blob: 42a0d7b11959c6ce926b350b42ec08142db167d0 [file] [log] [blame]
Roland McGrath88ac2922008-07-25 19:45:43 -07001/*
2 * Tracing hooks
3 *
4 * Copyright (C) 2008 Red Hat, Inc. All rights reserved.
5 *
6 * This copyrighted material is made available to anyone wishing to use,
7 * modify, copy, or redistribute it subject to the terms and conditions
8 * of the GNU General Public License v.2.
9 *
10 * This file defines hook entry points called by core code where
11 * user tracing/debugging support might need to do something. These
12 * entry points are called tracehook_*(). Each hook declared below
13 * has a detailed kerneldoc comment giving the context (locking et
14 * al) from which it is called, and the meaning of its return value.
15 *
16 * Each function here typically has only one call site, so it is ok
17 * to have some nontrivial tracehook_*() inlines. In all cases, the
18 * fast path when no tracing is enabled should be very short.
19 *
20 * The purpose of this file and the tracehook_* layer is to consolidate
21 * the interface that the kernel core and arch code uses to enable any
22 * user debugging or tracing facility (such as ptrace). The interfaces
23 * here are carefully documented so that maintainers of core and arch
24 * code do not need to think about the implementation details of the
25 * tracing facilities. Likewise, maintainers of the tracing code do not
26 * need to understand all the calling core or arch code in detail, just
27 * documented circumstances of each call, such as locking conditions.
28 *
29 * If the calling core code changes so that locking is different, then
30 * it is ok to change the interface documented here. The maintainer of
31 * core code changing should notify the maintainers of the tracing code
32 * that they need to work out the change.
33 *
34 * Some tracehook_*() inlines take arguments that the current tracing
35 * implementations might not necessarily use. These function signatures
36 * are chosen to pass in all the information that is on hand in the
37 * caller and might conceivably be relevant to a tracer, so that the
38 * core code won't have to be updated when tracing adds more features.
39 * If a call site changes so that some of those parameters are no longer
40 * already on hand without extra work, then the tracehook_* interface
41 * can change so there is no make-work burden on the core code. The
42 * maintainer of core code changing should notify the maintainers of the
43 * tracing code that they need to work out the change.
44 */
45
46#ifndef _LINUX_TRACEHOOK_H
47#define _LINUX_TRACEHOOK_H 1
48
49#include <linux/sched.h>
50#include <linux/ptrace.h>
Roland McGrath6341c392008-07-25 19:45:44 -070051#include <linux/security.h>
52struct linux_binprm;
53
54/**
Roland McGrathfa8e26c2008-07-25 19:45:50 -070055 * tracehook_expect_breakpoints - guess if task memory might be touched
56 * @task: current task, making a new mapping
57 *
58 * Return nonzero if @task is expected to want breakpoint insertion in
59 * its memory at some point. A zero return is no guarantee it won't
60 * be done, but this is a hint that it's known to be likely.
61 *
62 * May be called with @task->mm->mmap_sem held for writing.
63 */
64static inline int tracehook_expect_breakpoints(struct task_struct *task)
65{
66 return (task_ptrace(task) & PT_PTRACED) != 0;
67}
68
Roland McGrath283d7552008-07-25 19:45:52 -070069/*
70 * ptrace report for syscall entry and exit looks identical.
71 */
72static inline void ptrace_report_syscall(struct pt_regs *regs)
73{
74 int ptrace = task_ptrace(current);
75
76 if (!(ptrace & PT_PTRACED))
77 return;
78
79 ptrace_notify(SIGTRAP | ((ptrace & PT_TRACESYSGOOD) ? 0x80 : 0));
80
81 /*
82 * this isn't the same as continuing with a signal, but it will do
83 * for normal use. strace only continues with a signal if the
84 * stopping signal is not SIGTRAP. -brl
85 */
86 if (current->exit_code) {
87 send_sig(current->exit_code, current, 1);
88 current->exit_code = 0;
89 }
90}
91
92/**
93 * tracehook_report_syscall_entry - task is about to attempt a system call
94 * @regs: user register state of current task
95 *
96 * This will be called if %TIF_SYSCALL_TRACE has been set, when the
97 * current task has just entered the kernel for a system call.
98 * Full user register state is available here. Changing the values
99 * in @regs can affect the system call number and arguments to be tried.
100 * It is safe to block here, preventing the system call from beginning.
101 *
102 * Returns zero normally, or nonzero if the calling arch code should abort
103 * the system call. That must prevent normal entry so no system call is
104 * made. If @task ever returns to user mode after this, its register state
105 * is unspecified, but should be something harmless like an %ENOSYS error
106 * return.
107 *
108 * Called without locks, just after entering kernel mode.
109 */
110static inline __must_check int tracehook_report_syscall_entry(
111 struct pt_regs *regs)
112{
113 ptrace_report_syscall(regs);
114 return 0;
115}
116
117/**
118 * tracehook_report_syscall_exit - task has just finished a system call
119 * @regs: user register state of current task
120 * @step: nonzero if simulating single-step or block-step
121 *
122 * This will be called if %TIF_SYSCALL_TRACE has been set, when the
123 * current task has just finished an attempted system call. Full
124 * user register state is available here. It is safe to block here,
125 * preventing signals from being processed.
126 *
127 * If @step is nonzero, this report is also in lieu of the normal
128 * trap that would follow the system call instruction because
129 * user_enable_block_step() or user_enable_single_step() was used.
130 * In this case, %TIF_SYSCALL_TRACE might not be set.
131 *
132 * Called without locks, just before checking for pending signals.
133 */
134static inline void tracehook_report_syscall_exit(struct pt_regs *regs, int step)
135{
136 ptrace_report_syscall(regs);
137}
138
Roland McGrathfa8e26c2008-07-25 19:45:50 -0700139/**
Roland McGrath6341c392008-07-25 19:45:44 -0700140 * tracehook_unsafe_exec - check for exec declared unsafe due to tracing
141 * @task: current task doing exec
142 *
143 * Return %LSM_UNSAFE_* bits applied to an exec because of tracing.
144 *
145 * Called with task_lock() held on @task.
146 */
147static inline int tracehook_unsafe_exec(struct task_struct *task)
148{
149 int unsafe = 0;
150 int ptrace = task_ptrace(task);
151 if (ptrace & PT_PTRACED) {
152 if (ptrace & PT_PTRACE_CAP)
153 unsafe |= LSM_UNSAFE_PTRACE_CAP;
154 else
155 unsafe |= LSM_UNSAFE_PTRACE;
156 }
157 return unsafe;
158}
159
160/**
Roland McGrath0d094ef2008-07-25 19:45:49 -0700161 * tracehook_tracer_task - return the task that is tracing the given task
162 * @tsk: task to consider
163 *
164 * Returns NULL if noone is tracing @task, or the &struct task_struct
165 * pointer to its tracer.
166 *
167 * Must called under rcu_read_lock(). The pointer returned might be kept
168 * live only by RCU. During exec, this may be called with task_lock()
169 * held on @task, still held from when tracehook_unsafe_exec() was called.
170 */
171static inline struct task_struct *tracehook_tracer_task(struct task_struct *tsk)
172{
173 if (task_ptrace(tsk) & PT_PTRACED)
174 return rcu_dereference(tsk->parent);
175 return NULL;
176}
177
178/**
Roland McGrath6341c392008-07-25 19:45:44 -0700179 * tracehook_report_exec - a successful exec was completed
180 * @fmt: &struct linux_binfmt that performed the exec
181 * @bprm: &struct linux_binprm containing exec details
182 * @regs: user-mode register state
183 *
184 * An exec just completed, we are shortly going to return to user mode.
185 * The freshly initialized register state can be seen and changed in @regs.
186 * The name, file and other pointers in @bprm are still on hand to be
187 * inspected, but will be freed as soon as this returns.
188 *
189 * Called with no locks, but with some kernel resources held live
190 * and a reference on @fmt->module.
191 */
192static inline void tracehook_report_exec(struct linux_binfmt *fmt,
193 struct linux_binprm *bprm,
194 struct pt_regs *regs)
195{
196 if (!ptrace_event(PT_TRACE_EXEC, PTRACE_EVENT_EXEC, 0) &&
197 unlikely(task_ptrace(current) & PT_PTRACED))
198 send_sig(SIGTRAP, current, 0);
199}
Roland McGrath88ac2922008-07-25 19:45:43 -0700200
Roland McGrath30199f52008-07-25 19:45:46 -0700201/**
202 * tracehook_report_exit - task has begun to exit
203 * @exit_code: pointer to value destined for @current->exit_code
204 *
205 * @exit_code points to the value passed to do_exit(), which tracing
206 * might change here. This is almost the first thing in do_exit(),
207 * before freeing any resources or setting the %PF_EXITING flag.
208 *
209 * Called with no locks held.
210 */
211static inline void tracehook_report_exit(long *exit_code)
212{
213 ptrace_event(PT_TRACE_EXIT, PTRACE_EVENT_EXIT, *exit_code);
214}
215
Roland McGrath09a05392008-07-25 19:45:47 -0700216/**
217 * tracehook_prepare_clone - prepare for new child to be cloned
218 * @clone_flags: %CLONE_* flags from clone/fork/vfork system call
219 *
220 * This is called before a new user task is to be cloned.
221 * Its return value will be passed to tracehook_finish_clone().
222 *
223 * Called with no locks held.
224 */
225static inline int tracehook_prepare_clone(unsigned clone_flags)
226{
227 if (clone_flags & CLONE_UNTRACED)
228 return 0;
229
230 if (clone_flags & CLONE_VFORK) {
231 if (current->ptrace & PT_TRACE_VFORK)
232 return PTRACE_EVENT_VFORK;
233 } else if ((clone_flags & CSIGNAL) != SIGCHLD) {
234 if (current->ptrace & PT_TRACE_CLONE)
235 return PTRACE_EVENT_CLONE;
236 } else if (current->ptrace & PT_TRACE_FORK)
237 return PTRACE_EVENT_FORK;
238
239 return 0;
240}
241
242/**
243 * tracehook_finish_clone - new child created and being attached
244 * @child: new child task
245 * @clone_flags: %CLONE_* flags from clone/fork/vfork system call
246 * @trace: return value from tracehook_clone_prepare()
247 *
248 * This is called immediately after adding @child to its parent's children list.
249 * The @trace value is that returned by tracehook_prepare_clone().
250 *
251 * Called with current's siglock and write_lock_irq(&tasklist_lock) held.
252 */
253static inline void tracehook_finish_clone(struct task_struct *child,
254 unsigned long clone_flags, int trace)
255{
256 ptrace_init_task(child, (clone_flags & CLONE_PTRACE) || trace);
257}
258
259/**
260 * tracehook_report_clone - in parent, new child is about to start running
261 * @trace: return value from tracehook_clone_prepare()
262 * @regs: parent's user register state
263 * @clone_flags: flags from parent's system call
264 * @pid: new child's PID in the parent's namespace
265 * @child: new child task
266 *
267 * Called after a child is set up, but before it has been started running.
268 * The @trace value is that returned by tracehook_clone_prepare().
269 * This is not a good place to block, because the child has not started yet.
270 * Suspend the child here if desired, and block in tracehook_clone_complete().
271 * This must prevent the child from self-reaping if tracehook_clone_complete()
272 * uses the @child pointer; otherwise it might have died and been released by
273 * the time tracehook_report_clone_complete() is called.
274 *
275 * Called with no locks held, but the child cannot run until this returns.
276 */
277static inline void tracehook_report_clone(int trace, struct pt_regs *regs,
278 unsigned long clone_flags,
279 pid_t pid, struct task_struct *child)
280{
281 if (unlikely(trace)) {
282 /*
283 * The child starts up with an immediate SIGSTOP.
284 */
285 sigaddset(&child->pending.signal, SIGSTOP);
286 set_tsk_thread_flag(child, TIF_SIGPENDING);
287 }
288}
289
290/**
291 * tracehook_report_clone_complete - new child is running
292 * @trace: return value from tracehook_clone_prepare()
293 * @regs: parent's user register state
294 * @clone_flags: flags from parent's system call
295 * @pid: new child's PID in the parent's namespace
296 * @child: child task, already running
297 *
298 * This is called just after the child has started running. This is
299 * just before the clone/fork syscall returns, or blocks for vfork
300 * child completion if @clone_flags has the %CLONE_VFORK bit set.
301 * The @child pointer may be invalid if a self-reaping child died and
302 * tracehook_report_clone() took no action to prevent it from self-reaping.
303 *
304 * Called with no locks held.
305 */
306static inline void tracehook_report_clone_complete(int trace,
307 struct pt_regs *regs,
308 unsigned long clone_flags,
309 pid_t pid,
310 struct task_struct *child)
311{
312 if (unlikely(trace))
313 ptrace_event(0, trace, pid);
314}
315
Roland McGrathdaded342008-07-25 19:45:47 -0700316/**
317 * tracehook_report_vfork_done - vfork parent's child has exited or exec'd
318 * @child: child task, already running
319 * @pid: new child's PID in the parent's namespace
320 *
321 * Called after a %CLONE_VFORK parent has waited for the child to complete.
322 * The clone/vfork system call will return immediately after this.
323 * The @child pointer may be invalid if a self-reaping child died and
324 * tracehook_report_clone() took no action to prevent it from self-reaping.
325 *
326 * Called with no locks held.
327 */
328static inline void tracehook_report_vfork_done(struct task_struct *child,
329 pid_t pid)
330{
331 ptrace_event(PT_TRACE_VFORK_DONE, PTRACE_EVENT_VFORK_DONE, pid);
332}
333
Roland McGrathdae33572008-07-25 19:45:48 -0700334/**
335 * tracehook_prepare_release_task - task is being reaped, clean up tracing
336 * @task: task in %EXIT_DEAD state
337 *
338 * This is called in release_task() just before @task gets finally reaped
339 * and freed. This would be the ideal place to remove and clean up any
340 * tracing-related state for @task.
341 *
342 * Called with no locks held.
343 */
344static inline void tracehook_prepare_release_task(struct task_struct *task)
345{
346}
347
348/**
349 * tracehook_finish_release_task - task is being reaped, clean up tracing
350 * @task: task in %EXIT_DEAD state
351 *
352 * This is called in release_task() when @task is being in the middle of
353 * being reaped. After this, there must be no tracing entanglements.
354 *
355 * Called with write_lock_irq(&tasklist_lock) held.
356 */
357static inline void tracehook_finish_release_task(struct task_struct *task)
358{
359 ptrace_release_task(task);
360}
361
Roland McGrathc45aea22008-07-25 19:45:50 -0700362/**
363 * tracehook_signal_handler - signal handler setup is complete
364 * @sig: number of signal being delivered
365 * @info: siginfo_t of signal being delivered
366 * @ka: sigaction setting that chose the handler
367 * @regs: user register state
368 * @stepping: nonzero if debugger single-step or block-step in use
369 *
370 * Called by the arch code after a signal handler has been set up.
371 * Register and stack state reflects the user handler about to run.
372 * Signal mask changes have already been made.
373 *
374 * Called without locks, shortly before returning to user mode
375 * (or handling more signals).
376 */
377static inline void tracehook_signal_handler(int sig, siginfo_t *info,
378 const struct k_sigaction *ka,
379 struct pt_regs *regs, int stepping)
380{
381 if (stepping)
382 ptrace_notify(SIGTRAP);
383}
384
Roland McGrath35de2542008-07-25 19:45:51 -0700385/**
386 * tracehook_consider_ignored_signal - suppress short-circuit of ignored signal
387 * @task: task receiving the signal
388 * @sig: signal number being sent
389 * @handler: %SIG_IGN or %SIG_DFL
390 *
391 * Return zero iff tracing doesn't care to examine this ignored signal,
392 * so it can short-circuit normal delivery and never even get queued.
393 * Either @handler is %SIG_DFL and @sig's default is ignore, or it's %SIG_IGN.
394 *
395 * Called with @task->sighand->siglock held.
396 */
397static inline int tracehook_consider_ignored_signal(struct task_struct *task,
398 int sig,
399 void __user *handler)
400{
401 return (task_ptrace(task) & PT_PTRACED) != 0;
402}
403
Roland McGrath445a91d2008-07-25 19:45:52 -0700404/**
405 * tracehook_consider_fatal_signal - suppress special handling of fatal signal
406 * @task: task receiving the signal
407 * @sig: signal number being sent
408 * @handler: %SIG_DFL or %SIG_IGN
409 *
410 * Return nonzero to prevent special handling of this termination signal.
411 * Normally @handler is %SIG_DFL. It can be %SIG_IGN if @sig is ignored,
412 * in which case force_sig() is about to reset it to %SIG_DFL.
413 * When this returns zero, this signal might cause a quick termination
414 * that does not give the debugger a chance to intercept the signal.
415 *
416 * Called with or without @task->sighand->siglock held.
417 */
418static inline int tracehook_consider_fatal_signal(struct task_struct *task,
419 int sig,
420 void __user *handler)
421{
422 return (task_ptrace(task) & PT_PTRACED) != 0;
423}
424
Roland McGrath7bcf6a22008-07-25 19:45:53 -0700425/**
426 * tracehook_get_signal - deliver synthetic signal to traced task
427 * @task: @current
428 * @regs: task_pt_regs(@current)
429 * @info: details of synthetic signal
430 * @return_ka: sigaction for synthetic signal
431 *
432 * Return zero to check for a real pending signal normally.
433 * Return -1 after releasing the siglock to repeat the check.
434 * Return a signal number to induce an artifical signal delivery,
435 * setting *@info and *@return_ka to specify its details and behavior.
436 *
437 * The @return_ka->sa_handler value controls the disposition of the
438 * signal, no matter the signal number. For %SIG_DFL, the return value
439 * is a representative signal to indicate the behavior (e.g. %SIGTERM
440 * for death, %SIGQUIT for core dump, %SIGSTOP for job control stop,
441 * %SIGTSTP for stop unless in an orphaned pgrp), but the signal number
442 * reported will be @info->si_signo instead.
443 *
444 * Called with @task->sighand->siglock held, before dequeuing pending signals.
445 */
446static inline int tracehook_get_signal(struct task_struct *task,
447 struct pt_regs *regs,
448 siginfo_t *info,
449 struct k_sigaction *return_ka)
450{
451 return 0;
452}
453
Roland McGrath88ac2922008-07-25 19:45:43 -0700454#endif /* <linux/tracehook.h> */