trace.c revision 9e1e969838d9cc520abb96038aa98520c08c80b9
1#include "config.h" 2 3#include <asm/unistd.h> 4#include <sys/types.h> 5#include <sys/wait.h> 6#include <assert.h> 7#include <errno.h> 8#include <error.h> 9#include <stdio.h> 10#include <stdlib.h> 11#include <string.h> 12#include <unistd.h> 13 14#ifdef HAVE_LIBSELINUX 15# include <selinux/selinux.h> 16#endif 17 18#include "ptrace.h" 19#include "common.h" 20#include "breakpoint.h" 21#include "proc.h" 22#include "linux-gnu/trace.h" 23 24/* If the system headers did not provide the constants, hard-code the normal 25 values. */ 26#ifndef PTRACE_EVENT_FORK 27 28#define PTRACE_OLDSETOPTIONS 21 29#define PTRACE_SETOPTIONS 0x4200 30#define PTRACE_GETEVENTMSG 0x4201 31 32/* options set using PTRACE_SETOPTIONS */ 33#define PTRACE_O_TRACESYSGOOD 0x00000001 34#define PTRACE_O_TRACEFORK 0x00000002 35#define PTRACE_O_TRACEVFORK 0x00000004 36#define PTRACE_O_TRACECLONE 0x00000008 37#define PTRACE_O_TRACEEXEC 0x00000010 38#define PTRACE_O_TRACEVFORKDONE 0x00000020 39#define PTRACE_O_TRACEEXIT 0x00000040 40 41/* Wait extended result codes for the above trace options. */ 42#define PTRACE_EVENT_FORK 1 43#define PTRACE_EVENT_VFORK 2 44#define PTRACE_EVENT_CLONE 3 45#define PTRACE_EVENT_EXEC 4 46#define PTRACE_EVENT_VFORK_DONE 5 47#define PTRACE_EVENT_EXIT 6 48 49#endif /* PTRACE_EVENT_FORK */ 50 51#ifdef ARCH_HAVE_UMOVELONG 52extern int arch_umovelong (Process *, void *, long *, arg_type_info *); 53int 54umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 55 return arch_umovelong (proc, addr, result, info); 56} 57#else 58/* Read a single long from the process's memory address 'addr' */ 59int 60umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 61 long pointed_to; 62 63 errno = 0; 64 pointed_to = ptrace (PTRACE_PEEKTEXT, proc->pid, addr, 0); 65 if (pointed_to == -1 && errno) 66 return -errno; 67 68 *result = pointed_to; 69 if (info) { 70 switch(info->type) { 71 case ARGTYPE_INT: 72 *result &= 0x00000000ffffffffUL; 73 default: 74 break; 75 }; 76 } 77 return 0; 78} 79#endif 80 81void 82trace_fail_warning(pid_t pid) 83{ 84 /* This was adapted from GDB. */ 85#ifdef HAVE_LIBSELINUX 86 static int checked = 0; 87 if (checked) 88 return; 89 checked = 1; 90 91 /* -1 is returned for errors, 0 if it has no effect, 1 if 92 * PTRACE_ATTACH is forbidden. */ 93 if (security_get_boolean_active("deny_ptrace") == 1) 94 fprintf(stderr, 95"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 96"tracing other processes. You can disable this process attach protection by\n" 97"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 98#endif /* HAVE_LIBSELINUX */ 99} 100 101void 102trace_me(void) 103{ 104 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 105 if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) { 106 perror("PTRACE_TRACEME"); 107 trace_fail_warning(getpid()); 108 exit(1); 109 } 110} 111 112/* There's a (hopefully) brief period of time after the child process 113 * forks when we can't trace it yet. Here we wait for kernel to 114 * prepare the process. */ 115int 116wait_for_proc(pid_t pid) 117{ 118 /* man ptrace: PTRACE_ATTACH attaches to the process specified 119 in pid. The child is sent a SIGSTOP, but will not 120 necessarily have stopped by the completion of this call; 121 use wait() to wait for the child to stop. */ 122 if (waitpid(pid, NULL, __WALL) != pid) { 123 perror ("trace_pid: waitpid"); 124 return -1; 125 } 126 127 return 0; 128} 129 130int 131trace_pid(pid_t pid) 132{ 133 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 134 /* This shouldn't emit error messages, as there are legitimate 135 * reasons that the PID can't be attached: like it may have 136 * already ended. */ 137 if (ptrace(PTRACE_ATTACH, pid, 1, 0) < 0) 138 return -1; 139 140 return wait_for_proc(pid); 141} 142 143void 144trace_set_options(struct Process *proc) 145{ 146 if (proc->tracesysgood & 0x80) 147 return; 148 149 pid_t pid = proc->pid; 150 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 151 152 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 153 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 154 PTRACE_O_TRACEEXEC; 155 if (ptrace(PTRACE_SETOPTIONS, pid, 0, options) < 0 && 156 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, options) < 0) { 157 perror("PTRACE_SETOPTIONS"); 158 return; 159 } 160 proc->tracesysgood |= 0x80; 161} 162 163void 164untrace_pid(pid_t pid) { 165 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 166 ptrace(PTRACE_DETACH, pid, 1, 0); 167} 168 169void 170continue_after_signal(pid_t pid, int signum) { 171 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", pid, signum); 172 ptrace(PTRACE_SYSCALL, pid, 0, signum); 173} 174 175static enum ecb_status 176event_for_pid(Event * event, void * data) 177{ 178 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 179 return ecb_yield; 180 return ecb_cont; 181} 182 183static int 184have_events_for(pid_t pid) 185{ 186 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 187} 188 189void 190continue_process(pid_t pid) 191{ 192 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 193 194 /* Only really continue the process if there are no events in 195 the queue for this process. Otherwise just wait for the 196 other events to arrive. */ 197 if (!have_events_for(pid)) 198 /* We always trace syscalls to control fork(), 199 * clone(), execve()... */ 200 ptrace(PTRACE_SYSCALL, pid, 0, 0); 201 else 202 debug(DEBUG_PROCESS, 203 "putting off the continue, events in que."); 204} 205 206static struct pid_task * 207get_task_info(struct pid_set * pids, pid_t pid) 208{ 209 assert(pid != 0); 210 size_t i; 211 for (i = 0; i < pids->count; ++i) 212 if (pids->tasks[i].pid == pid) 213 return &pids->tasks[i]; 214 215 return NULL; 216} 217 218static struct pid_task * 219add_task_info(struct pid_set * pids, pid_t pid) 220{ 221 if (pids->count == pids->alloc) { 222 size_t ns = (2 * pids->alloc) ?: 4; 223 struct pid_task * n = realloc(pids->tasks, 224 sizeof(*pids->tasks) * ns); 225 if (n == NULL) 226 return NULL; 227 pids->tasks = n; 228 pids->alloc = ns; 229 } 230 struct pid_task * task_info = &pids->tasks[pids->count++]; 231 memset(task_info, 0, sizeof(*task_info)); 232 task_info->pid = pid; 233 return task_info; 234} 235 236static enum callback_status 237task_stopped(struct Process *task, void *data) 238{ 239 enum process_status st = process_status(task->pid); 240 if (data != NULL) 241 *(enum process_status *)data = st; 242 243 /* If the task is already stopped, don't worry about it. 244 * Likewise if it managed to become a zombie or terminate in 245 * the meantime. This can happen when the whole thread group 246 * is terminating. */ 247 switch (st) { 248 case ps_invalid: 249 case ps_tracing_stop: 250 case ps_zombie: 251 return CBS_CONT; 252 case ps_sleeping: 253 case ps_stop: 254 case ps_other: 255 return CBS_STOP; 256 } 257 258 abort (); 259} 260 261/* Task is blocked if it's stopped, or if it's a vfork parent. */ 262static enum callback_status 263task_blocked(struct Process *task, void *data) 264{ 265 struct pid_set * pids = data; 266 struct pid_task * task_info = get_task_info(pids, task->pid); 267 if (task_info != NULL 268 && task_info->vforked) 269 return CBS_CONT; 270 271 return task_stopped(task, NULL); 272} 273 274static Event *process_vfork_on_event(struct event_handler *super, Event *event); 275 276static enum callback_status 277task_vforked(struct Process *task, void *data) 278{ 279 if (task->event_handler != NULL 280 && task->event_handler->on_event == &process_vfork_on_event) 281 return CBS_STOP; 282 return CBS_CONT; 283} 284 285static int 286is_vfork_parent(struct Process *task) 287{ 288 return each_task(task->leader, NULL, &task_vforked, NULL) != NULL; 289} 290 291static enum callback_status 292send_sigstop(struct Process *task, void *data) 293{ 294 Process * leader = task->leader; 295 struct pid_set * pids = data; 296 297 /* Look for pre-existing task record, or add new. */ 298 struct pid_task * task_info = get_task_info(pids, task->pid); 299 if (task_info == NULL) 300 task_info = add_task_info(pids, task->pid); 301 if (task_info == NULL) { 302 perror("send_sigstop: add_task_info"); 303 destroy_event_handler(leader); 304 /* Signal failure upwards. */ 305 return CBS_STOP; 306 } 307 308 /* This task still has not been attached to. It should be 309 stopped by the kernel. */ 310 if (task->state == STATE_BEING_CREATED) 311 return CBS_CONT; 312 313 /* Don't bother sending SIGSTOP if we are already stopped, or 314 * if we sent the SIGSTOP already, which happens when we are 315 * handling "onexit" and inherited the handler from breakpoint 316 * re-enablement. */ 317 enum process_status st; 318 if (task_stopped(task, &st) == CBS_CONT) 319 return CBS_CONT; 320 if (task_info->sigstopped) { 321 if (!task_info->delivered) 322 return CBS_CONT; 323 task_info->delivered = 0; 324 } 325 326 /* Also don't attempt to stop the process if it's a parent of 327 * vforked process. We set up event handler specially to hint 328 * us. In that case parent is in D state, which we use to 329 * weed out unnecessary looping. */ 330 if (st == ps_sleeping 331 && is_vfork_parent (task)) { 332 task_info->vforked = 1; 333 return CBS_CONT; 334 } 335 336 if (task_kill(task->pid, SIGSTOP) >= 0) { 337 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 338 task_info->sigstopped = 1; 339 } else 340 fprintf(stderr, 341 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 342 343 return CBS_CONT; 344} 345 346/* On certain kernels, detaching right after a singlestep causes the 347 tracee to be killed with a SIGTRAP (that even though the singlestep 348 was properly caught by waitpid. The ugly workaround is to put a 349 breakpoint where IP points and let the process continue. After 350 this the breakpoint can be retracted and the process detached. */ 351static void 352ugly_workaround(Process * proc) 353{ 354 void * ip = get_instruction_pointer(proc); 355 struct breakpoint *sbp = dict_find_entry(proc->leader->breakpoints, ip); 356 if (sbp != NULL) 357 enable_breakpoint(proc, sbp); 358 else 359 insert_breakpoint(proc, ip, NULL); 360 ptrace(PTRACE_CONT, proc->pid, 0, 0); 361} 362 363static void 364process_stopping_done(struct process_stopping_handler * self, Process * leader) 365{ 366 debug(DEBUG_PROCESS, "process stopping done %d", 367 self->task_enabling_breakpoint->pid); 368 size_t i; 369 if (!self->exiting) { 370 for (i = 0; i < self->pids.count; ++i) 371 if (self->pids.tasks[i].pid != 0 372 && (self->pids.tasks[i].delivered 373 || self->pids.tasks[i].sysret)) 374 continue_process(self->pids.tasks[i].pid); 375 continue_process(self->task_enabling_breakpoint->pid); 376 destroy_event_handler(leader); 377 } 378 379 if (self->exiting) { 380 ugly_workaround: 381 self->state = psh_ugly_workaround; 382 ugly_workaround(self->task_enabling_breakpoint); 383 } else { 384 switch ((self->ugly_workaround_p)(self)) { 385 case CBS_FAIL: 386 /* xxx handle me */ 387 case CBS_STOP: 388 break; 389 case CBS_CONT: 390 goto ugly_workaround; 391 } 392 } 393} 394 395/* Before we detach, we need to make sure that task's IP is on the 396 * edge of an instruction. So for tasks that have a breakpoint event 397 * in the queue, we adjust the instruction pointer, just like 398 * continue_after_breakpoint does. */ 399static enum ecb_status 400undo_breakpoint(Event * event, void * data) 401{ 402 if (event != NULL 403 && event->proc->leader == data 404 && event->type == EVENT_BREAKPOINT) 405 set_instruction_pointer(event->proc, event->e_un.brk_addr); 406 return ecb_cont; 407} 408 409static enum callback_status 410untrace_task(struct Process *task, void *data) 411{ 412 if (task != data) 413 untrace_pid(task->pid); 414 return CBS_CONT; 415} 416 417static enum callback_status 418remove_task(struct Process *task, void *data) 419{ 420 /* Don't untrace leader just yet. */ 421 if (task != data) 422 remove_process(task); 423 return CBS_CONT; 424} 425 426static void 427detach_process(Process * leader) 428{ 429 each_qd_event(&undo_breakpoint, leader); 430 disable_all_breakpoints(leader); 431 432 /* Now untrace the process, if it was attached to by -p. */ 433 struct opt_p_t * it; 434 for (it = opt_p; it != NULL; it = it->next) { 435 Process * proc = pid2proc(it->pid); 436 if (proc == NULL) 437 continue; 438 if (proc->leader == leader) { 439 each_task(leader, NULL, &untrace_task, NULL); 440 break; 441 } 442 } 443 each_task(leader, NULL, &remove_task, leader); 444 destroy_event_handler(leader); 445 remove_task(leader, NULL); 446} 447 448static void 449handle_stopping_event(struct pid_task * task_info, Event ** eventp) 450{ 451 /* Mark all events, so that we know whom to SIGCONT later. */ 452 if (task_info != NULL) 453 task_info->got_event = 1; 454 455 Event * event = *eventp; 456 457 /* In every state, sink SIGSTOP events for tasks that it was 458 * sent to. */ 459 if (task_info != NULL 460 && event->type == EVENT_SIGNAL 461 && event->e_un.signum == SIGSTOP) { 462 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 463 if (task_info->sigstopped 464 && !task_info->delivered) { 465 task_info->delivered = 1; 466 *eventp = NULL; // sink the event 467 } else 468 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 469 "sigstopped=%d and delivered=%d\n", 470 task_info->pid, task_info->sigstopped, 471 task_info->delivered); 472 } 473} 474 475/* Some SIGSTOPs may have not been delivered to their respective tasks 476 * yet. They are still in the queue. If we have seen an event for 477 * that process, continue it, so that the SIGSTOP can be delivered and 478 * caught by ltrace. We don't mind that the process is after 479 * breakpoint (and therefore potentially doesn't have aligned IP), 480 * because the signal will be delivered without the process actually 481 * starting. */ 482static void 483continue_for_sigstop_delivery(struct pid_set * pids) 484{ 485 size_t i; 486 for (i = 0; i < pids->count; ++i) { 487 if (pids->tasks[i].pid != 0 488 && pids->tasks[i].sigstopped 489 && !pids->tasks[i].delivered 490 && pids->tasks[i].got_event) { 491 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 492 pids->tasks[i].pid); 493 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 494 } 495 } 496} 497 498static int 499event_exit_p(Event * event) 500{ 501 return event != NULL && (event->type == EVENT_EXIT 502 || event->type == EVENT_EXIT_SIGNAL); 503} 504 505static int 506event_exit_or_none_p(Event * event) 507{ 508 return event == NULL || event_exit_p(event) 509 || event->type == EVENT_NONE; 510} 511 512static int 513await_sigstop_delivery(struct pid_set * pids, struct pid_task * task_info, 514 Event * event) 515{ 516 /* If we still didn't get our SIGSTOP, continue the process 517 * and carry on. */ 518 if (event != NULL && !event_exit_or_none_p(event) 519 && task_info != NULL && task_info->sigstopped) { 520 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 521 task_info->pid); 522 /* We should get the signal the first thing 523 * after this, so it should be OK to continue 524 * even if we are over a breakpoint. */ 525 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 526 527 } else { 528 /* If all SIGSTOPs were delivered, uninstall the 529 * handler and continue everyone. */ 530 /* XXX I suspect that we should check tasks that are 531 * still around. Is things are now, there should be a 532 * race between waiting for everyone to stop and one 533 * of the tasks exiting. */ 534 int all_clear = 1; 535 size_t i; 536 for (i = 0; i < pids->count; ++i) 537 if (pids->tasks[i].pid != 0 538 && pids->tasks[i].sigstopped 539 && !pids->tasks[i].delivered) { 540 all_clear = 0; 541 break; 542 } 543 return all_clear; 544 } 545 546 return 0; 547} 548 549static int 550all_stops_accountable(struct pid_set * pids) 551{ 552 size_t i; 553 for (i = 0; i < pids->count; ++i) 554 if (pids->tasks[i].pid != 0 555 && !pids->tasks[i].got_event 556 && !have_events_for(pids->tasks[i].pid)) 557 return 0; 558 return 1; 559} 560 561/* The protocol is: 0 for success, negative for failure, positive if 562 * default singlestep is to be used. */ 563int arch_atomic_singlestep(struct Process *proc, struct breakpoint *sbp, 564 int (*add_cb)(void *addr, void *data), 565 void *add_cb_data); 566 567#ifndef ARCH_HAVE_ATOMIC_SINGLESTEP 568int 569arch_atomic_singlestep(struct Process *proc, struct breakpoint *sbp, 570 int (*add_cb)(void *addr, void *data), 571 void *add_cb_data) 572{ 573 return 1; 574} 575#endif 576 577static int 578atomic_singlestep_add_bp(void *addr, void *data) 579{ 580 struct process_stopping_handler *self = data; 581 struct Process *proc = self->task_enabling_breakpoint; 582 583 /* Only support single address as of now. */ 584 assert(self->atomic_skip_bp_addr == NULL); 585 586 self->atomic_skip_bp_addr = addr + 4; 587 insert_breakpoint(proc->leader, self->atomic_skip_bp_addr, NULL); 588 589 return 0; 590} 591 592static int 593singlestep(struct process_stopping_handler *self) 594{ 595 struct Process *proc = self->task_enabling_breakpoint; 596 597 int status = arch_atomic_singlestep(self->task_enabling_breakpoint, 598 self->breakpoint_being_enabled, 599 &atomic_singlestep_add_bp, self); 600 601 /* Propagate failure and success. */ 602 if (status <= 0) 603 return status; 604 605 /* Otherwise do the default action: singlestep. */ 606 debug(1, "PTRACE_SINGLESTEP"); 607 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) { 608 perror("PTRACE_SINGLESTEP"); 609 return -1; 610 } 611 return 0; 612} 613 614static void 615post_singlestep(struct process_stopping_handler *self, 616 struct Event **eventp) 617{ 618 continue_for_sigstop_delivery(&self->pids); 619 620 if ((*eventp)->type == EVENT_BREAKPOINT) 621 *eventp = NULL; // handled 622 623 if (self->atomic_skip_bp_addr != 0) 624 delete_breakpoint(self->task_enabling_breakpoint->leader, 625 self->atomic_skip_bp_addr); 626 627 self->breakpoint_being_enabled = NULL; 628} 629 630static void 631singlestep_error(struct process_stopping_handler *self) 632{ 633 struct Process *teb = self->task_enabling_breakpoint; 634 struct breakpoint *sbp = self->breakpoint_being_enabled; 635 fprintf(stderr, "%d couldn't continue when handling %s (%p) at %p\n", 636 teb->pid, sbp->libsym != NULL ? sbp->libsym->name : NULL, 637 sbp->addr, get_instruction_pointer(teb)); 638 delete_breakpoint(teb->leader, sbp->addr); 639} 640 641static void 642pt_continue(struct process_stopping_handler *self) 643{ 644 struct Process *teb = self->task_enabling_breakpoint; 645 debug(1, "PTRACE_CONT"); 646 ptrace(PTRACE_CONT, teb->pid, 0, 0); 647} 648 649static void 650pt_singlestep(struct process_stopping_handler *self) 651{ 652 if (singlestep(self) < 0) 653 singlestep_error(self); 654} 655 656static void 657disable_and(struct process_stopping_handler *self, 658 void (*do_this)(struct process_stopping_handler *self)) 659{ 660 struct Process *teb = self->task_enabling_breakpoint; 661 debug(DEBUG_PROCESS, "all stopped, now singlestep/cont %d", teb->pid); 662 if (self->breakpoint_being_enabled->enabled) 663 disable_breakpoint(teb, self->breakpoint_being_enabled); 664 (do_this)(self); 665 self->state = psh_singlestep; 666} 667 668void 669linux_ptrace_disable_and_singlestep(struct process_stopping_handler *self) 670{ 671 disable_and(self, &pt_singlestep); 672} 673 674void 675linux_ptrace_disable_and_continue(struct process_stopping_handler *self) 676{ 677 disable_and(self, &pt_continue); 678} 679 680/* This event handler is installed when we are in the process of 681 * stopping the whole thread group to do the pointer re-enablement for 682 * one of the threads. We pump all events to the queue for later 683 * processing while we wait for all the threads to stop. When this 684 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 685 * re-enable, and continue everyone. */ 686static Event * 687process_stopping_on_event(struct event_handler *super, Event *event) 688{ 689 struct process_stopping_handler * self = (void *)super; 690 Process * task = event->proc; 691 Process * leader = task->leader; 692 Process * teb = self->task_enabling_breakpoint; 693 694 debug(DEBUG_PROCESS, 695 "process_stopping_on_event: pid %d; event type %d; state %d", 696 task->pid, event->type, self->state); 697 698 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 699 if (task_info == NULL) 700 fprintf(stderr, "new task??? %d\n", task->pid); 701 handle_stopping_event(task_info, &event); 702 703 int state = self->state; 704 int event_to_queue = !event_exit_or_none_p(event); 705 706 /* Deactivate the entry if the task exits. */ 707 if (event_exit_p(event) && task_info != NULL) 708 task_info->pid = 0; 709 710 /* Always handle sysrets. Whether sysret occurred and what 711 * sys it rets from may need to be determined based on process 712 * stack, so we need to keep that in sync with reality. Note 713 * that we don't continue the process after the sysret is 714 * handled. See continue_after_syscall. */ 715 if (event != NULL && event->type == EVENT_SYSRET) { 716 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 717 event_to_queue = 0; 718 task_info->sysret = 1; 719 } 720 721 switch (state) { 722 case psh_stopping: 723 /* If everyone is stopped, singlestep. */ 724 if (each_task(leader, NULL, &task_blocked, 725 &self->pids) == NULL) { 726 (self->on_all_stopped)(self); 727 state = self->state; 728 } 729 break; 730 731 case psh_singlestep: 732 /* In singlestep state, breakpoint signifies that we 733 * have now stepped, and can re-enable the breakpoint. */ 734 if (event != NULL && task == teb) { 735 736 /* If we got SIGNAL instead of BREAKPOINT, 737 * then this is not singlestep at all. */ 738 if (event->type == EVENT_SIGNAL) { 739 do_singlestep: 740 if (singlestep(self) < 0) { 741 singlestep_error(self); 742 post_singlestep(self, &event); 743 goto psh_sinking; 744 } 745 break; 746 } else { 747 switch ((self->keep_stepping_p)(self)) { 748 case CBS_FAIL: 749 /* XXX handle me */ 750 case CBS_STOP: 751 break; 752 case CBS_CONT: 753 /* Sink singlestep event. */ 754 if (event->type == EVENT_BREAKPOINT) 755 event = NULL; 756 goto do_singlestep; 757 } 758 } 759 760 /* Re-enable the breakpoint that we are 761 * stepping over. */ 762 struct breakpoint *sbp = self->breakpoint_being_enabled; 763 if (sbp->enabled) 764 enable_breakpoint(teb, sbp); 765 766 /* If this was caused by a real breakpoint, as 767 * opposed to a singlestep, assume that it's 768 * an artificial breakpoint installed for some 769 * reason for the re-enablement. In that case 770 * handle it. */ 771 target_address_t ip = get_instruction_pointer(task); 772 struct breakpoint *other = address2bpstruct(leader, ip); 773 if (other != NULL) 774 breakpoint_on_hit(other, task); 775 776 post_singlestep(self, &event); 777 goto psh_sinking; 778 } 779 break; 780 781 psh_sinking: 782 state = self->state = psh_sinking; 783 case psh_sinking: 784 if (await_sigstop_delivery(&self->pids, task_info, event)) 785 process_stopping_done(self, leader); 786 break; 787 788 case psh_ugly_workaround: 789 if (event == NULL) 790 break; 791 if (event->type == EVENT_BREAKPOINT) { 792 undo_breakpoint(event, leader); 793 if (task == teb) 794 self->task_enabling_breakpoint = NULL; 795 } 796 if (self->task_enabling_breakpoint == NULL 797 && all_stops_accountable(&self->pids)) { 798 undo_breakpoint(event, leader); 799 detach_process(leader); 800 event = NULL; // handled 801 } 802 } 803 804 if (event != NULL && event_to_queue) { 805 enque_event(event); 806 event = NULL; // sink the event 807 } 808 809 return event; 810} 811 812static void 813process_stopping_destroy(struct event_handler *super) 814{ 815 struct process_stopping_handler * self = (void *)super; 816 free(self->pids.tasks); 817} 818 819static enum callback_status 820no(struct process_stopping_handler *self) 821{ 822 return CBS_STOP; 823} 824 825int 826process_install_stopping_handler(struct Process *proc, struct breakpoint *sbp, 827 void (*as)(struct process_stopping_handler *), 828 enum callback_status (*ks) 829 (struct process_stopping_handler *), 830 enum callback_status (*uw) 831 (struct process_stopping_handler *)) 832{ 833 debug(DEBUG_FUNCTION, 834 "process_install_stopping_handler: pid=%d", proc->pid); 835 836 struct process_stopping_handler *handler = calloc(sizeof(*handler), 1); 837 if (handler == NULL) 838 return -1; 839 840 if (as == NULL) 841 as = &linux_ptrace_disable_and_singlestep; 842 if (ks == NULL) 843 ks = &no; 844 if (uw == NULL) 845 uw = &no; 846 847 handler->super.on_event = process_stopping_on_event; 848 handler->super.destroy = process_stopping_destroy; 849 handler->task_enabling_breakpoint = proc; 850 handler->breakpoint_being_enabled = sbp; 851 handler->on_all_stopped = as; 852 handler->keep_stepping_p = ks; 853 handler->ugly_workaround_p = uw; 854 855 install_event_handler(proc->leader, &handler->super); 856 857 if (each_task(proc->leader, NULL, &send_sigstop, 858 &handler->pids) != NULL) { 859 destroy_event_handler(proc); 860 return -1; 861 } 862 863 /* And deliver the first fake event, in case all the 864 * conditions are already fulfilled. */ 865 Event ev = { 866 .type = EVENT_NONE, 867 .proc = proc, 868 }; 869 process_stopping_on_event(&handler->super, &ev); 870 871 return 0; 872} 873 874void 875continue_after_breakpoint(Process *proc, struct breakpoint *sbp) 876{ 877 debug(DEBUG_PROCESS, 878 "continue_after_breakpoint: pid=%d, addr=%p", 879 proc->pid, sbp->addr); 880 881 set_instruction_pointer(proc, sbp->addr); 882 883 if (sbp->enabled == 0) { 884 continue_process(proc->pid); 885 } else { 886#if defined __sparc__ || defined __ia64___ || defined __mips__ 887 /* we don't want to singlestep here */ 888 continue_process(proc->pid); 889#else 890 if (process_install_stopping_handler 891 (proc, sbp, NULL, NULL, NULL) < 0) { 892 perror("process_stopping_handler_create"); 893 /* Carry on not bothering to re-enable. */ 894 continue_process(proc->pid); 895 } 896#endif 897 } 898} 899 900/** 901 * Ltrace exit. When we are about to exit, we have to go through all 902 * the processes, stop them all, remove all the breakpoints, and then 903 * detach the processes that we attached to using -p. If we left the 904 * other tasks running, they might hit stray return breakpoints and 905 * produce artifacts, so we better stop everyone, even if it's a bit 906 * of extra work. 907 */ 908struct ltrace_exiting_handler 909{ 910 struct event_handler super; 911 struct pid_set pids; 912}; 913 914static Event * 915ltrace_exiting_on_event(struct event_handler *super, Event *event) 916{ 917 struct ltrace_exiting_handler * self = (void *)super; 918 Process * task = event->proc; 919 Process * leader = task->leader; 920 921 debug(DEBUG_PROCESS, 922 "ltrace_exiting_on_event: pid %d; event type %d", 923 task->pid, event->type); 924 925 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 926 handle_stopping_event(task_info, &event); 927 928 if (event != NULL && event->type == EVENT_BREAKPOINT) 929 undo_breakpoint(event, leader); 930 931 if (await_sigstop_delivery(&self->pids, task_info, event) 932 && all_stops_accountable(&self->pids)) 933 detach_process(leader); 934 935 /* Sink all non-exit events. We are about to exit, so we 936 * don't bother with queuing them. */ 937 if (event_exit_or_none_p(event)) 938 return event; 939 940 return NULL; 941} 942 943static void 944ltrace_exiting_destroy(struct event_handler *super) 945{ 946 struct ltrace_exiting_handler * self = (void *)super; 947 free(self->pids.tasks); 948} 949 950static int 951ltrace_exiting_install_handler(Process * proc) 952{ 953 /* Only install to leader. */ 954 if (proc->leader != proc) 955 return 0; 956 957 /* Perhaps we are already installed, if the user passed 958 * several -p options that are tasks of one process. */ 959 if (proc->event_handler != NULL 960 && proc->event_handler->on_event == <race_exiting_on_event) 961 return 0; 962 963 /* If stopping handler is already present, let it do the 964 * work. */ 965 if (proc->event_handler != NULL) { 966 assert(proc->event_handler->on_event 967 == &process_stopping_on_event); 968 struct process_stopping_handler * other 969 = (void *)proc->event_handler; 970 other->exiting = 1; 971 return 0; 972 } 973 974 struct ltrace_exiting_handler * handler 975 = calloc(sizeof(*handler), 1); 976 if (handler == NULL) { 977 perror("malloc exiting handler"); 978 fatal: 979 /* XXXXXXXXXXXXXXXXXXX fixme */ 980 return -1; 981 } 982 983 handler->super.on_event = ltrace_exiting_on_event; 984 handler->super.destroy = ltrace_exiting_destroy; 985 install_event_handler(proc->leader, &handler->super); 986 987 if (each_task(proc->leader, NULL, &send_sigstop, 988 &handler->pids) != NULL) 989 goto fatal; 990 991 return 0; 992} 993 994/* 995 * When the traced process vforks, it's suspended until the child 996 * process calls _exit or exec*. In the meantime, the two share the 997 * address space. 998 * 999 * The child process should only ever call _exit or exec*, but we 1000 * can't count on that (it's not the role of ltrace to policy, but to 1001 * observe). In any case, we will _at least_ have to deal with 1002 * removal of vfork return breakpoint (which we have to smuggle back 1003 * in, so that the parent can see it, too), and introduction of exec* 1004 * return breakpoint. Since we already have both breakpoint actions 1005 * to deal with, we might as well support it all. 1006 * 1007 * The gist is that we pretend that the child is in a thread group 1008 * with its parent, and handle it as a multi-threaded case, with the 1009 * exception that we know that the parent is blocked, and don't 1010 * attempt to stop it. When the child execs, we undo the setup. 1011 */ 1012 1013struct process_vfork_handler 1014{ 1015 struct event_handler super; 1016 void * bp_addr; 1017}; 1018 1019static Event * 1020process_vfork_on_event(struct event_handler *super, Event *event) 1021{ 1022 debug(DEBUG_PROCESS, 1023 "process_vfork_on_event: pid %d; event type %d", 1024 event->proc->pid, event->type); 1025 1026 struct process_vfork_handler * self = (void *)super; 1027 struct breakpoint *sbp; 1028 assert(self != NULL); 1029 1030 switch (event->type) { 1031 case EVENT_BREAKPOINT: 1032 /* Remember the vfork return breakpoint. */ 1033 if (self->bp_addr == NULL) 1034 self->bp_addr = event->e_un.brk_addr; 1035 break; 1036 1037 case EVENT_EXIT: 1038 case EVENT_EXIT_SIGNAL: 1039 case EVENT_EXEC: 1040 /* Smuggle back in the vfork return breakpoint, so 1041 * that our parent can trip over it once again. */ 1042 if (self->bp_addr != NULL) { 1043 sbp = dict_find_entry(event->proc->leader->breakpoints, 1044 self->bp_addr); 1045 if (sbp != NULL) 1046 insert_breakpoint(event->proc->parent, 1047 self->bp_addr, sbp->libsym); 1048 } 1049 1050 continue_process(event->proc->parent->pid); 1051 1052 /* Remove the leader that we artificially set up 1053 * earlier. */ 1054 change_process_leader(event->proc, event->proc); 1055 destroy_event_handler(event->proc); 1056 1057 default: 1058 ; 1059 } 1060 1061 return event; 1062} 1063 1064void 1065continue_after_vfork(Process * proc) 1066{ 1067 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 1068 struct process_vfork_handler * handler = calloc(sizeof(*handler), 1); 1069 if (handler == NULL) { 1070 perror("malloc vfork handler"); 1071 /* Carry on not bothering to treat the process as 1072 * necessary. */ 1073 continue_process(proc->parent->pid); 1074 return; 1075 } 1076 1077 /* We must set up custom event handler, so that we see 1078 * exec/exit events for the task itself. */ 1079 handler->super.on_event = process_vfork_on_event; 1080 install_event_handler(proc, &handler->super); 1081 1082 /* Make sure that the child is sole thread. */ 1083 assert(proc->leader == proc); 1084 assert(proc->next == NULL || proc->next->leader != proc); 1085 1086 /* Make sure that the child's parent is properly set up. */ 1087 assert(proc->parent != NULL); 1088 assert(proc->parent->leader != NULL); 1089 1090 change_process_leader(proc, proc->parent->leader); 1091} 1092 1093static int 1094is_mid_stopping(Process *proc) 1095{ 1096 return proc != NULL 1097 && proc->event_handler != NULL 1098 && proc->event_handler->on_event == &process_stopping_on_event; 1099} 1100 1101void 1102continue_after_syscall(Process * proc, int sysnum, int ret_p) 1103{ 1104 /* Don't continue if we are mid-stopping. */ 1105 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 1106 debug(DEBUG_PROCESS, 1107 "continue_after_syscall: don't continue %d", 1108 proc->pid); 1109 return; 1110 } 1111 continue_process(proc->pid); 1112} 1113 1114/* If ltrace gets SIGINT, the processes directly or indirectly run by 1115 * ltrace get it too. We just have to wait long enough for the signal 1116 * to be delivered and the process terminated, which we notice and 1117 * exit ltrace, too. So there's not much we need to do there. We 1118 * want to keep tracing those processes as usual, in case they just 1119 * SIG_IGN the SIGINT to do their shutdown etc. 1120 * 1121 * For processes ran on the background, we want to install an exit 1122 * handler that stops all the threads, removes all breakpoints, and 1123 * detaches. 1124 */ 1125void 1126os_ltrace_exiting(void) 1127{ 1128 struct opt_p_t * it; 1129 for (it = opt_p; it != NULL; it = it->next) { 1130 Process * proc = pid2proc(it->pid); 1131 if (proc == NULL || proc->leader == NULL) 1132 continue; 1133 if (ltrace_exiting_install_handler(proc->leader) < 0) 1134 fprintf(stderr, 1135 "Couldn't install exiting handler for %d.\n", 1136 proc->pid); 1137 } 1138} 1139 1140int 1141os_ltrace_exiting_sighandler(void) 1142{ 1143 extern int linux_in_waitpid; 1144 if (linux_in_waitpid) { 1145 os_ltrace_exiting(); 1146 return 1; 1147 } 1148 return 0; 1149} 1150 1151size_t 1152umovebytes(Process *proc, void *addr, void *laddr, size_t len) { 1153 1154 union { 1155 long a; 1156 char c[sizeof(long)]; 1157 } a; 1158 int started = 0; 1159 size_t offset = 0, bytes_read = 0; 1160 1161 while (offset < len) { 1162 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1163 if (a.a == -1 && errno) { 1164 if (started && errno == EIO) 1165 return bytes_read; 1166 else 1167 return -1; 1168 } 1169 started = 1; 1170 1171 if (len - offset >= sizeof(long)) { 1172 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1173 bytes_read += sizeof(long); 1174 } 1175 else { 1176 memcpy(laddr + offset, &a.c[0], len - offset); 1177 bytes_read += (len - offset); 1178 } 1179 offset += sizeof(long); 1180 } 1181 1182 return bytes_read; 1183} 1184 1185/* Read a series of bytes starting at the process's memory address 1186 'addr' and continuing until a NUL ('\0') is seen or 'len' bytes 1187 have been read. 1188*/ 1189int 1190umovestr(Process *proc, void *addr, int len, void *laddr) { 1191 union { 1192 long a; 1193 char c[sizeof(long)]; 1194 } a; 1195 unsigned i; 1196 int offset = 0; 1197 1198 while (offset < len) { 1199 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1200 for (i = 0; i < sizeof(long); i++) { 1201 if (a.c[i] && offset + (signed)i < len) { 1202 *(char *)(laddr + offset + i) = a.c[i]; 1203 } else { 1204 *(char *)(laddr + offset + i) = '\0'; 1205 return 0; 1206 } 1207 } 1208 offset += sizeof(long); 1209 } 1210 *(char *)(laddr + offset) = '\0'; 1211 return 0; 1212} 1213