2 * This file is part of ltrace.
3 * Copyright (C) 2011,2012 Petr Machata, Red Hat Inc.
4 * Copyright (C) 2010 Zachary T Welch, CodeSourcery
5 * Copyright (C) 2010 Joe Damato
6 * Copyright (C) 1998,2008,2009 Juan Cespedes
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License as
10 * published by the Free Software Foundation; either version 2 of the
11 * License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
24 #define _GNU_SOURCE /* For getline. */
28 #include <sys/syscall.h>
29 #include <sys/types.h>
43 #include "breakpoint.h"
48 #include "ltrace-elf.h"
51 /* /proc/pid doesn't exist just after the fork, and sometimes `ltrace'
52 * couldn't open it to find the executable. So it may be necessary to
56 #define MAX_DELAY 100000 /* 100000 microseconds = 0.1 seconds */
58 #define PROC_PID_FILE(VAR, FORMAT, PID) \
59 char VAR[strlen(FORMAT) + 6]; \
60 sprintf(VAR, FORMAT, PID)
63 * Returns a (malloc'd) file name corresponding to a running pid
70 PROC_PID_FILE(proc_exe, "/proc/%d/exe", pid);
72 while (delay < MAX_DELAY) {
73 if (!access(proc_exe, F_OK)) {
74 return strdup(proc_exe);
76 delay += 1000; /* 1 milisecond */
83 open_status_file(pid_t pid)
85 PROC_PID_FILE(fn, "/proc/%d/status", pid);
86 /* Don't complain if we fail. This would typically happen
87 when the process is about to terminate, and these files are
88 not available anymore. This function is called from the
89 event loop, and we don't want to clutter the output just
90 because the process terminates. */
91 return fopen(fn, "r");
95 find_line_starting(FILE * file, const char * prefix, size_t len)
100 if (getline(&line, &line_len, file) < 0)
102 if (strncmp(line, prefix, len) == 0)
109 each_line_starting(FILE *file, const char *prefix,
110 enum callback_status (*cb)(const char *line,
115 size_t len = strlen(prefix);
117 while ((line = find_line_starting(file, prefix, len)) != NULL) {
118 enum callback_status st = (*cb)(line, prefix, data);
125 static enum callback_status
126 process_leader_cb(const char *line, const char *prefix, void *data)
129 *pidp = atoi(line + strlen(prefix));
134 process_leader(pid_t pid)
137 FILE * file = open_status_file(pid);
139 each_line_starting(file, "Tgid:\t", &process_leader_cb, &tgid);
146 static enum callback_status
147 process_stopped_cb(const char *line, const char *prefix, void *data)
149 char c = line[strlen(prefix)];
150 // t:tracing stop, T:job control stop
151 *(int *)data = (c == 't' || c == 'T');
156 process_stopped(pid_t pid)
159 FILE * file = open_status_file(pid);
161 each_line_starting(file, "State:\t", &process_stopped_cb,
168 static enum callback_status
169 process_status_cb(const char *line, const char *prefix, void *data)
171 const char * status = line + strlen(prefix);
172 const char c = *status;
174 #define RETURN(C) do { \
175 *(enum process_status *)data = C; \
180 case 'Z': RETURN(ps_zombie);
181 case 't': RETURN(ps_tracing_stop);
183 /* This can be either "T (stopped)" or, for older
184 * kernels, "T (tracing stop)". */
185 if (!strcmp(status, "T (stopped)\n"))
187 else if (!strcmp(status, "T (tracing stop)\n"))
188 RETURN(ps_tracing_stop);
190 fprintf(stderr, "Unknown process status: %s",
192 RETURN(ps_stop); /* Some sort of stop
196 case 'S': RETURN(ps_sleeping);
204 process_status(pid_t pid)
206 enum process_status ret = ps_invalid;
207 FILE * file = open_status_file(pid);
209 each_line_starting(file, "State:\t", &process_status_cb, &ret);
211 if (ret == ps_invalid)
212 fprintf(stderr, "process_status %d: %s", pid,
215 /* If the file is not present, the process presumably
223 all_digits(const char *str)
225 while (isdigit(*str))
231 process_tasks(pid_t pid, pid_t **ret_tasks, size_t *ret_n)
233 PROC_PID_FILE(fn, "/proc/%d/task", pid);
234 DIR * d = opendir(fn);
244 struct dirent *result;
245 if (readdir_r(d, &entry, &result) != 0) {
251 if (result->d_type == DT_DIR && all_digits(result->d_name)) {
252 pid_t npid = atoi(result->d_name);
254 alloc = alloc > 0 ? (2 * alloc) : 8;
255 pid_t *ntasks = realloc(tasks,
256 sizeof(*tasks) * alloc);
257 if (ntasks == NULL) {
276 /* On native 64-bit system, we need to be careful when handling cross
277 * tracing. This select appropriate pointer depending on host and
278 * target architectures. XXX Really we should abstract this into the
279 * ABI object, as theorized about somewhere on pmachata/revamp
282 select_32_64(struct Process *proc, void *p32, void *p64)
284 if (sizeof(long) == 4 || proc->mask_32bit)
291 fetch_dyn64(struct Process *proc, arch_addr_t *addr, Elf64_Dyn *ret)
293 if (umovebytes(proc, *addr, ret, sizeof(*ret)) != sizeof(*ret))
295 *addr += sizeof(*ret);
300 fetch_dyn32(struct Process *proc, arch_addr_t *addr, Elf64_Dyn *ret)
303 if (umovebytes(proc, *addr, &dyn, sizeof(dyn)) != sizeof(dyn))
306 *addr += sizeof(dyn);
307 ret->d_tag = dyn.d_tag;
308 ret->d_un.d_val = dyn.d_un.d_val;
314 dyn_fetcher(struct Process *proc))(struct Process *,
315 arch_addr_t *, Elf64_Dyn *)
317 return select_32_64(proc, fetch_dyn32, fetch_dyn64);
321 proc_find_dynamic_entry_addr(struct Process *proc, arch_addr_t src_addr,
322 int d_tag, arch_addr_t *ret)
324 debug(DEBUG_FUNCTION, "find_dynamic_entry()");
326 if (ret == NULL || src_addr == 0 || d_tag < 0)
332 if (dyn_fetcher(proc)(proc, &src_addr, &entry) < 0
333 || entry.d_tag == DT_NULL
334 || i++ > 100) { /* Arbitrary cut-off so that we
335 * don't loop forever if the
336 * binary is corrupted. */
337 debug(2, "Couldn't find address for dtag!");
341 if (entry.d_tag == d_tag) {
342 /* XXX The double cast should be removed when
343 * arch_addr_t becomes integral type. */
344 *ret = (arch_addr_t)(uintptr_t)entry.d_un.d_val;
345 debug(2, "found address: %p in dtag %d", *ret, d_tag);
351 /* Our own type for representing 32-bit linkmap. We can't rely on the
352 * definition in link.h, because that's only accurate for our host
353 * architecture, not for target architecture (where the traced process
355 #define LT_LINK_MAP(BITS) \
357 Elf##BITS##_Addr l_addr; \
358 Elf##BITS##_Addr l_name; \
359 Elf##BITS##_Addr l_ld; \
360 Elf##BITS##_Addr l_next; \
361 Elf##BITS##_Addr l_prev; \
363 struct lt_link_map_32 LT_LINK_MAP(32);
364 struct lt_link_map_64 LT_LINK_MAP(64);
367 fetch_lm64(struct Process *proc, arch_addr_t addr,
368 struct lt_link_map_64 *ret)
370 if (umovebytes(proc, addr, ret, sizeof(*ret)) != sizeof(*ret))
376 fetch_lm32(struct Process *proc, arch_addr_t addr,
377 struct lt_link_map_64 *ret)
379 struct lt_link_map_32 lm;
380 if (umovebytes(proc, addr, &lm, sizeof(lm)) != sizeof(lm))
383 ret->l_addr = lm.l_addr;
384 ret->l_name = lm.l_name;
386 ret->l_next = lm.l_next;
387 ret->l_prev = lm.l_prev;
393 lm_fetcher(struct Process *proc))(struct Process *,
394 arch_addr_t, struct lt_link_map_64 *)
396 return select_32_64(proc, fetch_lm32, fetch_lm64);
399 /* The same as above holds for struct r_debug. */
400 #define LT_R_DEBUG(BITS) \
403 Elf##BITS##_Addr r_map; \
404 Elf##BITS##_Addr r_brk; \
406 Elf##BITS##_Addr r_ldbase; \
409 struct lt_r_debug_32 LT_R_DEBUG(32);
410 struct lt_r_debug_64 LT_R_DEBUG(64);
413 fetch_rd64(struct Process *proc, arch_addr_t addr,
414 struct lt_r_debug_64 *ret)
416 if (umovebytes(proc, addr, ret, sizeof(*ret)) != sizeof(*ret))
422 fetch_rd32(struct Process *proc, arch_addr_t addr,
423 struct lt_r_debug_64 *ret)
425 struct lt_r_debug_32 rd;
426 if (umovebytes(proc, addr, &rd, sizeof(rd)) != sizeof(rd))
429 ret->r_version = rd.r_version;
430 ret->r_map = rd.r_map;
431 ret->r_brk = rd.r_brk;
432 ret->r_state = rd.r_state;
433 ret->r_ldbase = rd.r_ldbase;
439 rdebug_fetcher(struct Process *proc))(struct Process *,
440 arch_addr_t, struct lt_r_debug_64 *)
442 return select_32_64(proc, fetch_rd32, fetch_rd64);
446 fetch_auxv64_entry(int fd, Elf64_auxv_t *ret)
448 /* Reaching EOF is as much problem as not reading whole
450 return read(fd, ret, sizeof(*ret)) == sizeof(*ret) ? 0 : -1;
454 fetch_auxv32_entry(int fd, Elf64_auxv_t *ret)
457 if (read(fd, &auxv, sizeof(auxv)) != sizeof(auxv))
460 ret->a_type = auxv.a_type;
461 ret->a_un.a_val = auxv.a_un.a_val;
466 auxv_fetcher(struct Process *proc))(int, Elf64_auxv_t *)
468 return select_32_64(proc, fetch_auxv32_entry, fetch_auxv64_entry);
472 crawl_linkmap(struct Process *proc, struct lt_r_debug_64 *dbg)
474 debug (DEBUG_FUNCTION, "crawl_linkmap()");
476 if (!dbg || !dbg->r_map) {
477 debug(2, "Debug structure or it's linkmap are NULL!");
481 /* XXX The double cast should be removed when
482 * arch_addr_t becomes integral type. */
483 arch_addr_t addr = (arch_addr_t)(uintptr_t)dbg->r_map;
486 struct lt_link_map_64 rlm;
487 if (lm_fetcher(proc)(proc, addr, &rlm) < 0) {
488 debug(2, "Unable to read link map");
492 arch_addr_t key = addr;
493 /* XXX The double cast should be removed when
494 * arch_addr_t becomes integral type. */
495 addr = (arch_addr_t)(uintptr_t)rlm.l_next;
496 if (rlm.l_name == 0) {
497 debug(2, "Name of mapped library is NULL");
501 char lib_name[BUFSIZ];
502 /* XXX The double cast should be removed when
503 * arch_addr_t becomes integral type. */
504 umovebytes(proc, (arch_addr_t)(uintptr_t)rlm.l_name,
505 lib_name, sizeof(lib_name));
507 /* Library name can be an empty string, in which case
508 * the entry represents either the main binary, or a
509 * VDSO. Unfortunately we can't rely on that, as in
510 * recent glibc, that entry is initialized to VDSO
513 * It's not clear how to detect VDSO in this case. We
514 * can't assume that l_name of real DSOs will be
515 * either absolute or relative (for LD_LIBRARY_PATH=:
516 * it will be neither). We can't compare l_addr with
517 * AT_SYSINFO_EHDR either, as l_addr is bias (which
518 * also means it's not unique, and therefore useless
519 * for this). We could load VDSO from process image
520 * and at least compare actual SONAMEs. For now, this
521 * kludge is about the best that we can do. */
523 || strcmp(lib_name, "linux-vdso.so.1") == 0
524 || strcmp(lib_name, "linux-gate.so.1") == 0
525 || strcmp(lib_name, "linux-vdso32.so.1") == 0
526 || strcmp(lib_name, "linux-vdso64.so.1") == 0)
529 /* Do we have that library already? */
530 if (proc_each_library(proc, NULL, library_with_key_cb, &key))
533 struct library *lib = malloc(sizeof(*lib));
537 library_destroy(lib);
538 fprintf(stderr, "Couldn't load ELF object %s: %s\n",
539 lib_name, strerror(errno));
542 library_init(lib, LT_LIBTYPE_DSO);
544 if (ltelf_read_library(lib, proc, lib_name, rlm.l_addr) < 0)
548 proc_add_library(proc, lib);
554 load_debug_struct(struct Process *proc, struct lt_r_debug_64 *ret)
556 debug(DEBUG_FUNCTION, "load_debug_struct");
558 if (rdebug_fetcher(proc)(proc, proc->os.debug_addr, ret) < 0) {
559 debug(2, "This process does not have a debug structure!");
567 rdebug_bp_on_hit(struct breakpoint *bp, struct Process *proc)
569 debug(DEBUG_FUNCTION, "arch_check_dbg");
571 struct lt_r_debug_64 rdbg;
572 if (load_debug_struct(proc, &rdbg) < 0) {
573 debug(2, "Unable to load debug structure!");
577 if (rdbg.r_state == RT_CONSISTENT) {
578 debug(2, "Linkmap is now consistent");
579 switch (proc->os.debug_state) {
581 debug(2, "Adding DSO to linkmap");
582 crawl_linkmap(proc, &rdbg);
585 debug(2, "Removing DSO from linkmap");
586 // XXX unload that library
589 debug(2, "Unexpected debug state!");
593 proc->os.debug_state = rdbg.r_state;
596 #ifndef ARCH_HAVE_FIND_DL_DEBUG
598 arch_find_dl_debug(struct Process *proc, arch_addr_t dyn_addr,
601 return proc_find_dynamic_entry_addr(proc, dyn_addr, DT_DEBUG, ret);
606 linkmap_init(struct Process *proc, arch_addr_t dyn_addr)
608 debug(DEBUG_FUNCTION, "linkmap_init(%d, dyn_addr=%p)", proc->pid, dyn_addr);
610 if (arch_find_dl_debug(proc, dyn_addr, &proc->os.debug_addr) == -1) {
611 debug(2, "Couldn't find debug structure!");
616 struct lt_r_debug_64 rdbg;
617 if ((status = load_debug_struct(proc, &rdbg)) < 0) {
618 debug(2, "No debug structure or no memory to allocate one!");
622 /* XXX The double cast should be removed when
623 * arch_addr_t becomes integral type. */
624 arch_addr_t addr = (arch_addr_t)(uintptr_t)rdbg.r_brk;
625 if (arch_translate_address_dyn(proc, addr, &addr) < 0)
628 struct breakpoint *rdebug_bp = insert_breakpoint(proc, addr, NULL);
629 static struct bp_callbacks rdebug_callbacks = {
630 .on_hit = rdebug_bp_on_hit,
632 rdebug_bp->cbs = &rdebug_callbacks;
634 crawl_linkmap(proc, &rdbg);
640 task_kill (pid_t pid, int sig)
646 ret = syscall (__NR_tkill, pid, sig);
651 process_removed(struct Process *proc)
653 delete_events_for(proc);
657 process_get_entry(struct Process *proc,
659 arch_addr_t *interp_biasp)
661 PROC_PID_FILE(fn, "/proc/%d/auxv", proc->pid);
662 int fd = open(fn, O_RDONLY);
666 fprintf(stderr, "couldn't read %s: %s", fn, strerror(errno));
674 arch_addr_t at_entry = 0;
675 arch_addr_t at_bias = 0;
677 Elf64_auxv_t entry = {};
678 if (auxv_fetcher(proc)(fd, &entry) < 0)
681 switch (entry.a_type) {
683 /* XXX The double cast should be removed when
684 * arch_addr_t becomes integral type. */
685 at_bias = (arch_addr_t)(uintptr_t)entry.a_un.a_val;
689 /* XXX The double cast should be removed when
690 * arch_addr_t becomes integral type. */
691 at_entry = (arch_addr_t)(uintptr_t)entry.a_un.a_val;
703 if (interp_biasp != NULL)
704 *interp_biasp = at_bias;
709 os_process_init(struct Process *proc)
711 proc->os.debug_addr = 0;
712 proc->os.debug_state = 0;
717 os_process_destroy(struct Process *proc)
722 os_process_clone(struct Process *retp, struct Process *proc)
729 os_process_exec(struct Process *proc)