trace.c revision 642626096a694c6af279d25d2b1b2fba5b10ddfb
1/* 2 * This file is part of ltrace. 3 * Copyright (C) 2007,2011,2012 Petr Machata, Red Hat Inc. 4 * Copyright (C) 2010 Joe Damato 5 * Copyright (C) 1998,2002,2003,2004,2008,2009 Juan Cespedes 6 * Copyright (C) 2006 Ian Wienand 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation; either version 2 of the 11 * License, or (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, but 14 * WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 21 * 02110-1301 USA 22 */ 23 24#include "config.h" 25 26#include <asm/unistd.h> 27#include <sys/types.h> 28#include <sys/wait.h> 29#include <assert.h> 30#include <errno.h> 31#include <stdio.h> 32#include <stdlib.h> 33#include <string.h> 34#include <unistd.h> 35 36#ifdef HAVE_LIBSELINUX 37# include <selinux/selinux.h> 38#endif 39 40#include "ptrace.h" 41#include "breakpoint.h" 42#include "proc.h" 43#include "linux-gnu/trace.h" 44#include "backend.h" 45#include "type.h" 46#include "events.h" 47 48/* If the system headers did not provide the constants, hard-code the normal 49 values. */ 50#ifndef PTRACE_EVENT_FORK 51 52#define PTRACE_OLDSETOPTIONS 21 53#define PTRACE_SETOPTIONS 0x4200 54#define PTRACE_GETEVENTMSG 0x4201 55 56/* options set using PTRACE_SETOPTIONS */ 57#define PTRACE_O_TRACESYSGOOD 0x00000001 58#define PTRACE_O_TRACEFORK 0x00000002 59#define PTRACE_O_TRACEVFORK 0x00000004 60#define PTRACE_O_TRACECLONE 0x00000008 61#define PTRACE_O_TRACEEXEC 0x00000010 62#define PTRACE_O_TRACEVFORKDONE 0x00000020 63#define PTRACE_O_TRACEEXIT 0x00000040 64 65/* Wait extended result codes for the above trace options. */ 66#define PTRACE_EVENT_FORK 1 67#define PTRACE_EVENT_VFORK 2 68#define PTRACE_EVENT_CLONE 3 69#define PTRACE_EVENT_EXEC 4 70#define PTRACE_EVENT_VFORK_DONE 5 71#define PTRACE_EVENT_EXIT 6 72 73#endif /* PTRACE_EVENT_FORK */ 74 75void 76trace_fail_warning(pid_t pid) 77{ 78 /* This was adapted from GDB. */ 79#ifdef HAVE_LIBSELINUX 80 static int checked = 0; 81 if (checked) 82 return; 83 checked = 1; 84 85 /* -1 is returned for errors, 0 if it has no effect, 1 if 86 * PTRACE_ATTACH is forbidden. */ 87 if (security_get_boolean_active("deny_ptrace") == 1) 88 fprintf(stderr, 89"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 90"tracing other processes. You can disable this process attach protection by\n" 91"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 92#endif /* HAVE_LIBSELINUX */ 93} 94 95void 96trace_me(void) 97{ 98 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 99 if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) { 100 perror("PTRACE_TRACEME"); 101 trace_fail_warning(getpid()); 102 exit(1); 103 } 104} 105 106/* There's a (hopefully) brief period of time after the child process 107 * forks when we can't trace it yet. Here we wait for kernel to 108 * prepare the process. */ 109int 110wait_for_proc(pid_t pid) 111{ 112 /* man ptrace: PTRACE_ATTACH attaches to the process specified 113 in pid. The child is sent a SIGSTOP, but will not 114 necessarily have stopped by the completion of this call; 115 use wait() to wait for the child to stop. */ 116 if (waitpid(pid, NULL, __WALL) != pid) { 117 perror ("trace_pid: waitpid"); 118 return -1; 119 } 120 121 return 0; 122} 123 124int 125trace_pid(pid_t pid) 126{ 127 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 128 /* This shouldn't emit error messages, as there are legitimate 129 * reasons that the PID can't be attached: like it may have 130 * already ended. */ 131 if (ptrace(PTRACE_ATTACH, pid, 0, 0) < 0) 132 return -1; 133 134 return wait_for_proc(pid); 135} 136 137void 138trace_set_options(struct Process *proc) 139{ 140 if (proc->tracesysgood & 0x80) 141 return; 142 143 pid_t pid = proc->pid; 144 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 145 146 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 147 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 148 PTRACE_O_TRACEEXEC; 149 if (ptrace(PTRACE_SETOPTIONS, pid, 0, (void *)options) < 0 && 150 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, (void *)options) < 0) { 151 perror("PTRACE_SETOPTIONS"); 152 return; 153 } 154 proc->tracesysgood |= 0x80; 155} 156 157void 158untrace_pid(pid_t pid) { 159 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 160 ptrace(PTRACE_DETACH, pid, 0, 0); 161} 162 163void 164continue_after_signal(pid_t pid, int signum) 165{ 166 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", 167 pid, signum); 168 ptrace(PTRACE_SYSCALL, pid, 0, (void *)(uintptr_t)signum); 169} 170 171static enum ecb_status 172event_for_pid(Event * event, void * data) 173{ 174 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 175 return ecb_yield; 176 return ecb_cont; 177} 178 179static int 180have_events_for(pid_t pid) 181{ 182 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 183} 184 185void 186continue_process(pid_t pid) 187{ 188 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 189 190 /* Only really continue the process if there are no events in 191 the queue for this process. Otherwise just wait for the 192 other events to arrive. */ 193 if (!have_events_for(pid)) 194 /* We always trace syscalls to control fork(), 195 * clone(), execve()... */ 196 ptrace(PTRACE_SYSCALL, pid, 0, 0); 197 else 198 debug(DEBUG_PROCESS, 199 "putting off the continue, events in que."); 200} 201 202static struct pid_task * 203get_task_info(struct pid_set * pids, pid_t pid) 204{ 205 assert(pid != 0); 206 size_t i; 207 for (i = 0; i < pids->count; ++i) 208 if (pids->tasks[i].pid == pid) 209 return &pids->tasks[i]; 210 211 return NULL; 212} 213 214static struct pid_task * 215add_task_info(struct pid_set * pids, pid_t pid) 216{ 217 if (pids->count == pids->alloc) { 218 size_t ns = (2 * pids->alloc) ?: 4; 219 struct pid_task * n = realloc(pids->tasks, 220 sizeof(*pids->tasks) * ns); 221 if (n == NULL) 222 return NULL; 223 pids->tasks = n; 224 pids->alloc = ns; 225 } 226 struct pid_task * task_info = &pids->tasks[pids->count++]; 227 memset(task_info, 0, sizeof(*task_info)); 228 task_info->pid = pid; 229 return task_info; 230} 231 232static enum callback_status 233task_stopped(struct Process *task, void *data) 234{ 235 enum process_status st = process_status(task->pid); 236 if (data != NULL) 237 *(enum process_status *)data = st; 238 239 /* If the task is already stopped, don't worry about it. 240 * Likewise if it managed to become a zombie or terminate in 241 * the meantime. This can happen when the whole thread group 242 * is terminating. */ 243 switch (st) { 244 case ps_invalid: 245 case ps_tracing_stop: 246 case ps_zombie: 247 return CBS_CONT; 248 case ps_sleeping: 249 case ps_stop: 250 case ps_other: 251 return CBS_STOP; 252 } 253 254 abort (); 255} 256 257/* Task is blocked if it's stopped, or if it's a vfork parent. */ 258static enum callback_status 259task_blocked(struct Process *task, void *data) 260{ 261 struct pid_set * pids = data; 262 struct pid_task * task_info = get_task_info(pids, task->pid); 263 if (task_info != NULL 264 && task_info->vforked) 265 return CBS_CONT; 266 267 return task_stopped(task, NULL); 268} 269 270static Event *process_vfork_on_event(struct event_handler *super, Event *event); 271 272static enum callback_status 273task_vforked(struct Process *task, void *data) 274{ 275 if (task->event_handler != NULL 276 && task->event_handler->on_event == &process_vfork_on_event) 277 return CBS_STOP; 278 return CBS_CONT; 279} 280 281static int 282is_vfork_parent(struct Process *task) 283{ 284 return each_task(task->leader, NULL, &task_vforked, NULL) != NULL; 285} 286 287static enum callback_status 288send_sigstop(struct Process *task, void *data) 289{ 290 Process * leader = task->leader; 291 struct pid_set * pids = data; 292 293 /* Look for pre-existing task record, or add new. */ 294 struct pid_task * task_info = get_task_info(pids, task->pid); 295 if (task_info == NULL) 296 task_info = add_task_info(pids, task->pid); 297 if (task_info == NULL) { 298 perror("send_sigstop: add_task_info"); 299 destroy_event_handler(leader); 300 /* Signal failure upwards. */ 301 return CBS_STOP; 302 } 303 304 /* This task still has not been attached to. It should be 305 stopped by the kernel. */ 306 if (task->state == STATE_BEING_CREATED) 307 return CBS_CONT; 308 309 /* Don't bother sending SIGSTOP if we are already stopped, or 310 * if we sent the SIGSTOP already, which happens when we are 311 * handling "onexit" and inherited the handler from breakpoint 312 * re-enablement. */ 313 enum process_status st; 314 if (task_stopped(task, &st) == CBS_CONT) 315 return CBS_CONT; 316 if (task_info->sigstopped) { 317 if (!task_info->delivered) 318 return CBS_CONT; 319 task_info->delivered = 0; 320 } 321 322 /* Also don't attempt to stop the process if it's a parent of 323 * vforked process. We set up event handler specially to hint 324 * us. In that case parent is in D state, which we use to 325 * weed out unnecessary looping. */ 326 if (st == ps_sleeping 327 && is_vfork_parent (task)) { 328 task_info->vforked = 1; 329 return CBS_CONT; 330 } 331 332 if (task_kill(task->pid, SIGSTOP) >= 0) { 333 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 334 task_info->sigstopped = 1; 335 } else 336 fprintf(stderr, 337 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 338 339 return CBS_CONT; 340} 341 342/* On certain kernels, detaching right after a singlestep causes the 343 tracee to be killed with a SIGTRAP (that even though the singlestep 344 was properly caught by waitpid. The ugly workaround is to put a 345 breakpoint where IP points and let the process continue. After 346 this the breakpoint can be retracted and the process detached. */ 347static void 348ugly_workaround(Process * proc) 349{ 350 void * ip = get_instruction_pointer(proc); 351 struct breakpoint *sbp = dict_find_entry(proc->leader->breakpoints, ip); 352 if (sbp != NULL) 353 enable_breakpoint(proc, sbp); 354 else 355 insert_breakpoint(proc, ip, NULL); 356 ptrace(PTRACE_CONT, proc->pid, 0, 0); 357} 358 359static void 360process_stopping_done(struct process_stopping_handler * self, Process * leader) 361{ 362 debug(DEBUG_PROCESS, "process stopping done %d", 363 self->task_enabling_breakpoint->pid); 364 size_t i; 365 if (!self->exiting) { 366 for (i = 0; i < self->pids.count; ++i) 367 if (self->pids.tasks[i].pid != 0 368 && (self->pids.tasks[i].delivered 369 || self->pids.tasks[i].sysret)) 370 continue_process(self->pids.tasks[i].pid); 371 continue_process(self->task_enabling_breakpoint->pid); 372 destroy_event_handler(leader); 373 } 374 375 if (self->exiting) { 376 ugly_workaround: 377 self->state = psh_ugly_workaround; 378 ugly_workaround(self->task_enabling_breakpoint); 379 } else { 380 switch ((self->ugly_workaround_p)(self)) { 381 case CBS_FAIL: 382 /* xxx handle me */ 383 case CBS_STOP: 384 break; 385 case CBS_CONT: 386 goto ugly_workaround; 387 } 388 } 389} 390 391/* Before we detach, we need to make sure that task's IP is on the 392 * edge of an instruction. So for tasks that have a breakpoint event 393 * in the queue, we adjust the instruction pointer, just like 394 * continue_after_breakpoint does. */ 395static enum ecb_status 396undo_breakpoint(Event * event, void * data) 397{ 398 if (event != NULL 399 && event->proc->leader == data 400 && event->type == EVENT_BREAKPOINT) 401 set_instruction_pointer(event->proc, event->e_un.brk_addr); 402 return ecb_cont; 403} 404 405static enum callback_status 406untrace_task(struct Process *task, void *data) 407{ 408 if (task != data) 409 untrace_pid(task->pid); 410 return CBS_CONT; 411} 412 413static enum callback_status 414remove_task(struct Process *task, void *data) 415{ 416 /* Don't untrace leader just yet. */ 417 if (task != data) 418 remove_process(task); 419 return CBS_CONT; 420} 421 422static enum callback_status 423retract_breakpoint_cb(struct Process *proc, struct breakpoint *bp, void *data) 424{ 425 breakpoint_on_retract(bp, proc); 426 return CBS_CONT; 427} 428 429static void 430detach_process(Process * leader) 431{ 432 each_qd_event(&undo_breakpoint, leader); 433 disable_all_breakpoints(leader); 434 proc_each_breakpoint(leader, NULL, retract_breakpoint_cb, NULL); 435 436 /* Now untrace the process, if it was attached to by -p. */ 437 struct opt_p_t * it; 438 for (it = opt_p; it != NULL; it = it->next) { 439 Process * proc = pid2proc(it->pid); 440 if (proc == NULL) 441 continue; 442 if (proc->leader == leader) { 443 each_task(leader, NULL, &untrace_task, NULL); 444 break; 445 } 446 } 447 each_task(leader, NULL, &remove_task, leader); 448 destroy_event_handler(leader); 449 remove_task(leader, NULL); 450} 451 452static void 453handle_stopping_event(struct pid_task * task_info, Event ** eventp) 454{ 455 /* Mark all events, so that we know whom to SIGCONT later. */ 456 if (task_info != NULL) 457 task_info->got_event = 1; 458 459 Event * event = *eventp; 460 461 /* In every state, sink SIGSTOP events for tasks that it was 462 * sent to. */ 463 if (task_info != NULL 464 && event->type == EVENT_SIGNAL 465 && event->e_un.signum == SIGSTOP) { 466 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 467 if (task_info->sigstopped 468 && !task_info->delivered) { 469 task_info->delivered = 1; 470 *eventp = NULL; // sink the event 471 } else 472 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 473 "sigstopped=%d and delivered=%d\n", 474 task_info->pid, task_info->sigstopped, 475 task_info->delivered); 476 } 477} 478 479/* Some SIGSTOPs may have not been delivered to their respective tasks 480 * yet. They are still in the queue. If we have seen an event for 481 * that process, continue it, so that the SIGSTOP can be delivered and 482 * caught by ltrace. We don't mind that the process is after 483 * breakpoint (and therefore potentially doesn't have aligned IP), 484 * because the signal will be delivered without the process actually 485 * starting. */ 486static void 487continue_for_sigstop_delivery(struct pid_set * pids) 488{ 489 size_t i; 490 for (i = 0; i < pids->count; ++i) { 491 if (pids->tasks[i].pid != 0 492 && pids->tasks[i].sigstopped 493 && !pids->tasks[i].delivered 494 && pids->tasks[i].got_event) { 495 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 496 pids->tasks[i].pid); 497 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 498 } 499 } 500} 501 502static int 503event_exit_p(Event * event) 504{ 505 return event != NULL && (event->type == EVENT_EXIT 506 || event->type == EVENT_EXIT_SIGNAL); 507} 508 509static int 510event_exit_or_none_p(Event * event) 511{ 512 return event == NULL || event_exit_p(event) 513 || event->type == EVENT_NONE; 514} 515 516static int 517await_sigstop_delivery(struct pid_set * pids, struct pid_task * task_info, 518 Event * event) 519{ 520 /* If we still didn't get our SIGSTOP, continue the process 521 * and carry on. */ 522 if (event != NULL && !event_exit_or_none_p(event) 523 && task_info != NULL && task_info->sigstopped) { 524 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 525 task_info->pid); 526 /* We should get the signal the first thing 527 * after this, so it should be OK to continue 528 * even if we are over a breakpoint. */ 529 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 530 531 } else { 532 /* If all SIGSTOPs were delivered, uninstall the 533 * handler and continue everyone. */ 534 /* XXX I suspect that we should check tasks that are 535 * still around. Is things are now, there should be a 536 * race between waiting for everyone to stop and one 537 * of the tasks exiting. */ 538 int all_clear = 1; 539 size_t i; 540 for (i = 0; i < pids->count; ++i) 541 if (pids->tasks[i].pid != 0 542 && pids->tasks[i].sigstopped 543 && !pids->tasks[i].delivered) { 544 all_clear = 0; 545 break; 546 } 547 return all_clear; 548 } 549 550 return 0; 551} 552 553static int 554all_stops_accountable(struct pid_set * pids) 555{ 556 size_t i; 557 for (i = 0; i < pids->count; ++i) 558 if (pids->tasks[i].pid != 0 559 && !pids->tasks[i].got_event 560 && !have_events_for(pids->tasks[i].pid)) 561 return 0; 562 return 1; 563} 564 565/* The protocol is: 0 for success, negative for failure, positive if 566 * default singlestep is to be used. */ 567int arch_atomic_singlestep(struct Process *proc, struct breakpoint *sbp, 568 int (*add_cb)(void *addr, void *data), 569 void *add_cb_data); 570 571#ifndef ARCH_HAVE_ATOMIC_SINGLESTEP 572int 573arch_atomic_singlestep(struct Process *proc, struct breakpoint *sbp, 574 int (*add_cb)(void *addr, void *data), 575 void *add_cb_data) 576{ 577 return 1; 578} 579#endif 580 581static Event *process_stopping_on_event(struct event_handler *super, 582 Event *event); 583 584static void 585remove_atomic_breakpoints(struct Process *proc) 586{ 587 struct process_stopping_handler *self 588 = (void *)proc->leader->event_handler; 589 assert(self != NULL); 590 assert(self->super.on_event == process_stopping_on_event); 591 592 int ct = sizeof(self->atomic_skip_bp_addrs) 593 / sizeof(*self->atomic_skip_bp_addrs); 594 int i; 595 for (i = 0; i < ct; ++i) 596 if (self->atomic_skip_bp_addrs[i] != 0) { 597 delete_breakpoint(proc, self->atomic_skip_bp_addrs[i]); 598 self->atomic_skip_bp_addrs[i] = 0; 599 } 600} 601 602static void 603atomic_singlestep_bp_on_hit(struct breakpoint *bp, struct Process *proc) 604{ 605 remove_atomic_breakpoints(proc); 606} 607 608static int 609atomic_singlestep_add_bp(void *addr, void *data) 610{ 611 struct process_stopping_handler *self = data; 612 struct Process *proc = self->task_enabling_breakpoint; 613 614 int ct = sizeof(self->atomic_skip_bp_addrs) 615 / sizeof(*self->atomic_skip_bp_addrs); 616 int i; 617 for (i = 0; i < ct; ++i) 618 if (self->atomic_skip_bp_addrs[i] == 0) { 619 self->atomic_skip_bp_addrs[i] = addr; 620 static struct bp_callbacks cbs = { 621 .on_hit = atomic_singlestep_bp_on_hit, 622 }; 623 struct breakpoint *bp 624 = insert_breakpoint(proc, addr, NULL); 625 breakpoint_set_callbacks(bp, &cbs); 626 return 0; 627 } 628 629 assert(!"Too many atomic singlestep breakpoints!"); 630 abort(); 631} 632 633static int 634singlestep(struct process_stopping_handler *self) 635{ 636 struct Process *proc = self->task_enabling_breakpoint; 637 638 int status = arch_atomic_singlestep(self->task_enabling_breakpoint, 639 self->breakpoint_being_enabled, 640 &atomic_singlestep_add_bp, self); 641 642 /* Propagate failure and success. */ 643 if (status <= 0) 644 return status; 645 646 /* Otherwise do the default action: singlestep. */ 647 debug(1, "PTRACE_SINGLESTEP"); 648 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) { 649 perror("PTRACE_SINGLESTEP"); 650 return -1; 651 } 652 return 0; 653} 654 655static void 656post_singlestep(struct process_stopping_handler *self, 657 struct Event **eventp) 658{ 659 continue_for_sigstop_delivery(&self->pids); 660 661 if (*eventp != NULL && (*eventp)->type == EVENT_BREAKPOINT) 662 *eventp = NULL; // handled 663 664 struct Process *proc = self->task_enabling_breakpoint; 665 666 remove_atomic_breakpoints(proc); 667 self->breakpoint_being_enabled = NULL; 668} 669 670static void 671singlestep_error(struct process_stopping_handler *self) 672{ 673 struct Process *teb = self->task_enabling_breakpoint; 674 struct breakpoint *sbp = self->breakpoint_being_enabled; 675 fprintf(stderr, "%d couldn't continue when handling %s (%p) at %p\n", 676 teb->pid, sbp->libsym != NULL ? sbp->libsym->name : NULL, 677 sbp->addr, get_instruction_pointer(teb)); 678 delete_breakpoint(teb->leader, sbp->addr); 679} 680 681static void 682pt_continue(struct process_stopping_handler *self) 683{ 684 struct Process *teb = self->task_enabling_breakpoint; 685 debug(1, "PTRACE_CONT"); 686 ptrace(PTRACE_CONT, teb->pid, 0, 0); 687} 688 689static void 690pt_singlestep(struct process_stopping_handler *self) 691{ 692 if (singlestep(self) < 0) 693 singlestep_error(self); 694} 695 696static void 697disable_and(struct process_stopping_handler *self, 698 void (*do_this)(struct process_stopping_handler *self)) 699{ 700 struct Process *teb = self->task_enabling_breakpoint; 701 debug(DEBUG_PROCESS, "all stopped, now singlestep/cont %d", teb->pid); 702 if (self->breakpoint_being_enabled->enabled) 703 disable_breakpoint(teb, self->breakpoint_being_enabled); 704 (do_this)(self); 705 self->state = psh_singlestep; 706} 707 708void 709linux_ptrace_disable_and_singlestep(struct process_stopping_handler *self) 710{ 711 disable_and(self, &pt_singlestep); 712} 713 714void 715linux_ptrace_disable_and_continue(struct process_stopping_handler *self) 716{ 717 disable_and(self, &pt_continue); 718} 719 720/* This event handler is installed when we are in the process of 721 * stopping the whole thread group to do the pointer re-enablement for 722 * one of the threads. We pump all events to the queue for later 723 * processing while we wait for all the threads to stop. When this 724 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 725 * re-enable, and continue everyone. */ 726static Event * 727process_stopping_on_event(struct event_handler *super, Event *event) 728{ 729 struct process_stopping_handler * self = (void *)super; 730 Process * task = event->proc; 731 Process * leader = task->leader; 732 Process * teb = self->task_enabling_breakpoint; 733 734 debug(DEBUG_PROCESS, 735 "process_stopping_on_event: pid %d; event type %d; state %d", 736 task->pid, event->type, self->state); 737 738 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 739 if (task_info == NULL) 740 fprintf(stderr, "new task??? %d\n", task->pid); 741 handle_stopping_event(task_info, &event); 742 743 int state = self->state; 744 int event_to_queue = !event_exit_or_none_p(event); 745 746 /* Deactivate the entry if the task exits. */ 747 if (event_exit_p(event) && task_info != NULL) 748 task_info->pid = 0; 749 750 /* Always handle sysrets. Whether sysret occurred and what 751 * sys it rets from may need to be determined based on process 752 * stack, so we need to keep that in sync with reality. Note 753 * that we don't continue the process after the sysret is 754 * handled. See continue_after_syscall. */ 755 if (event != NULL && event->type == EVENT_SYSRET) { 756 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 757 event_to_queue = 0; 758 task_info->sysret = 1; 759 } 760 761 switch (state) { 762 case psh_stopping: 763 /* If everyone is stopped, singlestep. */ 764 if (each_task(leader, NULL, &task_blocked, 765 &self->pids) == NULL) { 766 (self->on_all_stopped)(self); 767 state = self->state; 768 } 769 break; 770 771 case psh_singlestep: 772 /* In singlestep state, breakpoint signifies that we 773 * have now stepped, and can re-enable the breakpoint. */ 774 if (event != NULL && task == teb) { 775 776 /* If this was caused by a real breakpoint, as 777 * opposed to a singlestep, assume that it's 778 * an artificial breakpoint installed for some 779 * reason for the re-enablement. In that case 780 * handle it. */ 781 if (event->type == EVENT_BREAKPOINT) { 782 target_address_t ip 783 = get_instruction_pointer(task); 784 struct breakpoint *other 785 = address2bpstruct(leader, ip); 786 if (other != NULL) 787 breakpoint_on_hit(other, task); 788 } 789 790 /* If we got SIGNAL instead of BREAKPOINT, 791 * then this is not singlestep at all. */ 792 if (event->type == EVENT_SIGNAL) { 793 do_singlestep: 794 if (singlestep(self) < 0) { 795 singlestep_error(self); 796 post_singlestep(self, &event); 797 goto psh_sinking; 798 } 799 break; 800 } else { 801 switch ((self->keep_stepping_p)(self)) { 802 case CBS_FAIL: 803 /* XXX handle me */ 804 case CBS_STOP: 805 break; 806 case CBS_CONT: 807 /* Sink singlestep event. */ 808 if (event->type == EVENT_BREAKPOINT) 809 event = NULL; 810 goto do_singlestep; 811 } 812 } 813 814 /* Re-enable the breakpoint that we are 815 * stepping over. */ 816 struct breakpoint *sbp = self->breakpoint_being_enabled; 817 if (sbp->enabled) 818 enable_breakpoint(teb, sbp); 819 820 post_singlestep(self, &event); 821 goto psh_sinking; 822 } 823 break; 824 825 psh_sinking: 826 state = self->state = psh_sinking; 827 case psh_sinking: 828 if (await_sigstop_delivery(&self->pids, task_info, event)) 829 process_stopping_done(self, leader); 830 break; 831 832 case psh_ugly_workaround: 833 if (event == NULL) 834 break; 835 if (event->type == EVENT_BREAKPOINT) { 836 undo_breakpoint(event, leader); 837 if (task == teb) 838 self->task_enabling_breakpoint = NULL; 839 } 840 if (self->task_enabling_breakpoint == NULL 841 && all_stops_accountable(&self->pids)) { 842 undo_breakpoint(event, leader); 843 detach_process(leader); 844 event = NULL; // handled 845 } 846 } 847 848 if (event != NULL && event_to_queue) { 849 enque_event(event); 850 event = NULL; // sink the event 851 } 852 853 return event; 854} 855 856static void 857process_stopping_destroy(struct event_handler *super) 858{ 859 struct process_stopping_handler * self = (void *)super; 860 free(self->pids.tasks); 861} 862 863static enum callback_status 864no(struct process_stopping_handler *self) 865{ 866 return CBS_STOP; 867} 868 869int 870process_install_stopping_handler(struct Process *proc, struct breakpoint *sbp, 871 void (*as)(struct process_stopping_handler *), 872 enum callback_status (*ks) 873 (struct process_stopping_handler *), 874 enum callback_status (*uw) 875 (struct process_stopping_handler *)) 876{ 877 debug(DEBUG_FUNCTION, 878 "process_install_stopping_handler: pid=%d", proc->pid); 879 880 struct process_stopping_handler *handler = calloc(sizeof(*handler), 1); 881 if (handler == NULL) 882 return -1; 883 884 if (as == NULL) 885 as = &linux_ptrace_disable_and_singlestep; 886 if (ks == NULL) 887 ks = &no; 888 if (uw == NULL) 889 uw = &no; 890 891 handler->super.on_event = process_stopping_on_event; 892 handler->super.destroy = process_stopping_destroy; 893 handler->task_enabling_breakpoint = proc; 894 handler->breakpoint_being_enabled = sbp; 895 handler->on_all_stopped = as; 896 handler->keep_stepping_p = ks; 897 handler->ugly_workaround_p = uw; 898 899 install_event_handler(proc->leader, &handler->super); 900 901 if (each_task(proc->leader, NULL, &send_sigstop, 902 &handler->pids) != NULL) { 903 destroy_event_handler(proc); 904 return -1; 905 } 906 907 /* And deliver the first fake event, in case all the 908 * conditions are already fulfilled. */ 909 Event ev = { 910 .type = EVENT_NONE, 911 .proc = proc, 912 }; 913 process_stopping_on_event(&handler->super, &ev); 914 915 return 0; 916} 917 918void 919continue_after_breakpoint(Process *proc, struct breakpoint *sbp) 920{ 921 debug(DEBUG_PROCESS, 922 "continue_after_breakpoint: pid=%d, addr=%p", 923 proc->pid, sbp->addr); 924 925 set_instruction_pointer(proc, sbp->addr); 926 927 if (sbp->enabled == 0) { 928 continue_process(proc->pid); 929 } else { 930#if defined __sparc__ || defined __ia64___ || defined __mips__ 931 /* we don't want to singlestep here */ 932 continue_process(proc->pid); 933#else 934 if (process_install_stopping_handler 935 (proc, sbp, NULL, NULL, NULL) < 0) { 936 perror("process_stopping_handler_create"); 937 /* Carry on not bothering to re-enable. */ 938 continue_process(proc->pid); 939 } 940#endif 941 } 942} 943 944/** 945 * Ltrace exit. When we are about to exit, we have to go through all 946 * the processes, stop them all, remove all the breakpoints, and then 947 * detach the processes that we attached to using -p. If we left the 948 * other tasks running, they might hit stray return breakpoints and 949 * produce artifacts, so we better stop everyone, even if it's a bit 950 * of extra work. 951 */ 952struct ltrace_exiting_handler 953{ 954 struct event_handler super; 955 struct pid_set pids; 956}; 957 958static Event * 959ltrace_exiting_on_event(struct event_handler *super, Event *event) 960{ 961 struct ltrace_exiting_handler * self = (void *)super; 962 Process * task = event->proc; 963 Process * leader = task->leader; 964 965 debug(DEBUG_PROCESS, 966 "ltrace_exiting_on_event: pid %d; event type %d", 967 task->pid, event->type); 968 969 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 970 handle_stopping_event(task_info, &event); 971 972 if (event != NULL && event->type == EVENT_BREAKPOINT) 973 undo_breakpoint(event, leader); 974 975 if (await_sigstop_delivery(&self->pids, task_info, event) 976 && all_stops_accountable(&self->pids)) 977 detach_process(leader); 978 979 /* Sink all non-exit events. We are about to exit, so we 980 * don't bother with queuing them. */ 981 if (event_exit_or_none_p(event)) 982 return event; 983 984 return NULL; 985} 986 987static void 988ltrace_exiting_destroy(struct event_handler *super) 989{ 990 struct ltrace_exiting_handler * self = (void *)super; 991 free(self->pids.tasks); 992} 993 994static int 995ltrace_exiting_install_handler(Process * proc) 996{ 997 /* Only install to leader. */ 998 if (proc->leader != proc) 999 return 0; 1000 1001 /* Perhaps we are already installed, if the user passed 1002 * several -p options that are tasks of one process. */ 1003 if (proc->event_handler != NULL 1004 && proc->event_handler->on_event == <race_exiting_on_event) 1005 return 0; 1006 1007 /* If stopping handler is already present, let it do the 1008 * work. */ 1009 if (proc->event_handler != NULL) { 1010 assert(proc->event_handler->on_event 1011 == &process_stopping_on_event); 1012 struct process_stopping_handler * other 1013 = (void *)proc->event_handler; 1014 other->exiting = 1; 1015 return 0; 1016 } 1017 1018 struct ltrace_exiting_handler * handler 1019 = calloc(sizeof(*handler), 1); 1020 if (handler == NULL) { 1021 perror("malloc exiting handler"); 1022 fatal: 1023 /* XXXXXXXXXXXXXXXXXXX fixme */ 1024 return -1; 1025 } 1026 1027 handler->super.on_event = ltrace_exiting_on_event; 1028 handler->super.destroy = ltrace_exiting_destroy; 1029 install_event_handler(proc->leader, &handler->super); 1030 1031 if (each_task(proc->leader, NULL, &send_sigstop, 1032 &handler->pids) != NULL) 1033 goto fatal; 1034 1035 return 0; 1036} 1037 1038/* 1039 * When the traced process vforks, it's suspended until the child 1040 * process calls _exit or exec*. In the meantime, the two share the 1041 * address space. 1042 * 1043 * The child process should only ever call _exit or exec*, but we 1044 * can't count on that (it's not the role of ltrace to policy, but to 1045 * observe). In any case, we will _at least_ have to deal with 1046 * removal of vfork return breakpoint (which we have to smuggle back 1047 * in, so that the parent can see it, too), and introduction of exec* 1048 * return breakpoint. Since we already have both breakpoint actions 1049 * to deal with, we might as well support it all. 1050 * 1051 * The gist is that we pretend that the child is in a thread group 1052 * with its parent, and handle it as a multi-threaded case, with the 1053 * exception that we know that the parent is blocked, and don't 1054 * attempt to stop it. When the child execs, we undo the setup. 1055 */ 1056 1057struct process_vfork_handler 1058{ 1059 struct event_handler super; 1060 void * bp_addr; 1061}; 1062 1063static Event * 1064process_vfork_on_event(struct event_handler *super, Event *event) 1065{ 1066 debug(DEBUG_PROCESS, 1067 "process_vfork_on_event: pid %d; event type %d", 1068 event->proc->pid, event->type); 1069 1070 struct process_vfork_handler * self = (void *)super; 1071 struct breakpoint *sbp; 1072 assert(self != NULL); 1073 1074 switch (event->type) { 1075 case EVENT_BREAKPOINT: 1076 /* Remember the vfork return breakpoint. */ 1077 if (self->bp_addr == 0) 1078 self->bp_addr = event->e_un.brk_addr; 1079 break; 1080 1081 case EVENT_EXIT: 1082 case EVENT_EXIT_SIGNAL: 1083 case EVENT_EXEC: 1084 /* Smuggle back in the vfork return breakpoint, so 1085 * that our parent can trip over it once again. */ 1086 if (self->bp_addr != 0) { 1087 sbp = dict_find_entry(event->proc->leader->breakpoints, 1088 self->bp_addr); 1089 if (sbp != NULL) 1090 assert(sbp->libsym == NULL); 1091 /* We don't mind failing that, it's not a big 1092 * deal to not display one extra vfork return. */ 1093 insert_breakpoint(event->proc->parent, 1094 self->bp_addr, NULL); 1095 } 1096 1097 continue_process(event->proc->parent->pid); 1098 1099 /* Remove the leader that we artificially set up 1100 * earlier. */ 1101 change_process_leader(event->proc, event->proc); 1102 destroy_event_handler(event->proc); 1103 1104 default: 1105 ; 1106 } 1107 1108 return event; 1109} 1110 1111void 1112continue_after_vfork(Process * proc) 1113{ 1114 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 1115 struct process_vfork_handler * handler = calloc(sizeof(*handler), 1); 1116 if (handler == NULL) { 1117 perror("malloc vfork handler"); 1118 /* Carry on not bothering to treat the process as 1119 * necessary. */ 1120 continue_process(proc->parent->pid); 1121 return; 1122 } 1123 1124 /* We must set up custom event handler, so that we see 1125 * exec/exit events for the task itself. */ 1126 handler->super.on_event = process_vfork_on_event; 1127 install_event_handler(proc, &handler->super); 1128 1129 /* Make sure that the child is sole thread. */ 1130 assert(proc->leader == proc); 1131 assert(proc->next == NULL || proc->next->leader != proc); 1132 1133 /* Make sure that the child's parent is properly set up. */ 1134 assert(proc->parent != NULL); 1135 assert(proc->parent->leader != NULL); 1136 1137 change_process_leader(proc, proc->parent->leader); 1138} 1139 1140static int 1141is_mid_stopping(Process *proc) 1142{ 1143 return proc != NULL 1144 && proc->event_handler != NULL 1145 && proc->event_handler->on_event == &process_stopping_on_event; 1146} 1147 1148void 1149continue_after_syscall(Process * proc, int sysnum, int ret_p) 1150{ 1151 /* Don't continue if we are mid-stopping. */ 1152 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 1153 debug(DEBUG_PROCESS, 1154 "continue_after_syscall: don't continue %d", 1155 proc->pid); 1156 return; 1157 } 1158 continue_process(proc->pid); 1159} 1160 1161/* If ltrace gets SIGINT, the processes directly or indirectly run by 1162 * ltrace get it too. We just have to wait long enough for the signal 1163 * to be delivered and the process terminated, which we notice and 1164 * exit ltrace, too. So there's not much we need to do there. We 1165 * want to keep tracing those processes as usual, in case they just 1166 * SIG_IGN the SIGINT to do their shutdown etc. 1167 * 1168 * For processes ran on the background, we want to install an exit 1169 * handler that stops all the threads, removes all breakpoints, and 1170 * detaches. 1171 */ 1172void 1173os_ltrace_exiting(void) 1174{ 1175 struct opt_p_t * it; 1176 for (it = opt_p; it != NULL; it = it->next) { 1177 Process * proc = pid2proc(it->pid); 1178 if (proc == NULL || proc->leader == NULL) 1179 continue; 1180 if (ltrace_exiting_install_handler(proc->leader) < 0) 1181 fprintf(stderr, 1182 "Couldn't install exiting handler for %d.\n", 1183 proc->pid); 1184 } 1185} 1186 1187int 1188os_ltrace_exiting_sighandler(void) 1189{ 1190 extern int linux_in_waitpid; 1191 if (linux_in_waitpid) { 1192 os_ltrace_exiting(); 1193 return 1; 1194 } 1195 return 0; 1196} 1197 1198size_t 1199umovebytes(Process *proc, void *addr, void *laddr, size_t len) { 1200 1201 union { 1202 long a; 1203 char c[sizeof(long)]; 1204 } a; 1205 int started = 0; 1206 size_t offset = 0, bytes_read = 0; 1207 1208 while (offset < len) { 1209 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1210 if (a.a == -1 && errno) { 1211 if (started && errno == EIO) 1212 return bytes_read; 1213 else 1214 return -1; 1215 } 1216 started = 1; 1217 1218 if (len - offset >= sizeof(long)) { 1219 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1220 bytes_read += sizeof(long); 1221 } 1222 else { 1223 memcpy(laddr + offset, &a.c[0], len - offset); 1224 bytes_read += (len - offset); 1225 } 1226 offset += sizeof(long); 1227 } 1228 1229 return bytes_read; 1230} 1231