1 /* $NetBSD: kern_ktrace.c,v 1.55 2001/11/12 15:25:10 lukem Exp $ */ 2 3 /* 4 * Copyright (c) 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. All advertising materials mentioning features or use of this software 16 * must display the following acknowledgement: 17 * This product includes software developed by the University of 18 * California, Berkeley and its contributors. 19 * 4. Neither the name of the University nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * @(#)kern_ktrace.c 8.5 (Berkeley) 5/14/95 36 */ 37 38 #include <sys/cdefs.h> 39 __KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.55 2001/11/12 15:25:10 lukem Exp $"); 40 41 #include "opt_ktrace.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/proc.h> 46 #include <sys/file.h> 47 #include <sys/namei.h> 48 #include <sys/vnode.h> 49 #include <sys/ktrace.h> 50 #include <sys/malloc.h> 51 #include <sys/syslog.h> 52 #include <sys/filedesc.h> 53 #include <sys/ioctl.h> 54 55 #include <sys/mount.h> 56 #include <sys/syscallargs.h> 57 58 #ifdef KTRACE 59 60 int ktrace_common(struct proc *, int, int, int, struct file *); 61 void ktrinitheader(struct ktr_header *, struct proc *, int); 62 int ktrops(struct proc *, struct proc *, int, int, struct file *); 63 int ktrsetchildren(struct proc *, struct proc *, int, int, 64 struct file *); 65 int ktrwrite(struct proc *, struct ktr_header *); 66 int ktrcanset(struct proc *, struct proc *); 67 int ktrsamefile(struct file *, struct file *); 68 69 /* 70 * "deep" compare of two files for the purposes of clearing a trace. 71 * Returns true if they're the same open file, or if they point at the 72 * same underlying vnode/socket. 73 */ 74 75 int 76 ktrsamefile(struct file *f1, struct file *f2) 77 { 78 return ((f1 == f2) || 79 ((f1 != NULL) && (f2 != NULL) && 80 (f1->f_type == f2->f_type) && 81 (f1->f_data == f2->f_data))); 82 } 83 84 void 85 ktrderef(struct proc *p) 86 { 87 struct file *fp = p->p_tracep; 88 p->p_traceflag = 0; 89 if (fp == NULL) 90 return; 91 FILE_USE(fp); 92 closef(fp, NULL); 93 94 p->p_tracep = NULL; 95 } 96 97 void 98 ktradref(struct proc *p) 99 { 100 struct file *fp = p->p_tracep; 101 102 fp->f_count++; 103 } 104 105 void 106 ktrinitheader(struct ktr_header *kth, struct proc *p, int type) 107 { 108 109 memset(kth, 0, sizeof(*kth)); 110 kth->ktr_type = type; 111 microtime(&kth->ktr_time); 112 kth->ktr_pid = p->p_pid; 113 memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN); 114 } 115 116 void 117 ktrsyscall(struct proc *p, register_t code, size_t argsize, register_t args[]) 118 { 119 struct ktr_header kth; 120 struct ktr_syscall *ktp; 121 register_t *argp; 122 size_t len = sizeof(struct ktr_syscall) + argsize; 123 int i; 124 125 p->p_traceflag |= KTRFAC_ACTIVE; 126 ktrinitheader(&kth, p, KTR_SYSCALL); 127 ktp = malloc(len, M_TEMP, M_WAITOK); 128 ktp->ktr_code = code; 129 ktp->ktr_argsize = argsize; 130 argp = (register_t *)((char *)ktp + sizeof(struct ktr_syscall)); 131 for (i = 0; i < (argsize / sizeof(*argp)); i++) 132 *argp++ = args[i]; 133 kth.ktr_buf = (caddr_t)ktp; 134 kth.ktr_len = len; 135 (void) ktrwrite(p, &kth); 136 free(ktp, M_TEMP); 137 p->p_traceflag &= ~KTRFAC_ACTIVE; 138 } 139 140 void 141 ktrsysret(struct proc *p, register_t code, int error, register_t retval) 142 { 143 struct ktr_header kth; 144 struct ktr_sysret ktp; 145 146 p->p_traceflag |= KTRFAC_ACTIVE; 147 ktrinitheader(&kth, p, KTR_SYSRET); 148 ktp.ktr_code = code; 149 ktp.ktr_eosys = 0; /* XXX unused */ 150 ktp.ktr_error = error; 151 ktp.ktr_retval = retval; /* what about val2 ? */ 152 153 kth.ktr_buf = (caddr_t)&ktp; 154 kth.ktr_len = sizeof(struct ktr_sysret); 155 156 (void) ktrwrite(p, &kth); 157 p->p_traceflag &= ~KTRFAC_ACTIVE; 158 } 159 160 void 161 ktrnamei(struct proc *p, char *path) 162 { 163 struct ktr_header kth; 164 165 p->p_traceflag |= KTRFAC_ACTIVE; 166 ktrinitheader(&kth, p, KTR_NAMEI); 167 kth.ktr_len = strlen(path); 168 kth.ktr_buf = path; 169 170 (void) ktrwrite(p, &kth); 171 p->p_traceflag &= ~KTRFAC_ACTIVE; 172 } 173 174 void 175 ktremul(struct proc *p) 176 { 177 struct ktr_header kth; 178 const char *emul = p->p_emul->e_name; 179 180 p->p_traceflag |= KTRFAC_ACTIVE; 181 ktrinitheader(&kth, p, KTR_EMUL); 182 kth.ktr_len = strlen(emul); 183 kth.ktr_buf = (caddr_t)emul; 184 185 (void) ktrwrite(p, &kth); 186 p->p_traceflag &= ~KTRFAC_ACTIVE; 187 } 188 189 void 190 ktrgenio(struct proc *p, int fd, enum uio_rw rw, struct iovec *iov, 191 int len, int error) 192 { 193 struct ktr_header kth; 194 struct ktr_genio *ktp; 195 caddr_t cp; 196 int resid = len, cnt; 197 int buflen; 198 199 if (error) 200 return; 201 202 p->p_traceflag |= KTRFAC_ACTIVE; 203 204 buflen = min(PAGE_SIZE, len + sizeof(struct ktr_genio)); 205 206 ktrinitheader(&kth, p, KTR_GENIO); 207 ktp = malloc(buflen, M_TEMP, M_WAITOK); 208 ktp->ktr_fd = fd; 209 ktp->ktr_rw = rw; 210 211 kth.ktr_buf = (caddr_t)ktp; 212 213 cp = (caddr_t)((char *)ktp + sizeof(struct ktr_genio)); 214 buflen -= sizeof(struct ktr_genio); 215 216 while (resid > 0) { 217 KDASSERT(p->p_cpu != NULL); 218 KDASSERT(p->p_cpu == curcpu()); 219 if (p->p_cpu->ci_schedstate.spc_flags & SPCF_SHOULDYIELD) 220 preempt(NULL); 221 222 cnt = min(iov->iov_len, buflen); 223 if (cnt > resid) 224 cnt = resid; 225 if (copyin(iov->iov_base, cp, cnt)) 226 break; 227 228 kth.ktr_len = cnt + sizeof(struct ktr_genio); 229 230 if (__predict_false(ktrwrite(p, &kth) != 0)) 231 break; 232 233 iov->iov_base = (caddr_t)iov->iov_base + cnt; 234 iov->iov_len -= cnt; 235 236 if (iov->iov_len == 0) 237 iov++; 238 239 resid -= cnt; 240 } 241 242 free(ktp, M_TEMP); 243 p->p_traceflag &= ~KTRFAC_ACTIVE; 244 } 245 246 void 247 ktrpsig(struct proc *p, int sig, sig_t action, sigset_t *mask, int code) 248 { 249 struct ktr_header kth; 250 struct ktr_psig kp; 251 252 p->p_traceflag |= KTRFAC_ACTIVE; 253 ktrinitheader(&kth, p, KTR_PSIG); 254 kp.signo = (char)sig; 255 kp.action = action; 256 kp.mask = *mask; 257 kp.code = code; 258 kth.ktr_buf = (caddr_t)&kp; 259 kth.ktr_len = sizeof(struct ktr_psig); 260 261 (void) ktrwrite(p, &kth); 262 p->p_traceflag &= ~KTRFAC_ACTIVE; 263 } 264 265 void 266 ktrcsw(struct proc *p, int out, int user) 267 { 268 struct ktr_header kth; 269 struct ktr_csw kc; 270 271 p->p_traceflag |= KTRFAC_ACTIVE; 272 ktrinitheader(&kth, p, KTR_CSW); 273 kc.out = out; 274 kc.user = user; 275 kth.ktr_buf = (caddr_t)&kc; 276 kth.ktr_len = sizeof(struct ktr_csw); 277 278 (void) ktrwrite(p, &kth); 279 p->p_traceflag &= ~KTRFAC_ACTIVE; 280 } 281 282 void 283 ktruser(p, id, addr, len, ustr) 284 struct proc *p; 285 const char *id; 286 void *addr; 287 size_t len; 288 int ustr; 289 { 290 struct ktr_header kth; 291 struct ktr_user *ktp; 292 caddr_t user_dta; 293 294 p->p_traceflag |= KTRFAC_ACTIVE; 295 ktrinitheader(&kth, p, KTR_USER); 296 ktp = malloc(sizeof(struct ktr_user) + len, M_TEMP, M_WAITOK); 297 if (ustr) { 298 if (copyinstr(id, ktp->ktr_id, KTR_USER_MAXIDLEN, NULL) != 0) 299 ktp->ktr_id[0] = '\0'; 300 } else 301 strncpy(ktp->ktr_id, id, KTR_USER_MAXIDLEN); 302 ktp->ktr_id[KTR_USER_MAXIDLEN-1] = '\0'; 303 304 user_dta = (caddr_t) ((char *)ktp + sizeof(struct ktr_user)); 305 if (copyin(addr, (void *) user_dta, len) != 0) 306 len = 0; 307 308 kth.ktr_buf = (void *)ktp; 309 kth.ktr_len = sizeof(struct ktr_user) + len; 310 (void) ktrwrite(p, &kth); 311 312 free(ktp, M_TEMP); 313 p->p_traceflag &= ~KTRFAC_ACTIVE; 314 315 } 316 317 /* Interface and common routines */ 318 319 int 320 ktrace_common(struct proc *curp, int ops, int facs, int pid, struct file *fp) 321 { 322 int ret = 0; 323 int error = 0; 324 int one = 1; 325 int descend; 326 struct proc *p; 327 struct pgrp *pg; 328 329 curp->p_traceflag |= KTRFAC_ACTIVE; 330 descend = ops & KTRFLAG_DESCEND; 331 facs = facs & ~((unsigned) KTRFAC_ROOT); 332 333 /* 334 * Clear all uses of the tracefile 335 */ 336 if (KTROP(ops) == KTROP_CLEARFILE) { 337 proclist_lock_read(); 338 for (p = LIST_FIRST(&allproc); p != NULL; 339 p = LIST_NEXT(p, p_list)) { 340 if (ktrsamefile(p->p_tracep, fp)) { 341 if (ktrcanset(curp, p)) 342 ktrderef(p); 343 else 344 error = EPERM; 345 } 346 } 347 proclist_unlock_read(); 348 goto done; 349 } 350 351 /* 352 * Mark fp non-blocking, to avoid problems from possible deadlocks. 353 */ 354 355 if (fp != NULL) { 356 fp->f_flag |= FNONBLOCK; 357 (*fp->f_ops->fo_ioctl)(fp, FIONBIO, (caddr_t)&one, curp); 358 } 359 360 /* 361 * need something to (un)trace (XXX - why is this here?) 362 */ 363 if (!facs) { 364 error = EINVAL; 365 goto done; 366 } 367 /* 368 * do it 369 */ 370 if (pid < 0) { 371 /* 372 * by process group 373 */ 374 pg = pgfind(-pid); 375 if (pg == NULL) { 376 error = ESRCH; 377 goto done; 378 } 379 for (p = LIST_FIRST(&pg->pg_members); p != NULL; 380 p = LIST_NEXT(p, p_pglist)) { 381 if (descend) 382 ret |= ktrsetchildren(curp, p, ops, facs, fp); 383 else 384 ret |= ktrops(curp, p, ops, facs, fp); 385 } 386 387 } else { 388 /* 389 * by pid 390 */ 391 p = pfind(pid); 392 if (p == NULL) { 393 error = ESRCH; 394 goto done; 395 } 396 if (descend) 397 ret |= ktrsetchildren(curp, p, ops, facs, fp); 398 else 399 ret |= ktrops(curp, p, ops, facs, fp); 400 } 401 if (!ret) 402 error = EPERM; 403 done: 404 curp->p_traceflag &= ~KTRFAC_ACTIVE; 405 return (error); 406 } 407 408 /* 409 * ktrace system call 410 */ 411 /* ARGSUSED */ 412 int 413 sys_fktrace(struct proc *curp, void *v, register_t *retval) 414 { 415 struct sys_fktrace_args /* { 416 syscallarg(int) fd; 417 syscallarg(int) ops; 418 syscallarg(int) facs; 419 syscallarg(int) pid; 420 } */ *uap = v; 421 struct file *fp = NULL; 422 struct filedesc *fdp = curp->p_fd; 423 424 if ((fp = fd_getfile(fdp, SCARG(uap, fd))) == NULL) 425 return (EBADF); 426 427 if ((fp->f_flag & FWRITE) == 0) 428 return (EBADF); 429 430 return ktrace_common(curp, SCARG(uap, ops), 431 SCARG(uap, facs), SCARG(uap, pid), fp); 432 } 433 434 /* 435 * ktrace system call 436 */ 437 /* ARGSUSED */ 438 int 439 sys_ktrace(struct proc *curp, void *v, register_t *retval) 440 { 441 struct sys_ktrace_args /* { 442 syscallarg(const char *) fname; 443 syscallarg(int) ops; 444 syscallarg(int) facs; 445 syscallarg(int) pid; 446 } */ *uap = v; 447 struct vnode *vp = NULL; 448 struct file *fp = NULL; 449 int fd; 450 int ops = SCARG(uap, ops); 451 int error = 0; 452 struct nameidata nd; 453 454 ops = KTROP(ops) | (ops & KTRFLAG_DESCEND); 455 456 curp->p_traceflag |= KTRFAC_ACTIVE; 457 if (ops != KTROP_CLEAR) { 458 /* 459 * an operation which requires a file argument. 460 */ 461 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname), 462 curp); 463 if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) { 464 curp->p_traceflag &= ~KTRFAC_ACTIVE; 465 return (error); 466 } 467 vp = nd.ni_vp; 468 VOP_UNLOCK(vp, 0); 469 if (vp->v_type != VREG) { 470 (void) vn_close(vp, FREAD|FWRITE, curp->p_ucred, curp); 471 curp->p_traceflag &= ~KTRFAC_ACTIVE; 472 return (EACCES); 473 } 474 /* 475 * XXX This uses up a file descriptor slot in the 476 * tracing process for the duration of this syscall. 477 * This is not expected to be a problem. If 478 * falloc(NULL, ...) DTRT we could skip that part, but 479 * that would require changing its interface to allow 480 * the caller to pass in a ucred.. 481 * 482 * This will FILE_USE the fp it returns, if any. 483 * Keep it in use until we return. 484 */ 485 if ((error = falloc(curp, &fp, &fd)) != 0) 486 goto done; 487 488 fp->f_flag = FWRITE|FAPPEND; 489 fp->f_type = DTYPE_VNODE; 490 fp->f_ops = &vnops; 491 fp->f_data = (caddr_t)vp; 492 FILE_SET_MATURE(fp); 493 vp = NULL; 494 } 495 error = ktrace_common(curp, SCARG(uap, ops), SCARG(uap, facs), 496 SCARG(uap, pid), fp); 497 done: 498 if (vp != NULL) 499 (void) vn_close(vp, FWRITE, curp->p_ucred, curp); 500 if (fp != NULL) { 501 FILE_UNUSE(fp, curp); /* release file */ 502 fdrelease(curp, fd); /* release fd table slot */ 503 } 504 return (error); 505 } 506 507 int 508 ktrops(struct proc *curp, struct proc *p, int ops, int facs, struct file *fp) 509 { 510 511 if (!ktrcanset(curp, p)) 512 return (0); 513 if (KTROP(ops) == KTROP_SET) { 514 if (p->p_tracep != fp) { 515 /* 516 * if trace file already in use, relinquish 517 */ 518 ktrderef(p); 519 p->p_tracep = fp; 520 ktradref(p); 521 } 522 p->p_traceflag |= facs; 523 if (curp->p_ucred->cr_uid == 0) 524 p->p_traceflag |= KTRFAC_ROOT; 525 } else { 526 /* KTROP_CLEAR */ 527 if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) { 528 /* no more tracing */ 529 ktrderef(p); 530 } 531 } 532 533 /* 534 * Emit an emulation record, every time there is a ktrace 535 * change/attach request. 536 */ 537 if (KTRPOINT(p, KTR_EMUL)) 538 ktremul(p); 539 #ifdef __HAVE_SYSCALL_INTERN 540 (*p->p_emul->e_syscall_intern)(p); 541 #endif 542 543 return (1); 544 } 545 546 int 547 ktrsetchildren(struct proc *curp, struct proc *top, int ops, int facs, 548 struct file *fp) 549 { 550 struct proc *p; 551 int ret = 0; 552 553 p = top; 554 for (;;) { 555 ret |= ktrops(curp, p, ops, facs, fp); 556 /* 557 * If this process has children, descend to them next, 558 * otherwise do any siblings, and if done with this level, 559 * follow back up the tree (but not past top). 560 */ 561 if (LIST_FIRST(&p->p_children) != NULL) 562 p = LIST_FIRST(&p->p_children); 563 else for (;;) { 564 if (p == top) 565 return (ret); 566 if (LIST_NEXT(p, p_sibling) != NULL) { 567 p = LIST_NEXT(p, p_sibling); 568 break; 569 } 570 p = p->p_pptr; 571 } 572 } 573 /*NOTREACHED*/ 574 } 575 576 int 577 ktrwrite(struct proc *p, struct ktr_header *kth) 578 { 579 struct uio auio; 580 struct iovec aiov[2]; 581 int error, tries; 582 struct file *fp = p->p_tracep; 583 584 if (fp == NULL) 585 return 0; 586 587 auio.uio_iov = &aiov[0]; 588 auio.uio_offset = 0; 589 auio.uio_segflg = UIO_SYSSPACE; 590 auio.uio_rw = UIO_WRITE; 591 aiov[0].iov_base = (caddr_t)kth; 592 aiov[0].iov_len = sizeof(struct ktr_header); 593 auio.uio_resid = sizeof(struct ktr_header); 594 auio.uio_iovcnt = 1; 595 auio.uio_procp = (struct proc *)0; 596 if (kth->ktr_len > 0) { 597 auio.uio_iovcnt++; 598 aiov[1].iov_base = kth->ktr_buf; 599 aiov[1].iov_len = kth->ktr_len; 600 auio.uio_resid += kth->ktr_len; 601 } 602 603 FILE_USE(fp); 604 605 tries = 0; 606 do { 607 error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio, 608 fp->f_cred, FOF_UPDATE_OFFSET); 609 tries++; 610 if (error == EWOULDBLOCK) 611 yield(); 612 } while ((error == EWOULDBLOCK) && (tries < 3)); 613 FILE_UNUSE(fp, NULL); 614 615 if (__predict_true(error == 0)) 616 return (0); 617 /* 618 * If error encountered, give up tracing on this vnode. Don't report 619 * EPIPE as this can easily happen with fktrace()/ktruss. 620 */ 621 if (error != EPIPE) 622 log(LOG_NOTICE, 623 "ktrace write failed, errno %d, tracing stopped\n", 624 error); 625 proclist_lock_read(); 626 for (p = LIST_FIRST(&allproc); p != NULL; p = LIST_NEXT(p, p_list)) { 627 if (ktrsamefile(p->p_tracep, fp)) 628 ktrderef(p); 629 } 630 proclist_unlock_read(); 631 632 return (error); 633 } 634 635 /* 636 * Return true if caller has permission to set the ktracing state 637 * of target. Essentially, the target can't possess any 638 * more permissions than the caller. KTRFAC_ROOT signifies that 639 * root previously set the tracing status on the target process, and 640 * so, only root may further change it. 641 * 642 * TODO: check groups. use caller effective gid. 643 */ 644 int 645 ktrcanset(struct proc *callp, struct proc *targetp) 646 { 647 struct pcred *caller = callp->p_cred; 648 struct pcred *target = targetp->p_cred; 649 650 if ((caller->pc_ucred->cr_uid == target->p_ruid && 651 target->p_ruid == target->p_svuid && 652 caller->p_rgid == target->p_rgid && /* XXX */ 653 target->p_rgid == target->p_svgid && 654 (targetp->p_traceflag & KTRFAC_ROOT) == 0) || 655 caller->pc_ucred->cr_uid == 0) 656 return (1); 657 658 return (0); 659 } 660 #endif /* KTRACE */ 661 662 /* 663 * Put user defined entry to ktrace records. 664 */ 665 int 666 sys_utrace(p, v, retval) 667 struct proc *p; 668 void *v; 669 register_t *retval; 670 { 671 #ifdef KTRACE 672 struct sys_utrace_args /* { 673 syscallarg(const char *) label; 674 syscallarg(void *) addr; 675 syscallarg(size_t) len; 676 } */ *uap = v; 677 678 if (!KTRPOINT(p, KTR_USER)) 679 return (0); 680 681 if (SCARG(uap, len) > KTR_USER_MAXLEN) 682 return (EINVAL); 683 684 ktruser(p, SCARG(uap, label), SCARG(uap, addr), SCARG(uap, len), 1); 685 686 return (0); 687 #else /* !KTRACE */ 688 return ENOSYS; 689 #endif /* KTRACE */ 690 } 691