trace.c revision ffe4cd25089680daf1bd1ec0114d177ec3e0cf95
1#include "config.h" 2 3#include <asm/unistd.h> 4#include <sys/types.h> 5#include <sys/wait.h> 6#include <assert.h> 7#include <errno.h> 8#include <stdio.h> 9#include <stdlib.h> 10#include <string.h> 11#include <unistd.h> 12 13#ifdef HAVE_LIBSELINUX 14# include <selinux/selinux.h> 15#endif 16 17#include "ptrace.h" 18#include "common.h" 19 20/* If the system headers did not provide the constants, hard-code the normal 21 values. */ 22#ifndef PTRACE_EVENT_FORK 23 24#define PTRACE_OLDSETOPTIONS 21 25#define PTRACE_SETOPTIONS 0x4200 26#define PTRACE_GETEVENTMSG 0x4201 27 28/* options set using PTRACE_SETOPTIONS */ 29#define PTRACE_O_TRACESYSGOOD 0x00000001 30#define PTRACE_O_TRACEFORK 0x00000002 31#define PTRACE_O_TRACEVFORK 0x00000004 32#define PTRACE_O_TRACECLONE 0x00000008 33#define PTRACE_O_TRACEEXEC 0x00000010 34#define PTRACE_O_TRACEVFORKDONE 0x00000020 35#define PTRACE_O_TRACEEXIT 0x00000040 36 37/* Wait extended result codes for the above trace options. */ 38#define PTRACE_EVENT_FORK 1 39#define PTRACE_EVENT_VFORK 2 40#define PTRACE_EVENT_CLONE 3 41#define PTRACE_EVENT_EXEC 4 42#define PTRACE_EVENT_VFORK_DONE 5 43#define PTRACE_EVENT_EXIT 6 44 45#endif /* PTRACE_EVENT_FORK */ 46 47#ifdef ARCH_HAVE_UMOVELONG 48extern int arch_umovelong (Process *, void *, long *, arg_type_info *); 49int 50umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 51 return arch_umovelong (proc, addr, result, info); 52} 53#else 54/* Read a single long from the process's memory address 'addr' */ 55int 56umovelong (Process *proc, void *addr, long *result, arg_type_info *info) { 57 long pointed_to; 58 59 errno = 0; 60 pointed_to = ptrace (PTRACE_PEEKTEXT, proc->pid, addr, 0); 61 if (pointed_to == -1 && errno) 62 return -errno; 63 64 *result = pointed_to; 65 if (info) { 66 switch(info->type) { 67 case ARGTYPE_INT: 68 *result &= 0x00000000ffffffffUL; 69 default: 70 break; 71 }; 72 } 73 return 0; 74} 75#endif 76 77void 78trace_fail_warning(pid_t pid) 79{ 80 /* This was adapted from GDB. */ 81#ifdef HAVE_LIBSELINUX 82 static int checked = 0; 83 if (checked) 84 return; 85 checked = 1; 86 87 /* -1 is returned for errors, 0 if it has no effect, 1 if 88 * PTRACE_ATTACH is forbidden. */ 89 if (security_get_boolean_active("deny_ptrace") == 1) 90 fprintf(stderr, 91"The SELinux boolean 'deny_ptrace' is enabled, which may prevent ltrace from\n" 92"tracing other processes. You can disable this process attach protection by\n" 93"issuing 'setsebool deny_ptrace=0' in the superuser context.\n"); 94#endif /* HAVE_LIBSELINUX */ 95} 96 97void 98trace_me(void) 99{ 100 debug(DEBUG_PROCESS, "trace_me: pid=%d", getpid()); 101 if (ptrace(PTRACE_TRACEME, 0, 1, 0) < 0) { 102 perror("PTRACE_TRACEME"); 103 trace_fail_warning(getpid()); 104 exit(1); 105 } 106} 107 108/* There's a (hopefully) brief period of time after the child process 109 * exec's when we can't trace it yet. Here we wait for kernel to 110 * prepare the process. */ 111void 112wait_for_proc(pid_t pid) 113{ 114 size_t i; 115 for (i = 0; i < 100; ++i) { 116 /* We read from memory address 0, but that shouldn't 117 * be a problem: the reading will just fail. We are 118 * looking for a particular reason of failure. */ 119 if (ptrace(PTRACE_PEEKTEXT, pid, 0, 0) != -1 120 || errno != ESRCH) 121 return; 122 123 usleep(1000); 124 } 125 126 fprintf(stderr, "\ 127I consistently fail to read a word from the freshly launched process.\n\ 128I'll now try to proceed with tracing, but this shouldn't be happening.\n"); 129} 130 131int 132trace_pid(pid_t pid) 133{ 134 debug(DEBUG_PROCESS, "trace_pid: pid=%d", pid); 135 /* This shouldn't emit error messages, as there are legitimate 136 * reasons that the PID can't be attached: like it may have 137 * already ended. */ 138 if (ptrace(PTRACE_ATTACH, pid, 1, 0) < 0) 139 return -1; 140 141 /* man ptrace: PTRACE_ATTACH attaches to the process specified 142 in pid. The child is sent a SIGSTOP, but will not 143 necessarily have stopped by the completion of this call; 144 use wait() to wait for the child to stop. */ 145 if (waitpid (pid, NULL, __WALL) != pid) { 146 perror ("trace_pid: waitpid"); 147 return -1; 148 } 149 150 return 0; 151} 152 153void 154trace_set_options(Process *proc, pid_t pid) { 155 if (proc->tracesysgood & 0x80) 156 return; 157 158 debug(DEBUG_PROCESS, "trace_set_options: pid=%d", pid); 159 160 long options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | 161 PTRACE_O_TRACEVFORK | PTRACE_O_TRACECLONE | 162 PTRACE_O_TRACEEXEC; 163 if (ptrace(PTRACE_SETOPTIONS, pid, 0, options) < 0 && 164 ptrace(PTRACE_OLDSETOPTIONS, pid, 0, options) < 0) { 165 perror("PTRACE_SETOPTIONS"); 166 return; 167 } 168 proc->tracesysgood |= 0x80; 169} 170 171void 172untrace_pid(pid_t pid) { 173 debug(DEBUG_PROCESS, "untrace_pid: pid=%d", pid); 174 ptrace(PTRACE_DETACH, pid, 1, 0); 175} 176 177void 178continue_after_signal(pid_t pid, int signum) { 179 debug(DEBUG_PROCESS, "continue_after_signal: pid=%d, signum=%d", pid, signum); 180 ptrace(PTRACE_SYSCALL, pid, 0, signum); 181} 182 183static enum ecb_status 184event_for_pid(Event * event, void * data) 185{ 186 if (event->proc != NULL && event->proc->pid == (pid_t)(uintptr_t)data) 187 return ecb_yield; 188 return ecb_cont; 189} 190 191static int 192have_events_for(pid_t pid) 193{ 194 return each_qd_event(event_for_pid, (void *)(uintptr_t)pid) != NULL; 195} 196 197void 198continue_process(pid_t pid) 199{ 200 debug(DEBUG_PROCESS, "continue_process: pid=%d", pid); 201 202 /* Only really continue the process if there are no events in 203 the queue for this process. Otherwise just wait for the 204 other events to arrive. */ 205 if (!have_events_for(pid)) 206 /* We always trace syscalls to control fork(), 207 * clone(), execve()... */ 208 ptrace(PTRACE_SYSCALL, pid, 0, 0); 209 else 210 debug(DEBUG_PROCESS, 211 "putting off the continue, events in que."); 212} 213 214/** 215 * This is used for bookkeeping related to PIDs that the event 216 * handlers work with. 217 */ 218struct pid_task { 219 pid_t pid; /* This may be 0 for tasks that exited 220 * mid-handling. */ 221 int sigstopped : 1; 222 int got_event : 1; 223 int delivered : 1; 224 int vforked : 1; 225 int sysret : 1; 226} * pids; 227 228struct pid_set { 229 struct pid_task * tasks; 230 size_t count; 231 size_t alloc; 232}; 233 234/** 235 * Breakpoint re-enablement. When we hit a breakpoint, we must 236 * disable it, single-step, and re-enable it. That single-step can be 237 * done only by one task in a task group, while others are stopped, 238 * otherwise the processes would race for who sees the breakpoint 239 * disabled and who doesn't. The following is to keep track of it 240 * all. 241 */ 242struct process_stopping_handler 243{ 244 Event_Handler super; 245 246 /* The task that is doing the re-enablement. */ 247 Process * task_enabling_breakpoint; 248 249 /* The pointer being re-enabled. */ 250 Breakpoint * breakpoint_being_enabled; 251 252 enum { 253 /* We are waiting for everyone to land in t/T. */ 254 psh_stopping = 0, 255 256 /* We are doing the PTRACE_SINGLESTEP. */ 257 psh_singlestep, 258 259 /* We are waiting for all the SIGSTOPs to arrive so 260 * that we can sink them. */ 261 psh_sinking, 262 263 /* This is for tracking the ugly workaround. */ 264 psh_ugly_workaround, 265 } state; 266 267 int exiting; 268 269 struct pid_set pids; 270}; 271 272static struct pid_task * 273get_task_info(struct pid_set * pids, pid_t pid) 274{ 275 assert(pid != 0); 276 size_t i; 277 for (i = 0; i < pids->count; ++i) 278 if (pids->tasks[i].pid == pid) 279 return &pids->tasks[i]; 280 281 return NULL; 282} 283 284static struct pid_task * 285add_task_info(struct pid_set * pids, pid_t pid) 286{ 287 if (pids->count == pids->alloc) { 288 size_t ns = (2 * pids->alloc) ?: 4; 289 struct pid_task * n = realloc(pids->tasks, 290 sizeof(*pids->tasks) * ns); 291 if (n == NULL) 292 return NULL; 293 pids->tasks = n; 294 pids->alloc = ns; 295 } 296 struct pid_task * task_info = &pids->tasks[pids->count++]; 297 memset(task_info, 0, sizeof(*task_info)); 298 task_info->pid = pid; 299 return task_info; 300} 301 302static enum pcb_status 303task_stopped(Process * task, void * data) 304{ 305 enum process_status st = process_status(task->pid); 306 if (data != NULL) 307 *(enum process_status *)data = st; 308 309 /* If the task is already stopped, don't worry about it. 310 * Likewise if it managed to become a zombie or terminate in 311 * the meantime. This can happen when the whole thread group 312 * is terminating. */ 313 switch (st) { 314 case ps_invalid: 315 case ps_tracing_stop: 316 case ps_zombie: 317 return pcb_cont; 318 case ps_sleeping: 319 case ps_stop: 320 case ps_other: 321 return pcb_stop; 322 } 323 324 abort (); 325} 326 327/* Task is blocked if it's stopped, or if it's a vfork parent. */ 328static enum pcb_status 329task_blocked(Process * task, void * data) 330{ 331 struct pid_set * pids = data; 332 struct pid_task * task_info = get_task_info(pids, task->pid); 333 if (task_info != NULL 334 && task_info->vforked) 335 return pcb_cont; 336 337 return task_stopped(task, NULL); 338} 339 340static Event * process_vfork_on_event(Event_Handler * super, Event * event); 341 342static enum pcb_status 343task_vforked(Process * task, void * data) 344{ 345 if (task->event_handler != NULL 346 && task->event_handler->on_event == &process_vfork_on_event) 347 return pcb_stop; 348 return pcb_cont; 349} 350 351static int 352is_vfork_parent(Process * task) 353{ 354 return each_task(task->leader, &task_vforked, NULL) != NULL; 355} 356 357static enum pcb_status 358send_sigstop(Process * task, void * data) 359{ 360 Process * leader = task->leader; 361 struct pid_set * pids = data; 362 363 /* Look for pre-existing task record, or add new. */ 364 struct pid_task * task_info = get_task_info(pids, task->pid); 365 if (task_info == NULL) 366 task_info = add_task_info(pids, task->pid); 367 if (task_info == NULL) { 368 perror("send_sigstop: add_task_info"); 369 destroy_event_handler(leader); 370 /* Signal failure upwards. */ 371 return pcb_stop; 372 } 373 374 /* This task still has not been attached to. It should be 375 stopped by the kernel. */ 376 if (task->state == STATE_BEING_CREATED) 377 return pcb_cont; 378 379 /* Don't bother sending SIGSTOP if we are already stopped, or 380 * if we sent the SIGSTOP already, which happens when we are 381 * handling "onexit" and inherited the handler from breakpoint 382 * re-enablement. */ 383 enum process_status st; 384 if (task_stopped(task, &st) == pcb_cont) 385 return pcb_cont; 386 if (task_info->sigstopped) { 387 if (!task_info->delivered) 388 return pcb_cont; 389 task_info->delivered = 0; 390 } 391 392 /* Also don't attempt to stop the process if it's a parent of 393 * vforked process. We set up event handler specially to hint 394 * us. In that case parent is in D state, which we use to 395 * weed out unnecessary looping. */ 396 if (st == ps_sleeping 397 && is_vfork_parent (task)) { 398 task_info->vforked = 1; 399 return pcb_cont; 400 } 401 402 if (task_kill(task->pid, SIGSTOP) >= 0) { 403 debug(DEBUG_PROCESS, "send SIGSTOP to %d", task->pid); 404 task_info->sigstopped = 1; 405 } else 406 fprintf(stderr, 407 "Warning: couldn't send SIGSTOP to %d\n", task->pid); 408 409 return pcb_cont; 410} 411 412/* On certain kernels, detaching right after a singlestep causes the 413 tracee to be killed with a SIGTRAP (that even though the singlestep 414 was properly caught by waitpid. The ugly workaround is to put a 415 breakpoint where IP points and let the process continue. After 416 this the breakpoint can be retracted and the process detached. */ 417static void 418ugly_workaround(Process * proc) 419{ 420 void * ip = get_instruction_pointer(proc); 421 Breakpoint * sbp = dict_find_entry(proc->leader->breakpoints, ip); 422 if (sbp != NULL) 423 enable_breakpoint(proc, sbp); 424 else 425 insert_breakpoint(proc, ip, NULL, 1); 426 ptrace(PTRACE_CONT, proc->pid, 0, 0); 427} 428 429static void 430process_stopping_done(struct process_stopping_handler * self, Process * leader) 431{ 432 debug(DEBUG_PROCESS, "process stopping done %d", 433 self->task_enabling_breakpoint->pid); 434 size_t i; 435 if (!self->exiting) { 436 for (i = 0; i < self->pids.count; ++i) 437 if (self->pids.tasks[i].pid != 0 438 && (self->pids.tasks[i].delivered 439 || self->pids.tasks[i].sysret)) 440 continue_process(self->pids.tasks[i].pid); 441 continue_process(self->task_enabling_breakpoint->pid); 442 destroy_event_handler(leader); 443 } else { 444 self->state = psh_ugly_workaround; 445 ugly_workaround(self->task_enabling_breakpoint); 446 } 447} 448 449/* Before we detach, we need to make sure that task's IP is on the 450 * edge of an instruction. So for tasks that have a breakpoint event 451 * in the queue, we adjust the instruction pointer, just like 452 * continue_after_breakpoint does. */ 453static enum ecb_status 454undo_breakpoint(Event * event, void * data) 455{ 456 if (event != NULL 457 && event->proc->leader == data 458 && event->type == EVENT_BREAKPOINT) 459 set_instruction_pointer(event->proc, event->e_un.brk_addr); 460 return ecb_cont; 461} 462 463static enum pcb_status 464untrace_task(Process * task, void * data) 465{ 466 if (task != data) 467 untrace_pid(task->pid); 468 return pcb_cont; 469} 470 471static enum pcb_status 472remove_task(Process * task, void * data) 473{ 474 /* Don't untrace leader just yet. */ 475 if (task != data) 476 remove_process(task); 477 return pcb_cont; 478} 479 480static void 481detach_process(Process * leader) 482{ 483 each_qd_event(&undo_breakpoint, leader); 484 disable_all_breakpoints(leader); 485 486 /* Now untrace the process, if it was attached to by -p. */ 487 struct opt_p_t * it; 488 for (it = opt_p; it != NULL; it = it->next) { 489 Process * proc = pid2proc(it->pid); 490 if (proc == NULL) 491 continue; 492 if (proc->leader == leader) { 493 each_task(leader, &untrace_task, NULL); 494 break; 495 } 496 } 497 each_task(leader, &remove_task, leader); 498 destroy_event_handler(leader); 499 remove_task(leader, NULL); 500} 501 502static void 503handle_stopping_event(struct pid_task * task_info, Event ** eventp) 504{ 505 /* Mark all events, so that we know whom to SIGCONT later. */ 506 if (task_info != NULL) 507 task_info->got_event = 1; 508 509 Event * event = *eventp; 510 511 /* In every state, sink SIGSTOP events for tasks that it was 512 * sent to. */ 513 if (task_info != NULL 514 && event->type == EVENT_SIGNAL 515 && event->e_un.signum == SIGSTOP) { 516 debug(DEBUG_PROCESS, "SIGSTOP delivered to %d", task_info->pid); 517 if (task_info->sigstopped 518 && !task_info->delivered) { 519 task_info->delivered = 1; 520 *eventp = NULL; // sink the event 521 } else 522 fprintf(stderr, "suspicious: %d got SIGSTOP, but " 523 "sigstopped=%d and delivered=%d\n", 524 task_info->pid, task_info->sigstopped, 525 task_info->delivered); 526 } 527} 528 529/* Some SIGSTOPs may have not been delivered to their respective tasks 530 * yet. They are still in the queue. If we have seen an event for 531 * that process, continue it, so that the SIGSTOP can be delivered and 532 * caught by ltrace. We don't mind that the process is after 533 * breakpoint (and therefore potentially doesn't have aligned IP), 534 * because the signal will be delivered without the process actually 535 * starting. */ 536static void 537continue_for_sigstop_delivery(struct pid_set * pids) 538{ 539 size_t i; 540 for (i = 0; i < pids->count; ++i) { 541 if (pids->tasks[i].pid != 0 542 && pids->tasks[i].sigstopped 543 && !pids->tasks[i].delivered 544 && pids->tasks[i].got_event) { 545 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 546 pids->tasks[i].pid); 547 ptrace(PTRACE_SYSCALL, pids->tasks[i].pid, 0, 0); 548 } 549 } 550} 551 552static int 553event_exit_p(Event * event) 554{ 555 return event != NULL && (event->type == EVENT_EXIT 556 || event->type == EVENT_EXIT_SIGNAL); 557} 558 559static int 560event_exit_or_none_p(Event * event) 561{ 562 return event == NULL || event_exit_p(event) 563 || event->type == EVENT_NONE; 564} 565 566static int 567await_sigstop_delivery(struct pid_set * pids, struct pid_task * task_info, 568 Event * event) 569{ 570 /* If we still didn't get our SIGSTOP, continue the process 571 * and carry on. */ 572 if (event != NULL && !event_exit_or_none_p(event) 573 && task_info != NULL && task_info->sigstopped) { 574 debug(DEBUG_PROCESS, "continue %d for SIGSTOP delivery", 575 task_info->pid); 576 /* We should get the signal the first thing 577 * after this, so it should be OK to continue 578 * even if we are over a breakpoint. */ 579 ptrace(PTRACE_SYSCALL, task_info->pid, 0, 0); 580 581 } else { 582 /* If all SIGSTOPs were delivered, uninstall the 583 * handler and continue everyone. */ 584 /* XXX I suspect that we should check tasks that are 585 * still around. Is things are now, there should be a 586 * race between waiting for everyone to stop and one 587 * of the tasks exiting. */ 588 int all_clear = 1; 589 size_t i; 590 for (i = 0; i < pids->count; ++i) 591 if (pids->tasks[i].pid != 0 592 && pids->tasks[i].sigstopped 593 && !pids->tasks[i].delivered) { 594 all_clear = 0; 595 break; 596 } 597 return all_clear; 598 } 599 600 return 0; 601} 602 603static int 604all_stops_accountable(struct pid_set * pids) 605{ 606 size_t i; 607 for (i = 0; i < pids->count; ++i) 608 if (pids->tasks[i].pid != 0 609 && !pids->tasks[i].got_event 610 && !have_events_for(pids->tasks[i].pid)) 611 return 0; 612 return 1; 613} 614 615static void 616singlestep(Process * proc) 617{ 618 debug(1, "PTRACE_SINGLESTEP"); 619 if (ptrace(PTRACE_SINGLESTEP, proc->pid, 0, 0)) 620 perror("PTRACE_SINGLESTEP"); 621} 622 623/* This event handler is installed when we are in the process of 624 * stopping the whole thread group to do the pointer re-enablement for 625 * one of the threads. We pump all events to the queue for later 626 * processing while we wait for all the threads to stop. When this 627 * happens, we let the re-enablement thread to PTRACE_SINGLESTEP, 628 * re-enable, and continue everyone. */ 629static Event * 630process_stopping_on_event(Event_Handler * super, Event * event) 631{ 632 struct process_stopping_handler * self = (void *)super; 633 Process * task = event->proc; 634 Process * leader = task->leader; 635 Breakpoint * sbp = self->breakpoint_being_enabled; 636 Process * teb = self->task_enabling_breakpoint; 637 638 debug(DEBUG_PROCESS, 639 "pid %d; event type %d; state %d", 640 task->pid, event->type, self->state); 641 642 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 643 if (task_info == NULL) 644 fprintf(stderr, "new task??? %d\n", task->pid); 645 handle_stopping_event(task_info, &event); 646 647 int state = self->state; 648 int event_to_queue = !event_exit_or_none_p(event); 649 650 /* Deactivate the entry if the task exits. */ 651 if (event_exit_p(event) && task_info != NULL) 652 task_info->pid = 0; 653 654 /* Always handle sysrets. Whether sysret occurred and what 655 * sys it rets from may need to be determined based on process 656 * stack, so we need to keep that in sync with reality. Note 657 * that we don't continue the process after the sysret is 658 * handled. See continue_after_syscall. */ 659 if (event != NULL && event->type == EVENT_SYSRET) { 660 debug(1, "%d LT_EV_SYSRET", event->proc->pid); 661 event_to_queue = 0; 662 task_info->sysret = 1; 663 } 664 665 switch (state) { 666 case psh_stopping: 667 /* If everyone is stopped, singlestep. */ 668 if (each_task(leader, &task_blocked, &self->pids) == NULL) { 669 debug(DEBUG_PROCESS, "all stopped, now SINGLESTEP %d", 670 teb->pid); 671 if (sbp->enabled) 672 disable_breakpoint(teb, sbp); 673 singlestep(teb); 674 self->state = state = psh_singlestep; 675 } 676 break; 677 678 case psh_singlestep: 679 /* In singlestep state, breakpoint signifies that we 680 * have now stepped, and can re-enable the breakpoint. */ 681 if (event != NULL && task == teb) { 682 683 /* This is not the singlestep that we are waiting for. */ 684 if (event->type == EVENT_SIGNAL) { 685 singlestep(task); 686 break; 687 } 688 689 /* Essentially we don't care what event caused 690 * the thread to stop. We can do the 691 * re-enablement now. */ 692 if (sbp->enabled) 693 enable_breakpoint(teb, sbp); 694 695 continue_for_sigstop_delivery(&self->pids); 696 697 self->breakpoint_being_enabled = NULL; 698 self->state = state = psh_sinking; 699 700 if (event->type == EVENT_BREAKPOINT) 701 event = NULL; // handled 702 } else 703 break; 704 705 /* fall-through */ 706 707 case psh_sinking: 708 if (await_sigstop_delivery(&self->pids, task_info, event)) 709 process_stopping_done(self, leader); 710 break; 711 712 case psh_ugly_workaround: 713 if (event == NULL) 714 break; 715 if (event->type == EVENT_BREAKPOINT) { 716 undo_breakpoint(event, leader); 717 if (task == teb) 718 self->task_enabling_breakpoint = NULL; 719 } 720 if (self->task_enabling_breakpoint == NULL 721 && all_stops_accountable(&self->pids)) { 722 undo_breakpoint(event, leader); 723 detach_process(leader); 724 event = NULL; // handled 725 } 726 } 727 728 if (event != NULL && event_to_queue) { 729 enque_event(event); 730 event = NULL; // sink the event 731 } 732 733 return event; 734} 735 736static void 737process_stopping_destroy(Event_Handler * super) 738{ 739 struct process_stopping_handler * self = (void *)super; 740 free(self->pids.tasks); 741} 742 743void 744continue_after_breakpoint(Process *proc, Breakpoint *sbp) 745{ 746 set_instruction_pointer(proc, sbp->addr); 747 if (sbp->enabled == 0) { 748 continue_process(proc->pid); 749 } else { 750 debug(DEBUG_PROCESS, 751 "continue_after_breakpoint: pid=%d, addr=%p", 752 proc->pid, sbp->addr); 753#if defined __sparc__ || defined __ia64___ || defined __mips__ 754 /* we don't want to singlestep here */ 755 continue_process(proc->pid); 756#else 757 struct process_stopping_handler * handler 758 = calloc(sizeof(*handler), 1); 759 if (handler == NULL) { 760 perror("malloc breakpoint disable handler"); 761 fatal: 762 /* Carry on not bothering to re-enable. */ 763 continue_process(proc->pid); 764 return; 765 } 766 767 handler->super.on_event = process_stopping_on_event; 768 handler->super.destroy = process_stopping_destroy; 769 handler->task_enabling_breakpoint = proc; 770 handler->breakpoint_being_enabled = sbp; 771 install_event_handler(proc->leader, &handler->super); 772 773 if (each_task(proc->leader, &send_sigstop, 774 &handler->pids) != NULL) 775 goto fatal; 776 777 /* And deliver the first fake event, in case all the 778 * conditions are already fulfilled. */ 779 Event ev; 780 ev.type = EVENT_NONE; 781 ev.proc = proc; 782 process_stopping_on_event(&handler->super, &ev); 783#endif 784 } 785} 786 787/** 788 * Ltrace exit. When we are about to exit, we have to go through all 789 * the processes, stop them all, remove all the breakpoints, and then 790 * detach the processes that we attached to using -p. If we left the 791 * other tasks running, they might hit stray return breakpoints and 792 * produce artifacts, so we better stop everyone, even if it's a bit 793 * of extra work. 794 */ 795struct ltrace_exiting_handler 796{ 797 Event_Handler super; 798 struct pid_set pids; 799}; 800 801static Event * 802ltrace_exiting_on_event(Event_Handler * super, Event * event) 803{ 804 struct ltrace_exiting_handler * self = (void *)super; 805 Process * task = event->proc; 806 Process * leader = task->leader; 807 808 debug(DEBUG_PROCESS, "pid %d; event type %d", task->pid, event->type); 809 810 struct pid_task * task_info = get_task_info(&self->pids, task->pid); 811 handle_stopping_event(task_info, &event); 812 813 if (event != NULL && event->type == EVENT_BREAKPOINT) 814 undo_breakpoint(event, leader); 815 816 if (await_sigstop_delivery(&self->pids, task_info, event) 817 && all_stops_accountable(&self->pids)) 818 detach_process(leader); 819 820 /* Sink all non-exit events. We are about to exit, so we 821 * don't bother with queuing them. */ 822 if (event_exit_or_none_p(event)) 823 return event; 824 825 return NULL; 826} 827 828static void 829ltrace_exiting_destroy(Event_Handler * super) 830{ 831 struct ltrace_exiting_handler * self = (void *)super; 832 free(self->pids.tasks); 833} 834 835static int 836ltrace_exiting_install_handler(Process * proc) 837{ 838 /* Only install to leader. */ 839 if (proc->leader != proc) 840 return 0; 841 842 /* Perhaps we are already installed, if the user passed 843 * several -p options that are tasks of one process. */ 844 if (proc->event_handler != NULL 845 && proc->event_handler->on_event == <race_exiting_on_event) 846 return 0; 847 848 /* If stopping handler is already present, let it do the 849 * work. */ 850 if (proc->event_handler != NULL) { 851 assert(proc->event_handler->on_event 852 == &process_stopping_on_event); 853 struct process_stopping_handler * other 854 = (void *)proc->event_handler; 855 other->exiting = 1; 856 return 0; 857 } 858 859 struct ltrace_exiting_handler * handler 860 = calloc(sizeof(*handler), 1); 861 if (handler == NULL) { 862 perror("malloc exiting handler"); 863 fatal: 864 /* XXXXXXXXXXXXXXXXXXX fixme */ 865 return -1; 866 } 867 868 handler->super.on_event = ltrace_exiting_on_event; 869 handler->super.destroy = ltrace_exiting_destroy; 870 install_event_handler(proc->leader, &handler->super); 871 872 if (each_task(proc->leader, &send_sigstop, 873 &handler->pids) != NULL) 874 goto fatal; 875 876 return 0; 877} 878 879/* 880 * When the traced process vforks, it's suspended until the child 881 * process calls _exit or exec*. In the meantime, the two share the 882 * address space. 883 * 884 * The child process should only ever call _exit or exec*, but we 885 * can't count on that (it's not the role of ltrace to policy, but to 886 * observe). In any case, we will _at least_ have to deal with 887 * removal of vfork return breakpoint (which we have to smuggle back 888 * in, so that the parent can see it, too), and introduction of exec* 889 * return breakpoint. Since we already have both breakpoint actions 890 * to deal with, we might as well support it all. 891 * 892 * The gist is that we pretend that the child is in a thread group 893 * with its parent, and handle it as a multi-threaded case, with the 894 * exception that we know that the parent is blocked, and don't 895 * attempt to stop it. When the child execs, we undo the setup. 896 */ 897 898struct process_vfork_handler 899{ 900 Event_Handler super; 901 void * bp_addr; 902}; 903 904static Event * 905process_vfork_on_event(Event_Handler * super, Event * event) 906{ 907 struct process_vfork_handler * self = (void *)super; 908 Breakpoint * sbp; 909 assert(self != NULL); 910 911 switch (event->type) { 912 case EVENT_BREAKPOINT: 913 /* Remember the vfork return breakpoint. */ 914 if (self->bp_addr == NULL) 915 self->bp_addr = event->e_un.brk_addr; 916 break; 917 918 case EVENT_EXIT: 919 case EVENT_EXIT_SIGNAL: 920 case EVENT_EXEC: 921 /* Smuggle back in the vfork return breakpoint, so 922 * that our parent can trip over it once again. */ 923 if (self->bp_addr != NULL) { 924 sbp = dict_find_entry(event->proc->leader->breakpoints, 925 self->bp_addr); 926 if (sbp != NULL) 927 insert_breakpoint(event->proc->parent, 928 self->bp_addr, 929 sbp->libsym, 1); 930 } 931 932 continue_process(event->proc->parent->pid); 933 934 /* Remove the leader that we artificially set up 935 * earlier. */ 936 change_process_leader(event->proc, event->proc); 937 destroy_event_handler(event->proc); 938 939 default: 940 ; 941 } 942 943 return event; 944} 945 946void 947continue_after_vfork(Process * proc) 948{ 949 debug(DEBUG_PROCESS, "continue_after_vfork: pid=%d", proc->pid); 950 struct process_vfork_handler * handler = calloc(sizeof(*handler), 1); 951 if (handler == NULL) { 952 perror("malloc vfork handler"); 953 /* Carry on not bothering to treat the process as 954 * necessary. */ 955 continue_process(proc->parent->pid); 956 return; 957 } 958 959 /* We must set up custom event handler, so that we see 960 * exec/exit events for the task itself. */ 961 handler->super.on_event = process_vfork_on_event; 962 install_event_handler(proc, &handler->super); 963 964 /* Make sure that the child is sole thread. */ 965 assert(proc->leader == proc); 966 assert(proc->next == NULL || proc->next->leader != proc); 967 968 /* Make sure that the child's parent is properly set up. */ 969 assert(proc->parent != NULL); 970 assert(proc->parent->leader != NULL); 971 972 change_process_leader(proc, proc->parent->leader); 973} 974 975static int 976is_mid_stopping(Process *proc) 977{ 978 return proc != NULL 979 && proc->event_handler != NULL 980 && proc->event_handler->on_event == &process_stopping_on_event; 981} 982 983void 984continue_after_syscall(Process * proc, int sysnum, int ret_p) 985{ 986 /* Don't continue if we are mid-stopping. */ 987 if (ret_p && (is_mid_stopping(proc) || is_mid_stopping(proc->leader))) { 988 debug(DEBUG_PROCESS, 989 "continue_after_syscall: don't continue %d", 990 proc->pid); 991 return; 992 } 993 continue_process(proc->pid); 994} 995 996/* If ltrace gets SIGINT, the processes directly or indirectly run by 997 * ltrace get it too. We just have to wait long enough for the signal 998 * to be delivered and the process terminated, which we notice and 999 * exit ltrace, too. So there's not much we need to do there. We 1000 * want to keep tracing those processes as usual, in case they just 1001 * SIG_IGN the SIGINT to do their shutdown etc. 1002 * 1003 * For processes ran on the background, we want to install an exit 1004 * handler that stops all the threads, removes all breakpoints, and 1005 * detaches. 1006 */ 1007void 1008os_ltrace_exiting(void) 1009{ 1010 struct opt_p_t * it; 1011 for (it = opt_p; it != NULL; it = it->next) { 1012 Process * proc = pid2proc(it->pid); 1013 if (proc == NULL || proc->leader == NULL) 1014 continue; 1015 if (ltrace_exiting_install_handler(proc->leader) < 0) 1016 fprintf(stderr, 1017 "Couldn't install exiting handler for %d.\n", 1018 proc->pid); 1019 } 1020} 1021 1022int 1023os_ltrace_exiting_sighandler(void) 1024{ 1025 extern int linux_in_waitpid; 1026 if (linux_in_waitpid) { 1027 os_ltrace_exiting(); 1028 return 1; 1029 } 1030 return 0; 1031} 1032 1033size_t 1034umovebytes(Process *proc, void *addr, void *laddr, size_t len) { 1035 1036 union { 1037 long a; 1038 char c[sizeof(long)]; 1039 } a; 1040 int started = 0; 1041 size_t offset = 0, bytes_read = 0; 1042 1043 while (offset < len) { 1044 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1045 if (a.a == -1 && errno) { 1046 if (started && errno == EIO) 1047 return bytes_read; 1048 else 1049 return -1; 1050 } 1051 started = 1; 1052 1053 if (len - offset >= sizeof(long)) { 1054 memcpy(laddr + offset, &a.c[0], sizeof(long)); 1055 bytes_read += sizeof(long); 1056 } 1057 else { 1058 memcpy(laddr + offset, &a.c[0], len - offset); 1059 bytes_read += (len - offset); 1060 } 1061 offset += sizeof(long); 1062 } 1063 1064 return bytes_read; 1065} 1066 1067/* Read a series of bytes starting at the process's memory address 1068 'addr' and continuing until a NUL ('\0') is seen or 'len' bytes 1069 have been read. 1070*/ 1071int 1072umovestr(Process *proc, void *addr, int len, void *laddr) { 1073 union { 1074 long a; 1075 char c[sizeof(long)]; 1076 } a; 1077 unsigned i; 1078 int offset = 0; 1079 1080 while (offset < len) { 1081 a.a = ptrace(PTRACE_PEEKTEXT, proc->pid, addr + offset, 0); 1082 for (i = 0; i < sizeof(long); i++) { 1083 if (a.c[i] && offset + (signed)i < len) { 1084 *(char *)(laddr + offset + i) = a.c[i]; 1085 } else { 1086 *(char *)(laddr + offset + i) = '\0'; 1087 return 0; 1088 } 1089 } 1090 offset += sizeof(long); 1091 } 1092 *(char *)(laddr + offset) = '\0'; 1093 return 0; 1094} 1095