debuggerd.c revision 144773f9e1371a8d4b848c3136b931d5d0687b38 
1/* system/debuggerd/debuggerd.c
2**
3** Copyright 2006, The Android Open Source Project
4**
5** Licensed under the Apache License, Version 2.0 (the "License");
6** you may not use this file except in compliance with the License.
7** You may obtain a copy of the License at
8**
9**     http://www.apache.org/licenses/LICENSE-2.0
10**
11** Unless required by applicable law or agreed to in writing, software
12** distributed under the License is distributed on an "AS IS" BASIS,
13** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14** See the License for the specific language governing permissions and
15** limitations under the License.
16*/
17
18#include <stdio.h>
19#include <errno.h>
20#include <signal.h>
21#include <pthread.h>
22#include <stdarg.h>
23#include <fcntl.h>
24#include <sys/types.h>
25#include <dirent.h>
26
27#include <sys/ptrace.h>
28#include <sys/wait.h>
29#include <sys/exec_elf.h>
30#include <sys/stat.h>
31
32#include <cutils/sockets.h>
33#include <cutils/logd.h>
34#include <cutils/properties.h>
35
36#include <linux/input.h>
37
38#include <private/android_filesystem_config.h>
39
40#include "debuggerd.h"
41#include "utility.h"
42
43#define ANDROID_LOG_INFO 4
44
45/* Log information onto the tombstone */
46void _LOG(int tfd, bool in_tombstone_only, const char *fmt, ...)
47{
48    char buf[512];
49
50    va_list ap;
51    va_start(ap, fmt);
52
53    if (tfd >= 0) {
54        int len;
55        vsnprintf(buf, sizeof(buf), fmt, ap);
56        len = strlen(buf);
57        if(tfd >= 0) write(tfd, buf, len);
58    }
59
60    if (!in_tombstone_only)
61        __android_log_vprint(ANDROID_LOG_INFO, "DEBUG", fmt, ap);
62}
63
64// 6f000000-6f01e000 rwxp 00000000 00:0c 16389419   /system/lib/libcomposer.so
65// 012345678901234567890123456789012345678901234567890123456789
66// 0         1         2         3         4         5
67
68mapinfo *parse_maps_line(char *line)
69{
70    mapinfo *mi;
71    int len = strlen(line);
72
73    if(len < 1) return 0;
74    line[--len] = 0;
75
76    if(len < 50) return 0;
77    if(line[20] != 'x') return 0;
78
79    mi = malloc(sizeof(mapinfo) + (len - 47));
80    if(mi == 0) return 0;
81
82    mi->start = strtoul(line, 0, 16);
83    mi->end = strtoul(line + 9, 0, 16);
84    /* To be filled in parse_elf_info if the mapped section starts with
85     * elf_header
86     */
87    mi->exidx_start = mi->exidx_end = 0;
88    mi->symbols = 0;
89    mi->next = 0;
90    strcpy(mi->name, line + 49);
91
92    return mi;
93}
94
95void dump_build_info(int tfd)
96{
97    char fingerprint[PROPERTY_VALUE_MAX];
98
99    property_get("ro.build.fingerprint", fingerprint, "unknown");
100
101    _LOG(tfd, false, "Build fingerprint: '%s'\n", fingerprint);
102}
103
104const char *get_signame(int sig)
105{
106    switch(sig) {
107    case SIGILL:     return "SIGILL";
108    case SIGABRT:    return "SIGABRT";
109    case SIGBUS:     return "SIGBUS";
110    case SIGFPE:     return "SIGFPE";
111    case SIGSEGV:    return "SIGSEGV";
112    case SIGSTKFLT:  return "SIGSTKFLT";
113    default:         return "?";
114    }
115}
116
117const char *get_sigcode(int signo, int code)
118{
119    switch (signo) {
120    case SIGILL:
121        switch (code) {
122        case ILL_ILLOPC: return "ILL_ILLOPC";
123        case ILL_ILLOPN: return "ILL_ILLOPN";
124        case ILL_ILLADR: return "ILL_ILLADR";
125        case ILL_ILLTRP: return "ILL_ILLTRP";
126        case ILL_PRVOPC: return "ILL_PRVOPC";
127        case ILL_PRVREG: return "ILL_PRVREG";
128        case ILL_COPROC: return "ILL_COPROC";
129        case ILL_BADSTK: return "ILL_BADSTK";
130        }
131        break;
132    case SIGBUS:
133        switch (code) {
134        case BUS_ADRALN: return "BUS_ADRALN";
135        case BUS_ADRERR: return "BUS_ADRERR";
136        case BUS_OBJERR: return "BUS_OBJERR";
137        }
138        break;
139    case SIGFPE:
140        switch (code) {
141        case FPE_INTDIV: return "FPE_INTDIV";
142        case FPE_INTOVF: return "FPE_INTOVF";
143        case FPE_FLTDIV: return "FPE_FLTDIV";
144        case FPE_FLTOVF: return "FPE_FLTOVF";
145        case FPE_FLTUND: return "FPE_FLTUND";
146        case FPE_FLTRES: return "FPE_FLTRES";
147        case FPE_FLTINV: return "FPE_FLTINV";
148        case FPE_FLTSUB: return "FPE_FLTSUB";
149        }
150        break;
151    case SIGSEGV:
152        switch (code) {
153        case SEGV_MAPERR: return "SEGV_MAPERR";
154        case SEGV_ACCERR: return "SEGV_ACCERR";
155        }
156        break;
157    }
158    return "?";
159}
160
161void dump_fault_addr(int tfd, int pid, int sig)
162{
163    siginfo_t si;
164
165    memset(&si, 0, sizeof(si));
166    if(ptrace(PTRACE_GETSIGINFO, pid, 0, &si)){
167        _LOG(tfd, false, "cannot get siginfo: %s\n", strerror(errno));
168    } else {
169        _LOG(tfd, false, "signal %d (%s), code %d (%s), fault addr %08x\n",
170             sig, get_signame(sig),
171             si.si_code, get_sigcode(sig, si.si_code),
172             si.si_addr);
173    }
174}
175
176void dump_crash_banner(int tfd, unsigned pid, unsigned tid, int sig)
177{
178    char data[1024];
179    char *x = 0;
180    FILE *fp;
181
182    sprintf(data, "/proc/%d/cmdline", pid);
183    fp = fopen(data, "r");
184    if(fp) {
185        x = fgets(data, 1024, fp);
186        fclose(fp);
187    }
188
189    _LOG(tfd, false,
190         "*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n");
191    dump_build_info(tfd);
192    _LOG(tfd, false, "pid: %d, tid: %d  >>> %s <<<\n",
193         pid, tid, x ? x : "UNKNOWN");
194
195    if(sig) dump_fault_addr(tfd, tid, sig);
196}
197
198static void parse_elf_info(mapinfo *milist, pid_t pid)
199{
200    mapinfo *mi;
201    for (mi = milist; mi != NULL; mi = mi->next) {
202        Elf32_Ehdr ehdr;
203
204        memset(&ehdr, 0, sizeof(Elf32_Ehdr));
205        /* Read in sizeof(Elf32_Ehdr) worth of data from the beginning of
206         * mapped section.
207         */
208        get_remote_struct(pid, (void *) (mi->start), &ehdr,
209                          sizeof(Elf32_Ehdr));
210        /* Check if it has the matching magic words */
211        if (IS_ELF(ehdr)) {
212            Elf32_Phdr phdr;
213            Elf32_Phdr *ptr;
214            int i;
215
216            ptr = (Elf32_Phdr *) (mi->start + ehdr.e_phoff);
217            for (i = 0; i < ehdr.e_phnum; i++) {
218                /* Parse the program header */
219                get_remote_struct(pid, (char *) (ptr+i), &phdr,
220                                  sizeof(Elf32_Phdr));
221#ifdef __arm__
222                /* Found a EXIDX segment? */
223                if (phdr.p_type == PT_ARM_EXIDX) {
224                    mi->exidx_start = mi->start + phdr.p_offset;
225                    mi->exidx_end = mi->exidx_start + phdr.p_filesz;
226                    break;
227                }
228#endif
229            }
230
231            /* Try to load symbols from this file */
232            mi->symbols = symbol_table_create(mi->name);
233        }
234    }
235}
236
237void dump_crash_report(int tfd, unsigned pid, unsigned tid, bool at_fault)
238{
239    char data[1024];
240    FILE *fp;
241    mapinfo *milist = 0;
242    unsigned int sp_list[STACK_CONTENT_DEPTH];
243    int stack_depth;
244#ifdef __arm__
245    int frame0_pc_sane = 1;
246#endif
247
248    if (!at_fault) {
249        _LOG(tfd, true,
250         "--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---\n");
251        _LOG(tfd, true, "pid: %d, tid: %d\n", pid, tid);
252    }
253
254    dump_registers(tfd, tid, at_fault);
255
256    /* Clear stack pointer records */
257    memset(sp_list, 0, sizeof(sp_list));
258
259    sprintf(data, "/proc/%d/maps", pid);
260    fp = fopen(data, "r");
261    if(fp) {
262        while(fgets(data, 1024, fp)) {
263            mapinfo *mi = parse_maps_line(data);
264            if(mi) {
265                mi->next = milist;
266                milist = mi;
267            }
268        }
269        fclose(fp);
270    }
271
272    parse_elf_info(milist, tid);
273
274#if __arm__
275    /* If stack unwinder fails, use the default solution to dump the stack
276     * content.
277     */
278    stack_depth = unwind_backtrace_with_ptrace(tfd, tid, milist, sp_list,
279                                               &frame0_pc_sane, at_fault);
280
281    /* The stack unwinder should at least unwind two levels of stack. If less
282     * level is seen we make sure at lease pc and lr are dumped.
283     */
284    if (stack_depth < 2) {
285        dump_pc_and_lr(tfd, tid, milist, stack_depth, at_fault);
286    }
287
288    dump_stack_and_code(tfd, tid, milist, stack_depth, sp_list, at_fault);
289#endif
290
291    while(milist) {
292        mapinfo *next = milist->next;
293        symbol_table_free(milist->symbols);
294        free(milist);
295        milist = next;
296    }
297}
298
299#define MAX_TOMBSTONES	10
300
301#define typecheck(x,y) {    \
302    typeof(x) __dummy1;     \
303    typeof(y) __dummy2;     \
304    (void)(&__dummy1 == &__dummy2); }
305
306#define TOMBSTONE_DIR	"/data/tombstones"
307
308/*
309 * find_and_open_tombstone - find an available tombstone slot, if any, of the
310 * form tombstone_XX where XX is 00 to MAX_TOMBSTONES-1, inclusive. If no
311 * file is available, we reuse the least-recently-modified file.
312 */
313static int find_and_open_tombstone(void)
314{
315    unsigned long mtime = ULONG_MAX;
316    struct stat sb;
317    char path[128];
318    int fd, i, oldest = 0;
319
320    /*
321     * XXX: Our stat.st_mtime isn't time_t. If it changes, as it probably ought
322     * to, our logic breaks. This check will generate a warning if that happens.
323     */
324    typecheck(mtime, sb.st_mtime);
325
326    /*
327     * In a single wolf-like pass, find an available slot and, in case none
328     * exist, find and record the least-recently-modified file.
329     */
330    for (i = 0; i < MAX_TOMBSTONES; i++) {
331        snprintf(path, sizeof(path), TOMBSTONE_DIR"/tombstone_%02d", i);
332
333        if (!stat(path, &sb)) {
334            if (sb.st_mtime < mtime) {
335                oldest = i;
336                mtime = sb.st_mtime;
337            }
338            continue;
339        }
340        if (errno != ENOENT)
341            continue;
342
343        fd = open(path, O_CREAT | O_EXCL | O_WRONLY, 0600);
344        if (fd < 0)
345            continue;	/* raced ? */
346
347        fchown(fd, AID_SYSTEM, AID_SYSTEM);
348        return fd;
349    }
350
351    /* we didn't find an available file, so we clobber the oldest one */
352    snprintf(path, sizeof(path), TOMBSTONE_DIR"/tombstone_%02d", oldest);
353    fd = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0600);
354    fchown(fd, AID_SYSTEM, AID_SYSTEM);
355
356    return fd;
357}
358
359/* Return true if some thread is not detached cleanly */
360static bool dump_sibling_thread_report(int tfd, unsigned pid, unsigned tid)
361{
362    char task_path[1024];
363
364    sprintf(task_path, "/proc/%d/task", pid);
365    DIR *d;
366    struct dirent *de;
367    int need_cleanup = 0;
368
369    d = opendir(task_path);
370    /* Bail early if cannot open the task directory */
371    if (d == NULL) {
372        XLOG("Cannot open /proc/%d/task\n", pid);
373        return false;
374    }
375    while ((de = readdir(d)) != NULL) {
376        unsigned new_tid;
377        /* Ignore "." and ".." */
378        if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, ".."))
379            continue;
380        new_tid = atoi(de->d_name);
381        /* The main thread at fault has been handled individually */
382        if (new_tid == tid)
383            continue;
384
385        /* Skip this thread if cannot ptrace it */
386        if (ptrace(PTRACE_ATTACH, new_tid, 0, 0) < 0)
387            continue;
388
389        dump_crash_report(tfd, pid, new_tid, false);
390        need_cleanup |= ptrace(PTRACE_DETACH, new_tid, 0, 0);
391    }
392    closedir(d);
393    return need_cleanup != 0;
394}
395
396/* Return true if some thread is not detached cleanly */
397static bool engrave_tombstone(unsigned pid, unsigned tid, int debug_uid,
398                              int signal)
399{
400    int fd;
401    bool need_cleanup = false;
402
403    mkdir(TOMBSTONE_DIR, 0755);
404    chown(TOMBSTONE_DIR, AID_SYSTEM, AID_SYSTEM);
405
406    fd = find_and_open_tombstone();
407    if (fd < 0)
408        return need_cleanup;
409
410    dump_crash_banner(fd, pid, tid, signal);
411    dump_crash_report(fd, pid, tid, true);
412    /*
413     * If the user has requested to attach gdb, don't collect the per-thread
414     * information as it increases the chance to lose track of the process.
415     */
416    if ((signed)pid > debug_uid) {
417        need_cleanup = dump_sibling_thread_report(fd, pid, tid);
418    }
419
420    close(fd);
421    return need_cleanup;
422}
423
424static int
425write_string(const char* file, const char* string)
426{
427    int len;
428    int fd;
429    ssize_t amt;
430    fd = open(file, O_RDWR);
431    len = strlen(string);
432    if (fd < 0)
433        return -errno;
434    amt = write(fd, string, len);
435    close(fd);
436    return amt >= 0 ? 0 : -errno;
437}
438
439static
440void init_debug_led(void)
441{
442    // trout leds
443    write_string("/sys/class/leds/red/brightness", "0");
444    write_string("/sys/class/leds/green/brightness", "0");
445    write_string("/sys/class/leds/blue/brightness", "0");
446    write_string("/sys/class/leds/red/device/blink", "0");
447    // sardine leds
448    write_string("/sys/class/leds/left/cadence", "0,0");
449}
450
451static
452void enable_debug_led(void)
453{
454    // trout leds
455    write_string("/sys/class/leds/red/brightness", "255");
456    // sardine leds
457    write_string("/sys/class/leds/left/cadence", "1,0");
458}
459
460static
461void disable_debug_led(void)
462{
463    // trout leds
464    write_string("/sys/class/leds/red/brightness", "0");
465    // sardine leds
466    write_string("/sys/class/leds/left/cadence", "0,0");
467}
468
469extern int init_getevent();
470extern void uninit_getevent();
471extern int get_event(struct input_event* event, int timeout);
472
473static void wait_for_user_action(unsigned tid, struct ucred* cr)
474{
475    (void)tid;
476    /* First log a helpful message */
477    LOG(    "********************************************************\n"
478            "* Process %d has been suspended while crashing.  To\n"
479            "* attach gdbserver for a gdb connection on port 5039:\n"
480            "*\n"
481            "*     adb shell gdbserver :5039 --attach %d &\n"
482            "*\n"
483            "* Press HOME key to let the process continue crashing.\n"
484            "********************************************************\n",
485            cr->pid, cr->pid);
486
487    /* wait for HOME key (TODO: something useful for devices w/o HOME key) */
488    if (init_getevent() == 0) {
489        int ms = 1200 / 10;
490        int dit = 1;
491        int dah = 3*dit;
492        int _       = -dit;
493        int ___     = 3*_;
494        int _______ = 7*_;
495        const signed char codes[] = {
496           dit,_,dit,_,dit,___,dah,_,dah,_,dah,___,dit,_,dit,_,dit,_______
497        };
498        size_t s = 0;
499        struct input_event e;
500        int home = 0;
501        init_debug_led();
502        enable_debug_led();
503        do {
504            int timeout = abs((int)(codes[s])) * ms;
505            int res = get_event(&e, timeout);
506            if (res == 0) {
507                if (e.type==EV_KEY && e.code==KEY_HOME && e.value==0)
508                    home = 1;
509            } else if (res == 1) {
510                if (++s >= sizeof(codes)/sizeof(*codes))
511                    s = 0;
512                if (codes[s] > 0) {
513                    enable_debug_led();
514                } else {
515                    disable_debug_led();
516                }
517            }
518        } while (!home);
519        uninit_getevent();
520    }
521
522    /* don't forget to turn debug led off */
523    disable_debug_led();
524
525    /* close filedescriptor */
526    LOG("debuggerd resuming process %d", cr->pid);
527 }
528
529static void handle_crashing_process(int fd)
530{
531    char buf[64];
532    struct stat s;
533    unsigned tid;
534    struct ucred cr;
535    int n, len, status;
536    int tid_attach_status = -1;
537    unsigned retry = 30;
538    bool need_cleanup = false;
539
540    char value[PROPERTY_VALUE_MAX];
541    property_get("debug.db.uid", value, "-1");
542    int debug_uid = atoi(value);
543
544    XLOG("handle_crashing_process(%d)\n", fd);
545
546    len = sizeof(cr);
547    n = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &cr, &len);
548    if(n != 0) {
549        LOG("cannot get credentials\n");
550        goto done;
551    }
552
553    XLOG("reading tid\n");
554    fcntl(fd, F_SETFL, O_NONBLOCK);
555    while((n = read(fd, &tid, sizeof(unsigned))) != sizeof(unsigned)) {
556        if(errno == EINTR) continue;
557        if(errno == EWOULDBLOCK) {
558            if(retry-- > 0) {
559                usleep(100 * 1000);
560                continue;
561            }
562            LOG("timed out reading tid\n");
563            goto done;
564        }
565        LOG("read failure? %s\n", strerror(errno));
566        goto done;
567    }
568
569    sprintf(buf,"/proc/%d/task/%d", cr.pid, tid);
570    if(stat(buf, &s)) {
571        LOG("tid %d does not exist in pid %d. ignoring debug request\n",
572            tid, cr.pid);
573        close(fd);
574        return;
575    }
576
577    XLOG("BOOM: pid=%d uid=%d gid=%d tid=%d\n", cr.pid, cr.uid, cr.gid, tid);
578
579    tid_attach_status = ptrace(PTRACE_ATTACH, tid, 0, 0);
580    if(tid_attach_status < 0) {
581        LOG("ptrace attach failed: %s\n", strerror(errno));
582        goto done;
583    }
584
585    close(fd);
586    fd = -1;
587
588    for(;;) {
589        n = waitpid(tid, &status, __WALL);
590
591        if(n < 0) {
592            if(errno == EAGAIN) continue;
593            LOG("waitpid failed: %s\n", strerror(errno));
594            goto done;
595        }
596
597        XLOG("waitpid: n=%d status=%08x\n", n, status);
598
599        if(WIFSTOPPED(status)){
600            n = WSTOPSIG(status);
601            switch(n) {
602            case SIGSTOP:
603                XLOG("stopped -- continuing\n");
604                n = ptrace(PTRACE_CONT, tid, 0, 0);
605                if(n) {
606                    LOG("ptrace failed: %s\n", strerror(errno));
607                    goto done;
608                }
609                continue;
610
611            case SIGILL:
612            case SIGABRT:
613            case SIGBUS:
614            case SIGFPE:
615            case SIGSEGV:
616            case SIGSTKFLT: {
617                XLOG("stopped -- fatal signal\n");
618                need_cleanup = engrave_tombstone(cr.pid, tid, debug_uid, n);
619                kill(tid, SIGSTOP);
620                goto done;
621            }
622
623            default:
624                XLOG("stopped -- unexpected signal\n");
625                goto done;
626            }
627        } else {
628            XLOG("unexpected waitpid response\n");
629            goto done;
630        }
631    }
632
633done:
634    XLOG("detaching\n");
635
636    /* stop the process so we can debug */
637    kill(cr.pid, SIGSTOP);
638
639    /*
640     * If a thread has been attached by ptrace, make sure it is detached
641     * successfully otherwise we will get a zombie.
642     */
643    if (tid_attach_status == 0) {
644        int detach_status;
645        /* detach so we can attach gdbserver */
646        detach_status = ptrace(PTRACE_DETACH, tid, 0, 0);
647        need_cleanup |= (detach_status != 0);
648    }
649
650    /*
651     * if debug.db.uid is set, its value indicates if we should wait
652     * for user action for the crashing process.
653     * in this case, we log a message and turn the debug LED on
654     * waiting for a gdb connection (for instance)
655     */
656
657    if ((signed)cr.uid <= debug_uid) {
658        wait_for_user_action(tid, &cr);
659    }
660
661    /* resume stopped process (so it can crash in peace) */
662    kill(cr.pid, SIGCONT);
663
664    if (need_cleanup) {
665        LOG("debuggerd committing suicide to free the zombie!\n");
666        kill(getpid(), SIGKILL);
667    }
668
669    if(fd != -1) close(fd);
670}
671
672
673int main()
674{
675    int s;
676    struct sigaction act;
677    int logsocket = -1;
678
679    logsocket = socket_local_client("logd",
680            ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_DGRAM);
681    if(logsocket < 0) {
682        logsocket = -1;
683    } else {
684        fcntl(logsocket, F_SETFD, FD_CLOEXEC);
685    }
686
687    act.sa_handler = SIG_DFL;
688    sigemptyset(&act.sa_mask);
689    sigaddset(&act.sa_mask,SIGCHLD);
690    act.sa_flags = SA_NOCLDWAIT;
691    sigaction(SIGCHLD, &act, 0);
692
693    s = socket_local_server("android:debuggerd",
694            ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM);
695    if(s < 0) return -1;
696    fcntl(s, F_SETFD, FD_CLOEXEC);
697
698    LOG("debuggerd: " __DATE__ " " __TIME__ "\n");
699
700    for(;;) {
701        struct sockaddr addr;
702        socklen_t alen;
703        int fd;
704
705        alen = sizeof(addr);
706        fd = accept(s, &addr, &alen);
707        if(fd < 0) continue;
708
709        fcntl(fd, F_SETFD, FD_CLOEXEC);
710
711        handle_crashing_process(fd);
712    }
713    return 0;
714}
715