1 /*- 2 * Copyright (c) 1989, 1992 The Regents of the University of California. 3 * All rights reserved. 4 * 5 * This code is derived from software developed by the Computer Systems 6 * Engineering group at Lawrence Berkeley Laboratory under DARPA contract 7 * BG 91-66 and contributed to Berkeley. 8 * 9 * %sccs.include.redist.c% 10 */ 11 12 #if defined(LIBC_SCCS) && !defined(lint) 13 static char sccsid[] = "@(#)kvm_proc.c 5.27 (Berkeley) 05/28/92"; 14 #endif /* LIBC_SCCS and not lint */ 15 16 /* 17 * Proc traversal interface for kvm. ps and w are (probably) the exclusive 18 * users of this code, so we've factored it out into a separate module. 19 * Thus, we keep this grunge out of the other kvm applications (i.e., 20 * most other applications are interested only in open/close/read/nlist). 21 */ 22 23 #include <sys/param.h> 24 #include <sys/user.h> 25 #include <sys/proc.h> 26 #include <sys/exec.h> 27 #include <sys/stat.h> 28 #include <sys/ioctl.h> 29 #include <sys/tty.h> 30 #include <unistd.h> 31 #include <nlist.h> 32 #include <kvm.h> 33 34 #include <vm/vm.h> 35 #include <vm/vm_param.h> 36 #include <vm/swap_pager.h> 37 38 #include <sys/kinfo.h> 39 #include <sys/kinfo_proc.h> 40 41 #include <limits.h> 42 #include <db.h> 43 #include <paths.h> 44 45 #include "kvm_private.h" 46 47 static char * 48 kvm_readswap(kd, p, va, cnt) 49 kvm_t *kd; 50 const struct proc *p; 51 u_long va; 52 u_long *cnt; 53 { 54 register int ix; 55 register u_long addr, head; 56 register u_long offset, pagestart, sbstart, pgoff; 57 register off_t seekpoint; 58 struct vm_map_entry vme; 59 struct vm_object vmo; 60 struct pager_struct pager; 61 struct swpager swap; 62 struct swblock swb; 63 static char page[NBPG]; 64 65 head = (u_long)&p->p_vmspace->vm_map.header; 66 /* 67 * Look through the address map for the memory object 68 * that corresponds to the given virtual address. 69 * The header just has the entire valid range. 70 */ 71 addr = head; 72 while (1) { 73 if (kvm_read(kd, addr, (char *)&vme, sizeof(vme)) != 74 sizeof(vme)) 75 return (0); 76 77 if (va >= vme.start && va <= vme.end && 78 vme.object.vm_object != 0) 79 break; 80 81 addr = (u_long)vme.next; 82 if (addr == 0 || addr == head) 83 return (0); 84 } 85 /* 86 * We found the right object -- follow shadow links. 87 */ 88 offset = va - vme.start + vme.offset; 89 addr = (u_long)vme.object.vm_object; 90 while (1) { 91 if (kvm_read(kd, addr, (char *)&vmo, sizeof(vmo)) != 92 sizeof(vmo)) 93 return (0); 94 addr = (u_long)vmo.shadow; 95 if (addr == 0) 96 break; 97 offset += vmo.shadow_offset; 98 } 99 if (vmo.pager == 0) 100 return (0); 101 102 offset += vmo.paging_offset; 103 /* 104 * Read in the pager info and make sure it's a swap device. 105 */ 106 addr = (u_long)vmo.pager; 107 if (kvm_read(kd, addr, (char *)&pager, sizeof(pager)) != sizeof(pager) 108 || pager.pg_type != PG_SWAP) 109 return (0); 110 111 /* 112 * Read in the swap_pager private data, and compute the 113 * swap offset. 114 */ 115 addr = (u_long)pager.pg_data; 116 if (kvm_read(kd, addr, (char *)&swap, sizeof(swap)) != sizeof(swap)) 117 return (0); 118 ix = offset / dbtob(swap.sw_bsize); 119 if (swap.sw_blocks == 0 || ix >= swap.sw_nblocks) 120 return (0); 121 122 addr = (u_long)&swap.sw_blocks[ix]; 123 if (kvm_read(kd, addr, (char *)&swb, sizeof(swb)) != sizeof(swb)) 124 return (0); 125 126 sbstart = (offset / dbtob(swap.sw_bsize)) * dbtob(swap.sw_bsize); 127 sbstart /= NBPG; 128 pagestart = offset / NBPG; 129 pgoff = pagestart - sbstart; 130 131 if (swb.swb_block == 0 || (swb.swb_mask & (1 << pgoff)) == 0) 132 return (0); 133 134 seekpoint = dbtob(swb.swb_block) + ctob(pgoff); 135 errno = 0; 136 if (lseek(kd->swfd, seekpoint, 0) == -1 && errno != 0) 137 return (0); 138 if (read(kd->swfd, page, sizeof(page)) != sizeof(page)) 139 return (0); 140 141 offset %= NBPG; 142 *cnt = NBPG - offset; 143 return (&page[offset]); 144 } 145 146 #define KREAD(kd, addr, obj) \ 147 (kvm_read(kd, addr, (char *)(obj), sizeof(*obj)) != sizeof(*obj)) 148 149 /* 150 * Read proc's from memory file into buffer bp, which has space to hold 151 * at most maxcnt procs. 152 */ 153 static int 154 kvm_proclist(kd, what, arg, p, bp, maxcnt) 155 kvm_t *kd; 156 int what, arg; 157 struct proc *p; 158 struct kinfo_proc *bp; 159 int maxcnt; 160 { 161 register int cnt = 0; 162 struct eproc eproc; 163 struct pgrp pgrp; 164 struct session sess; 165 struct tty tty; 166 struct proc proc; 167 168 for (; cnt < maxcnt && p != 0; p = proc.p_nxt) { 169 if (KREAD(kd, (u_long)p, &proc)) { 170 _kvm_err(kd, kd->program, "can't read proc at %x", p); 171 return (-1); 172 } 173 if (KREAD(kd, (u_long)proc.p_cred, &eproc.e_pcred) == 0) 174 KREAD(kd, (u_long)eproc.e_pcred.pc_ucred, 175 &eproc.e_ucred); 176 177 switch(ki_op(what)) { 178 179 case KINFO_PROC_PID: 180 if (proc.p_pid != (pid_t)arg) 181 continue; 182 break; 183 184 case KINFO_PROC_UID: 185 if (eproc.e_ucred.cr_uid != (uid_t)arg) 186 continue; 187 break; 188 189 case KINFO_PROC_RUID: 190 if (eproc.e_pcred.p_ruid != (uid_t)arg) 191 continue; 192 break; 193 } 194 /* 195 * We're going to add another proc to the set. If this 196 * will overflow the buffer, assume the reason is because 197 * nprocs (or the proc list) is corrupt and declare an error. 198 */ 199 if (cnt >= maxcnt) { 200 _kvm_err(kd, kd->program, "nprocs corrupt"); 201 return (-1); 202 } 203 /* 204 * gather eproc 205 */ 206 eproc.e_paddr = p; 207 if (KREAD(kd, (u_long)proc.p_pgrp, &pgrp)) { 208 _kvm_err(kd, kd->program, "can't read pgrp at %x", 209 proc.p_pgrp); 210 return (-1); 211 } 212 eproc.e_sess = pgrp.pg_session; 213 eproc.e_pgid = pgrp.pg_id; 214 eproc.e_jobc = pgrp.pg_jobc; 215 if (KREAD(kd, (u_long)pgrp.pg_session, &sess)) { 216 _kvm_err(kd, kd->program, "can't read session at %x", 217 pgrp.pg_session); 218 return (-1); 219 } 220 if ((proc.p_flag & SCTTY) && sess.s_ttyp != NULL) { 221 if (KREAD(kd, (u_long)sess.s_ttyp, &tty)) { 222 _kvm_err(kd, kd->program, 223 "can't read tty at %x", sess.s_ttyp); 224 return (-1); 225 } 226 eproc.e_tdev = tty.t_dev; 227 eproc.e_tsess = tty.t_session; 228 if (tty.t_pgrp != NULL) { 229 if (KREAD(kd, (u_long)tty.t_pgrp, &pgrp)) { 230 _kvm_err(kd, kd->program, 231 "can't read tpgrp at &x", 232 tty.t_pgrp); 233 return (-1); 234 } 235 eproc.e_tpgid = pgrp.pg_id; 236 } else 237 eproc.e_tpgid = -1; 238 } else 239 eproc.e_tdev = NODEV; 240 eproc.e_flag = sess.s_ttyvp ? EPROC_CTTY : 0; 241 if (sess.s_leader == p) 242 eproc.e_flag |= EPROC_SLEADER; 243 if (proc.p_wmesg) 244 (void)kvm_read(kd, (u_long)proc.p_wmesg, 245 eproc.e_wmesg, WMESGLEN); 246 247 #ifdef sparc 248 (void)kvm_read(kd, (u_long)&proc.p_vmspace->vm_rssize, 249 (char *)&eproc.e_vm.vm_rssize, 250 sizeof(eproc.e_vm.vm_rssize)); 251 (void)kvm_read(kd, (u_long)&proc.p_vmspace->vm_tsize, 252 (char *)&eproc.e_vm.vm_tsize, 253 3 * sizeof(eproc.e_vm.vm_rssize)); /* XXX */ 254 #else 255 (void)kvm_read(kd, (u_long)proc.p_vmspace, 256 (char *)&eproc.e_vm, sizeof(eproc.e_vm)); 257 #endif 258 eproc.e_xsize = eproc.e_xrssize = 0; 259 eproc.e_xccount = eproc.e_xswrss = 0; 260 261 switch (ki_op(what)) { 262 263 case KINFO_PROC_PGRP: 264 if (eproc.e_pgid != (pid_t)arg) 265 continue; 266 break; 267 268 case KINFO_PROC_TTY: 269 if ((proc.p_flag&SCTTY) == 0 || 270 eproc.e_tdev != (dev_t)arg) 271 continue; 272 break; 273 } 274 bcopy((char *)&proc, (char *)&bp->kp_proc, sizeof(proc)); 275 bcopy((char *)&eproc, (char *)&bp->kp_eproc, sizeof(eproc)); 276 ++bp; 277 ++cnt; 278 } 279 return (cnt); 280 } 281 282 /* 283 * Build proc info array by reading in proc list from a crash dump. 284 * Return number of procs read. maxcnt is the max we will read. 285 */ 286 static int 287 kvm_deadprocs(kd, what, arg, a_allproc, a_zombproc, maxcnt) 288 kvm_t *kd; 289 int what, arg; 290 u_long a_allproc; 291 u_long a_zombproc; 292 int maxcnt; 293 { 294 register struct kinfo_proc *bp = kd->procbase; 295 register int acnt, zcnt; 296 struct proc *p; 297 298 if (KREAD(kd, a_allproc, &p)) { 299 _kvm_err(kd, kd->program, "cannot read allproc"); 300 return (-1); 301 } 302 acnt = kvm_proclist(kd, what, arg, p, bp, maxcnt); 303 if (acnt < 0) 304 return (acnt); 305 306 if (KREAD(kd, a_zombproc, &p)) { 307 _kvm_err(kd, kd->program, "cannot read zombproc"); 308 return (-1); 309 } 310 zcnt = kvm_proclist(kd, what, arg, p, bp + acnt, maxcnt - acnt); 311 if (zcnt < 0) 312 zcnt = 0; 313 314 return (acnt + zcnt); 315 } 316 317 struct kinfo_proc * 318 kvm_getprocs(kd, op, arg, cnt) 319 kvm_t *kd; 320 int op, arg; 321 int *cnt; 322 { 323 int size, st, nprocs; 324 325 if (kd->procbase != 0) { 326 free((void *)kd->procbase); 327 /* 328 * Clear this pointer in case this call fails. Otherwise, 329 * kvm_close() will free it again. 330 */ 331 kd->procbase = 0; 332 } 333 if (ISALIVE(kd)) { 334 size = 0; 335 st = getkerninfo(op, NULL, &size, arg); 336 if (st < 0) { 337 _kvm_syserr(kd, kd->program, "kvm_getprocs"); 338 return (0); 339 } 340 kd->procbase = (struct kinfo_proc *)_kvm_malloc(kd, st); 341 if (kd->procbase == 0) 342 return (0); 343 size = st; 344 st = getkerninfo(op, kd->procbase, &size, arg); 345 if (st < 0) { 346 _kvm_syserr(kd, kd->program, "kvm_getprocs"); 347 return (0); 348 } 349 if (size % sizeof(struct kinfo_proc) != 0) { 350 _kvm_err(kd, kd->program, 351 "proc size mismatch (%d total, %d chunks)", 352 size, sizeof(struct kinfo_proc)); 353 return (0); 354 } 355 nprocs = size / sizeof(struct kinfo_proc); 356 } else { 357 struct nlist nl[4], *p; 358 359 nl[0].n_name = "_nprocs"; 360 nl[1].n_name = "_allproc"; 361 nl[2].n_name = "_zombproc"; 362 nl[3].n_name = 0; 363 364 if (kvm_nlist(kd, nl) != 0) { 365 for (p = nl; p->n_type != 0; ++p) 366 ; 367 _kvm_err(kd, kd->program, 368 "%s: no such symbol", p->n_name); 369 return (0); 370 } 371 if (KREAD(kd, nl[0].n_value, &nprocs)) { 372 _kvm_err(kd, kd->program, "can't read nprocs"); 373 return (0); 374 } 375 size = nprocs * sizeof(struct kinfo_proc); 376 kd->procbase = (struct kinfo_proc *)_kvm_malloc(kd, size); 377 if (kd->procbase == 0) 378 return (0); 379 380 nprocs = kvm_deadprocs(kd, op, arg, nl[1].n_value, 381 nl[2].n_value, nprocs); 382 #ifdef notdef 383 size = nprocs * sizeof(struct kinfo_proc); 384 (void)realloc(kd->procbase, size); 385 #endif 386 } 387 *cnt = nprocs; 388 return (kd->procbase); 389 } 390 391 void 392 _kvm_freeprocs(kd) 393 kvm_t *kd; 394 { 395 if (kd->procbase) { 396 free(kd->procbase); 397 kd->procbase = 0; 398 } 399 } 400 401 void * 402 _kvm_realloc(kd, p, n) 403 kvm_t *kd; 404 void *p; 405 size_t n; 406 { 407 void *np = (void *)realloc(p, n); 408 409 if (np == 0) 410 _kvm_err(kd, kd->program, "out of memory"); 411 return (np); 412 } 413 414 #ifndef MAX 415 #define MAX(a, b) ((a) > (b) ? (a) : (b)) 416 #endif 417 418 /* 419 * Read in an argument vector from the user address space of process p. 420 * addr if the user-space base address of narg null-terminated contiguous 421 * strings. This is used to read in both the command arguments and 422 * environment strings. Read at most maxcnt characters of strings. 423 */ 424 static char ** 425 kvm_argv(kd, p, addr, narg, maxcnt) 426 kvm_t *kd; 427 struct proc *p; 428 register u_long addr; 429 register int narg; 430 register int maxcnt; 431 { 432 register char *cp; 433 register int len, cc; 434 register char **argv; 435 436 /* 437 * Check that there aren't an unreasonable number of agruments, 438 * and that the address is in user space. 439 */ 440 if (narg > 512 || addr < VM_MIN_ADDRESS || addr >= VM_MAXUSER_ADDRESS) 441 return (0); 442 443 if (kd->argv == 0) { 444 /* 445 * Try to avoid reallocs. 446 */ 447 kd->argc = MAX(narg + 1, 32); 448 kd->argv = (char **)_kvm_malloc(kd, kd->argc * 449 sizeof(*kd->argv)); 450 if (kd->argv == 0) 451 return (0); 452 } else if (narg + 1 > kd->argc) { 453 kd->argc = MAX(2 * kd->argc, narg + 1); 454 kd->argv = (char **)_kvm_realloc(kd, kd->argv, kd->argc * 455 sizeof(*kd->argv)); 456 if (kd->argv == 0) 457 return (0); 458 } 459 if (kd->argspc == 0) { 460 kd->argspc = (char *)_kvm_malloc(kd, NBPG); 461 if (kd->argspc == 0) 462 return (0); 463 kd->arglen = NBPG; 464 } 465 cp = kd->argspc; 466 argv = kd->argv; 467 *argv = cp; 468 len = 0; 469 /* 470 * Loop over pages, filling in the argument vector. 471 */ 472 while (addr < VM_MAXUSER_ADDRESS) { 473 cc = NBPG - (addr & PGOFSET); 474 if (maxcnt > 0 && cc > maxcnt - len) 475 cc = maxcnt - len;; 476 if (len + cc > kd->arglen) { 477 register int off; 478 register char **pp; 479 register char *op = kd->argspc; 480 481 kd->arglen *= 2; 482 kd->argspc = (char *)_kvm_realloc(kd, kd->argspc, 483 kd->arglen); 484 if (kd->argspc == 0) 485 return (0); 486 cp = &kd->argspc[len]; 487 /* 488 * Adjust argv pointers in case realloc moved 489 * the string space. 490 */ 491 off = kd->argspc - op; 492 for (pp = kd->argv; pp < argv; ++pp) 493 *pp += off; 494 } 495 if (kvm_uread(kd, p, addr, cp, cc) != cc) 496 /* XXX */ 497 return (0); 498 len += cc; 499 addr += cc; 500 501 if (maxcnt == 0 && len > 16 * NBPG) 502 /* sanity */ 503 return (0); 504 505 while (--cc >= 0) { 506 if (*cp++ == 0) { 507 if (--narg <= 0) { 508 *++argv = 0; 509 return (kd->argv); 510 } else 511 *++argv = cp; 512 } 513 } 514 if (maxcnt > 0 && len >= maxcnt) { 515 /* 516 * We're stopping prematurely. Terminate the 517 * argv and current string. 518 */ 519 *++argv = 0; 520 *cp = 0; 521 return (kd->argv); 522 } 523 } 524 } 525 526 static void 527 ps_str_a(p, addr, n) 528 struct ps_strings *p; 529 u_long *addr; 530 int *n; 531 { 532 *addr = (u_long)p->ps_argvstr; 533 *n = p->ps_nargvstr; 534 } 535 536 static void 537 ps_str_e(p, addr, n) 538 struct ps_strings *p; 539 u_long *addr; 540 int *n; 541 { 542 *addr = (u_long)p->ps_envstr; 543 *n = p->ps_nenvstr; 544 } 545 546 /* 547 * Determine if the proc indicated by p is still active. 548 * This test is not 100% foolproof in theory, but chances of 549 * being wrong are very low. 550 */ 551 static int 552 proc_verify(kd, kernp, p) 553 kvm_t *kd; 554 u_long kernp; 555 const struct proc *p; 556 { 557 struct proc kernproc; 558 559 /* 560 * Just read in the whole proc. It's not that big relative 561 * to the cost of the read system call. 562 */ 563 if (kvm_read(kd, kernp, (char *)&kernproc, sizeof(kernproc)) != 564 sizeof(kernproc)) 565 return (0); 566 return (p->p_pid == kernproc.p_pid && 567 (kernproc.p_stat != SZOMB || p->p_stat == SZOMB)); 568 } 569 570 static char ** 571 kvm_doargv(kd, kp, nchr, info) 572 kvm_t *kd; 573 const struct kinfo_proc *kp; 574 int nchr; 575 int (*info)(struct ps_strings*, u_long *, int *); 576 { 577 register const struct proc *p = &kp->kp_proc; 578 register char **ap; 579 u_long addr; 580 int cnt; 581 struct ps_strings arginfo; 582 583 /* 584 * Pointers are stored at the top of the user stack. 585 */ 586 if (p->p_stat == SZOMB || 587 kvm_uread(kd, p, USRSTACK - sizeof(arginfo), (char *)&arginfo, 588 sizeof(arginfo)) != sizeof(arginfo)) 589 return (0); 590 591 (*info)(&arginfo, &addr, &cnt); 592 ap = kvm_argv(kd, p, addr, cnt, nchr); 593 /* 594 * For live kernels, make sure this process didn't go away. 595 */ 596 if (ap != 0 && ISALIVE(kd) && 597 !proc_verify(kd, (u_long)kp->kp_eproc.e_paddr, p)) 598 ap = 0; 599 return (ap); 600 } 601 602 /* 603 * Get the command args. This code is now machine independent. 604 */ 605 char ** 606 kvm_getargv(kd, kp, nchr) 607 kvm_t *kd; 608 const struct kinfo_proc *kp; 609 int nchr; 610 { 611 return (kvm_doargv(kd, kp, nchr, ps_str_a)); 612 } 613 614 char ** 615 kvm_getenvv(kd, kp, nchr) 616 kvm_t *kd; 617 const struct kinfo_proc *kp; 618 int nchr; 619 { 620 return (kvm_doargv(kd, kp, nchr, ps_str_e)); 621 } 622 623 /* 624 * Read from user space. The user context is given by p. 625 */ 626 ssize_t 627 kvm_uread(kd, p, uva, buf, len) 628 kvm_t *kd; 629 register struct proc *p; 630 register u_long uva; 631 register char *buf; 632 register size_t len; 633 { 634 register char *cp; 635 636 cp = buf; 637 while (len > 0) { 638 u_long pa; 639 register int cc; 640 641 cc = _kvm_uvatop(kd, p, uva, &pa); 642 if (cc > 0) { 643 if (cc > len) 644 cc = len; 645 errno = 0; 646 if (lseek(kd->pmfd, (off_t)pa, 0) == -1 && errno != 0) { 647 _kvm_err(kd, 0, "invalid address (%x)", uva); 648 break; 649 } 650 cc = read(kd->pmfd, cp, cc); 651 if (cc < 0) { 652 _kvm_syserr(kd, 0, _PATH_MEM); 653 break; 654 } else if (cc < len) { 655 _kvm_err(kd, kd->program, "short read"); 656 break; 657 } 658 } else if (ISALIVE(kd)) { 659 /* try swap */ 660 register char *dp; 661 int cnt; 662 663 dp = kvm_readswap(kd, p, uva, &cnt); 664 if (dp == 0) { 665 _kvm_err(kd, 0, "invalid address (%x)", uva); 666 return (0); 667 } 668 cc = MIN(cnt, len); 669 bcopy(dp, cp, cc); 670 } else 671 break; 672 cp += cc; 673 uva += cc; 674 len -= cc; 675 } 676 return (ssize_t)(cp - buf); 677 } 678