trace.c revision 98ff309cdc98857eb30992f108439cb7d7673598
1/* 2 * This file is part of ltrace. 3 * Copyright (C) 2007,2011,2012,2013 Petr Machata, Red Hat Inc. 4 * Copyright (C) 2010 Joe Damato 5 * Copyright (C) 1998,2002,2003,2004,2008,2009 Juan Cespedes 6 * Copyright (C) 2006 Ian Wienand 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation; either version 2 of the 11 * License, or (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, but 14 * WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 16 * General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 21 * 02110-1301 USA 22 */ 23 24#include "config.h" 25 26#include <asm/unistd.h> 27#include <sys/types.h> 28#include <sys/wait.h> 29#include <assert.h> 30#include <errno.h> 31#include <stdio.h> 32#include <stdlib.h> 33#include <string.h> 34#include <unistd.h> 35 36#ifdef HAVE_LIBSELINUX 37# include <selinux/selinux.h> 38#endif 39 40#include "linux-gnu/trace.h" 41#include "linux-gnu/trace-defs.h" 42#include "backend.h" 43#include "breakpoint.h" 44#include "debug.h" 45#include "events.h" 46#include "options.h" 47#include "proc.h" 48#include "ptrace.h" 49#include "type.h" 50 51void 52trace_fail_warning(pid_t pid) 53{ 54 /* This was adapted from GDB. */ 55#ifdef HAVE_LIBSELINUX 56 static int checked = 0; 57 if (checked) 58 return; 59 checked = 1; 60 61 /* -1 is returned for errors, 0 if it has no effect, 1 if 62 * PTRACE_ATTACH is forbidden. */ 63 if (security_get_boolean_active("deny_ptrace") == 1) 64 fprintf(stderr, 65"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 66"tracing other processes. You can disable this process attach protection by\n" 67"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 68#endif /* HAVE_LIBSELINUX */ 69} 70 71void 72trace_me(void) 73{ 74 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 75 if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) { 76 perror("PTRACE_TRACEME"); 77 trace_fail_warning(getpid()); 78 exit(1); 79 } 80} 81 82/* There's a (hopefully) brief period of time after the child process 83 * forks when we can't trace it yet. Here we wait for kernel to 84 * prepare the process. */ 85int 86wait_for_proc(pid_t pid) 87{ 88 /* man ptrace: PTRACE_ATTACH attaches to the process specified 89 in pid. The child is sent a SIGSTOP, but will not 90 necessarily have stopped by the completion of this call; 91 use wait() to wait for the child to stop. */ 92 if (waitpid(pid, NULL, __WALL) != pid) { 93 perror ("trace_pid: waitpid"); 94 return -1; 95 } 96 97 return 0; 98} 99 100int 101trace_pid(pid_t pid) 102{ 103 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 104 /* This shouldn't emit error messages, as there are legitimate 105 * reasons that the PID can't be attached: like it may have 106 * already ended. */ 107 if (ptrace(PTRACE_ATTACH, pid, 0, 0) < 0) 108 return -1; 109 110 return wait_for_proc(pid); 111} 112 113void 114trace_set_options(struct process *proc) 115{ 116 if (proc->tracesysgood & 0x80) 117 return; 118 119 pid_t pid = proc->pid; 120 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 121 122 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 123 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 124 PTRACE_O_TRACEEXEC; 125 if (ptrace(PTRACE_SETOPTIONS, pid, 0, (void *)options) < 0 && 126 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, (void *)options) < 0) { 127 perror("PTRACE_SETOPTIONS"); 128 return; 129 } 130 proc->tracesysgood |= 0x80; 131} 132 133void 134untrace_pid(pid_t pid) { 135 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 136 ptrace(PTRACE_DETACH, pid, 0, 0); 137} 138 139void 140continue_after_signal(pid_t pid, int signum) 141{ 142 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", 143 pid, signum); 144 ptrace(PTRACE_SYSCALL, pid, 0, (void *)(uintptr_t)signum); 145} 146 147static enum ecb_status 148event_for_pid(Event *event, void *data) 149{ 150 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 151 return ECB_YIELD; 152 return ECB_CONT; 153} 154 155static int 156have_events_for(pid_t pid) 157{ 158 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 159} 160 161void 162continue_process(pid_t pid) 163{ 164 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 165 166 /* Only really continue the process if there are no events in 167 the queue for this process. Otherwise just wait for the 168 other events to arrive. */ 169 if (!have_events_for(pid)) 170 /* We always trace syscalls to control fork(), 171 * clone(), execve()... */ 172 ptrace(PTRACE_SYSCALL, pid, 0, 0); 173 else 174 debug(DEBUG_PROCESS, 175 "putting off the continue, events in que."); 176} 177 178static struct pid_task * 179get_task_info(struct pid_set *pids, pid_t pid) 180{ 181 assert(pid != 0); 182 size_t i; 183 for (i = 0; i < pids->count; ++i) 184 if (pids->tasks[i].pid == pid) 185 return &pids->tasks[i]; 186 187 return NULL; 188} 189 190static struct pid_task * 191add_task_info(struct pid_set *pids, pid_t pid) 192{ 193 if (pids->count == pids->alloc) { 194 size_t ns = (2 * pids->alloc) ?: 4; 195 struct pid_task *n = realloc(pids->tasks, 196 sizeof(*pids->tasks) * ns); 197 if (n == NULL) 198 return NULL; 199 pids->tasks = n; 200 pids->alloc = ns; 201 } 202 struct pid_task * task_info = &pids->tasks[pids->count++]; 203 memset(task_info, 0, sizeof(*task_info)); 204 task_info->pid = pid; 205 return task_info; 206} 207 208static enum callback_status 209task_stopped(struct process *task, void *data) 210{ 211 enum process_status st = process_status(task->pid); 212 if (data != NULL) 213 *(enum process_status *)data = st; 214 215 /* If the task is already stopped, don't worry about it. 216 * Likewise if it managed to become a zombie or terminate in 217 * the meantime. This can happen when the whole thread group 218 * is terminating. */ 219 switch (st) { 220 case PS_INVALID: 221 case PS_TRACING_STOP: 222 case PS_ZOMBIE: 223 return CBS_CONT; 224 case PS_SLEEPING: 225 case PS_STOP: 226 case PS_OTHER: 227 return CBS_STOP; 228 } 229 230 abort (); 231} 232 233/* Task is blocked if it's stopped, or if it's a vfork parent. */ 234static enum callback_status 235task_blocked(struct process *task, void *data) 236{ 237 struct pid_set *pids = data; 238 struct pid_task *task_info = get_task_info(pids, task->pid); 239 if (task_info != NULL 240 && task_info->vforked) 241 return CBS_CONT; 242 243 return task_stopped(task, NULL); 244} 245 246static Event *process_vfork_on_event(struct event_handler *super, Event *event); 247 248static enum callback_status 249task_vforked(struct process *task, void *data) 250{ 251 if (task->event_handler != NULL 252 && task->event_handler->on_event == &process_vfork_on_event) 253 return CBS_STOP; 254 return CBS_CONT; 255} 256 257static int 258is_vfork_parent(struct process *task) 259{ 260 return each_task(task->leader, NULL, &task_vforked, NULL) != NULL; 261} 262 263static enum callback_status 264send_sigstop(struct process *task, void *data) 265{ 266 struct process *leader = task->leader; 267 struct pid_set *pids = data; 268 269 /* Look for pre-existing task record, or add new. */ 270 struct pid_task *task_info = get_task_info(pids, task->pid); 271 if (task_info == NULL) 272 task_info = add_task_info(pids, task->pid); 273 if (task_info == NULL) { 274 perror("send_sigstop: add_task_info"); 275 destroy_event_handler(leader); 276 /* Signal failure upwards. */ 277 return CBS_STOP; 278 } 279 280 /* This task still has not been attached to. It should be 281 stopped by the kernel. */ 282 if (task->state == STATE_BEING_CREATED) 283 return CBS_CONT; 284 285 /* Don't bother sending SIGSTOP if we are already stopped, or 286 * if we sent the SIGSTOP already, which happens when we are 287 * handling "onexit" and inherited the handler from breakpoint 288 * re-enablement. */ 289 enum process_status st; 290 if (task_stopped(task, &st) == CBS_CONT) 291 return CBS_CONT; 292 if (task_info->sigstopped) { 293 if (!task_info->delivered) 294 return CBS_CONT; 295 task_info->delivered = 0; 296 } 297 298 /* Also don't attempt to stop the process if it's a parent of 299 * vforked process. We set up event handler specially to hint 300 * us. In that case parent is in D state, which we use to 301 * weed out unnecessary looping. */ 302 if (st == PS_SLEEPING 303 && is_vfork_parent(task)) { 304 task_info->vforked = 1; 305 return CBS_CONT; 306 } 307 308 if (task_kill(task->pid, SIGSTOP) >= 0) { 309 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 310 task_info->sigstopped = 1; 311 } else 312 fprintf(stderr, 313 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 314 315 return CBS_CONT; 316} 317 318/* On certain kernels, detaching right after a singlestep causes the 319 tracee to be killed with a SIGTRAP (that even though the singlestep 320 was properly caught by waitpid. The ugly workaround is to put a 321 breakpoint where IP points and let the process continue. After 322 this the breakpoint can be retracted and the process detached. */ 323static void 324ugly_workaround(struct process *proc) 325{ 326 arch_addr_t ip = get_instruction_pointer(proc); 327 struct breakpoint *found; 328 if (DICT_FIND_VAL(proc->leader->breakpoints, &ip, &found) < 0) { 329 insert_breakpoint(proc, ip, NULL); 330 } else { 331 assert(found != NULL); 332 enable_breakpoint(proc, found); 333 } 334 ptrace(PTRACE_CONT, proc->pid, 0, 0); 335} 336 337static void 338process_stopping_done(struct process_stopping_handler *self, 339 struct process *leader) 340{ 341 debug(DEBUG_PROCESS, "process stopping done %d", 342 self->task_enabling_breakpoint->pid); 343 344 if (!self->exiting) { 345 size_t i; 346 for (i = 0; i < self->pids.count; ++i) 347 if (self->pids.tasks[i].pid != 0 348 && (self->pids.tasks[i].delivered 349 || self->pids.tasks[i].sysret)) 350 continue_process(self->pids.tasks[i].pid); 351 continue_process(self->task_enabling_breakpoint->pid); 352 } 353 354 if (self->exiting) { 355 ugly_workaround: 356 self->state = PSH_UGLY_WORKAROUND; 357 ugly_workaround(self->task_enabling_breakpoint); 358 } else { 359 switch ((self->ugly_workaround_p)(self)) { 360 case CBS_FAIL: 361 /* xxx handle me */ 362 case CBS_STOP: 363 break; 364 case CBS_CONT: 365 goto ugly_workaround; 366 } 367 destroy_event_handler(leader); 368 } 369} 370 371/* Before we detach, we need to make sure that task's IP is on the 372 * edge of an instruction. So for tasks that have a breakpoint event 373 * in the queue, we adjust the instruction pointer, just like 374 * continue_after_breakpoint does. */ 375static enum ecb_status 376undo_breakpoint(Event *event, void *data) 377{ 378 if (event != NULL 379 && event->proc->leader == data 380 && event->type == EVENT_BREAKPOINT) 381 set_instruction_pointer(event->proc, event->e_un.brk_addr); 382 return ECB_CONT; 383} 384 385static enum callback_status 386untrace_task(struct process *task, void *data) 387{ 388 if (task != data) 389 untrace_pid(task->pid); 390 return CBS_CONT; 391} 392 393static enum callback_status 394remove_task(struct process *task, void *data) 395{ 396 /* Don't untrace leader just yet. */ 397 if (task != data) 398 remove_process(task); 399 return CBS_CONT; 400} 401 402static enum callback_status 403retract_breakpoint_cb(struct process *proc, struct breakpoint *bp, void *data) 404{ 405 breakpoint_on_retract(bp, proc); 406 return CBS_CONT; 407} 408 409static void 410detach_process(struct process *leader) 411{ 412 each_qd_event(&undo_breakpoint, leader); 413 disable_all_breakpoints(leader); 414 proc_each_breakpoint(leader, NULL, retract_breakpoint_cb, NULL); 415 416 /* Now untrace the process, if it was attached to by -p. */ 417 struct opt_p_t *it; 418 for (it = opt_p; it != NULL; it = it->next) { 419 struct process *proc = pid2proc(it->pid); 420 if (proc == NULL) 421 continue; 422 if (proc->leader == leader) { 423 each_task(leader, NULL, &untrace_task, NULL); 424 break; 425 } 426 } 427 each_task(leader, NULL, &remove_task, leader); 428 destroy_event_handler(leader); 429 remove_task(leader, NULL); 430} 431 432static void 433handle_stopping_event(struct pid_task *task_info, Event **eventp) 434{ 435 /* Mark all events, so that we know whom to SIGCONT later. */ 436 if (task_info != NULL) 437 task_info->got_event = 1; 438 439 Event *event = *eventp; 440 441 /* In every state, sink SIGSTOP events for tasks that it was 442 * sent to. */ 443 if (task_info != NULL 444 && event->type == EVENT_SIGNAL 445 && event->e_un.signum == SIGSTOP) { 446 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 447 if (task_info->sigstopped 448 && !task_info->delivered) { 449 task_info->delivered = 1; 450 *eventp = NULL; // sink the event 451 } else 452 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 453 "sigstopped=%d and delivered=%d\n", 454 task_info->pid, task_info->sigstopped, 455 task_info->delivered); 456 } 457} 458 459/* Some SIGSTOPs may have not been delivered to their respective tasks 460 * yet. They are still in the queue. If we have seen an event for 461 * that process, continue it, so that the SIGSTOP can be delivered and 462 * caught by ltrace. We don't mind that the process is after 463 * breakpoint (and therefore potentially doesn't have aligned IP), 464 * because the signal will be delivered without the process actually 465 * starting. */ 466static void 467continue_for_sigstop_delivery(struct pid_set *pids) 468{ 469 size_t i; 470 for (i = 0; i < pids->count; ++i) { 471 if (pids->tasks[i].pid != 0 472 && pids->tasks[i].sigstopped 473 && !pids->tasks[i].delivered 474 && pids->tasks[i].got_event) { 475 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 476 pids->tasks[i].pid); 477 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 478 } 479 } 480} 481 482static int 483event_exit_p(Event *event) 484{ 485 return event != NULL && (event->type == EVENT_EXIT 486 || event->type == EVENT_EXIT_SIGNAL); 487} 488 489static int 490event_exit_or_none_p(Event *event) 491{ 492 return event == NULL || event_exit_p(event) 493 || event->type == EVENT_NONE; 494} 495 496static int 497await_sigstop_delivery(struct pid_set *pids, struct pid_task *task_info, 498 Event *event) 499{ 500 /* If we still didn't get our SIGSTOP, continue the process 501 * and carry on. */ 502 if (event != NULL && !event_exit_or_none_p(event) 503 && task_info != NULL && task_info->sigstopped) { 504 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 505 task_info->pid); 506 /* We should get the signal the first thing 507 * after this, so it should be OK to continue 508 * even if we are over a breakpoint. */ 509 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 510 511 } else { 512 /* If all SIGSTOPs were delivered, uninstall the 513 * handler and continue everyone. */ 514 /* XXX I suspect that we should check tasks that are 515 * still around. Is things are now, there should be a 516 * race between waiting for everyone to stop and one 517 * of the tasks exiting. */ 518 int all_clear = 1; 519 size_t i; 520 for (i = 0; i < pids->count; ++i) 521 if (pids->tasks[i].pid != 0 522 && pids->tasks[i].sigstopped 523 && !pids->tasks[i].delivered) { 524 all_clear = 0; 525 break; 526 } 527 return all_clear; 528 } 529 530 return 0; 531} 532 533static int 534all_stops_accountable(struct pid_set *pids) 535{ 536 size_t i; 537 for (i = 0; i < pids->count; ++i) 538 if (pids->tasks[i].pid != 0 539 && !pids->tasks[i].got_event 540 && !have_events_for(pids->tasks[i].pid)) 541 return 0; 542 return 1; 543} 544 545#ifndef ARCH_HAVE_SW_SINGLESTEP 546enum sw_singlestep_status 547arch_sw_singlestep(struct process *proc, struct breakpoint *bp, 548 int (*add_cb)(arch_addr_t, struct sw_singlestep_data *), 549 struct sw_singlestep_data *data) 550{ 551 return SWS_HW; 552} 553#endif 554 555static Event *process_stopping_on_event(struct event_handler *super, 556 Event *event); 557 558static void 559remove_sw_breakpoints(struct process *proc) 560{ 561 struct process_stopping_handler *self 562 = (void *)proc->leader->event_handler; 563 assert(self != NULL); 564 assert(self->super.on_event == process_stopping_on_event); 565 566 int ct = sizeof(self->sws_bp_addrs) / sizeof(*self->sws_bp_addrs); 567 int i; 568 for (i = 0; i < ct; ++i) 569 if (self->sws_bp_addrs[i] != 0) { 570 delete_breakpoint(proc, self->sws_bp_addrs[i]); 571 self->sws_bp_addrs[i] = 0; 572 } 573} 574 575static void 576sw_singlestep_bp_on_hit(struct breakpoint *bp, struct process *proc) 577{ 578 remove_sw_breakpoints(proc); 579} 580 581struct sw_singlestep_data { 582 struct process_stopping_handler *self; 583}; 584 585static int 586sw_singlestep_add_bp(arch_addr_t addr, struct sw_singlestep_data *data) 587{ 588 struct process_stopping_handler *self = data->self; 589 struct process *proc = self->task_enabling_breakpoint; 590 591 int ct = sizeof(self->sws_bp_addrs) 592 / sizeof(*self->sws_bp_addrs); 593 int i; 594 for (i = 0; i < ct; ++i) 595 if (self->sws_bp_addrs[i] == 0) { 596 self->sws_bp_addrs[i] = addr; 597 static struct bp_callbacks cbs = { 598 .on_hit = sw_singlestep_bp_on_hit, 599 }; 600 struct breakpoint *bp 601 = insert_breakpoint(proc, addr, NULL); 602 breakpoint_set_callbacks(bp, &cbs); 603 return 0; 604 } 605 606 assert(!"Too many sw singlestep breakpoints!"); 607 abort(); 608} 609 610static int 611singlestep(struct process_stopping_handler *self) 612{ 613 struct process *proc = self->task_enabling_breakpoint; 614 615 struct sw_singlestep_data data = { self }; 616 switch (arch_sw_singlestep(self->task_enabling_breakpoint, 617 self->breakpoint_being_enabled, 618 &sw_singlestep_add_bp, &data)) { 619 case SWS_HW: 620 /* Otherwise do the default action: singlestep. */ 621 debug(1, "PTRACE_SINGLESTEP"); 622 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) { 623 perror("PTRACE_SINGLESTEP"); 624 return -1; 625 } 626 return 0; 627 628 case SWS_OK: 629 return 0; 630 631 case SWS_FAIL: 632 return -1; 633 } 634 abort(); 635} 636 637static void 638post_singlestep(struct process_stopping_handler *self, 639 struct Event **eventp) 640{ 641 continue_for_sigstop_delivery(&self->pids); 642 643 if (*eventp != NULL && (*eventp)->type == EVENT_BREAKPOINT) 644 *eventp = NULL; // handled 645 646 struct process *proc = self->task_enabling_breakpoint; 647 648 remove_sw_breakpoints(proc); 649 self->breakpoint_being_enabled = NULL; 650} 651 652static void 653singlestep_error(struct process_stopping_handler *self) 654{ 655 struct process *teb = self->task_enabling_breakpoint; 656 struct breakpoint *sbp = self->breakpoint_being_enabled; 657 fprintf(stderr, "%d couldn't continue when handling %s (%p) at %p\n", 658 teb->pid, breakpoint_name(sbp), sbp->addr, 659 get_instruction_pointer(teb)); 660 delete_breakpoint(teb->leader, sbp->addr); 661} 662 663static void 664pt_continue(struct process_stopping_handler *self) 665{ 666 struct process *teb = self->task_enabling_breakpoint; 667 debug(1, "PTRACE_CONT"); 668 ptrace(PTRACE_CONT, teb->pid, 0, 0); 669} 670 671static void 672pt_singlestep(struct process_stopping_handler *self) 673{ 674 if (singlestep(self) < 0) 675 singlestep_error(self); 676} 677 678static void 679disable_and(struct process_stopping_handler *self, 680 void (*do_this)(struct process_stopping_handler *self)) 681{ 682 struct process *teb = self->task_enabling_breakpoint; 683 debug(DEBUG_PROCESS, "all stopped, now singlestep/cont %d", teb->pid); 684 if (self->breakpoint_being_enabled->enabled) 685 disable_breakpoint(teb, self->breakpoint_being_enabled); 686 (do_this)(self); 687 self->state = PSH_SINGLESTEP; 688} 689 690void 691linux_ptrace_disable_and_singlestep(struct process_stopping_handler *self) 692{ 693 disable_and(self, &pt_singlestep); 694} 695 696void 697linux_ptrace_disable_and_continue(struct process_stopping_handler *self) 698{ 699 disable_and(self, &pt_continue); 700} 701 702/* This event handler is installed when we are in the process of 703 * stopping the whole thread group to do the pointer re-enablement for 704 * one of the threads. We pump all events to the queue for later 705 * processing while we wait for all the threads to stop. When this 706 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 707 * re-enable, and continue everyone. */ 708static Event * 709process_stopping_on_event(struct event_handler *super, Event *event) 710{ 711 struct process_stopping_handler *self = (void *)super; 712 struct process *task = event->proc; 713 struct process *leader = task->leader; 714 struct process *teb = self->task_enabling_breakpoint; 715 716 debug(DEBUG_PROCESS, 717 "process_stopping_on_event: pid %d; event type %d; state %d", 718 task->pid, event->type, self->state); 719 720 struct pid_task *task_info = get_task_info(&self->pids, task->pid); 721 if (task_info == NULL) 722 fprintf(stderr, "new task??? %d\n", task->pid); 723 handle_stopping_event(task_info, &event); 724 725 int state = self->state; 726 int event_to_queue = !event_exit_or_none_p(event); 727 728 /* Deactivate the entry if the task exits. */ 729 if (event_exit_p(event) && task_info != NULL) 730 task_info->pid = 0; 731 732 /* Always handle sysrets. Whether sysret occurred and what 733 * sys it rets from may need to be determined based on process 734 * stack, so we need to keep that in sync with reality. Note 735 * that we don't continue the process after the sysret is 736 * handled. See continue_after_syscall. */ 737 if (event != NULL && event->type == EVENT_SYSRET) { 738 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 739 event_to_queue = 0; 740 task_info->sysret = 1; 741 } 742 743 switch (state) { 744 case PSH_STOPPING: 745 /* If everyone is stopped, singlestep. */ 746 if (each_task(leader, NULL, &task_blocked, 747 &self->pids) == NULL) { 748 (self->on_all_stopped)(self); 749 state = self->state; 750 } 751 break; 752 753 case PSH_SINGLESTEP: 754 /* In singlestep state, breakpoint signifies that we 755 * have now stepped, and can re-enable the breakpoint. */ 756 if (event != NULL && task == teb) { 757 758 /* If this was caused by a real breakpoint, as 759 * opposed to a singlestep, assume that it's 760 * an artificial breakpoint installed for some 761 * reason for the re-enablement. In that case 762 * handle it. */ 763 if (event->type == EVENT_BREAKPOINT) { 764 arch_addr_t ip 765 = get_instruction_pointer(task); 766 struct breakpoint *other 767 = address2bpstruct(leader, ip); 768 if (other != NULL) 769 breakpoint_on_hit(other, task); 770 } 771 772 /* If we got SIGNAL instead of BREAKPOINT, 773 * then this is not singlestep at all. */ 774 if (event->type == EVENT_SIGNAL) { 775 do_singlestep: 776 if (singlestep(self) < 0) { 777 singlestep_error(self); 778 post_singlestep(self, &event); 779 goto psh_sinking; 780 } 781 break; 782 } else { 783 switch ((self->keep_stepping_p)(self)) { 784 case CBS_FAIL: 785 /* XXX handle me */ 786 case CBS_STOP: 787 break; 788 case CBS_CONT: 789 /* Sink singlestep event. */ 790 if (event->type == EVENT_BREAKPOINT) 791 event = NULL; 792 goto do_singlestep; 793 } 794 } 795 796 /* Re-enable the breakpoint that we are 797 * stepping over. */ 798 struct breakpoint *sbp = self->breakpoint_being_enabled; 799 if (sbp->enabled) 800 enable_breakpoint(teb, sbp); 801 802 post_singlestep(self, &event); 803 goto psh_sinking; 804 } 805 break; 806 807 psh_sinking: 808 state = self->state = PSH_SINKING; 809 /* Fall through. */ 810 case PSH_SINKING: 811 if (await_sigstop_delivery(&self->pids, task_info, event)) 812 process_stopping_done(self, leader); 813 break; 814 815 case PSH_UGLY_WORKAROUND: 816 if (event == NULL) 817 break; 818 if (event->type == EVENT_BREAKPOINT) { 819 undo_breakpoint(event, leader); 820 if (task == teb) 821 self->task_enabling_breakpoint = NULL; 822 } 823 if (self->task_enabling_breakpoint == NULL 824 && all_stops_accountable(&self->pids)) { 825 undo_breakpoint(event, leader); 826 detach_process(leader); 827 event = NULL; // handled 828 } 829 } 830 831 if (event != NULL && event_to_queue) { 832 enque_event(event); 833 event = NULL; // sink the event 834 } 835 836 return event; 837} 838 839static void 840process_stopping_destroy(struct event_handler *super) 841{ 842 struct process_stopping_handler *self = (void *)super; 843 free(self->pids.tasks); 844} 845 846static enum callback_status 847no(struct process_stopping_handler *self) 848{ 849 return CBS_STOP; 850} 851 852int 853process_install_stopping_handler(struct process *proc, struct breakpoint *sbp, 854 void (*as)(struct process_stopping_handler *), 855 enum callback_status (*ks) 856 (struct process_stopping_handler *), 857 enum callback_status (*uw) 858 (struct process_stopping_handler *)) 859{ 860 debug(DEBUG_FUNCTION, 861 "process_install_stopping_handler: pid=%d", proc->pid); 862 863 struct process_stopping_handler *handler = calloc(sizeof(*handler), 1); 864 if (handler == NULL) 865 return -1; 866 867 if (as == NULL) 868 as = &linux_ptrace_disable_and_singlestep; 869 if (ks == NULL) 870 ks = &no; 871 if (uw == NULL) 872 uw = &no; 873 874 handler->super.on_event = process_stopping_on_event; 875 handler->super.destroy = process_stopping_destroy; 876 handler->task_enabling_breakpoint = proc; 877 handler->breakpoint_being_enabled = sbp; 878 handler->on_all_stopped = as; 879 handler->keep_stepping_p = ks; 880 handler->ugly_workaround_p = uw; 881 882 install_event_handler(proc->leader, &handler->super); 883 884 if (each_task(proc->leader, NULL, &send_sigstop, 885 &handler->pids) != NULL) { 886 destroy_event_handler(proc); 887 return -1; 888 } 889 890 /* And deliver the first fake event, in case all the 891 * conditions are already fulfilled. */ 892 Event ev = { 893 .type = EVENT_NONE, 894 .proc = proc, 895 }; 896 process_stopping_on_event(&handler->super, &ev); 897 898 return 0; 899} 900 901void 902continue_after_breakpoint(struct process *proc, struct breakpoint *sbp) 903{ 904 debug(DEBUG_PROCESS, 905 "continue_after_breakpoint: pid=%d, addr=%p", 906 proc->pid, sbp->addr); 907 908 set_instruction_pointer(proc, sbp->addr); 909 910 if (sbp->enabled == 0) { 911 continue_process(proc->pid); 912 } else if (process_install_stopping_handler 913 (proc, sbp, NULL, NULL, NULL) < 0) { 914 perror("process_stopping_handler_create"); 915 /* Carry on not bothering to re-enable. */ 916 continue_process(proc->pid); 917 } 918} 919 920/** 921 * Ltrace exit. When we are about to exit, we have to go through all 922 * the processes, stop them all, remove all the breakpoints, and then 923 * detach the processes that we attached to using -p. If we left the 924 * other tasks running, they might hit stray return breakpoints and 925 * produce artifacts, so we better stop everyone, even if it's a bit 926 * of extra work. 927 */ 928struct ltrace_exiting_handler 929{ 930 struct event_handler super; 931 struct pid_set pids; 932}; 933 934static Event * 935ltrace_exiting_on_event(struct event_handler *super, Event *event) 936{ 937 struct ltrace_exiting_handler *self = (void *)super; 938 struct process *task = event->proc; 939 struct process *leader = task->leader; 940 941 debug(DEBUG_PROCESS, 942 "ltrace_exiting_on_event: pid %d; event type %d", 943 task->pid, event->type); 944 945 struct pid_task *task_info = get_task_info(&self->pids, task->pid); 946 handle_stopping_event(task_info, &event); 947 948 if (event != NULL && event->type == EVENT_BREAKPOINT) 949 undo_breakpoint(event, leader); 950 951 if (await_sigstop_delivery(&self->pids, task_info, event) 952 && all_stops_accountable(&self->pids)) 953 detach_process(leader); 954 955 /* Sink all non-exit events. We are about to exit, so we 956 * don't bother with queuing them. */ 957 if (event_exit_or_none_p(event)) 958 return event; 959 960 return NULL; 961} 962 963static void 964ltrace_exiting_destroy(struct event_handler *super) 965{ 966 struct ltrace_exiting_handler *self = (void *)super; 967 free(self->pids.tasks); 968} 969 970static int 971ltrace_exiting_install_handler(struct process *proc) 972{ 973 /* Only install to leader. */ 974 if (proc->leader != proc) 975 return 0; 976 977 /* Perhaps we are already installed, if the user passed 978 * several -p options that are tasks of one process. */ 979 if (proc->event_handler != NULL 980 && proc->event_handler->on_event == <race_exiting_on_event) 981 return 0; 982 983 /* If stopping handler is already present, let it do the 984 * work. */ 985 if (proc->event_handler != NULL) { 986 assert(proc->event_handler->on_event 987 == &process_stopping_on_event); 988 struct process_stopping_handler *other 989 = (void *)proc->event_handler; 990 other->exiting = 1; 991 return 0; 992 } 993 994 struct ltrace_exiting_handler *handler 995 = calloc(sizeof(*handler), 1); 996 if (handler == NULL) { 997 perror("malloc exiting handler"); 998 fatal: 999 /* XXXXXXXXXXXXXXXXXXX fixme */ 1000 return -1; 1001 } 1002 1003 handler->super.on_event = ltrace_exiting_on_event; 1004 handler->super.destroy = ltrace_exiting_destroy; 1005 install_event_handler(proc->leader, &handler->super); 1006 1007 if (each_task(proc->leader, NULL, &send_sigstop, 1008 &handler->pids) != NULL) 1009 goto fatal; 1010 1011 return 0; 1012} 1013 1014/* 1015 * When the traced process vforks, it's suspended until the child 1016 * process calls _exit or exec*. In the meantime, the two share the 1017 * address space. 1018 * 1019 * The child process should only ever call _exit or exec*, but we 1020 * can't count on that (it's not the role of ltrace to policy, but to 1021 * observe). In any case, we will _at least_ have to deal with 1022 * removal of vfork return breakpoint (which we have to smuggle back 1023 * in, so that the parent can see it, too), and introduction of exec* 1024 * return breakpoint. Since we already have both breakpoint actions 1025 * to deal with, we might as well support it all. 1026 * 1027 * The gist is that we pretend that the child is in a thread group 1028 * with its parent, and handle it as a multi-threaded case, with the 1029 * exception that we know that the parent is blocked, and don't 1030 * attempt to stop it. When the child execs, we undo the setup. 1031 */ 1032 1033struct process_vfork_handler 1034{ 1035 struct event_handler super; 1036 arch_addr_t bp_addr; 1037}; 1038 1039static Event * 1040process_vfork_on_event(struct event_handler *super, Event *event) 1041{ 1042 debug(DEBUG_PROCESS, 1043 "process_vfork_on_event: pid %d; event type %d", 1044 event->proc->pid, event->type); 1045 1046 struct process_vfork_handler *self = (void *)super; 1047 assert(self != NULL); 1048 1049 switch (event->type) { 1050 case EVENT_BREAKPOINT: 1051 /* Remember the vfork return breakpoint. */ 1052 if (self->bp_addr == 0) 1053 self->bp_addr = event->e_un.brk_addr; 1054 break; 1055 1056 case EVENT_EXIT: 1057 case EVENT_EXIT_SIGNAL: 1058 case EVENT_EXEC: 1059 /* Smuggle back in the vfork return breakpoint, so 1060 * that our parent can trip over it once again. */ 1061 if (self->bp_addr != 0) { 1062 struct breakpoint *found; 1063 if (DICT_FIND_VAL(event->proc->leader->breakpoints, 1064 &self->bp_addr, &found) == 0) 1065 assert(found->libsym == NULL); 1066 /* We don't mind failing that, it's not a big 1067 * deal to not display one extra vfork return. */ 1068 insert_breakpoint(event->proc->parent, 1069 self->bp_addr, NULL); 1070 } 1071 1072 continue_process(event->proc->parent->pid); 1073 1074 /* Remove the leader that we artificially set up 1075 * earlier. */ 1076 change_process_leader(event->proc, event->proc); 1077 destroy_event_handler(event->proc); 1078 1079 default: 1080 ; 1081 } 1082 1083 return event; 1084} 1085 1086void 1087continue_after_vfork(struct process *proc) 1088{ 1089 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 1090 struct process_vfork_handler *handler = calloc(sizeof(*handler), 1); 1091 if (handler == NULL) { 1092 perror("malloc vfork handler"); 1093 /* Carry on not bothering to treat the process as 1094 * necessary. */ 1095 continue_process(proc->parent->pid); 1096 return; 1097 } 1098 1099 /* We must set up custom event handler, so that we see 1100 * exec/exit events for the task itself. */ 1101 handler->super.on_event = process_vfork_on_event; 1102 install_event_handler(proc, &handler->super); 1103 1104 /* Make sure that the child is sole thread. */ 1105 assert(proc->leader == proc); 1106 assert(proc->next == NULL || proc->next->leader != proc); 1107 1108 /* Make sure that the child's parent is properly set up. */ 1109 assert(proc->parent != NULL); 1110 assert(proc->parent->leader != NULL); 1111 1112 change_process_leader(proc, proc->parent->leader); 1113} 1114 1115static int 1116is_mid_stopping(struct process *proc) 1117{ 1118 return proc != NULL 1119 && proc->event_handler != NULL 1120 && proc->event_handler->on_event == &process_stopping_on_event; 1121} 1122 1123void 1124continue_after_syscall(struct process *proc, int sysnum, int ret_p) 1125{ 1126 /* Don't continue if we are mid-stopping. */ 1127 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 1128 debug(DEBUG_PROCESS, 1129 "continue_after_syscall: don't continue %d", 1130 proc->pid); 1131 return; 1132 } 1133 continue_process(proc->pid); 1134} 1135 1136void 1137continue_after_exec(struct process *proc) 1138{ 1139 continue_process(proc->pid); 1140 1141 /* After the exec, we expect to hit the first executable 1142 * instruction. 1143 * 1144 * XXX TODO It would be nice to have this removed, but then we 1145 * need to do that also for initial call to wait_for_proc in 1146 * execute_program. In that case we could generate a 1147 * EVENT_FIRST event or something, or maybe this could somehow 1148 * be rolled into EVENT_NEW. */ 1149 wait_for_proc(proc->pid); 1150 continue_process(proc->pid); 1151} 1152 1153/* If ltrace gets SIGINT, the processes directly or indirectly run by 1154 * ltrace get it too. We just have to wait long enough for the signal 1155 * to be delivered and the process terminated, which we notice and 1156 * exit ltrace, too. So there's not much we need to do there. We 1157 * want to keep tracing those processes as usual, in case they just 1158 * SIG_IGN the SIGINT to do their shutdown etc. 1159 * 1160 * For processes ran on the background, we want to install an exit 1161 * handler that stops all the threads, removes all breakpoints, and 1162 * detaches. 1163 */ 1164void 1165os_ltrace_exiting(void) 1166{ 1167 struct opt_p_t *it; 1168 for (it = opt_p; it != NULL; it = it->next) { 1169 struct process *proc = pid2proc(it->pid); 1170 if (proc == NULL || proc->leader == NULL) 1171 continue; 1172 if (ltrace_exiting_install_handler(proc->leader) < 0) 1173 fprintf(stderr, 1174 "Couldn't install exiting handler for %d.\n", 1175 proc->pid); 1176 } 1177} 1178 1179int 1180os_ltrace_exiting_sighandler(void) 1181{ 1182 extern int linux_in_waitpid; 1183 if (linux_in_waitpid) { 1184 os_ltrace_exiting(); 1185 return 1; 1186 } 1187 return 0; 1188} 1189 1190size_t 1191umovebytes(struct process *proc, void *addr, void *laddr, size_t len) 1192{ 1193 1194 union { 1195 long a; 1196 char c[sizeof(long)]; 1197 } a; 1198 int started = 0; 1199 size_t offset = 0, bytes_read = 0; 1200 1201 while (offset < len) { 1202 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1203 if (a.a == -1 && errno) { 1204 if (started && errno == EIO) 1205 return bytes_read; 1206 else 1207 return -1; 1208 } 1209 started = 1; 1210 1211 if (len - offset >= sizeof(long)) { 1212 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1213 bytes_read += sizeof(long); 1214 } 1215 else { 1216 memcpy(laddr + offset, &a.c[0], len - offset); 1217 bytes_read += (len - offset); 1218 } 1219 offset += sizeof(long); 1220 } 1221 1222 return bytes_read; 1223} 1224