trace.c revision cc0e1e4b83d69441cc5f61ea87eda5458ee9fae3
1#include "config.h" 2 3#include <asm/unistd.h> 4#include <sys/types.h> 5#include <sys/wait.h> 6#include <assert.h> 7#include <errno.h> 8#include <stdio.h> 9#include <stdlib.h> 10#include <string.h> 11#include <unistd.h> 12 13#ifdef HAVE_LIBSELINUX 14# include <selinux/selinux.h> 15#endif 16 17#include "ptrace.h" 18#include "common.h" 19#include "breakpoint.h" 20#include "proc.h" 21#include "linux-gnu/trace.h" 22 23/* If the system headers did not provide the constants, hard-code the normal 24 values. */ 25#ifndef PTRACE_EVENT_FORK 26 27#define PTRACE_OLDSETOPTIONS 21 28#define PTRACE_SETOPTIONS 0x4200 29#define PTRACE_GETEVENTMSG 0x4201 30 31/* options set using PTRACE_SETOPTIONS */ 32#define PTRACE_O_TRACESYSGOOD 0x00000001 33#define PTRACE_O_TRACEFORK 0x00000002 34#define PTRACE_O_TRACEVFORK 0x00000004 35#define PTRACE_O_TRACECLONE 0x00000008 36#define PTRACE_O_TRACEEXEC 0x00000010 37#define PTRACE_O_TRACEVFORKDONE 0x00000020 38#define PTRACE_O_TRACEEXIT 0x00000040 39 40/* Wait extended result codes for the above trace options. */ 41#define PTRACE_EVENT_FORK 1 42#define PTRACE_EVENT_VFORK 2 43#define PTRACE_EVENT_CLONE 3 44#define PTRACE_EVENT_EXEC 4 45#define PTRACE_EVENT_VFORK_DONE 5 46#define PTRACE_EVENT_EXIT 6 47 48#endif /* PTRACE_EVENT_FORK */ 49 50#ifdef ARCH_HAVE_UMOVELONG 51extern int arch_umovelong (Process *, void *, long *, arg_type_info *); 52int 53umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 54 return arch_umovelong (proc, addr, result, info); 55} 56#else 57/* Read a single long from the process's memory address 'addr' */ 58int 59umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 60 long pointed_to; 61 62 errno = 0; 63 pointed_to = ptrace (PTRACE_PEEKTEXT, proc->pid, addr, 0); 64 if (pointed_to == -1 && errno) 65 return -errno; 66 67 *result = pointed_to; 68 if (info) { 69 switch(info->type) { 70 case ARGTYPE_INT: 71 *result &= 0x00000000ffffffffUL; 72 default: 73 break; 74 }; 75 } 76 return 0; 77} 78#endif 79 80void 81trace_fail_warning(pid_t pid) 82{ 83 /* This was adapted from GDB. */ 84#ifdef HAVE_LIBSELINUX 85 static int checked = 0; 86 if (checked) 87 return; 88 checked = 1; 89 90 /* -1 is returned for errors, 0 if it has no effect, 1 if 91 * PTRACE_ATTACH is forbidden. */ 92 if (security_get_boolean_active("deny_ptrace") == 1) 93 fprintf(stderr, 94"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 95"tracing other processes. You can disable this process attach protection by\n" 96"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 97#endif /* HAVE_LIBSELINUX */ 98} 99 100void 101trace_me(void) 102{ 103 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 104 if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) { 105 perror("PTRACE_TRACEME"); 106 trace_fail_warning(getpid()); 107 exit(1); 108 } 109} 110 111/* There's a (hopefully) brief period of time after the child process 112 * forks when we can't trace it yet. Here we wait for kernel to 113 * prepare the process. */ 114int 115wait_for_proc(pid_t pid) 116{ 117 /* man ptrace: PTRACE_ATTACH attaches to the process specified 118 in pid. The child is sent a SIGSTOP, but will not 119 necessarily have stopped by the completion of this call; 120 use wait() to wait for the child to stop. */ 121 if (waitpid(pid, NULL, __WALL) != pid) { 122 perror ("trace_pid: waitpid"); 123 return -1; 124 } 125 126 return 0; 127} 128 129int 130trace_pid(pid_t pid) 131{ 132 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 133 /* This shouldn't emit error messages, as there are legitimate 134 * reasons that the PID can't be attached: like it may have 135 * already ended. */ 136 if (ptrace(PTRACE_ATTACH, pid, 1, 0) < 0) 137 return -1; 138 139 return wait_for_proc(pid); 140} 141 142void 143trace_set_options(struct Process *proc) 144{ 145 if (proc->tracesysgood & 0x80) 146 return; 147 148 pid_t pid = proc->pid; 149 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 150 151 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 152 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 153 PTRACE_O_TRACEEXEC; 154 if (ptrace(PTRACE_SETOPTIONS, pid, 0, options) < 0 && 155 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, options) < 0) { 156 perror("PTRACE_SETOPTIONS"); 157 return; 158 } 159 proc->tracesysgood |= 0x80; 160} 161 162void 163untrace_pid(pid_t pid) { 164 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 165 ptrace(PTRACE_DETACH, pid, 1, 0); 166} 167 168void 169continue_after_signal(pid_t pid, int signum) { 170 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", pid, signum); 171 ptrace(PTRACE_SYSCALL, pid, 0, signum); 172} 173 174static enum ecb_status 175event_for_pid(Event * event, void * data) 176{ 177 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 178 return ecb_yield; 179 return ecb_cont; 180} 181 182static int 183have_events_for(pid_t pid) 184{ 185 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 186} 187 188void 189continue_process(pid_t pid) 190{ 191 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 192 193 /* Only really continue the process if there are no events in 194 the queue for this process. Otherwise just wait for the 195 other events to arrive. */ 196 if (!have_events_for(pid)) 197 /* We always trace syscalls to control fork(), 198 * clone(), execve()... */ 199 ptrace(PTRACE_SYSCALL, pid, 0, 0); 200 else 201 debug(DEBUG_PROCESS, 202 "putting off the continue, events in que."); 203} 204 205static struct pid_task * 206get_task_info(struct pid_set * pids, pid_t pid) 207{ 208 assert(pid != 0); 209 size_t i; 210 for (i = 0; i < pids->count; ++i) 211 if (pids->tasks[i].pid == pid) 212 return &pids->tasks[i]; 213 214 return NULL; 215} 216 217static struct pid_task * 218add_task_info(struct pid_set * pids, pid_t pid) 219{ 220 if (pids->count == pids->alloc) { 221 size_t ns = (2 * pids->alloc) ?: 4; 222 struct pid_task * n = realloc(pids->tasks, 223 sizeof(*pids->tasks) * ns); 224 if (n == NULL) 225 return NULL; 226 pids->tasks = n; 227 pids->alloc = ns; 228 } 229 struct pid_task * task_info = &pids->tasks[pids->count++]; 230 memset(task_info, 0, sizeof(*task_info)); 231 task_info->pid = pid; 232 return task_info; 233} 234 235static enum callback_status 236task_stopped(struct Process *task, void *data) 237{ 238 enum process_status st = process_status(task->pid); 239 if (data != NULL) 240 *(enum process_status *)data = st; 241 242 /* If the task is already stopped, don't worry about it. 243 * Likewise if it managed to become a zombie or terminate in 244 * the meantime. This can happen when the whole thread group 245 * is terminating. */ 246 switch (st) { 247 case ps_invalid: 248 case ps_tracing_stop: 249 case ps_zombie: 250 return CBS_CONT; 251 case ps_sleeping: 252 case ps_stop: 253 case ps_other: 254 return CBS_STOP; 255 } 256 257 abort (); 258} 259 260/* Task is blocked if it's stopped, or if it's a vfork parent. */ 261static enum callback_status 262task_blocked(struct Process *task, void *data) 263{ 264 struct pid_set * pids = data; 265 struct pid_task * task_info = get_task_info(pids, task->pid); 266 if (task_info != NULL 267 && task_info->vforked) 268 return CBS_CONT; 269 270 return task_stopped(task, NULL); 271} 272 273static Event *process_vfork_on_event(struct event_handler *super, Event *event); 274 275static enum callback_status 276task_vforked(struct Process *task, void *data) 277{ 278 if (task->event_handler != NULL 279 && task->event_handler->on_event == &process_vfork_on_event) 280 return CBS_STOP; 281 return CBS_CONT; 282} 283 284static int 285is_vfork_parent(struct Process *task) 286{ 287 return each_task(task->leader, NULL, &task_vforked, NULL) != NULL; 288} 289 290static enum callback_status 291send_sigstop(struct Process *task, void *data) 292{ 293 Process * leader = task->leader; 294 struct pid_set * pids = data; 295 296 /* Look for pre-existing task record, or add new. */ 297 struct pid_task * task_info = get_task_info(pids, task->pid); 298 if (task_info == NULL) 299 task_info = add_task_info(pids, task->pid); 300 if (task_info == NULL) { 301 perror("send_sigstop: add_task_info"); 302 destroy_event_handler(leader); 303 /* Signal failure upwards. */ 304 return CBS_STOP; 305 } 306 307 /* This task still has not been attached to. It should be 308 stopped by the kernel. */ 309 if (task->state == STATE_BEING_CREATED) 310 return CBS_CONT; 311 312 /* Don't bother sending SIGSTOP if we are already stopped, or 313 * if we sent the SIGSTOP already, which happens when we are 314 * handling "onexit" and inherited the handler from breakpoint 315 * re-enablement. */ 316 enum process_status st; 317 if (task_stopped(task, &st) == CBS_CONT) 318 return CBS_CONT; 319 if (task_info->sigstopped) { 320 if (!task_info->delivered) 321 return CBS_CONT; 322 task_info->delivered = 0; 323 } 324 325 /* Also don't attempt to stop the process if it's a parent of 326 * vforked process. We set up event handler specially to hint 327 * us. In that case parent is in D state, which we use to 328 * weed out unnecessary looping. */ 329 if (st == ps_sleeping 330 && is_vfork_parent (task)) { 331 task_info->vforked = 1; 332 return CBS_CONT; 333 } 334 335 if (task_kill(task->pid, SIGSTOP) >= 0) { 336 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 337 task_info->sigstopped = 1; 338 } else 339 fprintf(stderr, 340 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 341 342 return CBS_CONT; 343} 344 345/* On certain kernels, detaching right after a singlestep causes the 346 tracee to be killed with a SIGTRAP (that even though the singlestep 347 was properly caught by waitpid. The ugly workaround is to put a 348 breakpoint where IP points and let the process continue. After 349 this the breakpoint can be retracted and the process detached. */ 350static void 351ugly_workaround(Process * proc) 352{ 353 void * ip = get_instruction_pointer(proc); 354 struct breakpoint *sbp = dict_find_entry(proc->leader->breakpoints, ip); 355 if (sbp != NULL) 356 enable_breakpoint(proc, sbp); 357 else 358 insert_breakpoint(proc, ip, NULL); 359 ptrace(PTRACE_CONT, proc->pid, 0, 0); 360} 361 362static void 363process_stopping_done(struct process_stopping_handler * self, Process * leader) 364{ 365 debug(DEBUG_PROCESS, "process stopping done %d", 366 self->task_enabling_breakpoint->pid); 367 size_t i; 368 if (!self->exiting) { 369 for (i = 0; i < self->pids.count; ++i) 370 if (self->pids.tasks[i].pid != 0 371 && (self->pids.tasks[i].delivered 372 || self->pids.tasks[i].sysret)) 373 continue_process(self->pids.tasks[i].pid); 374 continue_process(self->task_enabling_breakpoint->pid); 375 destroy_event_handler(leader); 376 } 377 378 if (self->exiting) { 379 ugly_workaround: 380 self->state = psh_ugly_workaround; 381 ugly_workaround(self->task_enabling_breakpoint); 382 } else { 383 switch ((self->ugly_workaround_p)(self)) { 384 case CBS_FAIL: 385 /* xxx handle me */ 386 case CBS_STOP: 387 break; 388 case CBS_CONT: 389 goto ugly_workaround; 390 } 391 } 392} 393 394/* Before we detach, we need to make sure that task's IP is on the 395 * edge of an instruction. So for tasks that have a breakpoint event 396 * in the queue, we adjust the instruction pointer, just like 397 * continue_after_breakpoint does. */ 398static enum ecb_status 399undo_breakpoint(Event * event, void * data) 400{ 401 if (event != NULL 402 && event->proc->leader == data 403 && event->type == EVENT_BREAKPOINT) 404 set_instruction_pointer(event->proc, event->e_un.brk_addr); 405 return ecb_cont; 406} 407 408static enum callback_status 409untrace_task(struct Process *task, void *data) 410{ 411 if (task != data) 412 untrace_pid(task->pid); 413 return CBS_CONT; 414} 415 416static enum callback_status 417remove_task(struct Process *task, void *data) 418{ 419 /* Don't untrace leader just yet. */ 420 if (task != data) 421 remove_process(task); 422 return CBS_CONT; 423} 424 425static enum callback_status 426retract_breakpoint_cb(struct Process *proc, struct breakpoint *bp, void *data) 427{ 428 breakpoint_on_retract(bp, proc); 429 return CBS_CONT; 430} 431 432static void 433detach_process(Process * leader) 434{ 435 each_qd_event(&undo_breakpoint, leader); 436 disable_all_breakpoints(leader); 437 proc_each_breakpoint(leader, NULL, retract_breakpoint_cb, NULL); 438 439 /* Now untrace the process, if it was attached to by -p. */ 440 struct opt_p_t * it; 441 for (it = opt_p; it != NULL; it = it->next) { 442 Process * proc = pid2proc(it->pid); 443 if (proc == NULL) 444 continue; 445 if (proc->leader == leader) { 446 each_task(leader, NULL, &untrace_task, NULL); 447 break; 448 } 449 } 450 each_task(leader, NULL, &remove_task, leader); 451 destroy_event_handler(leader); 452 remove_task(leader, NULL); 453} 454 455static void 456handle_stopping_event(struct pid_task * task_info, Event ** eventp) 457{ 458 /* Mark all events, so that we know whom to SIGCONT later. */ 459 if (task_info != NULL) 460 task_info->got_event = 1; 461 462 Event * event = *eventp; 463 464 /* In every state, sink SIGSTOP events for tasks that it was 465 * sent to. */ 466 if (task_info != NULL 467 && event->type == EVENT_SIGNAL 468 && event->e_un.signum == SIGSTOP) { 469 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 470 if (task_info->sigstopped 471 && !task_info->delivered) { 472 task_info->delivered = 1; 473 *eventp = NULL; // sink the event 474 } else 475 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 476 "sigstopped=%d and delivered=%d\n", 477 task_info->pid, task_info->sigstopped, 478 task_info->delivered); 479 } 480} 481 482/* Some SIGSTOPs may have not been delivered to their respective tasks 483 * yet. They are still in the queue. If we have seen an event for 484 * that process, continue it, so that the SIGSTOP can be delivered and 485 * caught by ltrace. We don't mind that the process is after 486 * breakpoint (and therefore potentially doesn't have aligned IP), 487 * because the signal will be delivered without the process actually 488 * starting. */ 489static void 490continue_for_sigstop_delivery(struct pid_set * pids) 491{ 492 size_t i; 493 for (i = 0; i < pids->count; ++i) { 494 if (pids->tasks[i].pid != 0 495 && pids->tasks[i].sigstopped 496 && !pids->tasks[i].delivered 497 && pids->tasks[i].got_event) { 498 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 499 pids->tasks[i].pid); 500 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 501 } 502 } 503} 504 505static int 506event_exit_p(Event * event) 507{ 508 return event != NULL && (event->type == EVENT_EXIT 509 || event->type == EVENT_EXIT_SIGNAL); 510} 511 512static int 513event_exit_or_none_p(Event * event) 514{ 515 return event == NULL || event_exit_p(event) 516 || event->type == EVENT_NONE; 517} 518 519static int 520await_sigstop_delivery(struct pid_set * pids, struct pid_task * task_info, 521 Event * event) 522{ 523 /* If we still didn't get our SIGSTOP, continue the process 524 * and carry on. */ 525 if (event != NULL && !event_exit_or_none_p(event) 526 && task_info != NULL && task_info->sigstopped) { 527 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 528 task_info->pid); 529 /* We should get the signal the first thing 530 * after this, so it should be OK to continue 531 * even if we are over a breakpoint. */ 532 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 533 534 } else { 535 /* If all SIGSTOPs were delivered, uninstall the 536 * handler and continue everyone. */ 537 /* XXX I suspect that we should check tasks that are 538 * still around. Is things are now, there should be a 539 * race between waiting for everyone to stop and one 540 * of the tasks exiting. */ 541 int all_clear = 1; 542 size_t i; 543 for (i = 0; i < pids->count; ++i) 544 if (pids->tasks[i].pid != 0 545 && pids->tasks[i].sigstopped 546 && !pids->tasks[i].delivered) { 547 all_clear = 0; 548 break; 549 } 550 return all_clear; 551 } 552 553 return 0; 554} 555 556static int 557all_stops_accountable(struct pid_set * pids) 558{ 559 size_t i; 560 for (i = 0; i < pids->count; ++i) 561 if (pids->tasks[i].pid != 0 562 && !pids->tasks[i].got_event 563 && !have_events_for(pids->tasks[i].pid)) 564 return 0; 565 return 1; 566} 567 568/* The protocol is: 0 for success, negative for failure, positive if 569 * default singlestep is to be used. */ 570int arch_atomic_singlestep(struct Process *proc, struct breakpoint *sbp, 571 int (*add_cb)(void *addr, void *data), 572 void *add_cb_data); 573 574#ifndef ARCH_HAVE_ATOMIC_SINGLESTEP 575int 576arch_atomic_singlestep(struct Process *proc, struct breakpoint *sbp, 577 int (*add_cb)(void *addr, void *data), 578 void *add_cb_data) 579{ 580 return 1; 581} 582#endif 583 584static Event *process_stopping_on_event(struct event_handler *super, 585 Event *event); 586 587static void 588remove_atomic_breakpoints(struct Process *proc) 589{ 590 struct process_stopping_handler *self 591 = (void *)proc->leader->event_handler; 592 assert(self != NULL); 593 assert(self->super.on_event == process_stopping_on_event); 594 595 int ct = sizeof(self->atomic_skip_bp_addrs) 596 / sizeof(*self->atomic_skip_bp_addrs); 597 int i; 598 for (i = 0; i < ct; ++i) 599 if (self->atomic_skip_bp_addrs[i] != 0) { 600 delete_breakpoint(proc, self->atomic_skip_bp_addrs[i]); 601 self->atomic_skip_bp_addrs[i] = 0; 602 } 603} 604 605static void 606atomic_singlestep_bp_on_hit(struct breakpoint *bp, struct Process *proc) 607{ 608 remove_atomic_breakpoints(proc); 609} 610 611static int 612atomic_singlestep_add_bp(void *addr, void *data) 613{ 614 struct process_stopping_handler *self = data; 615 struct Process *proc = self->task_enabling_breakpoint; 616 617 int ct = sizeof(self->atomic_skip_bp_addrs) 618 / sizeof(*self->atomic_skip_bp_addrs); 619 int i; 620 for (i = 0; i < ct; ++i) 621 if (self->atomic_skip_bp_addrs[i] == 0) { 622 self->atomic_skip_bp_addrs[i] = addr; 623 static struct bp_callbacks cbs = { 624 .on_hit = atomic_singlestep_bp_on_hit, 625 }; 626 struct breakpoint *bp 627 = insert_breakpoint(proc, addr, NULL); 628 breakpoint_set_callbacks(bp, &cbs); 629 return 0; 630 } 631 632 assert(!"Too many atomic singlestep breakpoints!"); 633 abort(); 634} 635 636static int 637singlestep(struct process_stopping_handler *self) 638{ 639 struct Process *proc = self->task_enabling_breakpoint; 640 641 int status = arch_atomic_singlestep(self->task_enabling_breakpoint, 642 self->breakpoint_being_enabled, 643 &atomic_singlestep_add_bp, self); 644 645 /* Propagate failure and success. */ 646 if (status <= 0) 647 return status; 648 649 /* Otherwise do the default action: singlestep. */ 650 debug(1, "PTRACE_SINGLESTEP"); 651 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) { 652 perror("PTRACE_SINGLESTEP"); 653 return -1; 654 } 655 return 0; 656} 657 658static void 659post_singlestep(struct process_stopping_handler *self, 660 struct Event **eventp) 661{ 662 continue_for_sigstop_delivery(&self->pids); 663 664 if (*eventp != NULL && (*eventp)->type == EVENT_BREAKPOINT) 665 *eventp = NULL; // handled 666 667 struct Process *proc = self->task_enabling_breakpoint; 668 669 remove_atomic_breakpoints(proc); 670 self->breakpoint_being_enabled = NULL; 671} 672 673static void 674singlestep_error(struct process_stopping_handler *self) 675{ 676 struct Process *teb = self->task_enabling_breakpoint; 677 struct breakpoint *sbp = self->breakpoint_being_enabled; 678 fprintf(stderr, "%d couldn't continue when handling %s (%p) at %p\n", 679 teb->pid, sbp->libsym != NULL ? sbp->libsym->name : NULL, 680 sbp->addr, get_instruction_pointer(teb)); 681 delete_breakpoint(teb->leader, sbp->addr); 682} 683 684static void 685pt_continue(struct process_stopping_handler *self) 686{ 687 struct Process *teb = self->task_enabling_breakpoint; 688 debug(1, "PTRACE_CONT"); 689 ptrace(PTRACE_CONT, teb->pid, 0, 0); 690} 691 692static void 693pt_singlestep(struct process_stopping_handler *self) 694{ 695 if (singlestep(self) < 0) 696 singlestep_error(self); 697} 698 699static void 700disable_and(struct process_stopping_handler *self, 701 void (*do_this)(struct process_stopping_handler *self)) 702{ 703 struct Process *teb = self->task_enabling_breakpoint; 704 debug(DEBUG_PROCESS, "all stopped, now singlestep/cont %d", teb->pid); 705 if (self->breakpoint_being_enabled->enabled) 706 disable_breakpoint(teb, self->breakpoint_being_enabled); 707 (do_this)(self); 708 self->state = psh_singlestep; 709} 710 711void 712linux_ptrace_disable_and_singlestep(struct process_stopping_handler *self) 713{ 714 disable_and(self, &pt_singlestep); 715} 716 717void 718linux_ptrace_disable_and_continue(struct process_stopping_handler *self) 719{ 720 disable_and(self, &pt_continue); 721} 722 723/* This event handler is installed when we are in the process of 724 * stopping the whole thread group to do the pointer re-enablement for 725 * one of the threads. We pump all events to the queue for later 726 * processing while we wait for all the threads to stop. When this 727 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 728 * re-enable, and continue everyone. */ 729static Event * 730process_stopping_on_event(struct event_handler *super, Event *event) 731{ 732 struct process_stopping_handler * self = (void *)super; 733 Process * task = event->proc; 734 Process * leader = task->leader; 735 Process * teb = self->task_enabling_breakpoint; 736 737 debug(DEBUG_PROCESS, 738 "process_stopping_on_event: pid %d; event type %d; state %d", 739 task->pid, event->type, self->state); 740 741 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 742 if (task_info == NULL) 743 fprintf(stderr, "new task??? %d\n", task->pid); 744 handle_stopping_event(task_info, &event); 745 746 int state = self->state; 747 int event_to_queue = !event_exit_or_none_p(event); 748 749 /* Deactivate the entry if the task exits. */ 750 if (event_exit_p(event) && task_info != NULL) 751 task_info->pid = 0; 752 753 /* Always handle sysrets. Whether sysret occurred and what 754 * sys it rets from may need to be determined based on process 755 * stack, so we need to keep that in sync with reality. Note 756 * that we don't continue the process after the sysret is 757 * handled. See continue_after_syscall. */ 758 if (event != NULL && event->type == EVENT_SYSRET) { 759 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 760 event_to_queue = 0; 761 task_info->sysret = 1; 762 } 763 764 switch (state) { 765 case psh_stopping: 766 /* If everyone is stopped, singlestep. */ 767 if (each_task(leader, NULL, &task_blocked, 768 &self->pids) == NULL) { 769 (self->on_all_stopped)(self); 770 state = self->state; 771 } 772 break; 773 774 case psh_singlestep: 775 /* In singlestep state, breakpoint signifies that we 776 * have now stepped, and can re-enable the breakpoint. */ 777 if (event != NULL && task == teb) { 778 779 /* If this was caused by a real breakpoint, as 780 * opposed to a singlestep, assume that it's 781 * an artificial breakpoint installed for some 782 * reason for the re-enablement. In that case 783 * handle it. */ 784 if (event->type == EVENT_BREAKPOINT) { 785 target_address_t ip 786 = get_instruction_pointer(task); 787 struct breakpoint *other 788 = address2bpstruct(leader, ip); 789 if (other != NULL) 790 breakpoint_on_hit(other, task); 791 } 792 793 /* If we got SIGNAL instead of BREAKPOINT, 794 * then this is not singlestep at all. */ 795 if (event->type == EVENT_SIGNAL) { 796 do_singlestep: 797 if (singlestep(self) < 0) { 798 singlestep_error(self); 799 post_singlestep(self, &event); 800 goto psh_sinking; 801 } 802 break; 803 } else { 804 switch ((self->keep_stepping_p)(self)) { 805 case CBS_FAIL: 806 /* XXX handle me */ 807 case CBS_STOP: 808 break; 809 case CBS_CONT: 810 /* Sink singlestep event. */ 811 if (event->type == EVENT_BREAKPOINT) 812 event = NULL; 813 goto do_singlestep; 814 } 815 } 816 817 /* Re-enable the breakpoint that we are 818 * stepping over. */ 819 struct breakpoint *sbp = self->breakpoint_being_enabled; 820 if (sbp->enabled) 821 enable_breakpoint(teb, sbp); 822 823 post_singlestep(self, &event); 824 goto psh_sinking; 825 } 826 break; 827 828 psh_sinking: 829 state = self->state = psh_sinking; 830 case psh_sinking: 831 if (await_sigstop_delivery(&self->pids, task_info, event)) 832 process_stopping_done(self, leader); 833 break; 834 835 case psh_ugly_workaround: 836 if (event == NULL) 837 break; 838 if (event->type == EVENT_BREAKPOINT) { 839 undo_breakpoint(event, leader); 840 if (task == teb) 841 self->task_enabling_breakpoint = NULL; 842 } 843 if (self->task_enabling_breakpoint == NULL 844 && all_stops_accountable(&self->pids)) { 845 undo_breakpoint(event, leader); 846 detach_process(leader); 847 event = NULL; // handled 848 } 849 } 850 851 if (event != NULL && event_to_queue) { 852 enque_event(event); 853 event = NULL; // sink the event 854 } 855 856 return event; 857} 858 859static void 860process_stopping_destroy(struct event_handler *super) 861{ 862 struct process_stopping_handler * self = (void *)super; 863 free(self->pids.tasks); 864} 865 866static enum callback_status 867no(struct process_stopping_handler *self) 868{ 869 return CBS_STOP; 870} 871 872int 873process_install_stopping_handler(struct Process *proc, struct breakpoint *sbp, 874 void (*as)(struct process_stopping_handler *), 875 enum callback_status (*ks) 876 (struct process_stopping_handler *), 877 enum callback_status (*uw) 878 (struct process_stopping_handler *)) 879{ 880 debug(DEBUG_FUNCTION, 881 "process_install_stopping_handler: pid=%d", proc->pid); 882 883 struct process_stopping_handler *handler = calloc(sizeof(*handler), 1); 884 if (handler == NULL) 885 return -1; 886 887 if (as == NULL) 888 as = &linux_ptrace_disable_and_singlestep; 889 if (ks == NULL) 890 ks = &no; 891 if (uw == NULL) 892 uw = &no; 893 894 handler->super.on_event = process_stopping_on_event; 895 handler->super.destroy = process_stopping_destroy; 896 handler->task_enabling_breakpoint = proc; 897 handler->breakpoint_being_enabled = sbp; 898 handler->on_all_stopped = as; 899 handler->keep_stepping_p = ks; 900 handler->ugly_workaround_p = uw; 901 902 install_event_handler(proc->leader, &handler->super); 903 904 if (each_task(proc->leader, NULL, &send_sigstop, 905 &handler->pids) != NULL) { 906 destroy_event_handler(proc); 907 return -1; 908 } 909 910 /* And deliver the first fake event, in case all the 911 * conditions are already fulfilled. */ 912 Event ev = { 913 .type = EVENT_NONE, 914 .proc = proc, 915 }; 916 process_stopping_on_event(&handler->super, &ev); 917 918 return 0; 919} 920 921void 922continue_after_breakpoint(Process *proc, struct breakpoint *sbp) 923{ 924 debug(DEBUG_PROCESS, 925 "continue_after_breakpoint: pid=%d, addr=%p", 926 proc->pid, sbp->addr); 927 928 set_instruction_pointer(proc, sbp->addr); 929 930 if (sbp->enabled == 0) { 931 continue_process(proc->pid); 932 } else { 933#if defined __sparc__ || defined __ia64___ || defined __mips__ 934 /* we don't want to singlestep here */ 935 continue_process(proc->pid); 936#else 937 if (process_install_stopping_handler 938 (proc, sbp, NULL, NULL, NULL) < 0) { 939 perror("process_stopping_handler_create"); 940 /* Carry on not bothering to re-enable. */ 941 continue_process(proc->pid); 942 } 943#endif 944 } 945} 946 947/** 948 * Ltrace exit. When we are about to exit, we have to go through all 949 * the processes, stop them all, remove all the breakpoints, and then 950 * detach the processes that we attached to using -p. If we left the 951 * other tasks running, they might hit stray return breakpoints and 952 * produce artifacts, so we better stop everyone, even if it's a bit 953 * of extra work. 954 */ 955struct ltrace_exiting_handler 956{ 957 struct event_handler super; 958 struct pid_set pids; 959}; 960 961static Event * 962ltrace_exiting_on_event(struct event_handler *super, Event *event) 963{ 964 struct ltrace_exiting_handler * self = (void *)super; 965 Process * task = event->proc; 966 Process * leader = task->leader; 967 968 debug(DEBUG_PROCESS, 969 "ltrace_exiting_on_event: pid %d; event type %d", 970 task->pid, event->type); 971 972 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 973 handle_stopping_event(task_info, &event); 974 975 if (event != NULL && event->type == EVENT_BREAKPOINT) 976 undo_breakpoint(event, leader); 977 978 if (await_sigstop_delivery(&self->pids, task_info, event) 979 && all_stops_accountable(&self->pids)) 980 detach_process(leader); 981 982 /* Sink all non-exit events. We are about to exit, so we 983 * don't bother with queuing them. */ 984 if (event_exit_or_none_p(event)) 985 return event; 986 987 return NULL; 988} 989 990static void 991ltrace_exiting_destroy(struct event_handler *super) 992{ 993 struct ltrace_exiting_handler * self = (void *)super; 994 free(self->pids.tasks); 995} 996 997static int 998ltrace_exiting_install_handler(Process * proc) 999{ 1000 /* Only install to leader. */ 1001 if (proc->leader != proc) 1002 return 0; 1003 1004 /* Perhaps we are already installed, if the user passed 1005 * several -p options that are tasks of one process. */ 1006 if (proc->event_handler != NULL 1007 && proc->event_handler->on_event == <race_exiting_on_event) 1008 return 0; 1009 1010 /* If stopping handler is already present, let it do the 1011 * work. */ 1012 if (proc->event_handler != NULL) { 1013 assert(proc->event_handler->on_event 1014 == &process_stopping_on_event); 1015 struct process_stopping_handler * other 1016 = (void *)proc->event_handler; 1017 other->exiting = 1; 1018 return 0; 1019 } 1020 1021 struct ltrace_exiting_handler * handler 1022 = calloc(sizeof(*handler), 1); 1023 if (handler == NULL) { 1024 perror("malloc exiting handler"); 1025 fatal: 1026 /* XXXXXXXXXXXXXXXXXXX fixme */ 1027 return -1; 1028 } 1029 1030 handler->super.on_event = ltrace_exiting_on_event; 1031 handler->super.destroy = ltrace_exiting_destroy; 1032 install_event_handler(proc->leader, &handler->super); 1033 1034 if (each_task(proc->leader, NULL, &send_sigstop, 1035 &handler->pids) != NULL) 1036 goto fatal; 1037 1038 return 0; 1039} 1040 1041/* 1042 * When the traced process vforks, it's suspended until the child 1043 * process calls _exit or exec*. In the meantime, the two share the 1044 * address space. 1045 * 1046 * The child process should only ever call _exit or exec*, but we 1047 * can't count on that (it's not the role of ltrace to policy, but to 1048 * observe). In any case, we will _at least_ have to deal with 1049 * removal of vfork return breakpoint (which we have to smuggle back 1050 * in, so that the parent can see it, too), and introduction of exec* 1051 * return breakpoint. Since we already have both breakpoint actions 1052 * to deal with, we might as well support it all. 1053 * 1054 * The gist is that we pretend that the child is in a thread group 1055 * with its parent, and handle it as a multi-threaded case, with the 1056 * exception that we know that the parent is blocked, and don't 1057 * attempt to stop it. When the child execs, we undo the setup. 1058 */ 1059 1060struct process_vfork_handler 1061{ 1062 struct event_handler super; 1063 void * bp_addr; 1064}; 1065 1066static Event * 1067process_vfork_on_event(struct event_handler *super, Event *event) 1068{ 1069 debug(DEBUG_PROCESS, 1070 "process_vfork_on_event: pid %d; event type %d", 1071 event->proc->pid, event->type); 1072 1073 struct process_vfork_handler * self = (void *)super; 1074 struct breakpoint *sbp; 1075 assert(self != NULL); 1076 1077 switch (event->type) { 1078 case EVENT_BREAKPOINT: 1079 /* Remember the vfork return breakpoint. */ 1080 if (self->bp_addr == 0) 1081 self->bp_addr = event->e_un.brk_addr; 1082 break; 1083 1084 case EVENT_EXIT: 1085 case EVENT_EXIT_SIGNAL: 1086 case EVENT_EXEC: 1087 /* Smuggle back in the vfork return breakpoint, so 1088 * that our parent can trip over it once again. */ 1089 if (self->bp_addr != 0) { 1090 sbp = dict_find_entry(event->proc->leader->breakpoints, 1091 self->bp_addr); 1092 if (sbp != NULL) 1093 assert(sbp->libsym == NULL); 1094 /* We don't mind failing that, it's not a big 1095 * deal to not display one extra vfork return. */ 1096 insert_breakpoint(event->proc->parent, 1097 self->bp_addr, NULL); 1098 } 1099 1100 continue_process(event->proc->parent->pid); 1101 1102 /* Remove the leader that we artificially set up 1103 * earlier. */ 1104 change_process_leader(event->proc, event->proc); 1105 destroy_event_handler(event->proc); 1106 1107 default: 1108 ; 1109 } 1110 1111 return event; 1112} 1113 1114void 1115continue_after_vfork(Process * proc) 1116{ 1117 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 1118 struct process_vfork_handler * handler = calloc(sizeof(*handler), 1); 1119 if (handler == NULL) { 1120 perror("malloc vfork handler"); 1121 /* Carry on not bothering to treat the process as 1122 * necessary. */ 1123 continue_process(proc->parent->pid); 1124 return; 1125 } 1126 1127 /* We must set up custom event handler, so that we see 1128 * exec/exit events for the task itself. */ 1129 handler->super.on_event = process_vfork_on_event; 1130 install_event_handler(proc, &handler->super); 1131 1132 /* Make sure that the child is sole thread. */ 1133 assert(proc->leader == proc); 1134 assert(proc->next == NULL || proc->next->leader != proc); 1135 1136 /* Make sure that the child's parent is properly set up. */ 1137 assert(proc->parent != NULL); 1138 assert(proc->parent->leader != NULL); 1139 1140 change_process_leader(proc, proc->parent->leader); 1141} 1142 1143static int 1144is_mid_stopping(Process *proc) 1145{ 1146 return proc != NULL 1147 && proc->event_handler != NULL 1148 && proc->event_handler->on_event == &process_stopping_on_event; 1149} 1150 1151void 1152continue_after_syscall(Process * proc, int sysnum, int ret_p) 1153{ 1154 /* Don't continue if we are mid-stopping. */ 1155 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 1156 debug(DEBUG_PROCESS, 1157 "continue_after_syscall: don't continue %d", 1158 proc->pid); 1159 return; 1160 } 1161 continue_process(proc->pid); 1162} 1163 1164/* If ltrace gets SIGINT, the processes directly or indirectly run by 1165 * ltrace get it too. We just have to wait long enough for the signal 1166 * to be delivered and the process terminated, which we notice and 1167 * exit ltrace, too. So there's not much we need to do there. We 1168 * want to keep tracing those processes as usual, in case they just 1169 * SIG_IGN the SIGINT to do their shutdown etc. 1170 * 1171 * For processes ran on the background, we want to install an exit 1172 * handler that stops all the threads, removes all breakpoints, and 1173 * detaches. 1174 */ 1175void 1176os_ltrace_exiting(void) 1177{ 1178 struct opt_p_t * it; 1179 for (it = opt_p; it != NULL; it = it->next) { 1180 Process * proc = pid2proc(it->pid); 1181 if (proc == NULL || proc->leader == NULL) 1182 continue; 1183 if (ltrace_exiting_install_handler(proc->leader) < 0) 1184 fprintf(stderr, 1185 "Couldn't install exiting handler for %d.\n", 1186 proc->pid); 1187 } 1188} 1189 1190int 1191os_ltrace_exiting_sighandler(void) 1192{ 1193 extern int linux_in_waitpid; 1194 if (linux_in_waitpid) { 1195 os_ltrace_exiting(); 1196 return 1; 1197 } 1198 return 0; 1199} 1200 1201size_t 1202umovebytes(Process *proc, void *addr, void *laddr, size_t len) { 1203 1204 union { 1205 long a; 1206 char c[sizeof(long)]; 1207 } a; 1208 int started = 0; 1209 size_t offset = 0, bytes_read = 0; 1210 1211 while (offset < len) { 1212 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1213 if (a.a == -1 && errno) { 1214 if (started && errno == EIO) 1215 return bytes_read; 1216 else 1217 return -1; 1218 } 1219 started = 1; 1220 1221 if (len - offset >= sizeof(long)) { 1222 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1223 bytes_read += sizeof(long); 1224 } 1225 else { 1226 memcpy(laddr + offset, &a.c[0], len - offset); 1227 bytes_read += (len - offset); 1228 } 1229 offset += sizeof(long); 1230 } 1231 1232 return bytes_read; 1233} 1234 1235/* Read a series of bytes starting at the process's memory address 1236 'addr' and continuing until a NUL ('\0') is seen or 'len' bytes 1237 have been read. 1238*/ 1239int 1240umovestr(Process *proc, void *addr, int len, void *laddr) { 1241 union { 1242 long a; 1243 char c[sizeof(long)]; 1244 } a; 1245 unsigned i; 1246 int offset = 0; 1247 1248 while (offset < len) { 1249 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1250 for (i = 0; i < sizeof(long); i++) { 1251 if (a.c[i] && offset + (signed)i < len) { 1252 *(char *)(laddr + offset + i) = a.c[i]; 1253 } else { 1254 *(char *)(laddr + offset + i) = '\0'; 1255 return 0; 1256 } 1257 } 1258 offset += sizeof(long); 1259 } 1260 *(char *)(laddr + offset) = '\0'; 1261 return 0; 1262} 1263