2020-07-30 21:38:15 +00:00
|
|
|
/*
|
2021-02-08 18:34:41 +00:00
|
|
|
* Copyright (c) 2020, Itamar S. <itamar8910@gmail.com>
|
|
|
|
* Copyright (c) 2020-2021, Andreas Kling <kling@serenityos.org>
|
2020-07-30 21:38:15 +00:00
|
|
|
*
|
2021-04-22 08:24:48 +00:00
|
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
2020-07-30 21:38:15 +00:00
|
|
|
*/
|
|
|
|
|
2020-09-12 03:11:07 +00:00
|
|
|
#include <AK/ScopeGuard.h>
|
2020-07-30 21:38:15 +00:00
|
|
|
#include <Kernel/Process.h>
|
2021-07-31 08:06:13 +00:00
|
|
|
#include <Kernel/ThreadTracer.h>
|
2020-07-30 21:38:15 +00:00
|
|
|
#include <Kernel/VM/MemoryManager.h>
|
|
|
|
#include <Kernel/VM/PrivateInodeVMObject.h>
|
|
|
|
#include <Kernel/VM/ProcessPagingScope.h>
|
|
|
|
#include <Kernel/VM/Region.h>
|
|
|
|
#include <Kernel/VM/SharedInodeVMObject.h>
|
|
|
|
|
|
|
|
namespace Kernel {
|
|
|
|
|
2021-02-08 18:34:41 +00:00
|
|
|
static KResultOr<u32> handle_ptrace(const Kernel::Syscall::SC_ptrace_params& params, Process& caller)
|
|
|
|
{
|
|
|
|
ScopedSpinLock scheduler_lock(g_scheduler_lock);
|
|
|
|
if (params.request == PT_TRACE_ME) {
|
|
|
|
if (Process::current()->tracer())
|
|
|
|
return EBUSY;
|
|
|
|
|
|
|
|
caller.set_wait_for_tracer_at_next_execve(true);
|
|
|
|
return KSuccess;
|
|
|
|
}
|
|
|
|
|
|
|
|
// FIXME: PID/TID BUG
|
|
|
|
// This bug allows to request PT_ATTACH (or anything else) the same process, as
|
|
|
|
// long it is not the main thread. Alternatively, if this is desired, then the
|
|
|
|
// bug is that this prevents PT_ATTACH to the main thread from another thread.
|
|
|
|
if (params.tid == caller.pid().value())
|
|
|
|
return EINVAL;
|
|
|
|
|
|
|
|
auto peer = Thread::from_tid(params.tid);
|
|
|
|
if (!peer)
|
|
|
|
return ESRCH;
|
|
|
|
|
2021-07-17 23:13:34 +00:00
|
|
|
MutexLocker ptrace_locker(peer->process().ptrace_lock());
|
2021-02-08 22:01:53 +00:00
|
|
|
|
2021-02-08 18:34:41 +00:00
|
|
|
if ((peer->process().uid() != caller.euid())
|
|
|
|
|| (peer->process().uid() != peer->process().euid())) // Disallow tracing setuid processes
|
|
|
|
return EACCES;
|
|
|
|
|
|
|
|
if (!peer->process().is_dumpable())
|
|
|
|
return EACCES;
|
|
|
|
|
|
|
|
auto& peer_process = peer->process();
|
|
|
|
if (params.request == PT_ATTACH) {
|
|
|
|
if (peer_process.tracer()) {
|
|
|
|
return EBUSY;
|
|
|
|
}
|
2021-05-13 04:44:07 +00:00
|
|
|
auto result = peer_process.start_tracing_from(caller.pid());
|
|
|
|
if (result.is_error())
|
|
|
|
return result.error();
|
2021-02-08 18:34:41 +00:00
|
|
|
ScopedSpinLock lock(peer->get_lock());
|
|
|
|
if (peer->state() != Thread::State::Stopped) {
|
|
|
|
peer->send_signal(SIGSTOP, &caller);
|
|
|
|
}
|
|
|
|
return KSuccess;
|
|
|
|
}
|
|
|
|
|
|
|
|
auto* tracer = peer_process.tracer();
|
|
|
|
|
|
|
|
if (!tracer)
|
|
|
|
return EPERM;
|
|
|
|
|
|
|
|
if (tracer->tracer_pid() != caller.pid())
|
|
|
|
return EBUSY;
|
|
|
|
|
|
|
|
if (peer->state() == Thread::State::Running)
|
|
|
|
return EBUSY;
|
|
|
|
|
|
|
|
scheduler_lock.unlock();
|
|
|
|
|
|
|
|
switch (params.request) {
|
|
|
|
case PT_CONTINUE:
|
|
|
|
peer->send_signal(SIGCONT, &caller);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PT_DETACH:
|
|
|
|
peer_process.stop_tracing();
|
|
|
|
peer->send_signal(SIGCONT, &caller);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PT_SYSCALL:
|
|
|
|
tracer->set_trace_syscalls(true);
|
|
|
|
peer->send_signal(SIGCONT, &caller);
|
|
|
|
break;
|
|
|
|
|
|
|
|
case PT_GETREGS: {
|
|
|
|
if (!tracer->has_regs())
|
|
|
|
return EINVAL;
|
|
|
|
auto* regs = reinterpret_cast<PtraceRegisters*>(params.addr);
|
|
|
|
if (!copy_to_user(regs, &tracer->regs()))
|
|
|
|
return EFAULT;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case PT_SETREGS: {
|
|
|
|
if (!tracer->has_regs())
|
|
|
|
return EINVAL;
|
|
|
|
|
|
|
|
PtraceRegisters regs {};
|
|
|
|
if (!copy_from_user(®s, (const PtraceRegisters*)params.addr))
|
|
|
|
return EFAULT;
|
|
|
|
|
|
|
|
auto& peer_saved_registers = peer->get_register_dump_from_stack();
|
|
|
|
// Verify that the saved registers are in usermode context
|
|
|
|
if ((peer_saved_registers.cs & 0x03) != 3)
|
|
|
|
return EFAULT;
|
|
|
|
|
|
|
|
tracer->set_regs(regs);
|
|
|
|
copy_ptrace_registers_into_kernel_registers(peer_saved_registers, regs);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case PT_PEEK: {
|
|
|
|
Kernel::Syscall::SC_ptrace_peek_params peek_params {};
|
|
|
|
if (!copy_from_user(&peek_params, reinterpret_cast<Kernel::Syscall::SC_ptrace_peek_params*>(params.addr)))
|
|
|
|
return EFAULT;
|
|
|
|
if (!is_user_address(VirtualAddress { peek_params.address }))
|
|
|
|
return EFAULT;
|
|
|
|
auto result = peer->process().peek_user_data(Userspace<const u32*> { (FlatPtr)peek_params.address });
|
|
|
|
if (result.is_error())
|
|
|
|
return result.error();
|
|
|
|
if (!copy_to_user(peek_params.out_data, &result.value()))
|
|
|
|
return EFAULT;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
case PT_POKE:
|
|
|
|
if (!is_user_address(VirtualAddress { params.addr }))
|
|
|
|
return EFAULT;
|
|
|
|
return peer->process().poke_user_data(Userspace<u32*> { (FlatPtr)params.addr }, params.data);
|
|
|
|
|
2021-04-15 16:34:51 +00:00
|
|
|
case PT_PEEKDEBUG: {
|
|
|
|
Kernel::Syscall::SC_ptrace_peek_params peek_params {};
|
|
|
|
if (!copy_from_user(&peek_params, reinterpret_cast<Kernel::Syscall::SC_ptrace_peek_params*>(params.addr)))
|
|
|
|
return EFAULT;
|
|
|
|
auto result = peer->peek_debug_register(reinterpret_cast<uintptr_t>(peek_params.address));
|
|
|
|
if (result.is_error())
|
|
|
|
return result.error();
|
|
|
|
if (!copy_to_user(peek_params.out_data, &result.value()))
|
|
|
|
return EFAULT;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
case PT_POKEDEBUG:
|
|
|
|
return peer->poke_debug_register(reinterpret_cast<uintptr_t>(params.addr), params.data);
|
2021-02-08 18:34:41 +00:00
|
|
|
default:
|
|
|
|
return EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return KSuccess;
|
|
|
|
}
|
|
|
|
|
2021-06-28 18:59:35 +00:00
|
|
|
KResultOr<FlatPtr> Process::sys$ptrace(Userspace<const Syscall::SC_ptrace_params*> user_params)
|
2020-07-30 21:38:15 +00:00
|
|
|
{
|
2021-07-18 18:20:12 +00:00
|
|
|
VERIFY_PROCESS_BIG_LOCK_ACQUIRED(this)
|
2021-01-11 21:30:57 +00:00
|
|
|
REQUIRE_PROMISE(ptrace);
|
2021-02-08 18:34:41 +00:00
|
|
|
Syscall::SC_ptrace_params params {};
|
2020-09-12 03:11:07 +00:00
|
|
|
if (!copy_from_user(¶ms, user_params))
|
2021-03-01 12:49:16 +00:00
|
|
|
return EFAULT;
|
2021-02-08 18:34:41 +00:00
|
|
|
auto result = handle_ptrace(params, *this);
|
2021-01-20 22:11:17 +00:00
|
|
|
return result.is_error() ? result.error().error() : result.value();
|
2020-07-30 21:38:15 +00:00
|
|
|
}
|
|
|
|
|
2020-08-08 15:32:34 +00:00
|
|
|
/**
|
|
|
|
* "Does this process have a thread that is currently being traced by the provided process?"
|
|
|
|
*/
|
2020-12-09 04:18:45 +00:00
|
|
|
bool Process::has_tracee_thread(ProcessID tracer_pid)
|
2020-07-30 21:38:15 +00:00
|
|
|
{
|
2020-12-09 04:18:45 +00:00
|
|
|
if (auto tracer = this->tracer())
|
|
|
|
return tracer->tracer_pid() == tracer_pid;
|
|
|
|
return false;
|
2020-07-30 21:38:15 +00:00
|
|
|
}
|
|
|
|
|
2020-08-01 22:25:19 +00:00
|
|
|
KResultOr<u32> Process::peek_user_data(Userspace<const u32*> address)
|
2020-07-30 21:38:15 +00:00
|
|
|
{
|
|
|
|
uint32_t result;
|
|
|
|
|
|
|
|
// This function can be called from the context of another
|
|
|
|
// process that called PT_PEEK
|
|
|
|
ProcessPagingScope scope(*this);
|
2020-09-12 03:11:07 +00:00
|
|
|
if (!copy_from_user(&result, address)) {
|
2021-01-10 15:21:56 +00:00
|
|
|
dbgln("Invalid address for peek_user_data: {}", address.ptr());
|
2021-01-20 22:11:17 +00:00
|
|
|
return EFAULT;
|
2020-09-12 03:11:07 +00:00
|
|
|
}
|
2020-07-30 21:38:15 +00:00
|
|
|
|
|
|
|
return result;
|
|
|
|
}
|
|
|
|
|
2020-08-01 22:25:19 +00:00
|
|
|
KResult Process::poke_user_data(Userspace<u32*> address, u32 data)
|
2020-07-30 21:38:15 +00:00
|
|
|
{
|
|
|
|
Range range = { VirtualAddress(address), sizeof(u32) };
|
2021-02-08 14:45:40 +00:00
|
|
|
auto* region = space().find_region_containing(range);
|
2020-12-20 17:45:08 +00:00
|
|
|
if (!region)
|
2021-01-20 22:11:17 +00:00
|
|
|
return EFAULT;
|
2021-01-09 14:42:03 +00:00
|
|
|
ProcessPagingScope scope(*this);
|
2020-07-30 21:38:15 +00:00
|
|
|
if (region->is_shared()) {
|
|
|
|
// If the region is shared, we change its vmobject to a PrivateInodeVMObject
|
2020-08-01 22:25:19 +00:00
|
|
|
// to prevent the write operation from changing any shared inode data
|
2021-02-23 19:42:32 +00:00
|
|
|
VERIFY(region->vmobject().is_shared_inode());
|
2021-07-11 15:55:29 +00:00
|
|
|
auto vmobject = PrivateInodeVMObject::try_create_with_inode(static_cast<SharedInodeVMObject&>(region->vmobject()).inode());
|
2021-05-28 10:18:07 +00:00
|
|
|
if (!vmobject)
|
|
|
|
return ENOMEM;
|
|
|
|
region->set_vmobject(vmobject.release_nonnull());
|
2020-07-30 21:38:15 +00:00
|
|
|
region->set_shared(false);
|
|
|
|
}
|
|
|
|
const bool was_writable = region->is_writable();
|
2020-09-18 07:49:51 +00:00
|
|
|
if (!was_writable) {
|
2020-07-30 21:38:15 +00:00
|
|
|
region->set_writable(true);
|
|
|
|
region->remap();
|
|
|
|
}
|
2020-09-12 03:11:07 +00:00
|
|
|
ScopeGuard rollback([&]() {
|
|
|
|
if (!was_writable) {
|
|
|
|
region->set_writable(false);
|
|
|
|
region->remap();
|
|
|
|
}
|
|
|
|
});
|
2020-07-30 21:38:15 +00:00
|
|
|
|
2020-09-12 03:11:07 +00:00
|
|
|
if (!copy_to_user(address, &data)) {
|
2021-01-09 14:42:03 +00:00
|
|
|
dbgln("poke_user_data: Bad address {:p}", address.ptr());
|
2021-01-20 22:11:17 +00:00
|
|
|
return EFAULT;
|
2020-07-30 21:38:15 +00:00
|
|
|
}
|
2020-09-12 03:11:07 +00:00
|
|
|
|
2021-01-09 14:42:03 +00:00
|
|
|
return KSuccess;
|
2020-07-30 21:38:15 +00:00
|
|
|
}
|
|
|
|
|
2021-04-15 16:34:51 +00:00
|
|
|
KResultOr<u32> Thread::peek_debug_register(u32 register_index)
|
|
|
|
{
|
|
|
|
u32 data;
|
|
|
|
switch (register_index) {
|
|
|
|
case 0:
|
|
|
|
data = m_debug_register_state.dr0;
|
|
|
|
break;
|
|
|
|
case 1:
|
|
|
|
data = m_debug_register_state.dr1;
|
|
|
|
break;
|
|
|
|
case 2:
|
|
|
|
data = m_debug_register_state.dr2;
|
|
|
|
break;
|
|
|
|
case 3:
|
|
|
|
data = m_debug_register_state.dr3;
|
|
|
|
break;
|
|
|
|
case 6:
|
|
|
|
data = m_debug_register_state.dr6;
|
|
|
|
break;
|
|
|
|
case 7:
|
|
|
|
data = m_debug_register_state.dr7;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return EINVAL;
|
|
|
|
}
|
|
|
|
return data;
|
|
|
|
}
|
|
|
|
|
|
|
|
KResult Thread::poke_debug_register(u32 register_index, u32 data)
|
|
|
|
{
|
|
|
|
switch (register_index) {
|
|
|
|
case 0:
|
|
|
|
m_debug_register_state.dr0 = data;
|
|
|
|
break;
|
|
|
|
case 1:
|
|
|
|
m_debug_register_state.dr1 = data;
|
|
|
|
break;
|
|
|
|
case 2:
|
|
|
|
m_debug_register_state.dr2 = data;
|
|
|
|
break;
|
|
|
|
case 3:
|
|
|
|
m_debug_register_state.dr3 = data;
|
|
|
|
break;
|
|
|
|
case 7:
|
|
|
|
m_debug_register_state.dr7 = data;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return EINVAL;
|
|
|
|
}
|
|
|
|
return KSuccess;
|
|
|
|
}
|
|
|
|
|
2020-07-30 21:38:15 +00:00
|
|
|
}
|