1fcf9fc10SMark Johnston /*- 2*4d846d26SWarner Losh * SPDX-License-Identifier: BSD-2-Clause 35e53a4f9SPedro F. Giffuni * 48eb20f36SRui Paulo * Copyright (c) 2010 The FreeBSD Foundation 58eb20f36SRui Paulo * 68eb20f36SRui Paulo * This software was developed by Rui Paulo under sponsorship from the 78eb20f36SRui Paulo * FreeBSD Foundation. 88eb20f36SRui Paulo * 98eb20f36SRui Paulo * Redistribution and use in source and binary forms, with or without 108eb20f36SRui Paulo * modification, are permitted provided that the following conditions 118eb20f36SRui Paulo * are met: 128eb20f36SRui Paulo * 1. Redistributions of source code must retain the above copyright 138eb20f36SRui Paulo * notice, this list of conditions and the following disclaimer. 148eb20f36SRui Paulo * 2. Redistributions in binary form must reproduce the above copyright 158eb20f36SRui Paulo * notice, this list of conditions and the following disclaimer in the 168eb20f36SRui Paulo * documentation and/or other materials provided with the distribution. 178eb20f36SRui Paulo * 188eb20f36SRui Paulo * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 198eb20f36SRui Paulo * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 208eb20f36SRui Paulo * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 218eb20f36SRui Paulo * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 228eb20f36SRui Paulo * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 238eb20f36SRui Paulo * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 248eb20f36SRui Paulo * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 258eb20f36SRui Paulo * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 268eb20f36SRui Paulo * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 278eb20f36SRui Paulo * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 288eb20f36SRui Paulo * SUCH DAMAGE. 298eb20f36SRui Paulo */ 308eb20f36SRui Paulo 318eb20f36SRui Paulo #include <sys/types.h> 328eb20f36SRui Paulo #include <sys/ptrace.h> 338eb20f36SRui Paulo #include <sys/wait.h> 348eb20f36SRui Paulo 358eb20f36SRui Paulo #include <assert.h> 368eb20f36SRui Paulo #include <err.h> 378eb20f36SRui Paulo #include <errno.h> 38813b2694SMark Johnston #include <signal.h> 39813b2694SMark Johnston #include <stdio.h> 40fcf9fc10SMark Johnston 418eb20f36SRui Paulo #include "_libproc.h" 428eb20f36SRui Paulo 4327e54fb5SRuslan Bukin #if defined(__aarch64__) 4427e54fb5SRuslan Bukin #define AARCH64_BRK 0xd4200000 4527e54fb5SRuslan Bukin #define AARCH64_BRK_IMM16_SHIFT 5 4627e54fb5SRuslan Bukin #define AARCH64_BRK_IMM16_VAL (0xd << AARCH64_BRK_IMM16_SHIFT) 4727e54fb5SRuslan Bukin #define BREAKPOINT_INSTR (AARCH64_BRK | AARCH64_BRK_IMM16_VAL) 4827e54fb5SRuslan Bukin #define BREAKPOINT_INSTR_SZ 4 4927e54fb5SRuslan Bukin #elif defined(__amd64__) || defined(__i386__) 508eb20f36SRui Paulo #define BREAKPOINT_INSTR 0xcc /* int 0x3 */ 518eb20f36SRui Paulo #define BREAKPOINT_INSTR_SZ 1 52e3c074a0SAndrew Turner #define BREAKPOINT_ADJUST_SZ BREAKPOINT_INSTR_SZ 5327e54fb5SRuslan Bukin #elif defined(__arm__) 5427e54fb5SRuslan Bukin #define BREAKPOINT_INSTR 0xe7ffffff /* bkpt */ 5527e54fb5SRuslan Bukin #define BREAKPOINT_INSTR_SZ 4 56c7570492SJustin Hibbits #elif defined(__powerpc__) 57c7570492SJustin Hibbits #define BREAKPOINT_INSTR 0x7fe00008 /* trap */ 58c7570492SJustin Hibbits #define BREAKPOINT_INSTR_SZ 4 59ca20f8ecSRuslan Bukin #elif defined(__riscv) 607dd3aed9SRuslan Bukin #define BREAKPOINT_INSTR 0x00100073 /* sbreak */ 617dd3aed9SRuslan Bukin #define BREAKPOINT_INSTR_SZ 4 628eb20f36SRui Paulo #else 638eb20f36SRui Paulo #error "Add support for your architecture" 648eb20f36SRui Paulo #endif 658eb20f36SRui Paulo 661d290950SRuslan Bukin /* 671d290950SRuslan Bukin * Use 4-bytes holder for breakpoint instruction on all the platforms. 681d290950SRuslan Bukin * Works for x86 as well until it is endian-little platform. 691d290950SRuslan Bukin * (We are coping one byte only on x86 from this 4-bytes piece of 701d290950SRuslan Bukin * memory). 711d290950SRuslan Bukin */ 721d290950SRuslan Bukin typedef uint32_t instr_t; 731d290950SRuslan Bukin 74813b2694SMark Johnston static int 75813b2694SMark Johnston proc_stop(struct proc_handle *phdl) 76813b2694SMark Johnston { 77813b2694SMark Johnston int status; 78813b2694SMark Johnston 79813b2694SMark Johnston if (kill(proc_getpid(phdl), SIGSTOP) == -1) { 80813b2694SMark Johnston DPRINTF("kill %d", proc_getpid(phdl)); 81813b2694SMark Johnston return (-1); 82813b2694SMark Johnston } else if (waitpid(proc_getpid(phdl), &status, WSTOPPED) == -1) { 83813b2694SMark Johnston DPRINTF("waitpid %d", proc_getpid(phdl)); 84813b2694SMark Johnston return (-1); 85813b2694SMark Johnston } else if (!WIFSTOPPED(status)) { 86813b2694SMark Johnston DPRINTFX("waitpid: unexpected status 0x%x", status); 87813b2694SMark Johnston return (-1); 88813b2694SMark Johnston } 89813b2694SMark Johnston 90813b2694SMark Johnston return (0); 91813b2694SMark Johnston } 92813b2694SMark Johnston 938eb20f36SRui Paulo int 948eb20f36SRui Paulo proc_bkptset(struct proc_handle *phdl, uintptr_t address, 958eb20f36SRui Paulo unsigned long *saved) 968eb20f36SRui Paulo { 978eb20f36SRui Paulo struct ptrace_io_desc piod; 9892f92525SMark Johnston int ret = 0, stopped; 991d290950SRuslan Bukin instr_t instr; 1008eb20f36SRui Paulo 1018eb20f36SRui Paulo *saved = 0; 1028eb20f36SRui Paulo if (phdl->status == PS_DEAD || phdl->status == PS_UNDEAD || 1038eb20f36SRui Paulo phdl->status == PS_IDLE) { 1048eb20f36SRui Paulo errno = ENOENT; 1058eb20f36SRui Paulo return (-1); 1068eb20f36SRui Paulo } 1078eb20f36SRui Paulo 1089e5787d2SMatt Macy DPRINTFX("adding breakpoint at 0x%lx", (unsigned long)address); 109813b2694SMark Johnston 11092f92525SMark Johnston stopped = 0; 11192f92525SMark Johnston if (phdl->status != PS_STOP) { 112813b2694SMark Johnston if (proc_stop(phdl) != 0) 113813b2694SMark Johnston return (-1); 11492f92525SMark Johnston stopped = 1; 11592f92525SMark Johnston } 116813b2694SMark Johnston 1178eb20f36SRui Paulo /* 1188eb20f36SRui Paulo * Read the original instruction. 1198eb20f36SRui Paulo */ 1201d290950SRuslan Bukin instr = 0; 1218eb20f36SRui Paulo piod.piod_op = PIOD_READ_I; 1220ccd9d15SBrooks Davis piod.piod_offs = (void *)address; 1231d290950SRuslan Bukin piod.piod_addr = &instr; 1248eb20f36SRui Paulo piod.piod_len = BREAKPOINT_INSTR_SZ; 1258eb20f36SRui Paulo if (ptrace(PT_IO, proc_getpid(phdl), (caddr_t)&piod, 0) < 0) { 126fcf9fc10SMark Johnston DPRINTF("ERROR: couldn't read instruction at address 0x%jx", 127fcf9fc10SMark Johnston (uintmax_t)address); 128813b2694SMark Johnston ret = -1; 129813b2694SMark Johnston goto done; 1308eb20f36SRui Paulo } 1311d290950SRuslan Bukin *saved = instr; 1328eb20f36SRui Paulo /* 1338eb20f36SRui Paulo * Write a breakpoint instruction to that address. 1348eb20f36SRui Paulo */ 1351d290950SRuslan Bukin instr = BREAKPOINT_INSTR; 1368eb20f36SRui Paulo piod.piod_op = PIOD_WRITE_I; 1370ccd9d15SBrooks Davis piod.piod_offs = (void *)address; 1381d290950SRuslan Bukin piod.piod_addr = &instr; 1398eb20f36SRui Paulo piod.piod_len = BREAKPOINT_INSTR_SZ; 1408eb20f36SRui Paulo if (ptrace(PT_IO, proc_getpid(phdl), (caddr_t)&piod, 0) < 0) { 141fcf9fc10SMark Johnston DPRINTF("ERROR: couldn't write instruction at address 0x%jx", 142fcf9fc10SMark Johnston (uintmax_t)address); 143813b2694SMark Johnston ret = -1; 144813b2694SMark Johnston goto done; 1458eb20f36SRui Paulo } 1468eb20f36SRui Paulo 147813b2694SMark Johnston done: 14892f92525SMark Johnston if (stopped) 149813b2694SMark Johnston /* Restart the process if we had to stop it. */ 15092f92525SMark Johnston proc_continue(phdl); 151813b2694SMark Johnston 152813b2694SMark Johnston return (ret); 1538eb20f36SRui Paulo } 1548eb20f36SRui Paulo 1558eb20f36SRui Paulo int 1568eb20f36SRui Paulo proc_bkptdel(struct proc_handle *phdl, uintptr_t address, 1578eb20f36SRui Paulo unsigned long saved) 1588eb20f36SRui Paulo { 1598eb20f36SRui Paulo struct ptrace_io_desc piod; 16092f92525SMark Johnston int ret = 0, stopped; 1611d290950SRuslan Bukin instr_t instr; 1628eb20f36SRui Paulo 1638eb20f36SRui Paulo if (phdl->status == PS_DEAD || phdl->status == PS_UNDEAD || 1648eb20f36SRui Paulo phdl->status == PS_IDLE) { 1658eb20f36SRui Paulo errno = ENOENT; 1668eb20f36SRui Paulo return (-1); 1678eb20f36SRui Paulo } 168813b2694SMark Johnston 1699e5787d2SMatt Macy DPRINTFX("removing breakpoint at 0x%lx", (unsigned long)address); 170813b2694SMark Johnston 17192f92525SMark Johnston stopped = 0; 17292f92525SMark Johnston if (phdl->status != PS_STOP) { 173813b2694SMark Johnston if (proc_stop(phdl) != 0) 174813b2694SMark Johnston return (-1); 17592f92525SMark Johnston stopped = 1; 17692f92525SMark Johnston } 177813b2694SMark Johnston 1788eb20f36SRui Paulo /* 1798eb20f36SRui Paulo * Overwrite the breakpoint instruction that we setup previously. 1808eb20f36SRui Paulo */ 1811d290950SRuslan Bukin instr = saved; 1828eb20f36SRui Paulo piod.piod_op = PIOD_WRITE_I; 1830ccd9d15SBrooks Davis piod.piod_offs = (void *)address; 1841d290950SRuslan Bukin piod.piod_addr = &instr; 1858eb20f36SRui Paulo piod.piod_len = BREAKPOINT_INSTR_SZ; 1868eb20f36SRui Paulo if (ptrace(PT_IO, proc_getpid(phdl), (caddr_t)&piod, 0) < 0) { 187fcf9fc10SMark Johnston DPRINTF("ERROR: couldn't write instruction at address 0x%jx", 188fcf9fc10SMark Johnston (uintmax_t)address); 189813b2694SMark Johnston ret = -1; 1908eb20f36SRui Paulo } 1918eb20f36SRui Paulo 19292f92525SMark Johnston if (stopped) 193813b2694SMark Johnston /* Restart the process if we had to stop it. */ 19492f92525SMark Johnston proc_continue(phdl); 195813b2694SMark Johnston 196813b2694SMark Johnston return (ret); 1978eb20f36SRui Paulo } 1988eb20f36SRui Paulo 1998eb20f36SRui Paulo /* 2008eb20f36SRui Paulo * Decrement pc so that we delete the breakpoint at the correct 2018eb20f36SRui Paulo * address, i.e. at the BREAKPOINT_INSTR address. 202e3c074a0SAndrew Turner * 203e3c074a0SAndrew Turner * This is only needed on some architectures where the pc value 204e3c074a0SAndrew Turner * when reading registers points at the instruction after the 205e3c074a0SAndrew Turner * breakpoint, e.g. x86. 2068eb20f36SRui Paulo */ 2078eb20f36SRui Paulo void 2088eb20f36SRui Paulo proc_bkptregadj(unsigned long *pc) 2098eb20f36SRui Paulo { 210e3c074a0SAndrew Turner 211e3c074a0SAndrew Turner (void)pc; 212e3c074a0SAndrew Turner #ifdef BREAKPOINT_ADJUST_SZ 213e3c074a0SAndrew Turner *pc = *pc - BREAKPOINT_ADJUST_SZ; 214e3c074a0SAndrew Turner #endif 2158eb20f36SRui Paulo } 2168eb20f36SRui Paulo 2178eb20f36SRui Paulo /* 2188eb20f36SRui Paulo * Step over the breakpoint. 2198eb20f36SRui Paulo */ 2208eb20f36SRui Paulo int 2218eb20f36SRui Paulo proc_bkptexec(struct proc_handle *phdl, unsigned long saved) 2228eb20f36SRui Paulo { 2238eb20f36SRui Paulo unsigned long pc; 2248eb20f36SRui Paulo unsigned long samesaved; 2258eb20f36SRui Paulo int status; 2268eb20f36SRui Paulo 2278eb20f36SRui Paulo if (proc_regget(phdl, REG_PC, &pc) < 0) { 22830e81f7eSMark Johnston DPRINTFX("ERROR: couldn't get PC register"); 2298eb20f36SRui Paulo return (-1); 2308eb20f36SRui Paulo } 2318eb20f36SRui Paulo proc_bkptregadj(&pc); 2328eb20f36SRui Paulo if (proc_bkptdel(phdl, pc, saved) < 0) { 23330e81f7eSMark Johnston DPRINTFX("ERROR: couldn't delete breakpoint"); 2348eb20f36SRui Paulo return (-1); 2358eb20f36SRui Paulo } 2368eb20f36SRui Paulo /* 2378eb20f36SRui Paulo * Go back in time and step over the new instruction just 2388eb20f36SRui Paulo * set up by proc_bkptdel(). 2398eb20f36SRui Paulo */ 2408eb20f36SRui Paulo proc_regset(phdl, REG_PC, pc); 2418eb20f36SRui Paulo if (ptrace(PT_STEP, proc_getpid(phdl), (caddr_t)1, 0) < 0) { 24230e81f7eSMark Johnston DPRINTFX("ERROR: ptrace step failed"); 2438eb20f36SRui Paulo return (-1); 2448eb20f36SRui Paulo } 2454c74b245SRui Paulo proc_wstatus(phdl); 2464c74b245SRui Paulo status = proc_getwstat(phdl); 2478eb20f36SRui Paulo if (!WIFSTOPPED(status)) { 24830e81f7eSMark Johnston DPRINTFX("ERROR: don't know why process stopped"); 2498eb20f36SRui Paulo return (-1); 2508eb20f36SRui Paulo } 2518eb20f36SRui Paulo /* 2528eb20f36SRui Paulo * Restore the breakpoint. The saved instruction should be 2538eb20f36SRui Paulo * the same as the one that we were passed in. 2548eb20f36SRui Paulo */ 2558eb20f36SRui Paulo if (proc_bkptset(phdl, pc, &samesaved) < 0) { 25630e81f7eSMark Johnston DPRINTFX("ERROR: couldn't restore breakpoint"); 2578eb20f36SRui Paulo return (-1); 2588eb20f36SRui Paulo } 2598eb20f36SRui Paulo assert(samesaved == saved); 2608eb20f36SRui Paulo 2618eb20f36SRui Paulo return (0); 2628eb20f36SRui Paulo } 263