Understanding proc_rwmem

Previous thread: there is a way to avoid strict libraries linking? by Leinier Cruz Salfran on Wednesday, April 14, 2010 - 9:23 am. (14 messages)

Next thread: A cookie for anyone who can solve this C/macro problem... by Lawrence Stewart on Thursday, April 15, 2010 - 6:17 am. (3 messages)
From: Fernando Apesteguía
Date: Wednesday, April 14, 2010 - 1:22 pm

Hi all,

I'm trying to read process memory other than the current process in
kernel. I was told to use the proc_rwmem function, however I can't get
it working properly. At first, I'm trying to read how many elements
the environment variables vector has. To do this I tried this from a
linprocfs filler function:


        struct iovec iov;
	struct uio tmp_uio;
	struct ps_strings *pss;
	int ret_code;

	buff = malloc(sizeof(struct ps_strings), M_TEMP, M_WAITOK);
	memset(buff, 0, sizeof(struct ps_strings));

	PROC_LOCK_ASSERT(td->td_proc, MA_NOTOWNED);
	iov.iov_base = (caddr_t) buff;
	iov.iov_len = sizeof(struct ps_strings);
	tmp_uio.uio_iov = &iov;
	tmp_uio.uio_iovcnt = 1;
	tmp_uio.uio_offset = (off_t)(p->p_sysent->sv_psstrings);
	tmp_uio.uio_resid = sizeof(struct ps_strings);
	tmp_uio.uio_segflg = UIO_USERSPACE;
	tmp_uio.uio_rw = UIO_READ;
	tmp_uio.uio_td = td;
	ret_code = proc_rwmem(td->td_proc, &tmp_uio);

	if (ret_code == 0) {
		sbuf_printf(sb, "proc_rwmem successfully executed: %d\n", ret_code);
	} else {
		sbuf_printf(sb, "Error in proc_rwmem: %d\n", ret_code);
	}

	pss = (struct ps_strings *)(iov.iov_base);
	sbuf_printf(sb, "ps_nargvstr = %d\nps_nenvstr = %d\n",
			pss->ps_nargvstr, pss->ps_nenvstr);

	free(buff, M_TEMP);

Considering I left security and error handling aside, what is wrong
with the code above?
proc_rwmem returns 0 indicating no failure, but when I try to print
the result, I get random stuff. I thought maybe the problem is in the
uio_offset field, but p->p_sysent->sv_psstrings is a vm_offset_t. Is
the offset properly specified? If not, what else could be the problem?

Thanks in advance.

PS: I posted a similar question at forums.freebsd.org but got no
answer, that is why I ask here.
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: John Baldwin
Date: Wednesday, April 14, 2010 - 2:21 pm

I think you want to use 'p' instead of 'td->td_proc' here.  As it is you are 
reading from the current process instead of the target process I believe.

-- 
John Baldwin
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Kostik Belousov
Date: Wednesday, April 14, 2010 - 2:35 pm

And UIO_USERSPACE sound suspicious. Note that segment flag
is for the requestor address space.
From: Fernando Apesteguía
Date: Thursday, April 15, 2010 - 12:19 am

_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Fernando Apesteguía
Date: Friday, April 16, 2010 - 5:11 am

Thank you. You are right.

I made the changes suggested by both you and Kostik. I still have
random data when reading.
I'm trying to to the same thing using kern/sys_generic.c::read and
kern/sys_process.c::kern_ptrace
as examples, but I'm missing something...
After reading with proc_rwmem, is it possible to do something like the
following?

if (ret_code == 0) {
		sbuf_printf(sb, "proc_rwmem successfully executed: %d\n", ret_code);
} else {
		sbuf_printf(sb, "Error in proc_rwmem: %d\n", ret_code);
}

pss = (struct ps_strings *)(iov.iov_base);
sbuf_printf(sb, "ps_nargvstr = %d\nps_nenvstr = %d\n",
pss->ps_nargvstr, pss->ps_nenvstr);

_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: John Baldwin
Date: Friday, April 16, 2010 - 5:18 am

No, functions like uiomove() modify the iovec structures.  Just use 'buff' 
instead of iov.iov_base.

-- 
John Baldwin
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
From: Fernando Apesteguía
Date: Friday, April 16, 2010 - 5:37 am

Ah! That was it!

_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"
Previous thread: there is a way to avoid strict libraries linking? by Leinier Cruz Salfran on Wednesday, April 14, 2010 - 9:23 am. (14 messages)

Next thread: A cookie for anyone who can solve this C/macro problem... by Lawrence Stewart on Thursday, April 15, 2010 - 6:17 am. (3 messages)