1 /* 2 * Copyright (c) 1994, Sean Eric Fagan 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by Sean Eric Fagan. 16 * 4. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * $FreeBSD$ 32 */ 33 34 #include <sys/param.h> 35 #include <sys/systm.h> 36 #include <sys/lock.h> 37 #include <sys/mutex.h> 38 #include <sys/sysproto.h> 39 #include <sys/proc.h> 40 #include <sys/vnode.h> 41 #include <sys/ptrace.h> 42 #include <sys/sx.h> 43 #include <sys/user.h> 44 45 #include <machine/reg.h> 46 47 #include <vm/vm.h> 48 #include <vm/vm_param.h> 49 #include <vm/pmap.h> 50 #include <vm/vm_extern.h> 51 #include <vm/vm_map.h> 52 #include <vm/vm_kern.h> 53 #include <vm/vm_object.h> 54 #include <vm/vm_page.h> 55 56 int 57 proc_rwmem(struct proc *p, struct uio *uio) 58 { 59 struct vmspace *vm; 60 vm_map_t map; 61 vm_object_t object = NULL; 62 vm_offset_t pageno = 0; /* page number */ 63 vm_prot_t reqprot; 64 vm_offset_t kva; 65 int error; 66 int writing; 67 68 GIANT_REQUIRED; 69 70 /* 71 * if the vmspace is in the midst of being deallocated or the 72 * process is exiting, don't try to grab anything. The page table 73 * usage in that process can be messed up. 74 */ 75 vm = p->p_vmspace; 76 if ((p->p_flag & P_WEXIT)) 77 return (EFAULT); 78 if (vm->vm_refcnt < 1) 79 return (EFAULT); 80 ++vm->vm_refcnt; 81 /* 82 * The map we want... 83 */ 84 map = &vm->vm_map; 85 86 writing = uio->uio_rw == UIO_WRITE; 87 reqprot = writing ? (VM_PROT_WRITE | VM_PROT_OVERRIDE_WRITE) : 88 VM_PROT_READ; 89 90 kva = kmem_alloc_pageable(kernel_map, PAGE_SIZE); 91 92 /* 93 * Only map in one page at a time. We don't have to, but it 94 * makes things easier. This way is trivial - right? 95 */ 96 do { 97 vm_map_t tmap; 98 vm_offset_t uva; 99 int page_offset; /* offset into page */ 100 vm_map_entry_t out_entry; 101 vm_prot_t out_prot; 102 boolean_t wired; 103 vm_pindex_t pindex; 104 u_int len; 105 vm_page_t m; 106 107 object = NULL; 108 109 uva = (vm_offset_t)uio->uio_offset; 110 111 /* 112 * Get the page number of this segment. 113 */ 114 pageno = trunc_page(uva); 115 page_offset = uva - pageno; 116 117 /* 118 * How many bytes to copy 119 */ 120 len = min(PAGE_SIZE - page_offset, uio->uio_resid); 121 122 /* 123 * Fault the page on behalf of the process 124 */ 125 error = vm_fault(map, pageno, reqprot, VM_FAULT_NORMAL); 126 if (error) { 127 error = EFAULT; 128 break; 129 } 130 131 /* 132 * Now we need to get the page. out_entry, out_prot, wired, 133 * and single_use aren't used. One would think the vm code 134 * would be a *bit* nicer... We use tmap because 135 * vm_map_lookup() can change the map argument. 136 */ 137 tmap = map; 138 error = vm_map_lookup(&tmap, pageno, reqprot, &out_entry, 139 &object, &pindex, &out_prot, &wired); 140 141 if (error) { 142 error = EFAULT; 143 144 /* 145 * Make sure that there is no residue in 'object' from 146 * an error return on vm_map_lookup. 147 */ 148 object = NULL; 149 150 break; 151 } 152 153 m = vm_page_lookup(object, pindex); 154 155 /* Allow fallback to backing objects if we are reading */ 156 157 while (m == NULL && !writing && object->backing_object) { 158 159 pindex += OFF_TO_IDX(object->backing_object_offset); 160 object = object->backing_object; 161 162 m = vm_page_lookup(object, pindex); 163 } 164 165 if (m == NULL) { 166 error = EFAULT; 167 168 /* 169 * Make sure that there is no residue in 'object' from 170 * an error return on vm_map_lookup. 171 */ 172 object = NULL; 173 174 vm_map_lookup_done(tmap, out_entry); 175 176 break; 177 } 178 179 /* 180 * Wire the page into memory 181 */ 182 vm_page_wire(m); 183 184 /* 185 * We're done with tmap now. 186 * But reference the object first, so that we won't loose 187 * it. 188 */ 189 vm_object_reference(object); 190 vm_map_lookup_done(tmap, out_entry); 191 192 pmap_kenter(kva, VM_PAGE_TO_PHYS(m)); 193 194 /* 195 * Now do the i/o move. 196 */ 197 error = uiomove((caddr_t)(kva + page_offset), len, uio); 198 199 pmap_kremove(kva); 200 201 /* 202 * release the page and the object 203 */ 204 vm_page_unwire(m, 1); 205 vm_object_deallocate(object); 206 207 object = NULL; 208 209 } while (error == 0 && uio->uio_resid > 0); 210 211 if (object) 212 vm_object_deallocate(object); 213 214 kmem_free(kernel_map, kva, PAGE_SIZE); 215 vmspace_free(vm); 216 return (error); 217 } 218 219 /* 220 * Process debugging system call. 221 */ 222 #ifndef _SYS_SYSPROTO_H_ 223 struct ptrace_args { 224 int req; 225 pid_t pid; 226 caddr_t addr; 227 int data; 228 }; 229 #endif 230 231 int 232 ptrace(struct thread *td, struct ptrace_args *uap) 233 { 234 struct proc *curp = td->td_proc; 235 struct proc *p; 236 struct iovec iov; 237 struct uio uio; 238 union { 239 struct reg reg; 240 struct dbreg dbreg; 241 struct fpreg fpreg; 242 } r; 243 int error = 0; 244 int write; 245 246 write = 0; 247 if (uap->req == PT_TRACE_ME) { 248 p = curp; 249 PROC_LOCK(p); 250 } else { 251 if ((p = pfind(uap->pid)) == NULL) 252 return (ESRCH); 253 } 254 if (p_cansee(curp, p)) { 255 PROC_UNLOCK(p); 256 return (ESRCH); 257 } 258 259 if ((error = p_candebug(curp, p)) != 0) { 260 PROC_UNLOCK(p); 261 return (error); 262 } 263 264 /* 265 * Don't debug system processes! 266 */ 267 if ((p->p_flag & P_SYSTEM) != 0) { 268 PROC_UNLOCK(p); 269 return (EINVAL); 270 } 271 272 /* 273 * Permissions check 274 */ 275 switch (uap->req) { 276 case PT_TRACE_ME: 277 /* Always legal. */ 278 break; 279 280 case PT_ATTACH: 281 /* Self */ 282 if (p->p_pid == curp->p_pid) { 283 PROC_UNLOCK(p); 284 return (EINVAL); 285 } 286 287 /* Already traced */ 288 if (p->p_flag & P_TRACED) { 289 PROC_UNLOCK(p); 290 return (EBUSY); 291 } 292 293 /* OK */ 294 break; 295 296 case PT_READ_I: 297 case PT_READ_D: 298 case PT_WRITE_I: 299 case PT_WRITE_D: 300 case PT_CONTINUE: 301 case PT_KILL: 302 case PT_STEP: 303 case PT_DETACH: 304 #ifdef PT_GETREGS 305 case PT_GETREGS: 306 #endif 307 #ifdef PT_SETREGS 308 case PT_SETREGS: 309 #endif 310 #ifdef PT_GETFPREGS 311 case PT_GETFPREGS: 312 #endif 313 #ifdef PT_SETFPREGS 314 case PT_SETFPREGS: 315 #endif 316 #ifdef PT_GETDBREGS 317 case PT_GETDBREGS: 318 #endif 319 #ifdef PT_SETDBREGS 320 case PT_SETDBREGS: 321 #endif 322 /* not being traced... */ 323 if ((p->p_flag & P_TRACED) == 0) { 324 PROC_UNLOCK(p); 325 return (EPERM); 326 } 327 328 /* not being traced by YOU */ 329 if (p->p_pptr != curp) { 330 PROC_UNLOCK(p); 331 return (EBUSY); 332 } 333 334 /* not currently stopped */ 335 mtx_lock_spin(&sched_lock); 336 if (p->p_stat != SSTOP || (p->p_flag & P_WAITED) == 0) { 337 mtx_unlock_spin(&sched_lock); 338 PROC_UNLOCK(p); 339 return (EBUSY); 340 } 341 mtx_unlock_spin(&sched_lock); 342 343 /* OK */ 344 break; 345 346 default: 347 PROC_UNLOCK(p); 348 return (EINVAL); 349 } 350 351 PROC_UNLOCK(p); 352 #ifdef FIX_SSTEP 353 /* 354 * Single step fixup ala procfs 355 */ 356 FIX_SSTEP(&p->p_thread); /* XXXKSE */ 357 #endif 358 359 /* 360 * Actually do the requests 361 */ 362 363 td->td_retval[0] = 0; 364 365 switch (uap->req) { 366 case PT_TRACE_ME: 367 /* set my trace flag and "owner" so it can read/write me */ 368 sx_xlock(&proctree_lock); 369 PROC_LOCK(p); 370 p->p_flag |= P_TRACED; 371 p->p_oppid = p->p_pptr->p_pid; 372 PROC_UNLOCK(p); 373 sx_xunlock(&proctree_lock); 374 return (0); 375 376 case PT_ATTACH: 377 /* security check done above */ 378 sx_xlock(&proctree_lock); 379 PROC_LOCK(p); 380 p->p_flag |= P_TRACED; 381 p->p_oppid = p->p_pptr->p_pid; 382 if (p->p_pptr != curp) 383 proc_reparent(p, curp); 384 PROC_UNLOCK(p); 385 sx_xunlock(&proctree_lock); 386 uap->data = SIGSTOP; 387 goto sendsig; /* in PT_CONTINUE below */ 388 389 case PT_STEP: 390 case PT_CONTINUE: 391 case PT_DETACH: 392 if ((uap->req != PT_STEP) && ((unsigned)uap->data >= NSIG)) 393 return (EINVAL); 394 395 PHOLD(p); 396 397 if (uap->req == PT_STEP) { 398 if ((error = ptrace_single_step(&p->p_thread))) { 399 PRELE(p); 400 return (error); 401 } 402 } 403 404 if (uap->addr != (caddr_t)1) { 405 fill_kinfo_proc(p, &p->p_uarea->u_kproc); 406 if ((error = ptrace_set_pc(&p->p_thread, 407 (u_long)(uintfptr_t)uap->addr))) { 408 PRELE(p); 409 return (error); 410 } 411 } 412 PRELE(p); 413 414 if (uap->req == PT_DETACH) { 415 /* reset process parent */ 416 sx_xlock(&proctree_lock); 417 if (p->p_oppid != p->p_pptr->p_pid) { 418 struct proc *pp; 419 420 pp = pfind(p->p_oppid); 421 if (pp != NULL) 422 PROC_UNLOCK(pp); 423 else 424 pp = initproc; 425 PROC_LOCK(p); 426 proc_reparent(p, pp); 427 } else 428 PROC_LOCK(p); 429 p->p_flag &= ~(P_TRACED | P_WAITED); 430 p->p_oppid = 0; 431 432 PROC_UNLOCK(p); 433 sx_xunlock(&proctree_lock); 434 435 /* should we send SIGCHLD? */ 436 437 } 438 439 sendsig: 440 /* deliver or queue signal */ 441 PROC_LOCK(p); 442 mtx_lock_spin(&sched_lock); 443 if (p->p_stat == SSTOP) { 444 p->p_xstat = uap->data; 445 setrunnable(&p->p_thread); /* XXXKSE */ 446 mtx_unlock_spin(&sched_lock); 447 } else { 448 mtx_unlock_spin(&sched_lock); 449 if (uap->data) 450 psignal(p, uap->data); 451 452 } 453 PROC_UNLOCK(p); 454 return (0); 455 456 case PT_WRITE_I: 457 case PT_WRITE_D: 458 write = 1; 459 /* fallthrough */ 460 case PT_READ_I: 461 case PT_READ_D: 462 /* write = 0 set above */ 463 iov.iov_base = write ? (caddr_t)&uap->data : 464 (caddr_t)td->td_retval; 465 iov.iov_len = sizeof(int); 466 uio.uio_iov = &iov; 467 uio.uio_iovcnt = 1; 468 uio.uio_offset = (off_t)(uintptr_t)uap->addr; 469 uio.uio_resid = sizeof(int); 470 uio.uio_segflg = UIO_SYSSPACE; /* ie: the uap */ 471 uio.uio_rw = write ? UIO_WRITE : UIO_READ; 472 uio.uio_td = td; 473 error = proc_rwmem(p, &uio); 474 if (uio.uio_resid != 0) { 475 /* 476 * XXX proc_rwmem() doesn't currently return ENOSPC, 477 * so I think write() can bogusly return 0. 478 * XXX what happens for short writes? We don't want 479 * to write partial data. 480 * XXX proc_rwmem() returns EPERM for other invalid 481 * addresses. Convert this to EINVAL. Does this 482 * clobber returns of EPERM for other reasons? 483 */ 484 if (error == 0 || error == ENOSPC || error == EPERM) 485 error = EINVAL; /* EOF */ 486 } 487 return (error); 488 489 case PT_KILL: 490 uap->data = SIGKILL; 491 goto sendsig; /* in PT_CONTINUE above */ 492 493 #ifdef PT_SETREGS 494 case PT_SETREGS: 495 error = copyin(uap->addr, &r.reg, sizeof r.reg); 496 if (error == 0) { 497 PHOLD(p); 498 error = procfs_write_regs(&p->p_thread, &r.reg); 499 PRELE(p); 500 } 501 return (error); 502 #endif /* PT_SETREGS */ 503 504 #ifdef PT_GETREGS 505 case PT_GETREGS: 506 PHOLD(p); 507 error = procfs_read_regs(&p->p_thread, &r.reg); 508 PRELE(p); 509 if (error == 0) 510 error = copyout(&r.reg, uap->addr, sizeof r.reg); 511 return (error); 512 #endif /* PT_SETREGS */ 513 514 #ifdef PT_SETFPREGS 515 case PT_SETFPREGS: 516 error = copyin(uap->addr, &r.fpreg, sizeof r.fpreg); 517 if (error == 0) { 518 PHOLD(p); 519 error = procfs_write_fpregs(&p->p_thread, &r.fpreg); 520 PRELE(p); 521 } 522 return (error); 523 #endif /* PT_SETFPREGS */ 524 525 #ifdef PT_GETFPREGS 526 case PT_GETFPREGS: 527 PHOLD(p); 528 error = procfs_read_fpregs(&p->p_thread, &r.fpreg); 529 PRELE(p); 530 if (error == 0) 531 error = copyout(&r.fpreg, uap->addr, sizeof r.fpreg); 532 return (error); 533 #endif /* PT_SETFPREGS */ 534 535 #ifdef PT_SETDBREGS 536 case PT_SETDBREGS: 537 error = copyin(uap->addr, &r.dbreg, sizeof r.dbreg); 538 if (error == 0) { 539 PHOLD(p); 540 error = procfs_write_dbregs(&p->p_thread, &r.dbreg); 541 PRELE(p); 542 } 543 return (error); 544 #endif /* PT_SETDBREGS */ 545 546 #ifdef PT_GETDBREGS 547 case PT_GETDBREGS: 548 PHOLD(p); 549 error = procfs_read_dbregs(&p->p_thread, &r.dbreg); 550 PRELE(p); 551 if (error == 0) 552 error = copyout(&r.dbreg, uap->addr, sizeof r.dbreg); 553 return (error); 554 #endif /* PT_SETDBREGS */ 555 556 default: 557 KASSERT(0, ("unreachable code\n")); 558 break; 559 } 560 561 KASSERT(0, ("unreachable code\n")); 562 return (0); 563 } 564 565 int 566 trace_req(struct proc *p) 567 { 568 return (1); 569 } 570 571 /* 572 * stopevent() 573 * Stop a process because of a debugging event; 574 * stay stopped until p->p_step is cleared 575 * (cleared by PIOCCONT in procfs). 576 * 577 * Must be called with the proc struct mutex held. 578 */ 579 580 void 581 stopevent(struct proc *p, unsigned int event, unsigned int val) 582 { 583 584 PROC_LOCK_ASSERT(p, MA_OWNED | MA_NOTRECURSED); 585 p->p_step = 1; 586 587 do { 588 p->p_xstat = val; 589 p->p_stype = event; /* Which event caused the stop? */ 590 wakeup(&p->p_stype); /* Wake up any PIOCWAIT'ing procs */ 591 msleep(&p->p_step, &p->p_mtx, PWAIT, "stopevent", 0); 592 } while (p->p_step); 593 } 594