1994-05-27 12:33:43 +00:00
|
|
|
/*-
|
|
|
|
* Copyright (c) 1992, 1993
|
|
|
|
* The Regents of the University of California. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
|
|
* must display the following acknowledgement:
|
|
|
|
* This product includes software developed by the University of
|
|
|
|
* California, Berkeley and its contributors.
|
|
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef lint
|
1997-07-08 11:04:19 +00:00
|
|
|
static const char copyright[] =
|
1994-05-27 12:33:43 +00:00
|
|
|
"@(#) Copyright (c) 1992, 1993\n\
|
|
|
|
The Regents of the University of California. All rights reserved.\n";
|
|
|
|
#endif /* not lint */
|
|
|
|
|
1997-07-08 11:04:19 +00:00
|
|
|
#if 0
|
2002-06-30 09:24:25 +00:00
|
|
|
#ifndef lint
|
1994-05-27 12:33:43 +00:00
|
|
|
static char sccsid[] = "@(#)gcore.c 8.2 (Berkeley) 9/23/93";
|
2002-06-30 09:24:25 +00:00
|
|
|
#endif /* not lint */
|
1997-07-08 11:04:19 +00:00
|
|
|
#endif
|
2002-04-12 21:36:54 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
1994-05-27 12:33:43 +00:00
|
|
|
/*
|
|
|
|
* Originally written by Eric Cooper in Fall 1981.
|
|
|
|
* Inspired by a version 6 program by Len Levin, 1978.
|
|
|
|
* Several pieces of code lifted from Bill Joy's 4BSD ps.
|
|
|
|
* Most recently, hacked beyond recognition for 4.4BSD by Steven McCanne,
|
|
|
|
* Lawrence Berkeley Laboratory.
|
|
|
|
*
|
|
|
|
* Portions of this software were developed by the Computer Systems
|
|
|
|
* Engineering group at Lawrence Berkeley Laboratory under DARPA
|
|
|
|
* contract BG 91-66 and contributed to Berkeley.
|
|
|
|
*/
|
2002-04-12 21:36:54 +00:00
|
|
|
|
1994-05-27 12:33:43 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/time.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <sys/proc.h>
|
|
|
|
#include <sys/user.h>
|
|
|
|
#include <sys/sysctl.h>
|
2002-09-13 16:33:35 +00:00
|
|
|
#include <sys/linker_set.h>
|
1994-05-27 12:33:43 +00:00
|
|
|
|
2002-09-04 23:29:10 +00:00
|
|
|
#include <arpa/inet.h>
|
2001-05-03 00:35:53 +00:00
|
|
|
#include <machine/elf.h>
|
1994-05-27 12:33:43 +00:00
|
|
|
#include <machine/vmparam.h>
|
|
|
|
|
|
|
|
#include <a.out.h>
|
1997-07-08 11:04:19 +00:00
|
|
|
#include <err.h>
|
1994-05-27 12:33:43 +00:00
|
|
|
#include <fcntl.h>
|
|
|
|
#include <kvm.h>
|
|
|
|
#include <limits.h>
|
|
|
|
#include <signal.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <unistd.h>
|
|
|
|
|
|
|
|
#include "extern.h"
|
|
|
|
|
2002-03-22 01:22:50 +00:00
|
|
|
static void datadump(int, int, struct kinfo_proc *, u_long, int);
|
|
|
|
static void userdump(int, struct kinfo_proc *, u_long, int);
|
1994-05-27 12:33:43 +00:00
|
|
|
|
2002-09-13 16:33:35 +00:00
|
|
|
static kvm_t *kd;
|
1996-07-12 19:08:36 +00:00
|
|
|
|
1994-05-27 12:33:43 +00:00
|
|
|
static int data_offset;
|
2002-09-13 16:33:35 +00:00
|
|
|
static struct kinfo_proc *ki;
|
1994-05-27 12:33:43 +00:00
|
|
|
|
2002-09-13 16:33:35 +00:00
|
|
|
static int
|
|
|
|
aoutident(int efd, pid_t pid, char *binfile)
|
1994-05-27 12:33:43 +00:00
|
|
|
{
|
|
|
|
struct exec exec;
|
2002-09-13 16:33:35 +00:00
|
|
|
int cnt;
|
2002-09-04 23:29:10 +00:00
|
|
|
uid_t uid;
|
2002-09-13 16:33:35 +00:00
|
|
|
char errbuf[_POSIX2_LINE_MAX];
|
1994-05-27 12:33:43 +00:00
|
|
|
|
|
|
|
cnt = read(efd, &exec, sizeof(exec));
|
|
|
|
if (cnt != sizeof(exec))
|
2002-09-13 16:33:35 +00:00
|
|
|
return (0);
|
1998-10-19 19:42:18 +00:00
|
|
|
if (!N_BADMAG(exec)) {
|
|
|
|
/*
|
|
|
|
* This legacy a.out support uses the kvm interface instead
|
|
|
|
* of procfs.
|
|
|
|
*/
|
|
|
|
kd = kvm_openfiles(0, 0, 0, O_RDONLY, errbuf);
|
|
|
|
if (kd == NULL)
|
|
|
|
errx(1, "%s", errbuf);
|
|
|
|
|
|
|
|
uid = getuid();
|
|
|
|
|
|
|
|
ki = kvm_getprocs(kd, KERN_PROC_PID, pid, &cnt);
|
|
|
|
if (ki == NULL || cnt != 1)
|
|
|
|
errx(1, "%d: not found", pid);
|
|
|
|
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
if (ki->ki_ruid != uid && uid != 0)
|
1998-10-19 19:42:18 +00:00
|
|
|
errx(1, "%d: not owner", pid);
|
|
|
|
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
if (ki->ki_stat == SZOMB)
|
1998-10-19 19:42:18 +00:00
|
|
|
errx(1, "%d: zombie", pid);
|
|
|
|
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
if (ki->ki_flag & P_WEXIT)
|
1998-10-19 19:42:18 +00:00
|
|
|
errx(1, "%d: process exiting", pid);
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
if (ki->ki_flag & P_SYSTEM) /* Swapper or pagedaemon. */
|
1998-10-19 19:42:18 +00:00
|
|
|
errx(1, "%d: system process", pid);
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
if (exec.a_text != ptoa(ki->ki_tsize))
|
1998-10-19 19:42:18 +00:00
|
|
|
errx(1, "The executable %s does not belong to"
|
|
|
|
" process %d!\n"
|
1998-11-01 06:35:36 +00:00
|
|
|
"Text segment size (in bytes): executable %ld,"
|
1998-10-19 19:42:18 +00:00
|
|
|
" process %d", binfile, pid, exec.a_text,
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
ptoa(ki->ki_tsize));
|
1998-10-19 19:42:18 +00:00
|
|
|
data_offset = N_DATOFF(exec);
|
2002-09-13 16:33:35 +00:00
|
|
|
return (1);
|
1998-10-19 19:42:18 +00:00
|
|
|
}
|
2002-09-13 16:33:35 +00:00
|
|
|
return (0);
|
1994-05-27 12:33:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* core --
|
|
|
|
* Build the core file.
|
|
|
|
*/
|
|
|
|
void
|
2002-09-13 16:33:35 +00:00
|
|
|
aoutcore(int efd, int fd, pid_t pid)
|
1994-05-27 12:33:43 +00:00
|
|
|
{
|
|
|
|
union {
|
|
|
|
struct user user;
|
2001-09-12 08:38:13 +00:00
|
|
|
struct {
|
|
|
|
char uabytes[ctob(UAREA_PAGES)];
|
|
|
|
char ksbytes[ctob(KSTACK_PAGES)];
|
|
|
|
} bytes;
|
1994-05-27 12:33:43 +00:00
|
|
|
} uarea;
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
int tsize = ki->ki_tsize;
|
|
|
|
int dsize = ki->ki_dsize;
|
|
|
|
int ssize = ki->ki_ssize;
|
1994-05-27 12:33:43 +00:00
|
|
|
int cnt;
|
|
|
|
|
|
|
|
/* Read in user struct */
|
2001-09-12 08:38:13 +00:00
|
|
|
cnt = kvm_read(kd, (u_long)ki->ki_addr, uarea.bytes.uabytes,
|
|
|
|
ctob(UAREA_PAGES));
|
|
|
|
if (cnt != ctob(UAREA_PAGES))
|
|
|
|
errx(1, "read upages structure: %s",
|
|
|
|
cnt > 0 ? strerror(EIO) : strerror(errno));
|
|
|
|
|
|
|
|
cnt = kvm_read(kd, (u_long)ki->ki_kstack, uarea.bytes.ksbytes,
|
|
|
|
ctob(KSTACK_PAGES));
|
|
|
|
if (cnt != ctob(KSTACK_PAGES))
|
|
|
|
errx(1, "read kstack structure: %s",
|
1994-05-27 12:33:43 +00:00
|
|
|
cnt > 0 ? strerror(EIO) : strerror(errno));
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Fill in the eproc vm parameters, since these are garbage unless
|
|
|
|
* the kernel is dumping core or something.
|
|
|
|
*/
|
|
|
|
uarea.user.u_kproc = *ki;
|
|
|
|
|
|
|
|
/* Dump user area */
|
|
|
|
cnt = write(fd, &uarea, sizeof(uarea));
|
|
|
|
if (cnt != sizeof(uarea))
|
1997-07-08 11:04:19 +00:00
|
|
|
errx(1, "write user structure: %s",
|
1994-05-27 12:33:43 +00:00
|
|
|
cnt > 0 ? strerror(EIO) : strerror(errno));
|
|
|
|
|
|
|
|
/* Dump data segment */
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
datadump(efd, fd, ki, USRTEXT + ctob(tsize), dsize);
|
1994-05-27 12:33:43 +00:00
|
|
|
|
|
|
|
/* Dump stack segment */
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
userdump(fd, ki, USRSTACK - ctob(ssize), ssize);
|
1994-05-27 12:33:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2002-09-13 16:33:35 +00:00
|
|
|
datadump(int efd, int fd, struct kinfo_proc *kp, u_long addr, int npage)
|
1994-05-27 12:33:43 +00:00
|
|
|
{
|
2002-09-13 16:33:35 +00:00
|
|
|
int cc, delta;
|
1996-05-02 09:10:21 +00:00
|
|
|
char buffer[PAGE_SIZE];
|
1995-05-30 06:41:30 +00:00
|
|
|
|
1994-05-27 12:33:43 +00:00
|
|
|
delta = data_offset - addr;
|
|
|
|
while (--npage >= 0) {
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
cc = kvm_uread(kd, kp, addr, buffer, PAGE_SIZE);
|
1996-05-02 09:10:21 +00:00
|
|
|
if (cc != PAGE_SIZE) {
|
1994-05-27 12:33:43 +00:00
|
|
|
/* Try to read the page from the executable. */
|
|
|
|
if (lseek(efd, (off_t)addr + delta, SEEK_SET) == -1)
|
2002-04-12 21:36:54 +00:00
|
|
|
err(1, "seek executable");
|
1994-05-27 12:33:43 +00:00
|
|
|
cc = read(efd, buffer, sizeof(buffer));
|
1999-07-17 19:03:20 +00:00
|
|
|
if (cc != sizeof(buffer)) {
|
1995-05-30 06:41:30 +00:00
|
|
|
if (cc < 0)
|
1997-07-08 11:04:19 +00:00
|
|
|
err(1, "read executable");
|
1994-05-27 12:33:43 +00:00
|
|
|
else /* Assume untouched bss page. */
|
|
|
|
bzero(buffer, sizeof(buffer));
|
1999-07-17 19:03:20 +00:00
|
|
|
}
|
1994-05-27 12:33:43 +00:00
|
|
|
}
|
1996-05-02 09:10:21 +00:00
|
|
|
cc = write(fd, buffer, PAGE_SIZE);
|
|
|
|
if (cc != PAGE_SIZE)
|
1997-07-08 11:04:19 +00:00
|
|
|
errx(1, "write data segment: %s",
|
1994-05-27 12:33:43 +00:00
|
|
|
cc > 0 ? strerror(EIO) : strerror(errno));
|
1996-05-02 09:10:21 +00:00
|
|
|
addr += PAGE_SIZE;
|
1994-05-27 12:33:43 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2002-09-13 16:33:35 +00:00
|
|
|
userdump(int fd, struct kinfo_proc *kp, u_long addr, int npage)
|
1994-05-27 12:33:43 +00:00
|
|
|
{
|
2002-09-13 16:33:35 +00:00
|
|
|
int cc;
|
1996-05-02 09:10:21 +00:00
|
|
|
char buffer[PAGE_SIZE];
|
1994-05-27 12:33:43 +00:00
|
|
|
|
|
|
|
while (--npage >= 0) {
|
Change the proc information returned from the kernel so that it
no longer contains kernel specific data structures, but rather
only scalar values and structures that are already part of the
kernel/user interface, specifically rusage and rtprio. It no
longer contains proc, session, pcred, ucred, procsig, vmspace,
pstats, mtx, sigiolst, klist, callout, pasleep, or mdproc. If
any of these changed in size, ps, w, fstat, gcore, systat, and
top would all stop working. The new structure has over 200 bytes
of unassigned space for future values to be added, yet is nearly
100 bytes smaller per entry than the structure that it replaced.
2000-12-12 07:25:57 +00:00
|
|
|
cc = kvm_uread(kd, kp, addr, buffer, PAGE_SIZE);
|
1996-05-02 09:10:21 +00:00
|
|
|
if (cc != PAGE_SIZE)
|
1994-05-27 12:33:43 +00:00
|
|
|
/* Could be an untouched fill-with-zero page. */
|
1996-05-02 09:10:21 +00:00
|
|
|
bzero(buffer, PAGE_SIZE);
|
|
|
|
cc = write(fd, buffer, PAGE_SIZE);
|
|
|
|
if (cc != PAGE_SIZE)
|
1997-07-08 11:04:19 +00:00
|
|
|
errx(1, "write stack segment: %s",
|
1994-05-27 12:33:43 +00:00
|
|
|
cc > 0 ? strerror(EIO) : strerror(errno));
|
1996-05-02 09:10:21 +00:00
|
|
|
addr += PAGE_SIZE;
|
1994-05-27 12:33:43 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2002-09-13 16:33:35 +00:00
|
|
|
struct dumpers aoutdump = { aoutident, aoutcore };
|
|
|
|
TEXT_SET(dumpset, aoutdump);
|