trace.c revision 36f40e7d46838ec41ea03a2b9b748536d8fd57e2
1#include "config.h" 2 3#include <asm/unistd.h> 4#include <sys/types.h> 5#include <sys/wait.h> 6#include <assert.h> 7#include <errno.h> 8#include <error.h> 9#include <stdio.h> 10#include <stdlib.h> 11#include <string.h> 12#include <unistd.h> 13 14#ifdef HAVE_LIBSELINUX 15# include <selinux/selinux.h> 16#endif 17 18#include "ptrace.h" 19#include "common.h" 20#include "breakpoint.h" 21#include "proc.h" 22#include "linux-gnu/trace.h" 23 24/* If the system headers did not provide the constants, hard-code the normal 25 values. */ 26#ifndef PTRACE_EVENT_FORK 27 28#define PTRACE_OLDSETOPTIONS 21 29#define PTRACE_SETOPTIONS 0x4200 30#define PTRACE_GETEVENTMSG 0x4201 31 32/* options set using PTRACE_SETOPTIONS */ 33#define PTRACE_O_TRACESYSGOOD 0x00000001 34#define PTRACE_O_TRACEFORK 0x00000002 35#define PTRACE_O_TRACEVFORK 0x00000004 36#define PTRACE_O_TRACECLONE 0x00000008 37#define PTRACE_O_TRACEEXEC 0x00000010 38#define PTRACE_O_TRACEVFORKDONE 0x00000020 39#define PTRACE_O_TRACEEXIT 0x00000040 40 41/* Wait extended result codes for the above trace options. */ 42#define PTRACE_EVENT_FORK 1 43#define PTRACE_EVENT_VFORK 2 44#define PTRACE_EVENT_CLONE 3 45#define PTRACE_EVENT_EXEC 4 46#define PTRACE_EVENT_VFORK_DONE 5 47#define PTRACE_EVENT_EXIT 6 48 49#endif /* PTRACE_EVENT_FORK */ 50 51#ifdef ARCH_HAVE_UMOVELONG 52extern int arch_umovelong (Process *, void *, long *, arg_type_info *); 53int 54umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 55 return arch_umovelong (proc, addr, result, info); 56} 57#else 58/* Read a single long from the process's memory address 'addr' */ 59int 60umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 61 long pointed_to; 62 63 errno = 0; 64 pointed_to = ptrace (PTRACE_PEEKTEXT, proc->pid, addr, 0); 65 if (pointed_to == -1 && errno) 66 return -errno; 67 68 *result = pointed_to; 69 if (info) { 70 switch(info->type) { 71 case ARGTYPE_INT: 72 *result &= 0x00000000ffffffffUL; 73 default: 74 break; 75 }; 76 } 77 return 0; 78} 79#endif 80 81void 82trace_fail_warning(pid_t pid) 83{ 84 /* This was adapted from GDB. */ 85#ifdef HAVE_LIBSELINUX 86 static int checked = 0; 87 if (checked) 88 return; 89 checked = 1; 90 91 /* -1 is returned for errors, 0 if it has no effect, 1 if 92 * PTRACE_ATTACH is forbidden. */ 93 if (security_get_boolean_active("deny_ptrace") == 1) 94 fprintf(stderr, 95"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 96"tracing other processes. You can disable this process attach protection by\n" 97"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 98#endif /* HAVE_LIBSELINUX */ 99} 100 101void 102trace_me(void) 103{ 104 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 105 if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) { 106 perror("PTRACE_TRACEME"); 107 trace_fail_warning(getpid()); 108 exit(1); 109 } 110} 111 112/* There's a (hopefully) brief period of time after the child process 113 * forks when we can't trace it yet. Here we wait for kernel to 114 * prepare the process. */ 115int 116wait_for_proc(pid_t pid) 117{ 118 /* man ptrace: PTRACE_ATTACH attaches to the process specified 119 in pid. The child is sent a SIGSTOP, but will not 120 necessarily have stopped by the completion of this call; 121 use wait() to wait for the child to stop. */ 122 if (waitpid(pid, NULL, __WALL) != pid) { 123 perror ("trace_pid: waitpid"); 124 return -1; 125 } 126 127 return 0; 128} 129 130int 131trace_pid(pid_t pid) 132{ 133 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 134 /* This shouldn't emit error messages, as there are legitimate 135 * reasons that the PID can't be attached: like it may have 136 * already ended. */ 137 if (ptrace(PTRACE_ATTACH, pid, 1, 0) < 0) 138 return -1; 139 140 return wait_for_proc(pid); 141} 142 143void 144trace_set_options(Process *proc, pid_t pid) { 145 if (proc->tracesysgood & 0x80) 146 return; 147 148 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 149 150 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 151 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 152 PTRACE_O_TRACEEXEC; 153 if (ptrace(PTRACE_SETOPTIONS, pid, 0, options) < 0 && 154 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, options) < 0) { 155 perror("PTRACE_SETOPTIONS"); 156 return; 157 } 158 proc->tracesysgood |= 0x80; 159} 160 161void 162untrace_pid(pid_t pid) { 163 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 164 ptrace(PTRACE_DETACH, pid, 1, 0); 165} 166 167void 168continue_after_signal(pid_t pid, int signum) { 169 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", pid, signum); 170 ptrace(PTRACE_SYSCALL, pid, 0, signum); 171} 172 173static enum ecb_status 174event_for_pid(Event * event, void * data) 175{ 176 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 177 return ecb_yield; 178 return ecb_cont; 179} 180 181static int 182have_events_for(pid_t pid) 183{ 184 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 185} 186 187void 188continue_process(pid_t pid) 189{ 190 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 191 192 /* Only really continue the process if there are no events in 193 the queue for this process. Otherwise just wait for the 194 other events to arrive. */ 195 if (!have_events_for(pid)) 196 /* We always trace syscalls to control fork(), 197 * clone(), execve()... */ 198 ptrace(PTRACE_SYSCALL, pid, 0, 0); 199 else 200 debug(DEBUG_PROCESS, 201 "putting off the continue, events in que."); 202} 203 204static struct pid_task * 205get_task_info(struct pid_set * pids, pid_t pid) 206{ 207 assert(pid != 0); 208 size_t i; 209 for (i = 0; i < pids->count; ++i) 210 if (pids->tasks[i].pid == pid) 211 return &pids->tasks[i]; 212 213 return NULL; 214} 215 216static struct pid_task * 217add_task_info(struct pid_set * pids, pid_t pid) 218{ 219 if (pids->count == pids->alloc) { 220 size_t ns = (2 * pids->alloc) ?: 4; 221 struct pid_task * n = realloc(pids->tasks, 222 sizeof(*pids->tasks) * ns); 223 if (n == NULL) 224 return NULL; 225 pids->tasks = n; 226 pids->alloc = ns; 227 } 228 struct pid_task * task_info = &pids->tasks[pids->count++]; 229 memset(task_info, 0, sizeof(*task_info)); 230 task_info->pid = pid; 231 return task_info; 232} 233 234static enum callback_status 235task_stopped(struct Process *task, void *data) 236{ 237 enum process_status st = process_status(task->pid); 238 if (data != NULL) 239 *(enum process_status *)data = st; 240 241 /* If the task is already stopped, don't worry about it. 242 * Likewise if it managed to become a zombie or terminate in 243 * the meantime. This can happen when the whole thread group 244 * is terminating. */ 245 switch (st) { 246 case ps_invalid: 247 case ps_tracing_stop: 248 case ps_zombie: 249 return CBS_CONT; 250 case ps_sleeping: 251 case ps_stop: 252 case ps_other: 253 return CBS_STOP; 254 } 255 256 abort (); 257} 258 259/* Task is blocked if it's stopped, or if it's a vfork parent. */ 260static enum callback_status 261task_blocked(struct Process *task, void *data) 262{ 263 struct pid_set * pids = data; 264 struct pid_task * task_info = get_task_info(pids, task->pid); 265 if (task_info != NULL 266 && task_info->vforked) 267 return CBS_CONT; 268 269 return task_stopped(task, NULL); 270} 271 272static Event *process_vfork_on_event(struct event_handler *super, Event *event); 273 274static enum callback_status 275task_vforked(struct Process *task, void *data) 276{ 277 if (task->event_handler != NULL 278 && task->event_handler->on_event == &process_vfork_on_event) 279 return CBS_STOP; 280 return CBS_CONT; 281} 282 283static int 284is_vfork_parent(struct Process *task) 285{ 286 return each_task(task->leader, NULL, &task_vforked, NULL) != NULL; 287} 288 289static enum callback_status 290send_sigstop(struct Process *task, void *data) 291{ 292 Process * leader = task->leader; 293 struct pid_set * pids = data; 294 295 /* Look for pre-existing task record, or add new. */ 296 struct pid_task * task_info = get_task_info(pids, task->pid); 297 if (task_info == NULL) 298 task_info = add_task_info(pids, task->pid); 299 if (task_info == NULL) { 300 perror("send_sigstop: add_task_info"); 301 destroy_event_handler(leader); 302 /* Signal failure upwards. */ 303 return CBS_STOP; 304 } 305 306 /* This task still has not been attached to. It should be 307 stopped by the kernel. */ 308 if (task->state == STATE_BEING_CREATED) 309 return CBS_CONT; 310 311 /* Don't bother sending SIGSTOP if we are already stopped, or 312 * if we sent the SIGSTOP already, which happens when we are 313 * handling "onexit" and inherited the handler from breakpoint 314 * re-enablement. */ 315 enum process_status st; 316 if (task_stopped(task, &st) == CBS_CONT) 317 return CBS_CONT; 318 if (task_info->sigstopped) { 319 if (!task_info->delivered) 320 return CBS_CONT; 321 task_info->delivered = 0; 322 } 323 324 /* Also don't attempt to stop the process if it's a parent of 325 * vforked process. We set up event handler specially to hint 326 * us. In that case parent is in D state, which we use to 327 * weed out unnecessary looping. */ 328 if (st == ps_sleeping 329 && is_vfork_parent (task)) { 330 task_info->vforked = 1; 331 return CBS_CONT; 332 } 333 334 if (task_kill(task->pid, SIGSTOP) >= 0) { 335 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 336 task_info->sigstopped = 1; 337 } else 338 fprintf(stderr, 339 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 340 341 return CBS_CONT; 342} 343 344/* On certain kernels, detaching right after a singlestep causes the 345 tracee to be killed with a SIGTRAP (that even though the singlestep 346 was properly caught by waitpid. The ugly workaround is to put a 347 breakpoint where IP points and let the process continue. After 348 this the breakpoint can be retracted and the process detached. */ 349static void 350ugly_workaround(Process * proc) 351{ 352 void * ip = get_instruction_pointer(proc); 353 struct breakpoint *sbp = dict_find_entry(proc->leader->breakpoints, ip); 354 if (sbp != NULL) 355 enable_breakpoint(proc, sbp); 356 else 357 insert_breakpoint(proc, ip, NULL, 1); 358 ptrace(PTRACE_CONT, proc->pid, 0, 0); 359} 360 361static void 362process_stopping_done(struct process_stopping_handler * self, Process * leader) 363{ 364 debug(DEBUG_PROCESS, "process stopping done %d", 365 self->task_enabling_breakpoint->pid); 366 size_t i; 367 if (!self->exiting) { 368 for (i = 0; i < self->pids.count; ++i) 369 if (self->pids.tasks[i].pid != 0 370 && (self->pids.tasks[i].delivered 371 || self->pids.tasks[i].sysret)) 372 continue_process(self->pids.tasks[i].pid); 373 continue_process(self->task_enabling_breakpoint->pid); 374 destroy_event_handler(leader); 375 } else { 376 self->state = psh_ugly_workaround; 377 ugly_workaround(self->task_enabling_breakpoint); 378 } 379} 380 381/* Before we detach, we need to make sure that task's IP is on the 382 * edge of an instruction. So for tasks that have a breakpoint event 383 * in the queue, we adjust the instruction pointer, just like 384 * continue_after_breakpoint does. */ 385static enum ecb_status 386undo_breakpoint(Event * event, void * data) 387{ 388 if (event != NULL 389 && event->proc->leader == data 390 && event->type == EVENT_BREAKPOINT) 391 set_instruction_pointer(event->proc, event->e_un.brk_addr); 392 return ecb_cont; 393} 394 395static enum callback_status 396untrace_task(struct Process *task, void *data) 397{ 398 if (task != data) 399 untrace_pid(task->pid); 400 return CBS_CONT; 401} 402 403static enum callback_status 404remove_task(struct Process *task, void *data) 405{ 406 /* Don't untrace leader just yet. */ 407 if (task != data) 408 remove_process(task); 409 return CBS_CONT; 410} 411 412static void 413detach_process(Process * leader) 414{ 415 each_qd_event(&undo_breakpoint, leader); 416 disable_all_breakpoints(leader); 417 418 /* Now untrace the process, if it was attached to by -p. */ 419 struct opt_p_t * it; 420 for (it = opt_p; it != NULL; it = it->next) { 421 Process * proc = pid2proc(it->pid); 422 if (proc == NULL) 423 continue; 424 if (proc->leader == leader) { 425 each_task(leader, NULL, &untrace_task, NULL); 426 break; 427 } 428 } 429 each_task(leader, NULL, &remove_task, leader); 430 destroy_event_handler(leader); 431 remove_task(leader, NULL); 432} 433 434static void 435handle_stopping_event(struct pid_task * task_info, Event ** eventp) 436{ 437 /* Mark all events, so that we know whom to SIGCONT later. */ 438 if (task_info != NULL) 439 task_info->got_event = 1; 440 441 Event * event = *eventp; 442 443 /* In every state, sink SIGSTOP events for tasks that it was 444 * sent to. */ 445 if (task_info != NULL 446 && event->type == EVENT_SIGNAL 447 && event->e_un.signum == SIGSTOP) { 448 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 449 if (task_info->sigstopped 450 && !task_info->delivered) { 451 task_info->delivered = 1; 452 *eventp = NULL; // sink the event 453 } else 454 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 455 "sigstopped=%d and delivered=%d\n", 456 task_info->pid, task_info->sigstopped, 457 task_info->delivered); 458 } 459} 460 461/* Some SIGSTOPs may have not been delivered to their respective tasks 462 * yet. They are still in the queue. If we have seen an event for 463 * that process, continue it, so that the SIGSTOP can be delivered and 464 * caught by ltrace. We don't mind that the process is after 465 * breakpoint (and therefore potentially doesn't have aligned IP), 466 * because the signal will be delivered without the process actually 467 * starting. */ 468static void 469continue_for_sigstop_delivery(struct pid_set * pids) 470{ 471 size_t i; 472 for (i = 0; i < pids->count; ++i) { 473 if (pids->tasks[i].pid != 0 474 && pids->tasks[i].sigstopped 475 && !pids->tasks[i].delivered 476 && pids->tasks[i].got_event) { 477 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 478 pids->tasks[i].pid); 479 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 480 } 481 } 482} 483 484static int 485event_exit_p(Event * event) 486{ 487 return event != NULL && (event->type == EVENT_EXIT 488 || event->type == EVENT_EXIT_SIGNAL); 489} 490 491static int 492event_exit_or_none_p(Event * event) 493{ 494 return event == NULL || event_exit_p(event) 495 || event->type == EVENT_NONE; 496} 497 498static int 499await_sigstop_delivery(struct pid_set * pids, struct pid_task * task_info, 500 Event * event) 501{ 502 /* If we still didn't get our SIGSTOP, continue the process 503 * and carry on. */ 504 if (event != NULL && !event_exit_or_none_p(event) 505 && task_info != NULL && task_info->sigstopped) { 506 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 507 task_info->pid); 508 /* We should get the signal the first thing 509 * after this, so it should be OK to continue 510 * even if we are over a breakpoint. */ 511 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 512 513 } else { 514 /* If all SIGSTOPs were delivered, uninstall the 515 * handler and continue everyone. */ 516 /* XXX I suspect that we should check tasks that are 517 * still around. Is things are now, there should be a 518 * race between waiting for everyone to stop and one 519 * of the tasks exiting. */ 520 int all_clear = 1; 521 size_t i; 522 for (i = 0; i < pids->count; ++i) 523 if (pids->tasks[i].pid != 0 524 && pids->tasks[i].sigstopped 525 && !pids->tasks[i].delivered) { 526 all_clear = 0; 527 break; 528 } 529 return all_clear; 530 } 531 532 return 0; 533} 534 535static int 536all_stops_accountable(struct pid_set * pids) 537{ 538 size_t i; 539 for (i = 0; i < pids->count; ++i) 540 if (pids->tasks[i].pid != 0 541 && !pids->tasks[i].got_event 542 && !have_events_for(pids->tasks[i].pid)) 543 return 0; 544 return 1; 545} 546 547/* The protocol is: 0 for success, negative for failure, positive if 548 * default singlestep is to be used. */ 549int arch_atomic_singlestep(struct Process *proc, Breakpoint *sbp, 550 int (*add_cb)(void *addr, void *data), 551 void *add_cb_data); 552 553#ifndef ARCH_HAVE_ATOMIC_SINGLESTEP 554int 555arch_atomic_singlestep(struct Process *proc, Breakpoint *sbp, 556 int (*add_cb)(void *addr, void *data), 557 void *add_cb_data) 558{ 559 return 1; 560} 561#endif 562 563static int 564atomic_singlestep_add_bp(void *addr, void *data) 565{ 566 struct process_stopping_handler *self = data; 567 struct Process *proc = self->task_enabling_breakpoint; 568 569 /* Only support single address as of now. */ 570 assert(self->atomic_skip_bp_addr == NULL); 571 572 self->atomic_skip_bp_addr = addr + 4; 573 insert_breakpoint(proc->leader, self->atomic_skip_bp_addr, NULL, 1); 574 575 return 0; 576} 577 578static int 579singlestep(struct process_stopping_handler *self) 580{ 581 struct Process *proc = self->task_enabling_breakpoint; 582 583 int status = arch_atomic_singlestep(self->task_enabling_breakpoint, 584 self->breakpoint_being_enabled, 585 &atomic_singlestep_add_bp, self); 586 587 /* Propagate failure and success. */ 588 if (status <= 0) 589 return status; 590 591 /* Otherwise do the default action: singlestep. */ 592 debug(1, "PTRACE_SINGLESTEP"); 593 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) { 594 perror("PTRACE_SINGLESTEP"); 595 return -1; 596 } 597 return 0; 598} 599 600static void 601post_singlestep(struct process_stopping_handler *self, Event **eventp) 602{ 603 continue_for_sigstop_delivery(&self->pids); 604 605 if ((*eventp)->type == EVENT_BREAKPOINT) 606 *eventp = NULL; // handled 607 608 if (self->atomic_skip_bp_addr != 0) 609 delete_breakpoint(self->task_enabling_breakpoint->leader, 610 self->atomic_skip_bp_addr); 611 612 self->breakpoint_being_enabled = NULL; 613} 614 615static void 616singlestep_error(struct process_stopping_handler *self, Event **eventp) 617{ 618 struct Process *teb = self->task_enabling_breakpoint; 619 Breakpoint *sbp = self->breakpoint_being_enabled; 620 fprintf(stderr, "%d couldn't singlestep over %s (%p)\n", 621 teb->pid, sbp->libsym != NULL ? sbp->libsym->name : NULL, 622 sbp->addr); 623 delete_breakpoint(teb->leader, sbp->addr); 624 post_singlestep(self, eventp); 625} 626 627static void 628disable_and_singlestep(struct process_stopping_handler *self) 629{ 630 struct Process *teb = self->task_enabling_breakpoint; 631 debug(DEBUG_PROCESS, "all stopped, now SINGLESTEP %d", teb->pid); 632 if (self->breakpoint_being_enabled->enabled) 633 disable_breakpoint(teb, self->breakpoint_being_enabled); 634 if (singlestep(self) < 0) { 635 singlestep_error(self, &event); 636 //goto psh_sinking; /* XXX FIME */ 637 abort(); 638 } 639 self->state = psh_singlestep; 640} 641 642/* This event handler is installed when we are in the process of 643 * stopping the whole thread group to do the pointer re-enablement for 644 * one of the threads. We pump all events to the queue for later 645 * processing while we wait for all the threads to stop. When this 646 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 647 * re-enable, and continue everyone. */ 648static Event * 649process_stopping_on_event(struct event_handler *super, Event *event) 650{ 651 struct process_stopping_handler * self = (void *)super; 652 Process * task = event->proc; 653 Process * leader = task->leader; 654 Process * teb = self->task_enabling_breakpoint; 655 656 debug(DEBUG_PROCESS, 657 "pid %d; event type %d; state %d", 658 task->pid, event->type, self->state); 659 660 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 661 if (task_info == NULL) 662 fprintf(stderr, "new task??? %d\n", task->pid); 663 handle_stopping_event(task_info, &event); 664 665 int state = self->state; 666 int event_to_queue = !event_exit_or_none_p(event); 667 668 /* Deactivate the entry if the task exits. */ 669 if (event_exit_p(event) && task_info != NULL) 670 task_info->pid = 0; 671 672 /* Always handle sysrets. Whether sysret occurred and what 673 * sys it rets from may need to be determined based on process 674 * stack, so we need to keep that in sync with reality. Note 675 * that we don't continue the process after the sysret is 676 * handled. See continue_after_syscall. */ 677 if (event != NULL && event->type == EVENT_SYSRET) { 678 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 679 event_to_queue = 0; 680 task_info->sysret = 1; 681 } 682 683 switch (state) { 684 case psh_stopping: 685 /* If everyone is stopped, singlestep. */ 686 if (each_task(leader, NULL, &task_blocked, 687 &self->pids) == NULL) { 688 (self->on_all_stopped)(self); 689 state = self->state; 690 } 691 break; 692 693 case psh_singlestep: 694 /* In singlestep state, breakpoint signifies that we 695 * have now stepped, and can re-enable the breakpoint. */ 696 if (event != NULL && task == teb) { 697 698 /* If we got SIGNAL instead of BREAKPOINT, 699 * then this is not singlestep at all. */ 700 if (event->type == EVENT_SIGNAL 701 || (self->keep_stepping_p)(self)) { 702 if (singlestep(self) < 0) { 703 singlestep_error(self, &event); 704 goto psh_sinking; 705 } 706 break; 707 } 708 709 /* Essentially we don't care what event caused 710 * the thread to stop. We can do the 711 * re-enablement now. */ 712 struct breakpoint *sbp = self->breakpoint_being_enabled; 713 if (sbp->enabled) 714 enable_breakpoint(teb, sbp); 715 716 post_singlestep(self, &event); 717 goto psh_sinking; 718 } 719 break; 720 721 psh_sinking: 722 state = self->state = psh_sinking; 723 case psh_sinking: 724 if (await_sigstop_delivery(&self->pids, task_info, event)) 725 process_stopping_done(self, leader); 726 break; 727 728 case psh_ugly_workaround: 729 if (event == NULL) 730 break; 731 if (event->type == EVENT_BREAKPOINT) { 732 undo_breakpoint(event, leader); 733 if (task == teb) 734 self->task_enabling_breakpoint = NULL; 735 } 736 if (self->task_enabling_breakpoint == NULL 737 && all_stops_accountable(&self->pids)) { 738 undo_breakpoint(event, leader); 739 detach_process(leader); 740 event = NULL; // handled 741 } 742 } 743 744 if (event != NULL && event_to_queue) { 745 enque_event(event); 746 event = NULL; // sink the event 747 } 748 749 return event; 750} 751 752static void 753process_stopping_destroy(struct event_handler *super) 754{ 755 struct process_stopping_handler * self = (void *)super; 756 free(self->pids.tasks); 757} 758 759static enum callback_status 760no(struct process_stopping_handler *self) 761{ 762 return 0; 763} 764 765int 766process_install_stopping_handler(struct Process *proc, struct breakpoint *sbp, 767 void (*as)(struct process_stopping_handler *), 768 enum callback_status (*ks) 769 (struct process_stopping_handler *)) 770{ 771 struct process_stopping_handler *handler = calloc(sizeof(*handler), 1); 772 if (handler == NULL) 773 return -1; 774 775 if (as == NULL) 776 as = &disable_and_singlestep; 777 if (ks == NULL) 778 ks = &no; 779 780 handler->super.on_event = process_stopping_on_event; 781 handler->super.destroy = process_stopping_destroy; 782 handler->task_enabling_breakpoint = proc; 783 handler->breakpoint_being_enabled = sbp; 784 handler->on_all_stopped = as; 785 handler->keep_stepping_p = ks; 786 787 install_event_handler(proc->leader, &handler->super); 788 789 if (each_task(proc->leader, NULL, &send_sigstop, 790 &handler->pids) != NULL) { 791 destroy_event_handler(proc); 792 return -1; 793 } 794 795 /* And deliver the first fake event, in case all the 796 * conditions are already fulfilled. */ 797 Event ev = { 798 .type = EVENT_NONE, 799 .proc = proc, 800 }; 801 process_stopping_on_event(&handler->super, &ev); 802 803 return 0; 804} 805 806void 807continue_after_breakpoint(Process *proc, struct breakpoint *sbp) 808{ 809 set_instruction_pointer(proc, sbp->addr); 810 811 if (sbp->enabled == 0) { 812 continue_process(proc->pid); 813 } else { 814 debug(DEBUG_PROCESS, 815 "continue_after_breakpoint: pid=%d, addr=%p", 816 proc->pid, sbp->addr); 817#if defined __sparc__ || defined __ia64___ || defined __mips__ 818 /* we don't want to singlestep here */ 819 continue_process(proc->pid); 820#else 821 if (process_install_stopping_handler(proc, sbp, 822 NULL, NULL) < 0) { 823 perror("process_stopping_handler_create"); 824 /* Carry on not bothering to re-enable. */ 825 continue_process(proc->pid); 826 } 827#endif 828 } 829} 830 831/** 832 * Ltrace exit. When we are about to exit, we have to go through all 833 * the processes, stop them all, remove all the breakpoints, and then 834 * detach the processes that we attached to using -p. If we left the 835 * other tasks running, they might hit stray return breakpoints and 836 * produce artifacts, so we better stop everyone, even if it's a bit 837 * of extra work. 838 */ 839struct ltrace_exiting_handler 840{ 841 struct event_handler super; 842 struct pid_set pids; 843}; 844 845static Event * 846ltrace_exiting_on_event(struct event_handler *super, Event *event) 847{ 848 struct ltrace_exiting_handler * self = (void *)super; 849 Process * task = event->proc; 850 Process * leader = task->leader; 851 852 debug(DEBUG_PROCESS, "pid %d; event type %d", task->pid, event->type); 853 854 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 855 handle_stopping_event(task_info, &event); 856 857 if (event != NULL && event->type == EVENT_BREAKPOINT) 858 undo_breakpoint(event, leader); 859 860 if (await_sigstop_delivery(&self->pids, task_info, event) 861 && all_stops_accountable(&self->pids)) 862 detach_process(leader); 863 864 /* Sink all non-exit events. We are about to exit, so we 865 * don't bother with queuing them. */ 866 if (event_exit_or_none_p(event)) 867 return event; 868 869 return NULL; 870} 871 872static void 873ltrace_exiting_destroy(struct event_handler *super) 874{ 875 struct ltrace_exiting_handler * self = (void *)super; 876 free(self->pids.tasks); 877} 878 879static int 880ltrace_exiting_install_handler(Process * proc) 881{ 882 /* Only install to leader. */ 883 if (proc->leader != proc) 884 return 0; 885 886 /* Perhaps we are already installed, if the user passed 887 * several -p options that are tasks of one process. */ 888 if (proc->event_handler != NULL 889 && proc->event_handler->on_event == <race_exiting_on_event) 890 return 0; 891 892 /* If stopping handler is already present, let it do the 893 * work. */ 894 if (proc->event_handler != NULL) { 895 assert(proc->event_handler->on_event 896 == &process_stopping_on_event); 897 struct process_stopping_handler * other 898 = (void *)proc->event_handler; 899 other->exiting = 1; 900 return 0; 901 } 902 903 struct ltrace_exiting_handler * handler 904 = calloc(sizeof(*handler), 1); 905 if (handler == NULL) { 906 perror("malloc exiting handler"); 907 fatal: 908 /* XXXXXXXXXXXXXXXXXXX fixme */ 909 return -1; 910 } 911 912 handler->super.on_event = ltrace_exiting_on_event; 913 handler->super.destroy = ltrace_exiting_destroy; 914 install_event_handler(proc->leader, &handler->super); 915 916 if (each_task(proc->leader, NULL, &send_sigstop, 917 &handler->pids) != NULL) 918 goto fatal; 919 920 return 0; 921} 922 923/* 924 * When the traced process vforks, it's suspended until the child 925 * process calls _exit or exec*. In the meantime, the two share the 926 * address space. 927 * 928 * The child process should only ever call _exit or exec*, but we 929 * can't count on that (it's not the role of ltrace to policy, but to 930 * observe). In any case, we will _at least_ have to deal with 931 * removal of vfork return breakpoint (which we have to smuggle back 932 * in, so that the parent can see it, too), and introduction of exec* 933 * return breakpoint. Since we already have both breakpoint actions 934 * to deal with, we might as well support it all. 935 * 936 * The gist is that we pretend that the child is in a thread group 937 * with its parent, and handle it as a multi-threaded case, with the 938 * exception that we know that the parent is blocked, and don't 939 * attempt to stop it. When the child execs, we undo the setup. 940 */ 941 942struct process_vfork_handler 943{ 944 struct event_handler super; 945 void * bp_addr; 946}; 947 948static Event * 949process_vfork_on_event(struct event_handler *super, Event *event) 950{ 951 struct process_vfork_handler * self = (void *)super; 952 struct breakpoint *sbp; 953 assert(self != NULL); 954 955 switch (event->type) { 956 case EVENT_BREAKPOINT: 957 /* Remember the vfork return breakpoint. */ 958 if (self->bp_addr == NULL) 959 self->bp_addr = event->e_un.brk_addr; 960 break; 961 962 case EVENT_EXIT: 963 case EVENT_EXIT_SIGNAL: 964 case EVENT_EXEC: 965 /* Smuggle back in the vfork return breakpoint, so 966 * that our parent can trip over it once again. */ 967 if (self->bp_addr != NULL) { 968 sbp = dict_find_entry(event->proc->leader->breakpoints, 969 self->bp_addr); 970 if (sbp != NULL) 971 insert_breakpoint(event->proc->parent, 972 self->bp_addr, 973 sbp->libsym, 1); 974 } 975 976 continue_process(event->proc->parent->pid); 977 978 /* Remove the leader that we artificially set up 979 * earlier. */ 980 change_process_leader(event->proc, event->proc); 981 destroy_event_handler(event->proc); 982 983 default: 984 ; 985 } 986 987 return event; 988} 989 990void 991continue_after_vfork(Process * proc) 992{ 993 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 994 struct process_vfork_handler * handler = calloc(sizeof(*handler), 1); 995 if (handler == NULL) { 996 perror("malloc vfork handler"); 997 /* Carry on not bothering to treat the process as 998 * necessary. */ 999 continue_process(proc->parent->pid); 1000 return; 1001 } 1002 1003 /* We must set up custom event handler, so that we see 1004 * exec/exit events for the task itself. */ 1005 handler->super.on_event = process_vfork_on_event; 1006 install_event_handler(proc, &handler->super); 1007 1008 /* Make sure that the child is sole thread. */ 1009 assert(proc->leader == proc); 1010 assert(proc->next == NULL || proc->next->leader != proc); 1011 1012 /* Make sure that the child's parent is properly set up. */ 1013 assert(proc->parent != NULL); 1014 assert(proc->parent->leader != NULL); 1015 1016 change_process_leader(proc, proc->parent->leader); 1017} 1018 1019static int 1020is_mid_stopping(Process *proc) 1021{ 1022 return proc != NULL 1023 && proc->event_handler != NULL 1024 && proc->event_handler->on_event == &process_stopping_on_event; 1025} 1026 1027void 1028continue_after_syscall(Process * proc, int sysnum, int ret_p) 1029{ 1030 /* Don't continue if we are mid-stopping. */ 1031 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 1032 debug(DEBUG_PROCESS, 1033 "continue_after_syscall: don't continue %d", 1034 proc->pid); 1035 return; 1036 } 1037 continue_process(proc->pid); 1038} 1039 1040/* If ltrace gets SIGINT, the processes directly or indirectly run by 1041 * ltrace get it too. We just have to wait long enough for the signal 1042 * to be delivered and the process terminated, which we notice and 1043 * exit ltrace, too. So there's not much we need to do there. We 1044 * want to keep tracing those processes as usual, in case they just 1045 * SIG_IGN the SIGINT to do their shutdown etc. 1046 * 1047 * For processes ran on the background, we want to install an exit 1048 * handler that stops all the threads, removes all breakpoints, and 1049 * detaches. 1050 */ 1051void 1052os_ltrace_exiting(void) 1053{ 1054 struct opt_p_t * it; 1055 for (it = opt_p; it != NULL; it = it->next) { 1056 Process * proc = pid2proc(it->pid); 1057 if (proc == NULL || proc->leader == NULL) 1058 continue; 1059 if (ltrace_exiting_install_handler(proc->leader) < 0) 1060 fprintf(stderr, 1061 "Couldn't install exiting handler for %d.\n", 1062 proc->pid); 1063 } 1064} 1065 1066int 1067os_ltrace_exiting_sighandler(void) 1068{ 1069 extern int linux_in_waitpid; 1070 if (linux_in_waitpid) { 1071 os_ltrace_exiting(); 1072 return 1; 1073 } 1074 return 0; 1075} 1076 1077size_t 1078umovebytes(Process *proc, void *addr, void *laddr, size_t len) { 1079 1080 union { 1081 long a; 1082 char c[sizeof(long)]; 1083 } a; 1084 int started = 0; 1085 size_t offset = 0, bytes_read = 0; 1086 1087 while (offset < len) { 1088 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1089 if (a.a == -1 && errno) { 1090 if (started && errno == EIO) 1091 return bytes_read; 1092 else 1093 return -1; 1094 } 1095 started = 1; 1096 1097 if (len - offset >= sizeof(long)) { 1098 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1099 bytes_read += sizeof(long); 1100 } 1101 else { 1102 memcpy(laddr + offset, &a.c[0], len - offset); 1103 bytes_read += (len - offset); 1104 } 1105 offset += sizeof(long); 1106 } 1107 1108 return bytes_read; 1109} 1110 1111/* Read a series of bytes starting at the process's memory address 1112 'addr' and continuing until a NUL ('\0') is seen or 'len' bytes 1113 have been read. 1114*/ 1115int 1116umovestr(Process *proc, void *addr, int len, void *laddr) { 1117 union { 1118 long a; 1119 char c[sizeof(long)]; 1120 } a; 1121 unsigned i; 1122 int offset = 0; 1123 1124 while (offset < len) { 1125 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1126 for (i = 0; i < sizeof(long); i++) { 1127 if (a.c[i] && offset + (signed)i < len) { 1128 *(char *)(laddr + offset + i) = a.c[i]; 1129 } else { 1130 *(char *)(laddr + offset + i) = '\0'; 1131 return 0; 1132 } 1133 } 1134 offset += sizeof(long); 1135 } 1136 *(char *)(laddr + offset) = '\0'; 1137 return 0; 1138} 1139