1 /*
2 * Copyright 2016, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <arpa/inet.h>
18 #include <dirent.h>
19 #include <fcntl.h>
20 #include <stdlib.h>
21 #include <sys/prctl.h>
22 #include <sys/ptrace.h>
23 #include <sys/types.h>
24 #include <sys/un.h>
25 #include <sys/wait.h>
26 #include <unistd.h>
27
28 #include <cstdint>
29 #include <limits>
30 #include <map>
31 #include <memory>
32 #include <set>
33 #include <vector>
34
35 #include <android-base/errno_restorer.h>
36 #include <android-base/file.h>
37 #include <android-base/logging.h>
38 #include <android-base/macros.h>
39 #include <android-base/parseint.h>
40 #include <android-base/properties.h>
41 #include <android-base/stringprintf.h>
42 #include <android-base/strings.h>
43 #include <android-base/unique_fd.h>
44 #include <bionic/macros.h>
45 #include <bionic/reserved_signals.h>
46 #include <bionic/tls_defines.h>
47 #include <cutils/sockets.h>
48 #include <log/log.h>
49 #include <private/android_filesystem_config.h>
50 #include <procinfo/process.h>
51
52 #define ATRACE_TAG ATRACE_TAG_BIONIC
53 #include <utils/Trace.h>
54
55 #include <unwindstack/AndroidUnwinder.h>
56 #include <unwindstack/Error.h>
57 #include <unwindstack/MachineArm.h>
58 #include <unwindstack/MachineArm64.h>
59 #include <unwindstack/MachineRiscv64.h>
60 #include <unwindstack/Regs.h>
61 #include <unwindstack/RegsArm.h>
62 #include <unwindstack/RegsArm64.h>
63 #include <unwindstack/RegsRiscv64.h>
64 #include <unwindstack/UserArm.h>
65 #include <unwindstack/UserArm64.h>
66 #include <unwindstack/UserRiscv64.h>
67
68 #include <native_bridge_support/guest_state_accessor/accessor.h>
69
70 #include "libdebuggerd/backtrace.h"
71 #include "libdebuggerd/tombstone.h"
72 #include "libdebuggerd/utility.h"
73
74 #include "debuggerd/handler.h"
75 #include "tombstone_handler.h"
76
77 #include "protocol.h"
78 #include "util.h"
79
80 using android::base::ErrnoRestorer;
81 using android::base::StringPrintf;
82 using android::base::unique_fd;
83
84 // This stores guest architecture. When the architecture is supported, tombstone file will output
85 // guest state information.
86 static Architecture g_guest_arch = Architecture::NONE;
87
pid_contains_tid(int pid_proc_fd,pid_t tid)88 static bool pid_contains_tid(int pid_proc_fd, pid_t tid) {
89 struct stat st;
90 std::string task_path = StringPrintf("task/%d", tid);
91 return fstatat(pid_proc_fd, task_path.c_str(), &st, 0) == 0;
92 }
93
get_tracer(pid_t tracee)94 static pid_t get_tracer(pid_t tracee) {
95 // Check to see if the thread is being ptraced by another process.
96 android::procinfo::ProcessInfo process_info;
97 if (android::procinfo::GetProcessInfo(tracee, &process_info)) {
98 return process_info.tracer;
99 }
100 return -1;
101 }
102
103 // Attach to a thread, and verify that it's still a member of the given process
ptrace_seize_thread(int pid_proc_fd,pid_t tid,std::string * error,int flags=0)104 static bool ptrace_seize_thread(int pid_proc_fd, pid_t tid, std::string* error, int flags = 0) {
105 if (ptrace(PTRACE_SEIZE, tid, 0, flags) != 0) {
106 if (errno == EPERM) {
107 ErrnoRestorer errno_restorer; // In case get_tracer() fails and we fall through.
108 pid_t tracer_pid = get_tracer(tid);
109 if (tracer_pid > 0) {
110 *error = StringPrintf("failed to attach to thread %d, already traced by %d (%s)", tid,
111 tracer_pid, get_process_name(tracer_pid).c_str());
112 return false;
113 }
114 }
115
116 *error = StringPrintf("failed to attach to thread %d: %s", tid, strerror(errno));
117 return false;
118 }
119
120 // Make sure that the task we attached to is actually part of the pid we're dumping.
121 if (!pid_contains_tid(pid_proc_fd, tid)) {
122 if (ptrace(PTRACE_DETACH, tid, 0, 0) != 0) {
123 PLOG(WARNING) << "failed to detach from thread " << tid;
124 }
125 *error = StringPrintf("thread %d is not in process", tid);
126 return false;
127 }
128
129 return true;
130 }
131
wait_for_stop(pid_t tid,int * received_signal)132 static bool wait_for_stop(pid_t tid, int* received_signal) {
133 while (true) {
134 int status;
135 pid_t result = waitpid(tid, &status, __WALL);
136 if (result != tid) {
137 PLOG(ERROR) << "waitpid failed on " << tid << " while detaching";
138 return false;
139 }
140
141 if (WIFSTOPPED(status)) {
142 if (status >> 16 == PTRACE_EVENT_STOP) {
143 *received_signal = 0;
144 } else {
145 *received_signal = WSTOPSIG(status);
146 }
147 return true;
148 }
149 }
150 }
151
152 // Interrupt a process and wait for it to be interrupted.
ptrace_interrupt(pid_t tid,int * received_signal)153 static bool ptrace_interrupt(pid_t tid, int* received_signal) {
154 if (ptrace(PTRACE_INTERRUPT, tid, 0, 0) == 0) {
155 return wait_for_stop(tid, received_signal);
156 }
157
158 PLOG(ERROR) << "failed to interrupt " << tid << " to detach";
159 return false;
160 }
161
activity_manager_notify(pid_t pid,int signal,const std::string & amfd_data,bool recoverable_crash)162 static bool activity_manager_notify(pid_t pid, int signal, const std::string& amfd_data,
163 bool recoverable_crash) {
164 ATRACE_CALL();
165 android::base::unique_fd amfd(socket_local_client(
166 "/data/system/ndebugsocket", ANDROID_SOCKET_NAMESPACE_FILESYSTEM, SOCK_STREAM));
167 if (amfd.get() == -1) {
168 PLOG(ERROR) << "unable to connect to activity manager";
169 return false;
170 }
171
172 struct timeval tv = {
173 .tv_sec = 1 * android::base::HwTimeoutMultiplier(),
174 .tv_usec = 0,
175 };
176 if (setsockopt(amfd.get(), SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)) == -1) {
177 PLOG(ERROR) << "failed to set send timeout on activity manager socket";
178 return false;
179 }
180 tv.tv_sec = 3 * android::base::HwTimeoutMultiplier(); // 3 seconds on handshake read
181 if (setsockopt(amfd.get(), SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) == -1) {
182 PLOG(ERROR) << "failed to set receive timeout on activity manager socket";
183 return false;
184 }
185
186 // Activity Manager protocol:
187 // - 32-bit network-byte-order: pid
188 // - 32-bit network-byte-order: signal number
189 // - byte: recoverable_crash
190 // - bytes: raw text of the dump
191 // - null terminator
192
193 uint32_t datum = htonl(pid);
194 if (!android::base::WriteFully(amfd, &datum, sizeof(datum))) {
195 PLOG(ERROR) << "AM pid write failed";
196 return false;
197 }
198
199 datum = htonl(signal);
200 if (!android::base::WriteFully(amfd, &datum, sizeof(datum))) {
201 PLOG(ERROR) << "AM signo write failed";
202 return false;
203 }
204
205 uint8_t recoverable_crash_byte = recoverable_crash ? 1 : 0;
206 if (!android::base::WriteFully(amfd, &recoverable_crash_byte, sizeof(recoverable_crash_byte))) {
207 PLOG(ERROR) << "AM recoverable_crash_byte write failed";
208 return false;
209 }
210
211 if (!android::base::WriteFully(amfd, amfd_data.c_str(), amfd_data.size() + 1)) {
212 PLOG(ERROR) << "AM data write failed";
213 return false;
214 }
215
216 // 3 sec timeout reading the ack; we're fine if the read fails.
217 char ack;
218 android::base::ReadFully(amfd, &ack, 1);
219 return true;
220 }
221
222 // Globals used by the abort handler.
223 static pid_t g_target_thread = -1;
224 static bool g_tombstoned_connected = false;
225 static unique_fd g_tombstoned_socket;
226 static unique_fd g_output_fd;
227 static unique_fd g_proto_fd;
228
DefuseSignalHandlers()229 static void DefuseSignalHandlers() {
230 // Don't try to dump ourselves.
231 struct sigaction action = {};
232 action.sa_handler = SIG_DFL;
233 debuggerd_register_handlers(&action);
234
235 sigset_t mask;
236 sigemptyset(&mask);
237 if (sigprocmask(SIG_SETMASK, &mask, nullptr) != 0) {
238 PLOG(FATAL) << "failed to set signal mask";
239 }
240 }
241
Initialize(char ** argv)242 static void Initialize(char** argv) {
243 android::base::InitLogging(argv);
244 android::base::SetAborter([](const char* abort_msg) {
245 // If we abort before we get an output fd, contact tombstoned to let any
246 // potential listeners know that we failed.
247 if (!g_tombstoned_connected) {
248 if (!connect_tombstone_server(g_target_thread, &g_tombstoned_socket, &g_output_fd,
249 &g_proto_fd, kDebuggerdAnyIntercept)) {
250 // We failed to connect, not much we can do.
251 LOG(ERROR) << "failed to connected to tombstoned to report failure";
252 _exit(1);
253 }
254 }
255
256 dprintf(g_output_fd.get(), "crash_dump failed to dump process");
257 if (g_target_thread != 1) {
258 dprintf(g_output_fd.get(), " %d: %s\n", g_target_thread, abort_msg);
259 } else {
260 dprintf(g_output_fd.get(), ": %s\n", abort_msg);
261 }
262
263 _exit(1);
264 });
265 }
266
ParseArgs(int argc,char ** argv,pid_t * pseudothread_tid,DebuggerdDumpType * dump_type)267 static void ParseArgs(int argc, char** argv, pid_t* pseudothread_tid, DebuggerdDumpType* dump_type) {
268 if (argc != 4) {
269 LOG(FATAL) << "wrong number of args: " << argc << " (expected 4)";
270 }
271
272 if (!android::base::ParseInt(argv[1], &g_target_thread, 1, std::numeric_limits<pid_t>::max())) {
273 LOG(FATAL) << "invalid target tid: " << argv[1];
274 }
275
276 if (!android::base::ParseInt(argv[2], pseudothread_tid, 1, std::numeric_limits<pid_t>::max())) {
277 LOG(FATAL) << "invalid pseudothread tid: " << argv[2];
278 }
279
280 int dump_type_int;
281 if (!android::base::ParseInt(argv[3], &dump_type_int, 0)) {
282 LOG(FATAL) << "invalid requested dump type: " << argv[3];
283 }
284
285 *dump_type = static_cast<DebuggerdDumpType>(dump_type_int);
286 switch (*dump_type) {
287 case kDebuggerdNativeBacktrace:
288 case kDebuggerdTombstone:
289 case kDebuggerdTombstoneProto:
290 break;
291
292 default:
293 LOG(FATAL) << "invalid requested dump type: " << dump_type_int;
294 }
295 }
296
ReadCrashInfo(unique_fd & fd,siginfo_t * siginfo,std::unique_ptr<unwindstack::Regs> * regs,ProcessInfo * process_info,bool * recoverable_crash)297 static void ReadCrashInfo(unique_fd& fd, siginfo_t* siginfo,
298 std::unique_ptr<unwindstack::Regs>* regs, ProcessInfo* process_info,
299 bool* recoverable_crash) {
300 std::aligned_storage<sizeof(CrashInfo) + 1, alignof(CrashInfo)>::type buf;
301 CrashInfo* crash_info = reinterpret_cast<CrashInfo*>(&buf);
302 ssize_t rc = TEMP_FAILURE_RETRY(read(fd.get(), &buf, sizeof(buf)));
303 *recoverable_crash = false;
304 if (rc == -1) {
305 PLOG(FATAL) << "failed to read target ucontext";
306 }
307 ssize_t expected_size = 0;
308 switch (crash_info->header.version) {
309 case 1:
310 case 2:
311 case 3:
312 expected_size = sizeof(CrashInfoHeader) + sizeof(CrashInfoDataStatic);
313 break;
314
315 case 4:
316 expected_size = sizeof(CrashInfoHeader) + sizeof(CrashInfoDataDynamic);
317 break;
318
319 default:
320 LOG(FATAL) << "unexpected CrashInfo version: " << crash_info->header.version;
321 break;
322 }
323
324 if (rc < expected_size) {
325 LOG(FATAL) << "read " << rc << " bytes when reading target crash information, expected "
326 << expected_size;
327 }
328
329 switch (crash_info->header.version) {
330 case 4:
331 process_info->fdsan_table_address = crash_info->data.d.fdsan_table_address;
332 process_info->gwp_asan_state = crash_info->data.d.gwp_asan_state;
333 process_info->gwp_asan_metadata = crash_info->data.d.gwp_asan_metadata;
334 process_info->scudo_stack_depot = crash_info->data.d.scudo_stack_depot;
335 process_info->scudo_stack_depot_size = crash_info->data.d.scudo_stack_depot_size;
336 process_info->scudo_region_info = crash_info->data.d.scudo_region_info;
337 process_info->scudo_ring_buffer = crash_info->data.d.scudo_ring_buffer;
338 process_info->scudo_ring_buffer_size = crash_info->data.d.scudo_ring_buffer_size;
339 *recoverable_crash = crash_info->data.d.recoverable_crash;
340 process_info->crash_detail_page = crash_info->data.d.crash_detail_page;
341 FALLTHROUGH_INTENDED;
342 case 1:
343 case 2:
344 case 3:
345 process_info->abort_msg_address = crash_info->data.s.abort_msg_address;
346 *siginfo = crash_info->data.s.siginfo;
347 if (signal_has_si_addr(siginfo)) {
348 process_info->has_fault_address = true;
349 process_info->maybe_tagged_fault_address = reinterpret_cast<uintptr_t>(siginfo->si_addr);
350 process_info->untagged_fault_address =
351 untag_address(reinterpret_cast<uintptr_t>(siginfo->si_addr));
352 }
353 regs->reset(unwindstack::Regs::CreateFromUcontext(unwindstack::Regs::CurrentArch(),
354 &crash_info->data.s.ucontext));
355 break;
356
357 default:
358 __builtin_unreachable();
359 }
360 }
361
362 // Wait for a process to clone and return the child's pid.
363 // Note: this leaves the parent in PTRACE_EVENT_STOP.
wait_for_clone(pid_t pid,bool resume_child)364 static pid_t wait_for_clone(pid_t pid, bool resume_child) {
365 int status;
366 pid_t result = TEMP_FAILURE_RETRY(waitpid(pid, &status, __WALL));
367 if (result == -1) {
368 PLOG(FATAL) << "failed to waitpid";
369 }
370
371 if (WIFEXITED(status)) {
372 LOG(FATAL) << "traced process exited with status " << WEXITSTATUS(status);
373 } else if (WIFSIGNALED(status)) {
374 LOG(FATAL) << "traced process exited with signal " << WTERMSIG(status);
375 } else if (!WIFSTOPPED(status)) {
376 LOG(FATAL) << "process didn't stop? (status = " << status << ")";
377 }
378
379 if (status >> 8 != (SIGTRAP | (PTRACE_EVENT_CLONE << 8))) {
380 LOG(FATAL) << "process didn't stop due to PTRACE_O_TRACECLONE (status = " << status << ")";
381 }
382
383 pid_t child;
384 if (ptrace(PTRACE_GETEVENTMSG, pid, 0, &child) != 0) {
385 PLOG(FATAL) << "failed to get child pid via PTRACE_GETEVENTMSG";
386 }
387
388 int stop_signal;
389 if (!wait_for_stop(child, &stop_signal)) {
390 PLOG(FATAL) << "failed to waitpid on child";
391 }
392
393 CHECK_EQ(0, stop_signal);
394
395 if (resume_child) {
396 if (ptrace(PTRACE_CONT, child, 0, 0) != 0) {
397 PLOG(FATAL) << "failed to resume child (pid = " << child << ")";
398 }
399 }
400
401 return child;
402 }
403
wait_for_vm_process(pid_t pseudothread_tid)404 static pid_t wait_for_vm_process(pid_t pseudothread_tid) {
405 // The pseudothread will double-fork, we want its grandchild.
406 pid_t intermediate = wait_for_clone(pseudothread_tid, true);
407 pid_t vm_pid = wait_for_clone(intermediate, false);
408 if (ptrace(PTRACE_DETACH, intermediate, 0, 0) != 0) {
409 PLOG(FATAL) << "failed to detach from intermediate vm process";
410 }
411
412 return vm_pid;
413 }
414
InstallSigPipeHandler()415 static void InstallSigPipeHandler() {
416 struct sigaction action = {};
417 action.sa_handler = SIG_IGN;
418 action.sa_flags = SA_RESTART;
419 sigaction(SIGPIPE, &action, nullptr);
420 }
421
PtracePeek(int request,pid_t tid,uintptr_t addr,void * data,std::string_view err_msg,uintptr_t * result)422 static bool PtracePeek(int request, pid_t tid, uintptr_t addr, void* data, std::string_view err_msg,
423 uintptr_t* result) {
424 errno = 0;
425 *result = ptrace(request, tid, addr, data);
426 if (errno != 0) {
427 PLOG(ERROR) << err_msg;
428 return false;
429 }
430 return true;
431 }
432
GetGuestRegistersFromCrashedProcess(pid_t tid,NativeBridgeGuestRegs * guest_regs)433 static bool GetGuestRegistersFromCrashedProcess([[maybe_unused]] pid_t tid,
434 NativeBridgeGuestRegs* guest_regs) {
435 auto process_memory = unwindstack::Memory::CreateProcessMemoryCached(tid);
436
437 uintptr_t header_ptr = 0;
438 uintptr_t base = 0;
439 #if defined(__x86_64__)
440 if (!PtracePeek(PTRACE_PEEKUSER, tid, offsetof(user_regs_struct, fs_base), nullptr,
441 "failed to read thread register for thread " + std::to_string(tid), &base)) {
442 return false;
443 }
444 #elif defined(__aarch64__)
445 // base is implicitly casted to uint64_t.
446 struct iovec pt_iov {
447 .iov_base = &base, .iov_len = sizeof(base),
448 };
449
450 if (ptrace(PTRACE_GETREGSET, tid, NT_ARM_TLS, &pt_iov) != 0) {
451 PLOG(ERROR) << "failed to read thread register for thread " << tid;
452 return false;
453 }
454 #elif defined(__riscv)
455 struct user_regs_struct regs;
456 struct iovec pt_iov = {.iov_base = ®s, .iov_len = sizeof(regs)};
457 if (ptrace(PTRACE_GETREGSET, tid, NT_PRSTATUS, &pt_iov) != 0) {
458 PLOG(ERROR) << "failed to read thread register for thread " << tid;
459 return false;
460 }
461 base = reinterpret_cast<uintptr_t>(regs.tp);
462 #else
463 // TODO(b/339287219): Add case for Riscv host.
464 return false;
465 #endif
466 auto ptr_to_guest_slot = base + TLS_SLOT_NATIVE_BRIDGE_GUEST_STATE * sizeof(uintptr_t);
467 if (!process_memory->ReadFully(ptr_to_guest_slot, &header_ptr, sizeof(uintptr_t))) {
468 PLOG(ERROR) << "failed to get guest state TLS slot content for thread " << tid;
469 return false;
470 }
471
472 NativeBridgeGuestStateHeader header;
473 if (!process_memory->ReadFully(header_ptr, &header, sizeof(NativeBridgeGuestStateHeader))) {
474 PLOG(ERROR) << "failed to get the guest state header for thread " << tid;
475 return false;
476 }
477 if (header.signature != NATIVE_BRIDGE_GUEST_STATE_SIGNATURE) {
478 // Return when ptr points to unmapped memory or no valid guest state.
479 return false;
480 }
481 auto guest_state_data_copy = std::make_unique<unsigned char[]>(header.guest_state_data_size);
482 if (!process_memory->ReadFully(reinterpret_cast<uintptr_t>(header.guest_state_data),
483 guest_state_data_copy.get(), header.guest_state_data_size)) {
484 PLOG(ERROR) << "failed to read the guest state data for thread " << tid;
485 return false;
486 }
487
488 LoadGuestStateRegisters(guest_state_data_copy.get(), header.guest_state_data_size, guest_regs);
489 return true;
490 }
491
ReadGuestRegisters(std::unique_ptr<unwindstack::Regs> * regs,pid_t tid)492 static void ReadGuestRegisters([[maybe_unused]] std::unique_ptr<unwindstack::Regs>* regs,
493 pid_t tid) {
494 // TODO: remove [[maybe_unused]], when the ARM32 case is removed from the native bridge support.
495 NativeBridgeGuestRegs guest_regs;
496 if (!GetGuestRegistersFromCrashedProcess(tid, &guest_regs)) {
497 return;
498 }
499
500 switch (guest_regs.guest_arch) {
501 #if defined(__LP64__)
502 case NATIVE_BRIDGE_ARCH_ARM64: {
503 unwindstack::arm64_user_regs arm64_user_regs = {};
504 for (size_t i = 0; i < unwindstack::ARM64_REG_R31; i++) {
505 arm64_user_regs.regs[i] = guest_regs.regs_arm64.x[i];
506 }
507 arm64_user_regs.sp = guest_regs.regs_arm64.sp;
508 arm64_user_regs.pc = guest_regs.regs_arm64.ip;
509 regs->reset(unwindstack::RegsArm64::Read(&arm64_user_regs));
510
511 g_guest_arch = Architecture::ARM64;
512 break;
513 }
514 case NATIVE_BRIDGE_ARCH_RISCV64: {
515 unwindstack::riscv64_user_regs riscv64_user_regs = {};
516 // RISCV64_REG_PC is at the first position.
517 riscv64_user_regs.regs[0] = guest_regs.regs_riscv64.ip;
518 for (size_t i = 1; i < unwindstack::RISCV64_REG_REAL_COUNT; i++) {
519 riscv64_user_regs.regs[i] = guest_regs.regs_riscv64.x[i];
520 }
521 regs->reset(unwindstack::RegsRiscv64::Read(&riscv64_user_regs, tid));
522
523 g_guest_arch = Architecture::RISCV64;
524 break;
525 }
526 #endif
527 default:
528 break;
529 }
530 }
531
main(int argc,char ** argv)532 int main(int argc, char** argv) {
533 DefuseSignalHandlers();
534 InstallSigPipeHandler();
535
536 // There appears to be a bug in the kernel where our death causes SIGHUP to
537 // be sent to our process group if we exit while it has stopped jobs (e.g.
538 // because of wait_for_debugger). Use setsid to create a new process group to
539 // avoid hitting this.
540 setsid();
541
542 atrace_begin(ATRACE_TAG, "before reparent");
543 pid_t target_process = getppid();
544
545 // Open /proc/`getppid()` before we daemonize.
546 std::string target_proc_path = "/proc/" + std::to_string(target_process);
547 int target_proc_fd = open(target_proc_path.c_str(), O_DIRECTORY | O_RDONLY);
548 if (target_proc_fd == -1) {
549 PLOG(FATAL) << "failed to open " << target_proc_path;
550 }
551
552 // Make sure getppid() hasn't changed.
553 if (getppid() != target_process) {
554 LOG(FATAL) << "parent died";
555 }
556 atrace_end(ATRACE_TAG);
557
558 // Reparent ourselves to init, so that the signal handler can waitpid on the
559 // original process to avoid leaving a zombie for non-fatal dumps.
560 // Move the input/output pipes off of stdout/stderr, out of paranoia.
561 unique_fd output_pipe(dup(STDOUT_FILENO));
562 unique_fd input_pipe(dup(STDIN_FILENO));
563
564 unique_fd fork_exit_read, fork_exit_write;
565 if (!Pipe(&fork_exit_read, &fork_exit_write)) {
566 PLOG(FATAL) << "failed to create pipe";
567 }
568
569 pid_t forkpid = fork();
570 if (forkpid == -1) {
571 PLOG(FATAL) << "fork failed";
572 } else if (forkpid == 0) {
573 fork_exit_read.reset();
574 } else {
575 // We need the pseudothread to live until we get around to verifying the vm pid against it.
576 // The last thing it does is block on a waitpid on us, so wait until our child tells us to die.
577 fork_exit_write.reset();
578 char buf;
579 TEMP_FAILURE_RETRY(read(fork_exit_read.get(), &buf, sizeof(buf)));
580 _exit(0);
581 }
582
583 ATRACE_NAME("after reparent");
584 pid_t pseudothread_tid;
585 DebuggerdDumpType dump_type;
586 ProcessInfo process_info;
587
588 Initialize(argv);
589 ParseArgs(argc, argv, &pseudothread_tid, &dump_type);
590
591 // Die if we take too long.
592 //
593 // Note: processes with many threads and minidebug-info can take a bit to
594 // unwind, do not make this too small. b/62828735
595 alarm(30 * android::base::HwTimeoutMultiplier());
596
597 // Collect the list of open files.
598 OpenFilesList open_files;
599 {
600 ATRACE_NAME("open files");
601 populate_open_files_list(&open_files, g_target_thread);
602 }
603
604 // In order to reduce the duration that we pause the process for, we ptrace
605 // the threads, fetch their registers and associated information, and then
606 // fork a separate process as a snapshot of the process's address space.
607 std::set<pid_t> threads;
608 if (!android::procinfo::GetProcessTids(g_target_thread, &threads)) {
609 PLOG(FATAL) << "failed to get process threads";
610 }
611
612 std::map<pid_t, ThreadInfo> thread_info;
613 siginfo_t siginfo;
614 std::string error;
615 bool recoverable_crash = false;
616
617 {
618 ATRACE_NAME("ptrace");
619 for (pid_t thread : threads) {
620 // Trace the pseudothread separately, so we can use different options.
621 if (thread == pseudothread_tid) {
622 continue;
623 }
624
625 if (!ptrace_seize_thread(target_proc_fd, thread, &error)) {
626 bool fatal = thread == g_target_thread;
627 LOG(fatal ? FATAL : WARNING) << error;
628 }
629
630 ThreadInfo info;
631 info.pid = target_process;
632 info.tid = thread;
633 info.uid = getuid();
634 info.thread_name = get_thread_name(thread);
635
636 unique_fd attr_fd(openat(target_proc_fd, "attr/current", O_RDONLY | O_CLOEXEC));
637 if (!android::base::ReadFdToString(attr_fd, &info.selinux_label)) {
638 PLOG(WARNING) << "failed to read selinux label";
639 }
640
641 if (!ptrace_interrupt(thread, &info.signo)) {
642 PLOG(WARNING) << "failed to ptrace interrupt thread " << thread;
643 ptrace(PTRACE_DETACH, thread, 0, 0);
644 continue;
645 }
646
647 struct iovec tagged_addr_iov = {
648 &info.tagged_addr_ctrl,
649 sizeof(info.tagged_addr_ctrl),
650 };
651 if (ptrace(PTRACE_GETREGSET, thread, NT_ARM_TAGGED_ADDR_CTRL,
652 reinterpret_cast<void*>(&tagged_addr_iov)) == -1) {
653 info.tagged_addr_ctrl = -1;
654 }
655
656 struct iovec pac_enabled_keys_iov = {
657 &info.pac_enabled_keys,
658 sizeof(info.pac_enabled_keys),
659 };
660 if (ptrace(PTRACE_GETREGSET, thread, NT_ARM_PAC_ENABLED_KEYS,
661 reinterpret_cast<void*>(&pac_enabled_keys_iov)) == -1) {
662 info.pac_enabled_keys = -1;
663 }
664
665 if (thread == g_target_thread) {
666 // Read the thread's registers along with the rest of the crash info out of the pipe.
667 ReadCrashInfo(input_pipe, &siginfo, &info.registers, &process_info, &recoverable_crash);
668 info.siginfo = &siginfo;
669 info.signo = info.siginfo->si_signo;
670
671 info.command_line = get_command_line(g_target_thread);
672 } else {
673 info.registers.reset(unwindstack::Regs::RemoteGet(thread));
674 if (!info.registers) {
675 PLOG(WARNING) << "failed to fetch registers for thread " << thread;
676 ptrace(PTRACE_DETACH, thread, 0, 0);
677 continue;
678 }
679 }
680 ReadGuestRegisters(&info.guest_registers, thread);
681
682 thread_info[thread] = std::move(info);
683 }
684 }
685
686 // Trace the pseudothread with PTRACE_O_TRACECLONE and tell it to fork.
687 if (!ptrace_seize_thread(target_proc_fd, pseudothread_tid, &error, PTRACE_O_TRACECLONE)) {
688 LOG(FATAL) << "failed to seize pseudothread: " << error;
689 }
690
691 if (TEMP_FAILURE_RETRY(write(output_pipe.get(), "\1", 1)) != 1) {
692 PLOG(FATAL) << "failed to write to pseudothread";
693 }
694
695 pid_t vm_pid = wait_for_vm_process(pseudothread_tid);
696 if (ptrace(PTRACE_DETACH, pseudothread_tid, 0, 0) != 0) {
697 PLOG(FATAL) << "failed to detach from pseudothread";
698 }
699
700 // The pseudothread can die now.
701 fork_exit_write.reset();
702
703 // Defer the message until later, for readability.
704 bool wait_for_debugger = android::base::GetBoolProperty(
705 "debug.debuggerd.wait_for_debugger",
706 android::base::GetBoolProperty("debug.debuggerd.wait_for_gdb", false));
707 if (siginfo.si_signo == BIONIC_SIGNAL_DEBUGGER) {
708 wait_for_debugger = false;
709 }
710
711 // Detach from all of our attached threads before resuming.
712 for (const auto& [tid, thread] : thread_info) {
713 int resume_signal = thread.signo == BIONIC_SIGNAL_DEBUGGER ? 0 : thread.signo;
714 if (wait_for_debugger) {
715 resume_signal = 0;
716 if (tgkill(target_process, tid, SIGSTOP) != 0) {
717 PLOG(WARNING) << "failed to send SIGSTOP to " << tid;
718 }
719 }
720
721 LOG(DEBUG) << "detaching from thread " << tid;
722 if (ptrace(PTRACE_DETACH, tid, 0, resume_signal) != 0) {
723 PLOG(ERROR) << "failed to detach from thread " << tid;
724 }
725 }
726
727 // Drop our capabilities now that we've fetched all of the information we need.
728 drop_capabilities();
729
730 {
731 ATRACE_NAME("tombstoned_connect");
732 LOG(INFO) << "obtaining output fd from tombstoned, type: " << dump_type;
733 g_tombstoned_connected = connect_tombstone_server(g_target_thread, &g_tombstoned_socket,
734 &g_output_fd, &g_proto_fd, dump_type);
735 }
736
737 if (g_tombstoned_connected) {
738 if (TEMP_FAILURE_RETRY(dup2(g_output_fd.get(), STDOUT_FILENO)) == -1) {
739 PLOG(ERROR) << "failed to dup2 output fd (" << g_output_fd.get() << ") to STDOUT_FILENO";
740 }
741 } else {
742 unique_fd devnull(TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR)));
743 TEMP_FAILURE_RETRY(dup2(devnull.get(), STDOUT_FILENO));
744 g_output_fd = std::move(devnull);
745 }
746
747 LOG(INFO) << "performing dump of process " << target_process
748 << " (target tid = " << g_target_thread << ")";
749
750 int signo = siginfo.si_signo;
751 bool fatal_signal = signo != BIONIC_SIGNAL_DEBUGGER;
752 bool backtrace = false;
753
754 // si_value is special when used with BIONIC_SIGNAL_DEBUGGER.
755 // 0: dump tombstone
756 // 1: dump backtrace
757 if (!fatal_signal) {
758 int si_val = siginfo.si_value.sival_int;
759 if (si_val == 0) {
760 backtrace = false;
761 } else if (si_val == 1) {
762 backtrace = true;
763 } else {
764 LOG(WARNING) << "unknown si_value value " << si_val;
765 }
766 }
767
768 // TODO: Use seccomp to lock ourselves down.
769
770 unwindstack::AndroidRemoteUnwinder unwinder(vm_pid, unwindstack::Regs::CurrentArch());
771 unwindstack::ErrorData error_data;
772 if (!unwinder.Initialize(error_data)) {
773 LOG(FATAL) << "Failed to initialize unwinder object: "
774 << unwindstack::GetErrorCodeString(error_data.code);
775 }
776
777 std::string amfd_data;
778 if (backtrace) {
779 ATRACE_NAME("dump_backtrace");
780 dump_backtrace(std::move(g_output_fd), &unwinder, thread_info, g_target_thread);
781 } else {
782 {
783 ATRACE_NAME("fdsan table dump");
784 populate_fdsan_table(&open_files, unwinder.GetProcessMemory(),
785 process_info.fdsan_table_address);
786 }
787
788 {
789 ATRACE_NAME("engrave_tombstone");
790 unwindstack::ArchEnum regs_arch = unwindstack::ARCH_UNKNOWN;
791 switch (g_guest_arch) {
792 case Architecture::ARM64: {
793 regs_arch = unwindstack::ARCH_ARM64;
794 break;
795 }
796 case Architecture::RISCV64: {
797 regs_arch = unwindstack::ARCH_RISCV64;
798 break;
799 }
800 default: {
801 }
802 }
803 if (regs_arch == unwindstack::ARCH_UNKNOWN) {
804 engrave_tombstone(std::move(g_output_fd), std::move(g_proto_fd), &unwinder, thread_info,
805 g_target_thread, process_info, &open_files, &amfd_data);
806 } else {
807 unwindstack::AndroidRemoteUnwinder guest_unwinder(vm_pid, regs_arch);
808 engrave_tombstone(std::move(g_output_fd), std::move(g_proto_fd), &unwinder, thread_info,
809 g_target_thread, process_info, &open_files, &amfd_data, &g_guest_arch,
810 &guest_unwinder);
811 }
812 }
813 }
814
815 if (fatal_signal) {
816 // Don't try to notify ActivityManager if it just crashed, or we might hang until timeout.
817 if (thread_info[target_process].thread_name != "system_server") {
818 activity_manager_notify(target_process, signo, amfd_data, recoverable_crash);
819 }
820 }
821
822 if (wait_for_debugger) {
823 // Use ALOGI to line up with output from engrave_tombstone.
824 ALOGI(
825 "***********************************************************\n"
826 "* Process %d has been suspended while crashing.\n"
827 "* To attach the debugger, run this on the host:\n"
828 "*\n"
829 "* lldbclient.py -p %d\n"
830 "*\n"
831 "***********************************************************",
832 target_process, target_process);
833 }
834
835 // Close stdout before we notify tombstoned of completion.
836 close(STDOUT_FILENO);
837 if (g_tombstoned_connected &&
838 !notify_completion(g_tombstoned_socket.get(), g_output_fd.get(), g_proto_fd.get())) {
839 LOG(ERROR) << "failed to notify tombstoned of completion";
840 }
841
842 return 0;
843 }
844