#
342704 |
|
02-Jan-2019 |
jhb |
MFC 341800: Don't report stale signal information in ptrace_lwpinfo.
Once a signal's siginfo was copied to 'td_si' as part of the signal exchange in issignal(), it was never cleared. This caused future thread events that are reported as SIGTRAP events without signal information to report the stale siginfo in 'td_si'. For example, if a debugger created a new process and used SIGSTOP to stop it after PT_ATTACH, future system call entry / exit events would set PL_FLAG_SI with the SIGSTOP siginfo in pl_siginfo. This broke 'catch syscall' in current versions of gdb as it assumed PL_FLAG_SI with SIGTRAP indicates a breakpoint or single step trap.
|
#
328384 |
|
25-Jan-2018 |
jhb |
MFC 287600,287602: Fixes for fork following tests.
287600: Properly size the children[] arrays in the follow fork tests.
287602: Use _exit() instead of exit() in child processes created during tests.
|
#
328379 |
|
24-Jan-2018 |
jhb |
MFC 325028,328344: Discard the correct thread event reported for a ptrace stop.
325028: Discard the correct thread event reported for a ptrace stop.
When multiple threads wish to report a tracing event to a debugger, both threads call ptracestop() and one thread will win the race to be the reporting thread (p->p_xthread). The debugger uses PT_LWPINFO with the process ID to determine which thread / LWP is reporting an event and the details of that event. This event is cleared as a side effect of the subsequent ptrace event that resumed the process (PT_CONTINUE, PT_STEP, etc.). However, ptrace() was clearing the event identified by the LWP ID passed to the resume request even if that wasn't the 'p_xthread'. This could result in clearing an event that had not yet been observed by the debugger and leaving the existing event for 'p_thread' pending so that it was reported a second time.
Specifically, if the debugger stopped due to a software breakpoint in one thread, but then switched to another thread that was used to resume (e.g. if the user switched to a different thread and issued a step), the resume request (PT_STEP) cleared a pending event (if any) for the thread being stepped. However, the process immediately stopped and the first thread reported it's breakpoint event a second time. The debugger decremented the PC for "both" breakpoint events which resulted in the PC now pointing into the middle of an instruction (on x86) and a SIGILL fault when the process was resumed a second time.
To fix, always clear the pending event for 'p_xthread' when resuming a process. ptrace() still honors the requested LWP ID when enabling single-stepping (PT_STEP) or setting a different PC (PT_CONTINUE).
328344: Mark the unused argument to continue_thread() as such.
clang in HEAD and 11 does not warn about this, but clang in 10 does.
|
#
328309 |
|
24-Jan-2018 |
jhb |
MFC 326953: Catch up to r325719 which makes the kern.proc.pid sysctl "work" for zombies.
Some of the ptrace tests need to wait for a child process to become a zombie before preceding. The parent process polls the child process via the kern.proc.pid sysctl to wait for it to become a zombie. Previously the code polled until the sysctl failed with ESRCH. Now it will poll until either the sysctl fails with ESRCH (for compatiblity with older kernels) or returns a kinfo_proc structure with the ki_stat field set to SZOMB.
|
#
315963 |
|
25-Mar-2017 |
badger |
MFC r315412, r314852:
r315412: Don't clear p_ptevents on normal SIGKILL delivery
The ptrace() user has the option of discarding the signal. In such a case, p_ptevents should not be modified. If the ptrace() user decides to send a SIGKILL, ptevents will be cleared in ptracestop(). procfs events do not have the capability to discard the signal, so continue to clear the mask in that case.
r314852: don't stop in issignal() if P_SINGLE_EXIT is set
Suppose a traced process is stopped in ptracestop() due to receipt of a SIGSTOP signal, and is awaiting orders from the tracing process on how to handle the signal. Before sending any such orders, the tracing process exits. This should kill the traced process. But suppose a second thread handles the SIGKILL and proceeds to exit1(), calling thread_single(). The first thread will now awaken and will have a chance to check once more if it should go to sleep due to the SIGSTOP. It must not sleep after P_SINGLE_EXIT has been set; this would prevent the SIGKILL from taking effect, leaving a stopped orphan behind after the tracing process dies.
Also add new tests for this condition.
Sponsored by: Dell EMC
|
#
315949 |
|
25-Mar-2017 |
badger |
MFC r313992, r314075, r314118, r315484:
r315484: ptrace_test: eliminate assumption about thread scheduling
A couple of the ptrace tests make assumptions about which thread in a multithreaded process will run after a halt. This makes the tests less portable across branches, and susceptible to future breakage. Instead, twiddle thread scheduling and priorities to match the tests' expectation.
r314118: Actually fix buildworlds other than i386/amd64/sparc64 after r313992
Disable offending test for platforms without a userspace visible breakpoint().
r314075: Fix world build for archs where __builtin_debugtrap() does not work.
The offending code was introduced in r313992.
r313992: Defer ptracestop() signals that cannot be delivered immediately
When a thread is stopped in ptracestop(), the ptrace(2) user may request a signal be delivered upon resumption of the thread. Heretofore, those signals were discarded unless ptracestop()'s caller was issignal(). Fix this by modifying ptracestop() to queue up signals requested by the ptrace user that will be delivered when possible. Take special care when the signal is SIGKILL (usually generated from a PT_KILL request); no new stop events should be triggered after a PT_KILL.
Add a number of tests for the new functionality. Several tests were authored by jhb.
PR: 212607 Sponsored by: Dell EMC
|
#
304499 |
|
19-Aug-2016 |
jhb |
MFC 303001: Add PTRACE_VFORK to trace vfork events.
First, PL_FLAG_FORKED events now also set a PL_FLAG_VFORKED flag when the new child was created via vfork() rather than fork(). Second, a new PL_FLAG_VFORK_DONE event can now be enabled via the PTRACE_VFORK event mask. This new stop is reported after the vfork parent resumes due to the child calling exit or exec. Debuggers can use this stop to reinsert breakpoints in the vfork parent process before it resumes.
|
#
304188 |
|
15-Aug-2016 |
jhb |
MFC 302900,302902,302921,303461,304009: Add a mask of optional ptrace() events.
302900: Add a test for user signal delivery.
This test verifies we get the correct ptrace event details when a signal is posted to a traced process from userland.
302902: Add a mask of optional ptrace() events.
ptrace() now stores a mask of optional events in p_ptevents. Currently this mask is a single integer, but it can be expanded into an array of integers in the future.
Two new ptrace requests can be used to manipulate the event mask: PT_GET_EVENT_MASK fetches the current event mask and PT_SET_EVENT_MASK sets the current event mask.
The current set of events include: - PTRACE_EXEC: trace calls to execve(). - PTRACE_SCE: trace system call entries. - PTRACE_SCX: trace syscam call exits. - PTRACE_FORK: trace forks and auto-attach to new child processes. - PTRACE_LWP: trace LWP events.
The S_PT_SCX and S_PT_SCE events in the procfs p_stops flags have been replaced by PTRACE_SCE and PTRACE_SCX. PTRACE_FORK replaces P_FOLLOW_FORK and PTRACE_LWP replaces P2_LWP_EVENTS.
The PT_FOLLOW_FORK and PT_LWP_EVENTS ptrace requests remain for compatibility but now simply toggle corresponding flags in the event mask.
While here, document that PT_SYSCALL, PT_TO_SCE, and PT_TO_SCX both modify the event mask and continue the traced process.
302921: Rename PTRACE_SYSCALL to LINUX_PTRACE_SYSCALL.
303461: Note that not all optional ptrace events use SIGTRAP.
New child processes attached due to PTRACE_FORK use SIGSTOP instead of SIGTRAP. All other ptrace events use SIGTRAP.
304009: Remove description of P_FOLLOWFORK as this flag was removed.
|
#
304017 |
|
12-Aug-2016 |
jhb |
MFC 292894,292896: Add ptrace(2) reporting for LWP events.
292894: Add ptrace(2) reporting for LWP events.
Add two new LWPINFO flags: PL_FLAG_BORN and PL_FLAG_EXITED for reporting thread creation and destruction. Newly created threads will stop to report PL_FLAG_BORN before returning to userland and exiting threads will stop to report PL_FLAG_EXIT before exiting completely. Both of these events are only enabled and reported if PT_LWP_EVENTS is enabled on a process.
292896: Document the recently added support for ptrace(2) LWP events.
|
#
293270 |
|
06-Jan-2016 |
ngie |
MFC r288961,r288962:
r288961 (by bdrewery):
Fix build with older GCC which, doesn't like 'main' being a variable name.
r288962 (by jhb):
Tweak: use 'mainlwp' instead of 'mainpid' since this is a thread (LWP) identifier, not a pid.
|
#
289780 |
|
22-Oct-2015 |
jhb |
MFC 287386,288949,288993: Export current system call code and argument count for system call entry and exit events. To preserve the ABI, the new fields are moved to the end of struct thread in these branches (unlike HEAD) and explicitly copied when new threads are created. In addition, the new tests are only added in 10.
r287386: Export current system call code and argument count for system call entry and exit events. procfs stop events for system call tracing report these values (argument count for system call entry and code for system call exit), but ptrace() does not provide this information. (Note that while the system call code can be determined in an ABI-specific manner during system call entry, it is not generally available during system call exit.)
The values are exported via new fields at the end of struct ptrace_lwpinfo available via PT_LWPINFO.
r288949: Fix various edge cases related to system call tracing. - Always set td_dbg_sc_* when P_TRACED is set on system call entry even if the debugger is not tracing system call entries. This ensures the fields are valid when reporting other stops that occur at system call boundaries such as for PT_FOLLOW_FORKS or when only tracing system call exits. - Set TDB_SCX when reporting the stop for a new child process in fork_return(). This causes the event to be reported as a system call exit. - Report a system call exit event in fork_return() for new threads in a traced process. - Copy td_dbg_sc_* to new threads instead of zeroing. This ensures that td_dbg_sc_code in particular will report the system call that created the new thread or process when it reports a system call exit event in fork_return(). - Add new ptrace tests to verify that new child processes and threads report system call exit events with a valid pl_syscall_code via PT_LWPINFO.
r288993: Document the recently added pl_syscall_* fields in struct ptrace_lwpinfo.
|
#
287604 |
|
09-Sep-2015 |
jhb |
MFC 283281,283282,283562,283647,283836,284000,286158: Various fixes to orphan handling which also fix issues with following forks.
283281: Always set p_oppid when attaching to an existing process via procfs tracing. This matches the behavior of ptrace(PT_ATTACH). Also, the procfs detach request assumes p_oppid is always set.
283282: Only reparent a traced process to its old parent if the tracing process is not the old parent. Otherwise, proc_reap() will leave the zombie in place resulting in the process' status being returned twice to its parent.
Add test cases for PT_TRACE_ME and PT_ATTACH which are fixed by this change.
283562: Do not allow a process to reap an orphan (a child currently being traced by another process such as a debugger). The parent process does need to check for matching orphan pids to avoid returning ECHILD if an orphan has exited, but it should not return the exited status for the child until after the debugger has detached from the orphan process either explicitly or implicitly via wait().
Add two tests for for this case: one where the debugger is the direct child (thus the parent has a non-empty children list) and one where the debugger is not a direct child (so the only "child" of the parent is the orphan).
283647: Tweak the description of when waitpid() doesn't return any status for a non-blocking wait to avoid the word "empty".
283836: Consistently only use one end of the pipe in the parent and debugger processes and do not rely on EOF due to a close() in the debugger.
284000: Add a CHILD_REQUIRE macro similar to ATF_REQUIRE for use in child processes of the main test process.
286158: Clear P_TRACED before reparenting a detached process back to its original parent. Otherwise the debugee will be set as an orphan of the debugger.
Add tests for tracing forks via PT_FOLLOW_FORK.
|
#
287604 |
|
09-Sep-2015 |
jhb |
MFC 283281,283282,283562,283647,283836,284000,286158: Various fixes to orphan handling which also fix issues with following forks.
283281: Always set p_oppid when attaching to an existing process via procfs tracing. This matches the behavior of ptrace(PT_ATTACH). Also, the procfs detach request assumes p_oppid is always set.
283282: Only reparent a traced process to its old parent if the tracing process is not the old parent. Otherwise, proc_reap() will leave the zombie in place resulting in the process' status being returned twice to its parent.
Add test cases for PT_TRACE_ME and PT_ATTACH which are fixed by this change.
283562: Do not allow a process to reap an orphan (a child currently being traced by another process such as a debugger). The parent process does need to check for matching orphan pids to avoid returning ECHILD if an orphan has exited, but it should not return the exited status for the child until after the debugger has detached from the orphan process either explicitly or implicitly via wait().
Add two tests for for this case: one where the debugger is the direct child (thus the parent has a non-empty children list) and one where the debugger is not a direct child (so the only "child" of the parent is the orphan).
283647: Tweak the description of when waitpid() doesn't return any status for a non-blocking wait to avoid the word "empty".
283836: Consistently only use one end of the pipe in the parent and debugger processes and do not rely on EOF due to a close() in the debugger.
284000: Add a CHILD_REQUIRE macro similar to ATF_REQUIRE for use in child processes of the main test process.
286158: Clear P_TRACED before reparenting a detached process back to its original parent. Otherwise the debugee will be set as an orphan of the debugger.
Add tests for tracing forks via PT_FOLLOW_FORK.
|