 CTR2(KTR_PTRACE, "PT_COREDUMP: pid %d, fd %d",
1621 p->p_pid, pc->pc_fd);
1622
1623 if ((pc->pc_flags & ~(PC_COMPRESS | PC_ALL)) != 0) {
1624 error = EINVAL;
1625 break;
1626 }
1627 PROC_UNLOCK(p);
1628
1629 tcq = malloc(sizeof(*tcq), M_TEMP, M_WAITOK | M_ZERO);
1630 fp = NULL;
1631 error = fget_write(td, pc->pc_fd, &cap_write_rights, &fp);
1632 if (error != 0)
1633 goto coredump_cleanup_nofp;
1634 if (fp->f_type != DTYPE_VNODE || fp->f_vnode->v_type != VREG) {
1635 error = EPIPE;
1636 goto coredump_cleanup;
1637 }
1638
1639 PROC_LOCK(p);
1640 error = proc_can_ptrace(td, p);
1641 if (error != 0)
1642 goto coredump_cleanup_locked;
1643
1644 td2 = ptrace_sel_coredump_thread(p);
1645 if (td2 == NULL) {
1646 error = EBUSY;
1647 goto coredump_cleanup_locked;
1648 }
1649 KASSERT((td2->td_dbgflags & (TDB_COREDUMPREQ |
1650 TDB_SCREMOTEREQ)) == 0,
1651 ("proc %d tid %d req coredump", p->p_pid, td2->td_tid));
1652
1653 tcq->tc_vp = fp->f_vnode;
1654 tcq->tc_limit = pc->pc_limit == 0 ? OFF_MAX : pc->pc_limit;
1655 tcq->tc_flags = SVC_PT_COREDUMP;
1656 if ((pc->pc_flags & PC_COMPRESS) == 0)
1657 tcq->tc_flags |= SVC_NOCOMPRESS;
1658 if ((pc->pc_flags & PC_ALL) != 0)
1659 tcq->tc_flags |= SVC_ALL;
1660 td2->td_remotereq = tcq;
1661 td2->td_dbgflags |= TDB_COREDUMPREQ;
1662 thread_run_flash(td2);
1663 while ((td2->td_dbgflags & TDB_COREDUMPREQ) != 0)
1664 msleep(p, &p->p_mtx, PPAUSE, "crdmp", 0);
1665 error = tcq->tc_error;
1666 coredump_cleanup_locked:
1667 PROC_UNLOCK(p);
1668 coredump_cleanup:
1669 fdrop(fp, td);
1670 coredump_cleanup_nofp:
1671 free(tcq, M_TEMP);
1672 PROC_LOCK(p);
1673 break;
1674
1675 case PT_SC_REMOTE:
1676 pscr = addr;
1677 CTR2(KTR_PTRACE, "PT_SC_REMOTE: pid %d, syscall %d",
1678 p->p_pid, pscr->pscr_syscall);
1679 if ((td2->td_dbgflags & TDB_BOUNDARY) == 0) {
1680 error = EBUSY;
1681 break;
1682 }
1683 PROC_UNLOCK(p);
1684 MPASS(pscr->pscr_nargs <= nitems(td->td_sa.args));
1685
1686 tsr = malloc(sizeof(struct thr_syscall_req), M_TEMP,
1687 M_WAITOK | M_ZERO);
1688
1689 tsr->ts_sa.code = pscr->pscr_syscall;
1690 tsr->ts_nargs = pscr->pscr_nargs;
1691 memcpy(&tsr->ts_sa.args, pscr->pscr_args,
1692 sizeof(syscallarg_t) * tsr->ts_nargs);
1693
1694 PROC_LOCK(p);
1695 error = proc_can_ptrace(td, p);
1696 if (error != 0) {
1697 free(tsr, M_TEMP);
1698 break;
1699 }
1700 if (td2->td_proc != p) {
1701 free(tsr, M_TEMP);
1702 error = ESRCH;
1703 break;
1704 }
1705 KASSERT((td2->td_dbgflags & (TDB_COREDUMPREQ |
1706 TDB_SCREMOTEREQ)) == 0,
1707 ("proc %d tid %d req coredump", p->p_pid, td2->td_tid));
1708
1709 td2->td_remotereq = tsr;
1710 td2->td_dbgflags |= TDB_SCREMOTEREQ;
1711 thread_run_flash(td2);
1712 while ((td2->td_dbgflags & TDB_SCREMOTEREQ) != 0)
1713 msleep(p, &p->p_mtx, PPAUSE, "pscrx", 0);
1714 error = 0;
1715 memcpy(&pscr->pscr_ret, &tsr->ts_ret, sizeof(tsr->ts_ret));
1716 free(tsr, M_TEMP);
1717 break;
1718
1719 default:
1720 #ifdef __HAVE_PTRACE_MACHDEP
1721 if (req >= PT_FIRSTMACH) {
1722 PROC_UNLOCK(p);
1723 error = cpu_ptrace(td2, req, addr, data);
1724 PROC_LOCK(p);
1725 } else
1726 #endif
1727 /* Unknown request. */
1728 error = EINVAL;
1729 break;
1730 }
1731 out:
1732 /* Drop our hold on this process now that the request has completed. */
1733 _PRELE(p);
1734 fail:
1735 if (p2_req_set) {
1736 if ((p->p_flag2 & P2_PTRACEREQ) != 0)
1737 wakeup(&p->p_flag2);
1738 p->p_flag2 &= ~P2_PTRACEREQ;
1739 }
1740 PROC_UNLOCK(p);
1741 if (proctree_locked)
1742 sx_xunlock(&proctree_lock);
1743 return (error);
1744 }
1745 #undef PROC_READ
1746 #undef PROC_WRITE
1747