xref: /netbsd-src/sys/kern/sys_process.c (revision 366e81869c056a2c569cba90e971c65ad4d009e6)
1 /*	$NetBSD: sys_process.c,v 1.73 2002/03/17 17:02:45 thorpej Exp $	*/
2 
3 /*-
4  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
5  * Copyright (c) 1982, 1986, 1989, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  * (c) UNIX System Laboratories, Inc.
8  * All or some portions of this file are derived from material licensed
9  * to the University of California by American Telephone and Telegraph
10  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
11  * the permission of UNIX System Laboratories, Inc.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. All advertising materials mentioning features or use of this software
22  *    must display the following acknowledgement:
23  *	This product includes software developed by the University of
24  *	California, Berkeley and its contributors.
25  * 4. Neither the name of the University nor the names of its contributors
26  *    may be used to endorse or promote products derived from this software
27  *    without specific prior written permission.
28  *
29  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
30  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
31  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
32  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
33  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
34  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
37  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
38  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39  * SUCH DAMAGE.
40  *
41  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
42  */
43 
44 /*
45  * References:
46  *	(1) Bach's "The Design of the UNIX Operating System",
47  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
48  *	(3) the "4.4BSD Programmer's Reference Manual" published
49  *		by USENIX and O'Reilly & Associates.
50  * The 4.4BSD PRM does a reasonably good job of documenting what the various
51  * ptrace() requests should actually do, and its text is quoted several times
52  * in this file.
53  */
54 
55 #include <sys/cdefs.h>
56 __KERNEL_RCSID(0, "$NetBSD: sys_process.c,v 1.73 2002/03/17 17:02:45 thorpej Exp $");
57 
58 #include <sys/param.h>
59 #include <sys/systm.h>
60 #include <sys/proc.h>
61 #include <sys/errno.h>
62 #include <sys/ptrace.h>
63 #include <sys/uio.h>
64 #include <sys/user.h>
65 
66 #include <sys/mount.h>
67 #include <sys/syscallargs.h>
68 
69 #include <uvm/uvm_extern.h>
70 
71 #include <machine/reg.h>
72 
73 #include <miscfs/procfs/procfs.h>
74 
75 /* Macros to clear/set/test flags. */
76 #define	SET(t, f)	(t) |= (f)
77 #define	CLR(t, f)	(t) &= ~(f)
78 #define	ISSET(t, f)	((t) & (f))
79 
80 /*
81  * Process debugging system call.
82  */
83 int
84 sys_ptrace(p, v, retval)
85 	struct proc *p;
86 	void *v;
87 	register_t *retval;
88 {
89 	struct sys_ptrace_args /* {
90 		syscallarg(int) req;
91 		syscallarg(pid_t) pid;
92 		syscallarg(caddr_t) addr;
93 		syscallarg(int) data;
94 	} */ *uap = v;
95 	struct proc *t;				/* target process */
96 	struct uio uio;
97 	struct iovec iov;
98 	struct ptrace_io_desc piod;
99 	int s, error, write, tmp;
100 
101 	/* "A foolish consistency..." XXX */
102 	if (SCARG(uap, req) == PT_TRACE_ME)
103 		t = p;
104 	else {
105 
106 		/* Find the process we're supposed to be operating on. */
107 		if ((t = pfind(SCARG(uap, pid))) == NULL)
108 			return (ESRCH);
109 	}
110 
111 	/* Can't trace a process that's currently exec'ing. */
112 	if ((t->p_flag & P_INEXEC) != 0)
113 		return EAGAIN;
114 
115 	/* Make sure we can operate on it. */
116 	switch (SCARG(uap, req)) {
117 	case  PT_TRACE_ME:
118 		/* Saying that you're being traced is always legal. */
119 		break;
120 
121 	case  PT_ATTACH:
122 		/*
123 		 * You can't attach to a process if:
124 		 *	(1) it's the process that's doing the attaching,
125 		 */
126 		if (t->p_pid == p->p_pid)
127 			return (EINVAL);
128 
129 		/*
130 		 *  (2) it's a system process
131 		 */
132 		if (t->p_flag & P_SYSTEM)
133 			return (EPERM);
134 
135 		/*
136 		 *	(3) it's already being traced, or
137 		 */
138 		if (ISSET(t->p_flag, P_TRACED))
139 			return (EBUSY);
140 
141 		/*
142 		 *	(4) it's not owned by you, or is set-id on exec
143 		 *	    (unless you're root), or...
144 		 */
145 		if ((t->p_cred->p_ruid != p->p_cred->p_ruid ||
146 			ISSET(t->p_flag, P_SUGID)) &&
147 		    (error = suser(p->p_ucred, &p->p_acflag)) != 0)
148 			return (error);
149 
150 		/*
151 		 *	(5) ...it's init, which controls the security level
152 		 *	    of the entire system, and the system was not
153 		 *	    compiled with permanently insecure mode turned on
154 		 */
155 		if (t == initproc && securelevel > -1)
156 			return (EPERM);
157 
158 		/*
159 		 * (6) the tracer is chrooted, and its root directory is
160 		 * not at or above the root directory of the tracee
161 		 */
162 
163 		if (!proc_isunder(t, p))
164 			return EPERM;
165 		break;
166 
167 	case  PT_READ_I:
168 	case  PT_READ_D:
169 	case  PT_WRITE_I:
170 	case  PT_WRITE_D:
171 	case  PT_CONTINUE:
172 	case  PT_IO:
173 	case  PT_KILL:
174 	case  PT_DETACH:
175 #ifdef PT_STEP
176 	case  PT_STEP:
177 #endif
178 #ifdef PT_GETREGS
179 	case  PT_GETREGS:
180 #endif
181 #ifdef PT_SETREGS
182 	case  PT_SETREGS:
183 #endif
184 #ifdef PT_GETFPREGS
185 	case  PT_GETFPREGS:
186 #endif
187 #ifdef PT_SETFPREGS
188 	case  PT_SETFPREGS:
189 #endif
190 
191 #ifdef __HAVE_PTRACE_MACHDEP
192 	PTRACE_MACHDEP_REQUEST_CASES
193 #endif
194 
195 		/*
196 		 * You can't do what you want to the process if:
197 		 *	(1) It's not being traced at all,
198 		 */
199 		if (!ISSET(t->p_flag, P_TRACED))
200 			return (EPERM);
201 
202 		/*
203 		 *	(2) it's being traced by procfs (which has
204 		 *	    different signal delivery semantics),
205 		 */
206 		if (ISSET(t->p_flag, P_FSTRACE))
207 			return (EBUSY);
208 
209 		/*
210 		 *	(3) it's not being traced by _you_, or
211 		 */
212 		if (t->p_pptr != p)
213 			return (EBUSY);
214 
215 		/*
216 		 *	(4) it's not currently stopped.
217 		 */
218 		if (t->p_stat != SSTOP || !ISSET(t->p_flag, P_WAITED))
219 			return (EBUSY);
220 		break;
221 
222 	default:			/* It was not a legal request. */
223 		return (EINVAL);
224 	}
225 
226 	/* Do single-step fixup if needed. */
227 	FIX_SSTEP(t);
228 
229 	/* Now do the operation. */
230 	write = 0;
231 	*retval = 0;
232 	tmp = 0;
233 
234 	switch (SCARG(uap, req)) {
235 	case  PT_TRACE_ME:
236 		/* Just set the trace flag. */
237 		SET(t->p_flag, P_TRACED);
238 		t->p_oppid = t->p_pptr->p_pid;
239 		return (0);
240 
241 	case  PT_WRITE_I:		/* XXX no separate I and D spaces */
242 	case  PT_WRITE_D:
243 		write = 1;
244 		tmp = SCARG(uap, data);
245 	case  PT_READ_I:		/* XXX no separate I and D spaces */
246 	case  PT_READ_D:
247 		/* write = 0 done above. */
248 		iov.iov_base = (caddr_t)&tmp;
249 		iov.iov_len = sizeof(tmp);
250 		uio.uio_iov = &iov;
251 		uio.uio_iovcnt = 1;
252 		uio.uio_offset = (off_t)(long)SCARG(uap, addr);
253 		uio.uio_resid = sizeof(tmp);
254 		uio.uio_segflg = UIO_SYSSPACE;
255 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
256 		uio.uio_procp = p;
257 		error = procfs_domem(p, t, NULL, &uio);
258 		if (!write)
259 			*retval = tmp;
260 		return (error);
261 
262 	case  PT_IO:
263 		error = copyin(SCARG(uap, addr), &piod, sizeof(piod));
264 		if (error)
265 			return (error);
266 		iov.iov_base = piod.piod_addr;
267 		iov.iov_len = piod.piod_len;
268 		uio.uio_iov = &iov;
269 		uio.uio_iovcnt = 1;
270 		uio.uio_offset = (off_t)(long)piod.piod_offs;
271 		uio.uio_resid = piod.piod_len;
272 		uio.uio_segflg = UIO_USERSPACE;
273 		uio.uio_procp = p;
274 		switch (piod.piod_op) {
275 		case PIOD_READ_D:
276 		case PIOD_READ_I:
277 			uio.uio_rw = UIO_READ;
278 			break;
279 		case PIOD_WRITE_D:
280 		case PIOD_WRITE_I:
281 			uio.uio_rw = UIO_WRITE;
282 			break;
283 		default:
284 			return (EINVAL);
285 		}
286 		error = procfs_domem(p, t, NULL, &uio);
287 		piod.piod_len -= uio.uio_resid;
288 		(void) copyout(&piod, SCARG(uap, addr), sizeof(piod));
289 		return (error);
290 
291 #ifdef PT_STEP
292 	case  PT_STEP:
293 		/*
294 		 * From the 4.4BSD PRM:
295 		 * "Execution continues as in request PT_CONTINUE; however
296 		 * as soon as possible after execution of at least one
297 		 * instruction, execution stops again. [ ... ]"
298 		 */
299 #endif
300 	case  PT_CONTINUE:
301 	case  PT_DETACH:
302 		/*
303 		 * From the 4.4BSD PRM:
304 		 * "The data argument is taken as a signal number and the
305 		 * child's execution continues at location addr as if it
306 		 * incurred that signal.  Normally the signal number will
307 		 * be either 0 to indicate that the signal that caused the
308 		 * stop should be ignored, or that value fetched out of
309 		 * the process's image indicating which signal caused
310 		 * the stop.  If addr is (int *)1 then execution continues
311 		 * from where it stopped."
312 		 */
313 
314 		/* Check that the data is a valid signal number or zero. */
315 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG)
316 			return (EINVAL);
317 
318 		PHOLD(t);
319 
320 #ifdef PT_STEP
321 		/*
322 		 * Arrange for a single-step, if that's requested and possible.
323 		 */
324 		error = process_sstep(t, SCARG(uap, req) == PT_STEP);
325 		if (error)
326 			goto relebad;
327 #endif
328 
329 		/* If the address parameter is not (int *)1, set the pc. */
330 		if ((int *)SCARG(uap, addr) != (int *)1)
331 			if ((error = process_set_pc(t, SCARG(uap, addr))) != 0)
332 				goto relebad;
333 
334 		PRELE(t);
335 
336 		if (SCARG(uap, req) == PT_DETACH) {
337 			/* give process back to original parent or init */
338 			if (t->p_oppid != t->p_pptr->p_pid) {
339 				struct proc *pp;
340 
341 				pp = pfind(t->p_oppid);
342 				proc_reparent(t, pp ? pp : initproc);
343 			}
344 
345 			/* not being traced any more */
346 			t->p_oppid = 0;
347 			CLR(t->p_flag, P_TRACED|P_WAITED);
348 		}
349 
350 	sendsig:
351 		/* Finally, deliver the requested signal (or none). */
352 		if (t->p_stat == SSTOP) {
353 			t->p_xstat = SCARG(uap, data);
354 			SCHED_LOCK(s);
355 			setrunnable(t);
356 			SCHED_UNLOCK(s);
357 		} else {
358 			if (SCARG(uap, data) != 0)
359 				psignal(t, SCARG(uap, data));
360 		}
361 		return (0);
362 
363 	relebad:
364 		PRELE(t);
365 		return (error);
366 
367 	case  PT_KILL:
368 		/* just send the process a KILL signal. */
369 		SCARG(uap, data) = SIGKILL;
370 		goto sendsig;	/* in PT_CONTINUE, above. */
371 
372 	case  PT_ATTACH:
373 		/*
374 		 * Go ahead and set the trace flag.
375 		 * Save the old parent (it's reset in
376 		 *   _DETACH, and also in kern_exit.c:wait4()
377 		 * Reparent the process so that the tracing
378 		 *   proc gets to see all the action.
379 		 * Stop the target.
380 		 */
381 		SET(t->p_flag, P_TRACED);
382 		t->p_oppid = t->p_pptr->p_pid;
383 		if (t->p_pptr != p)
384 			proc_reparent(t, p);
385 		SCARG(uap, data) = SIGSTOP;
386 		goto sendsig;
387 
388 #ifdef PT_SETREGS
389 	case  PT_SETREGS:
390 		write = 1;
391 #endif
392 #ifdef PT_GETREGS
393 	case  PT_GETREGS:
394 		/* write = 0 done above. */
395 #endif
396 #if defined(PT_SETREGS) || defined(PT_GETREGS)
397 		if (!procfs_validregs(t, NULL))
398 			return (EINVAL);
399 		else {
400 			iov.iov_base = SCARG(uap, addr);
401 			iov.iov_len = sizeof(struct reg);
402 			uio.uio_iov = &iov;
403 			uio.uio_iovcnt = 1;
404 			uio.uio_offset = 0;
405 			uio.uio_resid = sizeof(struct reg);
406 			uio.uio_segflg = UIO_USERSPACE;
407 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
408 			uio.uio_procp = p;
409 			return (procfs_doregs(p, t, NULL, &uio));
410 		}
411 #endif
412 
413 #ifdef PT_SETFPREGS
414 	case  PT_SETFPREGS:
415 		write = 1;
416 #endif
417 #ifdef PT_GETFPREGS
418 	case  PT_GETFPREGS:
419 		/* write = 0 done above. */
420 #endif
421 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
422 		if (!procfs_validfpregs(t, NULL))
423 			return (EINVAL);
424 		else {
425 			iov.iov_base = SCARG(uap, addr);
426 			iov.iov_len = sizeof(struct fpreg);
427 			uio.uio_iov = &iov;
428 			uio.uio_iovcnt = 1;
429 			uio.uio_offset = 0;
430 			uio.uio_resid = sizeof(struct fpreg);
431 			uio.uio_segflg = UIO_USERSPACE;
432 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
433 			uio.uio_procp = p;
434 			return (procfs_dofpregs(p, t, NULL, &uio));
435 		}
436 #endif
437 
438 #ifdef __HAVE_PTRACE_MACHDEP
439 	PTRACE_MACHDEP_REQUEST_CASES
440 		return (ptrace_machdep_dorequest(p, t,
441 		    SCARG(uap, req), SCARG(uap, addr),
442 		    SCARG(uap, data)));
443 #endif
444 	}
445 
446 #ifdef DIAGNOSTIC
447 	panic("ptrace: impossible");
448 #endif
449 	return 0;
450 }
451