1*fcf9fc10SMark Johnston /*- 28eb20f36SRui Paulo * Copyright (c) 2010 The FreeBSD Foundation 38eb20f36SRui Paulo * All rights reserved. 48eb20f36SRui Paulo * 58eb20f36SRui Paulo * This software was developed by Rui Paulo under sponsorship from the 68eb20f36SRui Paulo * FreeBSD Foundation. 78eb20f36SRui Paulo * 88eb20f36SRui Paulo * Redistribution and use in source and binary forms, with or without 98eb20f36SRui Paulo * modification, are permitted provided that the following conditions 108eb20f36SRui Paulo * are met: 118eb20f36SRui Paulo * 1. Redistributions of source code must retain the above copyright 128eb20f36SRui Paulo * notice, this list of conditions and the following disclaimer. 138eb20f36SRui Paulo * 2. Redistributions in binary form must reproduce the above copyright 148eb20f36SRui Paulo * notice, this list of conditions and the following disclaimer in the 158eb20f36SRui Paulo * documentation and/or other materials provided with the distribution. 168eb20f36SRui Paulo * 178eb20f36SRui Paulo * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 188eb20f36SRui Paulo * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 198eb20f36SRui Paulo * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 208eb20f36SRui Paulo * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 218eb20f36SRui Paulo * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 228eb20f36SRui Paulo * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 238eb20f36SRui Paulo * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 248eb20f36SRui Paulo * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 258eb20f36SRui Paulo * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 268eb20f36SRui Paulo * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 278eb20f36SRui Paulo * SUCH DAMAGE. 288eb20f36SRui Paulo */ 298eb20f36SRui Paulo 308eb20f36SRui Paulo #include <sys/cdefs.h> 318eb20f36SRui Paulo __FBSDID("$FreeBSD$"); 328eb20f36SRui Paulo 338eb20f36SRui Paulo #include <sys/types.h> 348eb20f36SRui Paulo #include <sys/ptrace.h> 358eb20f36SRui Paulo #include <sys/wait.h> 368eb20f36SRui Paulo 378eb20f36SRui Paulo #include <assert.h> 388eb20f36SRui Paulo #include <err.h> 398eb20f36SRui Paulo #include <errno.h> 40813b2694SMark Johnston #include <signal.h> 41813b2694SMark Johnston #include <stdio.h> 42*fcf9fc10SMark Johnston 438eb20f36SRui Paulo #include "_libproc.h" 448eb20f36SRui Paulo 4527e54fb5SRuslan Bukin #if defined(__aarch64__) 4627e54fb5SRuslan Bukin #define AARCH64_BRK 0xd4200000 4727e54fb5SRuslan Bukin #define AARCH64_BRK_IMM16_SHIFT 5 4827e54fb5SRuslan Bukin #define AARCH64_BRK_IMM16_VAL (0xd << AARCH64_BRK_IMM16_SHIFT) 4927e54fb5SRuslan Bukin #define BREAKPOINT_INSTR (AARCH64_BRK | AARCH64_BRK_IMM16_VAL) 5027e54fb5SRuslan Bukin #define BREAKPOINT_INSTR_SZ 4 5127e54fb5SRuslan Bukin #elif defined(__amd64__) || defined(__i386__) 528eb20f36SRui Paulo #define BREAKPOINT_INSTR 0xcc /* int 0x3 */ 538eb20f36SRui Paulo #define BREAKPOINT_INSTR_SZ 1 54e3c074a0SAndrew Turner #define BREAKPOINT_ADJUST_SZ BREAKPOINT_INSTR_SZ 5527e54fb5SRuslan Bukin #elif defined(__arm__) 5627e54fb5SRuslan Bukin #define BREAKPOINT_INSTR 0xe7ffffff /* bkpt */ 5727e54fb5SRuslan Bukin #define BREAKPOINT_INSTR_SZ 4 58f2242861SOleksandr Tymoshenko #elif defined(__mips__) 59f2242861SOleksandr Tymoshenko #define BREAKPOINT_INSTR 0xd /* break */ 60f2242861SOleksandr Tymoshenko #define BREAKPOINT_INSTR_SZ 4 61c7570492SJustin Hibbits #elif defined(__powerpc__) 62c7570492SJustin Hibbits #define BREAKPOINT_INSTR 0x7fe00008 /* trap */ 63c7570492SJustin Hibbits #define BREAKPOINT_INSTR_SZ 4 647dd3aed9SRuslan Bukin #elif defined(__riscv__) 657dd3aed9SRuslan Bukin #define BREAKPOINT_INSTR 0x00100073 /* sbreak */ 667dd3aed9SRuslan Bukin #define BREAKPOINT_INSTR_SZ 4 678eb20f36SRui Paulo #else 688eb20f36SRui Paulo #error "Add support for your architecture" 698eb20f36SRui Paulo #endif 708eb20f36SRui Paulo 711d290950SRuslan Bukin /* 721d290950SRuslan Bukin * Use 4-bytes holder for breakpoint instruction on all the platforms. 731d290950SRuslan Bukin * Works for x86 as well until it is endian-little platform. 741d290950SRuslan Bukin * (We are coping one byte only on x86 from this 4-bytes piece of 751d290950SRuslan Bukin * memory). 761d290950SRuslan Bukin */ 771d290950SRuslan Bukin typedef uint32_t instr_t; 781d290950SRuslan Bukin 79813b2694SMark Johnston static int 80813b2694SMark Johnston proc_stop(struct proc_handle *phdl) 81813b2694SMark Johnston { 82813b2694SMark Johnston int status; 83813b2694SMark Johnston 84813b2694SMark Johnston if (kill(proc_getpid(phdl), SIGSTOP) == -1) { 85813b2694SMark Johnston DPRINTF("kill %d", proc_getpid(phdl)); 86813b2694SMark Johnston return (-1); 87813b2694SMark Johnston } else if (waitpid(proc_getpid(phdl), &status, WSTOPPED) == -1) { 88813b2694SMark Johnston DPRINTF("waitpid %d", proc_getpid(phdl)); 89813b2694SMark Johnston return (-1); 90813b2694SMark Johnston } else if (!WIFSTOPPED(status)) { 91813b2694SMark Johnston DPRINTFX("waitpid: unexpected status 0x%x", status); 92813b2694SMark Johnston return (-1); 93813b2694SMark Johnston } 94813b2694SMark Johnston 95813b2694SMark Johnston return (0); 96813b2694SMark Johnston } 97813b2694SMark Johnston 988eb20f36SRui Paulo int 998eb20f36SRui Paulo proc_bkptset(struct proc_handle *phdl, uintptr_t address, 1008eb20f36SRui Paulo unsigned long *saved) 1018eb20f36SRui Paulo { 1028eb20f36SRui Paulo struct ptrace_io_desc piod; 1031d290950SRuslan Bukin unsigned long caddr; 10492f92525SMark Johnston int ret = 0, stopped; 1051d290950SRuslan Bukin instr_t instr; 1068eb20f36SRui Paulo 1078eb20f36SRui Paulo *saved = 0; 1088eb20f36SRui Paulo if (phdl->status == PS_DEAD || phdl->status == PS_UNDEAD || 1098eb20f36SRui Paulo phdl->status == PS_IDLE) { 1108eb20f36SRui Paulo errno = ENOENT; 1118eb20f36SRui Paulo return (-1); 1128eb20f36SRui Paulo } 1138eb20f36SRui Paulo 114813b2694SMark Johnston DPRINTFX("adding breakpoint at 0x%lx", address); 115813b2694SMark Johnston 11692f92525SMark Johnston stopped = 0; 11792f92525SMark Johnston if (phdl->status != PS_STOP) { 118813b2694SMark Johnston if (proc_stop(phdl) != 0) 119813b2694SMark Johnston return (-1); 12092f92525SMark Johnston stopped = 1; 12192f92525SMark Johnston } 122813b2694SMark Johnston 1238eb20f36SRui Paulo /* 1248eb20f36SRui Paulo * Read the original instruction. 1258eb20f36SRui Paulo */ 1268eb20f36SRui Paulo caddr = address; 1271d290950SRuslan Bukin instr = 0; 1288eb20f36SRui Paulo piod.piod_op = PIOD_READ_I; 1298eb20f36SRui Paulo piod.piod_offs = (void *)caddr; 1301d290950SRuslan Bukin piod.piod_addr = &instr; 1318eb20f36SRui Paulo piod.piod_len = BREAKPOINT_INSTR_SZ; 1328eb20f36SRui Paulo if (ptrace(PT_IO, proc_getpid(phdl), (caddr_t)&piod, 0) < 0) { 133*fcf9fc10SMark Johnston DPRINTF("ERROR: couldn't read instruction at address 0x%jx", 134*fcf9fc10SMark Johnston (uintmax_t)address); 135813b2694SMark Johnston ret = -1; 136813b2694SMark Johnston goto done; 1378eb20f36SRui Paulo } 1381d290950SRuslan Bukin *saved = instr; 1398eb20f36SRui Paulo /* 1408eb20f36SRui Paulo * Write a breakpoint instruction to that address. 1418eb20f36SRui Paulo */ 1428eb20f36SRui Paulo caddr = address; 1431d290950SRuslan Bukin instr = BREAKPOINT_INSTR; 1448eb20f36SRui Paulo piod.piod_op = PIOD_WRITE_I; 1458eb20f36SRui Paulo piod.piod_offs = (void *)caddr; 1461d290950SRuslan Bukin piod.piod_addr = &instr; 1478eb20f36SRui Paulo piod.piod_len = BREAKPOINT_INSTR_SZ; 1488eb20f36SRui Paulo if (ptrace(PT_IO, proc_getpid(phdl), (caddr_t)&piod, 0) < 0) { 149*fcf9fc10SMark Johnston DPRINTF("ERROR: couldn't write instruction at address 0x%jx", 150*fcf9fc10SMark Johnston (uintmax_t)address); 151813b2694SMark Johnston ret = -1; 152813b2694SMark Johnston goto done; 1538eb20f36SRui Paulo } 1548eb20f36SRui Paulo 155813b2694SMark Johnston done: 15692f92525SMark Johnston if (stopped) 157813b2694SMark Johnston /* Restart the process if we had to stop it. */ 15892f92525SMark Johnston proc_continue(phdl); 159813b2694SMark Johnston 160813b2694SMark Johnston return (ret); 1618eb20f36SRui Paulo } 1628eb20f36SRui Paulo 1638eb20f36SRui Paulo int 1648eb20f36SRui Paulo proc_bkptdel(struct proc_handle *phdl, uintptr_t address, 1658eb20f36SRui Paulo unsigned long saved) 1668eb20f36SRui Paulo { 1678eb20f36SRui Paulo struct ptrace_io_desc piod; 1681d290950SRuslan Bukin unsigned long caddr; 16992f92525SMark Johnston int ret = 0, stopped; 1701d290950SRuslan Bukin instr_t instr; 1718eb20f36SRui Paulo 1728eb20f36SRui Paulo if (phdl->status == PS_DEAD || phdl->status == PS_UNDEAD || 1738eb20f36SRui Paulo phdl->status == PS_IDLE) { 1748eb20f36SRui Paulo errno = ENOENT; 1758eb20f36SRui Paulo return (-1); 1768eb20f36SRui Paulo } 177813b2694SMark Johnston 178813b2694SMark Johnston DPRINTFX("removing breakpoint at 0x%lx", address); 179813b2694SMark Johnston 18092f92525SMark Johnston stopped = 0; 18192f92525SMark Johnston if (phdl->status != PS_STOP) { 182813b2694SMark Johnston if (proc_stop(phdl) != 0) 183813b2694SMark Johnston return (-1); 18492f92525SMark Johnston stopped = 1; 18592f92525SMark Johnston } 186813b2694SMark Johnston 1878eb20f36SRui Paulo /* 1888eb20f36SRui Paulo * Overwrite the breakpoint instruction that we setup previously. 1898eb20f36SRui Paulo */ 1908eb20f36SRui Paulo caddr = address; 1911d290950SRuslan Bukin instr = saved; 1928eb20f36SRui Paulo piod.piod_op = PIOD_WRITE_I; 1938eb20f36SRui Paulo piod.piod_offs = (void *)caddr; 1941d290950SRuslan Bukin piod.piod_addr = &instr; 1958eb20f36SRui Paulo piod.piod_len = BREAKPOINT_INSTR_SZ; 1968eb20f36SRui Paulo if (ptrace(PT_IO, proc_getpid(phdl), (caddr_t)&piod, 0) < 0) { 197*fcf9fc10SMark Johnston DPRINTF("ERROR: couldn't write instruction at address 0x%jx", 198*fcf9fc10SMark Johnston (uintmax_t)address); 199813b2694SMark Johnston ret = -1; 2008eb20f36SRui Paulo } 2018eb20f36SRui Paulo 20292f92525SMark Johnston if (stopped) 203813b2694SMark Johnston /* Restart the process if we had to stop it. */ 20492f92525SMark Johnston proc_continue(phdl); 205813b2694SMark Johnston 206813b2694SMark Johnston return (ret); 2078eb20f36SRui Paulo } 2088eb20f36SRui Paulo 2098eb20f36SRui Paulo /* 2108eb20f36SRui Paulo * Decrement pc so that we delete the breakpoint at the correct 2118eb20f36SRui Paulo * address, i.e. at the BREAKPOINT_INSTR address. 212e3c074a0SAndrew Turner * 213e3c074a0SAndrew Turner * This is only needed on some architectures where the pc value 214e3c074a0SAndrew Turner * when reading registers points at the instruction after the 215e3c074a0SAndrew Turner * breakpoint, e.g. x86. 2168eb20f36SRui Paulo */ 2178eb20f36SRui Paulo void 2188eb20f36SRui Paulo proc_bkptregadj(unsigned long *pc) 2198eb20f36SRui Paulo { 220e3c074a0SAndrew Turner 221e3c074a0SAndrew Turner (void)pc; 222e3c074a0SAndrew Turner #ifdef BREAKPOINT_ADJUST_SZ 223e3c074a0SAndrew Turner *pc = *pc - BREAKPOINT_ADJUST_SZ; 224e3c074a0SAndrew Turner #endif 2258eb20f36SRui Paulo } 2268eb20f36SRui Paulo 2278eb20f36SRui Paulo /* 2288eb20f36SRui Paulo * Step over the breakpoint. 2298eb20f36SRui Paulo */ 2308eb20f36SRui Paulo int 2318eb20f36SRui Paulo proc_bkptexec(struct proc_handle *phdl, unsigned long saved) 2328eb20f36SRui Paulo { 2338eb20f36SRui Paulo unsigned long pc; 2348eb20f36SRui Paulo unsigned long samesaved; 2358eb20f36SRui Paulo int status; 2368eb20f36SRui Paulo 2378eb20f36SRui Paulo if (proc_regget(phdl, REG_PC, &pc) < 0) { 23830e81f7eSMark Johnston DPRINTFX("ERROR: couldn't get PC register"); 2398eb20f36SRui Paulo return (-1); 2408eb20f36SRui Paulo } 2418eb20f36SRui Paulo proc_bkptregadj(&pc); 2428eb20f36SRui Paulo if (proc_bkptdel(phdl, pc, saved) < 0) { 24330e81f7eSMark Johnston DPRINTFX("ERROR: couldn't delete breakpoint"); 2448eb20f36SRui Paulo return (-1); 2458eb20f36SRui Paulo } 2468eb20f36SRui Paulo /* 2478eb20f36SRui Paulo * Go back in time and step over the new instruction just 2488eb20f36SRui Paulo * set up by proc_bkptdel(). 2498eb20f36SRui Paulo */ 2508eb20f36SRui Paulo proc_regset(phdl, REG_PC, pc); 2518eb20f36SRui Paulo if (ptrace(PT_STEP, proc_getpid(phdl), (caddr_t)1, 0) < 0) { 25230e81f7eSMark Johnston DPRINTFX("ERROR: ptrace step failed"); 2538eb20f36SRui Paulo return (-1); 2548eb20f36SRui Paulo } 2554c74b245SRui Paulo proc_wstatus(phdl); 2564c74b245SRui Paulo status = proc_getwstat(phdl); 2578eb20f36SRui Paulo if (!WIFSTOPPED(status)) { 25830e81f7eSMark Johnston DPRINTFX("ERROR: don't know why process stopped"); 2598eb20f36SRui Paulo return (-1); 2608eb20f36SRui Paulo } 2618eb20f36SRui Paulo /* 2628eb20f36SRui Paulo * Restore the breakpoint. The saved instruction should be 2638eb20f36SRui Paulo * the same as the one that we were passed in. 2648eb20f36SRui Paulo */ 2658eb20f36SRui Paulo if (proc_bkptset(phdl, pc, &samesaved) < 0) { 26630e81f7eSMark Johnston DPRINTFX("ERROR: couldn't restore breakpoint"); 2678eb20f36SRui Paulo return (-1); 2688eb20f36SRui Paulo } 2698eb20f36SRui Paulo assert(samesaved == saved); 2708eb20f36SRui Paulo 2718eb20f36SRui Paulo return (0); 2728eb20f36SRui Paulo } 273