| The Android Open Source Project | dd7bc33 | 2009-03-03 19:32:55 -0800 | [diff] [blame] | 1 | /* system/debuggerd/debuggerd.c | 
|  | 2 | ** | 
|  | 3 | ** Copyright 2006, The Android Open Source Project | 
|  | 4 | ** | 
|  | 5 | ** Licensed under the Apache License, Version 2.0 (the "License"); | 
|  | 6 | ** you may not use this file except in compliance with the License. | 
|  | 7 | ** You may obtain a copy of the License at | 
|  | 8 | ** | 
|  | 9 | **     http://www.apache.org/licenses/LICENSE-2.0 | 
|  | 10 | ** | 
|  | 11 | ** Unless required by applicable law or agreed to in writing, software | 
|  | 12 | ** distributed under the License is distributed on an "AS IS" BASIS, | 
|  | 13 | ** WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | 
|  | 14 | ** See the License for the specific language governing permissions and | 
|  | 15 | ** limitations under the License. | 
|  | 16 | */ | 
|  | 17 |  | 
|  | 18 | #include <stdio.h> | 
|  | 19 | #include <stdlib.h> | 
|  | 20 | #include <unistd.h> | 
|  | 21 | #include <errno.h> | 
|  | 22 | #include <signal.h> | 
|  | 23 | #include <pthread.h> | 
|  | 24 | #include <stdarg.h> | 
|  | 25 | #include <fcntl.h> | 
|  | 26 | #include <sys/types.h> | 
|  | 27 | #include <dirent.h> | 
|  | 28 |  | 
|  | 29 | #include <sys/ptrace.h> | 
|  | 30 | #include <sys/wait.h> | 
|  | 31 | #include <sys/exec_elf.h> | 
|  | 32 | #include <sys/stat.h> | 
|  | 33 |  | 
|  | 34 | #include <cutils/sockets.h> | 
|  | 35 | #include <cutils/logd.h> | 
|  | 36 | #include <cutils/sockets.h> | 
|  | 37 | #include <cutils/properties.h> | 
|  | 38 |  | 
|  | 39 | #include <linux/input.h> | 
|  | 40 |  | 
|  | 41 | #include <private/android_filesystem_config.h> | 
|  | 42 |  | 
|  | 43 | #include "utility.h" | 
|  | 44 |  | 
|  | 45 | /* Main entry point to get the backtrace from the crashing process */ | 
|  | 46 | extern int unwind_backtrace_with_ptrace(int tfd, pid_t pid, mapinfo *map, | 
|  | 47 | unsigned int sp_list[], | 
|  | 48 | int *frame0_pc_sane, | 
|  | 49 | bool at_fault); | 
|  | 50 |  | 
|  | 51 | static char **process_name_ptr; | 
|  | 52 |  | 
|  | 53 | static int logsocket = -1; | 
|  | 54 |  | 
|  | 55 | #define ANDROID_LOG_INFO 4 | 
|  | 56 |  | 
|  | 57 | /* Log information onto the tombstone */ | 
|  | 58 | void _LOG(int tfd, bool in_tombstone_only, const char *fmt, ...) | 
|  | 59 | { | 
|  | 60 | char buf[128]; | 
|  | 61 |  | 
|  | 62 | va_list ap; | 
|  | 63 | va_start(ap, fmt); | 
|  | 64 |  | 
|  | 65 | if (tfd >= 0) { | 
|  | 66 | int len; | 
|  | 67 | vsnprintf(buf, sizeof(buf), fmt, ap); | 
|  | 68 | len = strlen(buf); | 
|  | 69 | if(tfd >= 0) write(tfd, buf, len); | 
|  | 70 | } | 
|  | 71 |  | 
|  | 72 | if (!in_tombstone_only) | 
|  | 73 | __android_log_vprint(ANDROID_LOG_INFO, "DEBUG", fmt, ap); | 
|  | 74 | } | 
|  | 75 |  | 
|  | 76 | #define LOG(fmt...) _LOG(-1, 0, fmt) | 
|  | 77 | #if 0 | 
|  | 78 | #define XLOG(fmt...) _LOG(-1, 0, fmt) | 
|  | 79 | #else | 
|  | 80 | #define XLOG(fmt...) do {} while(0) | 
|  | 81 | #endif | 
|  | 82 |  | 
|  | 83 | // 6f000000-6f01e000 rwxp 00000000 00:0c 16389419   /system/lib/libcomposer.so | 
|  | 84 | // 012345678901234567890123456789012345678901234567890123456789 | 
|  | 85 | // 0         1         2         3         4         5 | 
|  | 86 |  | 
|  | 87 | mapinfo *parse_maps_line(char *line) | 
|  | 88 | { | 
|  | 89 | mapinfo *mi; | 
|  | 90 | int len = strlen(line); | 
|  | 91 |  | 
|  | 92 | if(len < 1) return 0; | 
|  | 93 | line[--len] = 0; | 
|  | 94 |  | 
|  | 95 | if(len < 50) return 0; | 
|  | 96 | if(line[20] != 'x') return 0; | 
|  | 97 |  | 
|  | 98 | mi = malloc(sizeof(mapinfo) + (len - 47)); | 
|  | 99 | if(mi == 0) return 0; | 
|  | 100 |  | 
|  | 101 | mi->start = strtoul(line, 0, 16); | 
|  | 102 | mi->end = strtoul(line + 9, 0, 16); | 
|  | 103 | /* To be filled in parse_exidx_info if the mapped section starts with | 
|  | 104 | * elf_header | 
|  | 105 | */ | 
|  | 106 | mi->exidx_start = mi->exidx_end = 0; | 
|  | 107 | mi->next = 0; | 
|  | 108 | strcpy(mi->name, line + 49); | 
|  | 109 |  | 
|  | 110 | return mi; | 
|  | 111 | } | 
|  | 112 |  | 
|  | 113 | void dump_build_info(int tfd) | 
|  | 114 | { | 
|  | 115 | char fingerprint[PROPERTY_VALUE_MAX]; | 
|  | 116 |  | 
|  | 117 | property_get("ro.build.fingerprint", fingerprint, "unknown"); | 
|  | 118 |  | 
|  | 119 | _LOG(tfd, false, "Build fingerprint: '%s'\n", fingerprint); | 
|  | 120 | } | 
|  | 121 |  | 
|  | 122 |  | 
|  | 123 | void dump_stack_and_code(int tfd, int pid, mapinfo *map, | 
|  | 124 | int unwind_depth, unsigned int sp_list[], | 
|  | 125 | int frame0_pc_sane, bool at_fault) | 
|  | 126 | { | 
|  | 127 | unsigned int sp, pc, p, end, data; | 
|  | 128 | struct pt_regs r; | 
|  | 129 | int sp_depth; | 
|  | 130 | bool only_in_tombstone = !at_fault; | 
|  | 131 |  | 
|  | 132 | if(ptrace(PTRACE_GETREGS, pid, 0, &r)) return; | 
|  | 133 | sp = r.ARM_sp; | 
|  | 134 | pc = r.ARM_pc; | 
|  | 135 |  | 
|  | 136 | /* Died because calling the weeds - dump | 
|  | 137 | * the code around the PC in the next frame instead. | 
|  | 138 | */ | 
|  | 139 | if (frame0_pc_sane == 0) { | 
|  | 140 | pc = r.ARM_lr; | 
|  | 141 | } | 
|  | 142 |  | 
|  | 143 | _LOG(tfd, true, "code%s:\n", frame0_pc_sane ? "" : " (around frame #01)"); | 
|  | 144 |  | 
|  | 145 | end = p = pc & ~3; | 
|  | 146 | p -= 16; | 
|  | 147 |  | 
|  | 148 | /* Dump the code as: | 
|  | 149 | *  PC         contents | 
|  | 150 | *  00008d34   fffffcd0 4c0eb530 b0934a0e 1c05447c | 
|  | 151 | *  00008d44   f7ff18a0 490ced94 68035860 d0012b00 | 
|  | 152 | */ | 
|  | 153 | while (p <= end) { | 
|  | 154 | int i; | 
|  | 155 |  | 
|  | 156 | _LOG(tfd, true, " %08x  ", p); | 
|  | 157 | for (i = 0; i < 4; i++) { | 
|  | 158 | data = ptrace(PTRACE_PEEKTEXT, pid, (void*)p, NULL); | 
|  | 159 | _LOG(tfd, true, " %08x", data); | 
|  | 160 | p += 4; | 
|  | 161 | } | 
|  | 162 | _LOG(tfd, true, "\n", p); | 
|  | 163 | } | 
|  | 164 |  | 
|  | 165 | p = sp - 64; | 
|  | 166 | p &= ~3; | 
|  | 167 | if (unwind_depth != 0) { | 
|  | 168 | if (unwind_depth < STACK_CONTENT_DEPTH) { | 
|  | 169 | end = sp_list[unwind_depth-1]; | 
|  | 170 | } | 
|  | 171 | else { | 
|  | 172 | end = sp_list[STACK_CONTENT_DEPTH-1]; | 
|  | 173 | } | 
|  | 174 | } | 
|  | 175 | else { | 
|  | 176 | end = sp | 0x000000ff; | 
|  | 177 | end += 0xff; | 
|  | 178 | } | 
|  | 179 |  | 
|  | 180 | _LOG(tfd, only_in_tombstone, "stack:\n"); | 
|  | 181 |  | 
|  | 182 | /* If the crash is due to PC == 0, there will be two frames that | 
|  | 183 | * have identical SP value. | 
|  | 184 | */ | 
|  | 185 | if (sp_list[0] == sp_list[1]) { | 
|  | 186 | sp_depth = 1; | 
|  | 187 | } | 
|  | 188 | else { | 
|  | 189 | sp_depth = 0; | 
|  | 190 | } | 
|  | 191 |  | 
|  | 192 | while (p <= end) { | 
|  | 193 | char *prompt; | 
|  | 194 | char level[16]; | 
|  | 195 | data = ptrace(PTRACE_PEEKTEXT, pid, (void*)p, NULL); | 
|  | 196 | if (p == sp_list[sp_depth]) { | 
|  | 197 | sprintf(level, "#%02d", sp_depth++); | 
|  | 198 | prompt = level; | 
|  | 199 | } | 
|  | 200 | else { | 
|  | 201 | prompt = "   "; | 
|  | 202 | } | 
|  | 203 |  | 
|  | 204 | /* Print the stack content in the log for the first 3 frames. For the | 
|  | 205 | * rest only print them in the tombstone file. | 
|  | 206 | */ | 
|  | 207 | _LOG(tfd, (sp_depth > 2) || only_in_tombstone, | 
|  | 208 | "%s %08x  %08x  %s\n", prompt, p, data, | 
|  | 209 | map_to_name(map, data, "")); | 
|  | 210 | p += 4; | 
|  | 211 | } | 
|  | 212 | /* print another 64-byte of stack data after the last frame */ | 
|  | 213 |  | 
|  | 214 | end = p+64; | 
|  | 215 | while (p <= end) { | 
|  | 216 | data = ptrace(PTRACE_PEEKTEXT, pid, (void*)p, NULL); | 
|  | 217 | _LOG(tfd, (sp_depth > 2) || only_in_tombstone, | 
|  | 218 | "    %08x  %08x  %s\n", p, data, | 
|  | 219 | map_to_name(map, data, "")); | 
|  | 220 | p += 4; | 
|  | 221 | } | 
|  | 222 | } | 
|  | 223 |  | 
|  | 224 | void dump_pc_and_lr(int tfd, int pid, mapinfo *map, int unwound_level, | 
|  | 225 | bool at_fault) | 
|  | 226 | { | 
|  | 227 | struct pt_regs r; | 
|  | 228 |  | 
|  | 229 | if(ptrace(PTRACE_GETREGS, pid, 0, &r)) { | 
|  | 230 | _LOG(tfd, !at_fault, "tid %d not responding!\n", pid); | 
|  | 231 | return; | 
|  | 232 | } | 
|  | 233 |  | 
|  | 234 | if (unwound_level == 0) { | 
|  | 235 | _LOG(tfd, !at_fault, "         #%02d  pc %08x  %s\n", 0, r.ARM_pc, | 
|  | 236 | map_to_name(map, r.ARM_pc, "<unknown>")); | 
|  | 237 | } | 
|  | 238 | _LOG(tfd, !at_fault, "         #%02d  lr %08x  %s\n", 1, r.ARM_lr, | 
|  | 239 | map_to_name(map, r.ARM_lr, "<unknown>")); | 
|  | 240 | } | 
|  | 241 |  | 
|  | 242 | void dump_registers(int tfd, int pid, bool at_fault) | 
|  | 243 | { | 
|  | 244 | struct pt_regs r; | 
|  | 245 | bool only_in_tombstone = !at_fault; | 
|  | 246 |  | 
|  | 247 | if(ptrace(PTRACE_GETREGS, pid, 0, &r)) { | 
|  | 248 | _LOG(tfd, only_in_tombstone, | 
|  | 249 | "cannot get registers: %s\n", strerror(errno)); | 
|  | 250 | return; | 
|  | 251 | } | 
|  | 252 |  | 
|  | 253 | _LOG(tfd, only_in_tombstone, " r0 %08x  r1 %08x  r2 %08x  r3 %08x\n", | 
|  | 254 | r.ARM_r0, r.ARM_r1, r.ARM_r2, r.ARM_r3); | 
|  | 255 | _LOG(tfd, only_in_tombstone, " r4 %08x  r5 %08x  r6 %08x  r7 %08x\n", | 
|  | 256 | r.ARM_r4, r.ARM_r5, r.ARM_r6, r.ARM_r7); | 
|  | 257 | _LOG(tfd, only_in_tombstone, " r8 %08x  r9 %08x  10 %08x  fp %08x\n", | 
|  | 258 | r.ARM_r8, r.ARM_r9, r.ARM_r10, r.ARM_fp); | 
|  | 259 | _LOG(tfd, only_in_tombstone, | 
|  | 260 | " ip %08x  sp %08x  lr %08x  pc %08x  cpsr %08x\n", | 
|  | 261 | r.ARM_ip, r.ARM_sp, r.ARM_lr, r.ARM_pc, r.ARM_cpsr); | 
|  | 262 | } | 
|  | 263 |  | 
|  | 264 | const char *get_signame(int sig) | 
|  | 265 | { | 
|  | 266 | switch(sig) { | 
|  | 267 | case SIGILL:     return "SIGILL"; | 
|  | 268 | case SIGABRT:    return "SIGABRT"; | 
|  | 269 | case SIGBUS:     return "SIGBUS"; | 
|  | 270 | case SIGFPE:     return "SIGFPE"; | 
|  | 271 | case SIGSEGV:    return "SIGSEGV"; | 
|  | 272 | case SIGSTKFLT:  return "SIGSTKFLT"; | 
|  | 273 | default:         return "?"; | 
|  | 274 | } | 
|  | 275 | } | 
|  | 276 |  | 
|  | 277 | void dump_fault_addr(int tfd, int pid, int sig) | 
|  | 278 | { | 
|  | 279 | siginfo_t si; | 
|  | 280 |  | 
|  | 281 | memset(&si, 0, sizeof(si)); | 
|  | 282 | if(ptrace(PTRACE_GETSIGINFO, pid, 0, &si)){ | 
|  | 283 | _LOG(tfd, false, "cannot get siginfo: %s\n", strerror(errno)); | 
|  | 284 | } else { | 
|  | 285 | _LOG(tfd, false, "signal %d (%s), fault addr %08x\n", | 
|  | 286 | sig, get_signame(sig), si.si_addr); | 
|  | 287 | } | 
|  | 288 | } | 
|  | 289 |  | 
|  | 290 | void dump_crash_banner(int tfd, unsigned pid, unsigned tid, int sig) | 
|  | 291 | { | 
|  | 292 | char data[1024]; | 
|  | 293 | char *x = 0; | 
|  | 294 | FILE *fp; | 
|  | 295 |  | 
|  | 296 | sprintf(data, "/proc/%d/cmdline", pid); | 
|  | 297 | fp = fopen(data, "r"); | 
|  | 298 | if(fp) { | 
|  | 299 | x = fgets(data, 1024, fp); | 
|  | 300 | fclose(fp); | 
|  | 301 | } | 
|  | 302 |  | 
|  | 303 | _LOG(tfd, false, | 
|  | 304 | "*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***\n"); | 
|  | 305 | dump_build_info(tfd); | 
|  | 306 | _LOG(tfd, false, "pid: %d, tid: %d  >>> %s <<<\n", | 
|  | 307 | pid, tid, x ? x : "UNKNOWN"); | 
|  | 308 |  | 
|  | 309 | if(sig) dump_fault_addr(tfd, tid, sig); | 
|  | 310 | } | 
|  | 311 |  | 
|  | 312 | static void parse_exidx_info(mapinfo *milist, pid_t pid) | 
|  | 313 | { | 
|  | 314 | mapinfo *mi; | 
|  | 315 | for (mi = milist; mi != NULL; mi = mi->next) { | 
|  | 316 | Elf32_Ehdr ehdr; | 
|  | 317 |  | 
|  | 318 | memset(&ehdr, 0, sizeof(Elf32_Ehdr)); | 
|  | 319 | /* Read in sizeof(Elf32_Ehdr) worth of data from the beginning of | 
|  | 320 | * mapped section. | 
|  | 321 | */ | 
|  | 322 | get_remote_struct(pid, (void *) (mi->start), &ehdr, | 
|  | 323 | sizeof(Elf32_Ehdr)); | 
|  | 324 | /* Check if it has the matching magic words */ | 
|  | 325 | if (IS_ELF(ehdr)) { | 
|  | 326 | Elf32_Phdr phdr; | 
|  | 327 | Elf32_Phdr *ptr; | 
|  | 328 | int i; | 
|  | 329 |  | 
|  | 330 | ptr = (Elf32_Phdr *) (mi->start + ehdr.e_phoff); | 
|  | 331 | for (i = 0; i < ehdr.e_phnum; i++) { | 
|  | 332 | /* Parse the program header */ | 
|  | 333 | get_remote_struct(pid, (void *) ptr+i, &phdr, | 
|  | 334 | sizeof(Elf32_Phdr)); | 
|  | 335 | /* Found a EXIDX segment? */ | 
|  | 336 | if (phdr.p_type == PT_ARM_EXIDX) { | 
|  | 337 | mi->exidx_start = mi->start + phdr.p_offset; | 
|  | 338 | mi->exidx_end = mi->exidx_start + phdr.p_filesz; | 
|  | 339 | break; | 
|  | 340 | } | 
|  | 341 | } | 
|  | 342 | } | 
|  | 343 | } | 
|  | 344 | } | 
|  | 345 |  | 
|  | 346 | void dump_crash_report(int tfd, unsigned pid, unsigned tid, bool at_fault) | 
|  | 347 | { | 
|  | 348 | char data[1024]; | 
|  | 349 | FILE *fp; | 
|  | 350 | mapinfo *milist = 0; | 
|  | 351 | unsigned int sp_list[STACK_CONTENT_DEPTH]; | 
|  | 352 | int stack_depth; | 
|  | 353 | int frame0_pc_sane = 1; | 
|  | 354 |  | 
|  | 355 | if (!at_fault) { | 
|  | 356 | _LOG(tfd, true, | 
|  | 357 | "--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---\n"); | 
|  | 358 | _LOG(tfd, true, "pid: %d, tid: %d\n", pid, tid); | 
|  | 359 | } | 
|  | 360 |  | 
|  | 361 | dump_registers(tfd, tid, at_fault); | 
|  | 362 |  | 
|  | 363 | /* Clear stack pointer records */ | 
|  | 364 | memset(sp_list, 0, sizeof(sp_list)); | 
|  | 365 |  | 
|  | 366 | sprintf(data, "/proc/%d/maps", pid); | 
|  | 367 | fp = fopen(data, "r"); | 
|  | 368 | if(fp) { | 
|  | 369 | while(fgets(data, 1024, fp)) { | 
|  | 370 | mapinfo *mi = parse_maps_line(data); | 
|  | 371 | if(mi) { | 
|  | 372 | mi->next = milist; | 
|  | 373 | milist = mi; | 
|  | 374 | } | 
|  | 375 | } | 
|  | 376 | fclose(fp); | 
|  | 377 | } | 
|  | 378 |  | 
|  | 379 | parse_exidx_info(milist, tid); | 
|  | 380 |  | 
|  | 381 | /* If stack unwinder fails, use the default solution to dump the stack | 
|  | 382 | * content. | 
|  | 383 | */ | 
|  | 384 | stack_depth = unwind_backtrace_with_ptrace(tfd, tid, milist, sp_list, | 
|  | 385 | &frame0_pc_sane, at_fault); | 
|  | 386 |  | 
|  | 387 | /* The stack unwinder should at least unwind two levels of stack. If less | 
|  | 388 | * level is seen we make sure at lease pc and lr are dumped. | 
|  | 389 | */ | 
|  | 390 | if (stack_depth < 2) { | 
|  | 391 | dump_pc_and_lr(tfd, tid, milist, stack_depth, at_fault); | 
|  | 392 | } | 
|  | 393 |  | 
|  | 394 | dump_stack_and_code(tfd, tid, milist, stack_depth, sp_list, frame0_pc_sane, | 
|  | 395 | at_fault); | 
|  | 396 |  | 
|  | 397 | while(milist) { | 
|  | 398 | mapinfo *next = milist->next; | 
|  | 399 | free(milist); | 
|  | 400 | milist = next; | 
|  | 401 | } | 
|  | 402 | } | 
|  | 403 |  | 
|  | 404 | /* FIXME: unused: use it or lose it*/ | 
|  | 405 | #if 0 | 
|  | 406 | static | 
|  | 407 | void start_gdbserver_vs(int pid, int port) | 
|  | 408 | { | 
|  | 409 | pid_t p; | 
|  | 410 | char *args[5]; | 
|  | 411 | char commspec[16]; | 
|  | 412 | char pidspec[16]; | 
|  | 413 |  | 
|  | 414 | p = fork(); | 
|  | 415 | if(p < 0) { | 
|  | 416 | LOG("could not fork()\n"); | 
|  | 417 | return; | 
|  | 418 | } | 
|  | 419 |  | 
|  | 420 | if(p == 0) { | 
|  | 421 | sprintf(commspec, ":%d", port); | 
|  | 422 | sprintf(pidspec, "%d", pid); | 
|  | 423 | args[0] = "/system/bin/gdbserver"; | 
|  | 424 | args[1] = commspec; | 
|  | 425 | args[2] = "--attach"; | 
|  | 426 | args[3] = pidspec; | 
|  | 427 | args[4] = 0; | 
|  | 428 | exit(execv(args[0], args)); | 
|  | 429 | } else { | 
|  | 430 | LOG("gdbserver pid=%d port=%d targetpid=%d\n", | 
|  | 431 | p, port, pid); | 
|  | 432 |  | 
|  | 433 | sleep(5); | 
|  | 434 | } | 
|  | 435 | } | 
|  | 436 | #endif | 
|  | 437 |  | 
|  | 438 | #define MAX_TOMBSTONES	10 | 
|  | 439 |  | 
|  | 440 | #define typecheck(x,y) {    \ | 
|  | 441 | typeof(x) __dummy1;     \ | 
|  | 442 | typeof(y) __dummy2;     \ | 
|  | 443 | (void)(&__dummy1 == &__dummy2); } | 
|  | 444 |  | 
|  | 445 | #define TOMBSTONE_DIR	"/data/tombstones" | 
|  | 446 |  | 
|  | 447 | /* | 
|  | 448 | * find_and_open_tombstone - find an available tombstone slot, if any, of the | 
|  | 449 | * form tombstone_XX where XX is 00 to MAX_TOMBSTONES-1, inclusive. If no | 
|  | 450 | * file is available, we reuse the least-recently-modified file. | 
|  | 451 | */ | 
|  | 452 | static int find_and_open_tombstone(void) | 
|  | 453 | { | 
|  | 454 | unsigned long mtime = ULONG_MAX; | 
|  | 455 | struct stat sb; | 
|  | 456 | char path[128]; | 
|  | 457 | int fd, i, oldest = 0; | 
|  | 458 |  | 
|  | 459 | /* | 
|  | 460 | * XXX: Our stat.st_mtime isn't time_t. If it changes, as it probably ought | 
|  | 461 | * to, our logic breaks. This check will generate a warning if that happens. | 
|  | 462 | */ | 
|  | 463 | typecheck(mtime, sb.st_mtime); | 
|  | 464 |  | 
|  | 465 | /* | 
|  | 466 | * In a single wolf-like pass, find an available slot and, in case none | 
|  | 467 | * exist, find and record the least-recently-modified file. | 
|  | 468 | */ | 
|  | 469 | for (i = 0; i < MAX_TOMBSTONES; i++) { | 
|  | 470 | snprintf(path, sizeof(path), TOMBSTONE_DIR"/tombstone_%02d", i); | 
|  | 471 |  | 
|  | 472 | if (!stat(path, &sb)) { | 
|  | 473 | if (sb.st_mtime < mtime) { | 
|  | 474 | oldest = i; | 
|  | 475 | mtime = sb.st_mtime; | 
|  | 476 | } | 
|  | 477 | continue; | 
|  | 478 | } | 
|  | 479 | if (errno != ENOENT) | 
|  | 480 | continue; | 
|  | 481 |  | 
|  | 482 | fd = open(path, O_CREAT | O_EXCL | O_WRONLY, 0600); | 
|  | 483 | if (fd < 0) | 
|  | 484 | continue;	/* raced ? */ | 
|  | 485 |  | 
|  | 486 | fchown(fd, AID_SYSTEM, AID_SYSTEM); | 
|  | 487 | return fd; | 
|  | 488 | } | 
|  | 489 |  | 
|  | 490 | /* we didn't find an available file, so we clobber the oldest one */ | 
|  | 491 | snprintf(path, sizeof(path), TOMBSTONE_DIR"/tombstone_%02d", oldest); | 
|  | 492 | fd = open(path, O_CREAT | O_TRUNC | O_WRONLY, 0600); | 
|  | 493 | fchown(fd, AID_SYSTEM, AID_SYSTEM); | 
|  | 494 |  | 
|  | 495 | return fd; | 
|  | 496 | } | 
|  | 497 |  | 
|  | 498 | /* Return true if some thread is not detached cleanly */ | 
|  | 499 | static bool dump_sibling_thread_report(int tfd, unsigned pid, unsigned tid) | 
|  | 500 | { | 
|  | 501 | char task_path[1024]; | 
|  | 502 |  | 
|  | 503 | sprintf(task_path, "/proc/%d/task", pid); | 
|  | 504 | DIR *d; | 
|  | 505 | struct dirent *de; | 
|  | 506 | int need_cleanup = 0; | 
|  | 507 |  | 
|  | 508 | d = opendir(task_path); | 
|  | 509 | /* Bail early if cannot open the task directory */ | 
|  | 510 | if (d == NULL) { | 
|  | 511 | XLOG("Cannot open /proc/%d/task\n", pid); | 
|  | 512 | return false; | 
|  | 513 | } | 
|  | 514 | while ((de = readdir(d)) != NULL) { | 
|  | 515 | unsigned new_tid; | 
|  | 516 | /* Ignore "." and ".." */ | 
|  | 517 | if (!strcmp(de->d_name, ".") || !strcmp(de->d_name, "..")) | 
|  | 518 | continue; | 
|  | 519 | new_tid = atoi(de->d_name); | 
|  | 520 | /* The main thread at fault has been handled individually */ | 
|  | 521 | if (new_tid == tid) | 
|  | 522 | continue; | 
|  | 523 |  | 
|  | 524 | /* Skip this thread if cannot ptrace it */ | 
|  | 525 | if (ptrace(PTRACE_ATTACH, new_tid, 0, 0) < 0) | 
|  | 526 | continue; | 
|  | 527 |  | 
|  | 528 | dump_crash_report(tfd, pid, new_tid, false); | 
|  | 529 | need_cleanup |= ptrace(PTRACE_DETACH, new_tid, 0, 0); | 
|  | 530 | } | 
|  | 531 | closedir(d); | 
|  | 532 | return need_cleanup != 0; | 
|  | 533 | } | 
|  | 534 |  | 
|  | 535 | /* Return true if some thread is not detached cleanly */ | 
|  | 536 | static bool engrave_tombstone(unsigned pid, unsigned tid, int debug_uid, | 
|  | 537 | int signal) | 
|  | 538 | { | 
|  | 539 | int fd; | 
|  | 540 | bool need_cleanup = false; | 
|  | 541 |  | 
|  | 542 | mkdir(TOMBSTONE_DIR, 0755); | 
|  | 543 | chown(TOMBSTONE_DIR, AID_SYSTEM, AID_SYSTEM); | 
|  | 544 |  | 
|  | 545 | fd = find_and_open_tombstone(); | 
|  | 546 | if (fd < 0) | 
|  | 547 | return need_cleanup; | 
|  | 548 |  | 
|  | 549 | dump_crash_banner(fd, pid, tid, signal); | 
|  | 550 | dump_crash_report(fd, pid, tid, true); | 
|  | 551 | /* | 
|  | 552 | * If the user has requested to attach gdb, don't collect the per-thread | 
|  | 553 | * information as it increases the chance to lose track of the process. | 
|  | 554 | */ | 
|  | 555 | if ((signed)pid > debug_uid) { | 
|  | 556 | need_cleanup = dump_sibling_thread_report(fd, pid, tid); | 
|  | 557 | } | 
|  | 558 |  | 
|  | 559 | close(fd); | 
|  | 560 | return need_cleanup; | 
|  | 561 | } | 
|  | 562 |  | 
|  | 563 | static int | 
|  | 564 | write_string(const char* file, const char* string) | 
|  | 565 | { | 
|  | 566 | int len; | 
|  | 567 | int fd; | 
|  | 568 | ssize_t amt; | 
|  | 569 | fd = open(file, O_RDWR); | 
|  | 570 | len = strlen(string); | 
|  | 571 | if (fd < 0) | 
|  | 572 | return -errno; | 
|  | 573 | amt = write(fd, string, len); | 
|  | 574 | close(fd); | 
|  | 575 | return amt >= 0 ? 0 : -errno; | 
|  | 576 | } | 
|  | 577 |  | 
|  | 578 | static | 
|  | 579 | void init_debug_led(void) | 
|  | 580 | { | 
|  | 581 | // trout leds | 
|  | 582 | write_string("/sys/class/leds/red/brightness", "0"); | 
|  | 583 | write_string("/sys/class/leds/green/brightness", "0"); | 
|  | 584 | write_string("/sys/class/leds/blue/brightness", "0"); | 
|  | 585 | write_string("/sys/class/leds/red/device/blink", "0"); | 
|  | 586 | // sardine leds | 
|  | 587 | write_string("/sys/class/leds/left/cadence", "0,0"); | 
|  | 588 | } | 
|  | 589 |  | 
|  | 590 | static | 
|  | 591 | void enable_debug_led(void) | 
|  | 592 | { | 
|  | 593 | // trout leds | 
|  | 594 | write_string("/sys/class/leds/red/brightness", "255"); | 
|  | 595 | // sardine leds | 
|  | 596 | write_string("/sys/class/leds/left/cadence", "1,0"); | 
|  | 597 | } | 
|  | 598 |  | 
|  | 599 | static | 
|  | 600 | void disable_debug_led(void) | 
|  | 601 | { | 
|  | 602 | // trout leds | 
|  | 603 | write_string("/sys/class/leds/red/brightness", "0"); | 
|  | 604 | // sardine leds | 
|  | 605 | write_string("/sys/class/leds/left/cadence", "0,0"); | 
|  | 606 | } | 
|  | 607 |  | 
|  | 608 | extern int init_getevent(); | 
|  | 609 | extern void uninit_getevent(); | 
|  | 610 | extern int get_event(struct input_event* event, int timeout); | 
|  | 611 |  | 
|  | 612 | static void wait_for_user_action(unsigned tid, struct ucred* cr) | 
|  | 613 | { | 
|  | 614 | (void)tid; | 
|  | 615 | /* First log a helpful message */ | 
|  | 616 | LOG(    "********************************************************\n" | 
|  | 617 | "* process %d crashed. debuggerd waiting for gdbserver   \n" | 
|  | 618 | "*                                                       \n" | 
|  | 619 | "*     adb shell gdbserver :port --attach %d &           \n" | 
|  | 620 | "*                                                       \n" | 
|  | 621 | "* and press the HOME key.                               \n" | 
|  | 622 | "********************************************************\n", | 
|  | 623 | cr->pid, cr->pid); | 
|  | 624 |  | 
|  | 625 | /* wait for HOME key */ | 
|  | 626 | if (init_getevent() == 0) { | 
|  | 627 | int ms = 1200 / 10; | 
|  | 628 | int dit = 1; | 
|  | 629 | int dah = 3*dit; | 
|  | 630 | int _       = -dit; | 
|  | 631 | int ___     = 3*_; | 
|  | 632 | int _______ = 7*_; | 
|  | 633 | const signed char codes[] = { | 
|  | 634 | dit,_,dit,_,dit,___,dah,_,dah,_,dah,___,dit,_,dit,_,dit,_______ | 
|  | 635 | }; | 
|  | 636 | size_t s = 0; | 
|  | 637 | struct input_event e; | 
|  | 638 | int home = 0; | 
|  | 639 | init_debug_led(); | 
|  | 640 | enable_debug_led(); | 
|  | 641 | do { | 
|  | 642 | int timeout = abs((int)(codes[s])) * ms; | 
|  | 643 | int res = get_event(&e, timeout); | 
|  | 644 | if (res == 0) { | 
|  | 645 | if (e.type==EV_KEY && e.code==KEY_HOME && e.value==0) | 
|  | 646 | home = 1; | 
|  | 647 | } else if (res == 1) { | 
|  | 648 | if (++s >= sizeof(codes)/sizeof(*codes)) | 
|  | 649 | s = 0; | 
|  | 650 | if (codes[s] > 0) { | 
|  | 651 | enable_debug_led(); | 
|  | 652 | } else { | 
|  | 653 | disable_debug_led(); | 
|  | 654 | } | 
|  | 655 | } | 
|  | 656 | } while (!home); | 
|  | 657 | uninit_getevent(); | 
|  | 658 | } | 
|  | 659 |  | 
|  | 660 | /* don't forget to turn debug led off */ | 
|  | 661 | disable_debug_led(); | 
|  | 662 |  | 
|  | 663 | /* close filedescriptor */ | 
|  | 664 | LOG("debuggerd resuming process %d", cr->pid); | 
|  | 665 | } | 
|  | 666 |  | 
|  | 667 | static void handle_crashing_process(int fd) | 
|  | 668 | { | 
|  | 669 | char buf[64]; | 
|  | 670 | struct stat s; | 
|  | 671 | unsigned tid; | 
|  | 672 | struct ucred cr; | 
|  | 673 | int n, len, status; | 
|  | 674 | int tid_attach_status = -1; | 
|  | 675 | unsigned retry = 30; | 
|  | 676 | bool need_cleanup = false; | 
|  | 677 |  | 
|  | 678 | char value[PROPERTY_VALUE_MAX]; | 
|  | 679 | property_get("debug.db.uid", value, "-1"); | 
|  | 680 | int debug_uid = atoi(value); | 
|  | 681 |  | 
|  | 682 | XLOG("handle_crashing_process(%d)\n", fd); | 
|  | 683 |  | 
|  | 684 | len = sizeof(cr); | 
|  | 685 | n = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &cr, &len); | 
|  | 686 | if(n != 0) { | 
|  | 687 | LOG("cannot get credentials\n"); | 
|  | 688 | goto done; | 
|  | 689 | } | 
|  | 690 |  | 
|  | 691 | XLOG("reading tid\n"); | 
|  | 692 | fcntl(fd, F_SETFL, O_NONBLOCK); | 
|  | 693 | while((n = read(fd, &tid, sizeof(unsigned))) != sizeof(unsigned)) { | 
|  | 694 | if(errno == EINTR) continue; | 
|  | 695 | if(errno == EWOULDBLOCK) { | 
|  | 696 | if(retry-- > 0) { | 
|  | 697 | usleep(100 * 1000); | 
|  | 698 | continue; | 
|  | 699 | } | 
|  | 700 | LOG("timed out reading tid\n"); | 
|  | 701 | goto done; | 
|  | 702 | } | 
|  | 703 | LOG("read failure? %s\n", strerror(errno)); | 
|  | 704 | goto done; | 
|  | 705 | } | 
|  | 706 |  | 
|  | 707 | sprintf(buf,"/proc/%d/task/%d", cr.pid, tid); | 
|  | 708 | if(stat(buf, &s)) { | 
|  | 709 | LOG("tid %d does not exist in pid %d. ignorning debug request\n", | 
|  | 710 | tid, cr.pid); | 
|  | 711 | close(fd); | 
|  | 712 | return; | 
|  | 713 | } | 
|  | 714 |  | 
|  | 715 | XLOG("BOOM: pid=%d uid=%d gid=%d tid=%d\n", cr.pid, cr.uid, cr.gid, tid); | 
|  | 716 |  | 
|  | 717 | tid_attach_status = ptrace(PTRACE_ATTACH, tid, 0, 0); | 
|  | 718 | if(tid_attach_status < 0) { | 
|  | 719 | LOG("ptrace attach failed: %s\n", strerror(errno)); | 
|  | 720 | goto done; | 
|  | 721 | } | 
|  | 722 |  | 
|  | 723 | close(fd); | 
|  | 724 | fd = -1; | 
|  | 725 |  | 
|  | 726 | for(;;) { | 
|  | 727 | n = waitpid(tid, &status, __WALL); | 
|  | 728 |  | 
|  | 729 | if(n < 0) { | 
|  | 730 | if(errno == EAGAIN) continue; | 
|  | 731 | LOG("waitpid failed: %s\n", strerror(errno)); | 
|  | 732 | goto done; | 
|  | 733 | } | 
|  | 734 |  | 
|  | 735 | XLOG("waitpid: n=%d status=%08x\n", n, status); | 
|  | 736 |  | 
|  | 737 | if(WIFSTOPPED(status)){ | 
|  | 738 | n = WSTOPSIG(status); | 
|  | 739 | switch(n) { | 
|  | 740 | case SIGSTOP: | 
|  | 741 | XLOG("stopped -- continuing\n"); | 
|  | 742 | n = ptrace(PTRACE_CONT, tid, 0, 0); | 
|  | 743 | if(n) { | 
|  | 744 | LOG("ptrace failed: %s\n", strerror(errno)); | 
|  | 745 | goto done; | 
|  | 746 | } | 
|  | 747 | continue; | 
|  | 748 |  | 
|  | 749 | case SIGILL: | 
|  | 750 | case SIGABRT: | 
|  | 751 | case SIGBUS: | 
|  | 752 | case SIGFPE: | 
|  | 753 | case SIGSEGV: | 
|  | 754 | case SIGSTKFLT: { | 
|  | 755 | XLOG("stopped -- fatal signal\n"); | 
|  | 756 | need_cleanup = engrave_tombstone(cr.pid, tid, debug_uid, n); | 
|  | 757 | kill(tid, SIGSTOP); | 
|  | 758 | goto done; | 
|  | 759 | } | 
|  | 760 |  | 
|  | 761 | default: | 
|  | 762 | XLOG("stopped -- unexpected signal\n"); | 
|  | 763 | goto done; | 
|  | 764 | } | 
|  | 765 | } else { | 
|  | 766 | XLOG("unexpected waitpid response\n"); | 
|  | 767 | goto done; | 
|  | 768 | } | 
|  | 769 | } | 
|  | 770 |  | 
|  | 771 | done: | 
|  | 772 | XLOG("detaching\n"); | 
|  | 773 |  | 
|  | 774 | /* stop the process so we can debug */ | 
|  | 775 | kill(cr.pid, SIGSTOP); | 
|  | 776 |  | 
|  | 777 | /* | 
|  | 778 | * If a thread has been attached by ptrace, make sure it is detached | 
|  | 779 | * successfully otherwise we will get a zombie. | 
|  | 780 | */ | 
|  | 781 | if (tid_attach_status == 0) { | 
|  | 782 | int detach_status; | 
|  | 783 | /* detach so we can attach gdbserver */ | 
|  | 784 | detach_status = ptrace(PTRACE_DETACH, tid, 0, 0); | 
|  | 785 | need_cleanup |= (detach_status != 0); | 
|  | 786 | } | 
|  | 787 |  | 
|  | 788 | /* | 
|  | 789 | * if debug.db.uid is set, its value indicates if we should wait | 
|  | 790 | * for user action for the crashing process. | 
|  | 791 | * in this case, we log a message and turn the debug LED on | 
|  | 792 | * waiting for a gdb connection (for instance) | 
|  | 793 | */ | 
|  | 794 |  | 
|  | 795 | if ((signed)cr.uid <= debug_uid) { | 
|  | 796 | wait_for_user_action(tid, &cr); | 
|  | 797 | } | 
|  | 798 |  | 
|  | 799 | /* resume stopped process (so it can crash in peace) */ | 
|  | 800 | kill(cr.pid, SIGCONT); | 
|  | 801 |  | 
|  | 802 | if (need_cleanup) { | 
|  | 803 | LOG("debuggerd committing suicide to free the zombie!\n"); | 
|  | 804 | kill(getpid(), SIGKILL); | 
|  | 805 | } | 
|  | 806 |  | 
|  | 807 | if(fd != -1) close(fd); | 
|  | 808 | } | 
|  | 809 |  | 
|  | 810 | int main(int argc, char **argv) | 
|  | 811 | { | 
|  | 812 | int s; | 
|  | 813 | struct sigaction act; | 
|  | 814 |  | 
|  | 815 | process_name_ptr = argv; | 
|  | 816 |  | 
|  | 817 | logsocket = socket_local_client("logd", | 
|  | 818 | ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_DGRAM); | 
|  | 819 | if(logsocket < 0) { | 
|  | 820 | logsocket = -1; | 
|  | 821 | } else { | 
|  | 822 | fcntl(logsocket, F_SETFD, FD_CLOEXEC); | 
|  | 823 | } | 
|  | 824 |  | 
|  | 825 | act.sa_handler = SIG_DFL; | 
|  | 826 | sigemptyset(&act.sa_mask); | 
|  | 827 | sigaddset(&act.sa_mask,SIGCHLD); | 
|  | 828 | act.sa_flags = SA_NOCLDWAIT; | 
|  | 829 | sigaction(SIGCHLD, &act, 0); | 
|  | 830 |  | 
|  | 831 | s = socket_local_server("android:debuggerd", | 
|  | 832 | ANDROID_SOCKET_NAMESPACE_ABSTRACT, SOCK_STREAM); | 
|  | 833 | if(s < 0) return -1; | 
|  | 834 | fcntl(s, F_SETFD, FD_CLOEXEC); | 
|  | 835 |  | 
|  | 836 | LOG("debuggerd: " __DATE__ " " __TIME__ "\n"); | 
|  | 837 |  | 
|  | 838 | for(;;) { | 
|  | 839 | struct sockaddr addr; | 
|  | 840 | socklen_t alen; | 
|  | 841 | int fd; | 
|  | 842 |  | 
|  | 843 | alen = sizeof(addr); | 
|  | 844 | fd = accept(s, &addr, &alen); | 
|  | 845 | if(fd < 0) continue; | 
|  | 846 |  | 
|  | 847 | fcntl(fd, F_SETFD, FD_CLOEXEC); | 
|  | 848 |  | 
|  | 849 | handle_crashing_process(fd); | 
|  | 850 | } | 
|  | 851 | return 0; | 
|  | 852 | } |