Commit | Line | Data |
---|---|---|
88ac2921 RM |
1 | /* |
2 | * Tracing hooks | |
3 | * | |
4 | * Copyright (C) 2008 Red Hat, Inc. All rights reserved. | |
5 | * | |
6 | * This copyrighted material is made available to anyone wishing to use, | |
7 | * modify, copy, or redistribute it subject to the terms and conditions | |
8 | * of the GNU General Public License v.2. | |
9 | * | |
10 | * This file defines hook entry points called by core code where | |
11 | * user tracing/debugging support might need to do something. These | |
12 | * entry points are called tracehook_*(). Each hook declared below | |
13 | * has a detailed kerneldoc comment giving the context (locking et | |
14 | * al) from which it is called, and the meaning of its return value. | |
15 | * | |
16 | * Each function here typically has only one call site, so it is ok | |
17 | * to have some nontrivial tracehook_*() inlines. In all cases, the | |
18 | * fast path when no tracing is enabled should be very short. | |
19 | * | |
20 | * The purpose of this file and the tracehook_* layer is to consolidate | |
21 | * the interface that the kernel core and arch code uses to enable any | |
22 | * user debugging or tracing facility (such as ptrace). The interfaces | |
23 | * here are carefully documented so that maintainers of core and arch | |
24 | * code do not need to think about the implementation details of the | |
25 | * tracing facilities. Likewise, maintainers of the tracing code do not | |
26 | * need to understand all the calling core or arch code in detail, just | |
27 | * documented circumstances of each call, such as locking conditions. | |
28 | * | |
29 | * If the calling core code changes so that locking is different, then | |
30 | * it is ok to change the interface documented here. The maintainer of | |
31 | * core code changing should notify the maintainers of the tracing code | |
32 | * that they need to work out the change. | |
33 | * | |
34 | * Some tracehook_*() inlines take arguments that the current tracing | |
35 | * implementations might not necessarily use. These function signatures | |
36 | * are chosen to pass in all the information that is on hand in the | |
37 | * caller and might conceivably be relevant to a tracer, so that the | |
38 | * core code won't have to be updated when tracing adds more features. | |
39 | * If a call site changes so that some of those parameters are no longer | |
40 | * already on hand without extra work, then the tracehook_* interface | |
41 | * can change so there is no make-work burden on the core code. The | |
42 | * maintainer of core code changing should notify the maintainers of the | |
43 | * tracing code that they need to work out the change. | |
44 | */ | |
45 | ||
46 | #ifndef _LINUX_TRACEHOOK_H | |
47 | #define _LINUX_TRACEHOOK_H 1 | |
48 | ||
49 | #include <linux/sched.h> | |
50 | #include <linux/ptrace.h> | |
6341c393 RM |
51 | #include <linux/security.h> |
52 | struct linux_binprm; | |
53 | ||
54 | /** | |
55 | * tracehook_unsafe_exec - check for exec declared unsafe due to tracing | |
56 | * @task: current task doing exec | |
57 | * | |
58 | * Return %LSM_UNSAFE_* bits applied to an exec because of tracing. | |
59 | * | |
60 | * Called with task_lock() held on @task. | |
61 | */ | |
62 | static inline int tracehook_unsafe_exec(struct task_struct *task) | |
63 | { | |
64 | int unsafe = 0; | |
65 | int ptrace = task_ptrace(task); | |
66 | if (ptrace & PT_PTRACED) { | |
67 | if (ptrace & PT_PTRACE_CAP) | |
68 | unsafe |= LSM_UNSAFE_PTRACE_CAP; | |
69 | else | |
70 | unsafe |= LSM_UNSAFE_PTRACE; | |
71 | } | |
72 | return unsafe; | |
73 | } | |
74 | ||
0d094efe RM |
75 | /** |
76 | * tracehook_tracer_task - return the task that is tracing the given task | |
77 | * @tsk: task to consider | |
78 | * | |
79 | * Returns NULL if noone is tracing @task, or the &struct task_struct | |
80 | * pointer to its tracer. | |
81 | * | |
82 | * Must called under rcu_read_lock(). The pointer returned might be kept | |
83 | * live only by RCU. During exec, this may be called with task_lock() | |
84 | * held on @task, still held from when tracehook_unsafe_exec() was called. | |
85 | */ | |
86 | static inline struct task_struct *tracehook_tracer_task(struct task_struct *tsk) | |
87 | { | |
88 | if (task_ptrace(tsk) & PT_PTRACED) | |
89 | return rcu_dereference(tsk->parent); | |
90 | return NULL; | |
91 | } | |
92 | ||
6341c393 RM |
93 | /** |
94 | * tracehook_report_exec - a successful exec was completed | |
95 | * @fmt: &struct linux_binfmt that performed the exec | |
96 | * @bprm: &struct linux_binprm containing exec details | |
97 | * @regs: user-mode register state | |
98 | * | |
99 | * An exec just completed, we are shortly going to return to user mode. | |
100 | * The freshly initialized register state can be seen and changed in @regs. | |
101 | * The name, file and other pointers in @bprm are still on hand to be | |
102 | * inspected, but will be freed as soon as this returns. | |
103 | * | |
104 | * Called with no locks, but with some kernel resources held live | |
105 | * and a reference on @fmt->module. | |
106 | */ | |
107 | static inline void tracehook_report_exec(struct linux_binfmt *fmt, | |
108 | struct linux_binprm *bprm, | |
109 | struct pt_regs *regs) | |
110 | { | |
111 | if (!ptrace_event(PT_TRACE_EXEC, PTRACE_EVENT_EXEC, 0) && | |
112 | unlikely(task_ptrace(current) & PT_PTRACED)) | |
113 | send_sig(SIGTRAP, current, 0); | |
114 | } | |
88ac2921 | 115 | |
30199f5a RM |
116 | /** |
117 | * tracehook_report_exit - task has begun to exit | |
118 | * @exit_code: pointer to value destined for @current->exit_code | |
119 | * | |
120 | * @exit_code points to the value passed to do_exit(), which tracing | |
121 | * might change here. This is almost the first thing in do_exit(), | |
122 | * before freeing any resources or setting the %PF_EXITING flag. | |
123 | * | |
124 | * Called with no locks held. | |
125 | */ | |
126 | static inline void tracehook_report_exit(long *exit_code) | |
127 | { | |
128 | ptrace_event(PT_TRACE_EXIT, PTRACE_EVENT_EXIT, *exit_code); | |
129 | } | |
130 | ||
09a05394 RM |
131 | /** |
132 | * tracehook_prepare_clone - prepare for new child to be cloned | |
133 | * @clone_flags: %CLONE_* flags from clone/fork/vfork system call | |
134 | * | |
135 | * This is called before a new user task is to be cloned. | |
136 | * Its return value will be passed to tracehook_finish_clone(). | |
137 | * | |
138 | * Called with no locks held. | |
139 | */ | |
140 | static inline int tracehook_prepare_clone(unsigned clone_flags) | |
141 | { | |
142 | if (clone_flags & CLONE_UNTRACED) | |
143 | return 0; | |
144 | ||
145 | if (clone_flags & CLONE_VFORK) { | |
146 | if (current->ptrace & PT_TRACE_VFORK) | |
147 | return PTRACE_EVENT_VFORK; | |
148 | } else if ((clone_flags & CSIGNAL) != SIGCHLD) { | |
149 | if (current->ptrace & PT_TRACE_CLONE) | |
150 | return PTRACE_EVENT_CLONE; | |
151 | } else if (current->ptrace & PT_TRACE_FORK) | |
152 | return PTRACE_EVENT_FORK; | |
153 | ||
154 | return 0; | |
155 | } | |
156 | ||
157 | /** | |
158 | * tracehook_finish_clone - new child created and being attached | |
159 | * @child: new child task | |
160 | * @clone_flags: %CLONE_* flags from clone/fork/vfork system call | |
161 | * @trace: return value from tracehook_clone_prepare() | |
162 | * | |
163 | * This is called immediately after adding @child to its parent's children list. | |
164 | * The @trace value is that returned by tracehook_prepare_clone(). | |
165 | * | |
166 | * Called with current's siglock and write_lock_irq(&tasklist_lock) held. | |
167 | */ | |
168 | static inline void tracehook_finish_clone(struct task_struct *child, | |
169 | unsigned long clone_flags, int trace) | |
170 | { | |
171 | ptrace_init_task(child, (clone_flags & CLONE_PTRACE) || trace); | |
172 | } | |
173 | ||
174 | /** | |
175 | * tracehook_report_clone - in parent, new child is about to start running | |
176 | * @trace: return value from tracehook_clone_prepare() | |
177 | * @regs: parent's user register state | |
178 | * @clone_flags: flags from parent's system call | |
179 | * @pid: new child's PID in the parent's namespace | |
180 | * @child: new child task | |
181 | * | |
182 | * Called after a child is set up, but before it has been started running. | |
183 | * The @trace value is that returned by tracehook_clone_prepare(). | |
184 | * This is not a good place to block, because the child has not started yet. | |
185 | * Suspend the child here if desired, and block in tracehook_clone_complete(). | |
186 | * This must prevent the child from self-reaping if tracehook_clone_complete() | |
187 | * uses the @child pointer; otherwise it might have died and been released by | |
188 | * the time tracehook_report_clone_complete() is called. | |
189 | * | |
190 | * Called with no locks held, but the child cannot run until this returns. | |
191 | */ | |
192 | static inline void tracehook_report_clone(int trace, struct pt_regs *regs, | |
193 | unsigned long clone_flags, | |
194 | pid_t pid, struct task_struct *child) | |
195 | { | |
196 | if (unlikely(trace)) { | |
197 | /* | |
198 | * The child starts up with an immediate SIGSTOP. | |
199 | */ | |
200 | sigaddset(&child->pending.signal, SIGSTOP); | |
201 | set_tsk_thread_flag(child, TIF_SIGPENDING); | |
202 | } | |
203 | } | |
204 | ||
205 | /** | |
206 | * tracehook_report_clone_complete - new child is running | |
207 | * @trace: return value from tracehook_clone_prepare() | |
208 | * @regs: parent's user register state | |
209 | * @clone_flags: flags from parent's system call | |
210 | * @pid: new child's PID in the parent's namespace | |
211 | * @child: child task, already running | |
212 | * | |
213 | * This is called just after the child has started running. This is | |
214 | * just before the clone/fork syscall returns, or blocks for vfork | |
215 | * child completion if @clone_flags has the %CLONE_VFORK bit set. | |
216 | * The @child pointer may be invalid if a self-reaping child died and | |
217 | * tracehook_report_clone() took no action to prevent it from self-reaping. | |
218 | * | |
219 | * Called with no locks held. | |
220 | */ | |
221 | static inline void tracehook_report_clone_complete(int trace, | |
222 | struct pt_regs *regs, | |
223 | unsigned long clone_flags, | |
224 | pid_t pid, | |
225 | struct task_struct *child) | |
226 | { | |
227 | if (unlikely(trace)) | |
228 | ptrace_event(0, trace, pid); | |
229 | } | |
230 | ||
daded34b RM |
231 | /** |
232 | * tracehook_report_vfork_done - vfork parent's child has exited or exec'd | |
233 | * @child: child task, already running | |
234 | * @pid: new child's PID in the parent's namespace | |
235 | * | |
236 | * Called after a %CLONE_VFORK parent has waited for the child to complete. | |
237 | * The clone/vfork system call will return immediately after this. | |
238 | * The @child pointer may be invalid if a self-reaping child died and | |
239 | * tracehook_report_clone() took no action to prevent it from self-reaping. | |
240 | * | |
241 | * Called with no locks held. | |
242 | */ | |
243 | static inline void tracehook_report_vfork_done(struct task_struct *child, | |
244 | pid_t pid) | |
245 | { | |
246 | ptrace_event(PT_TRACE_VFORK_DONE, PTRACE_EVENT_VFORK_DONE, pid); | |
247 | } | |
248 | ||
dae33574 RM |
249 | /** |
250 | * tracehook_prepare_release_task - task is being reaped, clean up tracing | |
251 | * @task: task in %EXIT_DEAD state | |
252 | * | |
253 | * This is called in release_task() just before @task gets finally reaped | |
254 | * and freed. This would be the ideal place to remove and clean up any | |
255 | * tracing-related state for @task. | |
256 | * | |
257 | * Called with no locks held. | |
258 | */ | |
259 | static inline void tracehook_prepare_release_task(struct task_struct *task) | |
260 | { | |
261 | } | |
262 | ||
263 | /** | |
264 | * tracehook_finish_release_task - task is being reaped, clean up tracing | |
265 | * @task: task in %EXIT_DEAD state | |
266 | * | |
267 | * This is called in release_task() when @task is being in the middle of | |
268 | * being reaped. After this, there must be no tracing entanglements. | |
269 | * | |
270 | * Called with write_lock_irq(&tasklist_lock) held. | |
271 | */ | |
272 | static inline void tracehook_finish_release_task(struct task_struct *task) | |
273 | { | |
274 | ptrace_release_task(task); | |
275 | } | |
276 | ||
88ac2921 | 277 | #endif /* <linux/tracehook.h> */ |