feat(ptrace): implement ptrace - #2198
Conversation
github-actions
Bot
added
enhancement
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b06e133273
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
27a3212 to
b087c14
Compare
fslongjin
left a comment
fslongjin
left a comment
There was a problem hiding this comment.
Thank you for the substantial work on this ptrace implementation. The request coverage is broad, the state/event organization is moving in a useful direction, and the latest revision fixes several issues raised on the earlier commit. I also verified that the current commit builds successfully with make kernel.
I am requesting changes because the remaining issues cross kernel security and lifetime boundaries rather than being isolated compatibility details:
- register access does not yet own a provably frozen tracee context, so GETREGS/SETREGS can race with a fatal-signal wakeup;
- the ptrace/proc-mem permission model is incomplete around dumpability and FSCREDS;
- x86 hardware breakpoints can target kernel execution and DR7 is not fully validated;
- remote writes bypass MM/page-cache dirtying;
- several new integration paths can lose syscall-stop, scheduling, or timer events, and the mm teardown path adds an O(N) process-table scan to exec/exit.
The common architectural theme is ownership. The generic ptrace layer should own tracer relationships and stop/event transitions; the scheduler should provide a frozen-context contract; the architecture backend should validate registers and user-only hardware breakpoints; and the MM layer should own remote-memory/COW/page-cache semantics. This does not require overengineering, but those boundaries need to be explicit before the feature can safely expose write/control operations.
Please also add focused regression coverage for the races and permission transitions above. The current integration run is encouraging, but PtraceTest.Int3 is still blocklisted and several YAMA/PR_SET_PTRACER cases are skipped, so the passing suite does not exercise these failure modes. Once the lifetime, permission, debug-register, and remote-MM issues are addressed, I would be happy to review the next revision.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 39b77beb4b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: aLinChe <1129332011@qq.com>
Signed-off-by: longjin <longjin@dragonos.org>
Signed-off-by: longjin <longjin@dragonos.org>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f1796ca38
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Translate the Chinese comments and human-readable string messages in the newly added or modified lines of this PR's changes into idiomatic English, so that the new change set contains no Chinese comments. Covers 56 files across the ptrace/uprobe/signal/syscall/mm/sched subsystems and their related dunitest suites. Only comment and doc text was translated; code, identifiers, and formatting are unchanged. Rust code is formatted via `make fmt`. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: longjin <longjin@dragonos.org>
Signed-off-by: longjin <longjin@dragonos.org>
Signed-off-by: longjin <longjin@dragonos.org>
Signed-off-by: longjin <longjin@dragonos.org>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6bda640eca
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: longjin <longjin@dragonos.org>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8e784b647
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: longjin <longjin@dragonos.org>
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ee3efcf1eb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: longjin <longjin@dragonos.org>
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
2 participants
Summary
This PR adds a Linux 6.6-compatible ptrace foundation to DragonOS and integrates it with signals, syscall dispatch, seccomp, process lifecycle events, wait/zombie ownership, remote memory access, x86 debug traps, and uprobes.
The implementation has been reworked from a single large ptrace file into a small set of ownership-oriented modules. It intentionally keeps one ptrace state machine, the existing scheduler state, and the existing global relation transaction lock; it does not add a second scheduler model, a generic command framework, production test hooks, or a new global sleeping lock.
Architecture
flowchart LR ABI["sys_ptrace.rs<br/>ABI dispatch"] --> OP["operation.rs<br/>generation-bound request guard"] HOOKS["signal / syscall / fork / exec / exit / seccomp"] --> CORE["ptrace/mod.rs<br/>stop and event orchestration"] CORE --> LIFE["lifecycle.rs<br/>cross-object lifecycle transactions"] CORE --> STOP["stop.rs<br/>typed stop/session state"] OP --> STOP OP --> REL["relation.rs<br/>ownership and O(1) relation index"] LIFE --> REL LIFE --> STOP OP --> REMOTE["remote_access.rs<br/>shared cross-mm access"] ABI_TYPES["abi.rs<br/>requests, options, events, syscall-info"] --> COREModule responsibilities
ptrace/abi.rsptrace/stop.rsptrace/relation.rsptrace/lifecycle.rsptrace/operation.rsPtraceRequestGuardptrace/mod.rsEach PCB embeds one
PtraceTaskownership header:PtraceRelationsowns the tracer, tracee vector, O(1) tracee slot, and monotonic session generation.PtraceStatelock owns stop, resume, pending-event, freeze, EXITKILL, and x86 debug state.PTRACE_RELATION_LOCKremains the transaction boundary for relation changes. Fallible allocations are prepared outside irq-disabled critical sections and revalidated before an infallible commit.State and lifecycle model
A scheduler stop is represented as one typed active phase:
stateDiagram-v2 [*] --> NoActiveStop NoActiveStop --> Traced: publish stop generation N Traced --> Listening: PTRACE_LISTEN Traced --> NoActiveStop: resume / detach / fatal / reset Listening --> NoActiveStop: retrap / detach / fatal / resetPending event stops, completed resume records, and request freezes are deliberately separate overlays because they can coexist with an active
TracedorListeningstop.Important lifecycle guarantees:
PtraceRequestGuardinstalls a(session_generation, stop_generation)freeze owner, rejects fatal-signal races, waits forrunning == false, and revalidates ownership before exposing a kernel-stackTrapFrame.PTRACE_O_EXITKILLis published as an irrevocable teardown verdict in the old relation transaction, preventing it from being redirected into a replacement tracing session.Disabled,NotCommitted, andCommitted, so EXEC, SECCOMP, SIGCONT, and other events cannot leak from an old tracer session into a new one.Implemented ptrace behavior
Relationships and execution control
PTRACE_TRACEME,PTRACE_ATTACH,PTRACE_SEIZE, andPTRACE_DETACHPTRACE_CONT,PTRACE_SYSCALL,PTRACE_SINGLESTEPPTRACE_SYSEMUandPTRACE_SYSEMU_SINGLESTEPPTRACE_INTERRUPT,PTRACE_LISTEN, andPTRACE_EVENT_STOPRegister, signal, and event ABI
PTRACE_GETREGS/PTRACE_SETREGSPTRACE_GETREGSET/PTRACE_SETREGSETforNT_PRSTATUSPTRACE_PEEKUSER/PTRACE_POKEUSER, including x86 DR0-DR7PTRACE_GETSIGINFO/PTRACE_SETSIGINFOPTRACE_GETSIGMASK/PTRACE_SETSIGMASKPTRACE_SETOPTIONS,PTRACE_GETEVENTMSG, andPTRACE_GET_SYSCALL_INFOSupported event options include
TRACESYSGOOD,TRACEFORK,TRACEVFORK,TRACECLONE,TRACEEXEC,TRACEVFORKDONE,TRACEEXIT,TRACESECCOMP, andEXITKILL.PTRACE_O_SUSPEND_SECCOMPis intentionally rejected withEINVALbecause DragonOS does not implement seccomp suspension.Syscall, seccomp, signal, and process lifecycle integration
TRACESYSGOOD, and syscall-info snapshots.SECCOMP_RET_TRACEuses a typed event result and reloads the syscall number plus all six arguments after a committed TRACE stop./proc/<pid>/statusreports the actual tracer TID in the reader's PID namespace.Remote memory access
AddressSpace::access_remote_vm()is the shared cross-mm engine for ptrace memory requests,/proc/<pid>/mem, andprocess_vm_readv/writev.process_vm_*respects normal VMA permissions.CAP_SYS_PTRACE, and Yama-style policy.VM_IO/VM_PFNMAP/ unsupported external-PFN mappings remain rejected; no unsafe special-VMA callback or FUSE-DAX workaround is introduced.x86_64 debug, segment, and uprobe integration
GDB validation
The original contributor's GDB validation captures are retained below as real-world debugger evidence:
Validation
All checks below apply to head
415b079254fdf6f15ee62fa753e92107f86aecdc.The gVisor ptrace blocklist is empty. The DragonOS runner declares only the verified
INT3:TRUEplatform capability, so the Int3 test executes instead of being skipped.Explicit scope limits
NT_PRSTATUSis implemented for GETREGSET/SETREGSET; FP/XSTATE regsets are future work.PTRACE_O_SUSPEND_SECCOMPis not implemented and returnsEINVAL.todo!().