1 2/*--------------------------------------------------------------------*/ 3/*--- Client-space code for the core. vg_preloaded.c ---*/ 4/*--------------------------------------------------------------------*/ 5 6/* 7 This file is part of Valgrind, a dynamic binary instrumentation 8 framework. 9 10 Copyright (C) 2000-2017 Julian Seward 11 jseward@acm.org 12 13 This program is free software; you can redistribute it and/or 14 modify it under the terms of the GNU General Public License as 15 published by the Free Software Foundation; either version 2 of the 16 License, or (at your option) any later version. 17 18 This program is distributed in the hope that it will be useful, but 19 WITHOUT ANY WARRANTY; without even the implied warranty of 20 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 21 General Public License for more details. 22 23 You should have received a copy of the GNU General Public License 24 along with this program; if not, write to the Free Software 25 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 26 02111-1307, USA. 27 28 The GNU General Public License is contained in the file COPYING. 29*/ 30 31 32/* --------------------------------------------------------------------- 33 ALL THE CODE IN THIS FILE RUNS ON THE SIMULATED CPU. 34 35 These functions are not called directly - they're the targets of code 36 redirection or load notifications (see pub_core_redir.h for info). 37 They're named weirdly so that the intercept code can find them when the 38 shared object is initially loaded. 39 40 Note that this filename has the "vg_" prefix because it can appear 41 in stack traces, and the "vg_" makes it a little clearer that it 42 originates from Valgrind. 43 ------------------------------------------------------------------ */ 44 45#include "pub_core_basics.h" 46#include "pub_core_clreq.h" 47#include "pub_core_debuginfo.h" // Needed for pub_core_redir.h 48#include "pub_core_redir.h" // For VG_NOTIFY_ON_LOAD 49 50#if defined(VGO_linux) || defined(VGO_solaris) 51 52/* --------------------------------------------------------------------- 53 Hook for running __gnu_cxx::__freeres() and __libc_freeres() once 54 the program exits. 55 ------------------------------------------------------------------ */ 56 57void VG_NOTIFY_ON_LOAD(freeres)(Vg_FreeresToRun to_run); 58void VG_NOTIFY_ON_LOAD(freeres)(Vg_FreeresToRun to_run) 59{ 60# if !defined(__UCLIBC__) && !defined(MUSL_LIBC) \ 61 && !defined(VGPV_amd64_linux_android) \ 62 && !defined(VGPV_arm_linux_android) \ 63 && !defined(VGPV_x86_linux_android) \ 64 && !defined(VGPV_mips32_linux_android) \ 65 && !defined(VGPV_arm64_linux_android) \ 66 67 /* g++ mangled __gnu_cxx::__freeres yields -> _ZN9__gnu_cxx9__freeresEv */ 68 extern void _ZN9__gnu_cxx9__freeresEv(void) __attribute__((weak)); 69 if (((to_run & VG_RUN__GNU_CXX__FREERES) != 0) && 70 (_ZN9__gnu_cxx9__freeresEv != NULL)) { 71 _ZN9__gnu_cxx9__freeresEv(); 72 } 73 74# if defined(VGO_linux) 75 /* __libc_freeres() not yet available on Solaris. */ 76 extern void __libc_freeres(void); 77 if ((to_run & VG_RUN__LIBC_FREERES) != 0) { 78 __libc_freeres(); 79 } 80# endif 81# endif 82 83 VALGRIND_DO_CLIENT_REQUEST_STMT(VG_USERREQ__FREERES_DONE, 0, 0, 0, 0, 0); 84 /*NOTREACHED*/ 85 *(volatile int *)0 = 'x'; 86} 87 88#endif // VGO_linux || VGO_solaris 89 90#if defined(VGO_linux) 91 92/* --------------------------------------------------------------------- 93 Wrapper for indirect functions which need to be redirected. 94 ------------------------------------------------------------------ */ 95 96void * VG_NOTIFY_ON_LOAD(ifunc_wrapper) (void); 97void * VG_NOTIFY_ON_LOAD(ifunc_wrapper) (void) 98{ 99 OrigFn fn; 100 Addr result = 0; 101 Addr fnentry; 102 103 /* Call the original indirect function and get it's result */ 104 VALGRIND_GET_ORIG_FN(fn); 105 CALL_FN_W_v(result, fn); 106 107#if defined(VGP_ppc64be_linux) 108 /* ppc64be uses function descriptors, so get the actual function entry 109 address for the client request, but return the function descriptor 110 from this function. 111 result points to the function descriptor, which starts with the 112 function entry. */ 113 fnentry = *(Addr*)result; 114#else 115 fnentry = result; 116#endif 117 118 /* Ask the valgrind core running on the real CPU (as opposed to this 119 code which runs on the emulated CPU) to update the redirection that 120 led to this function. This client request eventually gives control to 121 the function VG_(redir_add_ifunc_target) in m_redir.c */ 122 VALGRIND_DO_CLIENT_REQUEST_STMT(VG_USERREQ__ADD_IFUNC_TARGET, 123 fn.nraddr, fnentry, 0, 0, 0); 124 return (void*)result; 125} 126 127#elif defined(VGO_darwin) 128 129#include "config.h" /* VERSION */ 130 131/* --------------------------------------------------------------------- 132 Darwin crash log hints 133 ------------------------------------------------------------------ */ 134 135/* This string will be inserted into crash logs, so crashes while 136 running under Valgrind can be distinguished from other crashes. */ 137__private_extern__ const char *__crashreporter_info__ = "Instrumented by Valgrind " VERSION; 138 139/* --------------------------------------------------------------------- 140 Darwin environment cleanup 141 ------------------------------------------------------------------ */ 142 143/* Scrubbing DYLD_INSERT_LIBRARIES from envp during exec is insufficient, 144 as there are other ways to launch a process with environment that 145 valgrind can't catch easily (i.e. launchd). 146 Instead, scrub DYLD_INSERT_LIBRARIES from the parent process once 147 dyld is done loading vg_preload.so. 148*/ 149#include <string.h> 150#include <crt_externs.h> 151 152// GrP fixme copied from m_libcproc 153static void env_unsetenv ( HChar **env, const HChar *varname ) 154{ 155 HChar **from; 156 HChar **to = NULL; 157 Int len = strlen(varname); 158 159 for (from = to = env; from && *from; from++) { 160 if (!(strncmp(varname, *from, len) == 0 && (*from)[len] == '=')) { 161 *to = *from; 162 to++; 163 } 164 } 165 *(to++) = *(from++); 166 /* fix the 4th "char* apple" pointer (aka. executable path pointer) */ 167 *(to++) = *(from++); 168 *to = NULL; 169} 170 171static void vg_cleanup_env(void) __attribute__((constructor)); 172static void vg_cleanup_env(void) 173{ 174 HChar **envp = (HChar**)*_NSGetEnviron(); 175 env_unsetenv(envp, "VALGRIND_LAUNCHER"); 176 env_unsetenv(envp, "DYLD_SHARED_REGION"); 177 // GrP fixme should be more like mash_colon_env() 178 env_unsetenv(envp, "DYLD_INSERT_LIBRARIES"); 179} 180 181/* --------------------------------------------------------------------- 182 Darwin arc4random (rdar://6166275) 183 ------------------------------------------------------------------ */ 184 185#include <fcntl.h> 186#include <unistd.h> 187 188int VG_REPLACE_FUNCTION_ZU(libSystemZdZaZddylib, arc4random)(void); 189int VG_REPLACE_FUNCTION_ZU(libSystemZdZaZddylib, arc4random)(void) 190{ 191 static int rnd = -1; 192 int result; 193 194 if (rnd < 0) rnd = open("/dev/random", O_RDONLY); 195 196 read(rnd, &result, sizeof(result)); 197 return result; 198} 199 200void VG_REPLACE_FUNCTION_ZU(libSystemZdZaZddylib, arc4random_stir)(void); 201void VG_REPLACE_FUNCTION_ZU(libSystemZdZaZddylib, arc4random_stir)(void) 202{ 203 // do nothing 204} 205 206void VG_REPLACE_FUNCTION_ZU(libSystemZdZaZddylib, arc4random_addrandom)(unsigned char *dat, int datlen); 207void VG_REPLACE_FUNCTION_ZU(libSystemZdZaZddylib, arc4random_addrandom)(unsigned char *dat, int datlen) 208{ 209 // do nothing 210 // GrP fixme ought to check [dat..dat+datlen) is defined 211 // but don't care if it's initialized 212} 213 214#elif defined(VGO_solaris) 215 216/* Declare the errno and environ symbols weakly in case the client is not 217 linked against libc. In such a case it also cannot run replacement 218 functions for set_error() and spawnveg() where these two variables are 219 needed so this is ok. */ 220__attribute__((weak)) extern int errno; 221__attribute__((weak)) extern char **environ; 222 223#include <assert.h> 224#include <errno.h> 225#include <spawn.h> 226#include <sys/syscall.h> 227#include <sys/signal.h> 228#include <unistd.h> 229 230/* Replace function block_all_signals() from libc. When the client program is 231 not running under valgrind, the function blocks all signals by setting 232 sc_sigblock flag in the schedctl control block. When run under Valgrind 233 this would bypass Valgrind's syscall and signal machinery. 234 Valgrind's signal machinery needs to retain control over which signals are 235 blocked and which not (see m_signals.c and m_scheduler/scheduler.c for more 236 information - typically synchronous signals should not be blocked). 237 Therefore this function replacement emulates lwp_sigmask syscall. 238*/ 239void VG_REPLACE_FUNCTION_ZU(VG_Z_LIBC_SONAME, block_all_signals)(/*ulwp_t*/ void *self); 240void VG_REPLACE_FUNCTION_ZU(VG_Z_LIBC_SONAME, block_all_signals)(/*ulwp_t*/ void *self) 241{ 242 syscall(SYS_lwp_sigmask, SIG_SETMASK, ~0U, ~0U, ~0U, ~0U); 243} 244 245/* Replace functions get_error() and set_error() in libc. These functions are 246 internal to the library and are used to work with an error value returned 247 by posix_spawn() (when it is implemented using vfork()). A child calls 248 set_error() to set an error code and the parent then calls get_error() to 249 read it. Accessor functions are used so these trivial store+load operations 250 are not changed by the compiler in any way. 251 252 Since Valgrind translates vfork() to a normal fork(), calling set_error() 253 by the child would have no effect on the error value in the parent so 254 something must be done to fix this problem. 255 256 A pipe is created between a child and its parent in the forksys pre-wrapper 257 when a vfork() is encountered. The child's end of the pipe is closed when 258 the child exits or execs (because close-on-exec is set on the file 259 descriptor). Valgrind (the parent) waits on the child's end of the pipe to 260 be closed which preserves the vfork() behaviour that the parent process is 261 suspended while the child is using its resources. 262 263 The pipe is then used to send an eventual error code set by the child in 264 posix_spawn() to the parent. If there is any error Valgrind returns it as 265 an error from the vfork() syscall. This means the syscall can return errors 266 that it would normally never return but this is not a problem in practice 267 because any error is directly propagated as a return code from 268 posix_spawn(). 269 270 Address of vg_vfork_fildes is found by Valgrind when debug information for 271 vgpreload_core.so is being processed. A value of this variable is set in 272 the forksys pre-wrapper before a fork() call is made and set back to -1 273 before returning from the wrapper by the parent. 274 275 Newer Solaris versions introduce the spawn syscall and posix_spawn() is 276 implemented using it. The redirect is not needed for these versions. 277*/ 278int vg_vfork_fildes = -1; 279 280int VG_REPLACE_FUNCTION_ZU(VG_Z_LIBC_SONAME, get_error)(int *errp); 281int VG_REPLACE_FUNCTION_ZU(VG_Z_LIBC_SONAME, get_error)(int *errp) 282{ 283 /* Always return 0 when the parent tries to call get_error(). Any error 284 from the child is returned directly as an error from the vfork child. 285 Value pointed by errp is initialized only by the child so not 286 redirecting this function would mean that the parent gets an 287 uninitialized/garbage value when it calls this function. */ 288 return 0; 289} 290 291int VG_REPLACE_FUNCTION_ZU(VG_Z_LIBC_SONAME, set_error)(int *errp, int err); 292int VG_REPLACE_FUNCTION_ZU(VG_Z_LIBC_SONAME, set_error)(int *errp, int err) 293{ 294 *errp = err; 295 296 /* Libc should always call set_error() only after doing a vfork() syscall 297 in posix_spawn(). The forksys pre-wrapper saves a descriptor of the 298 child's end of the pipe in vg_vfork_fildes so it is an error if it is 299 not a valid file descriptor at this point. */ 300 assert(vg_vfork_fildes >= 0); 301 /* Current protocol between this function and the forksys pre-wrapper 302 allows to send only errors in range [0, 255] (one byte values). */ 303 assert(err >= 0 && err <= 0xff); 304 305 if (err != 0) { 306 unsigned char w = (unsigned char)(err & 0xff); 307 ssize_t res; 308 do { 309 res = write(vg_vfork_fildes, &w, 1); 310 assert(res == 1 || (errno == EINTR || errno == ERESTART)); 311 } while (res != 1); 312 } 313 314 return err; 315} 316 317/* Replace spawnveg() in libast.so.1. This function is used by ksh to spawn 318 new processes. The library has a build time option to select between 319 several variants of this function based on behaviour of vfork() and 320 posix_spawn() on the system for which the library is being compiled. 321 Unfortunately, Solaris and illumos use the real vfork() variant which does 322 not work correctly with the vfork() -> fork() translation done by Valgrind 323 (see the forksys pre-wrapper for details). Therefore the function is 324 replaced here with an implementation that uses posix_spawn(). This 325 replacement can be removed when a configuration of libast in Solaris and 326 illumos is changed to use the posix_spawn() implementation. 327*/ 328pid_t VG_REPLACE_FUNCTION_ZU(libastZdsoZd1, spawnveg)(const char *command, 329 char **argv, 330 char **envv, 331 pid_t pgid); 332pid_t VG_REPLACE_FUNCTION_ZU(libastZdsoZd1, spawnveg)(const char *command, 333 char **argv, 334 char **envp, 335 pid_t pgid) 336{ 337 int err = 0; 338 pid_t pid; 339 posix_spawnattr_t attr; 340 int attr_init_done = 0; 341 342 err = posix_spawnattr_init(&attr); 343 if (err != 0) 344 goto out; 345 attr_init_done = 1; 346 347 err = posix_spawnattr_init(&attr); 348 if (err != 0) 349 goto out; 350 351 if (pgid != 0) { 352 if (pgid <= 1) 353 pgid = 0; 354 err = posix_spawnattr_setpgroup(&attr, pgid); 355 if (err != 0) 356 goto out; 357 err = posix_spawnattr_setflags(&attr, POSIX_SPAWN_SETPGROUP); 358 if (err != 0) 359 goto out; 360 } 361 362 err = posix_spawn(&pid, command, NULL, &attr, argv, envp ? envp : environ); 363 364out: 365 if (attr_init_done) 366 posix_spawnattr_destroy(&attr); 367 if (err != 0) { 368 errno = err; 369 return -1; 370 } 371 return pid; 372} 373 374#else 375# error Unknown OS 376#endif 377 378/*--------------------------------------------------------------------*/ 379/*--- end ---*/ 380/*--------------------------------------------------------------------*/ 381