procfs_mem.c revision 37649 
1/*
2 * Copyright (c) 1993 Jan-Simon Pendry
3 * Copyright (c) 1993 Sean Eric Fagan
4 * Copyright (c) 1993
5 *	The Regents of the University of California.  All rights reserved.
6 *
7 * This code is derived from software contributed to Berkeley by
8 * Jan-Simon Pendry and Sean Eric Fagan.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 * 3. All advertising materials mentioning features or use of this software
19 *    must display the following acknowledgement:
20 *	This product includes software developed by the University of
21 *	California, Berkeley and its contributors.
22 * 4. Neither the name of the University nor the names of its contributors
23 *    may be used to endorse or promote products derived from this software
24 *    without specific prior written permission.
25 *
26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * SUCH DAMAGE.
37 *
38 *	@(#)procfs_mem.c	8.5 (Berkeley) 6/15/94
39 *
40 *	$Id: procfs_mem.c,v 1.33 1998/06/07 17:11:57 dfr Exp $
41 */
42
43/*
44 * This is a lightly hacked and merged version
45 * of sef's pread/pwrite functions
46 */
47
48#include <sys/param.h>
49#include <sys/systm.h>
50#include <sys/proc.h>
51#include <sys/vnode.h>
52#include <miscfs/procfs/procfs.h>
53#include <vm/vm.h>
54#include <vm/vm_param.h>
55#include <vm/vm_prot.h>
56#include <sys/lock.h>
57#include <vm/pmap.h>
58#include <vm/vm_map.h>
59#include <vm/vm_kern.h>
60#include <vm/vm_object.h>
61#include <vm/vm_page.h>
62#include <vm/vm_extern.h>
63#include <sys/user.h>
64#include <sys/ptrace.h>
65
66static int	procfs_rwmem __P((struct proc *curp,
67				  struct proc *p, struct uio *uio));
68
69static int
70procfs_rwmem(curp, p, uio)
71	struct proc *curp;
72	struct proc *p;
73	struct uio *uio;
74{
75	int error;
76	int writing;
77	struct vmspace *vm;
78	vm_map_t map;
79	vm_object_t object = NULL;
80	vm_offset_t pageno = 0;		/* page number */
81	vm_prot_t reqprot;
82	vm_offset_t kva;
83
84	/*
85	 * if the vmspace is in the midst of being deallocated or the
86	 * process is exiting, don't try to grab anything.  The page table
87	 * usage in that process can be messed up.
88	 */
89	vm = p->p_vmspace;
90	if ((p->p_flag & P_WEXIT) || (vm->vm_refcnt < 1))
91		return EFAULT;
92	++vm->vm_refcnt;
93	/*
94	 * The map we want...
95	 */
96	map = &vm->vm_map;
97
98	writing = uio->uio_rw == UIO_WRITE;
99	reqprot = writing ? (VM_PROT_WRITE | VM_PROT_OVERRIDE_WRITE) : VM_PROT_READ;
100
101	kva = kmem_alloc_pageable(kernel_map, PAGE_SIZE);
102
103	/*
104	 * Only map in one page at a time.  We don't have to, but it
105	 * makes things easier.  This way is trivial - right?
106	 */
107	do {
108		vm_map_t tmap;
109		vm_offset_t uva;
110		int page_offset;		/* offset into page */
111		vm_map_entry_t out_entry;
112		vm_prot_t out_prot;
113		boolean_t wired;
114		vm_pindex_t pindex;
115		u_int len;
116		vm_page_t m;
117
118		object = NULL;
119
120		uva = (vm_offset_t) uio->uio_offset;
121
122		/*
123		 * Get the page number of this segment.
124		 */
125		pageno = trunc_page(uva);
126		page_offset = uva - pageno;
127
128		/*
129		 * How many bytes to copy
130		 */
131		len = min(PAGE_SIZE - page_offset, uio->uio_resid);
132
133		if (uva >= VM_MAXUSER_ADDRESS) {
134			vm_offset_t tkva;
135
136			if (writing ||
137			    uva >= VM_MAXUSER_ADDRESS + UPAGES * PAGE_SIZE ||
138			    (ptrace_read_u_check(p,
139						 uva - (vm_offset_t) VM_MAXUSER_ADDRESS,
140						 (size_t) len) &&
141			     !procfs_kmemaccess(curp))) {
142				error = 0;
143				break;
144			}
145
146			/* we are reading the "U area", force it into core */
147			PHOLD(p);
148
149			/* sanity check */
150			if (!(p->p_flag & P_INMEM)) {
151				/* aiee! */
152				PRELE(p);
153				error = EFAULT;
154				break;
155			}
156
157			/* populate the ptrace/procfs area */
158			p->p_addr->u_kproc.kp_proc = *p;
159			fill_eproc (p, &p->p_addr->u_kproc.kp_eproc);
160
161			/* locate the in-core address */
162			tkva = (uintptr_t)p->p_addr + uva - VM_MAXUSER_ADDRESS;
163
164			/* transfer it */
165			error = uiomove((caddr_t)tkva, len, uio);
166
167			/* let the pages go */
168			PRELE(p);
169
170			continue;
171		}
172
173		/*
174		 * Fault the page on behalf of the process
175		 */
176		error = vm_fault(map, pageno, reqprot, FALSE);
177		if (error) {
178			error = EFAULT;
179			break;
180		}
181
182		/*
183		 * Now we need to get the page.  out_entry, out_prot, wired,
184		 * and single_use aren't used.  One would think the vm code
185		 * would be a *bit* nicer...  We use tmap because
186		 * vm_map_lookup() can change the map argument.
187		 */
188		tmap = map;
189		error = vm_map_lookup(&tmap, pageno, reqprot,
190			      &out_entry, &object, &pindex, &out_prot,
191			      &wired);
192
193		if (error) {
194			error = EFAULT;
195
196			/*
197			 * Make sure that there is no residue in 'object' from
198			 * an error return on vm_map_lookup.
199			 */
200			object = NULL;
201
202			break;
203		}
204
205		m = vm_page_lookup(object, pindex);
206
207		/* Allow fallback to backing objects if we are reading */
208
209		while (m == NULL && !writing && object->backing_object) {
210
211		  pindex += OFF_TO_IDX(object->backing_object_offset);
212		  object = object->backing_object;
213
214		  m = vm_page_lookup(object, pindex);
215		}
216
217		if (m == NULL) {
218			error = EFAULT;
219
220			/*
221			 * Make sure that there is no residue in 'object' from
222			 * an error return on vm_map_lookup.
223			 */
224			object = NULL;
225
226			vm_map_lookup_done(tmap, out_entry);
227
228			break;
229		}
230
231		/*
232		 * Wire the page into memory
233		 */
234		vm_page_wire(m);
235
236		/*
237		 * We're done with tmap now.
238		 * But reference the object first, so that we won't loose
239		 * it.
240		 */
241		vm_object_reference(object);
242		vm_map_lookup_done(tmap, out_entry);
243
244		pmap_kenter(kva, VM_PAGE_TO_PHYS(m));
245
246		/*
247		 * Now do the i/o move.
248		 */
249		error = uiomove((caddr_t)(kva + page_offset), len, uio);
250
251		pmap_kremove(kva);
252
253		/*
254		 * release the page and the object
255		 */
256		vm_page_unwire(m);
257		vm_object_deallocate(object);
258
259		object = NULL;
260
261	} while (error == 0 && uio->uio_resid > 0);
262
263	if (object)
264		vm_object_deallocate(object);
265
266	kmem_free(kernel_map, kva, PAGE_SIZE);
267	vmspace_free(vm);
268	return (error);
269}
270
271/*
272 * Copy data in and out of the target process.
273 * We do this by mapping the process's page into
274 * the kernel and then doing a uiomove direct
275 * from the kernel address space.
276 */
277int
278procfs_domem(curp, p, pfs, uio)
279	struct proc *curp;
280	struct proc *p;
281	struct pfsnode *pfs;
282	struct uio *uio;
283{
284
285	if (uio->uio_resid == 0)
286		return (0);
287
288 	/*
289 	 * XXX
290 	 * We need to check for KMEM_GROUP because ps is sgid kmem;
291 	 * not allowing it here causes ps to not work properly.  Arguably,
292 	 * this is a bug with what ps does.  We only need to do this
293 	 * for Pmem nodes, and only if it's reading.  This is still not
294 	 * good, as it may still be possible to grab illicit data if
295 	 * a process somehow gets to be KMEM_GROUP.  Note that this also
296 	 * means that KMEM_GROUP can't change without editing procfs.h!
297 	 * All in all, quite yucky.
298 	 */
299
300 	if (!CHECKIO(curp, p) &&
301	    !(uio->uio_rw == UIO_READ &&
302	      procfs_kmemaccess(curp)))
303 		return EPERM;
304
305	return (procfs_rwmem(curp, p, uio));
306}
307
308/*
309 * Given process (p), find the vnode from which
310 * its text segment is being executed.
311 *
312 * It would be nice to grab this information from
313 * the VM system, however, there is no sure-fire
314 * way of doing that.  Instead, fork(), exec() and
315 * wait() all maintain the p_textvp field in the
316 * process proc structure which contains a held
317 * reference to the exec'ed vnode.
318 */
319struct vnode *
320procfs_findtextvp(p)
321	struct proc *p;
322{
323
324	return (p->p_textvp);
325}
326
327int procfs_kmemaccess(curp)
328	struct proc *curp;
329{
330	int i;
331	struct ucred *cred;
332
333	cred = curp->p_cred->pc_ucred;
334	if (suser(cred, &curp->p_acflag))
335		return 1;
336
337	for (i = 0; i < cred->cr_ngroups; i++)
338		if (cred->cr_groups[i] == KMEM_GROUP)
339			return 1;
340
341	return 0;
342}
343