1 /*
2 * Copyright 2016, The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <arpa/inet.h>
18 #include <dirent.h>
19 #include <fcntl.h>
20 #include <stdlib.h>
21 #include <sys/prctl.h>
22 #include <sys/ptrace.h>
23 #include <sys/types.h>
24 #include <sys/un.h>
25 #include <sys/user.h>
26 #include <sys/wait.h>
27 #include <unistd.h>
28
29 #if defined(__i386__)
30 #include <asm/ldt.h>
31 #endif
32
33 #include <cstdint>
34 #include <limits>
35 #include <map>
36 #include <memory>
37 #include <set>
38 #include <vector>
39
40 #include <android-base/errno_restorer.h>
41 #include <android-base/file.h>
42 #include <android-base/logging.h>
43 #include <android-base/macros.h>
44 #include <android-base/parseint.h>
45 #include <android-base/properties.h>
46 #include <android-base/stringprintf.h>
47 #include <android-base/strings.h>
48 #include <android-base/unique_fd.h>
49 #include <bionic/macros.h>
50 #include <bionic/reserved_signals.h>
51 #include <bionic/tls_defines.h>
52 #include <cutils/sockets.h>
53 #include <log/log.h>
54 #include <private/android_filesystem_config.h>
55 #include <procinfo/process.h>
56
57 #define ATRACE_TAG ATRACE_TAG_BIONIC
58 #include <utils/Trace.h>
59
60 #include <unwindstack/AndroidUnwinder.h>
61 #include <unwindstack/Error.h>
62 #include <unwindstack/MachineArm.h>
63 #include <unwindstack/MachineArm64.h>
64 #include <unwindstack/MachineRiscv64.h>
65 #include <unwindstack/Regs.h>
66 #include <unwindstack/RegsArm.h>
67 #include <unwindstack/RegsArm64.h>
68 #include <unwindstack/RegsRiscv64.h>
69 #include <unwindstack/UserArm.h>
70 #include <unwindstack/UserArm64.h>
71 #include <unwindstack/UserRiscv64.h>
72
73 #include <native_bridge_support/guest_state_accessor/accessor.h>
74
75 #include "libdebuggerd/backtrace.h"
76 #include "libdebuggerd/tombstone.h"
77 #include "libdebuggerd/utility.h"
78
79 #include "debuggerd/handler.h"
80 #include "tombstone_handler.h"
81
82 #include "protocol.h"
83 #include "util.h"
84
85 using android::base::ErrnoRestorer;
86 using android::base::StringPrintf;
87 using android::base::unique_fd;
88
89 // This stores guest architecture. When the architecture is supported, tombstone file will output
90 // guest state information.
91 static Architecture g_guest_arch = Architecture::NONE;
92
pid_contains_tid(int pid_proc_fd,pid_t tid)93 static bool pid_contains_tid(int pid_proc_fd, pid_t tid) {
94 struct stat st;
95 std::string task_path = StringPrintf("task/%d", tid);
96 return fstatat(pid_proc_fd, task_path.c_str(), &st, 0) == 0;
97 }
98
get_tracer(pid_t tracee)99 static pid_t get_tracer(pid_t tracee) {
100 // Check to see if the thread is being ptraced by another process.
101 android::procinfo::ProcessInfo process_info;
102 if (android::procinfo::GetProcessInfo(tracee, &process_info)) {
103 return process_info.tracer;
104 }
105 return -1;
106 }
107
108 // Attach to a thread, and verify that it's still a member of the given process
ptrace_seize_thread(int pid_proc_fd,pid_t tid,std::string * error,int flags=0)109 static bool ptrace_seize_thread(int pid_proc_fd, pid_t tid, std::string* error, int flags = 0) {
110 if (ptrace(PTRACE_SEIZE, tid, 0, flags) != 0) {
111 if (errno == EPERM) {
112 ErrnoRestorer errno_restorer; // In case get_tracer() fails and we fall through.
113 pid_t tracer_pid = get_tracer(tid);
114 if (tracer_pid > 0) {
115 *error = StringPrintf("failed to attach to thread %d, already traced by %d (%s)", tid,
116 tracer_pid, get_process_name(tracer_pid).c_str());
117 return false;
118 }
119 }
120
121 *error = StringPrintf("failed to attach to thread %d: %s", tid, strerror(errno));
122 return false;
123 }
124
125 // Make sure that the task we attached to is actually part of the pid we're dumping.
126 if (!pid_contains_tid(pid_proc_fd, tid)) {
127 if (ptrace(PTRACE_DETACH, tid, 0, 0) != 0) {
128 PLOG(WARNING) << "failed to detach from thread " << tid;
129 }
130 *error = StringPrintf("thread %d is not in process", tid);
131 return false;
132 }
133
134 return true;
135 }
136
wait_for_stop(pid_t tid,int * received_signal)137 static bool wait_for_stop(pid_t tid, int* received_signal) {
138 while (true) {
139 int status;
140 pid_t result = waitpid(tid, &status, __WALL);
141 if (result != tid) {
142 PLOG(ERROR) << "waitpid failed on " << tid << " while detaching";
143 return false;
144 }
145
146 if (WIFSTOPPED(status)) {
147 if (status >> 16 == PTRACE_EVENT_STOP) {
148 *received_signal = 0;
149 } else {
150 *received_signal = WSTOPSIG(status);
151 }
152 return true;
153 }
154 }
155 }
156
157 // Interrupt a process and wait for it to be interrupted.
ptrace_interrupt(pid_t tid,int * received_signal)158 static bool ptrace_interrupt(pid_t tid, int* received_signal) {
159 if (ptrace(PTRACE_INTERRUPT, tid, 0, 0) == 0) {
160 return wait_for_stop(tid, received_signal);
161 }
162
163 PLOG(ERROR) << "failed to interrupt " << tid << " to detach";
164 return false;
165 }
166
activity_manager_notify(pid_t pid,int signal,const std::string & amfd_data,bool recoverable_crash)167 static bool activity_manager_notify(pid_t pid, int signal, const std::string& amfd_data,
168 bool recoverable_crash) {
169 ATRACE_CALL();
170 android::base::unique_fd amfd(socket_local_client(
171 "/data/system/ndebugsocket", ANDROID_SOCKET_NAMESPACE_FILESYSTEM, SOCK_STREAM));
172 if (amfd.get() == -1) {
173 PLOG(ERROR) << "unable to connect to activity manager";
174 return false;
175 }
176
177 struct timeval tv = {
178 .tv_sec = 1 * android::base::HwTimeoutMultiplier(),
179 .tv_usec = 0,
180 };
181 if (setsockopt(amfd.get(), SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)) == -1) {
182 PLOG(ERROR) << "failed to set send timeout on activity manager socket";
183 return false;
184 }
185 tv.tv_sec = 3 * android::base::HwTimeoutMultiplier(); // 3 seconds on handshake read
186 if (setsockopt(amfd.get(), SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) == -1) {
187 PLOG(ERROR) << "failed to set receive timeout on activity manager socket";
188 return false;
189 }
190
191 // Activity Manager protocol:
192 // - 32-bit network-byte-order: pid
193 // - 32-bit network-byte-order: signal number
194 // - byte: recoverable_crash
195 // - bytes: raw text of the dump
196 // - null terminator
197
198 uint32_t datum = htonl(pid);
199 if (!android::base::WriteFully(amfd, &datum, sizeof(datum))) {
200 PLOG(ERROR) << "AM pid write failed";
201 return false;
202 }
203
204 datum = htonl(signal);
205 if (!android::base::WriteFully(amfd, &datum, sizeof(datum))) {
206 PLOG(ERROR) << "AM signo write failed";
207 return false;
208 }
209
210 uint8_t recoverable_crash_byte = recoverable_crash ? 1 : 0;
211 if (!android::base::WriteFully(amfd, &recoverable_crash_byte, sizeof(recoverable_crash_byte))) {
212 PLOG(ERROR) << "AM recoverable_crash_byte write failed";
213 return false;
214 }
215
216 if (!android::base::WriteFully(amfd, amfd_data.c_str(), amfd_data.size() + 1)) {
217 PLOG(ERROR) << "AM data write failed";
218 return false;
219 }
220
221 // 3 sec timeout reading the ack; we're fine if the read fails.
222 char ack;
223 android::base::ReadFully(amfd, &ack, 1);
224 return true;
225 }
226
227 // Globals used by the abort handler.
228 static pid_t g_target_thread = -1;
229 static bool g_tombstoned_connected = false;
230 static unique_fd g_tombstoned_socket;
231 static unique_fd g_output_fd;
232 static unique_fd g_proto_fd;
233
DefuseSignalHandlers()234 static void DefuseSignalHandlers() {
235 // Don't try to dump ourselves.
236 struct sigaction action = {};
237 action.sa_handler = SIG_DFL;
238 debuggerd_register_handlers(&action);
239
240 sigset_t mask;
241 sigemptyset(&mask);
242 if (sigprocmask(SIG_SETMASK, &mask, nullptr) != 0) {
243 PLOG(FATAL) << "failed to set signal mask";
244 }
245 }
246
Initialize(char ** argv)247 static void Initialize(char** argv) {
248 android::base::InitLogging(argv);
249 android::base::SetAborter([](const char* abort_msg) {
250 // If we abort before we get an output fd, contact tombstoned to let any
251 // potential listeners know that we failed.
252 if (!g_tombstoned_connected) {
253 if (!connect_tombstone_server(g_target_thread, &g_tombstoned_socket, &g_output_fd,
254 &g_proto_fd, kDebuggerdAnyIntercept)) {
255 // We failed to connect, not much we can do.
256 LOG(ERROR) << "failed to connected to tombstoned to report failure";
257 _exit(1);
258 }
259 }
260
261 dprintf(g_output_fd.get(), "crash_dump failed to dump process");
262 if (g_target_thread != 1) {
263 dprintf(g_output_fd.get(), " %d: %s\n", g_target_thread, abort_msg);
264 } else {
265 dprintf(g_output_fd.get(), ": %s\n", abort_msg);
266 }
267
268 _exit(1);
269 });
270 }
271
ParseArgs(int argc,char ** argv,pid_t * pseudothread_tid,DebuggerdDumpType * dump_type)272 static void ParseArgs(int argc, char** argv, pid_t* pseudothread_tid, DebuggerdDumpType* dump_type) {
273 if (argc != 4) {
274 LOG(FATAL) << "wrong number of args: " << argc << " (expected 4)";
275 }
276
277 if (!android::base::ParseInt(argv[1], &g_target_thread, 1, std::numeric_limits<pid_t>::max())) {
278 LOG(FATAL) << "invalid target tid: " << argv[1];
279 }
280
281 if (!android::base::ParseInt(argv[2], pseudothread_tid, 1, std::numeric_limits<pid_t>::max())) {
282 LOG(FATAL) << "invalid pseudothread tid: " << argv[2];
283 }
284
285 int dump_type_int;
286 if (!android::base::ParseInt(argv[3], &dump_type_int, 0)) {
287 LOG(FATAL) << "invalid requested dump type: " << argv[3];
288 }
289
290 *dump_type = static_cast<DebuggerdDumpType>(dump_type_int);
291 switch (*dump_type) {
292 case kDebuggerdNativeBacktrace:
293 case kDebuggerdTombstone:
294 case kDebuggerdTombstoneProto:
295 break;
296
297 default:
298 LOG(FATAL) << "invalid requested dump type: " << dump_type_int;
299 }
300 }
301
ReadCrashInfo(unique_fd & fd,siginfo_t * siginfo,std::unique_ptr<unwindstack::Regs> * regs,ProcessInfo * process_info,bool * recoverable_crash)302 static void ReadCrashInfo(unique_fd& fd, siginfo_t* siginfo,
303 std::unique_ptr<unwindstack::Regs>* regs, ProcessInfo* process_info,
304 bool* recoverable_crash) {
305 std::aligned_storage<sizeof(CrashInfo) + 1, alignof(CrashInfo)>::type buf;
306 CrashInfo* crash_info = reinterpret_cast<CrashInfo*>(&buf);
307 ssize_t rc = TEMP_FAILURE_RETRY(read(fd.get(), &buf, sizeof(buf)));
308 *recoverable_crash = false;
309 if (rc == -1) {
310 PLOG(FATAL) << "failed to read target ucontext";
311 }
312 ssize_t expected_size = 0;
313 switch (crash_info->header.version) {
314 case 1:
315 case 2:
316 case 3:
317 expected_size = sizeof(CrashInfoHeader) + sizeof(CrashInfoDataStatic);
318 break;
319
320 case 4:
321 expected_size = sizeof(CrashInfoHeader) + sizeof(CrashInfoDataDynamic);
322 break;
323
324 default:
325 LOG(FATAL) << "unexpected CrashInfo version: " << crash_info->header.version;
326 break;
327 }
328
329 if (rc < expected_size) {
330 LOG(FATAL) << "read " << rc << " bytes when reading target crash information, expected "
331 << expected_size;
332 }
333
334 switch (crash_info->header.version) {
335 case 4:
336 process_info->fdsan_table_address = crash_info->data.d.fdsan_table_address;
337 process_info->gwp_asan_state = crash_info->data.d.gwp_asan_state;
338 process_info->gwp_asan_metadata = crash_info->data.d.gwp_asan_metadata;
339 process_info->scudo_stack_depot = crash_info->data.d.scudo_stack_depot;
340 process_info->scudo_stack_depot_size = crash_info->data.d.scudo_stack_depot_size;
341 process_info->scudo_region_info = crash_info->data.d.scudo_region_info;
342 process_info->scudo_ring_buffer = crash_info->data.d.scudo_ring_buffer;
343 process_info->scudo_ring_buffer_size = crash_info->data.d.scudo_ring_buffer_size;
344 *recoverable_crash = crash_info->data.d.recoverable_crash;
345 process_info->crash_detail_page = crash_info->data.d.crash_detail_page;
346 FALLTHROUGH_INTENDED;
347 case 1:
348 case 2:
349 case 3:
350 process_info->abort_msg_address = crash_info->data.s.abort_msg_address;
351 *siginfo = crash_info->data.s.siginfo;
352 if (signal_has_si_addr(siginfo)) {
353 process_info->has_fault_address = true;
354 process_info->maybe_tagged_fault_address = reinterpret_cast<uintptr_t>(siginfo->si_addr);
355 process_info->untagged_fault_address =
356 untag_address(reinterpret_cast<uintptr_t>(siginfo->si_addr));
357 }
358 regs->reset(unwindstack::Regs::CreateFromUcontext(unwindstack::Regs::CurrentArch(),
359 &crash_info->data.s.ucontext));
360 break;
361
362 default:
363 __builtin_unreachable();
364 }
365 }
366
367 // Wait for a process to clone and return the child's pid.
368 // Note: this leaves the parent in PTRACE_EVENT_STOP.
wait_for_clone(pid_t pid,bool resume_child)369 static pid_t wait_for_clone(pid_t pid, bool resume_child) {
370 int status;
371 pid_t result = TEMP_FAILURE_RETRY(waitpid(pid, &status, __WALL));
372 if (result == -1) {
373 PLOG(FATAL) << "failed to waitpid";
374 }
375
376 if (WIFEXITED(status)) {
377 LOG(FATAL) << "traced process exited with status " << WEXITSTATUS(status);
378 } else if (WIFSIGNALED(status)) {
379 LOG(FATAL) << "traced process exited with signal " << WTERMSIG(status);
380 } else if (!WIFSTOPPED(status)) {
381 LOG(FATAL) << "process didn't stop? (status = " << status << ")";
382 }
383
384 if (status >> 8 != (SIGTRAP | (PTRACE_EVENT_CLONE << 8))) {
385 LOG(FATAL) << "process didn't stop due to PTRACE_O_TRACECLONE (status = " << status << ")";
386 }
387
388 pid_t child;
389 if (ptrace(PTRACE_GETEVENTMSG, pid, 0, &child) != 0) {
390 PLOG(FATAL) << "failed to get child pid via PTRACE_GETEVENTMSG";
391 }
392
393 int stop_signal;
394 if (!wait_for_stop(child, &stop_signal)) {
395 PLOG(FATAL) << "failed to waitpid on child";
396 }
397
398 CHECK_EQ(0, stop_signal);
399
400 if (resume_child) {
401 if (ptrace(PTRACE_CONT, child, 0, 0) != 0) {
402 PLOG(FATAL) << "failed to resume child (pid = " << child << ")";
403 }
404 }
405
406 return child;
407 }
408
wait_for_vm_process(pid_t pseudothread_tid)409 static pid_t wait_for_vm_process(pid_t pseudothread_tid) {
410 // The pseudothread will double-fork, we want its grandchild.
411 pid_t intermediate = wait_for_clone(pseudothread_tid, true);
412 pid_t vm_pid = wait_for_clone(intermediate, false);
413 if (ptrace(PTRACE_DETACH, intermediate, 0, 0) != 0) {
414 PLOG(FATAL) << "failed to detach from intermediate vm process";
415 }
416
417 return vm_pid;
418 }
419
InstallSigPipeHandler()420 static void InstallSigPipeHandler() {
421 struct sigaction action = {};
422 action.sa_handler = SIG_IGN;
423 action.sa_flags = SA_RESTART;
424 sigaction(SIGPIPE, &action, nullptr);
425 }
426
PtracePeek(int request,pid_t tid,uintptr_t addr,void * data,std::string_view err_msg,uintptr_t * result)427 static bool PtracePeek(int request, pid_t tid, uintptr_t addr, void* data, std::string_view err_msg,
428 uintptr_t* result) {
429 errno = 0;
430 *result = ptrace(request, tid, addr, data);
431 if (errno != 0) {
432 PLOG(ERROR) << err_msg;
433 return false;
434 }
435 return true;
436 }
437
GetGuestRegistersFromCrashedProcess(pid_t tid,NativeBridgeGuestRegs * guest_regs)438 static bool GetGuestRegistersFromCrashedProcess(pid_t tid, NativeBridgeGuestRegs* guest_regs) {
439 auto process_memory = unwindstack::Memory::CreateProcessMemoryCached(tid);
440
441 uintptr_t header_ptr = 0;
442 uintptr_t base = 0;
443 #if defined(__aarch64__)
444 // base is implicitly casted to uint64_t.
445 struct iovec pt_iov {
446 .iov_base = &base, .iov_len = sizeof(base),
447 };
448
449 if (ptrace(PTRACE_GETREGSET, tid, NT_ARM_TLS, &pt_iov) != 0) {
450 PLOG(ERROR) << "failed to read thread register for thread " << tid;
451 return false;
452 }
453 #elif defined(__arm__)
454 // Arm doesn't support any guest architectures yet.
455 return false;
456 #elif defined(__i386__)
457 struct user_regs_struct regs;
458 struct iovec pt_iov = {.iov_base = ®s, .iov_len = sizeof(regs)};
459 if (ptrace(PTRACE_GETREGSET, tid, NT_PRSTATUS, &pt_iov) != 0) {
460 PLOG(ERROR) << "failed to get registers for thread " << tid;
461 return false;
462 }
463
464 struct user_desc desc;
465 desc.entry_number = regs.xgs >> 3;
466 if (ptrace(PTRACE_GET_THREAD_AREA, tid, desc.entry_number, &desc) != 0) {
467 PLOG(ERROR) << "failed to get thread area for thread " << tid;
468 return false;
469 }
470 base = desc.base_addr;
471 #elif defined(__riscv)
472 struct user_regs_struct regs;
473 struct iovec pt_iov = {.iov_base = ®s, .iov_len = sizeof(regs)};
474 if (ptrace(PTRACE_GETREGSET, tid, NT_PRSTATUS, &pt_iov) != 0) {
475 PLOG(ERROR) << "failed to read thread register for thread " << tid;
476 return false;
477 }
478 base = reinterpret_cast<uintptr_t>(regs.tp);
479 #elif defined(__x86_64__)
480 if (!PtracePeek(PTRACE_PEEKUSER, tid, offsetof(user_regs_struct, fs_base), nullptr,
481 "failed to read thread register for thread " + std::to_string(tid), &base)) {
482 return false;
483 }
484 #else
485 // TODO(b/339287219): Add case for Riscv host.
486 return false;
487 #endif
488 auto ptr_to_guest_slot = base + TLS_SLOT_NATIVE_BRIDGE_GUEST_STATE * sizeof(uintptr_t);
489 if (!process_memory->ReadFully(ptr_to_guest_slot, &header_ptr, sizeof(uintptr_t))) {
490 PLOG(ERROR) << "failed to get guest state TLS slot content for thread " << tid;
491 return false;
492 }
493
494 NativeBridgeGuestStateHeader header;
495 if (!process_memory->ReadFully(header_ptr, &header, sizeof(NativeBridgeGuestStateHeader)) ||
496 header.signature != NATIVE_BRIDGE_GUEST_STATE_SIGNATURE) {
497 // Return when ptr points to unmapped memory or no valid guest state.
498 return false;
499 }
500
501 auto guest_state_data_copy = std::make_unique<unsigned char[]>(header.guest_state_data_size);
502 if (!process_memory->ReadFully(reinterpret_cast<uintptr_t>(header.guest_state_data),
503 guest_state_data_copy.get(), header.guest_state_data_size)) {
504 PLOG(ERROR) << "failed to read the guest state data for thread " << tid;
505 return false;
506 }
507
508 LoadGuestStateRegisters(guest_state_data_copy.get(), header.guest_state_data_size, guest_regs);
509 return true;
510 }
511
ReadGuestRegisters(std::unique_ptr<unwindstack::Regs> * regs,pid_t tid)512 static void ReadGuestRegisters(std::unique_ptr<unwindstack::Regs>* regs, pid_t tid) {
513 NativeBridgeGuestRegs guest_regs;
514 if (!GetGuestRegistersFromCrashedProcess(tid, &guest_regs)) {
515 return;
516 }
517
518 switch (guest_regs.guest_arch) {
519 #if defined(__LP64__)
520 case NATIVE_BRIDGE_ARCH_ARM64: {
521 unwindstack::arm64_user_regs arm64_user_regs = {};
522 for (size_t i = 0; i < unwindstack::ARM64_REG_R31; i++) {
523 arm64_user_regs.regs[i] = guest_regs.regs_arm64.x[i];
524 }
525 arm64_user_regs.sp = guest_regs.regs_arm64.sp;
526 arm64_user_regs.pc = guest_regs.regs_arm64.ip;
527 regs->reset(unwindstack::RegsArm64::Read(&arm64_user_regs));
528
529 g_guest_arch = Architecture::ARM64;
530 break;
531 }
532 case NATIVE_BRIDGE_ARCH_RISCV64: {
533 unwindstack::riscv64_user_regs riscv64_user_regs = {};
534 // RISCV64_REG_PC is at the first position.
535 riscv64_user_regs.regs[0] = guest_regs.regs_riscv64.ip;
536 for (size_t i = 1; i < unwindstack::RISCV64_REG_REAL_COUNT; i++) {
537 riscv64_user_regs.regs[i] = guest_regs.regs_riscv64.x[i];
538 }
539 regs->reset(unwindstack::RegsRiscv64::Read(&riscv64_user_regs, tid));
540
541 g_guest_arch = Architecture::RISCV64;
542 break;
543 }
544 #else
545 case NATIVE_BRIDGE_ARCH_ARM: {
546 unwindstack::arm_user_regs arm_user_regs = {};
547 for (size_t i = 0; i < unwindstack::ARM_REG_LAST; i++) {
548 arm_user_regs.regs[i] = guest_regs.regs_arm.r[i];
549 }
550 regs->reset(unwindstack::RegsArm::Read(&arm_user_regs));
551
552 g_guest_arch = Architecture::ARM32;
553 break;
554 }
555 #endif
556 default:
557 break;
558 }
559 }
560
main(int argc,char ** argv)561 int main(int argc, char** argv) {
562 DefuseSignalHandlers();
563 InstallSigPipeHandler();
564
565 // There appears to be a bug in the kernel where our death causes SIGHUP to
566 // be sent to our process group if we exit while it has stopped jobs (e.g.
567 // because of wait_for_debugger). Use setsid to create a new process group to
568 // avoid hitting this.
569 setsid();
570
571 atrace_begin(ATRACE_TAG, "before reparent");
572 pid_t target_process = getppid();
573
574 // Open /proc/`getppid()` before we daemonize.
575 std::string target_proc_path = "/proc/" + std::to_string(target_process);
576 int target_proc_fd = open(target_proc_path.c_str(), O_DIRECTORY | O_RDONLY);
577 if (target_proc_fd == -1) {
578 PLOG(FATAL) << "failed to open " << target_proc_path;
579 }
580
581 // Make sure getppid() hasn't changed.
582 if (getppid() != target_process) {
583 LOG(FATAL) << "parent died";
584 }
585 atrace_end(ATRACE_TAG);
586
587 // Reparent ourselves to init, so that the signal handler can waitpid on the
588 // original process to avoid leaving a zombie for non-fatal dumps.
589 // Move the input/output pipes off of stdout/stderr, out of paranoia.
590 unique_fd output_pipe(dup(STDOUT_FILENO));
591 unique_fd input_pipe(dup(STDIN_FILENO));
592
593 unique_fd fork_exit_read, fork_exit_write;
594 if (!Pipe(&fork_exit_read, &fork_exit_write)) {
595 PLOG(FATAL) << "failed to create pipe";
596 }
597
598 pid_t forkpid = fork();
599 if (forkpid == -1) {
600 PLOG(FATAL) << "fork failed";
601 } else if (forkpid == 0) {
602 fork_exit_read.reset();
603 } else {
604 // We need the pseudothread to live until we get around to verifying the vm pid against it.
605 // The last thing it does is block on a waitpid on us, so wait until our child tells us to die.
606 fork_exit_write.reset();
607 char buf;
608 TEMP_FAILURE_RETRY(read(fork_exit_read.get(), &buf, sizeof(buf)));
609 _exit(0);
610 }
611
612 ATRACE_NAME("after reparent");
613 pid_t pseudothread_tid;
614 DebuggerdDumpType dump_type;
615 ProcessInfo process_info;
616
617 Initialize(argv);
618 ParseArgs(argc, argv, &pseudothread_tid, &dump_type);
619
620 // Die if we take too long.
621 //
622 // Note: processes with many threads and minidebug-info can take a bit to
623 // unwind, do not make this too small. b/62828735
624 alarm(30 * android::base::HwTimeoutMultiplier());
625
626 // Collect the list of open files.
627 OpenFilesList open_files;
628 {
629 ATRACE_NAME("open files");
630 populate_open_files_list(&open_files, g_target_thread);
631 }
632
633 // In order to reduce the duration that we pause the process for, we ptrace
634 // the threads, fetch their registers and associated information, and then
635 // fork a separate process as a snapshot of the process's address space.
636 std::set<pid_t> threads;
637 if (!android::procinfo::GetProcessTids(g_target_thread, &threads)) {
638 PLOG(FATAL) << "failed to get process threads";
639 }
640
641 std::map<pid_t, ThreadInfo> thread_info;
642 siginfo_t siginfo;
643 std::string error;
644 bool recoverable_crash = false;
645
646 {
647 ATRACE_NAME("ptrace");
648 for (pid_t thread : threads) {
649 // Trace the pseudothread separately, so we can use different options.
650 if (thread == pseudothread_tid) {
651 continue;
652 }
653
654 if (!ptrace_seize_thread(target_proc_fd, thread, &error)) {
655 bool fatal = thread == g_target_thread;
656 LOG(fatal ? FATAL : WARNING) << error;
657 }
658
659 ThreadInfo info;
660 info.pid = target_process;
661 info.tid = thread;
662 info.uid = getuid();
663 info.thread_name = get_thread_name(thread);
664
665 unique_fd attr_fd(openat(target_proc_fd, "attr/current", O_RDONLY | O_CLOEXEC));
666 if (!android::base::ReadFdToString(attr_fd, &info.selinux_label)) {
667 PLOG(WARNING) << "failed to read selinux label";
668 }
669
670 if (!ptrace_interrupt(thread, &info.signo)) {
671 PLOG(WARNING) << "failed to ptrace interrupt thread " << thread;
672 ptrace(PTRACE_DETACH, thread, 0, 0);
673 continue;
674 }
675
676 struct iovec tagged_addr_iov = {
677 &info.tagged_addr_ctrl,
678 sizeof(info.tagged_addr_ctrl),
679 };
680 if (ptrace(PTRACE_GETREGSET, thread, NT_ARM_TAGGED_ADDR_CTRL,
681 reinterpret_cast<void*>(&tagged_addr_iov)) == -1) {
682 info.tagged_addr_ctrl = -1;
683 }
684
685 struct iovec pac_enabled_keys_iov = {
686 &info.pac_enabled_keys,
687 sizeof(info.pac_enabled_keys),
688 };
689 if (ptrace(PTRACE_GETREGSET, thread, NT_ARM_PAC_ENABLED_KEYS,
690 reinterpret_cast<void*>(&pac_enabled_keys_iov)) == -1) {
691 info.pac_enabled_keys = -1;
692 }
693
694 #if defined(__aarch64__)
695 struct iovec tls_iov = {
696 &info.tls,
697 sizeof(info.tls),
698 };
699 if (ptrace(PTRACE_GETREGSET, thread, NT_ARM_TLS, reinterpret_cast<void*>(&tls_iov)) == -1) {
700 info.tls = 0;
701 }
702 #endif
703 if (thread == g_target_thread) {
704 // Read the thread's registers along with the rest of the crash info out of the pipe.
705 ReadCrashInfo(input_pipe, &siginfo, &info.registers, &process_info, &recoverable_crash);
706 info.siginfo = &siginfo;
707 info.signo = info.siginfo->si_signo;
708
709 info.command_line = get_command_line(g_target_thread);
710 } else {
711 info.registers.reset(unwindstack::Regs::RemoteGet(thread));
712 if (!info.registers) {
713 PLOG(WARNING) << "failed to fetch registers for thread " << thread;
714 ptrace(PTRACE_DETACH, thread, 0, 0);
715 continue;
716 }
717 }
718 ReadGuestRegisters(&info.guest_registers, thread);
719
720 thread_info[thread] = std::move(info);
721 }
722 }
723
724 // Trace the pseudothread with PTRACE_O_TRACECLONE and tell it to fork.
725 if (!ptrace_seize_thread(target_proc_fd, pseudothread_tid, &error, PTRACE_O_TRACECLONE)) {
726 LOG(FATAL) << "failed to seize pseudothread: " << error;
727 }
728
729 if (TEMP_FAILURE_RETRY(write(output_pipe.get(), "\1", 1)) != 1) {
730 PLOG(FATAL) << "failed to write to pseudothread";
731 }
732
733 pid_t vm_pid = wait_for_vm_process(pseudothread_tid);
734 if (ptrace(PTRACE_DETACH, pseudothread_tid, 0, 0) != 0) {
735 PLOG(FATAL) << "failed to detach from pseudothread";
736 }
737
738 // The pseudothread can die now.
739 fork_exit_write.reset();
740
741 // Defer the message until later, for readability.
742 bool wait_for_debugger = android::base::GetBoolProperty(
743 "debug.debuggerd.wait_for_debugger",
744 android::base::GetBoolProperty("debug.debuggerd.wait_for_gdb", false));
745 if (siginfo.si_signo == BIONIC_SIGNAL_DEBUGGER) {
746 wait_for_debugger = false;
747 }
748
749 // Detach from all of our attached threads before resuming.
750 for (const auto& [tid, thread] : thread_info) {
751 int resume_signal = thread.signo == BIONIC_SIGNAL_DEBUGGER ? 0 : thread.signo;
752 if (wait_for_debugger) {
753 resume_signal = 0;
754 if (tgkill(target_process, tid, SIGSTOP) != 0) {
755 PLOG(WARNING) << "failed to send SIGSTOP to " << tid;
756 }
757 }
758
759 LOG(DEBUG) << "detaching from thread " << tid;
760 if (ptrace(PTRACE_DETACH, tid, 0, resume_signal) != 0) {
761 PLOG(ERROR) << "failed to detach from thread " << tid;
762 }
763 }
764
765 // Drop our capabilities now that we've fetched all of the information we need.
766 drop_capabilities();
767
768 {
769 ATRACE_NAME("tombstoned_connect");
770 LOG(INFO) << "obtaining output fd from tombstoned, type: " << dump_type;
771 g_tombstoned_connected = connect_tombstone_server(g_target_thread, &g_tombstoned_socket,
772 &g_output_fd, &g_proto_fd, dump_type);
773 }
774
775 if (g_tombstoned_connected) {
776 if (TEMP_FAILURE_RETRY(dup2(g_output_fd.get(), STDOUT_FILENO)) == -1) {
777 PLOG(ERROR) << "failed to dup2 output fd (" << g_output_fd.get() << ") to STDOUT_FILENO";
778 }
779 } else {
780 unique_fd devnull(TEMP_FAILURE_RETRY(open("/dev/null", O_RDWR)));
781 TEMP_FAILURE_RETRY(dup2(devnull.get(), STDOUT_FILENO));
782 g_output_fd = std::move(devnull);
783 }
784
785 LOG(INFO) << "performing dump of process " << target_process
786 << " (target tid = " << g_target_thread << ")";
787
788 int signo = siginfo.si_signo;
789 bool fatal_signal = signo != BIONIC_SIGNAL_DEBUGGER;
790 bool backtrace = false;
791
792 // si_value is special when used with BIONIC_SIGNAL_DEBUGGER.
793 // 0: dump tombstone
794 // 1: dump backtrace
795 if (!fatal_signal) {
796 int si_val = siginfo.si_value.sival_int;
797 if (si_val == 0) {
798 backtrace = false;
799 } else if (si_val == 1) {
800 backtrace = true;
801 } else {
802 LOG(WARNING) << "unknown si_value value " << si_val;
803 }
804 }
805
806 // TODO: Use seccomp to lock ourselves down.
807
808 unwindstack::AndroidRemoteUnwinder unwinder(vm_pid, unwindstack::Regs::CurrentArch());
809 unwindstack::ErrorData error_data;
810 if (!unwinder.Initialize(error_data)) {
811 LOG(FATAL) << "Failed to initialize unwinder object: "
812 << unwindstack::GetErrorCodeString(error_data.code);
813 }
814
815 std::string amfd_data;
816 if (backtrace) {
817 ATRACE_NAME("dump_backtrace");
818 dump_backtrace(std::move(g_output_fd), &unwinder, thread_info, g_target_thread);
819 } else {
820 {
821 ATRACE_NAME("fdsan table dump");
822 populate_fdsan_table(&open_files, unwinder.GetProcessMemory(),
823 process_info.fdsan_table_address);
824 }
825
826 {
827 ATRACE_NAME("engrave_tombstone");
828 unwindstack::ArchEnum regs_arch = unwindstack::ARCH_UNKNOWN;
829 switch (g_guest_arch) {
830 case Architecture::ARM32:
831 regs_arch = unwindstack::ARCH_ARM;
832 break;
833 case Architecture::ARM64:
834 regs_arch = unwindstack::ARCH_ARM64;
835 break;
836 case Architecture::RISCV64:
837 regs_arch = unwindstack::ARCH_RISCV64;
838 break;
839 default:
840 break;
841 }
842 if (regs_arch == unwindstack::ARCH_UNKNOWN) {
843 engrave_tombstone(std::move(g_output_fd), std::move(g_proto_fd), &unwinder, thread_info,
844 g_target_thread, process_info, &open_files, &amfd_data);
845 } else {
846 unwindstack::AndroidRemoteUnwinder guest_unwinder(vm_pid, regs_arch);
847 engrave_tombstone(std::move(g_output_fd), std::move(g_proto_fd), &unwinder, thread_info,
848 g_target_thread, process_info, &open_files, &amfd_data, &g_guest_arch,
849 &guest_unwinder);
850 }
851 }
852 }
853
854 if (fatal_signal) {
855 // Don't try to notify ActivityManager if it just crashed, or we might hang until timeout.
856 if (thread_info[target_process].thread_name != "system_server") {
857 activity_manager_notify(target_process, signo, amfd_data, recoverable_crash);
858 }
859 }
860
861 if (wait_for_debugger) {
862 // Use ALOGI to line up with output from engrave_tombstone.
863 ALOGI(
864 "***********************************************************\n"
865 "* Process %d has been suspended while crashing.\n"
866 "* To attach the debugger, run this on the host:\n"
867 "*\n"
868 "* lldbclient.py -p %d\n"
869 "*\n"
870 "***********************************************************",
871 target_process, target_process);
872 }
873
874 // Close stdout before we notify tombstoned of completion.
875 close(STDOUT_FILENO);
876 if (g_tombstoned_connected &&
877 !notify_completion(g_tombstoned_socket.get(), g_output_fd.get(), g_proto_fd.get())) {
878 LOG(ERROR) << "failed to notify tombstoned of completion";
879 }
880
881 return 0;
882 }
883