void do_exec(int old_pid, int new_pid) { unsigned long regs[FRAME_SIZE]; int err; if((ptrace(PTRACE_ATTACH, new_pid, 0, 0) < 0) || (ptrace(PTRACE_CONT, new_pid, 0, 0) < 0)) tracer_panic("do_exec failed to attach proc - errno = %d", errno); CATCH_EINTR(err = waitpid(new_pid, 0, WUNTRACED)); if (err < 0) tracer_panic("do_exec failed to attach proc in waitpid - errno = %d", errno); if(ptrace_getregs(old_pid, regs) < 0) tracer_panic("do_exec failed to get registers - errno = %d", errno); kill(old_pid, SIGKILL); if(ptrace_setregs(new_pid, regs) < 0) tracer_panic("do_exec failed to start new proc - errno = %d", errno); }
void do_exec(int old_pid, int new_pid) { unsigned long regs[FRAME_SIZE]; int err; if((ptrace(PTRACE_ATTACH, new_pid, 0, 0) < 0) || (ptrace(PTRACE_CONT, new_pid, 0, 0) < 0)) tracer_panic("do_exec failed to attach proc - errno = %d", errno); CATCH_EINTR(err = waitpid(new_pid, 0, WUNTRACED)); if (err < 0) tracer_panic("do_exec failed to attach proc in waitpid - errno = %d", errno); if(ptrace_getregs(old_pid, regs) < 0) tracer_panic("do_exec failed to get registers - errno = %d", errno); os_kill_ptraced_process(old_pid, 0); if (ptrace(PTRACE_OLDSETOPTIONS, new_pid, 0, (void *)PTRACE_O_TRACESYSGOOD) < 0) tracer_panic("do_exec: PTRACE_SETOPTIONS failed, errno = %d", errno); if(ptrace_setregs(new_pid, regs) < 0) tracer_panic("do_exec failed to start new proc - errno = %d", errno); }
static void sleeping_process_signal(int pid, int sig) { switch(sig){ /* These two result from UML being ^Z-ed and bg-ed. PTRACE_CONT is * right because the process must be in the kernel already. */ case SIGCONT: case SIGTSTP: if(ptrace(PTRACE_CONT, pid, 0, sig) < 0) tracer_panic("sleeping_process_signal : Failed to " "continue pid %d, signal = %d, " "errno = %d\n", pid, sig, errno); break; /* This happens when the debugger (e.g. strace) is doing system call * tracing on the kernel. During a context switch, the current task * will be set to the incoming process and the outgoing process will * hop into write and then read. Since it's not the current process * any more, the trace of those will land here. So, we need to just * PTRACE_SYSCALL it. */ case SIGTRAP: if(ptrace(PTRACE_SYSCALL, pid, 0, 0) < 0) tracer_panic("sleeping_process_signal : Failed to " "PTRACE_SYSCALL pid %d, errno = %d\n", pid, errno); break; case SIGSTOP: break; default: tracer_panic("sleeping process %d got unexpected " "signal : %d\n", pid, sig); break; } }
void attach_process(int pid) { if((ptrace(PTRACE_ATTACH, pid, 0, 0) < 0) || (ptrace(PTRACE_CONT, pid, 0, 0) < 0)) tracer_panic("OP_FORK failed to attach pid"); wait_for_stop(pid, SIGSTOP, PTRACE_CONT, NULL); if(ptrace(PTRACE_CONT, pid, 0, 0) < 0) tracer_panic("OP_FORK failed to continue process"); }
void arch_leave_kernel(void *task, int pid) { #ifdef UM_USER_CS if(ptrace(PTRACE_POKEUSER, pid, CS, UM_USER_CS) < 0) tracer_panic("POKEUSER CS failed"); #endif if(ptrace(PTRACE_POKEUSER, pid, DS, __USER_DS) < 0) tracer_panic("POKEUSER DS failed"); if(ptrace(PTRACE_POKEUSER, pid, ES, __USER_DS) < 0) tracer_panic("POKEUSER ES failed"); }
int do_proc_op(void *t, int proc_id) { struct task_struct *task; struct thread_struct *thread; int op, pid; task = t; thread = &task->thread; op = thread->request.op; switch(op){ case OP_NONE: case OP_TRACE_ON: break; case OP_EXEC: pid = thread->request.u.exec.pid; do_exec(thread->mode.tt.extern_pid, pid); thread->mode.tt.extern_pid = pid; cpu_tasks[task_thread_info(task)->cpu].pid = pid; break; case OP_FORK: attach_process(thread->request.u.fork.pid); break; case OP_CB: (*thread->request.u.cb.proc)(thread->request.u.cb.arg); break; case OP_REBOOT: case OP_HALT: break; default: tracer_panic("Bad op in do_proc_op"); break; } thread->request.op = OP_NONE; return(op); }
int tracer(int (*init_proc)(void *), void *sp) { void *task = NULL; unsigned long eip = 0; int status, pid = 0, sig = 0, cont_type, tracing = 0, op = 0; int last_index, proc_id = 0, n, err, old_tracing = 0, strace = 0; capture_signal_stack(); signal(SIGPIPE, SIG_IGN); setup_tracer_winch(); tracing_pid = os_getpid(); printf("tracing thread pid = %d\n", tracing_pid); pid = clone(signal_tramp, sp, CLONE_FILES | SIGCHLD, init_proc); CATCH_EINTR(n = waitpid(pid, &status, WUNTRACED)); if(n < 0){ printf("waitpid on idle thread failed, errno = %d\n", errno); exit(1); } if((ptrace(PTRACE_CONT, pid, 0, 0) < 0)){ printf("Failed to continue idle thread, errno = %d\n", errno); exit(1); } signal(SIGSEGV, (sighandler_t) tracer_segv); signal(SIGUSR1, signal_usr1); if(debug_trace){ printf("Tracing thread pausing to be attached\n"); stop(); } if(debug){ if(gdb_pid != -1) debugger_pid = attach_debugger(pid, gdb_pid, 1); else debugger_pid = init_ptrace_proxy(pid, 1, debug_stop); if(debug_parent){ debugger_parent = os_process_parent(debugger_pid); init_parent_proxy(debugger_parent); err = attach(debugger_parent); if(err){ printf("Failed to attach debugger parent %d, " "errno = %d\n", debugger_parent, -err); debugger_parent = -1; } else { if(ptrace(PTRACE_SYSCALL, debugger_parent, 0, 0) < 0){ printf("Failed to continue debugger " "parent, errno = %d\n", errno); debugger_parent = -1; } } } } set_cmdline("(tracing thread)"); while(1){ CATCH_EINTR(pid = waitpid(-1, &status, WUNTRACED)); if(pid <= 0){ if(errno != ECHILD){ printf("wait failed - errno = %d\n", errno); } continue; } if(pid == debugger_pid){ int cont = 0; if(WIFEXITED(status) || WIFSIGNALED(status)) debugger_pid = -1; /* XXX Figure out how to deal with gdb and SMP */ else cont = debugger_signal(status, cpu_tasks[0].pid); if(cont == PTRACE_SYSCALL) strace = 1; continue; } else if(pid == debugger_parent){ debugger_parent_signal(status, pid); continue; } nsignals++; if(WIFEXITED(status)) ; #ifdef notdef { printf("Child %d exited with status %d\n", pid, WEXITSTATUS(status)); } #endif else if(WIFSIGNALED(status)){ sig = WTERMSIG(status); if(sig != 9){ printf("Child %d exited with signal %d\n", pid, sig); } } else if(WIFSTOPPED(status)){ proc_id = pid_to_processor_id(pid); sig = WSTOPSIG(status); if(signal_index[proc_id] == 1024){ signal_index[proc_id] = 0; last_index = 1023; } else last_index = signal_index[proc_id] - 1; if(((sig == SIGPROF) || (sig == SIGVTALRM) || (sig == SIGALRM)) && (signal_record[proc_id][last_index].signal == sig)&& (signal_record[proc_id][last_index].pid == pid)) signal_index[proc_id] = last_index; signal_record[proc_id][signal_index[proc_id]].pid = pid; gettimeofday(&signal_record[proc_id][signal_index[proc_id]].time, NULL); eip = ptrace(PTRACE_PEEKUSER, pid, PT_IP_OFFSET, 0); signal_record[proc_id][signal_index[proc_id]].addr = eip; signal_record[proc_id][signal_index[proc_id]++].signal = sig; if(proc_id == -1){ sleeping_process_signal(pid, sig); continue; } task = cpu_tasks[proc_id].task; tracing = is_tracing(task); old_tracing = tracing; switch(sig){ case SIGUSR1: sig = 0; op = do_proc_op(task, proc_id); switch(op){ case OP_TRACE_ON: arch_leave_kernel(task, pid); tracing = 1; break; case OP_REBOOT: case OP_HALT: unmap_physmem(); kmalloc_ok = 0; ptrace(PTRACE_KILL, pid, 0, 0); return(op == OP_REBOOT); case OP_NONE: printf("Detaching pid %d\n", pid); detach(pid, SIGSTOP); continue; default: break; } /* OP_EXEC switches host processes on us, * we want to continue the new one. */ pid = cpu_tasks[proc_id].pid; break; case SIGTRAP: if(!tracing && (debugger_pid != -1)){ child_signal(pid, status); continue; } tracing = 0; if(do_syscall(task, pid)) sig = SIGUSR2; else clear_singlestep(task); break; case SIGPROF: if(tracing) sig = 0; break; case SIGCHLD: case SIGHUP: sig = 0; break; case SIGSEGV: case SIGIO: case SIGALRM: case SIGVTALRM: case SIGFPE: case SIGBUS: case SIGILL: case SIGWINCH: default: tracing = 0; break; } set_tracing(task, tracing); if(!tracing && old_tracing) arch_enter_kernel(task, pid); if(!tracing && (debugger_pid != -1) && (sig != 0) && (sig != SIGALRM) && (sig != SIGVTALRM) && (sig != SIGSEGV) && (sig != SIGTRAP) && (sig != SIGUSR2) && (sig != SIGIO) && (sig != SIGFPE)){ child_signal(pid, status); continue; } if(tracing){ if(singlestepping_tt(task)) cont_type = PTRACE_SINGLESTEP; else cont_type = PTRACE_SYSCALL; } else cont_type = PTRACE_CONT; if((cont_type == PTRACE_CONT) && (debugger_pid != -1) && strace) cont_type = PTRACE_SYSCALL; if(ptrace(cont_type, pid, 0, sig) != 0){ tracer_panic("ptrace failed to continue " "process - errno = %d\n", errno); } } }