/*--------------------------------------------------------------------*/ /*--- Implementation of vgdb invoker subsystem via ptrace() calls. ---*/ /*--------------------------------------------------------------------*/ /* This file is part of Valgrind, a dynamic binary instrumentation framework. Copyright (C) 2011-2017 Philippe Waroquiers This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA. The GNU General Public License is contained in the file COPYING. */ #include "config.h" #include "vgdb.h" #include "pub_core_threadstate.h" #include #include #include #include #include #include #include #include #include #include #ifdef PTRACE_GETREGSET // TBD: better have a configure test instead ? #define HAVE_PTRACE_GETREGSET // A bi-arch build using PTRACE_GET/SETREGSET needs // some conversion code for register structures. // So, better do not use PTRACE_GET/SETREGSET // Rather we use PTRACE_GETREGS or PTRACE_PEEKUSER. // The only platform on which we must use PTRACE_GETREGSET is arm64. // The resulting vgdb cannot work in a bi-arch setup. // -1 means we will check that PTRACE_GETREGSET works. # if defined(VGA_arm64) #define USE_PTRACE_GETREGSET # endif #endif #include #include #include // glibc versions prior to 2.5 do not define PTRACE_GETSIGINFO on // the platforms we support. #if !((__GLIBC__ > 2) || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 5)) # ifndef PTRACE_GETSIGINFO # define PTRACE_GETSIGINFO 0x4202 # endif #endif // 32-bit or 64-bit wide, depending on primary architecture. typedef Addr CORE_ADDR; typedef Addr PTRACE_XFER_TYPE; typedef void* PTRACE_ARG3_TYPE; // if > 0, pid for which registers have to be restored. // if == 0, means we have not yet called setregs (or have already // restored the registers). static int pid_of_save_regs = 0; /* True if we have continued pid_of_save_regs after PTRACE_ATTACH. */ static Bool pid_of_save_regs_continued = False; // When setregs has been called to change the registers of pid_of_save_regs, // vgdb cannot transmit the signals intercepted during ptrace. // So, we queue them, and will deliver them when detaching. // See function waitstopped for more info. static int signal_queue_sz = 0; static siginfo_t *signal_queue; /* True when loss of connection indicating that the Valgrind process is dying. */ static Bool dying = False; /* ptrace_(read|write)_memory are modified extracts of linux-low.c from gdb 6.6. Copyrighted FSF */ /* Copy LEN bytes from valgrind memory starting at MEMADDR to vgdb memory starting at MYADDR. */ static int ptrace_read_memory (pid_t inferior_pid, CORE_ADDR memaddr, void *myaddr, size_t len) { register int i; /* Round starting address down to longword boundary. */ register CORE_ADDR addr = memaddr & -(CORE_ADDR) sizeof (PTRACE_XFER_TYPE); /* Round ending address up; get number of longwords that makes. */ register int count = (((memaddr + len) - addr) + sizeof (PTRACE_XFER_TYPE) - 1) / sizeof (PTRACE_XFER_TYPE); /* Allocate buffer of that many longwords. */ register PTRACE_XFER_TYPE *buffer = (PTRACE_XFER_TYPE *) alloca (count * sizeof (PTRACE_XFER_TYPE)); /* Read all the longwords */ for (i = 0; i < count; i++, addr += sizeof (PTRACE_XFER_TYPE)) { errno = 0; buffer[i] = ptrace (PTRACE_PEEKTEXT, inferior_pid, (PTRACE_ARG3_TYPE) addr, 0); if (errno) return errno; } /* Copy appropriate bytes out of the buffer. */ memcpy (myaddr, (char *) buffer + (memaddr & (sizeof (PTRACE_XFER_TYPE) - 1)), len); return 0; } /* Copy LEN bytes of data from vgdb memory at MYADDR to valgrind memory at MEMADDR. On failure (cannot write the valgrind memory) returns the value of errno. */ __attribute__((unused)) /* not used on all platforms */ static int ptrace_write_memory (pid_t inferior_pid, CORE_ADDR memaddr, const void *myaddr, size_t len) { register int i; /* Round starting address down to longword boundary. */ register CORE_ADDR addr = memaddr & -(CORE_ADDR) sizeof (PTRACE_XFER_TYPE); /* Round ending address up; get number of longwords that makes. */ register int count = (((memaddr + len) - addr) + sizeof (PTRACE_XFER_TYPE) - 1) / sizeof (PTRACE_XFER_TYPE); /* Allocate buffer of that many longwords. */ register PTRACE_XFER_TYPE *buffer = (PTRACE_XFER_TYPE *) alloca (count * sizeof (PTRACE_XFER_TYPE)); if (debuglevel >= 1) { DEBUG (1, "Writing "); for (i = 0; i < len; i++) PDEBUG (1, "%02x", ((const unsigned char*)myaddr)[i]); PDEBUG(1, " to %p\n", (void *) memaddr); } /* Fill start and end extra bytes of buffer with existing memory data. */ buffer[0] = ptrace (PTRACE_PEEKTEXT, inferior_pid, (PTRACE_ARG3_TYPE) addr, 0); if (count > 1) { buffer[count - 1] = ptrace (PTRACE_PEEKTEXT, inferior_pid, (PTRACE_ARG3_TYPE) (addr + (count - 1) * sizeof (PTRACE_XFER_TYPE)), 0); } /* Copy data to be written over corresponding part of buffer */ memcpy ((char *) buffer + (memaddr & (sizeof (PTRACE_XFER_TYPE) - 1)), myaddr, len); /* Write the entire buffer. */ for (i = 0; i < count; i++, addr += sizeof (PTRACE_XFER_TYPE)) { errno = 0; ptrace (PTRACE_POKETEXT, inferior_pid, (PTRACE_ARG3_TYPE) addr, buffer[i]); if (errno) return errno; } return 0; } /* subset of VG_(threads) needed for vgdb ptrace. This is initialized when process is attached. */ typedef struct { ThreadStatus status; Int lwpid; } VgdbThreadState; static VgdbThreadState *vgdb_threads; static int vg_n_threads; static const HChar* name_of_ThreadStatus ( ThreadStatus status ) { switch (status) { case VgTs_Empty: return "VgTs_Empty"; case VgTs_Init: return "VgTs_Init"; case VgTs_Runnable: return "VgTs_Runnable"; case VgTs_WaitSys: return "VgTs_WaitSys"; case VgTs_Yielding: return "VgTs_Yielding"; case VgTs_Zombie: return "VgTs_Zombie"; default: return "VgTs_???"; } } static char *status_image (int status) { static char result[256]; // large enough int sz = 0; #define APPEND(...) sz += snprintf (result+sz, 256 - sz - 1, __VA_ARGS__) result[0] = 0; if (WIFEXITED(status)) APPEND ("WIFEXITED %d ", WEXITSTATUS(status)); if (WIFSIGNALED(status)) { APPEND ("WIFSIGNALED %d ", WTERMSIG(status)); if (WCOREDUMP(status)) APPEND ("WCOREDUMP "); } if (WIFSTOPPED(status)) APPEND ("WIFSTOPPED %d ", WSTOPSIG(status)); #ifdef WIFCONTINUED if (WIFCONTINUED(status)) APPEND ("WIFCONTINUED "); #endif return result; #undef APPEND } /* Wait till the process pid is reported as stopped with signal_expected. If other signal(s) than signal_expected are received, waitstopped will pass them to pid, waiting for signal_expected to stop pid. Returns True when process is in stopped state with signal_expected. Returns False if a problem was encountered while waiting for pid to be stopped. If pid is reported as being dead/exited, waitstopped will return False. */ static Bool waitstopped (pid_t pid, int signal_expected, const char *msg) { pid_t p; int status = 0; int signal_received; int res; while (1) { DEBUG(1, "waitstopped %s before waitpid signal_expected %d\n", msg, signal_expected); p = waitpid(pid, &status, __WALL); DEBUG(1, "after waitpid pid %d p %d status 0x%x %s\n", pid, p, status, status_image (status)); if (p != pid) { ERROR(errno, "%s waitpid pid %d in waitstopped %d status 0x%x %s\n", msg, pid, p, status, status_image (status)); return False; } if (WIFEXITED(status)) { shutting_down = True; return False; } assert (WIFSTOPPED(status)); signal_received = WSTOPSIG(status); if (signal_received == signal_expected) break; /* pid received a signal which is not the signal we are waiting for. If we have not (yet) changed the registers of the inferior or we have (already) reset them, we can transmit the signal. If we have already set the registers of the inferior, we cannot transmit the signal, as this signal would arrive when the gdbserver code runs. And valgrind only expects signals to arrive in a small code portion around client syscall logic, where signal are unmasked (see e.g. m_syswrap/syscall-x86-linux.S ML_(do_syscall_for_client_WRK). As ptrace is forcing a call to gdbserver by jumping 'out of this region', signals are not masked, but will arrive outside of the allowed/expected code region. So, if we have changed the registers of the inferior, we rather queue the signal to transmit them when detaching, after having restored the registers to the initial values. */ if (pid_of_save_regs) { siginfo_t *newsiginfo; // realloc a bigger queue, and store new signal at the end. // This is not very efficient but we assume not many sigs are queued. signal_queue_sz++; signal_queue = vrealloc(signal_queue, sizeof(siginfo_t) * signal_queue_sz); newsiginfo = signal_queue + (signal_queue_sz - 1); res = ptrace (PTRACE_GETSIGINFO, pid, NULL, newsiginfo); if (res != 0) { ERROR(errno, "PTRACE_GETSIGINFO failed: signal lost !!!!\n"); signal_queue_sz--; } else DEBUG(1, "waitstopped PTRACE_CONT, queuing signal %d" " si_signo %d si_pid %d\n", signal_received, newsiginfo->si_signo, newsiginfo->si_pid); res = ptrace (PTRACE_CONT, pid, NULL, 0); } else { DEBUG(1, "waitstopped PTRACE_CONT with signal %d\n", signal_received); res = ptrace (PTRACE_CONT, pid, NULL, signal_received); } if (res != 0) { ERROR(errno, "waitstopped PTRACE_CONT\n"); return False; } } return True; } /* Stops the given pid, wait for the process to be stopped. Returns True if successful, False otherwise. msg is used in tracing and error reporting. */ static Bool stop (pid_t pid, const char *msg) { long res; DEBUG(1, "%s SIGSTOP pid %d\n", msg, pid); res = kill (pid, SIGSTOP); if (res != 0) { ERROR(errno, "%s SIGSTOP pid %d %ld\n", msg, pid, res); return False; } return waitstopped (pid, SIGSTOP, msg); } /* Attaches to given pid, wait for the process to be stopped. Returns True if successful, False otherwise. msg is used in tracing and error reporting. */ static Bool attach (pid_t pid, const char *msg) { long res; static Bool output_error = True; static Bool initial_attach = True; // For a ptrace_scope protected system, we do not want to output // repetitively attach error. We will output once an error // for the initial_attach. Once the 1st attach has succeeded, we // again show all errors. DEBUG(1, "%s PTRACE_ATTACH pid %d\n", msg, pid); res = ptrace (PTRACE_ATTACH, pid, NULL, NULL); if (res != 0) { if (output_error || debuglevel > 0) { ERROR(errno, "%s PTRACE_ATTACH pid %d %ld\n", msg, pid, res); if (initial_attach) output_error = False; } return False; } initial_attach = False; output_error = True; return waitstopped(pid, SIGSTOP, msg); } /* once we are attached to the pid, get the list of threads and stop them all. Returns True if all threads properly suspended, False otherwise. */ static Bool acquire_and_suspend_threads (pid_t pid) { int i; int rw; Bool pid_found = False; Addr vgt; int sz_tst; int off_status; int off_lwpid; int nr_live_threads = 0; if (shared32 != NULL) { vgt = shared32->threads; vg_n_threads = shared32->vg_n_threads; sz_tst = shared32->sizeof_ThreadState; off_status = shared32->offset_status; off_lwpid = shared32->offset_lwpid; } else if (shared64 != NULL) { vgt = shared64->threads; vg_n_threads = shared64->vg_n_threads; sz_tst = shared64->sizeof_ThreadState; off_status = shared64->offset_status; off_lwpid = shared64->offset_lwpid; } else { assert (0); } vgdb_threads = vmalloc(vg_n_threads * sizeof vgdb_threads[0]); /* note: the entry 0 is unused */ DEBUG(1, "examining thread entries from tid 1 to tid %d\n", vg_n_threads-1); for (i = 1; i < vg_n_threads; i++) { vgt += sz_tst; rw = ptrace_read_memory(pid, vgt+off_status, &(vgdb_threads[i].status), sizeof(ThreadStatus)); if (rw != 0) { ERROR(rw, "status ptrace_read_memory\n"); return False; } rw = ptrace_read_memory(pid, vgt+off_lwpid, &(vgdb_threads[i].lwpid), sizeof(Int)); if (rw != 0) { ERROR(rw, "lwpid ptrace_read_memory\n"); return False; } if (vgdb_threads[i].status != VgTs_Empty) { DEBUG(1, "found tid %d status %s lwpid %d\n", i, name_of_ThreadStatus(vgdb_threads[i].status), vgdb_threads[i].lwpid); nr_live_threads++; if (vgdb_threads[i].lwpid <= 1) { if (vgdb_threads[i].lwpid == 0 && vgdb_threads[i].status == VgTs_Init) { DEBUG(1, "not set lwpid tid %d status %s lwpid %d\n", i, name_of_ThreadStatus(vgdb_threads[i].status), vgdb_threads[i].lwpid); } else { ERROR(1, "unexpected lwpid tid %d status %s lwpid %d\n", i, name_of_ThreadStatus(vgdb_threads[i].status), vgdb_threads[i].lwpid); } /* in case we have a VtTs_Init thread with lwpid not yet set, we try again later. */ return False; } if (vgdb_threads[i].lwpid == pid) { assert (!pid_found); assert (i == 1); pid_found = True; } else { if (!attach(vgdb_threads[i].lwpid, "attach_thread")) { ERROR(0, "ERROR attach pid %d tid %d\n", vgdb_threads[i].lwpid, i); return False; } } } } /* If we found no thread, it means the process is stopping, and we better do not force anything to happen during that. */ if (nr_live_threads > 0) return True; else return False; } static void detach_from_all_threads (pid_t pid) { int i; long res; Bool pid_found = False; /* detach from all the threads */ for (i = 1; i < vg_n_threads; i++) { if (vgdb_threads[i].status != VgTs_Empty) { if (vgdb_threads[i].status == VgTs_Init && vgdb_threads[i].lwpid == 0) { DEBUG(1, "skipping PTRACE_DETACH pid %d tid %d status %s\n", vgdb_threads[i].lwpid, i, name_of_ThreadStatus (vgdb_threads[i].status)); } else { if (vgdb_threads[i].lwpid == pid) { assert (!pid_found); pid_found = True; } DEBUG(1, "PTRACE_DETACH pid %d tid %d status %s\n", vgdb_threads[i].lwpid, i, name_of_ThreadStatus (vgdb_threads[i].status)); res = ptrace (PTRACE_DETACH, vgdb_threads[i].lwpid, NULL, NULL); if (res != 0) { ERROR(errno, "PTRACE_DETACH pid %d tid %d status %s res %ld\n", vgdb_threads[i].lwpid, i, name_of_ThreadStatus (vgdb_threads[i].status), res); } } } } free (vgdb_threads); if (!pid_found && pid) { /* No threads are live. Process is busy stopping. We need to detach from pid explicitly. */ DEBUG(1, "no thread live => PTRACE_DETACH pid %d\n", pid); res = ptrace (PTRACE_DETACH, pid, NULL, NULL); if (res != 0) ERROR(errno, "PTRACE_DETACH pid %d res %ld\n", pid, res); } } # if defined(VGA_arm64) /* arm64 is extra special, old glibc defined kernel user_pt_regs, but newer glibc instead define user_regs_struct. */ # ifdef HAVE_SYS_USER_REGS static struct user_regs_struct user_save; # else static struct user_pt_regs user_save; # endif # else static struct user user_save; # endif // The below indicates if ptrace_getregs (and ptrace_setregs) can be used. // Note that some linux versions are defining PTRACE_GETREGS but using // it gives back EIO. // has_working_ptrace_getregs can take the following values: // -1 : PTRACE_GETREGS is defined // runtime check not yet done. // 0 : PTRACE_GETREGS runtime check has failed. // 1 : PTRACE_GETREGS defined and runtime check ok. #ifdef HAVE_PTRACE_GETREGS static int has_working_ptrace_getregs = -1; #endif // Similar but for PTRACE_GETREGSET #ifdef HAVE_PTRACE_GETREGSET static int has_working_ptrace_getregset = -1; #endif /* Get the registers from pid into regs. regs_bsz value gives the length of *regs. Returns True if all ok, otherwise False. */ static Bool getregs (pid_t pid, void *regs, long regs_bsz) { DEBUG(1, "getregs regs_bsz %ld\n", regs_bsz); # ifdef HAVE_PTRACE_GETREGSET # ifndef USE_PTRACE_GETREGSET if (has_working_ptrace_getregset) DEBUG(1, "PTRACE_GETREGSET defined, not used (yet?) by vgdb\n"); has_working_ptrace_getregset = 0; # endif if (has_working_ptrace_getregset) { // Platforms having GETREGSET long res; elf_gregset_t elf_regs; struct iovec iovec; DEBUG(1, "getregs PTRACE_GETREGSET sizeof(elf_regs) %zu\n", sizeof(elf_regs)); iovec.iov_base = regs; iovec.iov_len = sizeof(elf_regs); res = ptrace (PTRACE_GETREGSET, pid, NT_PRSTATUS, &iovec); if (res == 0) { if (has_working_ptrace_getregset == -1) { // First call to PTRACE_GETREGSET successful => has_working_ptrace_getregset = 1; DEBUG(1, "detected a working PTRACE_GETREGSET\n"); } assert (has_working_ptrace_getregset == 1); return True; } else if (has_working_ptrace_getregset == 1) { // We had a working call, but now it fails. // This is unexpected. ERROR(errno, "PTRACE_GETREGSET %ld\n", res); return False; } else { // Check this is the first call: assert (has_working_ptrace_getregset == -1); if (errno == EIO) { DEBUG(1, "detected a broken PTRACE_GETREGSET with EIO\n"); has_working_ptrace_getregset = 0; // Fall over to the PTRACE_GETREGS or PTRACE_PEEKUSER case. } else { ERROR(errno, "broken PTRACE_GETREGSET unexpected errno %ld\n", res); return False; } } } # endif # ifdef HAVE_PTRACE_GETREGS if (has_working_ptrace_getregs) { // Platforms having GETREGS long res; DEBUG(1, "getregs PTRACE_GETREGS\n"); res = ptrace (PTRACE_GETREGS, pid, NULL, regs); if (res == 0) { if (has_working_ptrace_getregs == -1) { // First call to PTRACE_GETREGS successful => has_working_ptrace_getregs = 1; DEBUG(1, "detected a working PTRACE_GETREGS\n"); } assert (has_working_ptrace_getregs == 1); return True; } else if (has_working_ptrace_getregs == 1) { // We had a working call, but now it fails. // This is unexpected. ERROR(errno, "PTRACE_GETREGS %ld\n", res); return False; } else { // Check this is the first call: assert (has_working_ptrace_getregs == -1); if (errno == EIO) { DEBUG(1, "detected a broken PTRACE_GETREGS with EIO\n"); has_working_ptrace_getregs = 0; // Fall over to the PTRACE_PEEKUSER case. } else { ERROR(errno, "broken PTRACE_GETREGS unexpected errno %ld\n", res); return False; } } } # endif // We assume PTRACE_PEEKUSER is defined everywhere. { # ifdef PT_ENDREGS long peek_bsz = PT_ENDREGS; assert (peek_bsz <= regs_bsz); # else long peek_bsz = regs_bsz-1; # endif char *pregs = (char *) regs; long offset; errno = 0; DEBUG(1, "getregs PTRACE_PEEKUSER(s) peek_bsz %ld\n", peek_bsz); for (offset = 0; offset < peek_bsz; offset = offset + sizeof(long)) { *(long *)(pregs+offset) = ptrace(PTRACE_PEEKUSER, pid, offset, NULL); if (errno != 0) { ERROR(errno, "PTRACE_PEEKUSER offset %ld\n", offset); return False; } } return True; } // If neither of PTRACE_GETREGSET PTRACE_GETREGS PTRACE_PEEKUSER have // returned, then we are in serious trouble. assert (0); } /* Set the registers of pid to regs. regs_bsz value gives the length of *regs. Returns True if all ok, otherwise False. */ static Bool setregs (pid_t pid, void *regs, long regs_bsz) { DEBUG(1, "setregs regs_bsz %ld\n", regs_bsz); // Note : the below is checking for GETREGSET, not SETREGSET // as if one is defined and working, the other one should also work. # ifdef HAVE_PTRACE_GETREGSET if (has_working_ptrace_getregset) { // Platforms having SETREGSET long res; elf_gregset_t elf_regs; struct iovec iovec; // setregset can never be called before getregset has done a runtime check. assert (has_working_ptrace_getregset == 1); DEBUG(1, "setregs PTRACE_SETREGSET sizeof(elf_regs) %zu\n", sizeof(elf_regs)); iovec.iov_base = regs; iovec.iov_len = sizeof(elf_regs); res = ptrace (PTRACE_SETREGSET, pid, NT_PRSTATUS, &iovec); if (res != 0) { ERROR(errno, "PTRACE_SETREGSET %ld\n", res); return False; } return True; } # endif // Note : the below is checking for GETREGS, not SETREGS // as if one is defined and working, the other one should also work. # ifdef HAVE_PTRACE_GETREGS if (has_working_ptrace_getregs) { // Platforms having SETREGS long res; // setregs can never be called before getregs has done a runtime check. assert (has_working_ptrace_getregs == 1); DEBUG(1, "setregs PTRACE_SETREGS\n"); res = ptrace (PTRACE_SETREGS, pid, NULL, regs); if (res != 0) { ERROR(errno, "PTRACE_SETREGS %ld\n", res); return False; } return True; } # endif { char *pregs = (char *) regs; long offset; long res; # ifdef PT_ENDREGS long peek_bsz = PT_ENDREGS; assert (peek_bsz <= regs_bsz); # else long peek_bsz = regs_bsz-1; # endif errno = 0; DEBUG(1, "setregs PTRACE_POKEUSER(s) %ld\n", peek_bsz); for (offset = 0; offset < peek_bsz; offset = offset + sizeof(long)) { res = ptrace(PTRACE_POKEUSER, pid, offset, *(long*)(pregs+offset)); if (errno != 0) { ERROR(errno, "PTRACE_POKEUSER offset %ld res %ld\n", offset, res); return False; } } return True; } // If neither PTRACE_SETREGS not PTRACE_POKEUSER have returned, // then we are in serious trouble. assert (0); } /* Restore the registers to the saved value, then detaches from all threads */ static void restore_and_detach (pid_t pid) { int res; DEBUG(1, "restore_and_detach pid %d pid_of_save_regs %d\n", pid, pid_of_save_regs); if (pid_of_save_regs) { /* In case the 'main pid' has been continued, we need to stop it before resetting the registers. */ if (pid_of_save_regs_continued) { pid_of_save_regs_continued = False; if (!stop(pid_of_save_regs, "sigstop before reset regs")) DEBUG(0, "Could not sigstop before reset"); } DEBUG(1, "setregs restore registers pid %d\n", pid_of_save_regs); if (!setregs(pid_of_save_regs, &user_save.regs, sizeof(user_save.regs))) { ERROR(errno, "setregs restore registers pid %d after cont\n", pid_of_save_regs); } /* Now, we transmit all the signals we have queued. */ if (signal_queue_sz > 0) { int i; for (i = 0; i < signal_queue_sz; i++) { DEBUG(1, "PTRACE_CONT to transmit queued signal %d\n", signal_queue[i].si_signo); res = ptrace (PTRACE_CONT, pid_of_save_regs, NULL, signal_queue[i].si_signo); if (res != 0) ERROR(errno, "PTRACE_CONT with signal %d\n", signal_queue[i].si_signo); if (!stop(pid_of_save_regs, "sigstop after transmit sig")) DEBUG(0, "Could not sigstop after transmit sig"); } free (signal_queue); signal_queue = NULL; signal_queue_sz = 0; } pid_of_save_regs = 0; } else { DEBUG(1, "PTRACE_SETREGS restore registers: no pid\n"); } if (signal_queue) ERROR (0, "One or more signals queued were not delivered. " "First signal: %d\n", signal_queue[0].si_signo); detach_from_all_threads(pid); } Bool invoker_invoke_gdbserver (pid_t pid) { long res; Bool stopped; # if defined(VGA_arm64) /* arm64 is extra special, old glibc defined kernel user_pt_regs, but newer glibc instead define user_regs_struct. */ # ifdef HAVE_SYS_USER_REGS struct user_regs_struct user_mod; # else struct user_pt_regs user_mod; # endif # else struct user user_mod; # endif Addr sp __attribute__((unused)); // Not used on all platforms. /* A specific int value is passed to invoke_gdbserver, to check everything goes according to the plan. */ const int check = 0x8BADF00D; // ate bad food. const Addr bad_return = 0; // A bad return address will be pushed on the stack. // The function invoke_gdbserver cannot return. If ever it returns, a NULL // address pushed on the stack should ensure this is detected. /* Not yet attached. If problem, vgdb can abort, no cleanup needed. */ DEBUG(1, "attach to 'main' pid %d\n", pid); if (!attach(pid, "attach main pid")) { ERROR(0, "error attach main pid %d\n", pid); return False; } /* Now, we are attached. If problem, detach and return. */ if (!acquire_and_suspend_threads(pid)) { detach_from_all_threads(pid); /* if the pid does not exist anymore, we better stop */ if (kill(pid, 0) != 0) XERROR (errno, "invoke_gdbserver: check for pid %d existence failed\n", pid); return False; } if (!getregs(pid, &user_mod.regs, sizeof(user_mod.regs))) { detach_from_all_threads(pid); return False; } user_save = user_mod; #if defined(VGA_x86) sp = user_mod.regs.esp; #elif defined(VGA_amd64) sp = user_mod.regs.rsp; if (shared32 != NULL) { /* 64bit vgdb speaking with a 32bit executable. To have system call restart properly, we need to sign extend rax. For more info: web search '[patch] Fix syscall restarts for amd64->i386 biarch' e.g. http://sourceware.org/ml/gdb-patches/2009-11/msg00592.html */ *(long *)&user_save.regs.rax = *(int*)&user_save.regs.rax; DEBUG(1, "Sign extending %8.8lx to %8.8lx\n", user_mod.regs.rax, user_save.regs.rax); } #elif defined(VGA_arm) sp = user_mod.regs.uregs[13]; #elif defined(VGA_arm64) sp = user_mod.sp; #elif defined(VGA_ppc32) sp = user_mod.regs.gpr[1]; #elif defined(VGA_ppc64be) || defined(VGA_ppc64le) sp = user_mod.regs.gpr[1]; #elif defined(VGA_s390x) sp = user_mod.regs.gprs[15]; #elif defined(VGA_mips32) long long *p = (long long *)user_mod.regs; sp = p[29]; #elif defined(VGA_mips64) sp = user_mod.regs[29]; #else I_die_here : (sp) architecture missing in vgdb-invoker-ptrace.c #endif // the magic below is derived from spying what gdb sends to // the (classical) gdbserver when invoking a C function. if (shared32 != NULL) { // vgdb speaking with a 32bit executable. #if defined(VGA_x86) || defined(VGA_amd64) const int regsize = 4; int rw; /* push check arg on the stack */ sp = sp - regsize; DEBUG(1, "push check arg ptrace_write_memory\n"); assert(regsize == sizeof(check)); rw = ptrace_write_memory(pid, sp, &check, regsize); if (rw != 0) { ERROR(rw, "push check arg ptrace_write_memory"); detach_from_all_threads(pid); return False; } sp = sp - regsize; DEBUG(1, "push bad_return return address ptrace_write_memory\n"); // Note that for a 64 bits vgdb, only 4 bytes of NULL bad_return // are written. rw = ptrace_write_memory(pid, sp, &bad_return, regsize); if (rw != 0) { ERROR(rw, "push bad_return return address ptrace_write_memory"); detach_from_all_threads(pid); return False; } #if defined(VGA_x86) /* set ebp, esp, eip and orig_eax to invoke gdbserver */ // compiled in 32bits, speaking with a 32bits exe user_mod.regs.ebp = sp; // bp set to sp user_mod.regs.esp = sp; user_mod.regs.eip = shared32->invoke_gdbserver; user_mod.regs.orig_eax = -1L; #elif defined(VGA_amd64) /* set ebp, esp, eip and orig_eax to invoke gdbserver */ // compiled in 64bits, speaking with a 32bits exe user_mod.regs.rbp = sp; // bp set to sp user_mod.regs.rsp = sp; user_mod.regs.rip = shared32->invoke_gdbserver; user_mod.regs.orig_rax = -1L; #else I_die_here : not x86 or amd64 in x86/amd64 section/ #endif #elif defined(VGA_ppc32) || defined(VGA_ppc64be) || defined(VGA_ppc64le) user_mod.regs.nip = shared32->invoke_gdbserver; user_mod.regs.trap = -1L; /* put check arg in register 3 */ user_mod.regs.gpr[3] = check; /* put NULL return address in Link Register */ user_mod.regs.link = bad_return; #elif defined(VGA_arm) /* put check arg in register 0 */ user_mod.regs.uregs[0] = check; /* put NULL return address in Link Register */ user_mod.regs.uregs[14] = bad_return; user_mod.regs.uregs[15] = shared32->invoke_gdbserver; #elif defined(VGA_arm64) XERROR(0, "TBD arm64: vgdb a 32 bits executable with a 64 bits exe"); #elif defined(VGA_s390x) XERROR(0, "(fn32) s390x has no 32bits implementation"); #elif defined(VGA_mips32) /* put check arg in register 4 */ p[4] = check; /* put NULL return address in ra */ p[31] = bad_return; p[34] = shared32->invoke_gdbserver; p[25] = shared32->invoke_gdbserver; /* make stack space for args */ p[29] = sp - 32; #elif defined(VGA_mips64) assert(0); // cannot vgdb a 32 bits executable with a 64 bits exe #else I_die_here : architecture missing in vgdb-invoker-ptrace.c #endif } else if (shared64 != NULL) { #if defined(VGA_x86) assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe #elif defined(VGA_amd64) // vgdb speaking with a 64 bit executable. const int regsize = 8; int rw; /* give check arg in rdi */ user_mod.regs.rdi = check; /* push return address on stack : return to breakaddr */ sp = sp - regsize; DEBUG(1, "push bad_return return address ptrace_write_memory\n"); rw = ptrace_write_memory(pid, sp, &bad_return, sizeof(bad_return)); if (rw != 0) { ERROR(rw, "push bad_return return address ptrace_write_memory"); detach_from_all_threads(pid); return False; } /* set rbp, rsp, rip and orig_rax to invoke gdbserver */ user_mod.regs.rbp = sp; // bp set to sp user_mod.regs.rsp = sp; user_mod.regs.rip = shared64->invoke_gdbserver; user_mod.regs.orig_rax = -1L; #elif defined(VGA_arm) assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe #elif defined(VGA_arm64) user_mod.regs[0] = check; user_mod.sp = sp; user_mod.pc = shared64->invoke_gdbserver; /* put NULL return address in Link Register */ user_mod.regs[30] = bad_return; #elif defined(VGA_ppc32) assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe #elif defined(VGA_ppc64be) Addr func_addr; Addr toc_addr; int rw; rw = ptrace_read_memory(pid, shared64->invoke_gdbserver, &func_addr, sizeof(Addr)); if (rw != 0) { ERROR(rw, "ppc64 read func_addr\n"); detach_from_all_threads(pid); return False; } rw = ptrace_read_memory(pid, shared64->invoke_gdbserver+8, &toc_addr, sizeof(Addr)); if (rw != 0) { ERROR(rw, "ppc64 read toc_addr\n"); detach_from_all_threads(pid); return False; } // We are not pushing anything on the stack, so it is not // very clear why the sp has to be decreased, but it seems // needed. The ppc64 ABI might give some lights on this ? user_mod.regs.gpr[1] = sp - 220; user_mod.regs.gpr[2] = toc_addr; user_mod.regs.nip = func_addr; user_mod.regs.trap = -1L; /* put check arg in register 3 */ user_mod.regs.gpr[3] = check; /* put bad_return return address in Link Register */ user_mod.regs.link = bad_return; #elif defined(VGA_ppc64le) /* LE does not use the function pointer structure used in BE */ user_mod.regs.nip = shared64->invoke_gdbserver; user_mod.regs.gpr[1] = sp - 512; user_mod.regs.gpr[12] = user_mod.regs.nip; user_mod.regs.trap = -1L; /* put check arg in register 3 */ user_mod.regs.gpr[3] = check; /* put bad_return return address in Link Register */ user_mod.regs.link = bad_return; #elif defined(VGA_s390x) /* put check arg in register r2 */ user_mod.regs.gprs[2] = check; /* bad_return Return address is in r14 */ user_mod.regs.gprs[14] = bad_return; /* minimum stack frame */ sp = sp - 160; user_mod.regs.gprs[15] = sp; /* set program counter */ user_mod.regs.psw.addr = shared64->invoke_gdbserver; #elif defined(VGA_mips32) assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe #elif defined(VGA_mips64) /* put check arg in register 4 */ user_mod.regs[4] = check; /* put NULL return address in ra */ user_mod.regs[31] = bad_return; user_mod.regs[34] = shared64->invoke_gdbserver; user_mod.regs[25] = shared64->invoke_gdbserver; #else I_die_here: architecture missing in vgdb-invoker-ptrace.c #endif } else { assert(0); } if (!setregs(pid, &user_mod.regs, sizeof(user_mod.regs))) { detach_from_all_threads(pid); return False; } /* Now that we have modified the registers, we set pid_of_save_regs to indicate that restore_and_detach must restore the registers in case of cleanup. */ pid_of_save_regs = pid; pid_of_save_regs_continued = False; /* We PTRACE_CONT-inue pid. Either gdbserver will be invoked directly (if all threads are interruptible) or gdbserver will be called soon by the scheduler. In the first case, pid will stop on the break inserted above when gdbserver returns. In the 2nd case, the break will be encountered directly. */ DEBUG(1, "PTRACE_CONT to invoke\n"); res = ptrace (PTRACE_CONT, pid, NULL, NULL); if (res != 0) { ERROR(errno, "PTRACE_CONT\n"); restore_and_detach(pid); return False; } pid_of_save_regs_continued = True; /* Wait for SIGSTOP generated by m_gdbserver.c give_control_back_to_vgdb */ stopped = waitstopped (pid, SIGSTOP, "waitpid status after PTRACE_CONT to invoke"); if (stopped) { /* Here pid has properly stopped on the break. */ pid_of_save_regs_continued = False; restore_and_detach(pid); return True; } else { /* Whatever kind of problem happened. We shutdown. */ shutting_down = True; return False; } } void invoker_cleanup_restore_and_detach(void *v_pid) { DEBUG(1, "invoker_cleanup_restore_and_detach dying: %d\n", dying); if (!dying) restore_and_detach(*(int*)v_pid); } void invoker_restrictions_msg(void) { } void invoker_valgrind_dying(void) { /* Avoid messing up with registers of valgrind when it is dying. */ pid_of_save_regs_continued = False; dying = True; }