1 /*--------------------------------------------------------------------*/
2 /*--- Implementation of vgdb invoker subsystem via ptrace() calls. ---*/
3 /*--------------------------------------------------------------------*/
4 
5 /*
6    This file is part of Valgrind, a dynamic binary instrumentation
7    framework.
8 
9    Copyright (C) 2011-2015 Philippe Waroquiers
10 
11    This program is free software; you can redistribute it and/or
12    modify it under the terms of the GNU General Public License as
13    published by the Free Software Foundation; either version 2 of the
14    License, or (at your option) any later version.
15 
16    This program is distributed in the hope that it will be useful, but
17    WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
19    General Public License for more details.
20 
21    You should have received a copy of the GNU General Public License
22    along with this program; if not, write to the Free Software
23    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
24    02111-1307, USA.
25 
26    The GNU General Public License is contained in the file COPYING.
27 */
28 
29 #include "config.h"
30 
31 #include "vgdb.h"
32 #include "pub_core_threadstate.h"
33 
34 #include <alloca.h>
35 #include <assert.h>
36 #include <errno.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <sys/ptrace.h>
41 #include <sys/time.h>
42 #include <sys/user.h>
43 #include <sys/wait.h>
44 
45 #ifdef PTRACE_GETREGSET
46 // TBD: better have a configure test instead ?
47 #define HAVE_PTRACE_GETREGSET
48 
49 // A bi-arch build using PTRACE_GET/SETREGSET needs
50 // some conversion code for register structures.
51 // So, better do not use PTRACE_GET/SETREGSET
52 // Rather we use PTRACE_GETREGS or PTRACE_PEEKUSER.
53 
54 // The only platform on which we must use PTRACE_GETREGSET is arm64.
55 // The resulting vgdb cannot work in a bi-arch setup.
56 // -1 means we will check that PTRACE_GETREGSET works.
57 #  if defined(VGA_arm64)
58 #define USE_PTRACE_GETREGSET
59 #  endif
60 #endif
61 
62 #include <sys/uio.h>
63 #include <elf.h>
64 
65 #include <sys/procfs.h>
66 
67 // glibc versions prior to 2.5 do not define PTRACE_GETSIGINFO on
68 // the platforms we support.
69 #if !((__GLIBC__ > 2) || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 5))
70 #   ifndef PTRACE_GETSIGINFO
71 #   define PTRACE_GETSIGINFO 0x4202
72 #   endif
73 #endif
74 
75 // 32-bit or 64-bit wide, depending on primary architecture.
76 typedef Addr  CORE_ADDR;
77 typedef Addr  PTRACE_XFER_TYPE;
78 typedef void* PTRACE_ARG3_TYPE;
79 
80 // if > 0, pid for which registers have to be restored.
81 // if == 0, means we have not yet called setregs (or have already
82 // restored the registers).
83 static int pid_of_save_regs = 0;
84 /* True if we have continued pid_of_save_regs after PTRACE_ATTACH. */
85 static Bool pid_of_save_regs_continued = False;
86 // When setregs has been called to change the registers of pid_of_save_regs,
87 // vgdb cannot transmit the signals intercepted during ptrace.
88 // So, we queue them, and will deliver them when detaching.
89 // See function waitstopped for more info.
90 static int signal_queue_sz = 0;
91 static siginfo_t *signal_queue;
92 
93 /* True when loss of connection indicating that the Valgrind
94    process is dying. */
95 static Bool dying = False;
96 
97 /* ptrace_(read|write)_memory are modified extracts of linux-low.c
98    from gdb 6.6. Copyrighted FSF */
99 /* Copy LEN bytes from valgrind memory starting at MEMADDR
100    to vgdb memory starting at MYADDR.  */
101 static
ptrace_read_memory(pid_t inferior_pid,CORE_ADDR memaddr,void * myaddr,size_t len)102 int ptrace_read_memory (pid_t inferior_pid, CORE_ADDR memaddr,
103                         void *myaddr, size_t len)
104 {
105    register int i;
106    /* Round starting address down to longword boundary.  */
107    register CORE_ADDR addr = memaddr & -(CORE_ADDR) sizeof (PTRACE_XFER_TYPE);
108    /* Round ending address up; get number of longwords that makes.  */
109    register int count
110       = (((memaddr + len) - addr) + sizeof (PTRACE_XFER_TYPE) - 1)
111       / sizeof (PTRACE_XFER_TYPE);
112    /* Allocate buffer of that many longwords.  */
113    register PTRACE_XFER_TYPE *buffer
114       = (PTRACE_XFER_TYPE *) alloca (count * sizeof (PTRACE_XFER_TYPE));
115 
116    /* Read all the longwords */
117    for (i = 0; i < count; i++, addr += sizeof (PTRACE_XFER_TYPE)) {
118       errno = 0;
119       buffer[i] = ptrace (PTRACE_PEEKTEXT, inferior_pid,
120                           (PTRACE_ARG3_TYPE) addr, 0);
121       if (errno)
122          return errno;
123    }
124 
125    /* Copy appropriate bytes out of the buffer.  */
126    memcpy (myaddr,
127            (char *) buffer + (memaddr & (sizeof (PTRACE_XFER_TYPE) - 1)), len);
128 
129    return 0;
130 }
131 
132 /* Copy LEN bytes of data from vgdb memory at MYADDR
133    to valgrind memory at MEMADDR.
134    On failure (cannot write the valgrind memory)
135    returns the value of errno.  */
136 __attribute__((unused)) /* not used on all platforms */
137 static
ptrace_write_memory(pid_t inferior_pid,CORE_ADDR memaddr,const void * myaddr,size_t len)138 int ptrace_write_memory (pid_t inferior_pid, CORE_ADDR memaddr,
139                          const void *myaddr, size_t len)
140 {
141    register int i;
142    /* Round starting address down to longword boundary.  */
143    register CORE_ADDR addr = memaddr & -(CORE_ADDR) sizeof (PTRACE_XFER_TYPE);
144    /* Round ending address up; get number of longwords that makes.  */
145    register int count
146       = (((memaddr + len) - addr) + sizeof (PTRACE_XFER_TYPE) - 1)
147       / sizeof (PTRACE_XFER_TYPE);
148    /* Allocate buffer of that many longwords.  */
149    register PTRACE_XFER_TYPE *buffer
150       = (PTRACE_XFER_TYPE *) alloca (count * sizeof (PTRACE_XFER_TYPE));
151 
152    if (debuglevel >= 1) {
153       DEBUG (1, "Writing ");
154       for (i = 0; i < len; i++)
155          PDEBUG (1, "%02x", ((const unsigned char*)myaddr)[i]);
156       PDEBUG(1, " to %p\n", (void *) memaddr);
157    }
158 
159    /* Fill start and end extra bytes of buffer with existing memory data.  */
160 
161    buffer[0] = ptrace (PTRACE_PEEKTEXT, inferior_pid,
162                        (PTRACE_ARG3_TYPE) addr, 0);
163 
164    if (count > 1) {
165       buffer[count - 1]
166          = ptrace (PTRACE_PEEKTEXT, inferior_pid,
167                    (PTRACE_ARG3_TYPE) (addr + (count - 1)
168                                        * sizeof (PTRACE_XFER_TYPE)),
169                    0);
170    }
171 
172    /* Copy data to be written over corresponding part of buffer */
173 
174    memcpy ((char *) buffer + (memaddr & (sizeof (PTRACE_XFER_TYPE) - 1)),
175            myaddr, len);
176 
177    /* Write the entire buffer.  */
178 
179    for (i = 0; i < count; i++, addr += sizeof (PTRACE_XFER_TYPE)) {
180       errno = 0;
181       ptrace (PTRACE_POKETEXT, inferior_pid,
182               (PTRACE_ARG3_TYPE) addr, buffer[i]);
183       if (errno)
184          return errno;
185    }
186 
187    return 0;
188 }
189 
190 /* subset of VG_(threads) needed for vgdb ptrace.
191    This is initialized when process is attached. */
192 typedef struct {
193    ThreadStatus status;
194    Int lwpid;
195 }
196 VgdbThreadState;
197 static VgdbThreadState *vgdb_threads;
198 static int vg_n_threads;
199 
200 static const
name_of_ThreadStatus(ThreadStatus status)201 HChar* name_of_ThreadStatus ( ThreadStatus status )
202 {
203    switch (status) {
204    case VgTs_Empty:     return "VgTs_Empty";
205    case VgTs_Init:      return "VgTs_Init";
206    case VgTs_Runnable:  return "VgTs_Runnable";
207    case VgTs_WaitSys:   return "VgTs_WaitSys";
208    case VgTs_Yielding:  return "VgTs_Yielding";
209    case VgTs_Zombie:    return "VgTs_Zombie";
210    default:             return "VgTs_???";
211   }
212 }
213 
214 static
status_image(int status)215 char *status_image (int status)
216 {
217    static char result[256];  // large enough
218    int sz = 0;
219 #define APPEND(...) sz += snprintf (result+sz, 256 - sz - 1, __VA_ARGS__)
220 
221    result[0] = 0;
222 
223    if (WIFEXITED(status))
224       APPEND ("WIFEXITED %d ", WEXITSTATUS(status));
225 
226    if (WIFSIGNALED(status)) {
227       APPEND ("WIFSIGNALED %d ", WTERMSIG(status));
228       if (WCOREDUMP(status)) APPEND ("WCOREDUMP ");
229    }
230 
231    if (WIFSTOPPED(status))
232       APPEND ("WIFSTOPPED %d ", WSTOPSIG(status));
233 
234 #ifdef WIFCONTINUED
235    if (WIFCONTINUED(status))
236       APPEND ("WIFCONTINUED ");
237 #endif
238 
239    return result;
240 #undef APPEND
241 }
242 
243 /* Wait till the process pid is reported as stopped with signal_expected.
244    If other signal(s) than signal_expected are received, waitstopped
245    will pass them to pid, waiting for signal_expected to stop pid.
246    Returns True when process is in stopped state with signal_expected.
247    Returns False if a problem was encountered while waiting for pid
248    to be stopped.
249 
250    If pid is reported as being dead/exited, waitstopped will return False.
251 */
252 static
waitstopped(pid_t pid,int signal_expected,const char * msg)253 Bool waitstopped (pid_t pid, int signal_expected, const char *msg)
254 {
255    pid_t p;
256    int status = 0;
257    int signal_received;
258    int res;
259 
260    while (1) {
261       DEBUG(1, "waitstopped %s before waitpid signal_expected %d\n",
262             msg, signal_expected);
263       p = waitpid(pid, &status, __WALL);
264       DEBUG(1, "after waitpid pid %d p %d status 0x%x %s\n", pid, p,
265             status, status_image (status));
266       if (p != pid) {
267          ERROR(errno, "%s waitpid pid %d in waitstopped %d status 0x%x %s\n",
268                msg, pid, p, status, status_image (status));
269          return False;
270       }
271 
272       if (WIFEXITED(status)) {
273          shutting_down = True;
274          return False;
275       }
276 
277       assert (WIFSTOPPED(status));
278       signal_received = WSTOPSIG(status);
279       if (signal_received == signal_expected)
280          break;
281 
282       /* pid received a signal which is not the signal we are waiting for.
283          If we have not (yet) changed the registers of the inferior
284          or we have (already) reset them, we can transmit the signal.
285 
286          If we have already set the registers of the inferior, we cannot
287          transmit the signal, as this signal would arrive when the
288          gdbserver code runs. And valgrind only expects signals to
289          arrive in a small code portion around
290          client syscall logic, where signal are unmasked (see e.g.
291          m_syswrap/syscall-x86-linux.S ML_(do_syscall_for_client_WRK).
292 
293          As ptrace is forcing a call to gdbserver by jumping
294          'out of this region', signals are not masked, but
295          will arrive outside of the allowed/expected code region.
296          So, if we have changed the registers of the inferior, we
297          rather queue the signal to transmit them when detaching,
298          after having restored the registers to the initial values. */
299       if (pid_of_save_regs) {
300          siginfo_t *newsiginfo;
301 
302          // realloc a bigger queue, and store new signal at the end.
303          // This is not very efficient but we assume not many sigs are queued.
304          signal_queue_sz++;
305          signal_queue = vrealloc(signal_queue,
306                                  sizeof(siginfo_t) * signal_queue_sz);
307          newsiginfo = signal_queue + (signal_queue_sz - 1);
308 
309          res = ptrace (PTRACE_GETSIGINFO, pid, NULL, newsiginfo);
310          if (res != 0) {
311             ERROR(errno, "PTRACE_GETSIGINFO failed: signal lost !!!!\n");
312             signal_queue_sz--;
313          } else
314             DEBUG(1, "waitstopped PTRACE_CONT, queuing signal %d"
315                   " si_signo %d si_pid %d\n",
316                   signal_received, newsiginfo->si_signo, newsiginfo->si_pid);
317          res = ptrace (PTRACE_CONT, pid, NULL, 0);
318       } else {
319          DEBUG(1, "waitstopped PTRACE_CONT with signal %d\n", signal_received);
320          res = ptrace (PTRACE_CONT, pid, NULL, signal_received);
321       }
322       if (res != 0) {
323          ERROR(errno, "waitstopped PTRACE_CONT\n");
324          return False;
325       }
326    }
327 
328    return True;
329 }
330 
331 /* Stops the given pid, wait for the process to be stopped.
332    Returns True if successful, False otherwise.
333    msg is used in tracing and error reporting. */
334 static
stop(pid_t pid,const char * msg)335 Bool stop (pid_t pid, const char *msg)
336 {
337    long res;
338 
339    DEBUG(1, "%s SIGSTOP pid %d\n", msg, pid);
340    res = kill (pid, SIGSTOP);
341    if (res != 0) {
342       ERROR(errno, "%s SIGSTOP pid %d %ld\n", msg, pid, res);
343       return False;
344    }
345 
346    return waitstopped (pid, SIGSTOP, msg);
347 
348 }
349 
350 /* Attaches to given pid, wait for the process to be stopped.
351    Returns True if successful, False otherwise.
352    msg is used in tracing and error reporting. */
353 static
attach(pid_t pid,const char * msg)354 Bool attach (pid_t pid, const char *msg)
355 {
356    long res;
357    static Bool output_error = True;
358    static Bool initial_attach = True;
359    // For a ptrace_scope protected system, we do not want to output
360    // repetitively attach error. We will output once an error
361    // for the initial_attach. Once the 1st attach has succeeded, we
362    // again show all errors.
363 
364    DEBUG(1, "%s PTRACE_ATTACH pid %d\n", msg, pid);
365    res = ptrace (PTRACE_ATTACH, pid, NULL, NULL);
366    if (res != 0) {
367       if (output_error || debuglevel > 0) {
368          ERROR(errno, "%s PTRACE_ATTACH pid %d %ld\n", msg, pid, res);
369          if (initial_attach)
370             output_error = False;
371       }
372       return False;
373    }
374 
375    initial_attach = False;
376    output_error = True;
377    return waitstopped(pid, SIGSTOP, msg);
378 }
379 
380 /* once we are attached to the pid, get the list of threads and stop
381    them all.
382    Returns True if all threads properly suspended, False otherwise. */
383 static
acquire_and_suspend_threads(pid_t pid)384 Bool acquire_and_suspend_threads (pid_t pid)
385 {
386    int i;
387    int rw;
388    Bool pid_found = False;
389    Addr vgt;
390    int sz_tst;
391    int off_status;
392    int off_lwpid;
393    int nr_live_threads = 0;
394 
395    if (shared32 != NULL) {
396       vgt = shared32->threads;
397       vg_n_threads = shared32->vg_n_threads;
398       sz_tst = shared32->sizeof_ThreadState;
399       off_status = shared32->offset_status;
400       off_lwpid = shared32->offset_lwpid;
401    }
402    else if (shared64 != NULL) {
403       vgt = shared64->threads;
404       vg_n_threads = shared64->vg_n_threads;
405       sz_tst = shared64->sizeof_ThreadState;
406       off_status = shared64->offset_status;
407       off_lwpid = shared64->offset_lwpid;
408    } else {
409       assert (0);
410    }
411 
412    vgdb_threads = vmalloc(vg_n_threads * sizeof vgdb_threads[0]);
413 
414    /* note: the entry 0 is unused */
415    DEBUG(1, "examining thread entries from tid 1 to tid %d\n", vg_n_threads-1);
416    for (i = 1; i < vg_n_threads; i++) {
417       vgt += sz_tst;
418       rw = ptrace_read_memory(pid, vgt+off_status,
419                               &(vgdb_threads[i].status),
420                               sizeof(ThreadStatus));
421       if (rw != 0) {
422          ERROR(rw, "status ptrace_read_memory\n");
423          return False;
424       }
425 
426       rw = ptrace_read_memory(pid, vgt+off_lwpid,
427                               &(vgdb_threads[i].lwpid),
428                               sizeof(Int));
429       if (rw != 0) {
430          ERROR(rw, "lwpid ptrace_read_memory\n");
431          return False;
432       }
433 
434       if (vgdb_threads[i].status != VgTs_Empty) {
435          DEBUG(1, "found tid %d status %s lwpid %d\n",
436                i, name_of_ThreadStatus(vgdb_threads[i].status),
437                vgdb_threads[i].lwpid);
438          nr_live_threads++;
439          if (vgdb_threads[i].lwpid <= 1) {
440             if (vgdb_threads[i].lwpid == 0
441                 && vgdb_threads[i].status == VgTs_Init) {
442                DEBUG(1, "not set lwpid tid %d status %s lwpid %d\n",
443                      i, name_of_ThreadStatus(vgdb_threads[i].status),
444                      vgdb_threads[i].lwpid);
445             } else {
446                ERROR(1, "unexpected lwpid tid %d status %s lwpid %d\n",
447                      i, name_of_ThreadStatus(vgdb_threads[i].status),
448                      vgdb_threads[i].lwpid);
449             }
450             /* in case we have a VtTs_Init thread with lwpid not yet set,
451                we try again later. */
452             return False;
453          }
454          if (vgdb_threads[i].lwpid == pid) {
455             assert (!pid_found);
456             assert (i == 1);
457             pid_found = True;
458          } else {
459             if (!attach(vgdb_threads[i].lwpid, "attach_thread")) {
460                  ERROR(0, "ERROR attach pid %d tid %d\n",
461                        vgdb_threads[i].lwpid, i);
462                return False;
463             }
464          }
465       }
466    }
467    /* If we found no thread, it means the process is stopping, and
468       we better do not force anything to happen during that. */
469    if (nr_live_threads > 0)
470       return True;
471    else
472       return False;
473 }
474 
475 static
detach_from_all_threads(pid_t pid)476 void detach_from_all_threads (pid_t pid)
477 {
478    int i;
479    long res;
480    Bool pid_found = False;
481 
482    /* detach from all the threads  */
483    for (i = 1; i < vg_n_threads; i++) {
484       if (vgdb_threads[i].status != VgTs_Empty) {
485          if (vgdb_threads[i].status == VgTs_Init
486              && vgdb_threads[i].lwpid == 0) {
487             DEBUG(1, "skipping PTRACE_DETACH pid %d tid %d status %s\n",
488                   vgdb_threads[i].lwpid, i,
489                   name_of_ThreadStatus (vgdb_threads[i].status));
490          } else {
491             if (vgdb_threads[i].lwpid == pid) {
492                assert (!pid_found);
493                pid_found = True;
494             }
495             DEBUG(1, "PTRACE_DETACH pid %d tid %d status %s\n",
496                   vgdb_threads[i].lwpid, i,
497                   name_of_ThreadStatus (vgdb_threads[i].status));
498             res = ptrace (PTRACE_DETACH, vgdb_threads[i].lwpid, NULL, NULL);
499             if (res != 0) {
500                ERROR(errno, "PTRACE_DETACH pid %d tid %d status %s res %ld\n",
501                      vgdb_threads[i].lwpid, i,
502                      name_of_ThreadStatus (vgdb_threads[i].status),
503                      res);
504             }
505          }
506       }
507    }
508 
509    free (vgdb_threads);
510 
511    if (!pid_found && pid) {
512       /* No threads are live. Process is busy stopping.
513          We need to detach from pid explicitely. */
514       DEBUG(1, "no thread live => PTRACE_DETACH pid %d\n", pid);
515       res = ptrace (PTRACE_DETACH, pid, NULL, NULL);
516       if (res != 0)
517          ERROR(errno, "PTRACE_DETACH pid %d res %ld\n", pid, res);
518    }
519 }
520 
521 #  if defined(VGA_arm64) || defined(VGA_tilegx)
522 /* arm64 is extra special, old glibc defined kernel user_pt_regs, but
523    newer glibc instead define user_regs_struct. */
524 #    ifdef HAVE_SYS_USER_REGS
525 static struct user_regs_struct user_save;
526 #    else
527 static struct user_pt_regs user_save;
528 #    endif
529 #  else
530 static struct user user_save;
531 #  endif
532 // The below indicates if ptrace_getregs (and ptrace_setregs) can be used.
533 // Note that some linux versions are defining PTRACE_GETREGS but using
534 // it gives back EIO.
535 // has_working_ptrace_getregs can take the following values:
536 //  -1 : PTRACE_GETREGS is defined
537 //       runtime check not yet done.
538 //   0 : PTRACE_GETREGS runtime check has failed.
539 //   1 : PTRACE_GETREGS defined and runtime check ok.
540 #ifdef HAVE_PTRACE_GETREGS
541 static int has_working_ptrace_getregs = -1;
542 #endif
543 // Similar but for PTRACE_GETREGSET
544 #ifdef HAVE_PTRACE_GETREGSET
545 static int has_working_ptrace_getregset = -1;
546 #endif
547 
548 /* Get the registers from pid into regs.
549    regs_bsz value gives the length of *regs.
550    Returns True if all ok, otherwise False. */
551 static
getregs(pid_t pid,void * regs,long regs_bsz)552 Bool getregs (pid_t pid, void *regs, long regs_bsz)
553 {
554    DEBUG(1, "getregs regs_bsz %ld\n", regs_bsz);
555 #  ifdef HAVE_PTRACE_GETREGSET
556 #  ifndef USE_PTRACE_GETREGSET
557    if (has_working_ptrace_getregset)
558       DEBUG(1, "PTRACE_GETREGSET defined, not used (yet?) by vgdb\n");
559    has_working_ptrace_getregset = 0;
560 #  endif
561    if (has_working_ptrace_getregset) {
562       // Platforms having GETREGSET
563       long res;
564       elf_gregset_t elf_regs;
565       struct iovec iovec;
566 
567       DEBUG(1, "getregs PTRACE_GETREGSET sizeof(elf_regs) %zu\n",
568             sizeof(elf_regs));
569       iovec.iov_base = regs;
570       iovec.iov_len =  sizeof(elf_regs);
571 
572       res = ptrace (PTRACE_GETREGSET, pid, NT_PRSTATUS, &iovec);
573       if (res == 0) {
574          if (has_working_ptrace_getregset == -1) {
575             // First call to PTRACE_GETREGSET successful =>
576             has_working_ptrace_getregset = 1;
577             DEBUG(1, "detected a working PTRACE_GETREGSET\n");
578          }
579          assert (has_working_ptrace_getregset == 1);
580          return True;
581       }
582       else if (has_working_ptrace_getregset == 1) {
583          // We had a working call, but now it fails.
584          // This is unexpected.
585          ERROR(errno, "PTRACE_GETREGSET %ld\n", res);
586          return False;
587       } else {
588          // Check this is the first call:
589          assert (has_working_ptrace_getregset == -1);
590          if (errno == EIO) {
591             DEBUG(1, "detected a broken PTRACE_GETREGSET with EIO\n");
592             has_working_ptrace_getregset = 0;
593             // Fall over to the PTRACE_GETREGS or PTRACE_PEEKUSER case.
594          } else {
595             ERROR(errno, "broken PTRACE_GETREGSET unexpected errno %ld\n", res);
596             return False;
597          }
598       }
599    }
600 #  endif
601 
602 #  ifdef HAVE_PTRACE_GETREGS
603    if (has_working_ptrace_getregs) {
604       // Platforms having GETREGS
605       long res;
606       DEBUG(1, "getregs PTRACE_GETREGS\n");
607       res = ptrace (PTRACE_GETREGS, pid, NULL, regs);
608       if (res == 0) {
609          if (has_working_ptrace_getregs == -1) {
610             // First call to PTRACE_GETREGS successful =>
611             has_working_ptrace_getregs = 1;
612             DEBUG(1, "detected a working PTRACE_GETREGS\n");
613          }
614          assert (has_working_ptrace_getregs == 1);
615          return True;
616       }
617       else if (has_working_ptrace_getregs == 1) {
618          // We had a working call, but now it fails.
619          // This is unexpected.
620          ERROR(errno, "PTRACE_GETREGS %ld\n", res);
621          return False;
622       } else {
623          // Check this is the first call:
624          assert (has_working_ptrace_getregs == -1);
625          if (errno == EIO) {
626             DEBUG(1, "detected a broken PTRACE_GETREGS with EIO\n");
627             has_working_ptrace_getregs = 0;
628             // Fall over to the PTRACE_PEEKUSER case.
629          } else {
630             ERROR(errno, "broken PTRACE_GETREGS unexpected errno %ld\n", res);
631             return False;
632          }
633       }
634    }
635 #  endif
636 
637    // We assume  PTRACE_PEEKUSER is defined everywhere.
638    {
639 #     ifdef PT_ENDREGS
640       long peek_bsz = PT_ENDREGS;
641       assert (peek_bsz <= regs_bsz);
642 #     else
643       long peek_bsz = regs_bsz-1;
644 #     endif
645       char *pregs = (char *) regs;
646       long offset;
647       errno = 0;
648       DEBUG(1, "getregs PTRACE_PEEKUSER(s) peek_bsz %ld\n", peek_bsz);
649       for (offset = 0; offset < peek_bsz; offset = offset + sizeof(long)) {
650          *(long *)(pregs+offset) = ptrace(PTRACE_PEEKUSER, pid, offset, NULL);
651          if (errno != 0) {
652             ERROR(errno, "PTRACE_PEEKUSER offset %ld\n", offset);
653             return False;
654          }
655       }
656       return True;
657    }
658 
659    // If neither of PTRACE_GETREGSET PTRACE_GETREGS PTRACE_PEEKUSER have
660    // returned, then we are in serious trouble.
661    assert (0);
662 }
663 
664 /* Set the registers of pid to regs.
665    regs_bsz value gives the length of *regs.
666    Returns True if all ok, otherwise False. */
667 static
setregs(pid_t pid,void * regs,long regs_bsz)668 Bool setregs (pid_t pid, void *regs, long regs_bsz)
669 {
670    DEBUG(1, "setregs regs_bsz %ld\n", regs_bsz);
671 
672 // Note : the below is checking for GETREGSET, not SETREGSET
673 // as if one is defined and working, the other one should also work.
674 #  ifdef HAVE_PTRACE_GETREGSET
675    if (has_working_ptrace_getregset) {
676       // Platforms having SETREGSET
677       long res;
678       elf_gregset_t elf_regs;
679       struct iovec iovec;
680 
681       // setregset can never be called before getregset has done a runtime check.
682       assert (has_working_ptrace_getregset == 1);
683       DEBUG(1, "setregs PTRACE_SETREGSET sizeof(elf_regs) %zu\n",
684             sizeof(elf_regs));
685       iovec.iov_base = regs;
686       iovec.iov_len =  sizeof(elf_regs);
687       res = ptrace (PTRACE_SETREGSET, pid, NT_PRSTATUS, &iovec);
688       if (res != 0) {
689          ERROR(errno, "PTRACE_SETREGSET %ld\n", res);
690          return False;
691       }
692       return True;
693    }
694 #  endif
695 
696 // Note : the below is checking for GETREGS, not SETREGS
697 // as if one is defined and working, the other one should also work.
698 #  ifdef HAVE_PTRACE_GETREGS
699    if (has_working_ptrace_getregs) {
700       // Platforms having SETREGS
701       long res;
702       // setregs can never be called before getregs has done a runtime check.
703       assert (has_working_ptrace_getregs == 1);
704       DEBUG(1, "setregs PTRACE_SETREGS\n");
705       res = ptrace (PTRACE_SETREGS, pid, NULL, regs);
706       if (res != 0) {
707          ERROR(errno, "PTRACE_SETREGS %ld\n", res);
708          return False;
709       }
710       return True;
711    }
712 #  endif
713 
714    {
715       char *pregs = (char *) regs;
716       long offset;
717       long res;
718 #     ifdef PT_ENDREGS
719       long peek_bsz = PT_ENDREGS;
720       assert (peek_bsz <= regs_bsz);
721 #     else
722       long peek_bsz = regs_bsz-1;
723 #     endif
724       errno = 0;
725       DEBUG(1, "setregs PTRACE_POKEUSER(s) %ld\n", peek_bsz);
726       for (offset = 0; offset < peek_bsz; offset = offset + sizeof(long)) {
727          res = ptrace(PTRACE_POKEUSER, pid, offset, *(long*)(pregs+offset));
728          if (errno != 0) {
729             ERROR(errno, "PTRACE_POKEUSER offset %ld res %ld\n", offset, res);
730             return False;
731          }
732       }
733       return True;
734    }
735 
736    // If neither PTRACE_SETREGS not PTRACE_POKEUSER have returned,
737    // then we are in serious trouble.
738    assert (0);
739 }
740 
741 /* Restore the registers to the saved value, then detaches from all threads */
742 static
restore_and_detach(pid_t pid)743 void restore_and_detach (pid_t pid)
744 {
745    int res;
746 
747    DEBUG(1, "restore_and_detach pid %d pid_of_save_regs %d\n",
748          pid, pid_of_save_regs);
749 
750    if (pid_of_save_regs) {
751       /* In case the 'main pid' has been continued, we need to stop it
752          before resetting the registers. */
753       if (pid_of_save_regs_continued) {
754          pid_of_save_regs_continued = False;
755          if (!stop(pid_of_save_regs, "sigstop before reset regs"))
756             DEBUG(0, "Could not sigstop before reset");
757       }
758 
759       DEBUG(1, "setregs restore registers pid %d\n", pid_of_save_regs);
760       if (!setregs(pid_of_save_regs, &user_save.regs, sizeof(user_save.regs))) {
761          ERROR(errno, "setregs restore registers pid %d after cont\n",
762                pid_of_save_regs);
763       }
764 
765       /* Now, we transmit all the signals we have queued. */
766       if (signal_queue_sz > 0) {
767          int i;
768          for (i = 0; i < signal_queue_sz; i++) {
769             DEBUG(1, "PTRACE_CONT to transmit queued signal %d\n",
770                   signal_queue[i].si_signo);
771             res = ptrace (PTRACE_CONT, pid_of_save_regs, NULL,
772                           signal_queue[i].si_signo);
773             if (res != 0)
774                ERROR(errno, "PTRACE_CONT with signal %d\n",
775                      signal_queue[i].si_signo);
776             if (!stop(pid_of_save_regs, "sigstop after transmit sig"))
777                DEBUG(0, "Could not sigstop after transmit sig");
778          }
779          free (signal_queue);
780          signal_queue = NULL;
781          signal_queue_sz = 0;
782       }
783       pid_of_save_regs = 0;
784    } else {
785       DEBUG(1, "PTRACE_SETREGS restore registers: no pid\n");
786    }
787    if (signal_queue)
788       ERROR (0, "One or more signals queued were not delivered. "
789              "First signal: %d\n", signal_queue[0].si_signo);
790    detach_from_all_threads(pid);
791 }
792 
invoker_invoke_gdbserver(pid_t pid)793 Bool invoker_invoke_gdbserver (pid_t pid)
794 {
795    long res;
796    Bool stopped;
797 #  if defined(VGA_arm64) || defined(VGA_tilegx)
798 /* arm64 is extra special, old glibc defined kernel user_pt_regs, but
799    newer glibc instead define user_regs_struct. */
800 #    ifdef HAVE_SYS_USER_REGS
801    struct user_regs_struct user_mod;
802 #    else
803    struct user_pt_regs user_mod;
804 #    endif
805 #  else
806    struct user user_mod;
807 #  endif
808    Addr sp __attribute__((unused)); // Not used on all platforms.
809 
810    /* A specific int value is passed to invoke_gdbserver, to check
811       everything goes according to the plan. */
812    const int check = 0x8BADF00D; // ate bad food.
813 
814    const Addr bad_return = 0;
815    // A bad return address will be pushed on the stack.
816    // The function invoke_gdbserver cannot return. If ever it returns, a NULL
817    // address pushed on the stack should ensure this is detected.
818 
819    /* Not yet attached. If problem, vgdb can abort,
820       no cleanup needed. */
821 
822    DEBUG(1, "attach to 'main' pid %d\n", pid);
823    if (!attach(pid, "attach main pid")) {
824       ERROR(0, "error attach main pid %d\n", pid);
825       return False;
826    }
827 
828    /* Now, we are attached. If problem, detach and return. */
829 
830    if (!acquire_and_suspend_threads(pid)) {
831       detach_from_all_threads(pid);
832       /* if the pid does not exist anymore, we better stop */
833       if (kill(pid, 0) != 0)
834         XERROR (errno, "invoke_gdbserver: check for pid %d existence failed\n",
835                 pid);
836       return False;
837    }
838 
839    if (!getregs(pid, &user_mod.regs, sizeof(user_mod.regs))) {
840       detach_from_all_threads(pid);
841       return False;
842    }
843    user_save = user_mod;
844 
845 #if defined(VGA_x86)
846    sp = user_mod.regs.esp;
847 #elif defined(VGA_amd64)
848    sp = user_mod.regs.rsp;
849    if (shared32 != NULL) {
850      /* 64bit vgdb speaking with a 32bit executable.
851         To have system call restart properly, we need to sign extend rax.
852         For more info:
853         web search '[patch] Fix syscall restarts for amd64->i386 biarch'
854         e.g. http://sourceware.org/ml/gdb-patches/2009-11/msg00592.html */
855      *(long *)&user_save.regs.rax = *(int*)&user_save.regs.rax;
856      DEBUG(1, "Sign extending %8.8lx to %8.8lx\n",
857            user_mod.regs.rax, user_save.regs.rax);
858    }
859 #elif defined(VGA_arm)
860    sp = user_mod.regs.uregs[13];
861 #elif defined(VGA_arm64)
862    sp = user_mod.sp;
863 #elif defined(VGA_ppc32)
864    sp = user_mod.regs.gpr[1];
865 #elif defined(VGA_ppc64be) || defined(VGA_ppc64le)
866    sp = user_mod.regs.gpr[1];
867 #elif defined(VGA_s390x)
868    sp = user_mod.regs.gprs[15];
869 #elif defined(VGA_mips32)
870    long long *p = (long long *)user_mod.regs;
871    sp = p[29];
872 #elif defined(VGA_mips64)
873    sp = user_mod.regs[29];
874 #elif defined(VGA_tilegx)
875    sp = user_mod.sp;
876 #else
877    I_die_here : (sp) architecture missing in vgdb-invoker-ptrace.c
878 #endif
879 
880 
881    // the magic below is derived from spying what gdb sends to
882    // the (classical) gdbserver when invoking a C function.
883    if (shared32 != NULL) {
884       // vgdb speaking with a 32bit executable.
885 #if   defined(VGA_x86) || defined(VGA_amd64)
886       const int regsize = 4;
887       int rw;
888       /* push check arg on the stack */
889       sp = sp - regsize;
890       DEBUG(1, "push check arg ptrace_write_memory\n");
891       assert(regsize == sizeof(check));
892       rw = ptrace_write_memory(pid, sp,
893                                &check,
894                                regsize);
895       if (rw != 0) {
896          ERROR(rw, "push check arg ptrace_write_memory");
897          detach_from_all_threads(pid);
898          return False;
899       }
900 
901       sp = sp - regsize;
902       DEBUG(1, "push bad_return return address ptrace_write_memory\n");
903       // Note that for a 64 bits vgdb, only 4 bytes of NULL bad_return
904       // are written.
905       rw = ptrace_write_memory(pid, sp,
906                                &bad_return,
907                                regsize);
908       if (rw != 0) {
909          ERROR(rw, "push bad_return return address ptrace_write_memory");
910          detach_from_all_threads(pid);
911          return False;
912       }
913 #if   defined(VGA_x86)
914       /* set ebp, esp, eip and orig_eax to invoke gdbserver */
915       // compiled in 32bits, speaking with a 32bits exe
916       user_mod.regs.ebp = sp; // bp set to sp
917       user_mod.regs.esp = sp;
918       user_mod.regs.eip = shared32->invoke_gdbserver;
919       user_mod.regs.orig_eax = -1L;
920 #elif defined(VGA_amd64)
921       /* set ebp, esp, eip and orig_eax to invoke gdbserver */
922       // compiled in 64bits, speaking with a 32bits exe
923       user_mod.regs.rbp = sp; // bp set to sp
924       user_mod.regs.rsp = sp;
925       user_mod.regs.rip = shared32->invoke_gdbserver;
926       user_mod.regs.orig_rax = -1L;
927 #else
928       I_die_here : not x86 or amd64 in x86/amd64 section/
929 #endif
930 
931 #elif defined(VGA_ppc32) || defined(VGA_ppc64be) || defined(VGA_ppc64le)
932       user_mod.regs.nip = shared32->invoke_gdbserver;
933       user_mod.regs.trap = -1L;
934       /* put check arg in register 3 */
935       user_mod.regs.gpr[3] = check;
936       /* put NULL return address in Link Register */
937       user_mod.regs.link = bad_return;
938 
939 #elif defined(VGA_arm)
940       /* put check arg in register 0 */
941       user_mod.regs.uregs[0] = check;
942       /* put NULL return address in Link Register */
943       user_mod.regs.uregs[14] = bad_return;
944       user_mod.regs.uregs[15] = shared32->invoke_gdbserver;
945 
946 #elif defined(VGA_arm64)
947       XERROR(0, "TBD arm64: vgdb a 32 bits executable with a 64 bits exe");
948 
949 #elif defined(VGA_s390x)
950       XERROR(0, "(fn32) s390x has no 32bits implementation");
951 #elif defined(VGA_mips32)
952       /* put check arg in register 4 */
953       p[4] = check;
954       /* put NULL return address in ra */
955       p[31] = bad_return;
956       p[34] = shared32->invoke_gdbserver;
957       p[25] = shared32->invoke_gdbserver;
958       /* make stack space for args */
959       p[29] = sp - 32;
960 
961 #elif defined(VGA_mips64) || defined(VGA_tilegx)
962       assert(0); // cannot vgdb a 32 bits executable with a 64 bits exe
963 #else
964       I_die_here : architecture missing in vgdb-invoker-ptrace.c
965 #endif
966       }
967 
968    else if (shared64 != NULL) {
969 #if defined(VGA_x86)
970       assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe
971 #elif defined(VGA_amd64)
972       // vgdb speaking with a 64 bit executable.
973       const int regsize = 8;
974       int rw;
975 
976       /* give check arg in rdi */
977       user_mod.regs.rdi = check;
978 
979       /* push return address on stack : return to breakaddr */
980       sp = sp - regsize;
981       DEBUG(1, "push bad_return return address ptrace_write_memory\n");
982       rw = ptrace_write_memory(pid, sp,
983                                &bad_return,
984                                sizeof(bad_return));
985       if (rw != 0) {
986          ERROR(rw, "push bad_return return address ptrace_write_memory");
987          detach_from_all_threads(pid);
988          return False;
989       }
990 
991       /* set rbp, rsp, rip and orig_rax to invoke gdbserver */
992       user_mod.regs.rbp = sp; // bp set to sp
993       user_mod.regs.rsp = sp;
994       user_mod.regs.rip = shared64->invoke_gdbserver;
995       user_mod.regs.orig_rax = -1L;
996 
997 #elif defined(VGA_arm)
998       assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe
999 #elif defined(VGA_arm64)
1000       user_mod.regs[0] = check;
1001       user_mod.sp = sp;
1002       user_mod.pc = shared64->invoke_gdbserver;
1003       /* put NULL return address in Link Register */
1004       user_mod.regs[30] = bad_return;
1005 
1006 #elif defined(VGA_ppc32)
1007       assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe
1008 #elif defined(VGA_ppc64be)
1009       Addr func_addr;
1010       Addr toc_addr;
1011       int rw;
1012       rw = ptrace_read_memory(pid, shared64->invoke_gdbserver,
1013                               &func_addr,
1014                               sizeof(Addr));
1015       if (rw != 0) {
1016          ERROR(rw, "ppc64 read func_addr\n");
1017          detach_from_all_threads(pid);
1018          return False;
1019       }
1020       rw = ptrace_read_memory(pid, shared64->invoke_gdbserver+8,
1021                               &toc_addr,
1022                               sizeof(Addr));
1023       if (rw != 0) {
1024          ERROR(rw, "ppc64 read toc_addr\n");
1025          detach_from_all_threads(pid);
1026          return False;
1027       }
1028       // We are not pushing anything on the stack, so it is not
1029       // very clear why the sp has to be decreased, but it seems
1030       // needed. The ppc64 ABI might give some lights on this ?
1031       user_mod.regs.gpr[1] = sp - 220;
1032       user_mod.regs.gpr[2] = toc_addr;
1033       user_mod.regs.nip = func_addr;
1034       user_mod.regs.trap = -1L;
1035       /* put check arg in register 3 */
1036       user_mod.regs.gpr[3] = check;
1037       /* put bad_return return address in Link Register */
1038       user_mod.regs.link = bad_return;
1039 #elif defined(VGA_ppc64le)
1040       /* LE does not use the function pointer structure used in BE */
1041       user_mod.regs.nip = shared64->invoke_gdbserver;
1042       user_mod.regs.gpr[1] = sp - 512;
1043       user_mod.regs.gpr[12] = user_mod.regs.nip;
1044       user_mod.regs.trap = -1L;
1045       /* put check arg in register 3 */
1046       user_mod.regs.gpr[3] = check;
1047       /* put bad_return return address in Link Register */
1048       user_mod.regs.link = bad_return;
1049 #elif defined(VGA_s390x)
1050       /* put check arg in register r2 */
1051       user_mod.regs.gprs[2] = check;
1052       /* bad_return Return address is in r14 */
1053       user_mod.regs.gprs[14] = bad_return;
1054       /* minimum stack frame */
1055       sp = sp - 160;
1056       user_mod.regs.gprs[15] = sp;
1057       /* set program counter */
1058       user_mod.regs.psw.addr = shared64->invoke_gdbserver;
1059 #elif defined(VGA_mips32)
1060       assert(0); // cannot vgdb a 64 bits executable with a 32 bits exe
1061 #elif defined(VGA_mips64)
1062       /* put check arg in register 4 */
1063       user_mod.regs[4] = check;
1064       /* put NULL return address in ra */
1065       user_mod.regs[31] = bad_return;
1066       user_mod.regs[34] = shared64->invoke_gdbserver;
1067       user_mod.regs[25] = shared64->invoke_gdbserver;
1068 #elif defined(VGA_tilegx)
1069       /* put check arg in register r0 */
1070       user_mod.regs[0] = check;
1071       /* put NULL return address in lr */
1072       user_mod.lr = bad_return;
1073       user_mod.pc = shared64->invoke_gdbserver;
1074 #else
1075       I_die_here: architecture missing in vgdb-invoker-ptrace.c
1076 #endif
1077    }
1078    else {
1079       assert(0);
1080    }
1081 
1082    if (!setregs(pid, &user_mod.regs, sizeof(user_mod.regs))) {
1083       detach_from_all_threads(pid);
1084       return False;
1085    }
1086    /* Now that we have modified the registers, we set
1087       pid_of_save_regs to indicate that restore_and_detach
1088       must restore the registers in case of cleanup. */
1089    pid_of_save_regs = pid;
1090    pid_of_save_regs_continued = False;
1091 
1092 
1093    /* We PTRACE_CONT-inue pid.
1094       Either gdbserver will be invoked directly (if all
1095       threads are interruptible) or gdbserver will be
1096       called soon by the scheduler. In the first case,
1097       pid will stop on the break inserted above when
1098       gdbserver returns. In the 2nd case, the break will
1099       be encountered directly. */
1100    DEBUG(1, "PTRACE_CONT to invoke\n");
1101    res = ptrace (PTRACE_CONT, pid, NULL, NULL);
1102    if (res != 0) {
1103       ERROR(errno, "PTRACE_CONT\n");
1104       restore_and_detach(pid);
1105       return False;
1106    }
1107    pid_of_save_regs_continued = True;
1108    /* Wait for SIGSTOP generated by m_gdbserver.c give_control_back_to_vgdb */
1109    stopped = waitstopped (pid, SIGSTOP,
1110                           "waitpid status after PTRACE_CONT to invoke");
1111    if (stopped) {
1112       /* Here pid has properly stopped on the break. */
1113       pid_of_save_regs_continued = False;
1114       restore_and_detach(pid);
1115       return True;
1116    } else {
1117       /* Whatever kind of problem happened. We shutdown. */
1118       shutting_down = True;
1119       return False;
1120    }
1121 }
1122 
invoker_cleanup_restore_and_detach(void * v_pid)1123 void invoker_cleanup_restore_and_detach(void *v_pid)
1124 {
1125    DEBUG(1, "invoker_cleanup_restore_and_detach dying: %d\n", dying);
1126    if (!dying)
1127       restore_and_detach(*(int*)v_pid);
1128 }
1129 
invoker_restrictions_msg(void)1130 void invoker_restrictions_msg(void)
1131 {
1132 }
1133 
invoker_valgrind_dying(void)1134 void invoker_valgrind_dying(void)
1135 {
1136    /* Avoid messing up with registers of valgrind when it is dying. */
1137    pid_of_save_regs_continued = False;
1138    dying = True;
1139 }
1140