trace.c revision c1aa9588f3347c285038c2e45c01bbd2e7086a9f
1#include "config.h" 2 3#include <asm/unistd.h> 4#include <sys/types.h> 5#include <sys/wait.h> 6#include <assert.h> 7#include <errno.h> 8#include <error.h> 9#include <stdio.h> 10#include <stdlib.h> 11#include <string.h> 12#include <unistd.h> 13 14#ifdef HAVE_LIBSELINUX 15# include <selinux/selinux.h> 16#endif 17 18#include "ptrace.h" 19#include "common.h" 20#include "breakpoint.h" 21#include "proc.h" 22 23/* If the system headers did not provide the constants, hard-code the normal 24 values. */ 25#ifndef PTRACE_EVENT_FORK 26 27#define PTRACE_OLDSETOPTIONS 21 28#define PTRACE_SETOPTIONS 0x4200 29#define PTRACE_GETEVENTMSG 0x4201 30 31/* options set using PTRACE_SETOPTIONS */ 32#define PTRACE_O_TRACESYSGOOD 0x00000001 33#define PTRACE_O_TRACEFORK 0x00000002 34#define PTRACE_O_TRACEVFORK 0x00000004 35#define PTRACE_O_TRACECLONE 0x00000008 36#define PTRACE_O_TRACEEXEC 0x00000010 37#define PTRACE_O_TRACEVFORKDONE 0x00000020 38#define PTRACE_O_TRACEEXIT 0x00000040 39 40/* Wait extended result codes for the above trace options. */ 41#define PTRACE_EVENT_FORK 1 42#define PTRACE_EVENT_VFORK 2 43#define PTRACE_EVENT_CLONE 3 44#define PTRACE_EVENT_EXEC 4 45#define PTRACE_EVENT_VFORK_DONE 5 46#define PTRACE_EVENT_EXIT 6 47 48#endif /* PTRACE_EVENT_FORK */ 49 50#ifdef ARCH_HAVE_UMOVELONG 51extern int arch_umovelong (Process *, void *, long *, arg_type_info *); 52int 53umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 54 return arch_umovelong (proc, addr, result, info); 55} 56#else 57/* Read a single long from the process's memory address 'addr' */ 58int 59umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 60 long pointed_to; 61 62 errno = 0; 63 pointed_to = ptrace (PTRACE_PEEKTEXT, proc->pid, addr, 0); 64 if (pointed_to == -1 && errno) 65 return -errno; 66 67 *result = pointed_to; 68 if (info) { 69 switch(info->type) { 70 case ARGTYPE_INT: 71 *result &= 0x00000000ffffffffUL; 72 default: 73 break; 74 }; 75 } 76 return 0; 77} 78#endif 79 80void 81trace_fail_warning(pid_t pid) 82{ 83 /* This was adapted from GDB. */ 84#ifdef HAVE_LIBSELINUX 85 static int checked = 0; 86 if (checked) 87 return; 88 checked = 1; 89 90 /* -1 is returned for errors, 0 if it has no effect, 1 if 91 * PTRACE_ATTACH is forbidden. */ 92 if (security_get_boolean_active("deny_ptrace") == 1) 93 fprintf(stderr, 94"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 95"tracing other processes. You can disable this process attach protection by\n" 96"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 97#endif /* HAVE_LIBSELINUX */ 98} 99 100void 101trace_me(void) 102{ 103 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 104 if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) { 105 perror("PTRACE_TRACEME"); 106 trace_fail_warning(getpid()); 107 exit(1); 108 } 109} 110 111/* There's a (hopefully) brief period of time after the child process 112 * forks when we can't trace it yet. Here we wait for kernel to 113 * prepare the process. */ 114int 115wait_for_proc(pid_t pid) 116{ 117 /* man ptrace: PTRACE_ATTACH attaches to the process specified 118 in pid. The child is sent a SIGSTOP, but will not 119 necessarily have stopped by the completion of this call; 120 use wait() to wait for the child to stop. */ 121 if (waitpid(pid, NULL, __WALL) != pid) { 122 perror ("trace_pid: waitpid"); 123 return -1; 124 } 125 126 return 0; 127} 128 129int 130trace_pid(pid_t pid) 131{ 132 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 133 /* This shouldn't emit error messages, as there are legitimate 134 * reasons that the PID can't be attached: like it may have 135 * already ended. */ 136 if (ptrace(PTRACE_ATTACH, pid, 1, 0) < 0) 137 return -1; 138 139 return wait_for_proc(pid); 140} 141 142void 143trace_set_options(Process *proc, pid_t pid) { 144 if (proc->tracesysgood & 0x80) 145 return; 146 147 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 148 149 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 150 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 151 PTRACE_O_TRACEEXEC; 152 if (ptrace(PTRACE_SETOPTIONS, pid, 0, options) < 0 && 153 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, options) < 0) { 154 perror("PTRACE_SETOPTIONS"); 155 return; 156 } 157 proc->tracesysgood |= 0x80; 158} 159 160void 161untrace_pid(pid_t pid) { 162 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 163 ptrace(PTRACE_DETACH, pid, 1, 0); 164} 165 166void 167continue_after_signal(pid_t pid, int signum) { 168 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", pid, signum); 169 ptrace(PTRACE_SYSCALL, pid, 0, signum); 170} 171 172static enum ecb_status 173event_for_pid(Event * event, void * data) 174{ 175 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 176 return ecb_yield; 177 return ecb_cont; 178} 179 180static int 181have_events_for(pid_t pid) 182{ 183 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 184} 185 186void 187continue_process(pid_t pid) 188{ 189 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 190 191 /* Only really continue the process if there are no events in 192 the queue for this process. Otherwise just wait for the 193 other events to arrive. */ 194 if (!have_events_for(pid)) 195 /* We always trace syscalls to control fork(), 196 * clone(), execve()... */ 197 ptrace(PTRACE_SYSCALL, pid, 0, 0); 198 else 199 debug(DEBUG_PROCESS, 200 "putting off the continue, events in que."); 201} 202 203/** 204 * This is used for bookkeeping related to PIDs that the event 205 * handlers work with. 206 */ 207struct pid_task { 208 pid_t pid; /* This may be 0 for tasks that exited 209 * mid-handling. */ 210 int sigstopped : 1; 211 int got_event : 1; 212 int delivered : 1; 213 int vforked : 1; 214 int sysret : 1; 215} * pids; 216 217struct pid_set { 218 struct pid_task * tasks; 219 size_t count; 220 size_t alloc; 221}; 222 223/** 224 * Breakpoint re-enablement. When we hit a breakpoint, we must 225 * disable it, single-step, and re-enable it. That single-step can be 226 * done only by one task in a task group, while others are stopped, 227 * otherwise the processes would race for who sees the breakpoint 228 * disabled and who doesn't. The following is to keep track of it 229 * all. 230 */ 231struct process_stopping_handler 232{ 233 struct event_handler super; 234 235 /* The task that is doing the re-enablement. */ 236 Process *task_enabling_breakpoint; 237 238 /* The pointer being re-enabled. */ 239 struct breakpoint *breakpoint_being_enabled; 240 241 /* Artificial atomic skip breakpoint, if any needed. */ 242 void *atomic_skip_bp_addr; 243 244 /* When all tasks are stopped, this callback gets called. */ 245 void (*on_all_stopped)(struct process_stopping_handler *); 246 247 enum { 248 /* We are waiting for everyone to land in t/T. */ 249 psh_stopping = 0, 250 251 /* We are doing the PTRACE_SINGLESTEP. */ 252 psh_singlestep, 253 254 /* We are waiting for all the SIGSTOPs to arrive so 255 * that we can sink them. */ 256 psh_sinking, 257 258 /* This is for tracking the ugly workaround. */ 259 psh_ugly_workaround, 260 } state; 261 262 int exiting; 263 264 struct pid_set pids; 265}; 266 267static struct pid_task * 268get_task_info(struct pid_set * pids, pid_t pid) 269{ 270 assert(pid != 0); 271 size_t i; 272 for (i = 0; i < pids->count; ++i) 273 if (pids->tasks[i].pid == pid) 274 return &pids->tasks[i]; 275 276 return NULL; 277} 278 279static struct pid_task * 280add_task_info(struct pid_set * pids, pid_t pid) 281{ 282 if (pids->count == pids->alloc) { 283 size_t ns = (2 * pids->alloc) ?: 4; 284 struct pid_task * n = realloc(pids->tasks, 285 sizeof(*pids->tasks) * ns); 286 if (n == NULL) 287 return NULL; 288 pids->tasks = n; 289 pids->alloc = ns; 290 } 291 struct pid_task * task_info = &pids->tasks[pids->count++]; 292 memset(task_info, 0, sizeof(*task_info)); 293 task_info->pid = pid; 294 return task_info; 295} 296 297static enum callback_status 298task_stopped(struct Process *task, void *data) 299{ 300 enum process_status st = process_status(task->pid); 301 if (data != NULL) 302 *(enum process_status *)data = st; 303 304 /* If the task is already stopped, don't worry about it. 305 * Likewise if it managed to become a zombie or terminate in 306 * the meantime. This can happen when the whole thread group 307 * is terminating. */ 308 switch (st) { 309 case ps_invalid: 310 case ps_tracing_stop: 311 case ps_zombie: 312 return CBS_CONT; 313 case ps_sleeping: 314 case ps_stop: 315 case ps_other: 316 return CBS_STOP; 317 } 318 319 abort (); 320} 321 322/* Task is blocked if it's stopped, or if it's a vfork parent. */ 323static enum callback_status 324task_blocked(struct Process *task, void *data) 325{ 326 struct pid_set * pids = data; 327 struct pid_task * task_info = get_task_info(pids, task->pid); 328 if (task_info != NULL 329 && task_info->vforked) 330 return CBS_CONT; 331 332 return task_stopped(task, NULL); 333} 334 335static Event *process_vfork_on_event(struct event_handler *super, Event *event); 336 337static enum callback_status 338task_vforked(struct Process *task, void *data) 339{ 340 if (task->event_handler != NULL 341 && task->event_handler->on_event == &process_vfork_on_event) 342 return CBS_STOP; 343 return CBS_CONT; 344} 345 346static int 347is_vfork_parent(struct Process *task) 348{ 349 return each_task(task->leader, NULL, &task_vforked, NULL) != NULL; 350} 351 352static enum callback_status 353send_sigstop(struct Process *task, void *data) 354{ 355 Process * leader = task->leader; 356 struct pid_set * pids = data; 357 358 /* Look for pre-existing task record, or add new. */ 359 struct pid_task * task_info = get_task_info(pids, task->pid); 360 if (task_info == NULL) 361 task_info = add_task_info(pids, task->pid); 362 if (task_info == NULL) { 363 perror("send_sigstop: add_task_info"); 364 destroy_event_handler(leader); 365 /* Signal failure upwards. */ 366 return CBS_STOP; 367 } 368 369 /* This task still has not been attached to. It should be 370 stopped by the kernel. */ 371 if (task->state == STATE_BEING_CREATED) 372 return CBS_CONT; 373 374 /* Don't bother sending SIGSTOP if we are already stopped, or 375 * if we sent the SIGSTOP already, which happens when we are 376 * handling "onexit" and inherited the handler from breakpoint 377 * re-enablement. */ 378 enum process_status st; 379 if (task_stopped(task, &st) == CBS_CONT) 380 return CBS_CONT; 381 if (task_info->sigstopped) { 382 if (!task_info->delivered) 383 return CBS_CONT; 384 task_info->delivered = 0; 385 } 386 387 /* Also don't attempt to stop the process if it's a parent of 388 * vforked process. We set up event handler specially to hint 389 * us. In that case parent is in D state, which we use to 390 * weed out unnecessary looping. */ 391 if (st == ps_sleeping 392 && is_vfork_parent (task)) { 393 task_info->vforked = 1; 394 return CBS_CONT; 395 } 396 397 if (task_kill(task->pid, SIGSTOP) >= 0) { 398 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 399 task_info->sigstopped = 1; 400 } else 401 fprintf(stderr, 402 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 403 404 return CBS_CONT; 405} 406 407/* On certain kernels, detaching right after a singlestep causes the 408 tracee to be killed with a SIGTRAP (that even though the singlestep 409 was properly caught by waitpid. The ugly workaround is to put a 410 breakpoint where IP points and let the process continue. After 411 this the breakpoint can be retracted and the process detached. */ 412static void 413ugly_workaround(Process * proc) 414{ 415 void * ip = get_instruction_pointer(proc); 416 struct breakpoint *sbp = dict_find_entry(proc->leader->breakpoints, ip); 417 if (sbp != NULL) 418 enable_breakpoint(proc, sbp); 419 else 420 insert_breakpoint(proc, ip, NULL, 1); 421 ptrace(PTRACE_CONT, proc->pid, 0, 0); 422} 423 424static void 425process_stopping_done(struct process_stopping_handler * self, Process * leader) 426{ 427 debug(DEBUG_PROCESS, "process stopping done %d", 428 self->task_enabling_breakpoint->pid); 429 size_t i; 430 if (!self->exiting) { 431 for (i = 0; i < self->pids.count; ++i) 432 if (self->pids.tasks[i].pid != 0 433 && (self->pids.tasks[i].delivered 434 || self->pids.tasks[i].sysret)) 435 continue_process(self->pids.tasks[i].pid); 436 continue_process(self->task_enabling_breakpoint->pid); 437 destroy_event_handler(leader); 438 } else { 439 self->state = psh_ugly_workaround; 440 ugly_workaround(self->task_enabling_breakpoint); 441 } 442} 443 444/* Before we detach, we need to make sure that task's IP is on the 445 * edge of an instruction. So for tasks that have a breakpoint event 446 * in the queue, we adjust the instruction pointer, just like 447 * continue_after_breakpoint does. */ 448static enum ecb_status 449undo_breakpoint(Event * event, void * data) 450{ 451 if (event != NULL 452 && event->proc->leader == data 453 && event->type == EVENT_BREAKPOINT) 454 set_instruction_pointer(event->proc, event->e_un.brk_addr); 455 return ecb_cont; 456} 457 458static enum callback_status 459untrace_task(struct Process *task, void *data) 460{ 461 if (task != data) 462 untrace_pid(task->pid); 463 return CBS_CONT; 464} 465 466static enum callback_status 467remove_task(struct Process *task, void *data) 468{ 469 /* Don't untrace leader just yet. */ 470 if (task != data) 471 remove_process(task); 472 return CBS_CONT; 473} 474 475static void 476detach_process(Process * leader) 477{ 478 each_qd_event(&undo_breakpoint, leader); 479 disable_all_breakpoints(leader); 480 481 /* Now untrace the process, if it was attached to by -p. */ 482 struct opt_p_t * it; 483 for (it = opt_p; it != NULL; it = it->next) { 484 Process * proc = pid2proc(it->pid); 485 if (proc == NULL) 486 continue; 487 if (proc->leader == leader) { 488 each_task(leader, NULL, &untrace_task, NULL); 489 break; 490 } 491 } 492 each_task(leader, NULL, &remove_task, leader); 493 destroy_event_handler(leader); 494 remove_task(leader, NULL); 495} 496 497static void 498handle_stopping_event(struct pid_task * task_info, Event ** eventp) 499{ 500 /* Mark all events, so that we know whom to SIGCONT later. */ 501 if (task_info != NULL) 502 task_info->got_event = 1; 503 504 Event * event = *eventp; 505 506 /* In every state, sink SIGSTOP events for tasks that it was 507 * sent to. */ 508 if (task_info != NULL 509 && event->type == EVENT_SIGNAL 510 && event->e_un.signum == SIGSTOP) { 511 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 512 if (task_info->sigstopped 513 && !task_info->delivered) { 514 task_info->delivered = 1; 515 *eventp = NULL; // sink the event 516 } else 517 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 518 "sigstopped=%d and delivered=%d\n", 519 task_info->pid, task_info->sigstopped, 520 task_info->delivered); 521 } 522} 523 524/* Some SIGSTOPs may have not been delivered to their respective tasks 525 * yet. They are still in the queue. If we have seen an event for 526 * that process, continue it, so that the SIGSTOP can be delivered and 527 * caught by ltrace. We don't mind that the process is after 528 * breakpoint (and therefore potentially doesn't have aligned IP), 529 * because the signal will be delivered without the process actually 530 * starting. */ 531static void 532continue_for_sigstop_delivery(struct pid_set * pids) 533{ 534 size_t i; 535 for (i = 0; i < pids->count; ++i) { 536 if (pids->tasks[i].pid != 0 537 && pids->tasks[i].sigstopped 538 && !pids->tasks[i].delivered 539 && pids->tasks[i].got_event) { 540 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 541 pids->tasks[i].pid); 542 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 543 } 544 } 545} 546 547static int 548event_exit_p(Event * event) 549{ 550 return event != NULL && (event->type == EVENT_EXIT 551 || event->type == EVENT_EXIT_SIGNAL); 552} 553 554static int 555event_exit_or_none_p(Event * event) 556{ 557 return event == NULL || event_exit_p(event) 558 || event->type == EVENT_NONE; 559} 560 561static int 562await_sigstop_delivery(struct pid_set * pids, struct pid_task * task_info, 563 Event * event) 564{ 565 /* If we still didn't get our SIGSTOP, continue the process 566 * and carry on. */ 567 if (event != NULL && !event_exit_or_none_p(event) 568 && task_info != NULL && task_info->sigstopped) { 569 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 570 task_info->pid); 571 /* We should get the signal the first thing 572 * after this, so it should be OK to continue 573 * even if we are over a breakpoint. */ 574 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 575 576 } else { 577 /* If all SIGSTOPs were delivered, uninstall the 578 * handler and continue everyone. */ 579 /* XXX I suspect that we should check tasks that are 580 * still around. Is things are now, there should be a 581 * race between waiting for everyone to stop and one 582 * of the tasks exiting. */ 583 int all_clear = 1; 584 size_t i; 585 for (i = 0; i < pids->count; ++i) 586 if (pids->tasks[i].pid != 0 587 && pids->tasks[i].sigstopped 588 && !pids->tasks[i].delivered) { 589 all_clear = 0; 590 break; 591 } 592 return all_clear; 593 } 594 595 return 0; 596} 597 598static int 599all_stops_accountable(struct pid_set * pids) 600{ 601 size_t i; 602 for (i = 0; i < pids->count; ++i) 603 if (pids->tasks[i].pid != 0 604 && !pids->tasks[i].got_event 605 && !have_events_for(pids->tasks[i].pid)) 606 return 0; 607 return 1; 608} 609 610/* The protocol is: 0 for success, negative for failure, positive if 611 * default singlestep is to be used. */ 612int arch_atomic_singlestep(struct Process *proc, Breakpoint *sbp, 613 int (*add_cb)(void *addr, void *data), 614 void *add_cb_data); 615 616#ifndef ARCH_HAVE_ATOMIC_SINGLESTEP 617int 618arch_atomic_singlestep(struct Process *proc, Breakpoint *sbp, 619 int (*add_cb)(void *addr, void *data), 620 void *add_cb_data) 621{ 622 return 1; 623} 624#endif 625 626static int 627atomic_singlestep_add_bp(void *addr, void *data) 628{ 629 struct process_stopping_handler *self = data; 630 struct Process *proc = self->task_enabling_breakpoint; 631 632 /* Only support single address as of now. */ 633 assert(self->atomic_skip_bp_addr == NULL); 634 635 self->atomic_skip_bp_addr = addr + 4; 636 insert_breakpoint(proc->leader, self->atomic_skip_bp_addr, NULL, 1); 637 638 return 0; 639} 640 641static int 642singlestep(struct process_stopping_handler *self) 643{ 644 struct Process *proc = self->task_enabling_breakpoint; 645 646 int status = arch_atomic_singlestep(self->task_enabling_breakpoint, 647 self->breakpoint_being_enabled, 648 &atomic_singlestep_add_bp, self); 649 650 /* Propagate failure and success. */ 651 if (status <= 0) 652 return status; 653 654 /* Otherwise do the default action: singlestep. */ 655 debug(1, "PTRACE_SINGLESTEP"); 656 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) { 657 perror("PTRACE_SINGLESTEP"); 658 return -1; 659 } 660 return 0; 661} 662 663static void 664post_singlestep(struct process_stopping_handler *self, Event **eventp) 665{ 666 continue_for_sigstop_delivery(&self->pids); 667 668 if ((*eventp)->type == EVENT_BREAKPOINT) 669 *eventp = NULL; // handled 670 671 if (self->atomic_skip_bp_addr != 0) 672 delete_breakpoint(self->task_enabling_breakpoint->leader, 673 self->atomic_skip_bp_addr); 674 675 self->breakpoint_being_enabled = NULL; 676} 677 678static void 679singlestep_error(struct process_stopping_handler *self, Event **eventp) 680{ 681 struct Process *teb = self->task_enabling_breakpoint; 682 Breakpoint *sbp = self->breakpoint_being_enabled; 683 fprintf(stderr, "%d couldn't singlestep over %s (%p)\n", 684 teb->pid, sbp->libsym != NULL ? sbp->libsym->name : NULL, 685 sbp->addr); 686 delete_breakpoint(teb->leader, sbp->addr); 687 post_singlestep(self, eventp); 688} 689 690static void 691disable_and_singlestep(struct process_stopping_handler *self) 692{ 693 struct Process *teb = self->task_enabling_breakpoint; 694 debug(DEBUG_PROCESS, "all stopped, now SINGLESTEP %d", teb->pid); 695 if (self->breakpoint_being_enabled->enabled) 696 disable_breakpoint(teb, self->breakpoint_being_enabled); 697 if (singlestep(self) < 0) { 698 singlestep_error(self, &event); 699 //goto psh_sinking; /* XXX FIME */ 700 abort(); 701 } 702 self->state = psh_singlestep; 703} 704 705/* This event handler is installed when we are in the process of 706 * stopping the whole thread group to do the pointer re-enablement for 707 * one of the threads. We pump all events to the queue for later 708 * processing while we wait for all the threads to stop. When this 709 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 710 * re-enable, and continue everyone. */ 711static Event * 712process_stopping_on_event(struct event_handler *super, Event *event) 713{ 714 struct process_stopping_handler * self = (void *)super; 715 Process * task = event->proc; 716 Process * leader = task->leader; 717 Process * teb = self->task_enabling_breakpoint; 718 719 debug(DEBUG_PROCESS, 720 "pid %d; event type %d; state %d", 721 task->pid, event->type, self->state); 722 723 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 724 if (task_info == NULL) 725 fprintf(stderr, "new task??? %d\n", task->pid); 726 handle_stopping_event(task_info, &event); 727 728 int state = self->state; 729 int event_to_queue = !event_exit_or_none_p(event); 730 731 /* Deactivate the entry if the task exits. */ 732 if (event_exit_p(event) && task_info != NULL) 733 task_info->pid = 0; 734 735 /* Always handle sysrets. Whether sysret occurred and what 736 * sys it rets from may need to be determined based on process 737 * stack, so we need to keep that in sync with reality. Note 738 * that we don't continue the process after the sysret is 739 * handled. See continue_after_syscall. */ 740 if (event != NULL && event->type == EVENT_SYSRET) { 741 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 742 event_to_queue = 0; 743 task_info->sysret = 1; 744 } 745 746 switch (state) { 747 case psh_stopping: 748 /* If everyone is stopped, singlestep. */ 749 if (each_task(leader, NULL, &task_blocked, 750 &self->pids) == NULL) { 751 (self->on_all_stopped)(self); 752 state = self->state; 753 } 754 break; 755 756 case psh_singlestep: 757 /* In singlestep state, breakpoint signifies that we 758 * have now stepped, and can re-enable the breakpoint. */ 759 if (event != NULL && task == teb) { 760 761 /* This is not the singlestep that we are 762 * waiting for. */ 763 if (event->type == EVENT_SIGNAL) { 764 if (singlestep(self) < 0) { 765 singlestep_error(self, &event); 766 goto psh_sinking; 767 } 768 break; 769 } 770 771 /* Essentially we don't care what event caused 772 * the thread to stop. We can do the 773 * re-enablement now. */ 774 struct breakpoint *sbp = self->breakpoint_being_enabled; 775 if (sbp->enabled) 776 enable_breakpoint(teb, sbp); 777 778 post_singlestep(self, &event); 779 goto psh_sinking; 780 } 781 break; 782 783 psh_sinking: 784 state = self->state = psh_sinking; 785 case psh_sinking: 786 if (await_sigstop_delivery(&self->pids, task_info, event)) 787 process_stopping_done(self, leader); 788 break; 789 790 case psh_ugly_workaround: 791 if (event == NULL) 792 break; 793 if (event->type == EVENT_BREAKPOINT) { 794 undo_breakpoint(event, leader); 795 if (task == teb) 796 self->task_enabling_breakpoint = NULL; 797 } 798 if (self->task_enabling_breakpoint == NULL 799 && all_stops_accountable(&self->pids)) { 800 undo_breakpoint(event, leader); 801 detach_process(leader); 802 event = NULL; // handled 803 } 804 } 805 806 if (event != NULL && event_to_queue) { 807 enque_event(event); 808 event = NULL; // sink the event 809 } 810 811 return event; 812} 813 814static void 815process_stopping_destroy(struct event_handler *super) 816{ 817 struct process_stopping_handler * self = (void *)super; 818 free(self->pids.tasks); 819} 820 821int 822process_install_stopping_handler(struct Process *proc, struct breakpoint *sbp, 823 void (*cb)(struct process_stopping_handler *)) 824{ 825 struct process_stopping_handler *handler = calloc(sizeof(*handler), 1); 826 if (handler == NULL) 827 return -1; 828 829 handler->super.on_event = process_stopping_on_event; 830 handler->super.destroy = process_stopping_destroy; 831 handler->task_enabling_breakpoint = proc; 832 handler->breakpoint_being_enabled = sbp; 833 handler->on_all_stopped = cb; 834 835 install_event_handler(proc->leader, &handler->super); 836 837 if (each_task(proc->leader, NULL, &send_sigstop, 838 &handler->pids) != NULL) { 839 destroy_event_handler(proc); 840 return -1; 841 } 842 843 /* And deliver the first fake event, in case all the 844 * conditions are already fulfilled. */ 845 Event ev = { 846 .type = EVENT_NONE, 847 .proc = proc, 848 }; 849 process_stopping_on_event(&handler->super, &ev); 850 851 return 0; 852} 853 854void 855continue_after_breakpoint(Process *proc, struct breakpoint *sbp) 856{ 857 set_instruction_pointer(proc, sbp->addr); 858 859 if (sbp->enabled == 0) { 860 continue_process(proc->pid); 861 } else { 862 debug(DEBUG_PROCESS, 863 "continue_after_breakpoint: pid=%d, addr=%p", 864 proc->pid, sbp->addr); 865#if defined __sparc__ || defined __ia64___ || defined __mips__ 866 /* we don't want to singlestep here */ 867 continue_process(proc->pid); 868#else 869 if (process_install_stopping_handler 870 (proc, sbp, &disable_and_singlestep) < 0) { 871 perror("process_stopping_handler_create"); 872 /* Carry on not bothering to re-enable. */ 873 continue_process(proc->pid); 874 } 875#endif 876 } 877} 878 879/** 880 * Ltrace exit. When we are about to exit, we have to go through all 881 * the processes, stop them all, remove all the breakpoints, and then 882 * detach the processes that we attached to using -p. If we left the 883 * other tasks running, they might hit stray return breakpoints and 884 * produce artifacts, so we better stop everyone, even if it's a bit 885 * of extra work. 886 */ 887struct ltrace_exiting_handler 888{ 889 struct event_handler super; 890 struct pid_set pids; 891}; 892 893static Event * 894ltrace_exiting_on_event(struct event_handler *super, Event *event) 895{ 896 struct ltrace_exiting_handler * self = (void *)super; 897 Process * task = event->proc; 898 Process * leader = task->leader; 899 900 debug(DEBUG_PROCESS, "pid %d; event type %d", task->pid, event->type); 901 902 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 903 handle_stopping_event(task_info, &event); 904 905 if (event != NULL && event->type == EVENT_BREAKPOINT) 906 undo_breakpoint(event, leader); 907 908 if (await_sigstop_delivery(&self->pids, task_info, event) 909 && all_stops_accountable(&self->pids)) 910 detach_process(leader); 911 912 /* Sink all non-exit events. We are about to exit, so we 913 * don't bother with queuing them. */ 914 if (event_exit_or_none_p(event)) 915 return event; 916 917 return NULL; 918} 919 920static void 921ltrace_exiting_destroy(struct event_handler *super) 922{ 923 struct ltrace_exiting_handler * self = (void *)super; 924 free(self->pids.tasks); 925} 926 927static int 928ltrace_exiting_install_handler(Process * proc) 929{ 930 /* Only install to leader. */ 931 if (proc->leader != proc) 932 return 0; 933 934 /* Perhaps we are already installed, if the user passed 935 * several -p options that are tasks of one process. */ 936 if (proc->event_handler != NULL 937 && proc->event_handler->on_event == <race_exiting_on_event) 938 return 0; 939 940 /* If stopping handler is already present, let it do the 941 * work. */ 942 if (proc->event_handler != NULL) { 943 assert(proc->event_handler->on_event 944 == &process_stopping_on_event); 945 struct process_stopping_handler * other 946 = (void *)proc->event_handler; 947 other->exiting = 1; 948 return 0; 949 } 950 951 struct ltrace_exiting_handler * handler 952 = calloc(sizeof(*handler), 1); 953 if (handler == NULL) { 954 perror("malloc exiting handler"); 955 fatal: 956 /* XXXXXXXXXXXXXXXXXXX fixme */ 957 return -1; 958 } 959 960 handler->super.on_event = ltrace_exiting_on_event; 961 handler->super.destroy = ltrace_exiting_destroy; 962 install_event_handler(proc->leader, &handler->super); 963 964 if (each_task(proc->leader, NULL, &send_sigstop, 965 &handler->pids) != NULL) 966 goto fatal; 967 968 return 0; 969} 970 971/* 972 * When the traced process vforks, it's suspended until the child 973 * process calls _exit or exec*. In the meantime, the two share the 974 * address space. 975 * 976 * The child process should only ever call _exit or exec*, but we 977 * can't count on that (it's not the role of ltrace to policy, but to 978 * observe). In any case, we will _at least_ have to deal with 979 * removal of vfork return breakpoint (which we have to smuggle back 980 * in, so that the parent can see it, too), and introduction of exec* 981 * return breakpoint. Since we already have both breakpoint actions 982 * to deal with, we might as well support it all. 983 * 984 * The gist is that we pretend that the child is in a thread group 985 * with its parent, and handle it as a multi-threaded case, with the 986 * exception that we know that the parent is blocked, and don't 987 * attempt to stop it. When the child execs, we undo the setup. 988 */ 989 990struct process_vfork_handler 991{ 992 struct event_handler super; 993 void * bp_addr; 994}; 995 996static Event * 997process_vfork_on_event(struct event_handler *super, Event *event) 998{ 999 struct process_vfork_handler * self = (void *)super; 1000 struct breakpoint *sbp; 1001 assert(self != NULL); 1002 1003 switch (event->type) { 1004 case EVENT_BREAKPOINT: 1005 /* Remember the vfork return breakpoint. */ 1006 if (self->bp_addr == NULL) 1007 self->bp_addr = event->e_un.brk_addr; 1008 break; 1009 1010 case EVENT_EXIT: 1011 case EVENT_EXIT_SIGNAL: 1012 case EVENT_EXEC: 1013 /* Smuggle back in the vfork return breakpoint, so 1014 * that our parent can trip over it once again. */ 1015 if (self->bp_addr != NULL) { 1016 sbp = dict_find_entry(event->proc->leader->breakpoints, 1017 self->bp_addr); 1018 if (sbp != NULL) 1019 insert_breakpoint(event->proc->parent, 1020 self->bp_addr, 1021 sbp->libsym, 1); 1022 } 1023 1024 continue_process(event->proc->parent->pid); 1025 1026 /* Remove the leader that we artificially set up 1027 * earlier. */ 1028 change_process_leader(event->proc, event->proc); 1029 destroy_event_handler(event->proc); 1030 1031 default: 1032 ; 1033 } 1034 1035 return event; 1036} 1037 1038void 1039continue_after_vfork(Process * proc) 1040{ 1041 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 1042 struct process_vfork_handler * handler = calloc(sizeof(*handler), 1); 1043 if (handler == NULL) { 1044 perror("malloc vfork handler"); 1045 /* Carry on not bothering to treat the process as 1046 * necessary. */ 1047 continue_process(proc->parent->pid); 1048 return; 1049 } 1050 1051 /* We must set up custom event handler, so that we see 1052 * exec/exit events for the task itself. */ 1053 handler->super.on_event = process_vfork_on_event; 1054 install_event_handler(proc, &handler->super); 1055 1056 /* Make sure that the child is sole thread. */ 1057 assert(proc->leader == proc); 1058 assert(proc->next == NULL || proc->next->leader != proc); 1059 1060 /* Make sure that the child's parent is properly set up. */ 1061 assert(proc->parent != NULL); 1062 assert(proc->parent->leader != NULL); 1063 1064 change_process_leader(proc, proc->parent->leader); 1065} 1066 1067static int 1068is_mid_stopping(Process *proc) 1069{ 1070 return proc != NULL 1071 && proc->event_handler != NULL 1072 && proc->event_handler->on_event == &process_stopping_on_event; 1073} 1074 1075void 1076continue_after_syscall(Process * proc, int sysnum, int ret_p) 1077{ 1078 /* Don't continue if we are mid-stopping. */ 1079 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 1080 debug(DEBUG_PROCESS, 1081 "continue_after_syscall: don't continue %d", 1082 proc->pid); 1083 return; 1084 } 1085 continue_process(proc->pid); 1086} 1087 1088/* If ltrace gets SIGINT, the processes directly or indirectly run by 1089 * ltrace get it too. We just have to wait long enough for the signal 1090 * to be delivered and the process terminated, which we notice and 1091 * exit ltrace, too. So there's not much we need to do there. We 1092 * want to keep tracing those processes as usual, in case they just 1093 * SIG_IGN the SIGINT to do their shutdown etc. 1094 * 1095 * For processes ran on the background, we want to install an exit 1096 * handler that stops all the threads, removes all breakpoints, and 1097 * detaches. 1098 */ 1099void 1100os_ltrace_exiting(void) 1101{ 1102 struct opt_p_t * it; 1103 for (it = opt_p; it != NULL; it = it->next) { 1104 Process * proc = pid2proc(it->pid); 1105 if (proc == NULL || proc->leader == NULL) 1106 continue; 1107 if (ltrace_exiting_install_handler(proc->leader) < 0) 1108 fprintf(stderr, 1109 "Couldn't install exiting handler for %d.\n", 1110 proc->pid); 1111 } 1112} 1113 1114int 1115os_ltrace_exiting_sighandler(void) 1116{ 1117 extern int linux_in_waitpid; 1118 if (linux_in_waitpid) { 1119 os_ltrace_exiting(); 1120 return 1; 1121 } 1122 return 0; 1123} 1124 1125size_t 1126umovebytes(Process *proc, void *addr, void *laddr, size_t len) { 1127 1128 union { 1129 long a; 1130 char c[sizeof(long)]; 1131 } a; 1132 int started = 0; 1133 size_t offset = 0, bytes_read = 0; 1134 1135 while (offset < len) { 1136 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1137 if (a.a == -1 && errno) { 1138 if (started && errno == EIO) 1139 return bytes_read; 1140 else 1141 return -1; 1142 } 1143 started = 1; 1144 1145 if (len - offset >= sizeof(long)) { 1146 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1147 bytes_read += sizeof(long); 1148 } 1149 else { 1150 memcpy(laddr + offset, &a.c[0], len - offset); 1151 bytes_read += (len - offset); 1152 } 1153 offset += sizeof(long); 1154 } 1155 1156 return bytes_read; 1157} 1158 1159/* Read a series of bytes starting at the process's memory address 1160 'addr' and continuing until a NUL ('\0') is seen or 'len' bytes 1161 have been read. 1162*/ 1163int 1164umovestr(Process *proc, void *addr, int len, void *laddr) { 1165 union { 1166 long a; 1167 char c[sizeof(long)]; 1168 } a; 1169 unsigned i; 1170 int offset = 0; 1171 1172 while (offset < len) { 1173 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1174 for (i = 0; i < sizeof(long); i++) { 1175 if (a.c[i] && offset + (signed)i < len) { 1176 *(char *)(laddr + offset + i) = a.c[i]; 1177 } else { 1178 *(char *)(laddr + offset + i) = '\0'; 1179 return 0; 1180 } 1181 } 1182 offset += sizeof(long); 1183 } 1184 *(char *)(laddr + offset) = '\0'; 1185 return 0; 1186} 1187