The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 1 | /* system/debuggerd/debuggerd.c |
| 2 | ** |
| 3 | ** Copyright 2006, The Android Open Source Project |
| 4 | ** |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 5 | ** Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | ** you may not use this file except in compliance with the License. |
| 7 | ** You may obtain a copy of the License at |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 8 | ** |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 9 | ** http://www.apache.org/licenses/LICENSE-2.0 |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 10 | ** |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 11 | ** Unless required by applicable law or agreed to in writing, software |
| 12 | ** distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | ** See the License for the specific language governing permissions and |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 15 | ** limitations under the License. |
| 16 | */ |
| 17 | |
| 18 | #include <stdio.h> |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 19 | #include <errno.h> |
| 20 | #include <signal.h> |
| 21 | #include <pthread.h> |
| 22 | #include <stdarg.h> |
| 23 | #include <fcntl.h> |
| 24 | #include <sys/types.h> |
| 25 | #include <dirent.h> |
| 26 | |
| 27 | #include <sys/ptrace.h> |
| 28 | #include <sys/wait.h> |
| 29 | #include <sys/exec_elf.h> |
| 30 | #include <sys/stat.h> |
| 31 | |
| 32 | #include <cutils/sockets.h> |
| 33 | #include <cutils/logd.h> |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 34 | #include <cutils/properties.h> |
| 35 | |
| 36 | #include <linux/input.h> |
| 37 | |
| 38 | #include <private/android_filesystem_config.h> |
| 39 | |
Hristo Bojinov | c031a3b | 2010-08-27 14:00:57 -0700 | [diff] [blame] | 40 | #include <byteswap.h> |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 41 | #include "debuggerd.h" |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 42 | #include "utility.h" |
| 43 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 44 | #define ANDROID_LOG_INFO 4 |
| 45 | |
| 46 | /* Log information onto the tombstone */ |
| 47 | void _LOG(int tfd, bool in_tombstone_only, const char *fmt, ...) |
| 48 | { |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 49 | char buf[512]; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 50 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 51 | va_list ap; |
| 52 | va_start(ap, fmt); |
| 53 | |
| 54 | if (tfd >= 0) { |
| 55 | int len; |
| 56 | vsnprintf(buf, sizeof(buf), fmt, ap); |
| 57 | len = strlen(buf); |
| 58 | if(tfd >= 0) write(tfd, buf, len); |
| 59 | } |
| 60 | |
| 61 | if (!in_tombstone_only) |
| 62 | __android_log_vprint(ANDROID_LOG_INFO, "DEBUG", fmt, ap); |
| 63 | } |
| 64 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 65 | // 6f000000-6f01e000 rwxp 00000000 00:0c 16389419 /system/lib/libcomposer.so |
| 66 | // 012345678901234567890123456789012345678901234567890123456789 |
| 67 | // 0 1 2 3 4 5 |
| 68 | |
| 69 | mapinfo *parse_maps_line(char *line) |
| 70 | { |
| 71 | mapinfo *mi; |
| 72 | int len = strlen(line); |
| 73 | |
| 74 | if(len < 1) return 0; |
| 75 | line[--len] = 0; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 76 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 77 | if(len < 50) return 0; |
| 78 | if(line[20] != 'x') return 0; |
| 79 | |
| 80 | mi = malloc(sizeof(mapinfo) + (len - 47)); |
| 81 | if(mi == 0) return 0; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 82 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 83 | mi->start = strtoul(line, 0, 16); |
| 84 | mi->end = strtoul(line + 9, 0, 16); |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 85 | /* To be filled in parse_elf_info if the mapped section starts with |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 86 | * elf_header |
| 87 | */ |
| 88 | mi->exidx_start = mi->exidx_end = 0; |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 89 | mi->symbols = 0; |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 90 | mi->next = 0; |
| 91 | strcpy(mi->name, line + 49); |
| 92 | |
| 93 | return mi; |
| 94 | } |
| 95 | |
| 96 | void dump_build_info(int tfd) |
| 97 | { |
| 98 | char fingerprint[PROPERTY_VALUE_MAX]; |
| 99 | |
| 100 | property_get("ro.build.fingerprint", fingerprint, "unknown"); |
| 101 | |
| 102 | _LOG(tfd, false, "Build fingerprint: '%s'\n", fingerprint); |
| 103 | } |
| 104 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 105 | const char *get_signame(int sig) |
| 106 | { |
| 107 | switch(sig) { |
| 108 | case SIGILL: return "SIGILL"; |
| 109 | case SIGABRT: return "SIGABRT"; |
| 110 | case SIGBUS: return "SIGBUS"; |
| 111 | case SIGFPE: return "SIGFPE"; |
| 112 | case SIGSEGV: return "SIGSEGV"; |
| 113 | case SIGSTKFLT: return "SIGSTKFLT"; |
| 114 | default: return "?"; |
| 115 | } |
| 116 | } |
| 117 | |
Carl Shapiro | 83c6b05 | 2010-10-08 18:10:24 -0700 | [diff] [blame] | 118 | const char *get_sigcode(int signo, int code) |
| 119 | { |
| 120 | switch (signo) { |
| 121 | case SIGILL: |
| 122 | switch (code) { |
| 123 | case ILL_ILLOPC: return "ILL_ILLOPC"; |
| 124 | case ILL_ILLOPN: return "ILL_ILLOPN"; |
| 125 | case ILL_ILLADR: return "ILL_ILLADR"; |
| 126 | case ILL_ILLTRP: return "ILL_ILLTRP"; |
| 127 | case ILL_PRVOPC: return "ILL_PRVOPC"; |
| 128 | case ILL_PRVREG: return "ILL_PRVREG"; |
| 129 | case ILL_COPROC: return "ILL_COPROC"; |
| 130 | case ILL_BADSTK: return "ILL_BADSTK"; |
| 131 | } |
| 132 | break; |
| 133 | case SIGBUS: |
| 134 | switch (code) { |
| 135 | case BUS_ADRALN: return "BUS_ADRALN"; |
| 136 | case BUS_ADRERR: return "BUS_ADRERR"; |
| 137 | case BUS_OBJERR: return "BUS_OBJERR"; |
| 138 | } |
| 139 | break; |
| 140 | case SIGFPE: |
| 141 | switch (code) { |
| 142 | case FPE_INTDIV: return "FPE_INTDIV"; |
| 143 | case FPE_INTOVF: return "FPE_INTOVF"; |
| 144 | case FPE_FLTDIV: return "FPE_FLTDIV"; |
| 145 | case FPE_FLTOVF: return "FPE_FLTOVF"; |
| 146 | case FPE_FLTUND: return "FPE_FLTUND"; |
| 147 | case FPE_FLTRES: return "FPE_FLTRES"; |
| 148 | case FPE_FLTINV: return "FPE_FLTINV"; |
| 149 | case FPE_FLTSUB: return "FPE_FLTSUB"; |
| 150 | } |
| 151 | break; |
| 152 | case SIGSEGV: |
| 153 | switch (code) { |
| 154 | case SEGV_MAPERR: return "SEGV_MAPERR"; |
| 155 | case SEGV_ACCERR: return "SEGV_ACCERR"; |
| 156 | } |
| 157 | break; |
| 158 | } |
| 159 | return "?"; |
| 160 | } |
| 161 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 162 | void dump_fault_addr(int tfd, int pid, int sig) |
| 163 | { |
| 164 | siginfo_t si; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 165 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 166 | memset(&si, 0, sizeof(si)); |
| 167 | if(ptrace(PTRACE_GETSIGINFO, pid, 0, &si)){ |
| 168 | _LOG(tfd, false, "cannot get siginfo: %s\n", strerror(errno)); |
| 169 | } else { |
Carl Shapiro | 83c6b05 | 2010-10-08 18:10:24 -0700 | [diff] [blame] | 170 | _LOG(tfd, false, "signal %d (%s), code %d (%s), fault addr %08x\n", |
| 171 | sig, get_signame(sig), |
| 172 | si.si_code, get_sigcode(sig, si.si_code), |
| 173 | si.si_addr); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 174 | } |
| 175 | } |
| 176 | |
| 177 | void dump_crash_banner(int tfd, unsigned pid, unsigned tid, int sig) |
| 178 | { |
| 179 | char data[1024]; |
| 180 | char *x = 0; |
| 181 | FILE *fp; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 182 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 183 | sprintf(data, "/proc/%d/cmdline", pid); |
| 184 | fp = fopen(data, "r"); |
| 185 | if(fp) { |
| 186 | x = fgets(data, 1024, fp); |
| 187 | fclose(fp); |
| 188 | } |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 189 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 190 | _LOG(tfd, false, |
| 191 | "*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n"); |
| 192 | dump_build_info(tfd); |
| 193 | _LOG(tfd, false, "pid: %d, tid: %d >>> %s <<<\n", |
| 194 | pid, tid, x ? x : "UNKNOWN"); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 195 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 196 | if(sig) dump_fault_addr(tfd, tid, sig); |
| 197 | } |
| 198 | |
Hristo Bojinov | c031a3b | 2010-08-27 14:00:57 -0700 | [diff] [blame] | 199 | /* After randomization (ASLR), stack contents that point to randomized |
| 200 | * code become uninterpretable (e.g. can't be resolved to line numbers). |
| 201 | * Here, we bundle enough information so that stack analysis on the |
| 202 | * server side can still be performed. This means we are leaking some |
| 203 | * information about the device (its randomization base). We have to make |
| 204 | * sure an attacker has no way of intercepting the tombstone. |
| 205 | */ |
| 206 | |
| 207 | typedef struct { |
| 208 | int32_t mmap_addr; |
| 209 | char tag[4]; /* 'P', 'R', 'E', ' ' */ |
| 210 | } prelink_info_t __attribute__((packed)); |
| 211 | |
| 212 | static inline void set_prelink(long *prelink_addr, |
| 213 | prelink_info_t *info) |
| 214 | { |
| 215 | // We will assume the binary is little-endian, and test the |
| 216 | // host endianness here. |
| 217 | unsigned long test_endianness = 0xFF; |
| 218 | |
| 219 | if (sizeof(prelink_info_t) == 8 && prelink_addr) { |
| 220 | if (*(unsigned char *)&test_endianness) |
| 221 | *prelink_addr = info->mmap_addr; |
| 222 | else |
| 223 | *prelink_addr = bswap_32(info->mmap_addr); |
| 224 | } |
| 225 | } |
| 226 | |
| 227 | static int check_prelinked(const char *fname, |
| 228 | long *prelink_addr) |
| 229 | { |
| 230 | *prelink_addr = 0; |
| 231 | if (sizeof(prelink_info_t) != 8) return 0; |
| 232 | |
| 233 | int fd = open(fname, O_RDONLY); |
| 234 | if (fd < 0) return 0; |
| 235 | off_t end = lseek(fd, 0, SEEK_END); |
| 236 | int nr = sizeof(prelink_info_t); |
| 237 | |
| 238 | off_t sz = lseek(fd, -nr, SEEK_CUR); |
| 239 | if ((long)(end - sz) != (long)nr) return 0; |
| 240 | if (sz == (off_t)-1) return 0; |
| 241 | |
| 242 | prelink_info_t info; |
| 243 | int num_read = read(fd, &info, nr); |
| 244 | if (num_read < 0) return 0; |
| 245 | if (num_read != sizeof(info)) return 0; |
| 246 | |
| 247 | int prelinked = 0; |
| 248 | if (!strncmp(info.tag, "PRE ", 4)) { |
| 249 | set_prelink(prelink_addr, &info); |
| 250 | prelinked = 1; |
| 251 | } |
| 252 | if (close(fd) < 0) return 0; |
| 253 | return prelinked; |
| 254 | } |
| 255 | |
| 256 | void dump_randomization_base(int tfd, bool at_fault) { |
| 257 | bool only_in_tombstone = !at_fault; |
| 258 | long prelink_addr; |
| 259 | check_prelinked("/system/lib/libc.so", &prelink_addr); |
| 260 | _LOG(tfd, only_in_tombstone, |
| 261 | "\nlibc base address: %08x\n", prelink_addr); |
| 262 | } |
| 263 | |
| 264 | /* End of ASLR-related logic. */ |
| 265 | |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 266 | static void parse_elf_info(mapinfo *milist, pid_t pid) |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 267 | { |
| 268 | mapinfo *mi; |
| 269 | for (mi = milist; mi != NULL; mi = mi->next) { |
| 270 | Elf32_Ehdr ehdr; |
| 271 | |
| 272 | memset(&ehdr, 0, sizeof(Elf32_Ehdr)); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 273 | /* Read in sizeof(Elf32_Ehdr) worth of data from the beginning of |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 274 | * mapped section. |
| 275 | */ |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 276 | get_remote_struct(pid, (void *) (mi->start), &ehdr, |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 277 | sizeof(Elf32_Ehdr)); |
| 278 | /* Check if it has the matching magic words */ |
| 279 | if (IS_ELF(ehdr)) { |
| 280 | Elf32_Phdr phdr; |
| 281 | Elf32_Phdr *ptr; |
| 282 | int i; |
| 283 | |
| 284 | ptr = (Elf32_Phdr *) (mi->start + ehdr.e_phoff); |
| 285 | for (i = 0; i < ehdr.e_phnum; i++) { |
| 286 | /* Parse the program header */ |
Mike Dodd | 6b65747 | 2010-07-14 11:28:29 -0700 | [diff] [blame] | 287 | get_remote_struct(pid, (char *) (ptr+i), &phdr, |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 288 | sizeof(Elf32_Phdr)); |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 289 | #ifdef __arm__ |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 290 | /* Found a EXIDX segment? */ |
| 291 | if (phdr.p_type == PT_ARM_EXIDX) { |
| 292 | mi->exidx_start = mi->start + phdr.p_offset; |
| 293 | mi->exidx_end = mi->exidx_start + phdr.p_filesz; |
| 294 | break; |
| 295 | } |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 296 | #endif |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 297 | } |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 298 | |
| 299 | /* Try to load symbols from this file */ |
| 300 | mi->symbols = symbol_table_create(mi->name); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 301 | } |
| 302 | } |
| 303 | } |
| 304 | |
| 305 | void dump_crash_report(int tfd, unsigned pid, unsigned tid, bool at_fault) |
| 306 | { |
| 307 | char data[1024]; |
| 308 | FILE *fp; |
| 309 | mapinfo *milist = 0; |
| 310 | unsigned int sp_list[STACK_CONTENT_DEPTH]; |
| 311 | int stack_depth; |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 312 | #ifdef __arm__ |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 313 | int frame0_pc_sane = 1; |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 314 | #endif |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 315 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 316 | if (!at_fault) { |
| 317 | _LOG(tfd, true, |
| 318 | "--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---\n"); |
| 319 | _LOG(tfd, true, "pid: %d, tid: %d\n", pid, tid); |
| 320 | } |
| 321 | |
| 322 | dump_registers(tfd, tid, at_fault); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 323 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 324 | /* Clear stack pointer records */ |
| 325 | memset(sp_list, 0, sizeof(sp_list)); |
| 326 | |
| 327 | sprintf(data, "/proc/%d/maps", pid); |
| 328 | fp = fopen(data, "r"); |
| 329 | if(fp) { |
| 330 | while(fgets(data, 1024, fp)) { |
| 331 | mapinfo *mi = parse_maps_line(data); |
| 332 | if(mi) { |
| 333 | mi->next = milist; |
| 334 | milist = mi; |
| 335 | } |
| 336 | } |
| 337 | fclose(fp); |
| 338 | } |
| 339 | |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 340 | parse_elf_info(milist, tid); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 341 | |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 342 | #if __arm__ |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 343 | /* If stack unwinder fails, use the default solution to dump the stack |
| 344 | * content. |
| 345 | */ |
| 346 | stack_depth = unwind_backtrace_with_ptrace(tfd, tid, milist, sp_list, |
| 347 | &frame0_pc_sane, at_fault); |
| 348 | |
| 349 | /* The stack unwinder should at least unwind two levels of stack. If less |
| 350 | * level is seen we make sure at lease pc and lr are dumped. |
| 351 | */ |
| 352 | if (stack_depth < 2) { |
| 353 | dump_pc_and_lr(tfd, tid, milist, stack_depth, at_fault); |
| 354 | } |
| 355 | |
Hristo Bojinov | c031a3b | 2010-08-27 14:00:57 -0700 | [diff] [blame] | 356 | dump_randomization_base(tfd, at_fault); |
Ben Cheng | 2854db8 | 2010-01-28 10:00:03 -0800 | [diff] [blame] | 357 | dump_stack_and_code(tfd, tid, milist, stack_depth, sp_list, at_fault); |
Bruce Beare | 6cc4923 | 2010-10-13 16:11:15 -0700 | [diff] [blame] | 358 | #elif __i386__ |
| 359 | /* If stack unwinder fails, use the default solution to dump the stack |
| 360 | * content. |
| 361 | */ |
| 362 | stack_depth = unwind_backtrace_with_ptrace_x86(tfd, tid, milist,at_fault); |
| 363 | #else |
| 364 | #error "Unsupported architecture" |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 365 | #endif |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 366 | |
| 367 | while(milist) { |
| 368 | mapinfo *next = milist->next; |
Meng Hu | ae7b91b | 2009-11-05 16:10:50 -0600 | [diff] [blame] | 369 | symbol_table_free(milist->symbols); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 370 | free(milist); |
| 371 | milist = next; |
| 372 | } |
| 373 | } |
| 374 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 375 | #define MAX_TOMBSTONES 10 |
| 376 | |
| 377 | #define typecheck(x,y) { \ |
| 378 | typeof(x) __dummy1; \ |
| 379 | typeof(y) __dummy2; \ |
| 380 | (void)(&__dummy1 == &__dummy2); } |
| 381 | |
| 382 | #define TOMBSTONE_DIR "/data/tombstones" |
| 383 | |
| 384 | /* |
| 385 | * find_and_open_tombstone - find an available tombstone slot, if any, of the |
| 386 | * form tombstone_XX where XX is 00 to MAX_TOMBSTONES-1, inclusive. If no |
| 387 | * file is available, we reuse the least-recently-modified file. |
| 388 | */ |
| 389 | static int find_and_open_tombstone(void) |
| 390 | { |
| 391 | unsigned long mtime = ULONG_MAX; |
| 392 | struct stat sb; |
| 393 | char path[128]; |
| 394 | int fd, i, oldest = 0; |
| 395 | |
| 396 | /* |
| 397 | * XXX: Our stat.st_mtime isn't time_t. If it changes, as it probably ought |
| 398 | * to, our logic breaks. This check will generate a warning if that happens. |
| 399 | */ |
| 400 | typecheck(mtime, sb.st_mtime); |
| 401 | |
| 402 | /* |
| 403 | * In a single wolf-like pass, find an available slot and, in case none |
| 404 | * exist, find and record the least-recently-modified file. |
| 405 | */ |
| 406 | for (i = 0; i < MAX_TOMBSTONES; i++) { |
| 407 | snprintf(path, sizeof(path), TOMBSTONE_DIR"/tombstone_%02d", i); |
| 408 | |
| 409 | if (!stat(path, &sb)) { |
| 410 | if (sb.st_mtime < mtime) { |
| 411 | oldest = i; |
| 412 | mtime = sb.st_mtime; |
| 413 | } |
| 414 | continue; |
| 415 | } |
| 416 | if (errno != ENOENT) |
| 417 | continue; |
| 418 | |
| 419 | fd = open(path, O_CREAT | O_EXCL | O_WRONLY, 0600); |
| 420 | if (fd < 0) |
| 421 | continue; /* raced ? */ |
| 422 | |
| 423 | fchown(fd, AID_SYSTEM, AID_SYSTEM); |
| 424 | return fd; |
| 425 | } |
| 426 | |
| 427 | /* we didn't find an available file, so we clobber the oldest one */ |
| 428 | snprintf(path, sizeof(path), TOMBSTONE_DIR"/tombstone_%02d", oldest); |
| 429 | fd = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0600); |
| 430 | fchown(fd, AID_SYSTEM, AID_SYSTEM); |
| 431 | |
| 432 | return fd; |
| 433 | } |
| 434 | |
| 435 | /* Return true if some thread is not detached cleanly */ |
| 436 | static bool dump_sibling_thread_report(int tfd, unsigned pid, unsigned tid) |
| 437 | { |
| 438 | char task_path[1024]; |
| 439 | |
| 440 | sprintf(task_path, "/proc/%d/task", pid); |
| 441 | DIR *d; |
| 442 | struct dirent *de; |
| 443 | int need_cleanup = 0; |
| 444 | |
| 445 | d = opendir(task_path); |
| 446 | /* Bail early if cannot open the task directory */ |
| 447 | if (d == NULL) { |
| 448 | XLOG("Cannot open /proc/%d/task\n", pid); |
| 449 | return false; |
| 450 | } |
| 451 | while ((de = readdir(d)) != NULL) { |
| 452 | unsigned new_tid; |
| 453 | /* Ignore "." and ".." */ |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 454 | if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, "..")) |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 455 | continue; |
| 456 | new_tid = atoi(de->d_name); |
| 457 | /* The main thread at fault has been handled individually */ |
| 458 | if (new_tid == tid) |
| 459 | continue; |
| 460 | |
| 461 | /* Skip this thread if cannot ptrace it */ |
| 462 | if (ptrace(PTRACE_ATTACH, new_tid, 0, 0) < 0) |
| 463 | continue; |
| 464 | |
| 465 | dump_crash_report(tfd, pid, new_tid, false); |
| 466 | need_cleanup |= ptrace(PTRACE_DETACH, new_tid, 0, 0); |
| 467 | } |
| 468 | closedir(d); |
| 469 | return need_cleanup != 0; |
| 470 | } |
| 471 | |
| 472 | /* Return true if some thread is not detached cleanly */ |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 473 | static bool engrave_tombstone(unsigned pid, unsigned tid, int debug_uid, |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 474 | int signal) |
| 475 | { |
| 476 | int fd; |
| 477 | bool need_cleanup = false; |
| 478 | |
| 479 | mkdir(TOMBSTONE_DIR, 0755); |
| 480 | chown(TOMBSTONE_DIR, AID_SYSTEM, AID_SYSTEM); |
| 481 | |
| 482 | fd = find_and_open_tombstone(); |
| 483 | if (fd < 0) |
| 484 | return need_cleanup; |
| 485 | |
| 486 | dump_crash_banner(fd, pid, tid, signal); |
| 487 | dump_crash_report(fd, pid, tid, true); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 488 | /* |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 489 | * If the user has requested to attach gdb, don't collect the per-thread |
| 490 | * information as it increases the chance to lose track of the process. |
| 491 | */ |
| 492 | if ((signed)pid > debug_uid) { |
| 493 | need_cleanup = dump_sibling_thread_report(fd, pid, tid); |
| 494 | } |
| 495 | |
| 496 | close(fd); |
| 497 | return need_cleanup; |
| 498 | } |
| 499 | |
| 500 | static int |
| 501 | write_string(const char* file, const char* string) |
| 502 | { |
| 503 | int len; |
| 504 | int fd; |
| 505 | ssize_t amt; |
| 506 | fd = open(file, O_RDWR); |
| 507 | len = strlen(string); |
| 508 | if (fd < 0) |
| 509 | return -errno; |
| 510 | amt = write(fd, string, len); |
| 511 | close(fd); |
| 512 | return amt >= 0 ? 0 : -errno; |
| 513 | } |
| 514 | |
| 515 | static |
| 516 | void init_debug_led(void) |
| 517 | { |
| 518 | // trout leds |
| 519 | write_string("/sys/class/leds/red/brightness", "0"); |
| 520 | write_string("/sys/class/leds/green/brightness", "0"); |
| 521 | write_string("/sys/class/leds/blue/brightness", "0"); |
| 522 | write_string("/sys/class/leds/red/device/blink", "0"); |
| 523 | // sardine leds |
| 524 | write_string("/sys/class/leds/left/cadence", "0,0"); |
| 525 | } |
| 526 | |
| 527 | static |
| 528 | void enable_debug_led(void) |
| 529 | { |
| 530 | // trout leds |
| 531 | write_string("/sys/class/leds/red/brightness", "255"); |
| 532 | // sardine leds |
| 533 | write_string("/sys/class/leds/left/cadence", "1,0"); |
| 534 | } |
| 535 | |
| 536 | static |
| 537 | void disable_debug_led(void) |
| 538 | { |
| 539 | // trout leds |
| 540 | write_string("/sys/class/leds/red/brightness", "0"); |
| 541 | // sardine leds |
| 542 | write_string("/sys/class/leds/left/cadence", "0,0"); |
| 543 | } |
| 544 | |
| 545 | extern int init_getevent(); |
| 546 | extern void uninit_getevent(); |
| 547 | extern int get_event(struct input_event* event, int timeout); |
| 548 | |
| 549 | static void wait_for_user_action(unsigned tid, struct ucred* cr) |
| 550 | { |
| 551 | (void)tid; |
| 552 | /* First log a helpful message */ |
| 553 | LOG( "********************************************************\n" |
Andy McFadden | 3bfdcc9 | 2009-12-01 12:37:26 -0800 | [diff] [blame] | 554 | "* Process %d has been suspended while crashing. To\n" |
| 555 | "* attach gdbserver for a gdb connection on port 5039:\n" |
| 556 | "*\n" |
| 557 | "* adb shell gdbserver :5039 --attach %d &\n" |
| 558 | "*\n" |
| 559 | "* Press HOME key to let the process continue crashing.\n" |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 560 | "********************************************************\n", |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 561 | cr->pid, cr->pid); |
| 562 | |
Andy McFadden | 3bfdcc9 | 2009-12-01 12:37:26 -0800 | [diff] [blame] | 563 | /* wait for HOME key (TODO: something useful for devices w/o HOME key) */ |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 564 | if (init_getevent() == 0) { |
| 565 | int ms = 1200 / 10; |
| 566 | int dit = 1; |
| 567 | int dah = 3*dit; |
| 568 | int _ = -dit; |
| 569 | int ___ = 3*_; |
| 570 | int _______ = 7*_; |
| 571 | const signed char codes[] = { |
| 572 | dit,_,dit,_,dit,___,dah,_,dah,_,dah,___,dit,_,dit,_,dit,_______ |
| 573 | }; |
| 574 | size_t s = 0; |
| 575 | struct input_event e; |
| 576 | int home = 0; |
| 577 | init_debug_led(); |
| 578 | enable_debug_led(); |
| 579 | do { |
| 580 | int timeout = abs((int)(codes[s])) * ms; |
| 581 | int res = get_event(&e, timeout); |
| 582 | if (res == 0) { |
| 583 | if (e.type==EV_KEY && e.code==KEY_HOME && e.value==0) |
| 584 | home = 1; |
| 585 | } else if (res == 1) { |
| 586 | if (++s >= sizeof(codes)/sizeof(*codes)) |
| 587 | s = 0; |
| 588 | if (codes[s] > 0) { |
| 589 | enable_debug_led(); |
| 590 | } else { |
| 591 | disable_debug_led(); |
| 592 | } |
| 593 | } |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 594 | } while (!home); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 595 | uninit_getevent(); |
| 596 | } |
| 597 | |
| 598 | /* don't forget to turn debug led off */ |
| 599 | disable_debug_led(); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 600 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 601 | /* close filedescriptor */ |
| 602 | LOG("debuggerd resuming process %d", cr->pid); |
| 603 | } |
| 604 | |
| 605 | static void handle_crashing_process(int fd) |
| 606 | { |
| 607 | char buf[64]; |
| 608 | struct stat s; |
| 609 | unsigned tid; |
| 610 | struct ucred cr; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 611 | int n, len, status; |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 612 | int tid_attach_status = -1; |
| 613 | unsigned retry = 30; |
| 614 | bool need_cleanup = false; |
| 615 | |
| 616 | char value[PROPERTY_VALUE_MAX]; |
| 617 | property_get("debug.db.uid", value, "-1"); |
| 618 | int debug_uid = atoi(value); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 619 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 620 | XLOG("handle_crashing_process(%d)\n", fd); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 621 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 622 | len = sizeof(cr); |
| 623 | n = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &cr, &len); |
| 624 | if(n != 0) { |
| 625 | LOG("cannot get credentials\n"); |
| 626 | goto done; |
| 627 | } |
| 628 | |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 629 | XLOG("reading tid\n"); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 630 | fcntl(fd, F_SETFL, O_NONBLOCK); |
| 631 | while((n = read(fd, &tid, sizeof(unsigned))) != sizeof(unsigned)) { |
| 632 | if(errno == EINTR) continue; |
| 633 | if(errno == EWOULDBLOCK) { |
| 634 | if(retry-- > 0) { |
| 635 | usleep(100 * 1000); |
| 636 | continue; |
| 637 | } |
| 638 | LOG("timed out reading tid\n"); |
| 639 | goto done; |
| 640 | } |
| 641 | LOG("read failure? %s\n", strerror(errno)); |
| 642 | goto done; |
| 643 | } |
| 644 | |
David 'Digit' Turner | 02526d4 | 2011-01-21 04:27:12 +0100 | [diff] [blame] | 645 | snprintf(buf, sizeof buf, "/proc/%d/task/%d", cr.pid, tid); |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 646 | if(stat(buf, &s)) { |
Andy McFadden | 3bfdcc9 | 2009-12-01 12:37:26 -0800 | [diff] [blame] | 647 | LOG("tid %d does not exist in pid %d. ignoring debug request\n", |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 648 | tid, cr.pid); |
| 649 | close(fd); |
| 650 | return; |
| 651 | } |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 652 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 653 | XLOG("BOOM: pid=%d uid=%d gid=%d tid=%d\n", cr.pid, cr.uid, cr.gid, tid); |
| 654 | |
David 'Digit' Turner | 02526d4 | 2011-01-21 04:27:12 +0100 | [diff] [blame] | 655 | /* Note that at this point, the target thread's signal handler |
| 656 | * is blocked in a read() call. This gives us the time to PTRACE_ATTACH |
| 657 | * to it before it has a chance to really fault. |
| 658 | * |
| 659 | * After the attach, the thread is stopped, and we write to the file |
| 660 | * descriptor to ensure that it will run as soon as we call PTRACE_CONT |
| 661 | * below. See details in bionic/libc/linker/debugger.c, in function |
| 662 | * debugger_signal_handler(). |
| 663 | */ |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 664 | tid_attach_status = ptrace(PTRACE_ATTACH, tid, 0, 0); |
David 'Digit' Turner | 02526d4 | 2011-01-21 04:27:12 +0100 | [diff] [blame] | 665 | |
| 666 | TEMP_FAILURE_RETRY(write(fd, &tid, 1)); |
| 667 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 668 | if(tid_attach_status < 0) { |
| 669 | LOG("ptrace attach failed: %s\n", strerror(errno)); |
| 670 | goto done; |
| 671 | } |
| 672 | |
| 673 | close(fd); |
| 674 | fd = -1; |
| 675 | |
| 676 | for(;;) { |
| 677 | n = waitpid(tid, &status, __WALL); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 678 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 679 | if(n < 0) { |
| 680 | if(errno == EAGAIN) continue; |
| 681 | LOG("waitpid failed: %s\n", strerror(errno)); |
| 682 | goto done; |
| 683 | } |
| 684 | |
| 685 | XLOG("waitpid: n=%d status=%08x\n", n, status); |
| 686 | |
| 687 | if(WIFSTOPPED(status)){ |
| 688 | n = WSTOPSIG(status); |
| 689 | switch(n) { |
| 690 | case SIGSTOP: |
| 691 | XLOG("stopped -- continuing\n"); |
| 692 | n = ptrace(PTRACE_CONT, tid, 0, 0); |
| 693 | if(n) { |
| 694 | LOG("ptrace failed: %s\n", strerror(errno)); |
| 695 | goto done; |
| 696 | } |
| 697 | continue; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 698 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 699 | case SIGILL: |
| 700 | case SIGABRT: |
| 701 | case SIGBUS: |
| 702 | case SIGFPE: |
| 703 | case SIGSEGV: |
| 704 | case SIGSTKFLT: { |
| 705 | XLOG("stopped -- fatal signal\n"); |
| 706 | need_cleanup = engrave_tombstone(cr.pid, tid, debug_uid, n); |
| 707 | kill(tid, SIGSTOP); |
| 708 | goto done; |
| 709 | } |
| 710 | |
| 711 | default: |
| 712 | XLOG("stopped -- unexpected signal\n"); |
| 713 | goto done; |
| 714 | } |
| 715 | } else { |
| 716 | XLOG("unexpected waitpid response\n"); |
| 717 | goto done; |
| 718 | } |
| 719 | } |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 720 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 721 | done: |
| 722 | XLOG("detaching\n"); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 723 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 724 | /* stop the process so we can debug */ |
| 725 | kill(cr.pid, SIGSTOP); |
| 726 | |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 727 | /* |
| 728 | * If a thread has been attached by ptrace, make sure it is detached |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 729 | * successfully otherwise we will get a zombie. |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 730 | */ |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 731 | if (tid_attach_status == 0) { |
| 732 | int detach_status; |
| 733 | /* detach so we can attach gdbserver */ |
| 734 | detach_status = ptrace(PTRACE_DETACH, tid, 0, 0); |
| 735 | need_cleanup |= (detach_status != 0); |
| 736 | } |
| 737 | |
| 738 | /* |
| 739 | * if debug.db.uid is set, its value indicates if we should wait |
| 740 | * for user action for the crashing process. |
| 741 | * in this case, we log a message and turn the debug LED on |
| 742 | * waiting for a gdb connection (for instance) |
| 743 | */ |
| 744 | |
| 745 | if ((signed)cr.uid <= debug_uid) { |
| 746 | wait_for_user_action(tid, &cr); |
| 747 | } |
| 748 | |
| 749 | /* resume stopped process (so it can crash in peace) */ |
| 750 | kill(cr.pid, SIGCONT); |
| 751 | |
| 752 | if (need_cleanup) { |
| 753 | LOG("debuggerd committing suicide to free the zombie!\n"); |
| 754 | kill(getpid(), SIGKILL); |
| 755 | } |
| 756 | |
| 757 | if(fd != -1) close(fd); |
| 758 | } |
| 759 | |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 760 | |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 761 | int main() |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 762 | { |
| 763 | int s; |
| 764 | struct sigaction act; |
Bruce Beare | 8492490 | 2010-10-13 14:21:30 -0700 | [diff] [blame] | 765 | int logsocket = -1; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 766 | |
| 767 | logsocket = socket_local_client("logd", |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 768 | ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_DGRAM); |
| 769 | if(logsocket < 0) { |
| 770 | logsocket = -1; |
| 771 | } else { |
| 772 | fcntl(logsocket, F_SETFD, FD_CLOEXEC); |
| 773 | } |
| 774 | |
| 775 | act.sa_handler = SIG_DFL; |
| 776 | sigemptyset(&act.sa_mask); |
| 777 | sigaddset(&act.sa_mask,SIGCHLD); |
| 778 | act.sa_flags = SA_NOCLDWAIT; |
| 779 | sigaction(SIGCHLD, &act, 0); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 780 | |
| 781 | s = socket_local_server("android:debuggerd", |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 782 | ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM); |
| 783 | if(s < 0) return -1; |
| 784 | fcntl(s, F_SETFD, FD_CLOEXEC); |
| 785 | |
| 786 | LOG("debuggerd: " __DATE__ " " __TIME__ "\n"); |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 787 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 788 | for(;;) { |
| 789 | struct sockaddr addr; |
| 790 | socklen_t alen; |
| 791 | int fd; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 792 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 793 | alen = sizeof(addr); |
| 794 | fd = accept(s, &addr, &alen); |
| 795 | if(fd < 0) continue; |
Ben Cheng | 09e7137 | 2009-09-28 11:06:09 -0700 | [diff] [blame] | 796 | |
The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 797 | fcntl(fd, F_SETFD, FD_CLOEXEC); |
| 798 | |
| 799 | handle_crashing_process(fd); |
| 800 | } |
| 801 | return 0; |
| 802 | } |