pax_global_header00006660000000000000000000000064127736762040014530gustar00rootroot0000000000000052 comment=df302fa6f5e632d004b9917fb728772929e89fde rr-4.4.0/000077500000000000000000000000001277367620400121605ustar00rootroot00000000000000rr-4.4.0/.clang-format000066400000000000000000000025561277367620400145430ustar00rootroot00000000000000# BasedOnStyle: Mozilla AccessModifierOffset: -2 ConstructorInitializerIndentWidth: 4 AlignEscapedNewlinesLeft: false AlignTrailingComments: true AllowAllParametersOfDeclarationOnNextLine: false AllowShortIfStatementsOnASingleLine: false AllowShortLoopsOnASingleLine: false AlwaysBreakTemplateDeclarations: false AlwaysBreakBeforeMultilineStrings: false BreakBeforeBinaryOperators: false BreakBeforeTernaryOperators: true BreakConstructorInitializersBeforeComma: false BinPackParameters: true ColumnLimit: 80 ConstructorInitializerAllOnOneLineOrOnePerLine: true DerivePointerBinding: false ExperimentalAutoDetectBinPacking: false IndentCaseLabels: true MaxEmptyLinesToKeep: 1 NamespaceIndentation: None ObjCSpaceBeforeProtocolList: false PenaltyBreakBeforeFirstCallParameter: 19 PenaltyBreakComment: 60 PenaltyBreakString: 1000 PenaltyBreakFirstLessLess: 120 PenaltyExcessCharacter: 1000000 PenaltyReturnTypeOnItsOwnLine: 200 PointerBindsToType: true SpacesBeforeTrailingComments: 1 Cpp11BracedListStyle: false Standard: Cpp11 IndentWidth: 2 TabWidth: 8 UseTab: Never BreakBeforeBraces: Attach IndentFunctionDeclarationAfterType: false SpacesInParentheses: false SpacesInAngles: false SpaceInEmptyParentheses: false SpacesInCStyleCastParentheses: false SpaceAfterControlStatementKeyword: true SpaceBeforeAssignmentOperators: true ContinuationIndentWidth: 4 rr-4.4.0/.gitignore000066400000000000000000000004211277367620400141450ustar00rootroot00000000000000*~ .cproject CMakeCache.txt CMakeFiles/ cmake_install.cmake CPackConfig.cmake CPackSourceConfig.cmake _CPack_Packages/ CTestTestfile.cmake Debug dist/ install_manifest.txt Makefile Profile obj/ .project *.log *.orig *.rej *.pyc *.record *.replay .settings/ Testing/ .idea/ rr-4.4.0/.travis.yml000066400000000000000000000005311277367620400142700ustar00rootroot00000000000000sudo: required dist: trusty language: c compiler: gcc # XXX tests are disabled for the moment because the travis VM's CPU # type isn't supported, and because there are odd timeouts with no-op # tests script: ./src/script/setup_travis.sh && cmake -DWILL_RUN_TESTS=OFF . && make && make package notifications: email: - rr-builds@mozilla.org rr-4.4.0/CMakeLists.txt000066400000000000000000000767331277367620400147400ustar00rootroot00000000000000# *-* Mode: cmake; *-* cmake_minimum_required(VERSION 2.8.5) project(rr C CXX ASM) # On single configuration generators, make Debug the default configuration if(NOT CMAKE_CONFIGURATION_TYPES) if(NOT CMAKE_BUILD_TYPE) set(CMAKE_BUILD_TYPE "Debug" CACHE STRING "Whether to build in `Debug` or `Release` mode." FORCE) endif() endif() enable_testing() set(BUILD_SHARED_LIBS ON) set(EXECUTABLE_OUTPUT_PATH ${PROJECT_BINARY_DIR}/bin) set(LIBRARY_OUTPUT_PATH ${PROJECT_BINARY_DIR}/lib) set(WILL_RUN_TESTS ON CACHE BOOL "Run tests") # CAREFUL! "-" is an invalid character in RPM package names, while # debian is happy with it. However, "_" is illegal in debs, while RPM # is cool with it. Sigh. set(rr_VERSION_MAJOR 4) set(rr_VERSION_MINOR 4) set(rr_VERSION_PATCH 0) add_definitions(-DRR_VERSION="${rr_VERSION_MAJOR}.${rr_VERSION_MINOR}.${rr_VERSION_PATCH}") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -pthread -g3 -Wall -Wextra -Wstrict-prototypes") set(CMAKE_C_FLAGS_DEBUG "-O0 -Werror -DDEBUG") set(CMAKE_C_FLAGS_RELEASE "-O2") # Define __STDC_LIMIT_MACROS so |#include | works as expected. # Define __STDC_FORMAT_MACROS so |#include | works as expected. set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -D__USE_LARGEFILE64 -D__STDC_LIMIT_MACROS -D__STDC_FORMAT_MACROS -std=c++0x -pthread -g3 -Wall -Wextra") set(CMAKE_CXX_FLAGS_DEBUG "-O0 -Werror -DDEBUG") set(CMAKE_CXX_FLAGS_RELEASE "-O2") set(CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS} -g3") if(CMAKE_CXX_COMPILER_ID STREQUAL "Clang") set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-unused-command-line-argument") set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-unused-command-line-argument") endif() option(force32bit "Force a 32-bit rr build, rather than both 64 and 32-bit. rr will only be able to record and replay 32-bit processes.") option(disable32bit "On a 64-bit platform, avoid requiring a 32-bit cross-compilation toolchain by not building 32-bit components. rr will be able to record 32-bit processes but not replay them.") if(force32bit) set(rr_32BIT true) set(rr_64BIT false) set(rr_MBITNESS_OPTION -m32) else() if(CMAKE_SIZEOF_VOID_P EQUAL 8) if(disable32bit) set(rr_32BIT false) else() set(rr_32BIT true) endif() set(rr_64BIT true) else() set(rr_32BIT true) set(rr_64BIT false) endif() set(rr_MBITNESS_OPTION) endif() # Check that compiling 32-bit code on a 64-bit target works, if required. if(CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL "x86_64" AND rr_32BIT) # try_compile won't accept LINK_FLAGS, so do this manually. file(WRITE "${CMAKE_BINARY_DIR}/test32.c" "int main() { return 0; }") execute_process(COMMAND ${CMAKE_C_COMPILER} -o ${CMAKE_BINARY_DIR}/test32 ${CMAKE_BINARY_DIR}/test32.c -m32 RESULT_VARIABLE COMPILER_32BIT_RESULT) if(NOT (COMPILER_32BIT_RESULT EQUAL 0)) message(FATAL_ERROR "Your toolchain doesn't support 32-bit cross-compilation. Install the required packages or pass -Ddisable32bit=ON to cmake.") endif() endif() set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${rr_MBITNESS_OPTION}") set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${rr_MBITNESS_OPTION}") set(CMAKE_ASM_FLAGS "${CMAKE_ASM_FLAGS} ${rr_MBITNESS_OPTION}") find_package(PkgConfig REQUIRED) # If we're cross-compiling a 32-bit rr build on a 64-bit host we need # to ensure we're looking for the right libraries. # This has been tested on Ubuntu and Fedora. if(CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL "x86_64" AND NOT rr_64BIT) set(LIBDIR32_CANDIDATES /usr/lib/i386-linux-gnu/pkgconfig/ /usr/lib/pkgconfig/ ) foreach(libdir ${LIBDIR32_CANDIDATES}) if(IS_DIRECTORY ${libdir}) set(ENV{PKG_CONFIG_LIBDIR} ${libdir}) break() endif() endforeach(libdir) if(NOT DEFINED ENV{PKG_CONFIG_LIBDIR}) message(FATAL_ERROR "Couldn't find a suitable 32-bit pkgconfig lib dir. You probably need to install a 32-bit pkgconfig package (pkgconfig.i686 for Fedora or pkg-config:i386 for Ubuntu") endif() endif() # Check for required libraries set(REQUIRED_LIBS zlib ) foreach(required_lib ${REQUIRED_LIBS}) string(TOUPPER ${required_lib} PKG) pkg_check_modules(${PKG} REQUIRED ${required_lib}) set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${${PKG}_CFLAGS}") set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${${PKG}_CFLAGS}") endforeach(required_lib) # Check for Python >=2.7 but not Python 3. find_package(PythonInterp 2.7 REQUIRED) if(PYTHON_VERSION_MAJOR GREATER 2) message(FATAL_ERROR "Python 3 is not supported, please use Python 2.7.") endif() execute_process(COMMAND "${PYTHON_EXECUTABLE}" "-c" "# nothing" RESULT_VARIABLE python_status) if(python_status) message(FATAL_ERROR "Couldn't run python interpreter ${PYTHON_EXECUTABLE}.") endif() # Check for required Python modules if(WILL_RUN_TESTS) set(REQUIRED_PYTHON_MODULES pexpect ) else() set(REQUIRED_PYTHON_MODULES) endif() foreach(py_module ${REQUIRED_PYTHON_MODULES}) execute_process(COMMAND "${PYTHON_EXECUTABLE}" "-c" "import ${py_module}" RESULT_VARIABLE module_status) if(module_status) message(FATAL_ERROR "Couldn't find required Python module ${py_module}.") endif() endforeach(py_module) if(WILL_RUN_TESTS) # Check for gdb execute_process(COMMAND "gdb" "--version" RESULT_VARIABLE module_status OUTPUT_QUIET) if(module_status) message(FATAL_ERROR "Couldn't find gdb.") endif() endif() set(PRELOAD_COMPILE_FLAGS "-fno-stack-protector") if (NOT DEBUG_PRELOAD_LIB) set(PRELOAD_COMPILE_FLAGS "${PRELOAD_COMPILE_FLAGS} ${CMAKE_C_FLAGS_RELEASE}") endif() set_source_files_properties(src/preload/preload.c PROPERTIES COMPILE_FLAGS ${PRELOAD_COMPILE_FLAGS}) include_directories("${PROJECT_SOURCE_DIR}/include") include_directories("${PROJECT_SOURCE_DIR}/third-party/proc-service") # We need to know where our generated files are. include_directories("${CMAKE_CURRENT_BINARY_DIR}") add_library(rrpreload src/preload/preload.c src/preload/raw_syscall.S src/preload/syscall_hook.S src/preload/breakpoint_table.S ) # Ensure that CMake knows about our generated files. # # Alphabetical, please. set(GENERATED_FILES AssemblyTemplates.generated CheckSyscallNumbers.generated SyscallEnumsX64.generated SyscallEnumsX86.generated SyscallEnumsForTestsX64.generated SyscallEnumsForTestsX86.generated SyscallHelperFunctions.generated SyscallnameArch.generated SyscallRecordCase.generated ) foreach(generated_file ${GENERATED_FILES}) set_source_files_properties(${generated_file} PROPERTIES GENERATED true HEADER_FILE_ONLY true) add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/${generated_file}" COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_syscalls.py" "${CMAKE_CURRENT_BINARY_DIR}/${generated_file}" DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_syscalls.py" "${CMAKE_CURRENT_SOURCE_DIR}/src/syscalls.py" "${CMAKE_CURRENT_SOURCE_DIR}/src/assembly_templates.py") endforeach(generated_file) add_custom_target(Generated DEPENDS ${GENERATED_FILES}) add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64" COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64" DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py") add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32" COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32" DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py") add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64_replay" COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64_replay" DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py") add_custom_command(OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32_replay" COMMAND "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32_replay" DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/src/generate_rr_page.py") add_custom_target(Pages DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32_replay" "${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64_replay") set(RR_SOURCES src/test/cpuid_loop.S src/AddressSpace.cc src/AutoRemoteSyscalls.cc src/Command.cc src/CompressedReader.cc src/CompressedWriter.cc src/CPUIDBugDetector.cc src/DiversionSession.cc src/DumpCommand.cc src/ElfReader.cc src/EmuFs.cc src/Event.cc src/ExtraRegisters.cc src/fast_forward.cc src/FdTable.cc src/Flags.cc src/ftrace.cc src/GdbCommand.cc src/GdbCommandHandler.cc src/GdbConnection.cc src/GdbExpression.cc src/GdbInitCommand.cc src/GdbServer.cc src/HasTaskSet.cc src/HelpCommand.cc src/kernel_abi.cc src/kernel_metadata.cc src/log.cc src/MagicSaveDataMonitor.cc src/MmappedFileMonitor.cc src/MonitoredSharedMemory.cc src/Monkeypatcher.cc src/PerfCounters.cc src/ProcFdDirMonitor.cc src/ProcMemMonitor.cc src/PsCommand.cc src/RecordCommand.cc src/RecordSession.cc src/record_signal.cc src/record_syscall.cc src/RecordTask.cc src/Registers.cc src/remote_code_ptr.cc src/ReplayCommand.cc src/ReplaySession.cc src/replay_syscall.cc src/ReplayTask.cc src/ReplayTimeline.cc src/ReturnAddressList.cc src/Scheduler.cc src/SeccompFilterRewriter.cc src/Session.cc src/StdioMonitor.cc src/Task.cc src/TaskGroup.cc src/ThreadDb.cc src/TraceFrame.cc src/TraceStream.cc src/VirtualPerfCounterMonitor.cc src/util.cc src/WaitStatus.cc) function(post_build_executable target) # grsecurity needs these. But if we add them ourselves, they may conflict # with other flags added in other ways, and they all have to match :-(. So # don't do this until a better solution presents itself # add_custom_command(TARGET ${target} # POST_BUILD # COMMAND setfattr ARGS -n user.pax.flags -v m $) endfunction(post_build_executable) option(RR_BUILD_SHARED "Build the rr shared library as well as the binary (experimental).") if(RR_BUILD_SHARED) add_library(rr ${RR_SOURCES}) add_executable(rrbin src/main.cc) set(RR_BIN rrbin) post_build_executable(rrbin) set_target_properties(rrbin PROPERTIES OUTPUT_NAME rr) target_link_libraries(rrbin rr) else() add_executable(rr ${RR_SOURCES} src/main.cc) post_build_executable(rr) set(RR_BIN) endif() add_dependencies(rr Generated Pages) target_link_libraries(rr ${CMAKE_DL_LIBS} -lrt ${ZLIB_LDFLAGS} ) target_link_libraries(rrpreload ${CMAKE_DL_LIBS} ) add_executable(rr_exec_stub src/exec_stub.c) post_build_executable(rr_exec_stub) set_target_properties(rr_exec_stub PROPERTIES LINK_FLAGS "-nostartfiles -nodefaultlibs") set_source_files_properties(src/exec_stub.c COMPILE_FLAGS "-fno-stack-protector") set(RR_GDB_RESOURCES 32bit-avx.xml 32bit-core.xml 32bit-linux.xml 32bit-sse.xml 64bit-avx.xml 64bit-core.xml 64bit-linux.xml 64bit-sse.xml amd64-avx-linux.xml amd64-linux.xml i386-avx-linux.xml i386-linux.xml ) foreach(file ${RR_GDB_RESOURCES}) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/third-party/gdb/${file}" "${CMAKE_CURRENT_BINARY_DIR}/share/rr/${file}" COPYONLY) install(FILES third-party/gdb/${file} DESTINATION share/rr) endforeach(file) install(PROGRAMS scripts/signal-rr-recording.sh ${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64 ${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_64_replay ${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32 ${CMAKE_CURRENT_BINARY_DIR}/bin/rr_page_32_replay DESTINATION bin) install(TARGETS rr ${RR_BIN} rrpreload rr_exec_stub RUNTIME DESTINATION bin LIBRARY DESTINATION lib ARCHIVE DESTINATION lib) # Build 32-bit librrpreload on 64-bit builds. # We copy the source files into '32' subdirectories in the output # directory, so we can set different compile options on them. # This sucks but I can't find a better way to get CMake to build # the same source file in two different ways. if(rr_32BIT AND rr_64BIT) foreach(file preload_interface.h) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/preload/${file}" "${CMAKE_CURRENT_BINARY_DIR}/32/${file}" COPYONLY) endforeach(file) foreach(file preload.c raw_syscall.S syscall_hook.S breakpoint_table.S) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/preload/${file}" "${CMAKE_CURRENT_BINARY_DIR}/32/${file}" COPYONLY) set_source_files_properties("${CMAKE_CURRENT_BINARY_DIR}/32/${file}" PROPERTIES COMPILE_FLAGS "-m32 ${CMAKE_C_FLAGS_RELEASE}") endforeach(file) add_library(rrpreload_32 32/preload.c 32/raw_syscall.S 32/syscall_hook.S 32/breakpoint_table.S ) set_target_properties(rrpreload_32 PROPERTIES LINK_FLAGS -m32) target_link_libraries(rrpreload_32 ${CMAKE_DL_LIBS} ) foreach(file exec_stub.c) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/${file}" "${CMAKE_CURRENT_BINARY_DIR}/32/${file}" COPYONLY) set_source_files_properties("${CMAKE_CURRENT_BINARY_DIR}/32/${file}" PROPERTIES COMPILE_FLAGS "-m32 -fno-stack-protector") endforeach(file) add_executable(rr_exec_stub_32 32/exec_stub.c) post_build_executable(rr_exec_stub_32) set_target_properties(rr_exec_stub_32 PROPERTIES LINK_FLAGS "-nostartfiles -nodefaultlibs -m32") install(TARGETS rrpreload_32 rr_exec_stub_32 RUNTIME DESTINATION bin LIBRARY DESTINATION lib ARCHIVE DESTINATION lib) endif() ##-------------------------------------------------- ## Testing # A "basic test" consists of a foo.c source file. All basic tests use the # same basic_test.run driver script. The test name is passed as an additional # parameter to the driver script. This script just does # "compare_test EXIT-SUCCESS", i.e. records and replays the program and verifies # that the output of both runs is identical and contains EXIT-SUCCESS. # # NB: you must update this variable when adding a new test source # file. The list is not generated automatically. # # Alphabetical, please. set(BASIC_TESTS 64bit_child _llseek accept alarm alarm2 alsa_ioctl arch_prctl async_segv_ignored at_threadexit bad_ip bad_syscall barrier big_buffers block block_open brk brk2 capget chew_cpu chmod chown clock clock_nanosleep clone clone_bad_stack clone_bad_tls clone_file_range clone_immediate_exit clone_newflags clone_untraced cloned_sigmask constructor creat_address_not_truncated cwd_inaccessible daemon daemon_read desched_blocking_poll dup doublesegv epoll_create epoll_create1 eventfd exec_flags exec_no_env exec_self exec_from_main_thread exec_from_other_thread exit_with_syscallbuf_signal fadvise fanotify fault_in_code_page fcntl_owner_ex fcntl_dupfd fcntl_seals fcntl_sig fd_tracking_across_threads fds_clean flock flock2 fork_brk fork_child_crash fork_stress futex_pi futex_priorities fxregs getcpu getgroups getpwnam getrandom setitimer getsid gettimeofday grandchild_threads grandchild_threads_main_running grandchild_threads_thread_running grandchild_threads_parent_alive inotify int3 intr_futex_wait_restart intr_poll intr_ppoll intr_pselect intr_read_no_restart intr_read_restart intr_sleep intr_sleep_no_restart invalid_fcntl invalid_ioctl io ioctl ioctl_pty ioctl_tty kcmp kill_newborn legacy_ugid madvise madvise_free map_fixed membarrier memfd_create mincore mknod mlock mmap_discontinuous mmap_private mmap_ro mmap_self_maps_shared mmap_shared mmap_shared_multiple mmap_shared_subpage mmap_shared_write mmap_short_file mmap_tmpfs mprotect mprotect_heterogenous mprotect_none mprotect_stack mq mremap mremap_grow mremap_grow_shared mremap_non_page_size mremap_shrink msg msync mtio multiple_pending_signals multiple_pending_signals_sequential munmap_segv munmap_discontinuous nanosleep no_mask_timeslice numa old_fork orphan_process packet_mmap_disable pause perf_event personality pthread_rwlocks poll_sig_race ppoll prctl prctl_deathsig prctl_name prctl_tsc proc_fds proc_mem protect_rr_fds prw pthread_condvar_locking ptrace ptrace_attach_null_status ptrace_attach_running ptrace_attach_sleeping ptrace_attach_stopped ptrace_attach_thread_running ptrace_breakpoint ptrace_debug_regs ptrace_exec ptrace_exec32 ptrace_seize ptrace_sigchld_blocked ptrace_signals ptrace_syscall ptrace_syscall_clone_untraced ptrace_sysemu ptrace_trace_clone ptrace_trace_exit ptracer_death ptracer_death_multithread ptracer_death_multithread_peer quotactl rdtsc read_nothing readdir read_large read_oversize readlink readlinkat readv recvfrom rename rlimit robust_futex rusage samask save_data_fd # sched_attr ... disabled since suitable headers are not widely available yet sched_setaffinity sched_setparam sched_yield sched_yield_to_lower_priority scm_rights seccomp seccomp_null seccomp_tsync self_sigint sem sendfile set_ptracer set_tid_address setgid setgroups setsid setuid shm sigaction_old sigaltstack sigchld_interrupt_signal sigcont sighandler_fork sigill signal_deferred signal_unstoppable signalfd sigprocmask sigprocmask_in_syscallbuf_sighandler sigprocmask_rr_sigs sigprocmask_syscallbuf sigqueueinfo sigreturn sigreturn_reg sigreturnmask sigrt sigstop sigstop2 sigsuspend sigtrap simple sioc sock_names_opts spinlock_priorities splice stack_growth_after_syscallbuf stack_growth_syscallbuf stack_growth_with_guard stack_overflow stack_overflow_altstack stack_overflow_with_guard statfs stdout_child stdout_cloexec stdout_dup stdout_redirect strict_priorities switch_read symlink sync syscall_bp syscallbuf_signal_reset syscallbuf_sigstop syscallbuf_timeslice syscallbuf_timeslice2 sysconf sysctl sysemu_singlestep sysinfo tgkill thread_stress thread_yield timer timerfd times truncate uname unjoined_thread unshare utimes vfork_flush vfork_shared video_capture vm_readv_writev wait wait_sigstop write_race writev xattr zero_length_read ) set(BASIC_CPP_TESTS std_random ) # A "test with program" consists of a foo.c source file and a foo.run driver # script. See src/test/util.sh to learn how the .run files work. # # NB: you must update this variable when adding a new test source # file. The list is not generated automatically. # # Alphabetical, please. set(TESTS_WITH_PROGRAM abort_nonmain args async_kill_with_threads async_kill_with_threads_main_running async_kill_with_threads_thread_running async_segv async_signal_syscalls async_signal_syscalls2 async_signal_syscalls_siginfo async_usr1 block_clone_checkpoint block_clone_interrupted block_clone_syscallbuf_overflow block_intr_sigchld blocked_bad_ip blocked_sigill blocked_sigsegv breakpoint breakpoint_conditions breakpoint_overlap call_function # Disabled because it's very slow # check_session_leaks checkpoint_dying_threads checkpoint_mixed_mode checksum_sanity clone_interruption clone_vfork conditional_breakpoint_calls conditional_breakpoint_offload condvar_stress crash crash_in_function dconf_mock dev_tty dlopen execve_loop exit_codes exit_group exit_status explicit_checkpoints fork_syscalls function_calls getcwd goto_event hello # Disabled because issue #1806 makes tests fail on Debian 8.5 at least # history ignored_async_usr1 ignored_sigsegv immediate_restart int3_ok interrupt intr_ptrace_decline invalid_jump link madvise_dontfork main_thread_exit mmap_shared_prot mmap_write mprotect_growsdown mprotect_syscallbuf_overflow mutex_pi_stress priority ptrace_remote_unmap # Not called ps, because that interferes with using real 'ps' in tests rr_ps read_big_struct restart_abnormal_exit reverse_continue_breakpoint reverse_continue_multiprocess reverse_continue_process_signal reverse_many_breakpoints reverse_step_long reverse_step_threads reverse_step_threads_break search segfault shared_map shared_persistent_file signal_numbers stack_growth step_thread string_instructions string_instructions_async_signals string_instructions_replay string_instructions_watch syscallbuf_fd_disabling target_fork target_process term_nonmain term_rr term_trace_syscall thread_exit_signal threaded_syscall_spam threads tls ttyname unexpected_stack_growth user_ignore_sig vfork wait_for_all watchpoint watchpoint_at_sched watchpoint_before_signal watchpoint_syscall watchpoint_unaligned ) # A "test without program" is a foo.run driver script only, which does # something with one of the test executables above (or has special rules # to build its own executable). # # NB: you must update this variable when adding a new test source # file. The list is not generated automatically. # # Alphabetical, please. set(TESTS_WITHOUT_PROGRAM async_signal_syscalls_100 async_signal_syscalls_1000 bad_breakpoint break_block break_clock break_clone break_exec break_int3 break_mmap_private break_msg break_rdtsc break_sigreturn break_sync_signal break_thread break_time_slice breakpoint_consistent call_exit check_patched_pthread checkpoint_async_signal_syscalls_1000 checkpoint_mmap_shared checkpoint_prctl_name checkpoint_simple cont_signal cpuid dead_thread_target desched_ticks deliver_async_signal_during_syscalls env_newline exec_deleted exec_stop execp explicit_checkpoint_clone final_sigkill first_instruction fork_exec_info_thr gcrypt_rdrand get_thread_list hardlink_mmapped_files mprotect_step parent_no_break_child_bkpt parent_no_stop_child_crash post_exec_fpu_regs read_bad_mem record_replay remove_watchpoint restart_invalid_checkpoint restart_unstable restart_diversion reverse_alarm reverse_continue_exec_subprocess reverse_continue_fork_subprocess reverse_continue_start reverse_finish reverse_step_breakpoint reverse_step_signal reverse_step_threads2 reverse_watchpoint reverse_watchpoint_syscall run_end run_in_function sanity shm_checkpoint signal_stop signal_checkpoint simple_script simple_script_debug simple_winch stack_overflow_debug step1 step_rdtsc step_signal string_instructions_break string_instructions_replay_quirk subprocess_exit_ends_session switch_processes syscallbuf_timeslice_250 trace_version term_trace_cpu unwind_on_signal vfork_exec when ) foreach(test ${BASIC_TESTS} ${TESTS_WITH_PROGRAM}) add_executable(${test} src/test/${test}.c) post_build_executable(${test}) set_source_files_properties(src/test/${test}.c PROPERTIES COMPILE_FLAGS ${CMAKE_C_FLAGS_DEBUG}) add_dependencies(${test} Generated) target_link_libraries(${test} -lrt -ldl) endforeach(test) # Test disabled because it requires libuvc to be built and installed, and a # working USB camera # add_executable(usb src/test/usb.c) # post_build_executable(usb) # add_dependencies(usb Generated) # target_link_libraries(usb -lrt -L/usr/local/lib -luvc -lusb-1.0) foreach(test ${BASIC_CPP_TESTS}) add_executable(${test} src/test/${test}.cc) post_build_executable(${test}) set_source_files_properties(src/test/${test}.cc PROPERTIES COMPILE_FLAGS ${CMAKE_CXX_FLAGS_DEBUG}) add_dependencies(${test} Generated) target_link_libraries(${test} -lrt) endforeach(test) add_library(test_lib src/test/test_lib.c ) add_dependencies(test_lib Generated) target_link_libraries(constructor -lrt test_lib) # cpuid test needs to link with cpuid_loop.S add_executable(cpuid src/test/cpuid.c src/test/cpuid_loop.S) post_build_executable(cpuid) add_dependencies(cpuid Generated) target_link_libraries(cpuid -lrt) function(configure_test test) if("${test}" MATCHES "^checkpoint_") set(TIMEOUT 600) elseif("${test}" MATCHES "stress") set(TIMEOUT 600) else() set(TIMEOUT 120) endif() set_tests_properties(${test} PROPERTIES FAIL_REGULAR_EXPRESSION "FAILED" TIMEOUT ${TIMEOUT}) endfunction(configure_test) foreach(test ${BASIC_TESTS} ${BASIC_CPP_TESTS} ${OTHER_TESTS}) add_test(${test} bash ${CMAKE_SOURCE_DIR}/src/test/basic_test.run -b ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}) configure_test(${test}) add_test(${test}-no-syscallbuf bash ${CMAKE_SOURCE_DIR}/src/test/basic_test.run -n ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}) configure_test(${test}-no-syscallbuf) endforeach(test) foreach(test ${TESTS_WITH_PROGRAM} ${TESTS_WITHOUT_PROGRAM}) add_test(${test} bash ${CMAKE_SOURCE_DIR}/src/test/${test}.run -b ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}) configure_test(${test}) add_test(${test}-no-syscallbuf bash ${CMAKE_SOURCE_DIR}/src/test/${test}.run -n ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}) configure_test(${test}-no-syscallbuf) endforeach(test) # Run 32-bit tests on 64-bit builds. # We copy the test files into '32' subdirectories in the output # directory, so we can set different compile options on them. # This sucks but I can't find a better way to get CMake to build # the same source file in two different ways. if(rr_32BIT AND rr_64BIT) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/test/rrutil.h" "${CMAKE_CURRENT_BINARY_DIR}/32/rrutil.h" COPYONLY) foreach(test ${BASIC_TESTS} ${TESTS_WITH_PROGRAM} cpuid test_lib) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/test/${test}.c" "${CMAKE_CURRENT_BINARY_DIR}/32/${test}.c" COPYONLY) set_source_files_properties("${CMAKE_CURRENT_BINARY_DIR}/32/${test}.c" PROPERTIES COMPILE_FLAGS "-m32 ${CMAKE_C_FLAGS_DEBUG}") endforeach(test) foreach(test ${BASIC_CPP_TESTS}) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/test/${test}.cc" "${CMAKE_CURRENT_BINARY_DIR}/32/${test}.cc" COPYONLY) set_source_files_properties("${CMAKE_CURRENT_BINARY_DIR}/32/${test}.cc" PROPERTIES COMPILE_FLAGS "-m32 ${CMAKE_CXX_FLAGS_DEBUG}") endforeach(test) foreach(file cpuid_loop.S) configure_file("${CMAKE_CURRENT_SOURCE_DIR}/src/test/${file}" "${CMAKE_CURRENT_BINARY_DIR}/32/${file}" COPYONLY) set_source_files_properties("${CMAKE_CURRENT_BINARY_DIR}/32/${file}" PROPERTIES COMPILE_FLAGS -m32) endforeach(file) foreach(test ${BASIC_TESTS} ${TESTS_WITH_PROGRAM}) add_executable(${test}_32 "${CMAKE_CURRENT_BINARY_DIR}/32/${test}.c") post_build_executable(${test}_32) add_dependencies(${test}_32 Generated) set_target_properties(${test}_32 PROPERTIES LINK_FLAGS "-m32 ${CMAKE_C_FLAGS_DEBUG}") target_link_libraries(${test}_32 -lrt -ldl) endforeach(test) foreach(test ${BASIC_CPP_TESTS}) add_executable(${test}_32 "${CMAKE_CURRENT_BINARY_DIR}/32/${test}.cc") post_build_executable(${test}_32) add_dependencies(${test}_32 Generated) set_target_properties(${test}_32 PROPERTIES LINK_FLAGS "-m32 ${CMAKE_CXX_FLAGS_DEBUG}") target_link_libraries(${test}_32 -lrt) endforeach(test) add_library(test_lib_32 "${CMAKE_CURRENT_BINARY_DIR}/32/test_lib.c" ) add_dependencies(test_lib_32 Generated) set_target_properties(test_lib_32 PROPERTIES LINK_FLAGS -m32) target_link_libraries(constructor_32 -lrt test_lib_32) # cpuid test needs to link with cpuid_loop.S add_executable(cpuid_32 32/cpuid.c 32/cpuid_loop.S) post_build_executable(cpuid_32) add_dependencies(cpuid_32 Generated) set_target_properties(cpuid_32 PROPERTIES LINK_FLAGS -m32) target_link_libraries(cpuid_32 -lrt) foreach(test ${BASIC_TESTS} ${BASIC_CPP_TESTS} ${OTHER_TESTS}) add_test(${test}-32 bash ${CMAKE_SOURCE_DIR}/src/test/basic_test.run -b ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}_32) configure_test(${test}-32) add_test(${test}-32-no-syscallbuf bash ${CMAKE_SOURCE_DIR}/src/test/basic_test.run -n ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}_32) configure_test(${test}-32-no-syscallbuf) endforeach(test) foreach(test ${TESTS_WITH_PROGRAM} ${TESTS_WITHOUT_PROGRAM}) add_test(${test}-32 bash ${CMAKE_SOURCE_DIR}/src/test/${test}.run -b ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}_32) configure_test(${test}-32) add_test(${test}-32-no-syscallbuf bash ${CMAKE_SOURCE_DIR}/src/test/${test}.run -n ${CMAKE_SOURCE_DIR} ${PROJECT_BINARY_DIR} ${test}_32) configure_test(${test}-32-no-syscallbuf) endforeach(test) endif() set(CHAOS_TESTS core_count mmap_adjacent mmap_bits starvation_multithreaded starvation_singlethreaded ) foreach(test ${CHAOS_TESTS}) add_executable(${test} src/chaos-test/${test}.c) post_build_executable(${test}) target_link_libraries(${test} -lrt) endforeach(test) add_executable(ftrace_helper src/ftrace/ftrace_helper.c) include(ProcessorCount) ProcessorCount(N) if(NOT N EQUAL 0) set(JFLAG -j${N}) endif() add_custom_target(check COMMAND ${CMAKE_CTEST_COMMAND} --verbose ${JFLAG}) # Run only syscallbuf-enabled and native-bitness tests add_custom_target(fastcheck COMMAND ${CMAKE_CTEST_COMMAND} --verbose --exclude-regex '[-]' ${JFLAG}) ##-------------------------------------------------- ## Package configuration include (InstallRequiredSystemLibraries) set(CPACK_PACKAGE_NAME "rr") set(CPACK_PACKAGE_VERSION_MAJOR "${rr_VERSION_MAJOR}") set(CPACK_PACKAGE_VERSION_MINOR "${rr_VERSION_MINOR}") set(CPACK_PACKAGE_VERSION_PATCH "${rr_VERSION_PATCH}") set(CPACK_SYSTEM_NAME "${CMAKE_SYSTEM_NAME}-${CMAKE_SYSTEM_PROCESSOR}") set(CPACK_OUTPUT_FILE_PREFIX dist) set(CPACK_GENERATOR "TGZ;RPM;DEB") set(CPACK_SOURCE_GENERATOR "TGZ") set(CPACK_BINARY_DIR "${PROJECT_BINARY_DIR}") set(CPACK_STRIP_FILES TRUE) set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE") set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "Lightweight tool for recording and replaying execution of applications (trees of processes and threads)") set(CPACK_PACKAGE_DESCRIPTION_FILE "${CMAKE_SOURCE_DIR}/README.md") set(CPACK_PACKAGE_VENDOR "Mozilla Foundation") set(CPACK_DEBIAN_PACKAGE_MAINTAINER "Mozilla Foundation") set(CPACK_DEBIAN_PACKAGE_SECTION "devel") if(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "x86_64") set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "amd64") elseif(${CMAKE_SYSTEM_PROCESSOR} MATCHES "i.86") set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "i386") elseif(${CMAKE_SYSTEM_PROCESSOR} MATCHES "arm.*") set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "arm") endif() # XXX Cmake 2.8.7 doesn't know how to avoid specifying /usr, # /usr/bin, etc, as files to be installed, but distros are finicky # about their specification. We want to manually filter those paths # out of our install list but 2.8.7 also isn't capable of that. set(CPACK_RPM_USER_BINARY_SPECFILE "${CMAKE_SOURCE_DIR}/rr.spec") set(CPACK_RPM_PACKAGE_RELEASE 1) set(CPACK_RPM_PACKAGE_GROUP "Development/Debuggers") set(CPACK_RPM_PACKAGE_LICENSE "MIT and BSD") include (CPack) ##-------------------------------------------------- ## Misc add_custom_target(setup-travis COMMAND src/script/setup_travis.sh) rr-4.4.0/CONTRIBUTING.md000066400000000000000000000074051277367620400144170ustar00rootroot00000000000000## Submission Checklist Please make sure you go through this list before submitting a patch. The rules aren't hard and fast, but mostly adhering to them will make for quicker mergings. - [ ] Does your PR add support for a new kernel API? For example, supporting a new syscall. If so, your patch should include at least one new test for the API. This is usually pretty easy. See `$rr/src/test` for examples. - [ ] Did you run the rr test suite (including your new tests, if any), and pass all the tests? `make -C $objdir check`. Unfortunately, rr doesn't have automated infrastructure that can run the tests yet, so developers have to run them locally. - [ ] If you created new files for your PR, did you `git add` them? Habitually (or with a script or push hook) checking `git status` is a good habit to acquire. - [ ] If you changed the trace layout or format, did you bump `TRACE_VERSION`? - [ ] If you added new command-line parameters, did you update `print_usage()` to document them? - [ ] Does your PR apply cleanly on top of upstream/master HEAD? It's dangerous to have someone else sort out your merge conflicts, so just don't do it. Best of all is to have a PR *rebased* on top of upstream/master HEAD, so that the merge is simply a fast-forward. - [ ] If your PR includes multiple changesets, do they all (i) build cleanly in sequence; (ii) pass all tests in sequence? This is important for bisecting over commit history. - [ ] If your PR is a very large-scale change (for example, a rewrite in Rust to use the visitor pattern), did you discuss the proposed changes in an issue or the mailing list? It's hard to review large patches that just fall in ones lap. It's much easier to discuss the important changes at a high level and then approach the patch knowing what's important and what's not. - [ ] If your PR is large or includes many changesets, would it have been possible to break the changes into a series of smaller PRs? For example, it's hard to review a big patch that, say, fixes whitespace errors in a file along with a one-line, important, bug fix. It's much easier to review one PR that fixes whitespace (which can just be skimmed), and then review another PR that makes the one-line bug fix (which would be scrutinized more). This approach is also better for the patch author in that it usually allows the work to land faster, and reduces the burden of continually un-bit-rotting large, trivial, changes. - [ ] Did you check your code is formatted correctly? It's easiest to run ```` find src include -name '*.cc' -or -name '*.h' -or -name '*.c'|xargs clang-format -i -style=file ```` on each commit. ## Coding Guidelines rr uses assertions heavily, for code documentation, for automated checking that the code matches the documentation, and to improve the power of automated tests. Assertions are turned on in release builds. Whenever you depend on an invariant not immediately obvious, consider adding assertions to check it. rr ships with debugging enabled and compiler optimizations disabled for the rr process itself. That's because rr performance almost always depends on algorithmic issues --- minimizing the number of system calls, and especially, minimizing the number of context switches between the tracees and the rr process --- much more than the performance of the code running in the rr process. For the same reason, rr-process code should be as simple as possible even if that's less efficient. To some extent, once we're running code in the rr process, we've already lost performance-wise. OTOH we do enable optimizations in `preload.c` because that runs in tracees. ## Coding Style Put braces around all statement blocks, even one-line `if` bodies etc. All C++ declarations are in the `rr` namespace. All C++ types are in CamelCase; all C types are underscore_names. rr-4.4.0/Dockerfile000066400000000000000000000006271277367620400141570ustar00rootroot00000000000000FROM ubuntu:14.04 MAINTAINER Ted Mielczarek RUN dpkg --add-architecture i386 RUN apt-get update && apt-get install -qq linux-libc-dev linux-libc-dev:i386 gcc-multilib libc6-dev:i386 rpm lib32stdc++6 zlib1g:i386 zlib1g-dev:i386 python-pexpect build-essential gcc g++ gcc-4.8 g++-4.8 cmake pkg-config zlib1g-dev gdb cpp cpp-4.8 RUN ln -s /usr/lib32/libstdc++.so.6 /usr/lib32/libstdc++.so rr-4.4.0/LICENSE000066400000000000000000000051071277367620400131700ustar00rootroot00000000000000Copyright (c) 2013 Mozilla Foundation Copyright 2015 VMware, Inc Copyright 2015 Google Inc. Contributors: Albert Noll , Thomas Anderegg , Nimrod Partush Andrew Walton Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. /* * Copyright 2002 Niels Provos * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ rr-4.4.0/README.md000066400000000000000000000013411277367620400134360ustar00rootroot00000000000000[![Build Status (travis)](https://travis-ci.org/mozilla/rr.svg?branch=master "Travis")](https://travis-ci.org/mozilla/rr) rr is a lightweight tool for recording and replaying execution of applications (trees of processes and threads). More information about the project, including instructions on how to install, run, and build rr, is at [http://rr-project.org](http://rr-project.org). Or go directly to the [installation and building instructions](https://github.com/mozilla/rr/wiki/Building-And-Installing). Please contribute! Make sure to review the [pull request checklist](/CONTRIBUTING.md) before submitting a pull request. If you find rr useful, please [add a testimonial](https://github.com/mozilla/rr/wiki/Testimonials). rr-4.4.0/configure000077500000000000000000000001201277367620400140600ustar00rootroot00000000000000#!/bin/bash # Helper to make |./configure && make| do what you expect. cmake . rr-4.4.0/doc/000077500000000000000000000000001277367620400127255ustar00rootroot00000000000000rr-4.4.0/doc/res/000077500000000000000000000000001277367620400135165ustar00rootroot00000000000000rr-4.4.0/doc/res/syscall-buffer.svg000066400000000000000000000251101277367620400171570ustar00rootroot00000000000000ptrace traps vs. syscall bufferingptrace trapssyscallsyscallrrtraprrtraprrtraprrtraprrtrapsyscall bufferingsyscallsyscallsyscallsyscallsyscallbufferflushrrbufferbufferbuffersyscallsyscallsyscallrr-4.4.0/doc/rr.html000066400000000000000000001216231277367620400142430ustar00rootroot00000000000000 rr

How rr works

rr records nondeterministic executions and debugs them deterministically.

Practical tool; version 1.2 is latest release. Used to debug Firefox.

Why?

Deterministic debugging: record nondeterministic failure once, debug deterministically forever.

Record intermittent test failures "at scale" online, debug the recordings offline at leisure.

Omniscient debugging: issue queries over program state changes; go backwards in time.

Overview

rr record prog --args
→saves recording

rr replay
→debugger socket drives replay of most recent recording

Most of an application's execution is deterministic.

rr records the nondeterministic parts.

Examples of nondeterministic inputs

  • clock_gettime(...&now);
  • read(fd, buf, 4096);
  • __asm__("rdtsc")
  • ioctl(...)
  • UNIX signals...

Then during replay, emulate system calls and rdtsc by writing the saved nondeterministic data back to the tracee.

Shared-memory multitasking is a nondeterministic "input".

... but modern hardware can't record it efficiently. So rr doesn't record truly parallel executions.

Scheduling tasks

Can switch tasks at syscalls. Must preempt straight-line code too; and replay the preemptions deterministically.

Hardware performance counters (HPCs)

Recent chips count instructions-retired, branches-retired, ..., and can be programmed to interrupt after a count of x.

Simulate task preemption with HPC interrupts.

Idea: program insns-retired counter to interrupt after k ✱. That k approximates a time slice.

Replaying preemption

Record the insn-retired counter value v to the trace file. During replay, program the interrupt for v. Voilà.

UNIX signals are recorded and replayed like task preemptions.

Record counter value v and signum. Replay by interrupting after v and "delivering" signum.

System requirements

Basic requirements

  • Intel chip with Nehalem (2010) or later µarch1. VM with perf counter virtualization is OK.
  • x86 userspace. x86-64 kernel is OK.
  • linux with PTRACE_INTERRUPT support: ≥ 3.4
  • (strongly encouraged) linux with seccomp-bpf support: ≥ 3.5
1 Some Haswell chips don't work with rr (yet).

rr touches low-level details of machine architecture, by necessity; f.e. kernel syscall ABI.

Supporting more ISAs is "just work". x86-64 coming.

ARM chips don't have the performance counters that rr requires.

So no ARM support is possible at the moment.

Precise HPC events identify points in execution.

Precise replay of signals and preemption requires interrupting tracees at these events.

✱Performance counters are messier in reality

  • Insns-retired counter is imprecise. Use precise retired-branch counter instead.
  • Counter interrupts can overshoot. Subtract a "skid region".
  • (So replay point is technically indeterminate. But doesn't seem to be a problem in practice, yet.)

seccomp-bpf enables rr to selectively trace syscalls.

Only trap to rr for syscalls that can't be handled in the tracee. Over 100x faster in µbenchmarks.

Buffer syscalls; flush buffer as "super event"

Recorder implementation

Tasks are controlled through the ptrace API.

HPCs are controlled through the perf event API.

The first traced task is forked from rr. After that, clone() and fork()from tracees add new tasks.

And tasks die at exit().

Simplified recorder loop

    while live_task():
        task t = schedule()
        if not status_changed(t):
            resume_execution(t)
        state_change(t)
src/recorder.cc

Scheduling a task

    task schedule():
        for each task t, round-robin:
            if is_runnable(t)
               or status_changed(t):
                return t
        tid = waitpid(ANY_CHILD_TASK)
        return task_map[tid]
src/recorder_sched.cc

Tasks changing status

    bool status_changed(task t):
        # Non-blocking
        return waitpid(t.tid, WNOHANG)

    # Deceptively simple: includes
    # syscalls, signals, ptrace
    # events ...
src/task.cc

Resuming task execution

Invariant: At most one task is running userspace code. All other tasks are either idle or awaiting completion of a syscall.†

Multiple running tasks suffer from shared-memory hazards.

rr doesn't attempt to record these hazards, so can't replay them deterministically.

Resuming a task, simplified

    void resume_execution(task t):
        ptrace(PTRACE_SYSCALL, t.tid)
        waitpid(t.tid)  # Blocking

    # Again, deceptively simple: traps
    # for syscalls, signals, ptrace
    # events ...
src/{recorder, task}.cc

Most recorder work is done for state_change(task t).

But before looking at it, a few digressions ...

Generating time-slice interrupts

  • perf_event_open() fd for retired-conditional-branches; details are µarch specific
  • Set event "sample period" to k
  • Make event fd O_ASYNC and set tracee task as owner
  • → tracee sent SIGSTKFLT at rbc ≈ k
src/hpc.cc

Trapping tracees at rdtsc

  • prctl(PR_SET_TSC, PR_TSC_SIGSEGV) → tracees executing rdtsc trap to SIGSEGV
  • rr examines which instruction triggered SIGSEGV
  • if rdtsc, value is recorded by rr tracer and tracee insn is emulated

Tracees generate ptrace events by executing fork, clone, exit, and some other syscalls.

ptrace events exist for linux reasons that aren't interesting.

(rr tracees can share memory mappings with other processes.

Not possible to record efficiently in SW; needs kernel and/or HW support. Unsupported until then.)

Tracee events recorded by state_change()

  • "Pseudo"-signals delivered by implementation of rdtsc or time-slice interrupts
  • Other, "real", signals
  • ptrace events
  • Syscall entry and exit

Some syscalls must be executed atomically; can't switch task until syscall finishes.

Ex: mmap modifies address space, can race other syscalls.

On the other hand, some syscalls require switching; syscall can't finish until the task switches.

Ex: waitpid() only returns after child runs, changes state.

Problem: kernel writes non-atomic syscall outparams in an order that rr can't record.

Kernel outparam writes race rr tracees in userspace, syscalls.

Solution: allocate scratch space for the outparams of non-atomic syscalls. At syscall exit, write scratch data back to outparams.

→ rr orders outparam writes

POSIX signals can arrive at practically any point in execution and invoke signal handler code.

→ tracee code can be (almost) arbitrarily re-entered

Linux exits tracees out of syscalls with an ERESTART* error code before delivering signals. Syscall not always restarted after signal.

Sighandler nesting gets complex.

When a signal becomes pending

  • consult sighandler table to see if there's a registered sighandler function
  • if so, SINGLESTEP into the sighandler frame and record the struct sigframe set up by kernel. Also record sighandler registers.
  • otherwise, deliver the signal using the ptrace API

Sighandlers exit using the SYS_sigreturn syscall. rr uses these calls to help determine whether interrupted syscalls are restarted.

Tracees exit in unpredictable order at fatal signals like SIGABRT. Naïve waitpid() calls deadlock.

exit_group: same problem.

"Unstable" tracee exit

rr solves this by detaching and not waiting on affected tracees.

†Breaks rr scheduling invariant.

Syscall buffer

ptrace traps are expensive. Better to do as much work in tracee process as possible.

Use seccomp-bpf to selectively trap syscalls.

Syscall hooks are LD_PRELOAD'd into tracees.

Hook functions record kernel return value and outparam data to the syscall buffer.

rr monkeypatches __kernel_vsyscall() in vdso to jump to rr trampoline.

Trampoline calls dispatcher, which calls rr hook if available.

Untraced syscalls are recorded to syscallbuf by tracee. Traced events recorded by the rr process "flush" the tracee's syscallbuf.

Lib falls back on traced syscalls.

Simplified example of syscallbuf hook function

static int sys_close(int fd)
{
	long ret;
	if (!start_buffer_syscall(SYS_close))
		/* Fall back on traced syscall.
                 * This generates a ptrace trap. */
		return syscall(SYS_close, fd);

	/* Untraced syscall. Does not generate
         * ptrace trap.*/
	ret = untraced_syscall1(SYS_close, fd);
        /* Save the result to syscall buffer. */
	return commit_syscall(SYS_close, ret);
}

How untraced syscalls are made

  • Create single "untraced" kernel entry point 
    asm("_untraced_syscall:\n\t"
    "int $0x80");
  • Install seccomp-bpf filter that passes calls from _untraced_syscall, traps to rr otherwise.

seccomp-bpf traps generate PTRACE_EVENT_SECCOMP in tracer process.

rr can then PTRACE_SYSCALL the tracee into traced syscall.

Problem: buffered syscalls don't trap to rr, by design. But may-block syscalls (f.e. waitpid()) require rr to schedule another task.

perf events to the rescue: "descheduled" event

Set event to fire on tracee context switch. Event traps to rr.

Buffered syscall blocks → context switch → rr trap

Generating desched events

  • In tracee, perf_event_open() fd for context-switch counter
  • Set event "sample period" to 1 (i.e. next context switch) just before buffered syscall
  • Disarm event just after buffered syscall.
  • → tracee sent SIGSYS if context switched during buffered syscall
src/preload/preload.c

Saved traces

Traces are saved to $XDG_DATA_HOME/rr, or ~/.rr.

Stored on disk uncompressed. Trace compression is planned.

Trace directory contents

  • args_env: command-line args and environment pairs used to execvpe() initial tracee
  • events: sequence of syscalls, signals, and various other execution events
  • mmaps: metadata about mmap'd files
  • data/data_header: all recorded data, along with metadata about when it was recorded
  • version: trace format version number

Replayer implementation

Emulate most syscalls using trace data.

Actually execute a small number.

Built around PTRACE_SYSEMU

SYSCALL runs tracee to syscall, executes it.

SYSEMU runs to syscall, doesn't execute it. rr replays side effects.

Replaying time-slice interrupts, in theory

Program instructions counter to interrupt after the recorded t number of instructions.

Tracee stops at t.

Replaying time-slice interrupts, in practice

  • have to use retired-conditional-branch counter (RBC)
  • RBC interrupts aren't precise. Can overshoot by up to 70 branches.
  • RBC counter value doesn't uniquely identify a point in execution (unlike retired-insn counter value)

Finding execution target, in practice

  • program RBC interrupt for target-rbc - SKID_SIZE
  • after RBC interrupt, set breakpoint on target $ip to avoid single-stepping when possible
  • when breakpoint hit, compare RBC value and register files to guess if at execution target. If RBC and regs match what was recorded, done.

To reiterate, this is not sound.

Deterministic signals were raised by program execution. For example, *NULL = 42;

Replayed "naturally" in the course of execution.

Async signals were raised externally at some execution point during recording.

Replay to that execution point just as for time-slice interrupts.

Replay signal delivery by emulating

If there was a sighandler, restore recorded sigframe and registers at sighandler entry.

Otherwise, nothing else to do.

Replaying buffered syscalls

Read saved buffer from trace.

Replay each syscall as normal, but restore outparam data from records in the read buffer.

Debugger interface

Common commands supported.

c, s, si, b, bt, watch, info regs, thr, info thr ...

(rr) call foo() can cause replay divergence.

So you're not allowed to do it … for now. Support coming.

Small stub translates from and to gdb remote protocol.

Then passes debugger requests up to rr replayer.

src/debugger_gdb.cc

Replayer fulfills requests using ptrace() or cached data.

And resumes tracee execution when asked.

src/replayer.cc

Breakpoints, int $3, stepi, watchpoints all raise SIGTRAP.

$ip, breakpoint table, gdb request, and $DR6 decode trap.

src/replayer.cc

Future work

Checkpointing

Make a "deep fork" of tracee tree during replay.

Run code (or whatever) in copied tree, return to original.

Omniscient debugging (aka chroniclerr)

Use chronicle-style instrumentation to generate execution DB.

Query state changes in DB.

CHESS-style execution search; targeted recording

At each scheduling decision, make a checkpoint.

If execution reaches bad state, done. Else, resume checkpoint.

Other projects

  • Copy traces across machines
  • Integrate hardware shared-memory multithreading recorder like QuickRec
  • Record ptrace API; rr record rr record…
  • Handle GPU drivers (NVIDIA, ATI, ...)
  • Port to Darwin kernel
  • Port to Windows NT kernel
  • ARM port not possible with current generation of chips

Thanks from the rr team!

Appendix: rr for RnR people

Release 1.2 available today at

rr-project.org

Use cases

  • Run on modern, commodity hardware and software: dnf install rr; rr record…
  • Aspire to general tool, focus on Firefox initially
  • Record nondeterministic test failures at scale (e.g., Firefox build/test infra), debug offline
  • "Super-debugger" for local development
  • Search execution space to actively find bugs

Design concerns

  • Commodity HW → only record single HW thread (for now!)
  • Commodity SW → stick to higher-level userspace APIs (e.g., ptrace, PEBS)
  • Record tests at scale → record perf must be "economical", but not mission-critical
  • "Super-debugger" → the usual, plus queries over execution history; pretty fast replay
  • Search exe space → flexible scheduling and checkpointing

rr recorder overview

  • Record "applications" consisting of linux tasks
  • Schedule CPU slices by programming precise counter interrupt (retired branches, RBC) for k
  • Time slice is special case of signal: time-slice recorded as (0, rec-RBC), signals (signum, rec-RBC)
  • Record kernel-created signal stack
  • Syscall "outparams" and rdtsc generate trace traps; results saved to log
  • Plus a "faster" mode we'll cover later

Trade-off: scheduling from userspace

  • While it's great to fully control scheduling ...
  • ... we have to approximate timeslices; can be unfair
  • ... interactive programs don't "feel" native; rr has its own heuristics
  • ... can be slower
  • Future work is to have the option of both

Headache: kernel writes racing with userspace

  • rr doesn't (can't efficiently) record reads/writes of memory shared outside of tracee application.
  • But there are still hazards with the kernel:
  • ... kernel-write/task-read hazard on syscall outparam buffers → rr replaces user buffers with scratch and serializes writes
  • ... kernel-write/task-read on random futexes, e.g. CLONE_CHILD_CLEARTID → no good solution yet; usleep…

rr replayer overview

  • Replay signal/time-slice (signum, rec-RBC) by programming interrupt for rec-RBC
  • Emulate signals by restoring signal stack and regs
  • Emulate syscalls by restoring outparams where possible
  • Execute non-emulatable clone/mmap/et al. as required
  • Serve debugger requests (maybe covered later)

Replayer headache: slack in counter interrupts

  • Interrupt programmed for RBC = k may actually fire at up to RBC = k + slack
  • (Slack empirically seen to be >= 70 branches)
  • So we program interrupt for RBC = k - slack and then advance by breakpoint+stepi
  • "At target" when rec-RBC == rep-RBC and [rec-regs] == [rep-regs]
  • Replay target therefore technically indeterminate

Recorder "fast mode": syscall buffering

  • ptrace traps are slow
  • Idea: avoid them when possible by buffering log data in tracee task
  • Implementation: LD_PRELOAD a helper library with hooks for common syscalls (read, write, gettimeofday, etc.)
  • Hook makes fast untraced syscall, saves outparams in task-local buffer
  • Flush buffer at traced event (including buffer overflow)

Headache: many syscalls made internally in glibc

  • Those syscalls can't be wrapped by usual approach of interposing exported symbol using LD_PRELOAD
  • Solution: monkeypatch __kernel_vsyscall() in vdso.
  • Syscalls directly made through int $0x80 still can't be buffered.
  • We hope this terrible hack evolves into kernel support.

Headache: buffering syscalls that may block

  • read/write/… may block if buffer empty/full/…
  • But, untraced syscall from wrapper means no trap to rr for scheduling arbitration
  • If another tracee is blocked too, then may deadlock
  • Solution: libc wrapper programs perf_event interrupt triggered by next context-switch of task
  • If the syscall blocks, task is switched out, and rr tracer gets interrupt (SIGIO from perf_event)

Fun debugging tricks

  • Save register / RBC info at all events, verify in replay
  • Generate memory checksums at selected events, verify in replay
  • LLVM pass to add "execution path logging" (Bell-Larus): poor man's log of retired branches. Save to "magic fd" in recording, verify in replay.
  • Hack replayer itself to efficiently log arbitrary info at arbitrary points
rr-4.4.0/include/000077500000000000000000000000001277367620400136035ustar00rootroot00000000000000rr-4.4.0/include/rr/000077500000000000000000000000001277367620400142265ustar00rootroot00000000000000rr-4.4.0/include/rr/rr.h000066400000000000000000000025511277367620400150250ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_H_ #define RR_H_ /** * rr tracees can write data to this special fd that they want * verified across record/replay. When it's written in recording, rr * saves the data. During replay, the data are checked against the * recorded data. * * Tracees using this interface should take care that the buffers * storing the data are either not racy, or are synchronized by the * tracee. * * To simplify things, we make this a valid fd opened to /dev/null during * recording. * * Tracees may close this fd, or dup() something over it, etc. If that happens, * it will lose its magical properties. */ #define RR_MAGIC_SAVE_DATA_FD 999 /** * rr uses this fd to ensure the tracee has access to the original root * directory after a chroot(). Tracee close()es of this fd will be silently * ignored, and tracee dup()s to this fd will fail with EBADF. */ #define RR_RESERVED_ROOT_DIR_FD 1000 /** * The preferred fd that rr uses to control tracee desched. Some software * (e.g. the chromium IPC code) wants to have the first few fds all to itself, * so we need to stay above some floor. Tracee close()es of the fd that is * actually assigned will be silently ignored, and tracee dup()s to that fd will * fail with EBADF. */ #define RR_DESCHED_EVENT_FLOOR_FD 100 #endif /* RR_H_ */ rr-4.4.0/rr.spec000066400000000000000000000034411277367620400134610ustar00rootroot00000000000000Buildroot: @CPACK_BINARY_DIR@/_CPack_Packages/@CPACK_SYSTEM_NAME@/RPM/@CPACK_PACKAGE_FILE_NAME@ Summary: Lightweight tool for recording and replaying execution of applications (trees of processes and threads) Name: @CPACK_PACKAGE_NAME@ Version: @CPACK_PACKAGE_VERSION@ Release: @CPACK_RPM_PACKAGE_RELEASE@ License: @CPACK_RPM_PACKAGE_LICENSE@ Group: Development/Debuggers Vendor: @CPACK_PACKAGE_VENDOR@ Prefix: @CPACK_PACKAGING_INSTALL_PREFIX@ @CPACK_RPM_PACKAGE_REQUIRES@ %define _rpmdir @CPACK_BINARY_DIR@/_CPack_Packages/@CPACK_SYSTEM_NAME@/RPM %define _rpmfilename @CPACK_PACKAGE_FILE_NAME@.rpm %define _unpackaged_files_terminate_build 0 %define _topdir @CPACK_BINARY_DIR@/_CPack_Packages/@CPACK_SYSTEM_NAME@/RPM %description rr is a lightweight tool for recording and replaying execution of applications (trees of processes and threads). For more information, please visit http://rr-project.org # This is a shortcutted spec file generated by CMake RPM generator # we skip _install step because CPack does that for us. # We do only save CPack installed tree in _prepr # and then restore it in build. %prep mv $RPM_BUILD_ROOT @CPACK_BINARY_DIR@/_CPack_Packages/@CPACK_SYSTEM_NAME@/RPM/tmpBBroot %install if [ -e $RPM_BUILD_ROOT ]; then rm -Rf $RPM_BUILD_ROOT fi mv "@CPACK_BINARY_DIR@/_CPack_Packages/@CPACK_SYSTEM_NAME@/RPM/tmpBBroot" $RPM_BUILD_ROOT %files %defattr(-,root,root,-) @CPACK_PACKAGING_INSTALL_PREFIX@/lib/* @CPACK_PACKAGING_INSTALL_PREFIX@/bin/rr @CPACK_PACKAGING_INSTALL_PREFIX@/bin/rr_exec_stub* @CPACK_PACKAGING_INSTALL_PREFIX@/bin/rr_page* @CPACK_PACKAGING_INSTALL_PREFIX@/bin/signal-rr-recording.sh @CPACK_PACKAGING_INSTALL_PREFIX@/share/rr/*.xml %changelog * Tue Jun 25 2013 Chris Jones - - Initial build. rr-4.4.0/scripts/000077500000000000000000000000001277367620400136475ustar00rootroot00000000000000rr-4.4.0/scripts/reformat.sh000077500000000000000000000001211277367620400160170ustar00rootroot00000000000000#!/bin/sh find src -regex '.*\.\(c\|h\|cc\)$'|xargs clang-format -style=file -i rr-4.4.0/scripts/signal-rr-recording.sh000077500000000000000000000010561277367620400200600ustar00rootroot00000000000000#!/usr/bin/bash signal=$1 if [[ "$signal" == "" ]]; then echo "Usage: $0 " >&2 echo "Sends to all processes being recorded by rr" >&2 exit 1 fi function signal_descendants { pid=$1 for child in `ps -o pid= --ppid $pid`; do echo Sending $signal to $child kill -s $signal $child signal_descendants $child done } for rr_pid in `pidof rr` ; do if cat /proc/$rr_pid/cmdline | tr '\0' '\n' | head -n2 | tail -n1 | grep -qz '\(^record$\)\|/' ; then signal_descendants $rr_pid fi done rr-4.4.0/src/000077500000000000000000000000001277367620400127475ustar00rootroot00000000000000rr-4.4.0/src/AddressSpace.cc000066400000000000000000001631711277367620400156300ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "AddressSpace.h" #include #include #include #include #include #include "rr/rr.h" #include "preload/preload_interface.h" #include "AutoRemoteSyscalls.h" #include "MonitoredSharedMemory.h" #include "RecordSession.h" #include "RecordTask.h" #include "Session.h" #include "Task.h" #include "log.h" using namespace std; namespace rr { /*static*/ const uint8_t AddressSpace::breakpoint_insn; /** * Advance *str to skip leading blank characters. */ static const char* trim_leading_blanks(const char* str) { const char* trimmed = str; while (isblank(*trimmed)) { ++trimmed; } return trimmed; } /** * The following helper is used to iterate over a tracee's memory * map. */ class KernelMapIterator { public: KernelMapIterator(Task* t) : tid(t->tid) { init(); } KernelMapIterator(pid_t tid) : tid(tid) { init(); } ~KernelMapIterator() { if (maps_file) { fclose(maps_file); } } // It's very important to keep in mind that btrfs files can have the wrong // device number! const KernelMapping& current(string* raw_line = nullptr) { if (raw_line) { *raw_line = this->raw_line; } return km; } bool at_end() { return !maps_file; } void operator++(); private: void init() { char maps_path[PATH_MAX]; sprintf(maps_path, "/proc/%d/maps", tid); if (!(maps_file = fopen(maps_path, "r"))) FATAL() << "Failed to open " << maps_path; ++*this; } pid_t tid; FILE* maps_file; string raw_line; KernelMapping km; }; void KernelMapIterator::operator++() { char line[PATH_MAX * 2]; if (!fgets(line, sizeof(line), maps_file)) { fclose(maps_file); maps_file = nullptr; return; } uint64_t start, end, offset, inode; int dev_major, dev_minor; char flags[32]; int chars_scanned; int nparsed = sscanf(line, "%" SCNx64 "-%" SCNx64 " %31s %" SCNx64 " %x:%x %" SCNu64 " %n", &start, &end, flags, &offset, &dev_major, &dev_minor, &inode, &chars_scanned); assert(8 /*number of info fields*/ == nparsed || 7 /*num fields if name is blank*/ == nparsed); // trim trailing newline, if any int last_char = strlen(line) - 1; if (line[last_char] == '\n') { line[last_char] = 0; } raw_line = line; const char* name = trim_leading_blanks(line + chars_scanned); #if defined(__i386__) if (start > numeric_limits::max() || end > numeric_limits::max() || strcmp(name, "[vsyscall]") == 0) { // We manually read the exe link here because // this helper is used to set // |t->vm()->exe_image()|, so we can't rely on // that being correct yet. char proc_exe[PATH_MAX]; char exe[PATH_MAX]; snprintf(proc_exe, sizeof(proc_exe), "/proc/%d/exe", tid); readlink(proc_exe, exe, sizeof(exe)); FATAL() << "Sorry, tracee " << tid << " has x86-64 image " << exe << " and that's not supported with a 32-bit rr."; } #endif int prot = (strchr(flags, 'r') ? PROT_READ : 0) | (strchr(flags, 'w') ? PROT_WRITE : 0) | (strchr(flags, 'x') ? PROT_EXEC : 0); int f = (strchr(flags, 'p') ? MAP_PRIVATE : 0) | (strchr(flags, 's') ? MAP_SHARED : 0); km = KernelMapping(start, end, name, MKDEV(dev_major, dev_minor), inode, prot, f, offset); } static KernelMapping read_kernel_mapping(pid_t tid, remote_ptr addr) { MemoryRange range(addr, 1); for (KernelMapIterator it(tid); !it.at_end(); ++it) { const KernelMapping& km = it.current(); if (km.contains(range)) { return km; } } return KernelMapping(); } KernelMapping AddressSpace::read_kernel_mapping(Task* t, remote_ptr addr) { return rr::read_kernel_mapping(t->tid, addr); } KernelMapping AddressSpace::read_local_kernel_mapping(uint8_t* addr) { return rr::read_kernel_mapping(getpid(), remote_ptr((uintptr_t)addr)); } /** * Cat the /proc/[t->tid]/maps file to stdout, line by line. */ static void print_process_mmap(Task* t) { for (KernelMapIterator it(t); !it.at_end(); ++it) { string line; it.current(&line); cerr << line << '\n'; } } AddressSpace::Mapping::Mapping(const KernelMapping& map, const KernelMapping& recorded_map, EmuFile::shr_ptr emu_file, std::unique_ptr mapped_file_stat, void* local_addr, shared_ptr&& monitored) : map(map), recorded_map(recorded_map), emu_file(emu_file), mapped_file_stat(move(mapped_file_stat)), local_addr(static_cast(local_addr)), monitored_shared_memory(move(monitored)), flags(FLAG_NONE) {} static unique_ptr clone_stat( const unique_ptr& other) { return other ? unique_ptr(new struct stat(*other)) : nullptr; } AddressSpace::Mapping::Mapping(const Mapping& other) : map(other.map), recorded_map(other.recorded_map), emu_file(other.emu_file), mapped_file_stat(clone_stat(other.mapped_file_stat)), local_addr(other.local_addr), monitored_shared_memory(other.monitored_shared_memory), flags(other.flags) {} AddressSpace::Mapping::~Mapping() {} AddressSpace::~AddressSpace() { session_->on_destroy(this); } void AddressSpace::after_clone() { allocate_watchpoints(); } static uint32_t find_offset_of_syscall_instruction_in(SupportedArch arch, uint8_t* vdso_data, size_t vdso_len) { auto instruction = syscall_instruction(arch); for (uint32_t i = 1; i < vdso_len - instruction.size(); ++i) { if (memcmp(vdso_data + i, instruction.data(), instruction.size()) == 0) { return i; } } return 0; } uint32_t AddressSpace::offset_to_syscall_in_vdso[SupportedArch_MAX + 1]; remote_code_ptr AddressSpace::find_syscall_instruction(Task* t) { SupportedArch arch = t->arch(); if (!offset_to_syscall_in_vdso[arch]) { auto vdso_data = t->read_mem(vdso().start().cast(), vdso().size()); offset_to_syscall_in_vdso[arch] = find_offset_of_syscall_instruction_in( arch, vdso_data.data(), vdso_data.size()); ASSERT(t, offset_to_syscall_in_vdso[arch]) << "No syscall instruction found in VDSO"; } return remote_code_ptr( (vdso().start().cast() + offset_to_syscall_in_vdso[arch]) .as_int()); } static string find_rr_page_file(Task* t) { string path = exe_directory() + "../bin/rr_page_"; switch (t->arch()) { case x86: path += "32"; break; case x86_64: path += "64"; break; default: ASSERT(t, false) << "Unknown architecture"; return path; } if (!t->session().is_recording()) { path += "_replay"; } return path; } static vector read_all(Task* t, ScopedFd& fd) { char buf[4096]; vector result; while (true) { int ret = read(fd, buf, sizeof(buf)); ASSERT(t, ret >= 0); if (ret == 0) { return result; } result.insert(result.end(), buf, buf + ret); } } void AddressSpace::map_rr_page(AutoRemoteSyscalls& remote) { int prot = PROT_EXEC | PROT_READ; int flags = MAP_PRIVATE | MAP_FIXED; string file_name; Task* t = remote.task(); SupportedArch arch = t->arch(); string path = find_rr_page_file(t); AutoRestoreMem child_path(remote, path.c_str()); // skip leading '/' since we want the path to be relative to the root fd long child_fd = remote.syscall(syscall_number_for_openat(arch), RR_RESERVED_ROOT_DIR_FD, child_path.get() + 1, O_RDONLY); if (child_fd >= 0) { remote.infallible_mmap_syscall(rr_page_start(), rr_page_size(), prot, flags, child_fd, 0); struct stat fstat = t->stat_fd(child_fd); file_name = t->file_name_of_fd(child_fd); remote.infallible_syscall(syscall_number_for_close(arch), child_fd); map(t, rr_page_start(), rr_page_size(), prot, flags, 0, file_name, fstat.st_dev, fstat.st_ino); } else { ASSERT(t, child_fd == -EACCES) << "Unexpected error mapping rr_page"; flags |= MAP_ANONYMOUS; remote.infallible_mmap_syscall(rr_page_start(), rr_page_size(), prot, flags, -1, 0); ScopedFd page(path.c_str(), O_RDONLY); ASSERT(t, page.is_open()) << "Error opening rr_page ourselves"; vector page_data = read_all(t, page); t->write_bytes_helper(rr_page_start(), page_data.size(), page_data.data()); map(t, rr_page_start(), rr_page_size(), prot, flags, 0, file_name, 0, 0); } if (t->session().is_recording()) { // brk() will not have been called yet so the brk area is empty. brk_start = brk_end = remote.infallible_syscall(syscall_number_for_brk(arch), 0); ASSERT(t, !brk_end.is_null()); } traced_syscall_ip_ = rr_page_syscall_entry_point( TRACED, UNPRIVILEGED, RECORDING_AND_REPLAY, t->arch()); privileged_traced_syscall_ip_ = rr_page_syscall_entry_point( TRACED, PRIVILEGED, RECORDING_AND_REPLAY, t->arch()); } /** * Must match generate_rr_page.py */ static const AddressSpace::SyscallType entry_points[] = { { AddressSpace::TRACED, AddressSpace::UNPRIVILEGED, AddressSpace::RECORDING_AND_REPLAY }, { AddressSpace::TRACED, AddressSpace::PRIVILEGED, AddressSpace::RECORDING_AND_REPLAY }, { AddressSpace::UNTRACED, AddressSpace::UNPRIVILEGED, AddressSpace::RECORDING_AND_REPLAY }, { AddressSpace::UNTRACED, AddressSpace::UNPRIVILEGED, AddressSpace::REPLAY_ONLY }, { AddressSpace::UNTRACED, AddressSpace::UNPRIVILEGED, AddressSpace::RECORDING_ONLY }, { AddressSpace::UNTRACED, AddressSpace::PRIVILEGED, AddressSpace::RECORDING_AND_REPLAY }, { AddressSpace::UNTRACED, AddressSpace::PRIVILEGED, AddressSpace::REPLAY_ONLY }, { AddressSpace::UNTRACED, AddressSpace::PRIVILEGED, AddressSpace::RECORDING_ONLY }, }; static remote_code_ptr ip_from_index(size_t i) { return remote_code_ptr(RR_PAGE_ADDR + RR_PAGE_SYSCALL_STUB_SIZE * i + RR_PAGE_SYSCALL_INSTRUCTION_END); } remote_code_ptr AddressSpace::rr_page_syscall_exit_point(Traced traced, Privileged privileged, Enabled enabled) { for (auto& e : entry_points) { if (e.traced == traced && e.privileged == privileged && e.enabled == enabled) { return ip_from_index(&e - entry_points); } } return nullptr; } const AddressSpace::SyscallType* AddressSpace::rr_page_syscall_from_exit_point( remote_code_ptr ip) { for (size_t i = 0; i < array_length(entry_points); ++i) { if (ip_from_index(i) == ip) { return &entry_points[i]; } } return nullptr; } remote_code_ptr AddressSpace::rr_page_syscall_entry_point(Traced traced, Privileged privileged, Enabled enabled, SupportedArch arch) { remote_code_ptr ip = rr_page_syscall_exit_point(traced, privileged, enabled); return ip.is_null() ? remote_code_ptr() : ip.decrement_by_syscall_insn_length(arch); } vector AddressSpace::rr_page_syscalls() { vector result; for (auto& e : entry_points) { result.push_back(e); } return result; } template static vector read_auxv_arch(Task* t) { auto stack_ptr = t->regs().sp().cast(); auto argc = t->read_mem(stack_ptr); stack_ptr += argc + 1; // Check final NULL in argv auto null_ptr = t->read_mem(stack_ptr); assert(null_ptr == 0); stack_ptr++; // Should now point to envp while (0 != t->read_mem(stack_ptr)) { stack_ptr++; } stack_ptr++; // should now point to ELF Auxiliary Table vector result; while (true) { auto pair_vec = t->read_mem(stack_ptr, 2); stack_ptr += 2; typename Arch::unsigned_word pair[2] = { pair_vec[0], pair_vec[1] }; result.resize(result.size() + sizeof(pair)); memcpy(result.data() + result.size() - sizeof(pair), pair, sizeof(pair)); if (pair[0] == 0) { break; } } return result; } static vector read_auxv(Task* t) { RR_ARCH_FUNCTION(read_auxv_arch, t->arch(), t); } void AddressSpace::save_auxv(Task* t) { saved_auxv_ = read_auxv(t); } void AddressSpace::post_exec_syscall(Task* t) { // First locate a syscall instruction we can use for remote syscalls. traced_syscall_ip_ = find_syscall_instruction(t); privileged_traced_syscall_ip_ = nullptr; // Now remote syscalls work, we can open_mem_fd. t->open_mem_fd(); // Set up AutoRemoteSyscalls again now that the mem-fd is open. AutoRemoteSyscalls remote(t); // Now we can set up the "rr page" at its fixed address. This gives // us traced and untraced syscall instructions at known, fixed addresses. map_rr_page(remote); // Set up the preload_thread_locals shared area. t->session().create_shared_mmap(remote, PRELOAD_THREAD_LOCALS_SIZE, preload_thread_locals_start(), "preload_thread_locals"); } void AddressSpace::brk(Task* t, remote_ptr addr, int prot) { LOG(debug) << "brk(" << addr << ")"; remote_ptr old_brk = ceil_page_size(brk_end); remote_ptr new_brk = ceil_page_size(addr); if (old_brk < new_brk) { map(t, old_brk, new_brk - old_brk, prot, MAP_ANONYMOUS | MAP_PRIVATE, 0, "[heap]"); } else { unmap(t, new_brk, old_brk - new_brk); } brk_end = addr; } void AddressSpace::dump() const { fprintf(stderr, " (heap: %p-%p)\n", (void*)brk_start.as_int(), (void*)brk_end.as_int()); for (auto it = mem.begin(); it != mem.end(); ++it) { const KernelMapping& m = it->second.map; fprintf(stderr, "%s\n", m.str().c_str()); } } SupportedArch AddressSpace::arch() const { return (*task_set().begin())->arch(); } BreakpointType AddressSpace::get_breakpoint_type_for_retired_insn( remote_code_ptr ip) { remote_code_ptr addr = ip.decrement_by_bkpt_insn_length(SupportedArch::x86); return get_breakpoint_type_at_addr(addr); } BreakpointType AddressSpace::get_breakpoint_type_at_addr(remote_code_ptr addr) { auto it = breakpoints.find(addr); return it == breakpoints.end() ? BKPT_NONE : it->second.type(); } bool AddressSpace::is_breakpoint_in_private_read_only_memory( remote_code_ptr addr) { for (const auto& m : maps_containing_or_after(addr.to_data_ptr())) { if (m.map.start() >= addr.increment_by_bkpt_insn_length(arch()).to_data_ptr()) { break; } if ((m.map.prot() & PROT_WRITE) || (m.map.flags() & MAP_SHARED)) { return false; } } return true; } void AddressSpace::replace_breakpoints_with_original_values( uint8_t* dest, size_t length, remote_ptr addr) { for (auto& it : breakpoints) { remote_ptr bkpt_location = it.first.to_data_ptr(); remote_ptr start = max(addr, bkpt_location); remote_ptr end = min(addr + length, bkpt_location + it.second.data_length()); if (start < end) { memcpy(dest + (start - addr), it.second.original_data() + (start - bkpt_location), end - start); } } } bool AddressSpace::is_breakpoint_instruction(Task* t, remote_code_ptr ip) { bool ok = true; return t->read_mem(ip.to_data_ptr(), &ok) == breakpoint_insn && ok; } static void remove_range(set& ranges, const MemoryRange& range) { auto start = ranges.lower_bound(range); auto end = start; auto prev_end = start; while (end != ranges.end() && end->start() < range.end()) { prev_end = end; ++end; } if (start == end) { return; } MemoryRange start_range = *start; MemoryRange end_range = *prev_end; ranges.erase(start, end); if (start_range.start() < range.start()) { ranges.insert(MemoryRange(start_range.start(), range.start())); } if (range.end() < end_range.end()) { ranges.insert(MemoryRange(range.end(), end_range.end())); } } static void add_range(set& ranges, const MemoryRange& range) { // Remove overlapping ranges remove_range(ranges, range); ranges.insert(range); // We could coalesce adjacent ranges, but there's probably no need. } KernelMapping AddressSpace::map(Task* t, remote_ptr addr, size_t num_bytes, int prot, int flags, off64_t offset_bytes, const string& fsname, dev_t device, ino_t inode, unique_ptr mapped_file_stat, const KernelMapping* recorded_map, EmuFile::shr_ptr emu_file, void* local_addr, shared_ptr&& monitored) { LOG(debug) << "mmap(" << addr << ", " << num_bytes << ", " << HEX(prot) << ", " << HEX(flags) << ", " << HEX(offset_bytes); num_bytes = ceil_page_size(num_bytes); KernelMapping m(addr, addr + num_bytes, fsname, device, inode, prot, flags, offset_bytes); if (!num_bytes) { return m; } remove_range(dont_fork, MemoryRange(addr, num_bytes)); // The mmap() man page doesn't specifically describe // what should happen if an existing map is // "overwritten" by a new map (of the same resource). // In testing, the behavior seems to be as if the // overlapping region is unmapped and then remapped // per the arguments to the second call. unmap_internal(t, addr, num_bytes); const KernelMapping& actual_recorded_map = recorded_map ? *recorded_map : m; map_and_coalesce(t, m, actual_recorded_map, emu_file, move(mapped_file_stat), move(local_addr), move(monitored)); if ((prot & PROT_EXEC) && (fsname.find(SYSCALLBUF_LIB_FILENAME) != string::npos || fsname.find(SYSCALLBUF_LIB_FILENAME_32) != string::npos)) { syscallbuf_lib_start_ = addr; syscallbuf_lib_end_ = addr + num_bytes; } // During an emulated exec, we will explicitly map in a (copy of) the VDSO // at the recorded address. if (actual_recorded_map.is_vdso()) { vdso_start_addr = addr; } return m; } template void AddressSpace::at_preload_init_arch(Task* t) { auto params = t->read_mem( remote_ptr>(t->regs().arg1())); if (t->session().is_recording()) { ASSERT(t, t->session().as_record()->use_syscall_buffer() == params.syscallbuf_enabled) << "Tracee thinks syscallbuf is " << (params.syscallbuf_enabled ? "en" : "dis") << "abled, but tracer thinks " << (t->session().as_record()->use_syscall_buffer() ? "en" : "dis") << "abled"; } if (!params.syscallbuf_enabled) { return; } syscallbuf_enabled_ = true; if (t->session().is_recording()) { monkeypatch_state->patch_at_preload_init(static_cast(t)); } } void AddressSpace::at_preload_init(Task* t) { ASSERT(t, !syscallbuf_lib_start_.is_null()) << "should have found preload library already"; RR_ARCH_FUNCTION(at_preload_init_arch, t->arch(), t); } const AddressSpace::Mapping& AddressSpace::mapping_of( remote_ptr addr) const { MemoryRange range(floor_page_size(addr), page_size()); auto it = mem.find(range); assert(it != mem.end()); assert(it->second.map.contains(range)); return it->second; } uint32_t& AddressSpace::mapping_flags_of(remote_ptr addr) { return const_cast( static_cast(this)->mapping_of(addr)) .flags; } bool AddressSpace::has_mapping(remote_ptr addr) const { if (addr + page_size() < addr) { // Assume the last byte in the address space is never mapped; avoid overflow return false; } MemoryRange m(floor_page_size(addr), page_size()); auto it = mem.find(m); return it != mem.end() && it->first.contains(m); } void AddressSpace::protect(Task* t, remote_ptr addr, size_t num_bytes, int prot) { LOG(debug) << "mprotect(" << addr << ", " << num_bytes << ", " << HEX(prot) << ")"; MemoryRange last_overlap; auto protector = [this, prot, &last_overlap](const Mapping& mm, const MemoryRange& rem) { LOG(debug) << " protecting (" << rem << ") ..."; Mapping m = move(mm); remove_from_map(m.map); // PROT_GROWSDOWN means that if this is a grows-down segment // (which for us means "stack") then the change should be // extended to the start of the segment. // We don't try to handle the analogous PROT_GROWSUP, because we // don't understand the idea of a grows-up segment. remote_ptr new_start; if ((m.map.start() < rem.start()) && (prot & PROT_GROWSDOWN)) { new_start = m.map.start(); LOG(debug) << " PROT_GROWSDOWN: expanded region down to " << new_start; } else { new_start = rem.start(); } LOG(debug) << " erased (" << m.map << ")"; // If the first segment we protect underflows the // region, remap the underflow region with previous // prot. auto monitored = m.monitored_shared_memory; if (m.map.start() < new_start) { Mapping underflow( m.map.subrange(m.map.start(), rem.start()), m.recorded_map.subrange(m.recorded_map.start(), rem.start()), m.emu_file, clone_stat(m.mapped_file_stat), m.local_addr, move(monitored)); add_to_map(underflow); } // Remap the overlapping region with the new prot. remote_ptr new_end = min(rem.end(), m.map.end()); int new_prot = prot & (PROT_READ | PROT_WRITE | PROT_EXEC); Mapping overlap( m.map.subrange(new_start, new_end).set_prot(new_prot), m.recorded_map.subrange(new_start, new_end).set_prot(new_prot), m.emu_file, clone_stat(m.mapped_file_stat), m.local_addr ? m.local_addr + (new_start - m.map.start()) : 0, m.monitored_shared_memory ? m.monitored_shared_memory->subrange(new_start - m.map.start(), new_end - new_start) : nullptr); add_to_map(overlap); last_overlap = overlap.map; // If the last segment we protect overflows the // region, remap the overflow region with previous // prot. if (rem.end() < m.map.end()) { Mapping overflow( m.map.subrange(rem.end(), m.map.end()), m.recorded_map.subrange(rem.end(), m.map.end()), m.emu_file, clone_stat(m.mapped_file_stat), m.local_addr ? m.local_addr + (rem.end() - m.map.start()) : 0, m.monitored_shared_memory ? m.monitored_shared_memory->subrange(rem.end() - m.map.start(), m.map.end() - rem.end()) : nullptr); add_to_map(overflow); } }; for_each_in_range(addr, num_bytes, protector, ITERATE_CONTIGUOUS); if (last_overlap.size()) { // All mappings that we altered which might need coalescing // are adjacent to |last_overlap|. coalesce_around(t, mem.find(last_overlap)); } } void AddressSpace::fixup_mprotect_growsdown_parameters(Task* t) { ASSERT(t, !(t->regs().arg3() & PROT_GROWSUP)); if (t->regs().arg3() & PROT_GROWSDOWN) { Registers r = t->regs(); if (r.arg1() == floor_page_size(r.arg1()) && has_mapping(r.arg1())) { auto& km = mapping_of(r.arg1()).map; if (km.flags() & MAP_GROWSDOWN) { auto new_start = km.start(); r.set_arg2(remote_ptr(r.arg1()) + size_t(r.arg2()) - new_start); r.set_arg1(new_start); r.set_arg3(r.arg3() & ~PROT_GROWSDOWN); t->set_regs(r); } } } } void AddressSpace::remap(Task* t, remote_ptr old_addr, size_t old_num_bytes, remote_ptr new_addr, size_t new_num_bytes) { LOG(debug) << "mremap(" << old_addr << ", " << old_num_bytes << ", " << new_addr << ", " << new_num_bytes << ")"; Mapping mr = mapping_of(old_addr); assert(!mr.monitored_shared_memory); const KernelMapping& m = mr.map; old_num_bytes = ceil_page_size(old_num_bytes); unmap_internal(t, old_addr, old_num_bytes); if (0 == new_num_bytes) { return; } new_num_bytes = ceil_page_size(new_num_bytes); auto it = dont_fork.lower_bound(MemoryRange(old_addr, old_num_bytes)); if (it != dont_fork.end() && it->start() < old_addr + old_num_bytes) { // mremap fails if some but not all pages are marked DONTFORK assert(*it == MemoryRange(old_addr, old_num_bytes)); remove_range(dont_fork, MemoryRange(old_addr, old_num_bytes)); add_range(dont_fork, MemoryRange(new_addr, new_num_bytes)); } else { remove_range(dont_fork, MemoryRange(old_addr, old_num_bytes)); remove_range(dont_fork, MemoryRange(new_addr, new_num_bytes)); } remote_ptr new_end = new_addr + new_num_bytes; map_and_coalesce(t, m.set_range(new_addr, new_end), mr.recorded_map.set_range(new_addr, new_end), mr.emu_file, clone_stat(mr.mapped_file_stat), nullptr, nullptr); } void AddressSpace::remove_breakpoint(remote_code_ptr addr, BreakpointType type) { auto it = breakpoints.find(addr); if (it == breakpoints.end() || it->second.unref(type) > 0) { return; } destroy_breakpoint(it); } bool AddressSpace::add_breakpoint(remote_code_ptr addr, BreakpointType type) { auto it = breakpoints.find(addr); if (it == breakpoints.end()) { uint8_t overwritten_data; // Grab a random task from the VM so we can use its // read/write_mem() helpers. Task* t = *task_set().begin(); if (sizeof(overwritten_data) != t->read_bytes_fallible(addr.to_data_ptr(), sizeof(overwritten_data), &overwritten_data)) { return false; } t->write_mem(addr.to_data_ptr(), breakpoint_insn); auto it_and_is_new = breakpoints.insert(make_pair(addr, Breakpoint())); assert(it_and_is_new.second); it_and_is_new.first->second.overwritten_data = overwritten_data; it = it_and_is_new.first; } it->second.ref(type); return true; } void AddressSpace::remove_all_breakpoints() { while (!breakpoints.empty()) { destroy_breakpoint(breakpoints.begin()); } } void AddressSpace::suspend_breakpoint_at(remote_code_ptr addr) { auto it = breakpoints.find(addr); if (it != breakpoints.end()) { Task* t = *task_set().begin(); t->write_mem(addr.to_data_ptr(), it->second.overwritten_data); } } void AddressSpace::restore_breakpoint_at(remote_code_ptr addr) { auto it = breakpoints.find(addr); if (it != breakpoints.end()) { Task* t = *task_set().begin(); t->write_mem(addr.to_data_ptr(), breakpoint_insn); } } int AddressSpace::access_bits_of(WatchType type) { switch (type) { case WATCH_EXEC: return EXEC_BIT; case WATCH_WRITE: return WRITE_BIT; case WATCH_READWRITE: return READ_BIT | WRITE_BIT; default: FATAL() << "Unknown watchpoint type " << type; return 0; // not reached } } void AddressSpace::remove_watchpoint(remote_ptr addr, size_t num_bytes, WatchType type) { auto it = watchpoints.find(MemoryRange(addr, num_bytes)); if (it != watchpoints.end() && 0 == it->second.unwatch(access_bits_of(type))) { watchpoints.erase(it); } allocate_watchpoints(); } bool AddressSpace::add_watchpoint(remote_ptr addr, size_t num_bytes, WatchType type) { MemoryRange key(addr, num_bytes); auto it = watchpoints.find(key); if (it == watchpoints.end()) { auto it_and_is_new = watchpoints.insert(make_pair(key, Watchpoint(num_bytes))); assert(it_and_is_new.second); it = it_and_is_new.first; update_watchpoint_value(it->first, it->second); } it->second.watch(access_bits_of(type)); return allocate_watchpoints(); } void AddressSpace::save_watchpoints() { saved_watchpoints.push_back(watchpoints); } bool AddressSpace::restore_watchpoints() { assert(!saved_watchpoints.empty()); watchpoints = saved_watchpoints[saved_watchpoints.size() - 1]; saved_watchpoints.pop_back(); return allocate_watchpoints(); } bool AddressSpace::update_watchpoint_value(const MemoryRange& range, Watchpoint& watchpoint) { Task* t = *task_set().begin(); bool valid = true; vector value_bytes = watchpoint.value_bytes; for (size_t i = 0; i < value_bytes.size(); ++i) { value_bytes[i] = 0xFF; } remote_ptr addr = range.start(); size_t num_bytes = range.size(); while (num_bytes > 0) { ssize_t bytes_read = t->read_bytes_fallible( addr, num_bytes, value_bytes.data() + (addr - range.start())); if (bytes_read <= 0) { valid = false; // advance to next page and try to read more. We want to know // when the valid part of a partially invalid watchpoint changes. bytes_read = min(num_bytes, (floor_page_size(addr) + page_size()) - addr); } addr += bytes_read; num_bytes -= bytes_read; } bool changed = valid != watchpoint.valid || memcmp(value_bytes.data(), watchpoint.value_bytes.data(), value_bytes.size()) != 0; watchpoint.valid = valid; watchpoint.value_bytes = value_bytes; return changed; } void AddressSpace::update_watchpoint_values(remote_ptr start, remote_ptr end) { MemoryRange r(start, end); for (auto& it : watchpoints) { if (it.first.intersects(r) && update_watchpoint_value(it.first, it.second)) { it.second.changed = true; // We do nothing to track kernel reads of read-write watchpoints... } } } static int DR_WATCHPOINT(int n) { return 1 << n; } static bool watchpoint_triggered(uintptr_t debug_status, const vector& regs) { for (auto reg : regs) { if (debug_status & DR_WATCHPOINT(reg)) { return true; } } return false; } bool AddressSpace::notify_watchpoint_fired(uintptr_t debug_status) { bool triggered = false; for (auto& it : watchpoints) { if (((it.second.watched_bits() & WRITE_BIT) && update_watchpoint_value(it.first, it.second)) || ((it.second.watched_bits() & (READ_BIT | EXEC_BIT)) && watchpoint_triggered(debug_status, it.second.debug_regs_for_exec_read))) { it.second.changed = true; triggered = true; } } return triggered; } void AddressSpace::notify_written(remote_ptr addr, size_t num_bytes) { update_watchpoint_values(addr, addr + num_bytes); session()->accumulate_bytes_written(num_bytes); } void AddressSpace::remove_all_watchpoints() { watchpoints.clear(); allocate_watchpoints(); } void AddressSpace::unmap(Task* t, remote_ptr addr, ssize_t num_bytes) { LOG(debug) << "munmap(" << addr << ", " << num_bytes << ")"; num_bytes = ceil_page_size(num_bytes); if (!num_bytes) { return; } remove_range(dont_fork, MemoryRange(addr, num_bytes)); return unmap_internal(t, addr, num_bytes); } void AddressSpace::unmap_internal(Task*, remote_ptr addr, ssize_t num_bytes) { LOG(debug) << "munmap(" << addr << ", " << num_bytes << ")"; auto unmapper = [this](const Mapping& mm, const MemoryRange& rem) { LOG(debug) << " unmapping (" << rem << ") ..."; Mapping m = move(mm); remove_from_map(m.map); LOG(debug) << " erased (" << m.map << ") ..."; // If the first segment we unmap underflows the unmap // region, remap the underflow region. auto monitored = m.monitored_shared_memory; if (m.map.start() < rem.start()) { Mapping underflow(m.map.subrange(m.map.start(), rem.start()), m.recorded_map.subrange(m.map.start(), rem.start()), m.emu_file, clone_stat(m.mapped_file_stat), m.local_addr, move(monitored)); add_to_map(underflow); } // If the last segment we unmap overflows the unmap // region, remap the overflow region. if (rem.end() < m.map.end()) { Mapping overflow( m.map.subrange(rem.end(), m.map.end()), m.recorded_map.subrange(rem.end(), m.map.end()), m.emu_file, clone_stat(m.mapped_file_stat), m.local_addr ? m.local_addr + (rem.end() - m.map.start()) : 0, m.monitored_shared_memory ? m.monitored_shared_memory->subrange(rem.end() - m.map.start(), m.map.end() - rem.end()) : nullptr); add_to_map(overflow); } }; for_each_in_range(addr, num_bytes, unmapper); update_watchpoint_values(addr, addr + num_bytes); } void AddressSpace::advise(Task*, remote_ptr addr, ssize_t num_bytes, int advice) { LOG(debug) << "madvise(" << addr << ", " << num_bytes << ", " << advice << ")"; num_bytes = ceil_page_size(num_bytes); switch (advice) { case MADV_DONTFORK: add_range(dont_fork, MemoryRange(addr, num_bytes)); break; case MADV_DOFORK: remove_range(dont_fork, MemoryRange(addr, num_bytes)); break; default: break; } } void AddressSpace::did_fork_into(Task* t) { for (auto& range : dont_fork) { // During recording we execute MADV_DONTFORK so the forked child will // have had its dontfork areas unmapped by the kernel already if (!t->session().is_recording()) { AutoRemoteSyscalls remote(t); remote.infallible_syscall(syscall_number_for_munmap(remote.arch()), range.start(), range.size()); } t->vm()->unmap(t, range.start(), range.size()); } } static string strip_deleted(const string& s) { static const char deleted[] = " (deleted)"; ssize_t find_deleted = s.size() - (sizeof(deleted) - 1); if (s.find(deleted) == size_t(find_deleted)) { return s.substr(0, find_deleted); } return s; } enum HandleHeap { TREAT_HEAP_AS_ANONYMOUS, RESPECT_HEAP }; static bool normalized_file_names_equal(const KernelMapping& km1, const KernelMapping& km2, HandleHeap handle_heap) { if (km1.is_stack() || km2.is_stack()) { // The kernel seems to use "[stack:]" for any mapping area containing // thread |tid|'s stack pointer. When the thread exits, the next read of // the maps doesn't treat the area as stack at all. We don't want to track // thread exits, so if one of the mappings is a stack, skip the name // comparison. Device and inode numbers will still be checked. return true; } if (handle_heap == TREAT_HEAP_AS_ANONYMOUS && (km1.is_heap() || km2.is_heap())) { // The kernel's heuristics for treating an anonymous mapping as "[heap]" // are obscure. Just skip the name check. Device and inode numbers will // still be checked. return true; } // We don't track when a file gets deleted, so it's possible for the kernel // to have " (deleted)" when we don't. return strip_deleted(km1.fsname()) == strip_deleted(km2.fsname()); } /** * Return true iff |left| and |right| are located adjacently in memory * with the same metadata, and map adjacent locations of the same * underlying (real) device. */ static bool is_adjacent_mapping(const KernelMapping& mleft, const KernelMapping& mright, HandleHeap handle_heap, int32_t flags_to_check = 0xFFFFFFFF) { if (mleft.end() != mright.start()) { LOG(debug) << " (not adjacent in memory)"; return false; } if (((mleft.flags() ^ mright.flags()) & flags_to_check) || mleft.prot() != mright.prot()) { LOG(debug) << " (flags or prot differ)"; return false; } if (!normalized_file_names_equal(mleft, mright, handle_heap)) { LOG(debug) << " (not the same filename)"; return false; } if (mleft.device() != mright.device() || mleft.inode() != mright.inode()) { LOG(debug) << " (not the same device/inode)"; return false; } if (mleft.is_real_device() && mleft.file_offset_bytes() + off64_t(mleft.size()) != mright.file_offset_bytes()) { LOG(debug) << " (" << mleft.file_offset_bytes() << " + " << mleft.size() << " != " << mright.file_offset_bytes() << ": offsets into real device aren't adjacent)"; return false; } LOG(debug) << " adjacent!"; return true; } /** * If |*left_m| and |right_m| are adjacent (see * |is_adjacent_mapping()|), write a merged segment descriptor to * |*left_m| and return true. Otherwise return false. */ static bool try_merge_adjacent(KernelMapping* left_m, const KernelMapping& right_m) { if (is_adjacent_mapping(*left_m, right_m, TREAT_HEAP_AS_ANONYMOUS, KernelMapping::checkable_flags_mask)) { *left_m = KernelMapping(left_m->start(), right_m.end(), left_m->fsname(), left_m->device(), left_m->inode(), right_m.prot(), right_m.flags(), left_m->file_offset_bytes()); return true; } return false; } static dev_t normalized_device_number(const KernelMapping& m) { if (m.fsname().c_str()[0] != '/') { return m.device(); } // btrfs files can report the wrong device number in /proc//maps, so // restrict ourselves to checking whether the device number is != 0 if (m.device() != KernelMapping::NO_DEVICE) { return (dev_t)-1; } return m.device(); } static void assert_segments_match(Task* t, const KernelMapping& input_m, const KernelMapping& km) { KernelMapping m = input_m; string err; if (m.start() != km.start()) { err = "starts differ"; } else if (m.end() != km.end()) { err = "ends differ"; } else if (m.prot() != km.prot()) { err = "prots differ"; } else if ((m.flags() ^ km.flags()) & KernelMapping::checkable_flags_mask) { err = "flags differ"; } else if (!normalized_file_names_equal(m, km, TREAT_HEAP_AS_ANONYMOUS) && !(km.is_heap() && m.fsname() == "") && !(m.is_heap() && km.fsname() == "") && !km.is_vdso()) { // Due to emulated exec, the kernel may identify any of our anonymous maps // as [heap] (or not). // Kernels before 3.16 have a bug where any mapping at the original VDSO // address is marked [vdso] even if the VDSO was unmapped and replaced by // something else, so if the kernel reports [vdso] it may be spurious and // we skip this check. See kernel commit // a62c34bd2a8a3f159945becd57401e478818d51c. err = "filenames differ"; } else if (normalized_device_number(m) != normalized_device_number(km)) { err = "devices_differ"; } else if (m.inode() != km.inode()) { err = "inodes differ"; } if (err.size()) { LOG(error) << "cached mmap:"; t->vm()->dump(); LOG(error) << "/proc/" << t->tid << "/mmaps:"; print_process_mmap(t); ASSERT(t, false) << "\nCached mapping " << m << " should be " << km << "; " << err; } } KernelMapping AddressSpace::vdso() const { assert(!vdso_start_addr.is_null()); return mapping_of(vdso_start_addr).map; } /** * Iterate over /proc/maps segments for a task and verify that the * task's cached mapping matches the kernel's (given a lenient fuzz * factor). */ void AddressSpace::verify(Task* t) const { ASSERT(t, task_set().end() != task_set().find(t)); MemoryMap::const_iterator mem_it = mem.begin(); KernelMapIterator kernel_it(t); while (!kernel_it.at_end() && mem_it != mem.end()) { KernelMapping km = kernel_it.current(); ++kernel_it; while (!kernel_it.at_end()) { KernelMapping next_km = kernel_it.current(); if (!try_merge_adjacent(&km, next_km)) { break; } ++kernel_it; } KernelMapping vm = mem_it->second.map; ++mem_it; while (mem_it != mem.end() && try_merge_adjacent(&vm, mem_it->second.map)) { ++mem_it; } assert_segments_match(t, vm, km); } ASSERT(t, kernel_it.at_end() && mem_it == mem.end()); } // Just a place that rr's AutoSyscall functionality can use as a syscall // instruction in rr's address space for use before we have exec'd. extern "C" { extern char rr_syscall_addr; } static void __attribute__((noinline, used)) fake_syscall() { #ifdef __i386__ __asm__ __volatile__("rr_syscall_addr: int $0x80\n\t" "nop\n\t" "nop\n\t" "nop\n\t"); #elif defined(__x86_64__) __asm__ __volatile__("rr_syscall_addr: syscall\n\t" "nop\n\t" "nop\n\t" "nop\n\t"); #endif } AddressSpace::AddressSpace(Task* t, const string& exe, uint32_t exec_count) : exe(exe), leader_tid_(t->rec_tid), leader_serial(t->tuid().serial()), exec_count(exec_count), session_(&t->session()), monkeypatch_state(t->session().is_recording() ? new Monkeypatcher() : nullptr), syscallbuf_enabled_(false), first_run_event_(0) { // TODO: this is a workaround of // https://github.com/mozilla/rr/issues/1113 . if (session_->done_initial_exec()) { populate_address_space(t); assert(!vdso_start_addr.is_null()); } else { // Setup traced_syscall_ip_ now because we need to do AutoRemoteSyscalls // (for open_mem_fd) before the first exec. We rely on the fact that we // haven't execed yet, so the address space layout is the same. traced_syscall_ip_ = remote_code_ptr((uintptr_t)&rr_syscall_addr); } } AddressSpace::AddressSpace(Session* session, const AddressSpace& o, pid_t leader_tid, uint32_t leader_serial, uint32_t exec_count) : exe(o.exe), leader_tid_(leader_tid), leader_serial(leader_serial), exec_count(exec_count), brk_start(o.brk_start), brk_end(o.brk_end), mem(o.mem), monitored_mem(o.monitored_mem), session_(session), vdso_start_addr(o.vdso_start_addr), monkeypatch_state(o.monkeypatch_state ? new Monkeypatcher(*o.monkeypatch_state) : nullptr), traced_syscall_ip_(o.traced_syscall_ip_), privileged_traced_syscall_ip_(o.privileged_traced_syscall_ip_), syscallbuf_lib_start_(o.syscallbuf_lib_start_), syscallbuf_lib_end_(o.syscallbuf_lib_end_), syscallbuf_enabled_(o.syscallbuf_enabled_), saved_auxv_(o.saved_auxv_), first_run_event_(0) { for (auto& m : mem) { // The original address space continues to have exclusive ownership of // all local mappings. m.second.local_addr = nullptr; } for (auto& it : o.breakpoints) { breakpoints.insert(make_pair(it.first, it.second)); } for (auto& it : o.watchpoints) { watchpoints.insert(make_pair(it.first, it.second)); } if (session != o.session()) { // Cloning into a new session means we're checkpointing. first_run_event_ = o.first_run_event_; } // cloned tasks will automatically get cloned debug registers and // cloned address-space memory, so we don't need to do any more work here. } void AddressSpace::post_vm_clone(Task* t) { // Recreate preload_thread_locals mapping. AutoRemoteSyscalls remote(t); t->session().create_shared_mmap(remote, PRELOAD_THREAD_LOCALS_SIZE, preload_thread_locals_start(), "preload_thread_locals"); } static bool try_split_unaligned_range(MemoryRange& range, size_t bytes, vector& result) { if ((range.start().as_int() & (bytes - 1)) || range.size() < bytes) { return false; } result.push_back(MemoryRange(range.start(), bytes)); range = MemoryRange(range.start() + bytes, range.end()); return true; } static vector split_range(const MemoryRange& range) { vector result; MemoryRange r = range; while (r.size() > 0) { if ((sizeof(void*) < 8 || !try_split_unaligned_range(r, 8, result)) && !try_split_unaligned_range(r, 4, result) && !try_split_unaligned_range(r, 2, result)) { bool ret = try_split_unaligned_range(r, 1, result); assert(ret); } } return result; } static void configure_watch_registers(vector& regs, const MemoryRange& range, WatchType type, vector* assigned_regs) { auto split_ranges = split_range(range); if (type == WATCH_WRITE && range.size() > 1) { // We can suppress spurious write-watchpoint triggerings by checking // whether memory values have changed. So we can sometimes conserve // debug registers by upgrading an unaligned range to an aligned range // of a larger size. uintptr_t align; if (range.size() <= 2) { align = 2; } else if (range.size() <= 4 || sizeof(void*) <= 4) { align = 4; } else { align = 8; } remote_ptr aligned_start(range.start().as_int() & ~(align - 1)); remote_ptr aligned_end((range.end().as_int() + (align - 1)) & ~(align - 1)); auto split = split_range(MemoryRange(aligned_start, aligned_end)); // If the aligned range doesn't reduce register usage, use the original // split to avoid spurious triggerings if (split.size() < split_ranges.size()) { split_ranges = split; } } for (auto& r : split_ranges) { if (assigned_regs) { assigned_regs->push_back(regs.size()); } regs.push_back(WatchConfig(r.start(), r.size(), type)); } } vector AddressSpace::get_watch_configs( WillSetTaskState will_set_task_state) { vector result; for (auto& kv : watchpoints) { vector* assigned_regs = nullptr; if (will_set_task_state == SETTING_TASK_STATE) { kv.second.debug_regs_for_exec_read.clear(); assigned_regs = &kv.second.debug_regs_for_exec_read; } const MemoryRange& r = kv.first; int watching = kv.second.watched_bits(); if (EXEC_BIT & watching) { configure_watch_registers(result, r, WATCH_EXEC, assigned_regs); } if (READ_BIT & watching) { configure_watch_registers(result, r, WATCH_READWRITE, assigned_regs); } else if (WRITE_BIT & watching) { configure_watch_registers(result, r, WATCH_WRITE, nullptr); } } return result; } vector AddressSpace::get_watchpoints_internal( WatchpointFilter filter) { vector result; for (auto& kv : watchpoints) { if (filter == CHANGED_WATCHPOINTS) { if (!kv.second.changed) { continue; } kv.second.changed = false; } const MemoryRange& r = kv.first; int watching = kv.second.watched_bits(); if (EXEC_BIT & watching) { result.push_back(WatchConfig(r.start(), r.size(), WATCH_EXEC)); } if (READ_BIT & watching) { result.push_back(WatchConfig(r.start(), r.size(), WATCH_READWRITE)); } else if (WRITE_BIT & watching) { result.push_back(WatchConfig(r.start(), r.size(), WATCH_WRITE)); } } return result; } vector AddressSpace::consume_watchpoint_changes() { return get_watchpoints_internal(CHANGED_WATCHPOINTS); } vector AddressSpace::all_watchpoints() { return get_watchpoints_internal(ALL_WATCHPOINTS); } bool AddressSpace::has_any_watchpoint_changes() { for (auto& kv : watchpoints) { if (kv.second.changed) { return true; } } return false; } bool AddressSpace::has_exec_watchpoint_fired(remote_code_ptr addr) { for (auto& kv : watchpoints) { if (kv.second.changed && kv.second.exec_count > 0 && kv.first.start() == addr.to_data_ptr()) { return true; } } return false; } bool AddressSpace::allocate_watchpoints() { Task::DebugRegs regs = get_watch_configs(SETTING_TASK_STATE); if (regs.size() <= 0x7f) { bool ok = true; for (auto t : task_set()) { if (!t->set_debug_regs(regs)) { ok = false; } } if (ok) { return true; } } regs.clear(); for (auto t2 : task_set()) { t2->set_debug_regs(regs); } for (auto kv : watchpoints) { kv.second.debug_regs_for_exec_read.clear(); } return false; } static inline void assert_coalesceable(Task* t, const AddressSpace::Mapping& lower, const AddressSpace::Mapping& higher) { ASSERT(t, lower.emu_file == higher.emu_file); ASSERT(t, lower.flags == higher.flags); ASSERT(t, (lower.local_addr == 0 && higher.local_addr == 0) || lower.local_addr + lower.map.size() == higher.local_addr); ASSERT(t, !lower.monitored_shared_memory && !higher.monitored_shared_memory); } void AddressSpace::coalesce_around(Task* t, MemoryMap::iterator it) { auto first_kv = it; while (mem.begin() != first_kv) { auto next = first_kv; --first_kv; if (!is_adjacent_mapping(first_kv->second.map, next->second.map, RESPECT_HEAP)) { first_kv = next; break; } assert_coalesceable(t, first_kv->second, next->second); } auto last_kv = it; while (true) { auto prev = last_kv; ++last_kv; if (mem.end() == last_kv || !is_adjacent_mapping(prev->second.map, last_kv->second.map, RESPECT_HEAP)) { last_kv = prev; break; } assert_coalesceable(t, prev->second, last_kv->second); } ASSERT(t, last_kv != mem.end()); if (first_kv == last_kv) { LOG(debug) << " no mappings to coalesce"; return; } Mapping new_m(first_kv->second.map.extend(last_kv->first.end()), first_kv->second.recorded_map.extend(last_kv->first.end()), first_kv->second.emu_file, clone_stat(first_kv->second.mapped_file_stat), first_kv->second.local_addr); new_m.flags = first_kv->second.flags; LOG(debug) << " coalescing " << new_m.map; // monitored-memory currently isn't coalescable so we don't need to // adjust monitored_mem mem.erase(first_kv, ++last_kv); auto ins = mem.insert(MemoryMap::value_type(new_m.map, new_m)); assert(ins.second); // key didn't already exist } void AddressSpace::destroy_breakpoint(BreakpointMap::const_iterator it) { if (task_set().empty()) return; Task* t = *task_set().begin(); t->write_mem(it->first.to_data_ptr(), it->second.overwritten_data); breakpoints.erase(it); } void AddressSpace::for_each_in_range( remote_ptr addr, ssize_t num_bytes, function f, int how) { remote_ptr region_start = floor_page_size(addr); remote_ptr last_unmapped_end = region_start; remote_ptr region_end = ceil_page_size(addr + num_bytes); while (last_unmapped_end < region_end) { // Invariant: |rem| is always exactly the region of // memory remaining to be examined for pages to be // unmapped. MemoryRange rem(last_unmapped_end, region_end); // The next page to iterate may not be contiguous with // the last one seen. auto it = mem.lower_bound(rem); if (mem.end() == it) { LOG(debug) << " not found, done."; return; } // Don't make a reference here. |f| is allowed to erase Mappings. MemoryRange range = it->first; if (rem.end() <= range.start()) { LOG(debug) << " mapping at " << range.start() << " out of range, done."; return; } if (ITERATE_CONTIGUOUS == how && !(range.start() < region_start || rem.start() == range.start())) { LOG(debug) << " discontiguous mapping at " << range.start() << ", done."; return; } f(it->second, rem); // Maintain the loop invariant. last_unmapped_end = range.end(); } } void AddressSpace::map_and_coalesce( Task* t, const KernelMapping& m, const KernelMapping& recorded_map, EmuFile::shr_ptr emu_file, unique_ptr mapped_file_stat, void* local_addr, shared_ptr&& monitored) { LOG(debug) << " mapping " << m; if (monitored) { monitored_mem.insert(m.start()); } auto ins = mem.insert(MemoryMap::value_type( m, Mapping(m, recorded_map, emu_file, move(mapped_file_stat), local_addr, move(monitored)))); coalesce_around(t, ins.first); update_watchpoint_values(m.start(), m.end()); } static bool could_be_stack(const KernelMapping& km) { // On 4.1.6-200.fc22.x86_64 we observe that during exec of the rr_exec_stub // during replay, when the process switches from 32-bit to 64-bit, the 64-bit // registers seem truncated to 32 bits during the initial PTRACE_GETREGS so // our sp looks wrong and /proc//maps doesn't identify the region as // stack. // On stub execs there should only be one read-writable memory area anyway. return km.prot() == (PROT_READ | PROT_WRITE) && km.fsname() == "" && km.device() == KernelMapping::NO_DEVICE && km.inode() == KernelMapping::NO_INODE; } static dev_t check_device(const KernelMapping& km) { if (km.fsname().c_str()[0] != '/') { return km.device(); } // btrfs files can return the wrong device number in /proc//maps struct stat st; int ret = stat(km.fsname().c_str(), &st); if (ret < 0) { return km.device(); } return st.st_dev; } void AddressSpace::populate_address_space(Task* t) { bool found_proper_stack = false; for (KernelMapIterator it(t); !it.at_end(); ++it) { auto& km = it.current(); if (km.is_stack()) { found_proper_stack = true; } } // If we're being recorded by rr, we'll see the outer rr's rr_page and // preload_thread_locals. In post_exec() we'll remap those with our // own mappings. That's OK because a) the rr_page contents are the same // anyway and immutable and b) the preload_thread_locals page is only // used by the preload library, and the preload library only knows about // the inner rr. I.e. as far as the outer rr is concerned, the tracee is // not doing syscall buffering. int found_stacks = 0; for (KernelMapIterator it(t); !it.at_end(); ++it) { auto& km = it.current(); int flags = km.flags(); remote_ptr start = km.start(); bool is_stack = found_proper_stack ? km.is_stack() : could_be_stack(km); if (is_stack) { ++found_stacks; flags |= MAP_GROWSDOWN; if (uses_invisible_guard_page()) { // MAP_GROWSDOWN segments really occupy one additional page before // the start address shown by /proc//maps --- unless that page // is already occupied by another mapping. if (!has_mapping(start - page_size())) { start -= page_size(); } } } map(t, start, km.end() - start, km.prot(), flags, km.file_offset_bytes(), km.fsname(), check_device(km), km.inode(), nullptr); } ASSERT(t, found_stacks == 1); } static int random_addr_bits(SupportedArch arch) { switch (arch) { default: assert(0 && "Unknown architecture"); case x86: return 32; // Current x86-64 systems have only 48 bits of virtual address space, // and only the bottom half is usable by user space case x86_64: return 47; } } static MemoryRange adjust_range_for_stack_growth(const KernelMapping& km) { remote_ptr start = km.start(); if (km.flags() & MAP_GROWSDOWN) { start = min(start, km.end() - AddressSpace::chaos_mode_min_stack_size()); } return MemoryRange(start, km.end()); } remote_ptr AddressSpace::chaos_mode_find_free_memory(Task* t, size_t len) { remote_ptr addr; // Half the time, try to allocate at a completely random address. The other // half of the time, we'll try to allocate immediately before or after a // randomly chosen existing mapping. if (random() % 2) { int bits = random_addr_bits(t->arch()); // Some of these addresses will not be mappable. That's fine, the // kernel will fall back to a valid address if the hint is not valid. uint64_t r = ((uint64_t)(uint32_t)random() << 32) | (uint32_t)random(); addr = floor_page_size(remote_ptr(r & ((uint64_t(1) << bits) - 1))); } else { ASSERT(t, !mem.empty()); int map_index = random() % mem.size(); int map_count = 0; for (const auto& m : maps()) { if (map_count == map_index) { addr = m.map.start(); break; } ++map_count; } } // If there's a collision (which there always will be in the second case // above), either move the mapping forwards or backwards in memory until it // fits. Choose the direction randomly. int direction = (random() % 2) ? 1 : -1; while (true) { Maps m = maps_starting_at(addr); if (m.begin() == m.end()) { return addr; } MemoryRange range = adjust_range_for_stack_growth(m.begin()->map); if (range.start() >= addr + len) { // No overlap with an existing mapping; we're good! return addr; } if (direction == -1) { addr = range.start() - len; } else { addr = range.end(); } } } remote_ptr AddressSpace::find_free_memory(size_t required_space, remote_ptr after) { auto maps = maps_starting_at(after); auto current = maps.begin(); while (current != maps.end()) { auto next = current; ++next; if (next == maps.end()) { if (current->map.end() + required_space >= current->map.end()) { break; } } else { if (current->map.end() + required_space <= next->map.start()) { break; } } current = next; } return current->map.end(); } } // namespace rr rr-4.4.0/src/AddressSpace.h000066400000000000000000001033231277367620400154630ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_ADDRESS_SPACE_H_ #define RR_ADDRESS_SPACE_H_ #include #include #include #include #include #include #include #include #include #include "preload/preload_interface.h" #include "EmuFs.h" #include "HasTaskSet.h" #include "MemoryRange.h" #include "Monkeypatcher.h" #include "PropertyTable.h" #include "TaskishUid.h" #include "TraceStream.h" #include "kernel_abi.h" #include "remote_code_ptr.h" #include "util.h" namespace rr { class AutoRemoteSyscalls; class MonitoredSharedMemory; class RecordTask; class Session; class Task; /** * Records information that the kernel knows about a mapping. This includes * everything returned through /proc//maps but also information that * we know from observing mmap and mprotect calls. */ class KernelMapping : public MemoryRange { public: /** * These are the flags we track internally to distinguish * between adjacent segments. For example, the kernel * considers a NORESERVE anonynmous mapping that's adjacent to * a non-NORESERVE mapping distinct, even if all other * metadata are the same. See |is_adjacent_mapping()|. */ static const int map_flags_mask = MAP_ANONYMOUS | MAP_NORESERVE | MAP_PRIVATE | MAP_SHARED | MAP_STACK | MAP_GROWSDOWN; static const int checkable_flags_mask = MAP_PRIVATE | MAP_SHARED; static const dev_t NO_DEVICE = 0; static const ino_t NO_INODE = 0; KernelMapping() : device_(0), inode_(0), prot_(0), flags_(0), offset(0) {} KernelMapping(remote_ptr start, remote_ptr end, const std::string& fsname, dev_t device, ino_t inode, int prot, int flags, off64_t offset = 0) : MemoryRange(start, end), fsname_(fsname), device_(device), inode_(inode), prot_(prot), flags_(flags & map_flags_mask), offset(offset) { assert_valid(); } KernelMapping(const KernelMapping& o) : MemoryRange(o), fsname_(o.fsname_), device_(o.device_), inode_(o.inode_), prot_(o.prot_), flags_(o.flags_), offset(o.offset) { assert_valid(); } KernelMapping operator=(const KernelMapping& o) { this->~KernelMapping(); new (this) KernelMapping(o); return *this; } void assert_valid() const { assert(end() >= start()); assert(size() % page_size() == 0); assert(!(flags_ & ~map_flags_mask)); assert(offset % page_size() == 0); } KernelMapping extend(remote_ptr end) const { assert(end >= MemoryRange::end()); return KernelMapping(start(), end, fsname_, device_, inode_, prot_, flags_, offset); } KernelMapping set_range(remote_ptr start, remote_ptr end) const { return KernelMapping(start, end, fsname_, device_, inode_, prot_, flags_, offset); } KernelMapping subrange(remote_ptr start, remote_ptr end) const { assert(start >= MemoryRange::start() && end <= MemoryRange::end()); return KernelMapping( start, end, fsname_, device_, inode_, prot_, flags_, offset + (is_real_device() ? start - MemoryRange::start() : 0)); } KernelMapping set_prot(int prot) const { return KernelMapping(start(), end(), fsname_, device_, inode_, prot, flags_, offset); } /** * Dump a representation of |this| to a string in a format * similar to the former part of /proc/[tid]/maps. */ std::string str() const { char str[200]; sprintf(str, "%8p-%8p %c%c%c%c %08" PRIx64 " %02x:%02x %-10ld ", (void*)start().as_int(), (void*)end().as_int(), (PROT_READ & prot_) ? 'r' : '-', (PROT_WRITE & prot_) ? 'w' : '-', (PROT_EXEC & prot_) ? 'x' : '-', (MAP_SHARED & flags_) ? 's' : 'p', offset, (int)MAJOR(device()), (int)MINOR(device()), (long)inode()); return str + fsname(); } const std::string& fsname() const { return fsname_; } dev_t device() const { return device_; } ino_t inode() const { return inode_; } int prot() const { return prot_; } int flags() const { return flags_; } uint64_t file_offset_bytes() const { return offset; } /** * Return true if this file is/was backed by an external * device, as opposed to a transient RAM mapping. */ bool is_real_device() const { return device() > NO_DEVICE; } bool is_vdso() const { return fsname() == "[vdso]"; } bool is_heap() const { return fsname() == "[heap]"; } bool is_stack() const { return fsname().find("[stack") == 0; } bool is_vvar() const { return fsname() == "[vvar]"; } bool is_vsyscall() const { return fsname() == "[vsyscall]"; } struct stat fake_stat() const { struct stat fake_stat; memset(&fake_stat, 0, sizeof(fake_stat)); fake_stat.st_dev = device(); fake_stat.st_ino = inode(); fake_stat.st_size = size(); return fake_stat; } private: // The kernel's name for the mapping, as per /proc//maps. This must // be exactly correct. const std::string fsname_; dev_t device_; ino_t inode_; const int prot_; const int flags_; const uint64_t offset; }; inline std::ostream& operator<<(std::ostream& o, const KernelMapping& m) { o << m.str(); return o; } /** * Compare |a| and |b| so that "subset" lookups will succeed. What * does that mean? If |a| and |b| overlap (intersect), then this * comparator considers them equivalent. That means that if |a| * represents one byte within a mapping |b|, then |a| and |b| will be * considered equivalent. * * If |a| and |b| don't overlap, return true if |a|'s start address is * less than |b|'s/ */ struct MappingComparator { bool operator()(const MemoryRange& a, const MemoryRange& b) const { return !a.intersects(b) && a.start() < b.start(); } }; enum BreakpointType { BKPT_NONE = 0, // Trap for internal rr purposes, f.e. replaying async // signals. BKPT_INTERNAL, // Trap on behalf of a debugger user. BKPT_USER, }; enum WatchType { // NB: these random-looking enumeration values are chosen to // match the numbers programmed into x86 debug registers. WATCH_EXEC = 0x00, WATCH_WRITE = 0x01, WATCH_READWRITE = 0x03 }; enum DebugStatus { DS_WATCHPOINT_ANY = 0xf, DS_SINGLESTEP = 1 << 14, }; /** * A distinct watchpoint, corresponding to the information needed to * program a single x86 debug register. */ struct WatchConfig { WatchConfig(remote_ptr addr, size_t num_bytes, WatchType type) : addr(addr), num_bytes(num_bytes), type(type) {} remote_ptr addr; size_t num_bytes; WatchType type; }; /** * Models the address space for a set of tasks. This includes the set * of mapped pages, and the resources those mappings refer to. */ class AddressSpace : public HasTaskSet { friend class Session; friend struct VerifyAddressSpace; public: class Mapping { public: Mapping(const KernelMapping& map, const KernelMapping& recorded_map, EmuFile::shr_ptr emu_file, std::unique_ptr mapped_file_stat = nullptr, void* local_addr = nullptr, std::shared_ptr&& monitored = nullptr); ~Mapping(); Mapping(const Mapping&); Mapping() = default; const Mapping& operator=(const Mapping& other) { this->~Mapping(); new (this) Mapping(other); return *this; } const KernelMapping map; // The corresponding KernelMapping in the recording. During recording, // equal to 'map'. const KernelMapping recorded_map; const EmuFile::shr_ptr emu_file; std::unique_ptr mapped_file_stat; // If this mapping has been mapped into the local address space, // this is the address of the first byte of the equivalent local mapping. // This mapping is always mapped as PROT_READ|PROT_WRITE regardless of the // mapping's permissions in the tracee. Also note that it is the caller's // responsibility to keep this alive at least as long as this mapping is // present in the address space. uint8_t* local_addr; const std::shared_ptr monitored_shared_memory; // Flags indicate mappings that require special handling. Adjacent mappings // may only be merged if their `flags` value agree. enum : uint32_t { FLAG_NONE = 0x0, // This mapping represents a syscallbuf. It needs to handled specially // during checksumming since its contents are not fully restored by the // replay. IS_SYSCALLBUF = 0x1 }; uint32_t flags; }; typedef std::map MemoryMap; typedef std::shared_ptr shr_ptr; ~AddressSpace(); /** * Call this after a new task has been cloned within this * address space. */ void after_clone(); /** * Call this after a successful execve syscall has completed. At this point * it is safe to perform remote syscalls. */ void post_exec_syscall(Task* t); /** * Change the program data break of this address space to * |addr|. Only called during recording! */ void brk(Task* t, remote_ptr addr, int prot); /** * This can only be called during recording. */ remote_ptr current_brk() const { assert(!brk_end.is_null()); return brk_end; } /** * Dump a representation of |this| to stderr in a format * similar to /proc/[tid]/maps. * * XXX/ostream-ify me. */ void dump() const; /** * Return tid of the first task for this address space. */ pid_t leader_tid() const { return leader_tid_; } /** * Return AddressSpaceUid for this address space. */ AddressSpaceUid uid() const { return AddressSpaceUid(leader_tid_, leader_serial, exec_count); } Session* session() const { return session_; } SupportedArch arch() const; /** * Return the path this address space was exec()'d with. */ const std::string& exe_image() const { return exe; } /** * Assuming the last retired instruction has raised a SIGTRAP * and might be a breakpoint trap instruction, return the type * of breakpoint set at |ip() - sizeof(breakpoint_insn)|, if * one exists. Otherwise return TRAP_NONE. */ BreakpointType get_breakpoint_type_for_retired_insn(remote_code_ptr ip); /** * Return the type of breakpoint that's been registered for * |addr|. */ BreakpointType get_breakpoint_type_at_addr(remote_code_ptr addr); /** * Returns true when the breakpoint at |addr| is in private * non-writeable memory. When this returns true, the breakpoint can't be * overwritten by the tracee without an intervening mprotect or mmap * syscall. */ bool is_breakpoint_in_private_read_only_memory(remote_code_ptr addr); /** * Return true if there's a breakpoint instruction at |ip|. This might * be an explicit instruction, even if there's no breakpoint set via our API. */ bool is_breakpoint_instruction(Task* t, remote_code_ptr ip); /** * The buffer |dest| of length |length| represents the contents of tracee * memory at |addr|. Replace the bytes in |dest| that have been overwritten * by breakpoints with the original data that was replaced by the breakpoints. */ void replace_breakpoints_with_original_values(uint8_t* dest, size_t length, remote_ptr addr); /** * Map |num_bytes| into this address space at |addr|, with * |prot| protection and |flags|. The pages are (possibly * initially) backed starting at |offset| of |res|. |fsname|, |device| and * |inode| are values that will appear in the /proc//maps entry. * |mapped_file_stat| is a complete copy of the 'stat' data for the mapped * file, or null if this isn't a file mapping or isn't during recording. * |*recorded_map| is the mapping during recording, or null if the mapping * during recording is known to be the same as the new map (e.g. because * we are recording!). */ KernelMapping map( Task* t, remote_ptr addr, size_t num_bytes, int prot, int flags, off64_t offset_bytes, const std::string& fsname, dev_t device = KernelMapping::NO_DEVICE, ino_t inode = KernelMapping::NO_INODE, std::unique_ptr mapped_file_stat = nullptr, const KernelMapping* recorded_map = nullptr, EmuFile::shr_ptr emu_file = nullptr, void* local_addr = nullptr, std::shared_ptr&& monitored = nullptr); /** * Return the mapping and mapped resource for the byte at address 'addr'. * There must be such a mapping. */ const Mapping& mapping_of(remote_ptr addr) const; /** * Return a reference to the flags of the mapping at this address, allowing * manipulation. There must exist a mapping at `addr`. */ uint32_t& mapping_flags_of(remote_ptr addr); /** * Return true if there is some mapping for the byte at 'addr'. */ bool has_mapping(remote_ptr addr) const; /** * Object that generates robust iterators through the memory map. The * memory map can be updated without invalidating iterators, as long as * Mappings are not added or removed. */ class Maps { public: Maps(const AddressSpace& outer, remote_ptr start) : outer(outer), start(start) {} class iterator { public: iterator(const iterator& it) = default; const iterator& operator++() { ptr = to_it()->second.map.end(); return *this; } bool operator==(const iterator& other) const { return to_it() == other.to_it(); } bool operator!=(const iterator& other) const { return !(*this == other); } const Mapping* operator->() const { return &to_it()->second; } Mapping operator*() const { return to_it()->second; } iterator& operator=(const iterator& other) { this->~iterator(); new (this) iterator(other); return *this; } private: friend class Maps; iterator(const MemoryMap& outer, remote_ptr ptr) : outer(outer), ptr(ptr), at_end(false) {} iterator(const MemoryMap& outer) : outer(outer), at_end(true) {} MemoryMap::const_iterator to_it() const { return at_end ? outer.end() : outer.lower_bound(MemoryRange(ptr, ptr)); } const MemoryMap& outer; remote_ptr ptr; bool at_end; }; iterator begin() const { return iterator(outer.mem, start); } iterator end() const { return iterator(outer.mem); } private: const AddressSpace& outer; remote_ptr start; }; friend class Maps; Maps maps() const { return Maps(*this, remote_ptr()); } Maps maps_starting_at(remote_ptr start) { return Maps(*this, start); } Maps maps_containing_or_after(remote_ptr start) { if (has_mapping(start)) { return Maps(*this, mapping_of(start).map.start()); } else { return Maps(*this, start); } } const std::set>& monitored_addrs() const { return monitored_mem; } /** * Change the protection bits of [addr, addr + num_bytes) to * |prot|. */ void protect(Task* t, remote_ptr addr, size_t num_bytes, int prot); /** * Fix up mprotect registers parameters to take account of PROT_GROWSDOWN. */ void fixup_mprotect_growsdown_parameters(Task* t); /** * Move the mapping [old_addr, old_addr + old_num_bytes) to * [new_addr, old_addr + new_num_bytes), preserving metadata. */ void remap(Task* t, remote_ptr old_addr, size_t old_num_bytes, remote_ptr new_addr, size_t new_num_bytes); /** * Notify that data was written to this address space by rr or * by the kernel. */ void notify_written(remote_ptr addr, size_t num_bytes); /** Ensure a breakpoint of |type| is set at |addr|. */ bool add_breakpoint(remote_code_ptr addr, BreakpointType type); /** * Remove a |type| reference to the breakpoint at |addr|. If * the removed reference was the last, the breakpoint is * destroyed. */ void remove_breakpoint(remote_code_ptr addr, BreakpointType type); /** * Destroy all breakpoints in this VM, regardless of their * reference counts. */ void remove_all_breakpoints(); /** * Temporarily remove the breakpoint at |addr|. */ void suspend_breakpoint_at(remote_code_ptr addr); /** * Restore any temporarily removed breakpoint at |addr|. */ void restore_breakpoint_at(remote_code_ptr addr); /** * Manage watchpoints. Analogous to breakpoint-managing * methods above, except that watchpoints can be set for an * address range. */ bool add_watchpoint(remote_ptr addr, size_t num_bytes, WatchType type); void remove_watchpoint(remote_ptr addr, size_t num_bytes, WatchType type); void remove_all_watchpoints(); std::vector all_watchpoints(); /** * Save all watchpoint state onto a stack. */ void save_watchpoints(); /** * Pop all watchpoint state from the saved-state stack. */ bool restore_watchpoints(); /** * Notify that at least one watchpoint was hit --- recheck them all. * Returns true if any watchpoint actually triggered. Note that * debug_status can indicate a hit watchpoint that doesn't actually * trigger, because the value of a write-watchpoint did not change. * Likewise, debug_status can indicate a watchpoint wasn't hit that * actually was (because in some configurations, e.g. VMWare * hypervisor with 32-bit x86 guest, debug_status watchpoint bits * are known to not be set on singlestep). */ bool notify_watchpoint_fired(uintptr_t debug_status); /** * Return true if any watchpoint has fired. Will keep returning true until * consume_watchpoint_changes() is called. */ bool has_any_watchpoint_changes(); /** * Return true if an EXEC watchpoint has fired at addr since the last * consume_watchpoint_changes. */ bool has_exec_watchpoint_fired(remote_code_ptr addr); /** * Return all changed watchpoints in |watches| and clear their changed flags. */ std::vector consume_watchpoint_changes(); /** * Make [addr, addr + num_bytes) inaccessible within this * address space. */ void unmap(Task* t, remote_ptr addr, ssize_t num_bytes); /** * Notification of madvise call. */ void advise(Task* t, remote_ptr addr, ssize_t num_bytes, int advice); /** Return the vdso mapping of this. */ KernelMapping vdso() const; /** * Verify that this cached address space matches what the * kernel thinks it should be. */ void verify(Task* t) const; bool has_breakpoints() { return !breakpoints.empty(); } bool has_watchpoints() { return !watchpoints.empty(); } // Encoding of the |int $3| instruction. static const uint8_t breakpoint_insn = 0xCC; ScopedFd& mem_fd() { return child_mem_fd; } void set_mem_fd(ScopedFd&& fd) { child_mem_fd = std::move(fd); } Monkeypatcher& monkeypatcher() { assert(monkeypatch_state); return *monkeypatch_state; } void at_preload_init(Task* t); /* The address of the syscall instruction from which traced syscalls made by * the syscallbuf will originate. */ remote_code_ptr traced_syscall_ip() const { return traced_syscall_ip_; } /* The address of the syscall instruction from which privileged traced * syscalls made by the syscallbuf will originate. */ remote_code_ptr privileged_traced_syscall_ip() const { return privileged_traced_syscall_ip_; } /* Start and end of the mapping of the syscallbuf code * section, used to determine whether a tracee's $ip is in the * lib. */ remote_ptr syscallbuf_lib_start() const { return syscallbuf_lib_start_; } remote_ptr syscallbuf_lib_end() const { return syscallbuf_lib_end_; } bool syscallbuf_enabled() const { return syscallbuf_enabled_; } /** * We'll map a page of memory here into every exec'ed process for our own * use. */ static remote_ptr rr_page_start() { return RR_PAGE_ADDR; } /** * This might not be the length of an actual system page, but we allocate * at least this much space. */ static uint32_t rr_page_size() { return 4096; } static remote_ptr rr_page_end() { return rr_page_start() + rr_page_size(); } static remote_ptr preload_thread_locals_start() { return rr_page_start() + PAGE_SIZE; } static uint32_t preload_thread_locals_size() { return PRELOAD_THREAD_LOCALS_SIZE; } enum Traced { TRACED, UNTRACED }; enum Privileged { PRIVILEGED, UNPRIVILEGED }; enum Enabled { RECORDING_ONLY, REPLAY_ONLY, RECORDING_AND_REPLAY }; static remote_code_ptr rr_page_syscall_exit_point(Traced traced, Privileged privileged, Enabled enabled); static remote_code_ptr rr_page_syscall_entry_point(Traced traced, Privileged privileged, Enabled enabled, SupportedArch arch); struct SyscallType { Traced traced; Privileged privileged; Enabled enabled; }; static std::vector rr_page_syscalls(); static const SyscallType* rr_page_syscall_from_exit_point(remote_code_ptr ip); /** * Return a pointer to 8 bytes of 0xFF */ static remote_ptr rr_page_ff_bytes() { return RR_PAGE_FF_BYTES; } /** * Locate a syscall instruction in t's VDSO. * This gives us a way to execute remote syscalls without having to write * a syscall instruction into executable tracee memory (which might not be * possible with some kernels, e.g. PaX). */ remote_code_ptr find_syscall_instruction(Task* t); /** * Task |t| just forked from this address space. Apply dont_fork settings. */ void did_fork_into(Task* t); void set_first_run_event(TraceFrame::Time event) { first_run_event_ = event; } TraceFrame::Time first_run_event() { return first_run_event_; } const std::vector& saved_auxv() { return saved_auxv_; } void save_auxv(Task* t); /** * Reads the /proc//maps entry for a specific address. Does no caching. * If performed on a file in a btrfs file system, this may return the * wrong device number! If you stick to anonymous or special file * mappings, this should be OK. */ KernelMapping read_kernel_mapping(Task* t, remote_ptr addr); /** * Same as read_kernel_mapping, but reads rr's own memory map. */ static KernelMapping read_local_kernel_mapping(uint8_t* addr); static uint32_t chaos_mode_min_stack_size() { return 8 * 1024 * 1024; } remote_ptr chaos_mode_find_free_memory(Task* t, size_t len); remote_ptr find_free_memory( size_t len, remote_ptr after = remote_ptr()); PropertyTable& properties() { return properties_; } void post_vm_clone(Task* t); /** * TaskUid for the task whose locals are stored in the preload_thread_locals * area. */ const TaskUid& thread_locals_tuid() { return thread_locals_tuid_; } void set_thread_locals_tuid(const TaskUid& tuid) { thread_locals_tuid_ = tuid; } private: struct Breakpoint; typedef std::map BreakpointMap; class Watchpoint; /** * Called after a successful execve to set up the new AddressSpace. * Also called once for the initial spawn. */ AddressSpace(Task* t, const std::string& exe, uint32_t exec_count); /** * Called when an AddressSpace is cloned due to a fork() or a Session * clone. After this, and the task is properly set up, post_vm_clone will * be called. */ AddressSpace(Session* session, const AddressSpace& o, pid_t leader_tid, uint32_t leader_serial, uint32_t exec_count); /** * After an exec, populate the new address space of |t| with * the existing mappings we find in /proc/maps. */ void populate_address_space(Task* t); void unmap_internal(Task* t, remote_ptr addr, ssize_t num_bytes); // Also sets brk_ptr. void map_rr_page(AutoRemoteSyscalls& remote); bool update_watchpoint_value(const MemoryRange& range, Watchpoint& watchpoint); void update_watchpoint_values(remote_ptr start, remote_ptr end); enum WatchpointFilter { ALL_WATCHPOINTS, CHANGED_WATCHPOINTS }; std::vector get_watchpoints_internal(WatchpointFilter filter); enum WillSetTaskState { SETTING_TASK_STATE, NOT_SETTING_TASK_STATE }; std::vector get_watch_configs( WillSetTaskState will_set_task_state); /** * Construct a minimal set of watchpoints to be enabled based * on |set_watchpoint()| calls, and program them for each task * in this address space. */ bool allocate_watchpoints(); /** * Merge the mappings adjacent to |it| in memory that are * semantically "adjacent mappings" of the same resource as * well, for example have adjacent file offsets and the same * prot and flags. */ void coalesce_around(Task* t, MemoryMap::iterator it); /** * Erase |it| from |breakpoints| and restore any memory in * this it may have overwritten. */ void destroy_breakpoint(BreakpointMap::const_iterator it); /** * For each mapped segment overlapping [addr, addr + * num_bytes), call |f|. Pass |f| the overlapping mapping, * the mapped resource, and the range of addresses remaining * to be iterated over. * * Pass |ITERATE_CONTIGUOUS| to stop iterating when the last * contiguous mapping after |addr| within the region is seen. * Default is to iterate all mappings in the region. */ enum { ITERATE_DEFAULT, ITERATE_CONTIGUOUS }; void for_each_in_range( remote_ptr addr, ssize_t num_bytes, std::function f, int how = ITERATE_DEFAULT); /** * Map |m| of |r| into this address space, and coalesce any * mappings of |r| that are adjacent to |m|. */ void map_and_coalesce(Task* t, const KernelMapping& m, const KernelMapping& recorded_map, EmuFile::shr_ptr emu_file, std::unique_ptr mapped_file_stat, void* local_addr, std::shared_ptr&& monitored); void remove_from_map(const MemoryRange& range) { mem.erase(range); monitored_mem.erase(range.start()); } void add_to_map(const Mapping& m) { mem[m.map] = m; if (m.monitored_shared_memory) { monitored_mem.insert(m.map.start()); } } /** * Call this only during recording. */ template void at_preload_init_arch(Task* t); enum { EXEC_BIT = 1 << 0, READ_BIT = 1 << 1, WRITE_BIT = 1 << 2 }; /** Return the access bits above needed to watch |type|. */ static int access_bits_of(WatchType type); /** * Represents a refcount set on a particular address. Because there * can be multiple refcounts of multiple types set on a single * address, Breakpoint stores explicit USER and INTERNAL breakpoint * refcounts. Clients adding/removing breakpoints at this addr must * call ref()/unref() as appropriate. */ struct Breakpoint { Breakpoint() : internal_count(0), user_count(0) {} Breakpoint(const Breakpoint& o) = default; // AddressSpace::destroy_all_breakpoints() can cause this // destructor to be invoked while we have nonzero total // refcount, so the most we can assert is that the refcounts // are valid. ~Breakpoint() { assert(internal_count >= 0 && user_count >= 0); } void ref(BreakpointType which) { assert(internal_count >= 0 && user_count >= 0); ++*counter(which); } int unref(BreakpointType which) { assert(internal_count > 0 || user_count > 0); --*counter(which); assert(internal_count >= 0 && user_count >= 0); return internal_count + user_count; } BreakpointType type() const { // NB: USER breakpoints need to be processed before // INTERNAL ones. We want to give the debugger a // chance to dispatch commands before we attend to the // internal rr business. So if there's a USER "ref" // on the breakpoint, treat it as a USER breakpoint. return user_count > 0 ? BKPT_USER : BKPT_INTERNAL; } size_t data_length() { return 1; } uint8_t* original_data() { return &overwritten_data; } // "Refcounts" of breakpoints set at |addr|. The breakpoint // object must be unique since we have to save the overwritten // data, and we can't enforce the order in which breakpoints // are set/removed. int internal_count, user_count; uint8_t overwritten_data; static_assert(sizeof(overwritten_data) == sizeof(AddressSpace::breakpoint_insn), "Must have the same size."); int* counter(BreakpointType which) { assert(BKPT_INTERNAL == which || BKPT_USER == which); int* p = BKPT_USER == which ? &user_count : &internal_count; assert(*p >= 0); return p; } }; // XXX one is tempted to merge Breakpoint and Watchpoint into a single // entity, but the semantics are just different enough that separate // objects are easier for now. /** * Track the watched accesses of a contiguous range of memory * addresses. */ class Watchpoint { public: Watchpoint(size_t num_bytes) : exec_count(0), read_count(0), write_count(0), value_bytes(num_bytes), valid(false), changed(false) {} Watchpoint(const Watchpoint&) = default; ~Watchpoint() { assert_valid(); } void watch(int which) { assert_valid(); exec_count += (EXEC_BIT & which) != 0; read_count += (READ_BIT & which) != 0; write_count += (WRITE_BIT & which) != 0; } int unwatch(int which) { assert_valid(); if (EXEC_BIT & which) { assert(exec_count > 0); --exec_count; } if (READ_BIT & which) { assert(read_count > 0); --read_count; } if (WRITE_BIT & which) { assert(write_count > 0); --write_count; } return exec_count + read_count + write_count; } int watched_bits() const { return (exec_count > 0 ? EXEC_BIT : 0) | (read_count > 0 ? READ_BIT : 0) | (write_count > 0 ? WRITE_BIT : 0); } void assert_valid() const { assert(exec_count >= 0 && read_count >= 0 && write_count >= 0); } // Watchpoints stay alive until all watched access typed have // been cleared. We track refcounts of each watchable access // separately. int exec_count, read_count, write_count; // Debug registers allocated for read/exec access checking. // Write watchpoints are always triggered by checking for actual memory // value changes. Read/exec watchpoints can't be triggered that way, so // we look for these registers being triggered instead. std::vector debug_regs_for_exec_read; std::vector value_bytes; bool valid; bool changed; }; PropertyTable properties_; // All breakpoints set in this VM. BreakpointMap breakpoints; /* Path of the real executable image this address space was * exec()'d with. */ std::string exe; /* Pid of first task for this address space */ pid_t leader_tid_; /* Serial number of first task for this address space */ uint32_t leader_serial; uint32_t exec_count; // Only valid during recording remote_ptr brk_start; /* Current brk. Not necessarily page-aligned. */ remote_ptr brk_end; /* All segments mapped into this address space. */ MemoryMap mem; std::set> monitored_mem; /* madvise DONTFORK regions */ std::set dont_fork; // The session that created this. We save a ref to it so that // we can notify it when we die. Session* session_; // tid of the task whose thread-locals are in preload_thread_locals TaskUid thread_locals_tuid_; /* First mapped byte of the vdso. */ remote_ptr vdso_start_addr; // The monkeypatcher that's handling this address space. std::unique_ptr monkeypatch_state; // The watchpoints set for tasks in this VM. Watchpoints are // programmed per Task, but we track them per address space on // behalf of debuggers that assume that model. std::map watchpoints; std::vector> saved_watchpoints; // Tracee memory is read and written through this fd, which is // opened for the tracee's magic /proc/[tid]/mem device. The // advantage of this over ptrace is that we can access it even // when the tracee isn't at a ptrace-stop. It's also // theoretically faster for large data transfers, which rr can // do often. // // Users of child_mem_fd should fall back to ptrace-based memory // access when child_mem_fd is not open. ScopedFd child_mem_fd; remote_code_ptr traced_syscall_ip_; remote_code_ptr privileged_traced_syscall_ip_; remote_ptr syscallbuf_lib_start_; remote_ptr syscallbuf_lib_end_; bool syscallbuf_enabled_; std::vector saved_auxv_; /** * The time of the first event that ran code for a task in this address space. * 0 if no such event has occurred. */ TraceFrame::Time first_run_event_; /** * For each architecture, the offset of a syscall instruction with that * architecture's VDSO, or 0 if not known. */ static uint32_t offset_to_syscall_in_vdso[SupportedArch_MAX + 1]; /** * Ensure that the cached mapping of |t| matches /proc/maps, * using adjancent-map-merging heuristics that are as lenient * as possible given the data available from /proc/maps. */ static void check_segment_iterator(void* vasp, Task* t, const struct map_iterator_data* data); AddressSpace operator=(const AddressSpace&) = delete; }; } // namespace rr #endif /* RR_ADDRESS_SPACE_H_ */ rr-4.4.0/src/AutoRemoteSyscalls.cc000066400000000000000000000466231277367620400170730ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "AutoRemoteSyscalls.h" #include #include #include #include #include "rr/rr.h" #include "ReplaySession.h" #include "Session.h" #include "Task.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" using namespace std; namespace rr { /** * The ABI of the socketcall syscall is a nightmare; the first arg to * the kernel is the sub-operation, and the second argument is a * pointer to the args. The args depend on the sub-op. */ template struct socketcall_args { typename Arch::signed_long args[3]; } __attribute__((packed)); void AutoRestoreMem::init(const void* mem, ssize_t num_bytes) { ASSERT(remote.task(), remote.enable_mem_params() == AutoRemoteSyscalls::ENABLE_MEMORY_PARAMS) << "Memory parameters were disabled"; len = num_bytes; saved_sp = remote.regs().sp(); remote.regs().set_sp(remote.regs().sp() - len); remote.task()->set_regs(remote.regs()); addr = remote.regs().sp(); data.resize(len); remote.task()->read_bytes_helper(addr, len, data.data()); if (mem) { remote.task()->write_bytes_helper(addr, len, mem); } } AutoRestoreMem::~AutoRestoreMem() { assert(saved_sp == remote.regs().sp() + len); remote.task()->write_bytes_helper(addr, len, data.data()); remote.regs().set_sp(remote.regs().sp() + len); remote.task()->set_regs(remote.regs()); } AutoRemoteSyscalls::AutoRemoteSyscalls(Task* t, MemParamsEnabled enable_mem_params) : t(t), initial_regs(t->regs()), initial_ip(t->ip()), initial_sp(t->regs().sp()), pending_syscallno(-1), scratch_mem_was_mapped(false), enable_mem_params_(enable_mem_params) { // We could use privilged_traced_syscall_ip() here, but we don't actually // need privileges because tracee seccomp filters are modified to only // produce PTRACE_SECCOMP_EVENTs that we ignore. And before the rr page is // loaded, the privileged_traced_syscall_ip is not available. initial_regs.set_ip(t->vm()->traced_syscall_ip()); if (enable_mem_params == ENABLE_MEMORY_PARAMS) { maybe_fix_stack_pointer(); } // We need to make sure to clear any breakpoints or other alterations of // the syscall instruction we're using. Note that the tracee may have set its // own breakpoints or otherwise modified the instruction, so suspending our // own breakpoint is insufficient. std::vector syscall = rr::syscall_instruction(t->arch()); replaced_bytes = t->read_mem(initial_regs.ip().to_data_ptr(), syscall.size()); if (replaced_bytes == syscall) { replaced_bytes.clear(); } else { t->write_mem(initial_regs.ip().to_data_ptr(), syscall.data(), syscall.size()); } } static bool is_usable_area(const KernelMapping& km) { return (km.prot() & (PROT_READ | PROT_WRITE)) == (PROT_READ | PROT_WRITE) && (km.flags() & MAP_PRIVATE); } void AutoRemoteSyscalls::maybe_fix_stack_pointer() { if (!t->session().done_initial_exec()) { return; } remote_ptr last_stack_byte = t->regs().sp() - 1; if (t->vm()->has_mapping(last_stack_byte)) { auto m = t->vm()->mapping_of(last_stack_byte); if (is_usable_area(m.map) && m.map.start() + 2048 <= t->regs().sp()) { // 'sp' is in a stack region and there's plenty of space there. No need // to fix anything. return; } } MemoryRange found_stack; for (auto m : t->vm()->maps()) { if (is_usable_area(m.map)) { found_stack = m.map; break; } }; if (found_stack.start().is_null()) { AutoRemoteSyscalls remote(t, DISABLE_MEMORY_PARAMS); found_stack = MemoryRange(remote.infallible_mmap_syscall( remote_ptr(), 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0), 4096); scratch_mem_was_mapped = true; } fixed_sp = found_stack.end(); assert(!fixed_sp.is_null()); initial_regs.set_sp(fixed_sp); } AutoRemoteSyscalls::~AutoRemoteSyscalls() { restore_state_to(t); } void AutoRemoteSyscalls::restore_state_to(Task* t) { // Unmap our scatch region if required if (scratch_mem_was_mapped) { AutoRemoteSyscalls remote(t, DISABLE_MEMORY_PARAMS); remote.infallible_syscall(syscall_number_for_munmap(arch()), fixed_sp, 4096); } if (!replaced_bytes.empty()) { t->write_mem(remote_ptr( t->vm()->traced_syscall_ip().to_data_ptr()), replaced_bytes.data(), replaced_bytes.size()); } initial_regs.set_ip(initial_ip); initial_regs.set_sp(initial_sp); // Restore stomped registers. t->set_regs(initial_regs); } void AutoRemoteSyscalls::syscall_helper(SyscallWaiting wait, int syscallno, Registers& callregs) { LOG(debug) << "syscall " << syscall_name(syscallno, t->arch()); callregs.set_syscallno(syscallno); t->set_regs(callregs); t->enter_syscall(); ASSERT(t, t->regs().ip() - callregs.ip() == syscall_instruction_length(t->arch())) << "Should have advanced ip by one syscall_insn"; ASSERT(t, t->regs().original_syscallno() == syscallno) << "Should be entering " << t->syscall_name(syscallno) << ", but instead at " << t->syscall_name(t->regs().original_syscallno()); // Start running the syscall. pending_syscallno = syscallno; t->resume_execution(RESUME_SYSCALL, RESUME_NONBLOCKING, RESUME_NO_TICKS); if (WAIT == wait) { wait_syscall(syscallno); } } void AutoRemoteSyscalls::wait_syscall(int syscallno) { ASSERT(t, pending_syscallno == syscallno || syscallno < 0); // Wait for syscall-exit trap (or PTRACE_EVENT_* trap). // XXX we should handle stray signals here! t->wait(); pending_syscallno = -1; LOG(debug) << "done, result=" << t->regs().syscall_result(); ASSERT(t, t->regs().original_syscallno() == syscallno || syscallno < 0) << "Should be entering " << t->syscall_name(syscallno) << ", but instead at " << t->syscall_name(t->regs().original_syscallno()); } SupportedArch AutoRemoteSyscalls::arch() const { return t->arch(); } template static void write_socketcall_args(Task* t, remote_ptr remote_mem, typename Arch::signed_long arg1, typename Arch::signed_long arg2, typename Arch::signed_long arg3) { socketcall_args sc_args = { { arg1, arg2, arg3 } }; t->write_mem(remote_mem.cast>(), sc_args); } static size_t align_size(size_t size) { static int align_amount = sizeof(uintptr_t); return (size + align_amount - 1) & ~(align_amount - 1); } static remote_ptr allocate(remote_ptr* buf_end, const AutoRestoreMem& remote_buf, size_t size) { remote_ptr r = *buf_end; *buf_end += align_size(size); assert(size_t(*buf_end - remote_buf.get()) <= remote_buf.size()); return r; } template static remote_ptr allocate(remote_ptr* buf_end, const AutoRestoreMem& remote_buf) { return allocate(buf_end, remote_buf, sizeof(T)).cast(); } static int create_bind_and_listen_socket(const char* path) { struct sockaddr_un addr; int listen_sock = socket(AF_UNIX, SOCK_STREAM, 0); if (listen_sock < 0) { FATAL() << "Failed to create listen socket"; } addr.sun_family = AF_UNIX; strncpy(addr.sun_path, path, sizeof(addr.sun_path) - 1); addr.sun_path[sizeof(addr.sun_path) - 1] = 0; if (::bind(listen_sock, (struct sockaddr*)&addr, sizeof(addr))) { FATAL() << "Failed to bind listen socket"; } if (chmod(path, 0666)) { FATAL() << "Failed to make listening socket world-writeable"; } if (listen(listen_sock, 1)) { FATAL() << "Failed to mark listening for listen socket"; } return listen_sock; } template static int child_create_socket(AutoRemoteSyscalls& remote, remote_ptr> sc_args) { int child_sock; if (sc_args.is_null()) { child_sock = remote.infallible_syscall(Arch::socket, AF_UNIX, SOCK_STREAM, 0); } else { write_socketcall_args(remote.task(), sc_args, AF_UNIX, SOCK_STREAM, 0); child_sock = remote.infallible_syscall(Arch::socketcall, SYS_SOCKET, sc_args); } return child_sock; } template static void child_connect_socket(AutoRemoteSyscalls& remote, AutoRestoreMem& remote_buf, remote_ptr> sc_args, remote_ptr buf_end, int child_sock, const char* path, int* cwd_fd) { typename Arch::sockaddr_un addr; memset(&addr, 0, sizeof(addr)); // Make valgrind happy. addr.sun_family = AF_UNIX; assert(strlen(path) < sizeof(addr.sun_path)); // Skip leading '/' since we're going to access this relative to the root assert(path[0] == '/'); strcpy(addr.sun_path, path + 1); auto tmp_buf_end = buf_end; auto remote_dot = allocate(&tmp_buf_end, remote_buf, 2); remote.task()->write_mem(remote_dot.cast(), ".", 2); // This may fail because the tracee has done a setuid and is no longer // able to access its own CWD. There doesn't seem to be a way to save // and restore the CWD in this situation --- and connectat() doesn't exist yet // so we have no way to avoid having to set the CWD if we're in a chrooted // environment. We'll hack around such a failure later by putting the child // into a new directory that it can't access. *cwd_fd = remote.syscall(syscall_number_for_open(Arch::arch()), remote_dot, O_PATH | O_DIRECTORY); ASSERT(remote.task(), *cwd_fd >= 0 || *cwd_fd == -EACCES); remote.infallible_syscall(Arch::fchdir, RR_RESERVED_ROOT_DIR_FD); auto remote_addr = allocate(&buf_end, remote_buf); remote.task()->write_mem(remote_addr, addr); Registers callregs = remote.regs(); int remote_syscall; if (sc_args.is_null()) { callregs.set_arg1(child_sock); callregs.set_arg2(remote_addr); callregs.set_arg3(sizeof(addr)); remote_syscall = Arch::connect; } else { write_socketcall_args(remote.task(), sc_args, child_sock, remote_addr.as_int(), sizeof(addr)); callregs.set_arg1(SYS_CONNECT); callregs.set_arg2(sc_args); remote_syscall = Arch::socketcall; } remote.syscall_helper(AutoRemoteSyscalls::DONT_WAIT, remote_syscall, callregs); } template static void restore_cwd(AutoRemoteSyscalls& remote, int cwd_fd) { if (cwd_fd >= 0) { remote.infallible_syscall(Arch::fchdir, cwd_fd); remote.infallible_syscall(Arch::close, cwd_fd); } else { // We can't get back to the original directory. (Note that we may not // be able to access it ourselves from outside the tracee, if it's in a // mount namespace created by the tracee.) // Fake it by making a world-accessible directory, chdir the tracee into it, // then make it inaccessible. char path[PATH_MAX]; sprintf(path, "/tmp/rr-tracee-fd-inaccessible-dir-%d-%ld", remote.task()->tid, random()); int ret = mkdir(path, 0777); ASSERT(remote.task(), ret >= 0); AutoRestoreMem mem(remote, path); remote.infallible_syscall(Arch::chdir, mem.get()); ret = chmod(path, 0000); ASSERT(remote.task(), ret >= 0); ret = rmdir(path); ASSERT(remote.task(), ret >= 0); } } template static void child_sendmsg(AutoRemoteSyscalls& remote, AutoRestoreMem& remote_buf, remote_ptr> sc_args, remote_ptr buf_end, int child_sock, int fd) { char cmsgbuf[Arch::cmsg_space(sizeof(fd))]; memset(cmsgbuf, 0, sizeof(cmsgbuf)); // Pull the puppet strings to have the child send its fd // to us. Similarly to above, we DONT_WAIT on the // call to finish, since it's likely not defined whether the // sendmsg() may block on our recvmsg()ing what the tracee // sent us (in which case we would deadlock with the tracee). // We call sendmsg on child socket, but first we have to prepare a lot of // data. auto remote_msg = allocate(&buf_end, remote_buf); auto remote_msgdata = allocate(&buf_end, remote_buf); auto remote_cmsgbuf = allocate(&buf_end, remote_buf, sizeof(cmsgbuf)); // Unfortunately we need to send at least one byte of data in our // message for it to work typename Arch::iovec msgdata; msgdata.iov_base = remote_msg; // doesn't matter much, we ignore the data msgdata.iov_len = 1; remote.task()->write_mem(remote_msgdata, msgdata); typename Arch::msghdr msg; memset(&msg, 0, sizeof(msg)); msg.msg_control = remote_cmsgbuf; msg.msg_controllen = sizeof(cmsgbuf); msg.msg_iov = remote_msgdata; msg.msg_iovlen = 1; remote.task()->write_mem(remote_msg, msg); auto cmsg = reinterpret_cast(cmsgbuf); cmsg->cmsg_len = Arch::cmsg_len(sizeof(fd)); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; *static_cast(Arch::cmsg_data(cmsg)) = fd; remote.task()->write_bytes_helper(remote_cmsgbuf, sizeof(cmsgbuf), &cmsgbuf); Registers callregs = remote.regs(); int remote_syscall; if (sc_args.is_null()) { callregs.set_arg1(child_sock); callregs.set_arg2(remote_msg); callregs.set_arg3(0); remote_syscall = Arch::sendmsg; } else { write_socketcall_args(remote.task(), sc_args, child_sock, remote_msg.as_int(), 0); callregs.set_arg1(SYS_SENDMSG); callregs.set_arg2(sc_args); remote_syscall = Arch::socketcall; } remote.syscall_helper(AutoRemoteSyscalls::DONT_WAIT, remote_syscall, callregs); } static int recvmsg_socket(int sock) { char received_data; struct iovec msgdata; msgdata.iov_base = &received_data; msgdata.iov_len = 1; char cmsgbuf[CMSG_SPACE(sizeof(int))]; struct msghdr msg; memset(&msg, 0, sizeof(msg)); msg.msg_control = cmsgbuf; msg.msg_controllen = sizeof(cmsgbuf); msg.msg_iov = &msgdata; msg.msg_iovlen = 1; if (0 > recvmsg(sock, &msg, 0)) { FATAL() << "Failed to receive fd"; } struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg); assert(cmsg && cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS); int our_fd = *(int*)CMSG_DATA(cmsg); assert(our_fd >= 0); return our_fd; } template static size_t reserve() { return align_size(sizeof(T)); } template ScopedFd AutoRemoteSyscalls::retrieve_fd_arch(int fd) { size_t data_length = std::max(reserve(), reserve() + align_size(Arch::cmsg_space(sizeof(fd))) + reserve()); if (has_socketcall_syscall(Arch::arch())) { data_length += reserve>(); } AutoRestoreMem remote_buf(*this, nullptr, data_length); remote_ptr sc_args_end = remote_buf.get(); remote_ptr> sc_args; if (has_socketcall_syscall(Arch::arch())) { sc_args = allocate>(&sc_args_end, remote_buf); } char path[PATH_MAX]; sprintf(path, "/tmp/rr-tracee-fd-transfer-%d-%ld", t->tid, random()); int listen_sock = create_bind_and_listen_socket(path); int child_sock = child_create_socket(*this, sc_args); int cwd_fd; child_connect_socket(*this, remote_buf, sc_args, sc_args_end, child_sock, path, &cwd_fd); // Now the child is waiting for us to accept it. int sock = accept(listen_sock, nullptr, nullptr); if (sock < 0) { FATAL() << "Failed to create parent socket"; } // Verify that the child's PID is correct. This is a world-writeable socket // so anyone could connect, and this check is vital. struct ucred cred; cred.pid = -1; socklen_t credlen = sizeof(cred); if (getsockopt(sock, SOL_SOCKET, SO_PEERCRED, &cred, &credlen) < 0) { FATAL() << "Failed SO_PEERCRED"; } ASSERT(t, credlen == sizeof(cred)); if (cred.pid != task()->real_tgid()) { FATAL() << "Some other process connected to our socket!!!"; } // Complete child's connect() syscall wait_syscall(); int child_syscall_result = t->regs().syscall_result_signed(); if (child_syscall_result) { FATAL() << "Failed to connect() in tracee; err=" << errno_name(-child_syscall_result); } restore_cwd(*this, cwd_fd); // Listening socket not needed anymore close(listen_sock); unlink(path); child_sendmsg(*this, remote_buf, sc_args, sc_args_end, child_sock, fd); wait_syscall(); child_syscall_result = t->regs().syscall_result_signed(); if (0 >= child_syscall_result) { FATAL() << "Failed to sendmsg() in tracee; err=" << errno_name(-child_syscall_result); } // Child may be waiting on our recvmsg(). int our_fd = recvmsg_socket(sock); child_syscall_result = infallible_syscall(Arch::close, child_sock); if (0 > close(sock)) { FATAL() << "Failed to close parent socket"; } return ScopedFd(our_fd); } ScopedFd AutoRemoteSyscalls::retrieve_fd(int fd) { RR_ARCH_FUNCTION(retrieve_fd_arch, arch(), fd); } remote_ptr AutoRemoteSyscalls::infallible_mmap_syscall( remote_ptr addr, size_t length, int prot, int flags, int child_fd, uint64_t offset_pages) { // The first syscall argument is called "arg 1", so // our syscall-arg-index template parameter starts // with "1". remote_ptr ret = has_mmap2_syscall(arch()) ? infallible_syscall_ptr(syscall_number_for_mmap2(arch()), addr, length, prot, flags, child_fd, (off_t)offset_pages) : infallible_syscall_ptr(syscall_number_for_mmap(arch()), addr, length, prot, flags, child_fd, offset_pages * page_size()); if (flags & MAP_FIXED) { ASSERT(t, addr == ret) << "MAP_FIXED at " << addr << " but got " << ret; } return ret; } int64_t AutoRemoteSyscalls::infallible_lseek_syscall(int fd, int64_t offset, int whence) { switch (arch()) { case x86: { AutoRestoreMem mem(*this, &offset, sizeof(int64_t)); infallible_syscall(syscall_number_for__llseek(arch()), fd, offset >> 32, offset, mem.get(), whence); return t->read_mem(mem.get().cast()); } case x86_64: return infallible_syscall(syscall_number_for_lseek(arch()), fd, offset, whence); default: ASSERT(task(), false) << "Unknown arch"; return -1; } } void AutoRemoteSyscalls::check_syscall_result(int syscallno) { long ret = t->regs().syscall_result_signed(); if (-4096 < ret && ret < 0) { string extra_msg; if (is_open_syscall(syscallno, arch())) { extra_msg = " opening " + t->read_c_str(t->regs().arg1()); } else if (is_openat_syscall(syscallno, arch())) { extra_msg = " opening " + t->read_c_str(t->regs().arg2()); } ASSERT(t, false) << "Syscall " << syscall_name(syscallno, arch()) << " failed with errno " << errno_name(-ret) << extra_msg; } } } // namespace rr rr-4.4.0/src/AutoRemoteSyscalls.h000066400000000000000000000201201277367620400167150ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_AUTO_REMOTE_SYSCALLS_H_ #define RR_AUTO_REMOTE_SYSCALLS_H_ #include #include #include "Registers.h" #include "ScopedFd.h" #include "Task.h" namespace rr { class AutoRemoteSyscalls; class Task; /** * Helpers to make remote syscalls on behalf of a Task. Usage looks * like * * AutoRemoteSyscalls remote(t); // prepare remote syscalls * remote.syscall(syscall_number_for_open(remote.arch()), ...); // make *syscalls * ... * // when |remote| goes out of scope, remote syscalls are finished */ /** * Cookie used to restore stomped memory, usually prepared as the * argument to a remote syscall. */ class AutoRestoreMem { public: /** * Write |mem| into address space of the Task prepared for * remote syscalls in |remote|, in such a way that the write * will be undone. The address of the reserved mem space is * available via |get|. * If |mem| is null, data is not written, only the space is reserved. */ AutoRestoreMem(AutoRemoteSyscalls& remote, const void* mem, ssize_t num_bytes) : remote(remote) { init(mem, num_bytes); } /** * Convenience constructor for pushing a C string |str|, including * the trailing '\0' byte. */ AutoRestoreMem(AutoRemoteSyscalls& remote, const char* str) : remote(remote) { init((const uint8_t*)str, strlen(str) + 1 /*null byte*/); } ~AutoRestoreMem(); /** * Get a pointer to the reserved memory. */ remote_ptr get() const { return addr; } /** * Return size of reserved memory buffer. */ size_t size() const { return data.size(); } private: void init(const void* mem, ssize_t num_bytes); AutoRemoteSyscalls& remote; /* Address of tmp mem. */ remote_ptr addr; /* Saved data. */ std::vector data; /* (We keep this around for error checking.) */ remote_ptr saved_sp; /* Length of tmp mem. */ size_t len; AutoRestoreMem& operator=(const AutoRestoreMem&) = delete; AutoRestoreMem(const AutoRestoreMem&) = delete; void* operator new(size_t) = delete; void operator delete(void*) = delete; }; /** * RAII helper to prepare a Task for remote syscalls and undo any * preparation upon going out of scope. Note that this restores register * values when going out of scope, so *all* changes to Task's register * state are lost. */ class AutoRemoteSyscalls { public: enum MemParamsEnabled { ENABLE_MEMORY_PARAMS, DISABLE_MEMORY_PARAMS }; /** * Prepare |t| for a series of remote syscalls. * * NBBB! Before preparing for a series of remote syscalls, * the caller *must* ensure the callee will not receive any * signals. This code does not attempt to deal with signals. */ AutoRemoteSyscalls(Task* t, MemParamsEnabled enable_mem_params = ENABLE_MEMORY_PARAMS); /** * Undo in |t| any preparations that were made for a series of * remote syscalls. */ ~AutoRemoteSyscalls(); /** * If t's stack pointer doesn't look valid, temporarily adjust it to * the top of *some* stack area. */ void maybe_fix_stack_pointer(); /** * "Initial" registers saved from the target task. * * NB: a non-const reference is returned because some power * users want to update the registers that are restored after * finishing remote syscalls. Perhaps these users should be * fixed, or you should just be careful. */ Registers& regs() { return initial_regs; } /** * Undo any preparations to make remote syscalls in the context of |t|. * * This is usually called automatically by the destructor; * don't call it directly unless you really know what you'd * doing. *ESPECIALLY* don't call this on a |t| other than * the one passed to the contructor, unless you really know * what you're doing. */ void restore_state_to(Task* t); /** * Make |syscallno| with variadic |args| (limited to 6 on * x86). Return the raw kernel return value. */ template long syscall(int syscallno, Rest... args) { Registers callregs = regs(); // The first syscall argument is called "arg 1", so // our syscall-arg-index template parameter starts // with "1". syscall_helper<1>(syscallno, callregs, args...); return t->regs().syscall_result_signed(); } template long infallible_syscall(int syscallno, Rest... args) { Registers callregs = regs(); // The first syscall argument is called "arg 1", so // our syscall-arg-index template parameter starts // with "1". syscall_helper<1>(syscallno, callregs, args...); check_syscall_result(syscallno); return t->regs().syscall_result_signed(); } template remote_ptr infallible_syscall_ptr(int syscallno, Rest... args) { Registers callregs = regs(); syscall_helper<1>(syscallno, callregs, args...); check_syscall_result(syscallno); return t->regs().syscall_result(); } /** * Remote mmap syscalls are common and non-trivial due to the need to * select either mmap2 or mmap. */ remote_ptr infallible_mmap_syscall(remote_ptr addr, size_t length, int prot, int flags, int child_fd, uint64_t offset_pages); int64_t infallible_lseek_syscall(int fd, int64_t offset, int whence); /** The Task in the context of which we're making syscalls. */ Task* task() const { return t; } /** * A small helper to get at the Task's arch. * Out-of-line to avoid including Task.h here. */ SupportedArch arch() const; /** * Arranges for 'fd' to be transmitted to this process and returns * our opened version of it. */ ScopedFd retrieve_fd(int fd); /** * Remotely invoke in |t| the specified syscall with the given * arguments. The arguments must of course be valid in |t|, * and no checking of that is done by this function. * * If |wait| is |WAIT|, the syscall is finished in |t| and the * result is returned. Otherwise if it's |DONT_WAIT|, the * syscall is initiated but *not* finished in |t|, and the * return value is undefined. Call |wait_remote_syscall()| to * finish the syscall and get the return value. */ enum SyscallWaiting { WAIT = 1, DONT_WAIT = 0 }; void syscall_helper(SyscallWaiting wait, int syscallno, Registers& callregs); MemParamsEnabled enable_mem_params() { return enable_mem_params_; } private: /** * Wait for the |DONT_WAIT| syscall |syscallno| initiated by * |remote_syscall()| to finish, returning the result. * |syscallno| is only for assertion checking. If no value is passed in, * everything should work without the assertion checking. */ void wait_syscall(int syscallno = -1); void check_syscall_result(int syscallno); /** * "Recursively" build the set of syscall registers in * |callregs|. |Index| is the syscall arg that will be set to * |arg|, and |args| are the remaining arguments. */ template void syscall_helper(int syscallno, Registers& callregs, T arg, Rest... args) { callregs.set_arg(arg); syscall_helper(syscallno, callregs, args...); } /** * "Recursion" "base case": no more arguments to build, so * just make the syscall and return the kernel return value. */ template void syscall_helper(int syscallno, Registers& callregs) { syscall_helper(WAIT, syscallno, callregs); } template ScopedFd retrieve_fd_arch(int fd); Task* t; Registers initial_regs; remote_code_ptr initial_ip; remote_ptr initial_sp; remote_ptr fixed_sp; int pending_syscallno; std::vector replaced_bytes; /* Whether we had to mmap a scratch region because none was found */ bool scratch_mem_was_mapped; MemParamsEnabled enable_mem_params_; AutoRemoteSyscalls& operator=(const AutoRemoteSyscalls&) = delete; AutoRemoteSyscalls(const AutoRemoteSyscalls&) = delete; void* operator new(size_t) = delete; void operator delete(void*) = delete; }; } // namespace rr #endif // RR_AUTO_REMOTE_SYSCALLS_H_ rr-4.4.0/src/BreakpointCondition.h000066400000000000000000000005461277367620400170720ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_BREAKPOINT_CONDITION_H_ #define RR_BREAKPOINT_CONDITION_H_ namespace rr { class Task; class BreakpointCondition { public: virtual ~BreakpointCondition() {} virtual bool evaluate(Task* t) const = 0; }; } // namespace rr #endif // RR_BREAKPOINT_CONDITION_H_ rr-4.4.0/src/CPUIDBugDetector.cc000066400000000000000000000042311277367620400162520ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "CPUIDBugDetector.h" #include "Event.h" #include "Flags.h" #include "ReplaySession.h" #include "ReplayTask.h" #include "kernel_abi.h" extern "C" int cpuid_loop(int iterations); using namespace std; namespace rr { void CPUIDBugDetector::run_detection_code() { // Call cpuid_loop to generate trace data we can use to detect // the cpuid rcb undercount bug. This generates 4 geteuid // calls which should have 2 rcbs between each of the // 3 consecutive pairs. cpuid_loop(4); } static bool rcb_counts_ok(uint64_t prev, uint64_t current) { if (current - prev == 2) { return true; } if (!Flags::get().suppress_environment_warnings) { fprintf( stderr, "\n" "rr: Warning: You appear to be running in a VMWare guest with a bug\n" " where a conditional branch instruction between two CPUID " "instructions\n" " sometimes fails to be counted by the conditional branch " "performance\n" " counter. Work around this problem by adding\n" " monitor_control.disable_hvsim_clusters = true\n" " to your .vmx file.\n" "\n"); } return false; } void CPUIDBugDetector::notify_reached_syscall_during_replay(ReplayTask* t) { // We only care about events that happen before the first exec, // when our detection code runs. if (t->session().done_initial_exec()) { return; } const Event& ev = t->current_trace_frame().event(); if (!is_geteuid32_syscall(ev.Syscall().number, t->arch()) && !is_geteuid_syscall(ev.Syscall().number, t->arch())) { return; } uint64_t trace_rcb_count = t->current_trace_frame().ticks(); uint64_t actual_rcb_count = t->tick_count(); if (trace_rcb_count_at_last_geteuid32 > 0 && !detected_cpuid_bug) { if (!rcb_counts_ok(trace_rcb_count_at_last_geteuid32, trace_rcb_count) || !rcb_counts_ok(actual_rcb_count_at_last_geteuid32, actual_rcb_count)) { detected_cpuid_bug = true; } } trace_rcb_count_at_last_geteuid32 = trace_rcb_count; actual_rcb_count_at_last_geteuid32 = actual_rcb_count; } } // namespace rr rr-4.4.0/src/CPUIDBugDetector.h000066400000000000000000000025231277367620400161160ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_CPUID_BUG_DETECTOR_H_ #define RR_CPUID_BUG_DETECTOR_H_ #include namespace rr { class ReplayTask; /** * Helper to detect when the "CPUID can cause rcbs to be lost" bug is present. * See http://robert.ocallahan.org/2014/09/vmware-cpuid-conditional-branch.html * * This bug is caused by VMM optimizations described in * https://www.usenix.org/system/files/conference/atc12/atc12-final158.pdf * that cause instruction sequences related to CPUID to be optimized, * eliminating the user-space execution of a conditional branch between two * CPUID instructions (in some circumstances). */ class CPUIDBugDetector { public: CPUIDBugDetector() : trace_rcb_count_at_last_geteuid32(0), actual_rcb_count_at_last_geteuid32(0), detected_cpuid_bug(false) {} /** * Call this in the context of the first spawned process to run the * code that triggers the bug. */ static void run_detection_code(); /** * Call this when task t enters a traced syscall during replay. */ void notify_reached_syscall_during_replay(ReplayTask* t); private: uint64_t trace_rcb_count_at_last_geteuid32; uint64_t actual_rcb_count_at_last_geteuid32; bool detected_cpuid_bug; }; } // namespace rr #endif /* RR_CPUID_BUG_DETECTOR_H_ */ rr-4.4.0/src/Command.cc000066400000000000000000000102331277367620400146330ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define _BSD_SOURCE #include "Command.h" #include #include #include #include "TraceStream.h" #include "main.h" using namespace std; namespace rr { bool ParsedOption::verify_valid_int(int64_t min, int64_t max) const { if (int_value < min || int_value > max) { return false; } return true; } static vector* command_list; Command::Command(const char* name, const char* help) : name(name), help(help) { if (!command_list) { command_list = new vector(); } command_list->push_back(this); } Command* Command::command_for_name(const std::string& name) { for (auto& it : *command_list) { if (strcmp(it->name, name.c_str()) == 0) { return it; } } return nullptr; } bool Command::less_than_by_name(Command* c1, Command* c2) { return strcmp(c1->name, c2->name) < 0; } void Command::print_help_all(FILE* out) { vector cmds; for (auto& it : *command_list) { if (!it->help) { continue; } cmds.push_back(it); } sort(cmds.begin(), cmds.end(), less_than_by_name); for (auto& it : cmds) { const char* c = strchr(it->help, '\n'); if (c) { fprintf(out, "%.*s\n", (int)(c - it->help), it->help); } else { fputs(it->help, out); } } } void Command::print_help(FILE* out) { if (help) { fputs(help, out); } else { print_usage(out); } } static bool consume_args(std::vector& args, size_t count) { args.erase(args.begin(), args.begin() + count); return true; } static void assign_param(ParsedOption* opt, const char* s) { opt->value = s; opt->int_value = INT64_MIN; if (!opt->value.empty()) { char* end; int64_t v = strtoll(s, &end, 10); if (*end == 0) { opt->int_value = v; } } } bool Command::parse_option(std::vector& args, const OptionSpec* option_specs, size_t count, ParsedOption* out) { if (args.size() == 0 || args[0][0] != '-') { return false; } for (size_t i = 0; i < count; ++i) { if (args[0][1] == option_specs[i].short_name && args[0][1] >= 32) { out->short_name = option_specs[i].short_name; switch (option_specs[i].param) { case NO_PARAMETER: if (args[0][2] == 0) { return consume_args(args, 1); } return false; case HAS_PARAMETER: if (args[0][2] != 0) { assign_param(out, args[0].c_str() + 2); return consume_args(args, 1); } if (args.size() >= 2) { assign_param(out, args[1].c_str()); return consume_args(args, 2); } return false; default: assert(0 && "Unknown parameter type"); } } else if (args[0][1] == '-') { size_t equals = args[0].find('='); if (strncmp(args[0].c_str() + 2, option_specs[i].long_name, (equals == string::npos ? args[0].length() : equals) - 2) == 0) { out->short_name = option_specs[i].short_name; switch (option_specs[i].param) { case NO_PARAMETER: return consume_args(args, 1); case HAS_PARAMETER: if (equals == string::npos) { if (args.size() >= 2) { assign_param(out, args[1].c_str()); return consume_args(args, 2); } return false; } assign_param(out, args[0].c_str() + equals + 1); return consume_args(args, 1); default: assert(0 && "Unknown parameter type"); } } } } return false; } bool Command::verify_not_option(std::vector& args) { if (args.size() > 0 && args[0][0] == '-') { fprintf(stderr, "Invalid option %s\n", args[0].c_str()); return false; } return true; } bool Command::parse_optional_trace_dir(vector& args, string* out) { if (!verify_not_option(args)) { return false; } if (args.size() > 0) { *out = args[0]; args.erase(args.begin()); } else { *out = string(); } return true; } } // namespace rr rr-4.4.0/src/Command.h000066400000000000000000000035771277367620400145120ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_COMMAND_H_ #define RR_COMMAND_H_ #ifndef _DEFAULT_SOURCE #define _DEFAULT_SOURCE 1 #endif #include #include #include #include #include namespace rr { class TraceReader; enum OptionParameters { NO_PARAMETER, HAS_PARAMETER }; struct OptionSpec { char short_name; const char* long_name; OptionParameters param; }; struct ParsedOption { char short_name; std::string value; int64_t int_value; bool verify_valid_int(int64_t min = INT64_MIN + 1, int64_t max = INT64_MAX) const; }; /** * rr command-line commands. Objects of this class must be static, since * they are expected to be immortal. */ class Command { public: static Command* command_for_name(const std::string& name); static void print_help_all(FILE* out); /* Runs the command with the given parameters. Returns an exit code. */ virtual int run(std::vector& args) = 0; void print_help(FILE* out); static bool verify_not_option(std::vector& args); static bool parse_optional_trace_dir(std::vector& args, std::string* out); static bool parse_option(std::vector& args, const OptionSpec* option_specs, size_t count, ParsedOption* out); template static bool parse_option(std::vector& args, const OptionSpec (&option_specs)[N], ParsedOption* out) { return parse_option(args, option_specs, N, out); } protected: Command(const char* name, const char* help); virtual ~Command() {} static bool less_than_by_name(Command* c1, Command* c2); const char* name; const char* help; }; } // namespace rr #endif // RR_COMMAND_H_ rr-4.4.0/src/CompressedReader.cc000066400000000000000000000106061277367620400165100ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define _LARGEFILE64_SOURCE #include "CompressedReader.h" #include #include #include #include #include #include #include #include #include "CompressedWriter.h" using namespace std; namespace rr { CompressedReader::CompressedReader(const string& filename) : fd(new ScopedFd(filename.c_str(), O_CLOEXEC | O_RDONLY | O_LARGEFILE)) { fd_offset = 0; error = !fd->is_open(); if (error) { eof = false; } else { char ch; eof = pread(*fd, &ch, 1, fd_offset) == 0; } buffer_read_pos = 0; have_saved_state = false; } CompressedReader::CompressedReader(const CompressedReader& other) { fd = other.fd; fd_offset = other.fd_offset; error = other.error; eof = other.eof; buffer_read_pos = other.buffer_read_pos; buffer = other.buffer; have_saved_state = false; assert(!other.have_saved_state); } CompressedReader::~CompressedReader() { close(); } static bool read_all(const ScopedFd& fd, size_t size, void* data, uint64_t* offset) { while (size > 0) { ssize_t result = pread(fd, data, size, *offset); if (result <= 0) { return false; } size -= result; data = static_cast(data) + result; *offset += result; } return true; } static bool do_decompress(std::vector& compressed, std::vector& uncompressed) { z_stream stream; memset(&stream, 0, sizeof(stream)); int result = inflateInit(&stream); if (result != Z_OK) { assert(0 && "inflateInit failed!"); return false; } stream.next_in = &compressed[0]; stream.avail_in = compressed.size(); stream.next_out = &uncompressed[0]; stream.avail_out = uncompressed.size(); result = inflate(&stream, Z_FINISH); if (result != Z_STREAM_END) { assert(0 && "inflate failed!"); return false; } result = inflateEnd(&stream); if (result != Z_OK) { assert(0 && "inflateEnd failed!"); return false; } return true; } bool CompressedReader::read(void* data, size_t size) { while (size > 0) { if (error) { return false; } if (buffer_read_pos < buffer.size()) { size_t amount = std::min(size, buffer.size() - buffer_read_pos); memcpy(data, &buffer[buffer_read_pos], amount); size -= amount; data = static_cast(data) + amount; buffer_read_pos += amount; continue; } if (have_saved_state && !have_saved_buffer) { std::swap(buffer, saved_buffer); have_saved_buffer = true; } CompressedWriter::BlockHeader header; if (!read_all(*fd, sizeof(header), &header, &fd_offset)) { error = true; return false; } std::vector compressed_buf; compressed_buf.resize(header.compressed_length); if (!read_all(*fd, compressed_buf.size(), &compressed_buf[0], &fd_offset)) { error = true; return false; } char ch; if (pread(*fd, &ch, 1, fd_offset) == 0) { eof = true; } buffer.resize(header.uncompressed_length); buffer_read_pos = 0; if (!do_decompress(compressed_buf, buffer)) { error = true; return false; } } return true; } void CompressedReader::rewind() { assert(!have_saved_state); fd_offset = 0; buffer_read_pos = 0; buffer.clear(); eof = false; } void CompressedReader::close() { fd = nullptr; } void CompressedReader::save_state() { assert(!have_saved_state); have_saved_state = true; have_saved_buffer = false; saved_fd_offset = fd_offset; saved_buffer_read_pos = buffer_read_pos; } void CompressedReader::restore_state() { assert(have_saved_state); have_saved_state = false; if (saved_fd_offset < fd_offset) { eof = false; } fd_offset = saved_fd_offset; if (have_saved_buffer) { std::swap(buffer, saved_buffer); saved_buffer.clear(); } buffer_read_pos = saved_buffer_read_pos; } uint64_t CompressedReader::uncompressed_bytes() const { uint64_t offset = 0; uint64_t uncompressed_bytes = 0; CompressedWriter::BlockHeader header; while (read_all(*fd, sizeof(header), &header, &offset)) { uncompressed_bytes += header.uncompressed_length; offset += header.compressed_length; } return uncompressed_bytes; } uint64_t CompressedReader::compressed_bytes() const { return lseek(*fd, 0, SEEK_END); } } // namespace rr rr-4.4.0/src/CompressedReader.h000066400000000000000000000045021277367620400163500ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_COMPRESSED_READER_H_ #define RR_COMPRESSED_READER_H_ #include #include #include #include #include #include "ScopedFd.h" namespace rr { /** * CompressedReader opens an input file written by CompressedWriter * and reads data from it. Currently data is decompressed by the thread that * calls read(). */ class CompressedReader { public: CompressedReader(const std::string& filename); CompressedReader(const CompressedReader& aOther); ~CompressedReader(); bool good() const { return !error; } bool at_end() const { return eof && buffer_read_pos == buffer.size(); } // Returns true if successful. Otherwise there's an error and good() // will be false. bool read(void* data, size_t size); void rewind(); void close(); /** * Save the current position. Nested saves are not allowed. */ void save_state(); /** * Restore previously saved position. */ void restore_state(); /** * Gathers stats on the file stream. These are independent of what's * actually been read. */ uint64_t uncompressed_bytes() const; uint64_t compressed_bytes() const; template CompressedReader& operator>>(T& value) { read(&value, sizeof(value)); return *this; } CompressedReader& operator>>(std::string& value) { value.empty(); while (true) { char ch; read(&ch, 1); if (ch == 0) { break; } value.append(1, ch); } return *this; } template CompressedReader& operator>>(std::vector& value) { size_t len; *this >> len; value.resize(0); for (size_t i = 0; i < len; ++i) { T v; *this >> v; value.push_back(v); } return *this; } protected: /* Our fd might be the dup of another fd, so we can't rely on its current file position. Instead track the current position in fd_offset and use pread. */ uint64_t fd_offset; std::shared_ptr fd; bool error; bool eof; std::vector buffer; size_t buffer_read_pos; bool have_saved_state; bool have_saved_buffer; uint64_t saved_fd_offset; std::vector saved_buffer; size_t saved_buffer_read_pos; }; } // namespace rr #endif /* RR_COMPRESSED_READER_H_ */ rr-4.4.0/src/CompressedWriter.cc000066400000000000000000000165221277367620400165650ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define _LARGEFILE64_SOURCE #include "CompressedWriter.h" #include #include #include #include #include #include #include #include using namespace std; namespace rr { void* CompressedWriter::compression_thread_callback(void* p) { static_cast(p)->compression_thread(); return nullptr; } CompressedWriter::CompressedWriter(const string& filename, size_t block_size, uint32_t num_threads) : fd(filename.c_str(), O_CLOEXEC | O_WRONLY | O_CREAT | O_EXCL | O_LARGEFILE, 0400) { this->block_size = block_size; threads.resize(num_threads); thread_pos.resize(num_threads); buffer.resize(block_size * (num_threads + 2)); pthread_mutex_init(&mutex, nullptr); pthread_cond_init(&cond, nullptr); for (uint32_t i = 0; i < num_threads; ++i) { thread_pos[i] = UINT64_MAX; } next_thread_pos = 0; next_thread_end_pos = 0; closing = false; write_error = false; producer_reserved_pos = 0; producer_reserved_write_pos = 0; producer_reserved_upto_pos = 0; error = false; if (fd < 0) { error = true; return; } // Hold the lock so threads don't inspect the 'threads' array // until we've finished initializing it. pthread_mutex_lock(&mutex); for (uint32_t i = 0; i < num_threads; ++i) { pthread_create(&threads[i], nullptr, compression_thread_callback, this); size_t last_slash = filename.rfind('/'); string thread_name = string("compress ") + (last_slash == string::npos ? filename : filename.substr(last_slash + 1)); pthread_setname_np(threads[i], thread_name.substr(0, 15).c_str()); } pthread_mutex_unlock(&mutex); } CompressedWriter::~CompressedWriter() { close(); pthread_mutex_destroy(&mutex); pthread_cond_destroy(&cond); } void CompressedWriter::write(const void* data, size_t size) { while (!error && size > 0) { uint64_t reservation_size = producer_reserved_upto_pos - producer_reserved_write_pos; if (reservation_size == 0) { update_reservation(WAIT); continue; } size_t buf_offset = (size_t)(producer_reserved_write_pos % buffer.size()); size_t amount = min(buffer.size() - buf_offset, (size_t)min(reservation_size, size)); memcpy(&buffer[buf_offset], data, amount); producer_reserved_write_pos += amount; data = static_cast(data) + amount; size -= amount; } if (!error && producer_reserved_write_pos - producer_reserved_pos >= buffer.size() / 2) { update_reservation(NOWAIT); } } void CompressedWriter::update_reservation(WaitFlag wait_flag) { pthread_mutex_lock(&mutex); next_thread_end_pos = producer_reserved_write_pos; producer_reserved_pos = producer_reserved_write_pos; // Wake up threads that might be waiting to consume data. pthread_cond_broadcast(&cond); while (!error) { if (write_error) { error = true; break; } uint64_t completed_pos = next_thread_pos; for (uint32_t i = 0; i < thread_pos.size(); ++i) { completed_pos = min(completed_pos, thread_pos[i]); } producer_reserved_upto_pos = completed_pos + buffer.size(); if (producer_reserved_pos < producer_reserved_upto_pos || wait_flag == NOWAIT) { break; } pthread_cond_wait(&cond, &mutex); } pthread_mutex_unlock(&mutex); } void CompressedWriter::compression_thread() { pthread_mutex_lock(&mutex); int thread_index; pthread_t self = pthread_self(); for (thread_index = 0; threads[thread_index] != self; ++thread_index) { } // Add slop for incompressible data vector outputbuf; outputbuf.resize((size_t)(block_size * 1.1) + sizeof(BlockHeader)); BlockHeader* header = reinterpret_cast(&outputbuf[0]); while (true) { if (!write_error && next_thread_pos < next_thread_end_pos && (closing || next_thread_pos + block_size <= next_thread_end_pos)) { thread_pos[thread_index] = next_thread_pos; next_thread_pos = min(next_thread_end_pos, next_thread_pos + block_size); // header->uncompressed_length must be <= block_size, // therefore fits in a size_t. header->uncompressed_length = (size_t)(next_thread_pos - thread_pos[thread_index]); pthread_mutex_unlock(&mutex); header->compressed_length = do_compress(thread_pos[thread_index], header->uncompressed_length, &outputbuf[sizeof(BlockHeader)], outputbuf.size() - sizeof(BlockHeader)); pthread_mutex_lock(&mutex); if (header->compressed_length == 0) { write_error = true; } // wait until we're the next thread that needs to write while (!write_error) { bool other_thread_write_first = false; for (uint32_t i = 0; i < thread_pos.size(); ++i) { if (thread_pos[i] < thread_pos[thread_index]) { other_thread_write_first = true; } } if (!other_thread_write_first) { break; } pthread_cond_wait(&cond, &mutex); } if (!write_error) { pthread_mutex_unlock(&mutex); ::write(fd, &outputbuf[0], sizeof(BlockHeader) + header->compressed_length); pthread_mutex_lock(&mutex); } thread_pos[thread_index] = UINT64_MAX; // do a broadcast because we might need to unblock // the producer thread or a compressor thread waiting // for us to write. pthread_cond_broadcast(&cond); continue; } if (closing && (write_error || next_thread_pos == next_thread_end_pos)) { break; } pthread_cond_wait(&cond, &mutex); } pthread_mutex_unlock(&mutex); } void CompressedWriter::close() { if (!fd.is_open()) { return; } update_reservation(NOWAIT); pthread_mutex_lock(&mutex); closing = true; pthread_cond_broadcast(&cond); pthread_mutex_unlock(&mutex); for (auto i = threads.begin(); i != threads.end(); ++i) { pthread_join(*i, nullptr); } fd.close(); } size_t CompressedWriter::do_compress(uint64_t offset, size_t length, uint8_t* outputbuf, size_t outputbuf_len) { z_stream stream; memset(&stream, 0, sizeof(stream)); int result = deflateInit(&stream, Z_DEFAULT_COMPRESSION); if (result != Z_OK) { assert(0 && "deflateInit failed!"); return 0; } stream.next_out = outputbuf; stream.avail_out = outputbuf_len; while (length > 0 || stream.avail_in > 0) { if (stream.avail_in == 0) { size_t buf_offset = (size_t)(offset % buffer.size()); size_t amount = min(length, buffer.size() - buf_offset); stream.next_in = &buffer[buf_offset]; stream.avail_in = amount; length -= amount; offset += amount; } if (stream.avail_out == 0) { assert(0 && "outputbuf exhausted!"); return 0; } result = deflate(&stream, length == 0 ? Z_FINISH : Z_NO_FLUSH); if (result != (length == 0 ? Z_STREAM_END : Z_OK)) { assert(0 && "deflate failed!"); return 0; } } result = deflateEnd(&stream); if (result != Z_OK) { assert(0 && "deflateEnd failed!"); return 0; } return stream.total_out; } } // namespace rr rr-4.4.0/src/CompressedWriter.h000066400000000000000000000061551277367620400164300ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_COMPRESSED_WRITER_H_ #define RR_COMPRESSED_WRITER_H_ #include #include #include #include #include #include "ScopedFd.h" namespace rr { /** * CompressedWriter opens an output file and writes compressed blocks to it. * Blocks of a fixed but unspecified size (currently 1MB) are compressed. * Each block of compressed data is written to the file preceded by two * 32-bit words: the size of the compressed data (excluding block header) * and the size of the uncompressed data, in that order. See BlockHeader below. * * We use multiple threads to perform compression. The threads are * responsible for the actual data writes. The thread that creates the * CompressedWriter is the "producer" thread and must also be the caller of * 'write'. The producer thread may block in 'write' if 'buffer_size' bytes are * being compressed. * * Each data block is compressed independently using zlib. */ class CompressedWriter { public: CompressedWriter(const std::string& filename, size_t buffer_size, uint32_t num_threads); ~CompressedWriter(); // Call only on producer thread bool good() const { return !error; } // Call only on producer thread. void write(const void* data, size_t size); // Call only on producer thread void close(); struct BlockHeader { uint32_t compressed_length; uint32_t uncompressed_length; }; template CompressedWriter& operator<<(const T& value) { write(&value, sizeof(value)); return *this; } CompressedWriter& operator<<(const std::string& value) { write(value.c_str(), value.size() + 1); return *this; } template CompressedWriter& operator<<(const std::vector& value) { *this << value.size(); for (auto& i : value) { *this << i; } return *this; } protected: enum WaitFlag { WAIT, NOWAIT }; void update_reservation(WaitFlag wait_flag); static void* compression_thread_callback(void* p); void compression_thread(); size_t do_compress(uint64_t offset, size_t length, uint8_t* outputbuf, size_t outputbuf_len); // Immutable while threads are running ScopedFd fd; int block_size; pthread_mutex_t mutex; pthread_cond_t cond; std::vector threads; // Carefully shared... std::vector buffer; // BEGIN protected by 'mutex' /* position in output stream that this thread is currently working on, * or UINT64_MAX if it's idle */ std::vector thread_pos; /* position in output stream of data to dispatch to next thread */ uint64_t next_thread_pos; /* position in output stream of end of data ready to dispatch */ uint64_t next_thread_end_pos; bool closing; bool write_error; // END protected by 'mutex' /* producer thread only */ /* Areas in the buffer that have been reserved for write() */ uint64_t producer_reserved_pos; uint64_t producer_reserved_write_pos; uint64_t producer_reserved_upto_pos; bool error; }; } // namespace rr #endif /* RR_COMPRESSED_WRITER_H_ */ rr-4.4.0/src/DiversionSession.cc000066400000000000000000000127501277367620400165710ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "DiversionSession.h" #include "AutoRemoteSyscalls.h" #include "ReplaySession.h" #include "kernel_metadata.h" #include "log.h" using namespace std; namespace rr { DiversionSession::DiversionSession() : emu_fs(EmuFs::create()) {} DiversionSession::~DiversionSession() { // We won't permanently leak any OS resources by not ensuring // we've cleaned up here, but sessions can be created and // destroyed many times, and we don't want to temporarily hog // resources. kill_all_tasks(); assert(tasks().size() == 0 && vms().size() == 0); assert(emu_fs->size() == 0); } static void finish_emulated_syscall_with_ret(Task* t, long ret) { t->finish_emulated_syscall(); Registers r = t->regs(); r.set_syscall_result(ret); t->set_regs(r); } /** * Execute the syscall contained in |t|'s current register set. The * return value of the syscall is set for |t|'s registers, to be * returned to the tracee task. */ static void execute_syscall(Task* t) { t->finish_emulated_syscall(); AutoRemoteSyscalls remote(t); remote.syscall(remote.regs().original_syscallno(), remote.regs().arg1(), remote.regs().arg2(), remote.regs().arg3(), remote.regs().arg4(), remote.regs().arg5(), remote.regs().arg6()); remote.regs().set_syscall_result(t->regs().syscall_result()); } template static void process_syscall_arch(Task* t, int syscallno) { LOG(debug) << "Processing " << t->syscall_name(syscallno); if (syscallno == Arch::ioctl && t->is_desched_event_syscall()) { // The arm/disarm-desched ioctls are emulated as no-ops. // However, because the rr preload library expects these // syscalls to succeed and aborts if they don't, we fudge a // "0" return value. finish_emulated_syscall_with_ret(t, 0); return; } switch (syscallno) { // We blacklist these syscalls because the params include // namespaced identifiers that are different in replay than // recording, and during replay they may refer to different, // live resources. For example, if a recorded tracees kills // one of its threads, then during replay that killed pid // might refer to a live process outside the tracee tree. We // don't want diversion tracees randomly shooting down other // processes! // // We optimistically assume that filesystem operations were // intended by the user. // // There's a potential problem with "fd confusion": in the // diversion tasks, fds returned from open() during replay are // emulated. But those fds may accidentally refer to live fds // in the task fd table. So write()s etc may not be writing // to the file the tracee expects. However, the only real fds // that leak into tracees are the stdio fds, and there's not // much harm that can be caused by accidental writes to them. case Arch::ipc: case Arch::kill: case Arch::rt_sigqueueinfo: case Arch::rt_tgsigqueueinfo: case Arch::tgkill: case Arch::tkill: LOG(debug) << "Suppressing syscall " << syscall_name(syscallno, t->arch()); return; } LOG(debug) << "Executing syscall " << syscall_name(syscallno, t->arch()); return execute_syscall(t); } static void process_syscall(Task* t, int syscallno) { RR_ARCH_FUNCTION(process_syscall_arch, t->arch(), t, syscallno) } /** * Advance execution until either a signal is received (including a SIGTRAP * generated by a single-step) or a syscall is made. */ DiversionSession::DiversionResult DiversionSession::diversion_step( Task* t, RunCommand command, int signal_to_deliver) { assert(command != RUN_SINGLESTEP_FAST_FORWARD); assert_fully_initialized(); DiversionResult result; // An exit might have occurred while processing a previous syscall. if (t->ptrace_event() == PTRACE_EVENT_EXIT) { result.status = DIVERSION_EXITED; return result; } if (t->preload_globals) { // Disable syscall buffering during diversions t->write_mem(REMOTE_PTR_FIELD(t->preload_globals, in_diversion), (unsigned char)1); } switch (command) { case RUN_CONTINUE: LOG(debug) << "Continuing to next syscall"; t->resume_execution(RESUME_SYSEMU, RESUME_WAIT, RESUME_UNLIMITED_TICKS, signal_to_deliver); break; case RUN_SINGLESTEP: LOG(debug) << "Stepping to next insn/syscall"; t->resume_execution(RESUME_SYSEMU_SINGLESTEP, RESUME_WAIT, RESUME_UNLIMITED_TICKS, signal_to_deliver); break; default: FATAL() << "Illegal run command " << command; } if (t->ptrace_event() == PTRACE_EVENT_EXIT) { result.status = DIVERSION_EXITED; return result; } result.status = DIVERSION_CONTINUE; if (t->stop_sig()) { LOG(debug) << "Pending signal: " << t->get_siginfo(); result.break_status = diagnose_debugger_trap(t, command); LOG(debug) << "Diversion break at ip=" << (void*)t->ip().register_value() << "; break=" << result.break_status.breakpoint_hit << ", watch=" << !result.break_status.watchpoints_hit.empty() << ", singlestep=" << result.break_status.singlestep_complete; ASSERT(t, !result.break_status.singlestep_complete || command == RUN_SINGLESTEP); return result; } process_syscall(t, t->regs().original_syscallno()); check_for_watchpoint_changes(t, result.break_status); return result; } } // namespace rr rr-4.4.0/src/DiversionSession.h000066400000000000000000000036671277367620400164420ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_DIVERSION_SESSION_H_ #define RR_DIVERSION_SESSION_H_ #include "EmuFs.h" #include "Session.h" namespace rr { class ReplaySession; /** * A DiversionSession lets you run task(s) forward without replay. * Clone a ReplaySession to a DiversionSession to execute some arbitrary * code for its side effects. * * Diversion allows tracees to execute freely, as in "recorder" * mode, but doesn't attempt to record any data. Diverter * emulates the syscalls it's able to (such as writes to stdio fds), * and essentially ignores the syscalls it doesn't know how to * implement. Tracees can easily get into inconsistent states within * diversion mode, and no attempt is made to detect or rectify that. * * Diverter mode is designed to support short-lived diversions from * "replayer" sessions, as required to support gdb's |call foo()| * feature. A diversion is created for the call frame, then discarded * when the call finishes (loosely speaking). */ class DiversionSession : public Session { public: typedef std::shared_ptr shr_ptr; ~DiversionSession(); EmuFs& emufs() const { return *emu_fs; } enum DiversionStatus { // Some execution was done. diversion_step() can be called again. DIVERSION_CONTINUE, // All tracees are dead. diversion_step() should not be called again. DIVERSION_EXITED }; struct DiversionResult { DiversionStatus status; BreakStatus break_status; }; /** * Try make progress in this diversion session. Run task t if possible. */ DiversionResult diversion_step(Task* t, RunCommand command = RUN_CONTINUE, int signal_to_deliver = 0); virtual DiversionSession* as_diversion() { return this; } private: friend class ReplaySession; DiversionSession(); std::shared_ptr emu_fs; }; } // namespace rr #endif // RR_DIVERSION_SESSION_H_ rr-4.4.0/src/DumpCommand.cc000066400000000000000000000216431277367620400154700ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include #include #include #include "preload/preload_interface.h" #include "AddressSpace.h" #include "Command.h" #include "TraceStream.h" #include "kernel_metadata.h" #include "main.h" #include "util.h" using namespace std; namespace rr { class DumpCommand : public Command { public: virtual int run(vector& args); protected: DumpCommand(const char* name, const char* help) : Command(name, help) {} static DumpCommand singleton; }; DumpCommand DumpCommand::singleton( "dump", " rr dump [OPTIONS] [] [...]\n" " Event specs can be either an event number like `127', or a range\n" " like `1000-5000'. By default, all events are dumped.\n" " -b, --syscallbuf dump syscallbuf contents\n" " --g, --generic dump generic data\n" " -m, --recorded-metadata dump recorded data metadata\n" " -p, --mmaps dump mmap data\n" " -r, --raw dump trace frames in a more easily\n" " machine-parseable format instead of the\n" " default human-readable format\n" " -s, --statistics dump statistics about the trace\n"); struct DumpFlags { bool dump_syscallbuf; bool dump_generic; bool dump_recorded_data_metadata; bool dump_mmaps; bool raw_dump; bool dump_statistics; DumpFlags() : dump_syscallbuf(false), dump_generic(false), dump_recorded_data_metadata(false), dump_mmaps(false), raw_dump(false), dump_statistics(false) {} }; static bool parse_dump_arg(vector& args, DumpFlags& flags) { if (parse_global_option(args)) { return true; } static const OptionSpec options[] = { { 'b', "syscallbuf", NO_PARAMETER }, { 'g', "generic", NO_PARAMETER }, { 'm', "recorded-metadata", NO_PARAMETER }, { 'p', "mmaps", NO_PARAMETER }, { 'r', "raw", NO_PARAMETER }, { 's', "statistics", NO_PARAMETER } }; ParsedOption opt; if (!Command::parse_option(args, options, &opt)) { return false; } switch (opt.short_name) { case 'b': flags.dump_syscallbuf = true; break; case 'g': flags.dump_generic = true; break; case 'm': flags.dump_recorded_data_metadata = true; break; case 'p': flags.dump_mmaps = true; break; case 'r': flags.raw_dump = true; break; case 's': flags.dump_statistics = true; break; default: assert(0 && "Unknown option"); } return true; } static void dump_syscallbuf_data(TraceReader& trace, FILE* out, const TraceFrame& frame) { if (frame.event().type() != EV_SYSCALLBUF_FLUSH) { return; } auto buf = trace.read_raw_data(); size_t bytes_remaining = buf.data.size() - sizeof(struct syscallbuf_hdr); auto flush_hdr = reinterpret_cast(buf.data.data()); if (flush_hdr->num_rec_bytes > bytes_remaining) { fprintf(stderr, "Malformed trace file (bad recorded-bytes count)\n"); abort(); } bytes_remaining = flush_hdr->num_rec_bytes; auto record_ptr = reinterpret_cast(flush_hdr + 1); auto end_ptr = record_ptr + bytes_remaining; while (record_ptr < end_ptr) { auto record = reinterpret_cast(record_ptr); fprintf(out, " { syscall:'%s', ret:0x%lx, size:0x%lx }\n", syscall_name(record->syscallno, frame.event().arch()).c_str(), (long)record->ret, (long)record->size); if (record->size < sizeof(*record)) { fprintf(stderr, "Malformed trace file (bad record size)\n"); abort(); } record_ptr += stored_record_size(record->size); } } /** * Dump all events from the current to trace that match |spec| to * |out|. |spec| has the following syntax: /\d+(-\d+)?/, expressing * either a single event number of a range, and may be null to * indicate "dump all events". * * This function is side-effect-y, in that the trace file isn't * rewound in between matching each spec. Therefore specs should be * constructed so as to match properly on a serial linear scan; that * is, they should comprise disjoint and monotonically increasing * event sets. No attempt is made to enforce this or normalize specs. */ static void dump_events_matching(TraceReader& trace, const DumpFlags& flags, FILE* out, const string* spec) { uint32_t start = 0, end = numeric_limits::max(); // Try to parse the "range" syntax '[start]-[end]'. if (spec && 2 > sscanf(spec->c_str(), "%u-%u", &start, &end)) { // Fall back on assuming the spec is a single event // number, however it parses out with atoi(). start = end = atoi(spec->c_str()); } bool process_raw_data = flags.dump_syscallbuf || flags.dump_recorded_data_metadata; while (!trace.at_end()) { auto frame = trace.read_frame(); if (end < frame.time()) { return; } if (start <= frame.time() && frame.time() <= end) { if (flags.raw_dump) { frame.dump_raw(out); } else { frame.dump(out); } if (flags.dump_syscallbuf) { dump_syscallbuf_data(trace, out, frame); } while (true) { TraceReader::MappedData data; bool found; KernelMapping km = trace.read_mapped_region(&data, &found, TraceReader::DONT_VALIDATE); if (!found) { break; } if (flags.dump_mmaps) { char prot_flags[] = "rwxp"; if (!(km.prot() & PROT_READ)) { prot_flags[0] = '-'; } if (!(km.prot() & PROT_WRITE)) { prot_flags[1] = '-'; } if (!(km.prot() & PROT_EXEC)) { prot_flags[2] = '-'; } if (km.flags() & MAP_SHARED) { prot_flags[3] = 's'; } const char* fsname = km.fsname().c_str(); if (data.source == TraceReader::SOURCE_ZERO) { const char source_zero[] = ""; fsname = source_zero; } fprintf(out, " { map_file:\"%s\", addr:%p, length:%p, " "prot_flags:\"%s\", file_offset:0x%llx, " "data_file:\"%s\", data_offset:0x%llx, " "file_size:0x%llx }\n", fsname, (void*)km.start().as_int(), (void*)km.size(), prot_flags, (long long)km.file_offset_bytes(), data.file_name.c_str(), (long long)data.data_offset_bytes, (long long)data.file_size_bytes); } } TraceReader::RawData data; while (process_raw_data && trace.read_raw_data_for_frame(frame, data)) { if (flags.dump_recorded_data_metadata) { fprintf(out, " { tid:%d, addr:%p, length:%p }\n", data.rec_tid, (void*)data.addr.as_int(), (void*)data.data.size()); } } vector buf; while (flags.dump_generic && trace.read_generic_for_frame(frame, buf)) { fprintf(out, " { length:%p }\n", (void*)buf.size()); } if (!flags.raw_dump) { fprintf(out, "}\n"); } } else { TraceReader::RawData data; while (process_raw_data && trace.read_raw_data_for_frame(frame, data)) { } while (true) { TraceReader::MappedData data; KernelMapping km = trace.read_mapped_region(&data, nullptr, TraceReader::DONT_VALIDATE); if (km.size() == 0) { break; } } } } } static void dump_statistics(const TraceReader& trace, FILE* out) { uint64_t uncompressed = trace.uncompressed_bytes(); uint64_t compressed = trace.compressed_bytes(); fprintf(out, "// Uncompressed bytes %" PRIu64 ", compressed bytes %" PRIu64 ", ratio %.2fx\n", uncompressed, compressed, double(uncompressed) / compressed); } static void dump(const string& trace_dir, const DumpFlags& flags, const vector& specs, FILE* out) { TraceReader trace(trace_dir); if (flags.raw_dump) { fprintf(out, "global_time tid reason ticks " "hw_interrupts page_faults instructions " "eax ebx ecx edx esi edi ebp orig_eax esp eip eflags\n"); } if (specs.size() > 0) { for (size_t i = 0; i < specs.size(); ++i) { dump_events_matching(trace, flags, stdout, &specs[i]); } } else { // No specs => dump all events. dump_events_matching(trace, flags, stdout, nullptr /*all events*/); } if (flags.dump_statistics) { dump_statistics(trace, stdout); } } int DumpCommand::run(vector& args) { DumpFlags flags; while (parse_dump_arg(args, flags)) { } string trace_dir; if (!parse_optional_trace_dir(args, &trace_dir)) { print_help(stderr); return 1; } dump(trace_dir, flags, args, stdout); return 0; } } // namespace rr rr-4.4.0/src/ElfReader.cc000066400000000000000000000172451277367620400151200ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ElfReader.h" #include #include "log.h" using namespace std; namespace rr { class ElfReaderImplBase { public: ElfReaderImplBase(ElfReader& r) : r(r), ok_(false) {} virtual ~ElfReaderImplBase() {} virtual SymbolTable read_symbols(const char* symtab, const char* strtab) = 0; virtual DynamicSection read_dynamic() = 0; bool ok() { return ok_; } protected: ElfReader& r; bool ok_; }; template class ElfReaderImpl : public ElfReaderImplBase { public: ElfReaderImpl(ElfReader& r); virtual SymbolTable read_symbols(const char* symtab, const char* strtab); virtual DynamicSection read_dynamic(); private: const typename Arch::ElfShdr* find_section(const char* n); typename Arch::ElfEhdr elfheader; vector sections; vector section_names; }; template unique_ptr elf_reader_impl_arch(ElfReader& r) { return unique_ptr(new ElfReaderImpl(r)); } unique_ptr elf_reader_impl(ElfReader& r, SupportedArch arch) { RR_ARCH_FUNCTION(elf_reader_impl_arch, arch, r); } template ElfReaderImpl::ElfReaderImpl(ElfReader& r) : ElfReaderImplBase(r) { if (!r.read(0, elfheader) || memcmp(&elfheader, ELFMAG, SELFMAG) != 0 || elfheader.e_ident[EI_CLASS] != Arch::elfclass || elfheader.e_ident[EI_DATA] != Arch::elfendian || elfheader.e_machine != Arch::elfmachine || elfheader.e_shentsize != sizeof(typename Arch::ElfShdr) || elfheader.e_shstrndx >= elfheader.e_shnum) { LOG(debug) << "Invalid ELF file: invalid header"; return; } sections = r.read(elfheader.e_shoff, elfheader.e_shnum); if (sections.empty()) { LOG(debug) << "Invalid ELF file: no sections"; return; } auto& section_names_section = sections[elfheader.e_shstrndx]; section_names = r.read(section_names_section.sh_offset, section_names_section.sh_size); if (section_names.empty()) { LOG(debug) << "Invalid ELF file: can't read section names"; return; } section_names[section_names.size() - 1] = 0; ok_ = true; } template const typename Arch::ElfShdr* ElfReaderImpl::find_section(const char* n) { typename Arch::ElfShdr* section = nullptr; for (size_t i = 0; i < elfheader.e_shnum; ++i) { auto& s = sections[i]; if (s.sh_name >= section_names.size()) { LOG(debug) << "Invalid ELF file: invalid name offset for section " << i; continue; } const char* name = section_names.data() + s.sh_name; if (strcmp(name, n) == 0) { if (section) { LOG(debug) << "Invalid ELF file: duplicate symbol section " << n; return nullptr; } section = &s; } } if (!section) { LOG(debug) << "Missing section " << n; } return section; } template SymbolTable ElfReaderImpl::read_symbols(const char* symtab, const char* strtab) { SymbolTable result; if (!ok()) { return result; } const typename Arch::ElfShdr* symbols = find_section(symtab); if (!symbols) { return result; } const typename Arch::ElfShdr* strings = find_section(strtab); if (!strtab) { return result; } if (symbols->sh_entsize != sizeof(typename Arch::ElfSym)) { LOG(debug) << "Invalid ELF file: incorrect symbol size " << symbols->sh_entsize; return result; } if (symbols->sh_size % symbols->sh_entsize) { LOG(debug) << "Invalid ELF file: incorrect symbol section size " << symbols->sh_size; return result; } if (strings->sh_size == 0) { LOG(debug) << "Invalid ELF file: empty string table"; return result; } auto symbol_list = r.read( symbols->sh_offset, symbols->sh_size / symbols->sh_entsize); if (symbol_list.empty()) { LOG(debug) << "Invalid ELF file: can't read symbols " << symtab; return result; } result.strtab = r.read(strings->sh_offset, strings->sh_size); if (result.strtab.empty()) { LOG(debug) << "Invalid ELF file: can't read strings " << strtab; } result.strtab[result.strtab.size() - 1] = 0; result.symbols.resize(symbol_list.size()); for (size_t i = 0; i < symbol_list.size(); ++i) { auto& s = symbol_list[i]; if (s.st_shndx >= sections.size()) { // Don't leave this entry uninitialized result.symbols[i] = SymbolTable::Symbol(0, 0); continue; } auto& section = sections[s.st_shndx]; result.symbols[i] = SymbolTable::Symbol( s.st_value - section.sh_addr + section.sh_offset, s.st_name); } return result; } template DynamicSection ElfReaderImpl::read_dynamic() { DynamicSection result; if (!ok()) { return result; } const typename Arch::ElfShdr* dynamic = find_section(".dynamic"); if (!dynamic) { return result; } const typename Arch::ElfShdr* dynstr = find_section(".dynstr"); if (!dynstr) { return result; } if (dynamic->sh_entsize != sizeof(typename Arch::ElfDyn)) { LOG(debug) << "Invalid ELF file: incorrect .dynamic size " << dynamic->sh_entsize; return result; } if (!dynamic->sh_size) { return result; } if (dynamic->sh_size % dynamic->sh_entsize) { LOG(debug) << "Invalid ELF file: incorrect .dynamic section size " << dynamic->sh_size; return result; } if (dynstr->sh_size == 0) { LOG(debug) << "Invalid ELF file: empty string table"; return result; } auto dyn_list = r.read( dynamic->sh_offset, dynamic->sh_size / dynamic->sh_entsize); if (dyn_list.empty()) { LOG(debug) << "Invalid ELF file: can't read .dynamic"; return result; } result.strtab = r.read(dynstr->sh_offset, dynstr->sh_size); if (result.strtab.empty()) { LOG(debug) << "Invalid ELF file: can't read .dynstr"; } result.strtab[result.strtab.size() - 1] = 0; result.entries.resize(dyn_list.size()); for (size_t i = 0; i < dyn_list.size(); ++i) { auto& s = dyn_list[i]; result.entries[i] = DynamicSection::Entry(s.d_tag, s.d_val); } return result; } ElfReader::ElfReader(SupportedArch arch) : arch(arch) {} ElfReader::~ElfReader() {} ElfReaderImplBase& ElfReader::impl() { if (!impl_) { impl_ = elf_reader_impl(*this, arch); } return *impl_; } SymbolTable ElfReader::read_symbols(const char* symtab, const char* strtab) { return impl().read_symbols(symtab, strtab); } DynamicSection ElfReader::read_dynamic() { return impl().read_dynamic(); } bool ElfReader::ok() { return impl().ok(); } static bool read_all(ScopedFd& fd, size_t offset, size_t size, void* buf) { while (size) { ssize_t ret = pread(fd.get(), buf, size, offset); if (ret <= 0) { return false; } offset += ret; size -= ret; buf = static_cast(buf) + ret; } return true; } bool ElfFileReader::read(size_t offset, size_t size, void* buf) { return read_all(fd, offset, size, buf); } SupportedArch ElfFileReader::identify_arch(ScopedFd& fd) { /** * This code is quite lax. That's OK because this is only used to create * a specific ElfReaderImpl, which does much more thorough checking of the * header. */ static const int header_prefix_size = 20; char buf[header_prefix_size]; if (!read_all(fd, 0, sizeof(buf), buf) || buf[5] != 1) { return NativeArch::arch(); } switch (buf[18] | (buf[19] << 8)) { case 0x03: return x86; case 0x3e: return x86_64; default: return NativeArch::arch(); } } } // namespace rr rr-4.4.0/src/ElfReader.h000066400000000000000000000043561277367620400147610ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_ELF_READER_H_ #define RR_ELF_READER_H_ #include #include #include #include "ScopedFd.h" #include "kernel_abi.h" namespace rr { class ElfReaderImplBase; class SymbolTable { public: bool is_name(size_t i, const char* name) const { size_t offset = symbols[i].name_index; return offset < strtab.size() && strcmp(&strtab[offset], name) == 0; } uintptr_t file_offset(size_t i) const { return symbols[i].file_offset; } size_t size() const { return symbols.size(); } struct Symbol { Symbol(uintptr_t file_offset, size_t name_index) : file_offset(file_offset), name_index(name_index) {} Symbol() {} uintptr_t file_offset; size_t name_index; }; std::vector symbols; // Last character is always null std::vector strtab; }; class DynamicSection { public: struct Entry { public: Entry(uint64_t tag, uint64_t val) : tag(tag), val(val) {} Entry() {} uint64_t tag; uint64_t val; }; std::vector entries; // Last character is always null std::vector strtab; }; class ElfReader { public: ElfReader(SupportedArch arch); virtual ~ElfReader(); virtual bool read(size_t offset, size_t size, void* buf) = 0; template bool read(size_t offset, T& result) { return read(offset, sizeof(result), &result); } template std::vector read(size_t offset, size_t count) { std::vector result; result.resize(count); if (!read(offset, sizeof(T) * count, result.data())) { result.clear(); } return result; } bool ok(); SymbolTable read_symbols(const char* symtab, const char* strtab); DynamicSection read_dynamic(); private: ElfReaderImplBase& impl(); std::unique_ptr impl_; SupportedArch arch; }; class ElfFileReader : public ElfReader { public: ElfFileReader(ScopedFd& fd, SupportedArch arch) : ElfReader(arch), fd(fd) {} ElfFileReader(ScopedFd& fd) : ElfReader(identify_arch(fd)), fd(fd) {} virtual bool read(size_t offset, size_t size, void* buf); ScopedFd& fd; static SupportedArch identify_arch(ScopedFd& fd); }; } // namespace rr #endif /* RR_ELF_READER_H_ */ rr-4.4.0/src/EmuFs.cc000066400000000000000000000113761277367620400143050ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "EmuFs.h" #include #include #include #include #include "AddressSpace.h" #include "ReplaySession.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" using namespace std; namespace rr { static void replace_char(string& s, char c, char replacement) { size_t i; while (string::npos != (i = s.find(c))) { s[i] = replacement; } } EmuFile::~EmuFile() { LOG(debug) << " EmuFs::~File(einode:" << inode_ << ")"; owner.destroyed_file(*this); } EmuFile::shr_ptr EmuFile::clone(EmuFs& owner) { auto f = EmuFile::create(owner, orig_path.c_str(), device(), inode(), size_); uint64_t data[65536 / sizeof(uint64_t)]; uint64_t offset = 0; while (offset < size_) { ssize_t amount = min(size_ - offset, sizeof(data)); ssize_t ret = pread64(fd(), data, amount, offset); if (ret <= 0) { FATAL() << "Couldn't read all the data"; } // There could have been a short read amount = ret; uint8_t* data_ptr = reinterpret_cast(data); while (amount > 0) { ret = pwrite64(f->fd(), data_ptr, amount, offset); if (ret <= 0) { FATAL() << "Couldn't write all the data"; } amount -= ret; data_ptr += ret; offset += ret; } } return f; } string EmuFile::proc_path() const { stringstream ss; ss << "/proc/" << getpid() << "/fd/" << fd().get(); return ss.str(); } void EmuFile::update(dev_t device, ino_t inode, uint64_t size) { assert(device_ == device && inode_ == inode); if (size_ != size) { resize_shmem_segment(file, size); } size_ = size; } void EmuFile::ensure_size(uint64_t size) { if (size_ < size) { resize_shmem_segment(file, size); size_ = size; } } /*static*/ EmuFile::shr_ptr EmuFile::create(EmuFs& owner, const string& orig_path, dev_t orig_device, ino_t orig_inode, uint64_t orig_file_size) { // Sanitize the mapped file path so that we can use it in a // leaf name. string path_tag(orig_path); replace_char(path_tag, '/', '\\'); stringstream name; name << SHMEM_FS << "/rr-emufs-" << getpid() << "-dev-" << orig_device << "-inode-" << orig_inode << "-" << path_tag; string real_name = name.str().substr(0, 255); ScopedFd fd = open(real_name.c_str(), O_CREAT | O_EXCL | O_RDWR | O_CLOEXEC, 0600); if (!fd.is_open()) { FATAL() << "Failed to create shmem segment " << real_name; } /* Remove the fs name so that we don't have to worry about * cleaning up this segment in error conditions. */ unlink(real_name.c_str()); resize_shmem_segment(fd, orig_file_size); shr_ptr f(new EmuFile(owner, std::move(fd), orig_path, real_name, orig_device, orig_inode, orig_file_size)); LOG(debug) << "created emulated file for " << orig_path << " as " << name.str(); return f; } EmuFile::EmuFile(EmuFs& owner, ScopedFd&& fd, const string& orig_path, const string& real_path, dev_t orig_device, ino_t orig_inode, uint64_t orig_file_size) : orig_path(orig_path), tmp_path(real_path), file(std::move(fd)), owner(owner), size_(orig_file_size), device_(orig_device), inode_(orig_inode) {} EmuFile::shr_ptr EmuFs::at(const KernelMapping& recorded_map) const { return files.at(FileId(recorded_map)).lock(); } bool EmuFs::has_file_for(const KernelMapping& recorded_map) const { return files.find(FileId(recorded_map)) != files.end(); } EmuFile::shr_ptr EmuFs::clone_file(EmuFile::shr_ptr file) { assert(file); auto c = file->clone(*this); files[FileId(*file)] = c; return c; } EmuFile::shr_ptr EmuFs::get_or_create(const KernelMapping& recorded_km, uint64_t file_size) { FileId id(recorded_km); auto it = files.find(id); if (it != files.end()) { it->second.lock()->update(recorded_km.device(), recorded_km.inode(), file_size); return it->second.lock(); } auto vf = EmuFile::create(*this, recorded_km.fsname(), recorded_km.device(), recorded_km.inode(), file_size); files[id] = vf; return vf; } void EmuFs::log() const { LOG(error) << "EmuFs " << this << " with " << files.size() << " files:"; for (auto& kv : files) { auto file = kv.second.lock(); LOG(error) << " " << file->emu_path(); } } /*static*/ EmuFs::shr_ptr EmuFs::create() { return shr_ptr(new EmuFs()); } EmuFs::EmuFs() {} EmuFs::FileId::FileId(const KernelMapping& recorded_map) : device(recorded_map.device()), inode(recorded_map.inode()) {} } // namespace rr rr-4.4.0/src/EmuFs.h000066400000000000000000000127001277367620400141370ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_EMUFS_H_ #define RR_EMUFS_H_ #include #include #include #include #include "ScopedFd.h" namespace rr { class AddressSpace; class EmuFs; class KernelMapping; class ReplaySession; class Session; class Task; /** * Implement an "emulated file system" consisting of files that were * mmap'd shared during recording. These files require special * treatment because (i) they were most likely modified during * recording, so (ii) the original file contents only exist as * snapshots in the trace, but (iii) all mappings of the file must * point at the same underling resource, so that modifications are * seen by all mappees. * * The rr EmuFs creates "emulated files" in shared memory during * replay. Each efile is uniquely identified at a given event in the * trace by |(edev, einode)| (i.e., the recorded device ID and inode). * "What about inode recycling", you're probably thinking to yourself. * This scheme can cope with inode recycling, given a very important * assumption discussed below. * * Why is inode recycling not a problem? Assume that an mmap'd file * F_0 at trace time t_0 has the same (device, inode) ID as a * different file F_1 at trace time t_1. By definition, if the inode * ID was recycled in [t_0, t_1), then all references to F_0 must have * been dropped in that interval. A corollary of that is that all * memory mappings of F_0 must have been fully unmapped in the * interval. As per the first long comment in |gc()| below, an * emulated file can only be "live" during replay if some tracee still * has a mapping of it. Tracees' mappings of emulated files is a * subset of the ways they can create references to real files during * recording. Therefore the event during replay that drops the last * reference to the emulated F_0 must be a tracee unmapping of F_0. * * So as long as we GC emulated F_0 at the event of its fatal * unmapping, the lifetimes of emulated F_0 and emulated F_1 must be * disjoint. And F_0 being GC'd at that point is the important * assumption mentioned above. */ /** * A file within an EmuFs. The file is real, but it's mapped to file * ID that was recorded during replay. */ class EmuFile { public: typedef std::shared_ptr shr_ptr; ~EmuFile(); /** * Return the fd of the real file backing this. */ const ScopedFd& fd() const { return file; } /** * Return a pathname referring to the fd of this in this * tracer's address space. For example, "/proc/12345/fd/5". */ std::string proc_path() const; /** * Return the path of the original file from recording, the * one this is emulating. */ const std::string emu_path() const { return orig_path; } const std::string real_path() const { return tmp_path; } dev_t device() const { return device_; } ino_t inode() const { return inode_; } void ensure_size(uint64_t size); private: friend class EmuFs; EmuFile(EmuFs& owner, ScopedFd&& fd, const std::string& orig_path, const std::string& real_path, dev_t device, ino_t inode, uint64_t file_size); /** * Return a copy of this file. See |create()| for the meaning * of |fs_tag|. */ shr_ptr clone(EmuFs& owner); /** * Ensure that the emulated file is sized to match a later * stat() of it. */ void update(dev_t device, ino_t inode, uint64_t size); /** * Create a new emulated file for |orig_path| that will * emulate the recorded attributes |est|. |tag| is used to * uniquely identify this file among multiple EmuFs's that * might exist concurrently in this tracer process. */ static shr_ptr create(EmuFs& owner, const std::string& orig_path, dev_t orig_device, ino_t orig_inode, uint64_t orig_file_size); std::string orig_path; std::string tmp_path; ScopedFd file; EmuFs& owner; uint64_t size_; dev_t device_; ino_t inode_; EmuFile(const EmuFile&) = delete; EmuFile operator=(const EmuFile&) = delete; }; class EmuFs { public: typedef std::shared_ptr shr_ptr; /** * Return the EmuFile for |recorded_map|, which must exist or this won't * return. */ EmuFile::shr_ptr at(const KernelMapping& recorded_map) const; bool has_file_for(const KernelMapping& recorded_map) const; EmuFile::shr_ptr clone_file(EmuFile::shr_ptr emu_file); /** * Return an emulated file representing the recorded shared mapping * |recorded_km|. */ EmuFile::shr_ptr get_or_create(const KernelMapping& recorded_km, uint64_t file_size); /** * Dump information about this emufs to the "error" log. */ void log() const; size_t size() const { return files.size(); } /** Create and return a new emufs. */ static shr_ptr create(); void destroyed_file(EmuFile& emu_file) { files.erase(FileId(emu_file)); } private: EmuFs(); struct FileId { FileId(const KernelMapping& recorded_map); FileId(const EmuFile& emu_file) : device(emu_file.device()), inode(emu_file.inode()) {} bool operator<(const FileId& other) const { return device < other.device || (device == other.device && inode < other.inode); } dev_t device; ino_t inode; }; typedef std::map> FileMap; FileMap files; EmuFs(const EmuFs&) = delete; EmuFs& operator=(const EmuFs&) = delete; }; } // namespace rr #endif // RR_EMUFS_H rr-4.4.0/src/Event.cc000066400000000000000000000200561277367620400143420ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Event.h" #include #include #include #include "preload/preload_interface.h" #include "Task.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" using namespace std; namespace rr { Event::Event(EncodedEvent e) { switch (event_type = e.type) { case EV_SEGV_RDTSC: case EV_EXIT: case EV_SCHED: case EV_SYSCALLBUF_FLUSH: case EV_SYSCALLBUF_ABORT_COMMIT: case EV_SYSCALLBUF_RESET: case EV_PATCH_SYSCALL: case EV_GROW_MAP: case EV_TRACE_TERMINATION: case EV_UNSTABLE_EXIT: case EV_INTERRUPTED_SYSCALL_NOT_RESTARTED: case EV_EXIT_SIGHANDLER: new (&Base()) BaseEvent(e.has_exec_info, e.arch()); // No auxiliary data. assert(0 == e.data); return; case EV_DESCHED: new (&Desched()) DeschedEvent(nullptr, e.arch()); return; case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: new (&Signal()) SignalEvent( ~DET_SIGNAL_BIT & e.data, (DET_SIGNAL_BIT & e.data) ? DETERMINISTIC_SIG : NONDETERMINISTIC_SIG, e.arch()); return; case EV_SYSCALL: new (&Syscall()) SyscallEvent(e.data >> 3, e.arch()); Syscall().state = SyscallState((e.data & 0x3) + 1); Syscall().failed_during_preparation = (e.data & 0x4) != 0; return; default: FATAL() << "Unexpected event " << *this; } } Event::Event(const Event& o) : event_type(o.event_type) { switch (event_type) { case EV_DESCHED: new (&Desched()) DeschedEvent(o.Desched()); return; case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: new (&Signal()) SignalEvent(o.Signal()); return; case EV_SYSCALL: case EV_SYSCALL_INTERRUPTION: new (&Syscall()) SyscallEvent(o.Syscall()); return; default: new (&Base()) BaseEvent(o.Base()); return; } } Event::~Event() { switch (event_type) { case EV_DESCHED: Desched().~DeschedEvent(); return; case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: Signal().~SignalEvent(); return; case EV_SYSCALL: case EV_SYSCALL_INTERRUPTION: Syscall().~SyscallEvent(); return; default: Base().~BaseEvent(); return; } } Event& Event::operator=(const Event& o) { event_type = o.event_type; switch (event_type) { case EV_DESCHED: Desched().operator=(o.Desched()); break; case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: Signal().operator=(o.Signal()); break; case EV_SYSCALL: case EV_SYSCALL_INTERRUPTION: Syscall().operator=(o.Syscall()); break; default: Base().operator=(o.Base()); break; } return *this; } static void set_encoded_event_data(EncodedEvent* e, int data) { e->data = data; // Ensure that e->data is wide enough for the data assert(e->data == data); } EncodedEvent Event::encode() const { EncodedEvent e; e.type = event_type; e.has_exec_info = has_exec_info(); e.arch_ = arch(); switch (event_type) { case EV_SEGV_RDTSC: case EV_EXIT: case EV_SCHED: case EV_SYSCALLBUF_FLUSH: case EV_SYSCALLBUF_ABORT_COMMIT: case EV_SYSCALLBUF_RESET: case EV_PATCH_SYSCALL: case EV_GROW_MAP: case EV_TRACE_TERMINATION: case EV_UNSTABLE_EXIT: case EV_INTERRUPTED_SYSCALL_NOT_RESTARTED: case EV_EXIT_SIGHANDLER: // No auxiliary data. set_encoded_event_data(&e, 0); return e; case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: { set_encoded_event_data( &e, Signal().siginfo.si_signo | (Signal().deterministic == DETERMINISTIC_SIG ? DET_SIGNAL_BIT : 0)); return e; } case EV_SYSCALL: { // PROCESSING_SYSCALL is a transient state that we // should never attempt to record. assert(Syscall().state != PROCESSING_SYSCALL && Syscall().state != NO_SYSCALL); int data = (Syscall().is_restart ? syscall_number_for_restart_syscall(e.arch_) : Syscall().number) << 3; data |= (int)Syscall().state - 1; if (Syscall().failed_during_preparation) { data |= 0x4; } set_encoded_event_data(&e, data); return e; } default: FATAL() << "Unknown event type " << event_type; return e; // not reached } } HasExecInfo Event::record_exec_info() const { return Base().has_exec_info; } bool Event::has_ticks_slop() const { switch (type()) { case EV_SYSCALLBUF_ABORT_COMMIT: case EV_SYSCALLBUF_FLUSH: case EV_SYSCALLBUF_RESET: case EV_INTERRUPTED_SYSCALL_NOT_RESTARTED: case EV_DESCHED: case EV_GROW_MAP: return true; default: return false; } } bool Event::is_signal_event() const { switch (event_type) { case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: return true; default: return false; } } bool Event::is_syscall_event() const { switch (event_type) { case EV_SYSCALL: case EV_SYSCALL_INTERRUPTION: return true; default: return false; } } void Event::log() const { LOG(info) << *this; } string Event::str() const { stringstream ss; ss << type_name(); switch (event_type) { case EV_SIGNAL: case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: ss << ": " << signal_name(Signal().siginfo.si_signo) << "(" << (const char*)(Signal().deterministic == DETERMINISTIC_SIG ? "det" : "async") << ")"; break; case EV_SYSCALL: case EV_SYSCALL_INTERRUPTION: ss << ": " << syscall_name(Syscall().number, Syscall().regs.arch()); break; default: // No auxiliary information. break; } return ss.str(); } void Event::transform(EventType new_type) { switch (event_type) { case EV_SIGNAL: assert(EV_SIGNAL_DELIVERY == new_type); break; case EV_SIGNAL_DELIVERY: assert(EV_SIGNAL_HANDLER == new_type); break; case EV_SYSCALL: assert(EV_SYSCALL_INTERRUPTION == new_type); break; case EV_SYSCALL_INTERRUPTION: assert(EV_SYSCALL == new_type); break; default: FATAL() << "Can't transform immutable " << *this << " into " << new_type; } event_type = new_type; } std::string Event::type_name() const { switch (event_type) { case EV_SENTINEL: return "(none)"; #define CASE(_t) \ case EV_##_t: \ return #_t CASE(EXIT); CASE(EXIT_SIGHANDLER); CASE(INTERRUPTED_SYSCALL_NOT_RESTARTED); CASE(NOOP); CASE(SCHED); CASE(SEGV_RDTSC); CASE(SYSCALLBUF_FLUSH); CASE(SYSCALLBUF_ABORT_COMMIT); CASE(SYSCALLBUF_RESET); CASE(PATCH_SYSCALL); CASE(GROW_MAP); CASE(UNSTABLE_EXIT); CASE(DESCHED); CASE(SIGNAL); CASE(SIGNAL_DELIVERY); CASE(SIGNAL_HANDLER); CASE(SYSCALL); CASE(SYSCALL_INTERRUPTION); CASE(TRACE_TERMINATION); #undef CASE default: FATAL() << "Unknown event type " << event_type; return nullptr; // not reached } } SignalEvent::SignalEvent(const siginfo_t& siginfo, SignalDeterministic deterministic, Task* t) : BaseEvent(HAS_EXEC_INFO, t->arch()), siginfo(siginfo), deterministic(deterministic) {} const char* state_name(SyscallState state) { switch (state) { #define CASE(_id) \ case _id: \ return #_id CASE(NO_SYSCALL); CASE(ENTERING_SYSCALL_PTRACE); CASE(ENTERING_SYSCALL); CASE(PROCESSING_SYSCALL); CASE(EXITING_SYSCALL); #undef CASE default: return "???state"; } } } // namespace rr rr-4.4.0/src/Event.h000066400000000000000000000331341277367620400142050ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_EVENT_H_ #define RR_EVENT_H_ #include #include #include #include #include "Registers.h" #include "kernel_abi.h" struct syscallbuf_record; namespace rr { /** * Events serve two purposes: tracking Task state during recording, and * being stored in traces to guide replay. Some events are only used during * recording and are never actually stored in traces (and are thus irrelevant * to replay). */ enum EventType { EV_UNASSIGNED, EV_SENTINEL, // TODO: this is actually a pseudo-pseudosignal: it will never // appear in a trace, but is only used to communicate between // different parts of the recorder code that should be // refactored to not have to do that. EV_NOOP, EV_DESCHED, // Events present in traces: // No associated data. EV_EXIT, // Tracee exited its sighandler. We leave this breadcrumb so // that the popping of not-restarted syscall interruptions and // sigreturns is replayed in the same order. EV_EXIT_SIGHANDLER, // Pretty self-explanatory: recording detected that an // interrupted syscall wasn't restarted, so the interruption // record can be popped off the tracee's event stack. EV_INTERRUPTED_SYSCALL_NOT_RESTARTED, // Scheduling signal interrupted the trace. EV_SCHED, EV_SEGV_RDTSC, // Recorded syscallbuf data for one or more buffered syscalls. EV_SYSCALLBUF_FLUSH, EV_SYSCALLBUF_ABORT_COMMIT, // The syscallbuf was reset to the empty state. We record this event // later than it really happens, because during replay we must proceed to // the event *after* a syscallbuf flush and then reset the syscallbuf, // to ensure we don't reset it while preload code is still using the data. EV_SYSCALLBUF_RESET, // Syscall was entered, the syscall instruction was patched, and the // syscall was aborted. Resume execution at the patch. EV_PATCH_SYSCALL, // Map memory pages due to a (future) memory access. This is associated // with a mmap entry for the new pages. EV_GROW_MAP, // The trace was terminated before all tasks exited, most // likely because the recorder was sent a terminating signal. // There are no more trace frames coming, so the best thing to // do is probably to shut down. EV_TRACE_TERMINATION, // Like USR_EXIT, but recorded when the task is in an // "unstable" state in which we're not sure we can // synchronously wait for it to "really finish". EV_UNSTABLE_EXIT, // Use .signal. EV_SIGNAL, EV_SIGNAL_DELIVERY, EV_SIGNAL_HANDLER, // Use .syscall. EV_SYSCALL, EV_SYSCALL_INTERRUPTION, EV_LAST }; enum HasExecInfo { NO_EXEC_INFO, HAS_EXEC_INFO }; /** * An encoding of the relevant bits of |struct event| that can be * cheaply and easily serialized. */ union EncodedEvent { struct { EventType type : 5; HasExecInfo has_exec_info : 1; SupportedArch arch_ : 1; int data : 25; }; int encoded; bool operator==(const EncodedEvent& other) const { return encoded == other.encoded; } bool operator!=(const EncodedEvent& other) const { return !(*this == other); } SupportedArch arch() const { return arch_; } }; static_assert(sizeof(int) == sizeof(EncodedEvent), "Bit fields are messed up"); static_assert(EV_LAST < (1 << 5), "Allocate more bits to the |type| field"); /** * Events are interesting occurrences during tracee execution which * are relevant for replay. Most events correspond to tracee * execution, but some (a subset of "pseudosigs") save actions that * the *recorder* took on behalf of the tracee. */ struct BaseEvent { /** * Pass |HAS_EXEC_INFO| if the event is at a stable execution * point that we'll reach during replay too. */ BaseEvent(HasExecInfo has_exec_info, SupportedArch arch) : has_exec_info(has_exec_info), arch_(arch) {} SupportedArch arch() const { return arch_; } // When replaying an event is expected to leave the tracee in // the same execution state as during replay, the event has // meaningful execution info, and it should be recorded for // checking. But some pseudosigs aren't recorded in the same // tracee state they'll be replayed, so the tracee exeuction // state isn't meaningful. HasExecInfo has_exec_info; SupportedArch arch_; }; /** * Desched events track the fact that a tracee's desched-event * notification fired during a may-block buffered syscall, which rr * interprets as the syscall actually blocking (for a potentially * unbounded amount of time). After the syscall exits, rr advances * the tracee to where the desched is "disarmed" by the tracee. */ struct DeschedEvent : public BaseEvent { /** Desched of |rec|. */ DeschedEvent(remote_ptr rec, SupportedArch arch) : BaseEvent(NO_EXEC_INFO, arch), rec(rec) {} // Record of the syscall that was interrupted by a desched // notification. It's legal to reference this memory /while // the desched is being processed only/, because |t| is in the // middle of a desched, which means it's successfully // allocated (but not yet committed) this syscall record. remote_ptr rec; }; /** * Signal events track signals through the delivery phase, and if the * signal finds a sighandler, on to the end of the handling face. */ enum SignalDeterministic { NONDETERMINISTIC_SIG = 0, DETERMINISTIC_SIG = 1 }; struct SignalEvent : public BaseEvent { /** * Signal |signo| is the signum, and |deterministic| is true * for deterministically-delivered signals (see * record_signal.cc). */ SignalEvent(const siginfo_t& siginfo, SignalDeterministic deterministic, Task* t); SignalEvent(int signo, SignalDeterministic deterministic, SupportedArch arch) : BaseEvent(HAS_EXEC_INFO, arch), deterministic(deterministic) { memset(&siginfo, 0, sizeof(siginfo)); siginfo.si_signo = signo; } /** * For SIGILL, SIGFPE, SIGSEGV, SIGBUS and SIGTRAP this is si_addr. * For other signals this is zero. */ uint64_t signal_data() const { switch (siginfo.si_signo) { case SIGILL: case SIGFPE: case SIGSEGV: case SIGBUS: case SIGTRAP: return (uint64_t)siginfo.si_addr; default: return 0; } } void set_signal_data(uint64_t data) { switch (siginfo.si_signo) { case SIGILL: case SIGFPE: case SIGSEGV: case SIGBUS: case SIGTRAP: siginfo.si_addr = (void*)data; break; } } // Signal info siginfo_t siginfo; // True if this signal will be deterministically raised as the // side effect of retiring an instruction during replay, for // example |load $r 0x0| deterministically raises SIGSEGV. SignalDeterministic deterministic; }; /** * Syscall events track syscalls through entry into the kernel, * processing in the kernel, and exit from the kernel. * * This also models interrupted syscalls. During recording, only * descheduled buffered syscalls /push/ syscall interruptions; all * others are detected at exit time and transformed into syscall * interruptions from the original, normal syscalls. * * Normal system calls (interrupted or not) record two events: ENTERING_SYSCALL * and EXITING_SYSCALL. If the process exits before the syscall exit (because * this is an exit/exit_group syscall or the process gets SIGKILL), there's no * syscall exit event. * * When PTRACE_SYSCALL is used, there will be three events: * ENTERING_SYSCALL_PTRACE to run the process until it gets into the kernel, * then ENTERING_SYSCALL and EXITING_SYSCALL. We need three events to handle * PTRACE_SYSCALL with clone/fork/vfork and execve. The tracee must run to * the ENTERING_SYSCALL_PTRACE state, allow a context switch so the ptracer * can modify tracee registers, then perform ENTERING_SYSCALL (which actually * creates the new task or does the exec), allow a context switch so the * ptracer can modify the new task or post-exec state in a PTRACE_EVENT_EXEC/ * CLONE/FORK/VFORK, then perform EXITING_SYSCALL to get into the correct * post-syscall state. * * When PTRACE_SYSEMU is used, there will only be one event: an * ENTERING_SYSCALL_PTRACE. */ enum SyscallState { // Not present in trace. Just a dummy value. NO_SYSCALL, // Run to the given register state and enter the kernel but don't // perform any system call processing yet. ENTERING_SYSCALL_PTRACE, // Run to the given register state and enter the kernel, if not already // there due to a ENTERING_SYSCALL_PTRACE, and then perform the initial part // of the system call (any work required before issuing a during-system-call // ptrace event). ENTERING_SYSCALL, // Not present in trace. PROCESSING_SYSCALL, // Already in the kernel. Perform the final part of the system call and exit // with the recorded system call result. EXITING_SYSCALL }; struct SyscallEvent : public BaseEvent { /** Syscall |syscallno| is the syscall number. */ SyscallEvent(int syscallno, SupportedArch arch) : BaseEvent(HAS_EXEC_INFO, arch), regs(arch), desched_rec(nullptr), state(NO_SYSCALL), number(syscallno), is_restart(false), failed_during_preparation(false), in_sysemu(false) {} // The original (before scratch is set up) arguments to the // syscall passed by the tracee. These are used to detect // restarted syscalls. Registers regs; // If this is a descheduled buffered syscall, points at the // record for that syscall. remote_ptr desched_rec; SyscallState state; // Syscall number. int number; // True when this syscall was restarted after a signal interruption. bool is_restart; // True when this syscall failed during preparation. bool failed_during_preparation; // Syscall is being emulated via PTRACE_SYSEMU. bool in_sysemu; }; struct syscall_interruption_t { syscall_interruption_t(){}; }; static const syscall_interruption_t interrupted; /** * Sum type for all events (well, a C++ approximation thereof). An * Event always has a definted EventType. It can be down-casted to * one of the leaf types above iff the type tag is correct. */ struct Event { Event() : event_type(EV_UNASSIGNED) {} Event(EventType type, HasExecInfo info, SupportedArch arch) : event_type(type), base(info, arch) {} Event(const DeschedEvent& ev) : event_type(EV_DESCHED), desched(ev) {} Event(const SignalEvent& ev) : event_type(EV_SIGNAL), signal(ev) {} Event(const SyscallEvent& ev) : event_type(EV_SYSCALL), syscall(ev) {} Event(const syscall_interruption_t&, const SyscallEvent& ev) : event_type(EV_SYSCALL_INTERRUPTION), syscall(ev) {} /** * Re-construct this from an encoding created by * |Event::encode()|. */ Event(EncodedEvent e); Event(const Event& o); ~Event(); Event& operator=(const Event& o); // Events can always be cased to BaseEvent regardless of the // current concrete type, because all constituent types // inherit from BaseEvent. BaseEvent& Base() { return base; } const BaseEvent& Base() const { return base; } DeschedEvent& Desched() { assert(EV_DESCHED == event_type); return desched; } const DeschedEvent& Desched() const { assert(EV_DESCHED == event_type); return desched; } SignalEvent& Signal() { assert(is_signal_event()); return signal; } const SignalEvent& Signal() const { assert(is_signal_event()); return signal; } SyscallEvent& Syscall() { assert(is_syscall_event()); return syscall; } const SyscallEvent& Syscall() const { assert(is_syscall_event()); return syscall; } enum { // Deterministic signals are encoded as (signum | DET_SIGNAL_BIT). DET_SIGNAL_BIT = 0x80 }; /** * Return an encoding of this event that can be cheaply * serialized. The encoding is lossy. */ EncodedEvent encode() const; /** * Return true if a tracee at this event has meaningful * execution info (registers etc.) that rr should record. * "Meaningful" means that the same state will be seen when * reaching this event during replay. */ HasExecInfo record_exec_info() const; HasExecInfo has_exec_info() const { return base.has_exec_info; } bool has_ticks_slop() const; /** * Return true if this is one of the indicated type of events. */ bool is_signal_event() const; bool is_syscall_event() const; /** * Dump info about this to INFO log. * * Note: usually you want to use |LOG(info) << event;|. */ void log() const; /** Return a string describing this. */ std::string str() const; /** * Dynamically change the type of this. Only a small number * of type changes are allowed. */ void transform(EventType new_type); /** Return the current type of this. */ EventType type() const { return event_type; } /** Return the architecture associated with this. */ SupportedArch arch() const { return base.arch(); } /** Change the architecture for this event. */ void set_arch(SupportedArch a) { base.arch_ = a; } /** Return a string naming |ev|'s type. */ std::string type_name() const; /** Return an event of type EV_NOOP. */ static Event noop(SupportedArch arch) { return Event(EV_NOOP, NO_EXEC_INFO, arch); } private: EventType event_type; union { BaseEvent base; DeschedEvent desched; SignalEvent signal; SyscallEvent syscall; }; }; inline static std::ostream& operator<<(std::ostream& o, const Event& ev) { return o << ev.str(); } inline static std::ostream& operator<<(std::ostream& o, const EncodedEvent& ev) { return o << Event(ev); } const char* state_name(SyscallState state); } // namespace rr #endif // EVENT_H_ rr-4.4.0/src/ExtraRegisters.cc000066400000000000000000000264521277367620400162420ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ExtraRegisters.h" #include #include #include "log.h" #include "util.h" using namespace std; namespace rr { // This is the byte offset at which the ST0-7 register data begins // with an xsave (or fxsave) block. static const int st_regs_offset = 32; // NB: each STx register holds 10 bytes of actual data, but each // occupies 16 bytes of space within (f)xsave, presumably for // alignment purposes. static const int st_reg_space = 16; // Byte offset at which the XMM0-15 register data begins with (f)xsave. static const int xmm_regs_offset = 160; static const int xmm_reg_space = 16; static const uint8_t fxsave_387_ctrl_offsets[] = { // The Intel documentation says that the following layout is only valid in // 32-bit mode, or when fxsave is executed in 64-bit mode without an // appropriate REX prefix. The kernel seems to only use fxsave with the // REX prefix, so one would think these offsets would be different. But // GDB seems happy to use these offsets, so that's what we use too. 0, // DREG_64_FCTRL 2, // DREG_64_FSTAT 4, // DREG_64_FTAG 12, // DREG_64_FISEG 8, // DREG_64_FIOFF 20, // DREG_64_FOSEG 16, // DREG_64_FOOFF 6, // DREG_64_FOP }; struct RegData { int offset; int size; int xsave_feature_bit; RegData(int offset = -1, int size = 0) : offset(offset), size(size), xsave_feature_bit(-1) {} }; static bool reg_in_range(GdbRegister regno, GdbRegister low, GdbRegister high, int offset_base, int offset_stride, int size, RegData* out) { if (regno < low || regno > high) { return false; } out->offset = offset_base + offset_stride * (regno - low); out->size = size; return true; } static const int AVX_FEATURE = 2; static const size_t xsave_header_offset = 512; static const size_t xsave_header_size = 64; // This is always at 576 since AVX is always the first optional feature, // if present. static const size_t AVX_xsave_offset = 576; // Return the size and data location of register |regno|. // If we can't read the register, returns -1 in 'offset'. static RegData xsave_register_data(SupportedArch arch, GdbRegister regno) { // Check regno is in range, and if it's 32-bit then convert it to the // equivalent 64-bit register. switch (arch) { case x86: // Convert regno to the equivalent 64-bit version since the XSAVE layout // is compatible if (regno >= DREG_XMM0 && regno <= DREG_XMM7) { regno = (GdbRegister)(regno - DREG_XMM0 + DREG_64_XMM0); break; } if (regno >= DREG_YMM0H && regno <= DREG_YMM7H) { regno = (GdbRegister)(regno - DREG_YMM0H + DREG_64_YMM0H); break; } if (regno < DREG_FIRST_FXSAVE_REG || regno > DREG_LAST_FXSAVE_REG) { return RegData(); } if (regno == DREG_MXCSR) { regno = DREG_64_MXCSR; } else { regno = (GdbRegister)(regno - DREG_FIRST_FXSAVE_REG + DREG_64_FIRST_FXSAVE_REG); } break; case x86_64: break; default: assert(0 && "Unknown arch"); return RegData(); } RegData result; if (reg_in_range(regno, DREG_64_ST0, DREG_64_ST7, st_regs_offset, st_reg_space, 10, &result)) { return result; } if (reg_in_range(regno, DREG_64_XMM0, DREG_64_XMM15, xmm_regs_offset, xmm_reg_space, 16, &result)) { return result; } if (reg_in_range(regno, DREG_64_YMM0H, DREG_64_YMM15H, AVX_xsave_offset, 16, 16, &result)) { result.xsave_feature_bit = AVX_FEATURE; return result; } if (regno < DREG_64_FIRST_FXSAVE_REG || regno > DREG_64_LAST_FXSAVE_REG) { return RegData(); } if (regno == DREG_64_MXCSR) { return RegData(24, 4); } assert(regno >= DREG_64_FCTRL && regno <= DREG_64_FOP); // NB: most of these registers only occupy 2 bytes of space in // the (f)xsave region, but gdb's default x86 target // config expects us to send back 4 bytes of data for // each. return RegData(fxsave_387_ctrl_offsets[regno - DREG_64_FCTRL], 4); } static uint64_t xsave_features(const vector& data) { // If this is just FXSAVE(64) data then we we have no XSAVE header and no // XSAVE(64) features enabled. return data.size() < xsave_header_offset + xsave_header_size ? 0 : *reinterpret_cast(data.data() + xsave_header_offset); } size_t ExtraRegisters::read_register(uint8_t* buf, GdbRegister regno, bool* defined) const { if (format_ != XSAVE) { *defined = false; return 0; } auto reg_data = xsave_register_data(arch(), regno); if (reg_data.offset < 0 || empty()) { *defined = false; return reg_data.size; } assert(reg_data.size > 0); *defined = true; // Apparently before any AVX registers are used, the feature bit is not set // in the XSAVE data, so we'll just return 0 for them here. if (reg_data.xsave_feature_bit >= 0 && !(xsave_features(data_) & (1 << reg_data.xsave_feature_bit))) { memset(buf, 0, reg_data.size); } else { assert(size_t(reg_data.offset + reg_data.size) <= data_.size()); memcpy(buf, data_.data() + reg_data.offset, reg_data.size); } return reg_data.size; } void ExtraRegisters::validate(Task* t) { if (format_ != XSAVE) { return; } ASSERT(t, data_.size() >= 512); uint32_t offset = 512; if (data_.size() > offset) { ASSERT(t, data_.size() >= offset + 64); offset += 64; uint64_t features = xsave_features(data_); if (features & AVX_FEATURE) { ASSERT(t, data_.size() >= offset + 256); } } } static void print_reg(const ExtraRegisters& r, GdbRegister low, GdbRegister hi, const char* name, FILE* f) { uint8_t buf[128]; bool defined = false; size_t len = r.read_register(buf, low, &defined); assert(defined && len <= 64); if (hi != GdbRegister(0)) { size_t len2 = r.read_register(buf + len, hi, &defined); if (defined) { assert(len == len2); len += len2; } } char out[257]; bool printed_digit = false; char* p = out; for (int i = len - 1; i >= 0; --i) { if (!printed_digit && !buf[i] && i > 0) { continue; } p += sprintf(p, printed_digit ? "%02x" : "%x", buf[i]); printed_digit = true; } fprintf(f, "%s:0x%s", name, out); } static void print_regs(const ExtraRegisters& r, GdbRegister low, GdbRegister hi, int num_regs, const char* name_base, FILE* f) { for (int i = 0; i < num_regs; ++i) { char buf[80]; sprintf(buf, "%s%d", name_base, i); print_reg(r, (GdbRegister)(low + i), hi == GdbRegister(0) ? hi : (GdbRegister)(hi + i), buf, f); if (i < num_regs - 1) { fputc(' ', f); } } } void ExtraRegisters::print_register_file_compact(FILE* f) const { switch (arch_) { case x86: print_regs(*this, DREG_ST0, GdbRegister(0), 8, "st", f); print_regs(*this, DREG_XMM0, DREG_YMM0H, 8, "ymm", f); break; case x86_64: print_regs(*this, DREG_64_ST0, GdbRegister(0), 8, "st", f); print_regs(*this, DREG_64_XMM0, DREG_64_YMM0H, 16, "ymm", f); break; default: assert(0 && "Unknown arch"); break; } } static X86Arch::user_fpregs_struct convert_fxsave_to_x86_fpregs( const X86Arch::user_fpxregs_struct& buf) { X86Arch::user_fpregs_struct result; for (int i = 0; i < 8; ++i) { memcpy(reinterpret_cast(result.st_space) + i * 10, &buf.st_space[i * 4], 10); } result.cwd = buf.cwd | 0xffff0000; result.swd = buf.swd | 0xffff0000; // XXX Computing the correct twd is a pain. It probably doesn't matter to us // in practice. result.twd = 0; result.fip = buf.fip; result.fcs = buf.fcs; result.foo = buf.foo; result.fos = buf.fos; return result; } static void convert_x86_fpregs_to_fxsave(const X86Arch::user_fpregs_struct& buf, X86Arch::user_fpxregs_struct* result) { for (int i = 0; i < 8; ++i) { memcpy(&result->st_space[i * 4], reinterpret_cast(buf.st_space) + i * 10, 10); } result->cwd = buf.cwd; result->swd = buf.swd; // XXX Computing the correct twd is a pain. It probably doesn't matter to us // in practice. result->fip = buf.fip; result->fcs = buf.fcs; result->foo = buf.foo; result->fos = buf.fos; } template static vector to_vector(const T& v) { vector result; result.resize(sizeof(T)); memcpy(result.data(), &v, sizeof(T)); return result; } vector ExtraRegisters::get_user_fpregs_struct( SupportedArch arch) const { assert(format_ == XSAVE); switch (arch) { case x86: assert(data_.size() >= sizeof(X86Arch::user_fpxregs_struct)); return to_vector(convert_fxsave_to_x86_fpregs( *reinterpret_cast( data_.data()))); case x86_64: assert(data_.size() >= sizeof(X64Arch::user_fpregs_struct)); return to_vector( *reinterpret_cast(data_.data())); default: assert(0 && "Unknown arch"); return vector(); } } void ExtraRegisters::set_user_fpregs_struct(SupportedArch arch, void* data, size_t size) { assert(format_ == XSAVE); switch (arch) { case x86: assert(size >= sizeof(X86Arch::user_fpregs_struct)); assert(data_.size() >= sizeof(X86Arch::user_fpxregs_struct)); convert_x86_fpregs_to_fxsave( *static_cast(data), reinterpret_cast(data_.data())); return; case x86_64: assert(data_.size() >= sizeof(X64Arch::user_fpregs_struct)); assert(size >= sizeof(X64Arch::user_fpregs_struct)); memcpy(data_.data(), data, sizeof(X64Arch::user_fpregs_struct)); return; default: assert(0 && "Unknown arch"); } } X86Arch::user_fpxregs_struct ExtraRegisters::get_user_fpxregs_struct() const { assert(format_ == XSAVE); assert(arch_ == x86); assert(data_.size() >= sizeof(X86Arch::user_fpxregs_struct)); return *reinterpret_cast(data_.data()); } void ExtraRegisters::set_user_fpxregs_struct( const X86Arch::user_fpxregs_struct& regs) { assert(format_ == XSAVE); assert(arch_ == x86); assert(data_.size() >= sizeof(X86Arch::user_fpxregs_struct)); memcpy(data_.data(), ®s, sizeof(regs)); } static void set_word(SupportedArch arch, vector& v, GdbRegister r, int word) { RegData d = xsave_register_data(arch, r); assert(d.size == 4); assert(d.offset + d.size <= (int)v.size()); assert(-1 == d.xsave_feature_bit); *reinterpret_cast(v.data() + d.offset) = word; } void ExtraRegisters::reset() { assert(format_ == XSAVE); memset(data_.data(), 0, data_.size()); switch (arch()) { case x86_64: { set_word(arch(), data_, DREG_64_MXCSR, 0x1f80); set_word(arch(), data_, DREG_64_FCTRL, 0x37f); break; } case x86: { set_word(arch(), data_, DREG_MXCSR, 0x1f80); set_word(arch(), data_, DREG_FCTRL, 0x37f); break; } default: assert(0 && "Unknown arch"); break; } } } // namespace rr rr-4.4.0/src/ExtraRegisters.h000066400000000000000000000071751277367620400161050ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_EXTRA_REGISTERS_H_ #define RR_EXTRA_REGISTERS_H_ #include #include #include #include "GdbRegister.h" #include "kernel_abi.h" namespace rr { /** * An ExtraRegisters object contains values for all user-space-visible * registers other than those in Registers. * * Task is responsible for creating meaningful values of this class. * * The only reason this class has an arch() is to enable us to * interpret GdbRegister. */ class ExtraRegisters { public: // Create empty (uninitialized/unknown registers) value ExtraRegisters(SupportedArch arch = SupportedArch(-1)) : format_(NONE), arch_(arch) {} /** * On a x86 64-bit kernel, these structures are initialized by an XSAVE64 or * FXSAVE64. * On a x86 32-bit kernel, they are initialized by an XSAVE or FXSAVE. * * The layouts are basically the same in the first 512 bytes --- an * FXSAVE(64) area. The differences are: * -- On a 64-bit kernel, registers XMM8-XMM15 are saved, but on a 32-bit * kernel they are not (that space is reserved). * -- On a 64-bit kernel, bytes 8-15 store a 64-bit "FPU IP" address, * but on a 32-bit kernel they store "FPU IP/CS". Likewise, * bytes 16-23 store "FPU DP" or "FPU DP/DS". * We basically ignore these differences. If gdb requests 32-bit-specific * registers, we return them, assuming that the data there is valid. * * XSAVE/XSAVE64 have extra information after the first 512 bytes, which we * currently save and restore but do not otherwise use. If the data record * has more than 512 bytes then it's an XSAVE(64) area, otherwise it's just * the FXSAVE(64) area. */ enum Format { NONE, XSAVE }; // Set values from raw data void set_to_raw_data(SupportedArch a, Format format, std::vector& consume_data) { arch_ = a; format_ = format; std::swap(data_, consume_data); // The actual XSAVE minimum size is 576 bytes (512 followed by a 64-byte // XSAVE header) but sometimes we're storing an FXSAVE(64) which is only // 512 bytes. static const size_t min_xsave_size = 512; assert(format == NONE || data_.size() >= min_xsave_size); } Format format() const { return format_; } SupportedArch arch() const { return arch_; } const std::vector data() const { return data_; } int data_size() const { return data_.size(); } const uint8_t* data_bytes() const { return data_.data(); } bool empty() const { return data_.empty(); } /** * Like |Registers::read_register()|, except attempts to read * the value of an "extra register" (floating point / vector). */ size_t read_register(uint8_t* buf, GdbRegister regno, bool* defined) const; /** * Get a user_fpregs_struct for a particular Arch from these ExtraRegisters. */ std::vector get_user_fpregs_struct(SupportedArch arch) const; /** * Update registers from a user_fpregs_struct. */ void set_user_fpregs_struct(SupportedArch arch, void* data, size_t size); /** * Get a user_fpxregs_struct for from these ExtraRegisters. */ X86Arch::user_fpxregs_struct get_user_fpxregs_struct() const; /** * Update registers from a user_fpxregs_struct. */ void set_user_fpxregs_struct(const X86Arch::user_fpxregs_struct& regs); void print_register_file_compact(FILE* f) const; /** * Reset to post-exec initial state */ void reset(); void validate(Task* t); private: friend class Task; Format format_; SupportedArch arch_; std::vector data_; }; } // namespace rr #endif /* RR_EXTRA_REGISTERS_H_ */ rr-4.4.0/src/FdTable.cc000066400000000000000000000112231277367620400145560ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "FdTable.h" #include #include #include "rr/rr.h" #include "Session.h" #include "Task.h" #include "log.h" using namespace std; namespace rr { void FdTable::add_monitor(int fd, FileMonitor* monitor) { // In the future we could support multiple monitors on an fd, but we don't // need to yet. assert(!is_monitoring(fd)); fds[fd] = FileMonitor::shr_ptr(monitor); update_syscallbuf_fds_disabled(fd); } bool FdTable::is_rr_fd(int fd) { auto it = fds.find(fd); if (it == fds.end()) { return false; } return it->second->is_rr_fd(); } bool FdTable::emulate_ioctl(int fd, RecordTask* t, uint64_t* result) { auto it = fds.find(fd); if (it == fds.end()) { return false; } return it->second->emulate_ioctl(t, result); } bool FdTable::emulate_fcntl(int fd, RecordTask* t, uint64_t* result) { auto it = fds.find(fd); if (it == fds.end()) { return false; } return it->second->emulate_fcntl(t, result); } bool FdTable::emulate_read(int fd, RecordTask* t, const std::vector& ranges, int64_t offset, uint64_t* result) { auto it = fds.find(fd); if (it == fds.end()) { return false; } return it->second->emulate_read(t, ranges, offset, result); } void FdTable::filter_getdents(int fd, RecordTask* t) { auto it = fds.find(fd); if (it == fds.end()) { return; } it->second->filter_getdents(t); } Switchable FdTable::will_write(Task* t, int fd) { auto it = fds.find(fd); if (it == fds.end()) { return ALLOW_SWITCH; } return it->second->will_write(t); } void FdTable::did_write(Task* t, int fd, const std::vector& ranges, int64_t offset) { auto it = fds.find(fd); if (it != fds.end()) { it->second->did_write(t, ranges, offset); } } void FdTable::did_dup(int from, int to) { if (fds.count(from)) { fds[to] = fds[from]; } else { fds.erase(to); } update_syscallbuf_fds_disabled(to); } void FdTable::did_close(int fd) { LOG(debug) << "Close fd " << fd; fds.erase(fd); update_syscallbuf_fds_disabled(fd); } FileMonitor* FdTable::get_monitor(int fd) { auto it = fds.find(fd); if (it == fds.end()) { return NULL; } return it->second.get(); } static bool is_fd_monitored_in_any_task(AddressSpace* vm, int fd) { for (Task* t : vm->task_set()) { if (t->fd_table()->is_monitoring(fd)) { return true; } } return false; } void FdTable::update_syscallbuf_fds_disabled(int fd) { assert(fd >= 0); assert(task_set().size() > 0); unordered_set vms_updated; // It's possible for tasks with different VMs to share this fd table. // But tasks with the same VM might have different fd tables... for (Task* t : task_set()) { AddressSpace* vm = t->vm().get(); if (vms_updated.find(vm) != vms_updated.end()) { continue; } vms_updated.insert(vm); if (!t->preload_globals.is_null() && fd < SYSCALLBUF_FDS_DISABLED_SIZE) { bool disable = is_fd_monitored_in_any_task(vm, fd); t->write_mem( REMOTE_PTR_FIELD(t->preload_globals, syscallbuf_fds_disabled[0]) + fd, (char)disable); } } } void FdTable::init_syscallbuf_fds_disabled(Task* t) { ASSERT(t, has_task(t)); if (t->preload_globals.is_null()) { return; } char disabled[SYSCALLBUF_FDS_DISABLED_SIZE]; memset(disabled, 0, sizeof(disabled)); // It's possible that some tasks in this address space have a different // FdTable. We need to disable syscallbuf for an fd if any tasks for this // address space are monitoring the fd. for (Task* vm_t : t->vm()->task_set()) { for (auto& it : vm_t->fd_table()->fds) { int fd = it.first; assert(fd >= 0); if (fd < SYSCALLBUF_FDS_DISABLED_SIZE) { disabled[fd] = 1; } } } t->write_mem(REMOTE_PTR_FIELD(t->preload_globals, syscallbuf_fds_disabled[0]), disabled, SYSCALLBUF_FDS_DISABLED_SIZE); } static bool is_fd_open(Task* t, int fd) { char path[PATH_MAX]; sprintf(path, "/proc/%d/fd/%d", t->tid, fd); struct stat st; return 0 == lstat(path, &st); } void FdTable::update_for_cloexec(Task* t, TraceTaskEvent& event) { ASSERT(t, has_task(t)); vector fds_to_close; if (t->session().is_recording()) { for (auto& it : fds) { if (!is_fd_open(t, it.first)) { fds_to_close.push_back(it.first); } } event.set_fds_to_close(fds_to_close); } else { fds_to_close = event.fds_to_close(); } for (auto fd : fds_to_close) { did_close(fd); } } } // namespace rr rr-4.4.0/src/FdTable.h000066400000000000000000000040661277367620400144270ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_FD_TABLE_H_ #define RR_FD_TABLE_H_ #include #include #include "FileMonitor.h" #include "HasTaskSet.h" namespace rr { class TraceTaskEvent; class FdTable : public HasTaskSet { public: typedef std::shared_ptr shr_ptr; void add_monitor(int fd, FileMonitor* monitor); bool emulate_ioctl(int fd, RecordTask* t, uint64_t* result); bool emulate_fcntl(int fd, RecordTask* t, uint64_t* result); bool emulate_read(int fd, RecordTask* t, const std::vector& ranges, int64_t offset, uint64_t* result); void filter_getdents(int fd, RecordTask* t); bool is_rr_fd(int fd); Switchable will_write(Task* t, int fd); void did_write(Task* t, int fd, const std::vector& ranges, int64_t offset = -1); void did_dup(int from, int to); void did_close(int fd); shr_ptr clone(Task* t) { shr_ptr fds(new FdTable(*this)); fds->insert_task(t); return fds; } static shr_ptr create(Task* t) { shr_ptr fds(new FdTable()); fds->insert_task(t); return fds; } bool is_monitoring(int fd) { return fds.count(fd) > 0; } FileMonitor* get_monitor(int fd); /** * Regenerate syscallbuf_fds_disabled in task |t|. * Called during initialization of the preload library. */ void init_syscallbuf_fds_disabled(Task* t); /** * Called after task |t| for this FdTable has execed. Update for any fds * that were closed via CLOEXEC. * Rather than tracking CLOEXEC flags (which would be complicated), we just * scan /proc//fd during recording and note any monitored fds that have * been closed, and record these in the TraceTaskEvent. */ void update_for_cloexec(Task* t, TraceTaskEvent& event); private: FdTable() {} FdTable(const FdTable& other) : fds(other.fds) {} void update_syscallbuf_fds_disabled(int fd); std::unordered_map fds; }; } // namespace rr #endif /* RR_FD_TABLE_H_ */ rr-4.4.0/src/FileMonitor.h000066400000000000000000000055631277367620400153600ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_FILE_MONITOR_H_ #define RR_FILE_MONITOR_H_ class Task; #include #include #include #include #include "util.h" namespace rr { class RecordTask; class Registers; class FileMonitor { public: typedef std::shared_ptr shr_ptr; virtual ~FileMonitor() {} enum Type { Base, MagicSaveData, Mmapped, Preserve, ProcFd, ProcMem, Stdio, VirtualPerfCounter, }; virtual Type type() { return Base; } /** * Overriding this to return true will cause close() (and related fd-smashing * operations such as dup2) to return EBADF, and hide it from the tracee's * /proc/pid/fd/ */ virtual bool is_rr_fd() { return false; } /** * Notification that task |t| is about to write |data| bytes of length * |length| to the file. * In general writes can block, and concurrent blocking writes to the same * file may race so that the kernel performs writes out of order * with respect to will_write notifications. * If it is known that the write cannot block (or that blocking all of rr * on it is OK), this notification can return PREVENT_SWITCH to make the * write a blocking write. This ensures that writes are performed in the order * of will_write notifications. */ virtual Switchable will_write(Task*) { return ALLOW_SWITCH; } /** * Notification that task |t| wrote to the file descriptor. * Due to races, if will_write did not return PREVENT_SWITCH, it's possible * that the data in the buffers is not what was actually written. */ struct Range { remote_ptr data; size_t length; Range(remote_ptr data, size_t length) : data(data), length(length) {} }; virtual void did_write(Task*, const std::vector&, int64_t) {} /** * Return true if the ioctl should be fully emulated. If so the result * is stored in the last parameter. * Only called during recording. */ virtual bool emulate_ioctl(RecordTask*, uint64_t*) { return false; } /** * Return true if the fcntl should should be fully emulated. If so the * result is stored in the last parameter. * Only called during recording. */ virtual bool emulate_fcntl(RecordTask*, uint64_t*) { return false; } /** * Return true if the read should should be fully emulated. If so the * result is stored in the last parameter. The emulation should write to the * task's memory ranges. * Only called during recording. */ virtual bool emulate_read(RecordTask*, const std::vector&, int64_t, uint64_t*) { return false; } /** * Allows the FileMonitor to rewrite the output of a getdents/getdents64 call * if desired. */ virtual void filter_getdents(RecordTask*) {} }; } // namespace rr #endif /* RR_FILE_MONITOR_H_ */ rr-4.4.0/src/Flags.cc000066400000000000000000000003521277367620400143120ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Flags.h" #include namespace rr { Flags& Flags::get_for_init() { return singleton; } Flags Flags::singleton; } // namespace rr rr-4.4.0/src/Flags.h000066400000000000000000000037711277367620400141640ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_FLAGS_H_ #define RR_FLAGS_H_ #include #include #include #include "Ticks.h" #include "TraceFrame.h" namespace rr { /** * Command line arguments for rr */ struct Flags { enum { CHECKSUM_NONE = -3, CHECKSUM_SYSCALL = -2, CHECKSUM_ALL = -1 }; /* When to generate or check memory checksums. One of CHECKSUM_NONE, * CHECKSUM_SYSCALL or CHECKSUM_ALL, or a positive integer representing the * event time at which to start checksumming. */ int checksum; enum { DUMP_ON_ALL = 10000, DUMP_ON_RDTSC = 10001, DUMP_ON_NONE = -DUMP_ON_ALL }; int dump_on; enum { DUMP_AT_NONE = -1 }; /* time at which to create memory dump */ int dump_at; // global time // Force rr to do some things that it otherwise wouldn't, for // example launching an emergency debugger when the output // doesn't seem to be a tty. bool force_things; /* Mark the trace global time along with tracee writes to * stdio. */ bool mark_stdio; // Check that cached mmaps match /proc/maps after each event. bool check_cached_mmaps; // Suppress warnings related to environmental features outside rr's // control. bool suppress_environment_warnings; // Any warning or error that would be printed is treated as fatal bool fatal_errors_and_warnings; // User override for architecture detection, e.g. when running // under valgrind. std::string forced_uarch; Flags() : checksum(CHECKSUM_NONE), dump_on(DUMP_ON_NONE), dump_at(DUMP_AT_NONE), force_things(false), mark_stdio(false), check_cached_mmaps(false), suppress_environment_warnings(false) {} static const Flags& get() { return singleton; } /** * Get a reference that can be used to initialize the global Flags. * Can only be called once. */ static Flags& get_for_init(); private: static Flags singleton; }; } // namespace rr #endif /* RR_FLAGS_H_ */ rr-4.4.0/src/GdbCommand.cc000066400000000000000000000114341277367620400152540ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "GdbCommand.h" #include "ReplayTask.h" using namespace std; namespace rr { static SimpleGdbCommand when("when", [](GdbServer&, Task* t, const vector&) { if (!t->session().is_replaying()) { return string("Current event not known (diversion?)"); } return string("Current event: ") + to_string(static_cast(t)->current_trace_frame().time()); }); static SimpleGdbCommand when_ticks("when-ticks", [](GdbServer&, Task* t, const vector&) { if (!t->session().is_replaying()) { return string("Current event not known (diversion?)"); } return string("Current tick: ") + to_string(t->tick_count()); }); static SimpleGdbCommand when_tid("when-tid", [](GdbServer&, Task* t, const vector&) { if (!t->session().is_replaying()) { return string("Current event not known (diversion?)"); } return string("Current tid: ") + to_string(t->tid); }); static std::vector back_stack; static ReplayTimeline::Mark current_history_cp; static std::vector forward_stack; static SimpleGdbCommand rr_history_push( "rr-history-push", [](GdbServer& gdb_server, Task* t, const vector&) { if (!t->session().is_replaying()) { // Don't create new history state inside a diversion return string(); } if (current_history_cp) { back_stack.push_back(current_history_cp); } current_history_cp = gdb_server.get_timeline().mark(); forward_stack.clear(); return string(); }); static SimpleGdbCommand back("back", [](GdbServer& gdb_server, Task* t, const vector&) { if (!t->session().is_replaying()) { return GdbCommandHandler::cmd_end_diversion(); } if (back_stack.size() == 0) { return string("Can't go back. No more history entries."); } forward_stack.push_back(current_history_cp); current_history_cp = back_stack.back(); back_stack.pop_back(); gdb_server.get_timeline().seek_to_mark(current_history_cp); return string(); }); static SimpleGdbCommand forward("forward", [](GdbServer& gdb_server, Task* t, const vector&) { if (!t->session().is_replaying()) { return GdbCommandHandler::cmd_end_diversion(); } if (forward_stack.size() == 0) { return string("Can't go forward. No more history entries."); } back_stack.push_back(current_history_cp); current_history_cp = forward_stack.back(); forward_stack.pop_back(); gdb_server.get_timeline().seek_to_mark(current_history_cp); return string(); }); static int gNextCheckpointId = 0; string invoke_checkpoint(GdbServer& gdb_server, Task*, const vector& args) { const string& where = args[1]; int checkpoint_id = ++gNextCheckpointId; GdbServer::Checkpoint::Explicit e; if (gdb_server.timeline.can_add_checkpoint()) { e = GdbServer::Checkpoint::EXPLICIT; } else { e = GdbServer::Checkpoint::NOT_EXPLICIT; } gdb_server.checkpoints[checkpoint_id] = GdbServer::Checkpoint( gdb_server.timeline, gdb_server.last_continue_tuid, e, where); return string("Checkpoint ") + to_string(checkpoint_id) + " at " + where; } static SimpleGdbCommand checkpoint("checkpoint", invoke_checkpoint); string invoke_delete_checkpoint(GdbServer& gdb_server, Task*, const vector& args) { int id = stoi(args[1]); auto it = gdb_server.checkpoints.find(id); if (it != gdb_server.checkpoints.end()) { if (it->second.is_explicit == GdbServer::Checkpoint::EXPLICIT) { gdb_server.timeline.remove_explicit_checkpoint(it->second.mark); } gdb_server.checkpoints.erase(it); return string("Deleted checkpoint ") + to_string(id) + "."; } else { return string("No checkpoint number ") + to_string(id) + "."; } } static SimpleGdbCommand delete_checkpoint("delete checkpoint", invoke_delete_checkpoint); string invoke_info_checkpoints(GdbServer& gdb_server, Task*, const vector&) { if (gdb_server.checkpoints.size() == 0) { return "No checkpoints."; } string out = "ID\tWhen\tWhere"; for (auto& c : gdb_server.checkpoints) { out += string("\n") + to_string(c.first) + "\t" + to_string(c.second.mark.time()) + "\t" + c.second.where; } return out; } static SimpleGdbCommand info_checkpoints("info checkpoints", invoke_info_checkpoints); /*static*/ void GdbCommand::init_auto_args() { checkpoint.add_auto_arg("rr-where"); } } // namespace rr rr-4.4.0/src/GdbCommand.h000066400000000000000000000036361277367620400151230ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_GDB_COMMAND_H_ #define RR_GDB_COMMAND_H_ #include "GdbCommandHandler.h" #include "GdbServer.h" #include #include #include namespace rr { class GdbCommand { protected: GdbCommand(const std::string& cmd_name) : cmd_name(cmd_name) { GdbCommandHandler::register_command(*this); } public: virtual ~GdbCommand() {} const std::string& name() const { return cmd_name; } /** * Handle the RR Cmd and return a string response to be echo'd * to the user. * * NOTE: args[0] is the command name */ virtual std::string invoke(GdbServer& gdb_server, Task* t, const std::vector& args) = 0; /** * When called, gdb will automatically run gdb.execute() on this string and * pass it as an argument to the rr command. This is useful to pass gdb * state alongside the command invocation. */ void add_auto_arg(const std::string& auto_arg) { cmd_auto_args.push_back(auto_arg); } const std::vector& auto_args() const { return cmd_auto_args; } /** * Setup all the automatic auto_args for our commands. */ static void init_auto_args(); private: const std::string cmd_name; std::vector cmd_auto_args; }; class SimpleGdbCommand : public GdbCommand { public: SimpleGdbCommand( const std::string& cmd_name, const std::function&)>& invoker) : GdbCommand(cmd_name), invoker(invoker) {} virtual std::string invoke(GdbServer& gdb_server, Task* t, const std::vector& args) { return invoker(gdb_server, t, args); } std::function&)> invoker; }; } // namespace rr #endif rr-4.4.0/src/GdbCommandHandler.cc000066400000000000000000000125651277367620400165600ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "GdbCommand.h" #include "GdbCommandHandler.h" #include "log.h" #include #include using namespace std; namespace rr { // HashMap would be better here but the unordered_map API is annoying // and linear search is fine. static vector* gdb_command_list; static string gdb_macro_binding(const GdbCommand& cmd) { string auto_args_str = "["; for (size_t i = 0; i < cmd.auto_args().size(); i++) { if (i > 0) { auto_args_str += ", "; } auto_args_str += "'" + cmd.auto_args()[i] + "'"; } auto_args_str += "]"; return "python RRCmd('" + cmd.name() + "', " + auto_args_str + ")\n"; } /* static */ string GdbCommandHandler::gdb_macros() { GdbCommand::init_auto_args(); stringstream ss; ss << string(R"Delimiter( set python print-stack full python import re def gdb_unescape(string): result = "" pos = 0 while pos < len(string): result += chr(int(string[pos:pos+2], 16)) pos += 2 return result def gdb_escape(string): result = "" pos = 0 for curr_char in string: result += format(ord(curr_char), '02x') return result class RRWhere(gdb.Command): """Helper to get the location for checkpoints/history. Used by auto-args""" def __init__(self): gdb.Command.__init__(self, 'rr-where', gdb.COMMAND_USER, gdb.COMPLETE_NONE, True) def invoke(self, arg, from_tty): #Get the symbol name from 'frame 0' in the format: # '#0 0x00007f9d81a04c46 in _dl_start (arg=0x7ffee1f1c740) at rtld.c:356 # 356 in rtld.c' try: rv = gdb.execute('frame 0', to_string=True) except: rv = "???" # This may occurs if we're not running m = re.match("#0\w*(.*)", rv); if m: rv = m.group(1) else: rv = rv + "???" gdb.write(rv) RRWhere() class RRCmd(gdb.Command): def __init__(self, name, auto_args): gdb.Command.__init__(self, name, gdb.COMMAND_USER, gdb.COMPLETE_NONE, True) self.cmd_name = name self.auto_args = auto_args def invoke(self, arg, from_tty): args = gdb.string_to_argv(arg) self.rr_cmd(args) def rr_cmd(self, args): cmd_prefix = "maint packet qRRCmd:" + gdb_escape(self.cmd_name) argStr = "" for auto_arg in self.auto_args: argStr += ":" + gdb_escape(gdb.execute(auto_arg, to_string=True)) for arg in args: argStr += ":" + gdb_escape(arg) rv = gdb.execute(cmd_prefix + argStr, to_string=True); rv_match = re.search('received: "(.*)"', rv, re.MULTILINE); if not rv_match: gdb.write("Response error: " + rv) return response = gdb_unescape(rv_match.group(1)) gdb.write(response) def history_push(p): gdb.execute("rr-history-push", to_string=True) #Automatically push an history entry when the program execution stops #(signal, breakpoint).This is fired before an interactive prompt is shown. gdb.events.stop.connect(history_push) end )Delimiter"); if (gdb_command_list) { for (auto& it : *gdb_command_list) { ss << gdb_macro_binding(*it); } } ss << string(R"Delimiter( define hookpost-back frame end define hookpost-forward frame end )Delimiter"); return ss.str(); } /*static*/ GdbCommand* GdbCommandHandler::command_for_name(const string& name) { if (!gdb_command_list) { return nullptr; } for (auto& it : *gdb_command_list) { if (it->name() == name) { return it; } } return nullptr; } void GdbCommandHandler::register_command(GdbCommand& cmd) { LOG(debug) << "registering command: " << cmd.name(); if (!gdb_command_list) { gdb_command_list = new vector(); } gdb_command_list->push_back(&cmd); } // Use the simplest two hex character by byte encoding static string gdb_escape(const string& str) { stringstream ss; ss << hex; for (size_t i = 0; i < str.size(); i++) { int chr = (int)str.at(i); if (chr < 16) { ss << "0"; } ss << chr; } return ss.str(); } static string gdb_unescape(const string& str) { stringstream ss; for (size_t i = 0; i < str.size(); i += 2) { ss << (char)stoul(str.substr(i, 2), nullptr, 16); } return ss.str(); } static vector parse_cmd(string& str) { vector args; size_t pos = 0; string delimiter = ":"; while ((pos = str.find(delimiter)) != string::npos) { args.push_back(gdb_unescape(str.substr(0, pos))); str.erase(0, pos + delimiter.length()); } args.push_back(gdb_unescape(str)); return args; } /* static */ string GdbCommandHandler::process_command(GdbServer& gdb_server, Task* t, string payload) { const vector args = parse_cmd(payload); GdbCommand* cmd = command_for_name(args[0]); if (!cmd) { return gdb_escape(string() + "Command '" + args[0] + "' not found.\n"); } LOG(debug) << "invoking command: " << cmd->name(); string resp = cmd->invoke(gdb_server, t, args); if (resp == GdbCommandHandler::cmd_end_diversion()) { LOG(debug) << "cmd must run outside of diversion (" << resp << ")"; return resp; } LOG(debug) << "cmd response: " << resp; return gdb_escape(resp + "\n"); } } // namespace rr rr-4.4.0/src/GdbCommandHandler.h000066400000000000000000000020541277367620400164120ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_GDB_COMMAND_HANDLER_H_ #define RR_GDB_COMMAND_HANDLER_H_ #include namespace rr { class GdbCommand; class GdbServer; class Task; class GdbCommandHandler { public: // Declare any registered command with supporting // wrapper code. static std::string gdb_macros(); static void register_command(GdbCommand& cmd); /** * Process an incoming GDB payload of the following form: * :::... * * NOTE: RR Command are typically sent with the qRRCmd: prefix which * should of been striped already. */ static std::string process_command(GdbServer& gdb_server, Task* t, std::string payload); static GdbCommand* command_for_name(const std::string& name); /** * Special return value for commands that immediatly end a diversion session */ static std::string cmd_end_diversion() { return std::string("RRCmd_EndDiversion"); } private: }; } // namespace rr #endif rr-4.4.0/src/GdbConnection.cc000066400000000000000000001347101277367620400160000ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define REVERSE_EXECUTION /** * Much of this implementation is based on the documentation at * * http://sourceware.org/gdb/onlinedocs/gdb/Packets.html */ #include "GdbConnection.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "GdbCommandHandler.h" #include "ReplaySession.h" #include "ScopedFd.h" #include "StringVectorToCharArray.h" #include "log.h" using namespace std; namespace rr { static const char INTERRUPT_CHAR = '\x03'; #ifdef DEBUGTAG #define UNHANDLED_REQ() FATAL() #else #define UNHANDLED_REQ() \ write_packet(""); \ LOG(info) #endif const GdbThreadId GdbThreadId::ANY(0, 0); const GdbThreadId GdbThreadId::ALL(-1, -1); static bool request_needs_immediate_response(const GdbRequest* req) { switch (req->type) { case DREQ_NONE: case DREQ_CONT: return false; default: return true; } } GdbConnection::GdbConnection(pid_t tgid, const Features& features) : tgid(tgid), cpu_features_(0), no_ack(false), features_(features) { #ifndef REVERSE_EXECUTION features_.reverse_execution = false; #endif } static ScopedFd open_socket(const char* address, unsigned short* port, GdbConnection::ProbePort probe) { ScopedFd listen_fd(socket(AF_INET, SOCK_STREAM | SOCK_CLOEXEC, 0)); if (!listen_fd.is_open()) { FATAL() << "Couldn't create socket"; } struct sockaddr_in addr; addr.sin_family = AF_INET; addr.sin_addr.s_addr = inet_addr(address); int reuseaddr = 1; int ret = setsockopt(listen_fd, SOL_SOCKET, SO_REUSEADDR, &reuseaddr, sizeof(reuseaddr)); if (ret < 0) { FATAL() << "Couldn't set SO_REUSEADDR"; } do { addr.sin_port = htons(*port); ret = ::bind(listen_fd, (struct sockaddr*)&addr, sizeof(addr)); if (ret && (EADDRINUSE == errno || EACCES == errno || EINVAL == errno)) { continue; } if (ret) { FATAL() << "Couldn't bind to port " << *port; } ret = listen(listen_fd, 1 /*backlogged connection*/); if (ret && EADDRINUSE == errno) { continue; } if (ret) { FATAL() << "Couldn't listen on port " << *port; } break; } while (++(*port), probe == GdbConnection::PROBE_PORT); return listen_fd; } void GdbConnection::await_debugger(ScopedFd& listen_fd) { struct sockaddr_in client_addr; socklen_t len = sizeof(client_addr); sock_fd = ScopedFd(accept(listen_fd, (struct sockaddr*)&client_addr, &len)); // We might restart this debugging session, so don't set the // socket fd CLOEXEC. } static const char connection_addr[] = "127.0.0.1"; struct DebuggerParams { char exe_image[PATH_MAX]; short port; }; static void push_default_gdb_options(vector& vec) { vec.push_back("-l"); vec.push_back("-1"); } static void push_target_remote_cmd(vector& vec, unsigned short port) { vec.push_back("-ex"); stringstream ss; ss << "target extended-remote :"; ss << port; vec.push_back(ss.str()); } unique_ptr GdbConnection::await_client_connection( unsigned short desired_port, ProbePort probe, pid_t tgid, const string& exe_image, const Features& features, ScopedFd* client_params_fd) { auto dbg = unique_ptr(new GdbConnection(tgid, features)); unsigned short port = desired_port; ScopedFd listen_fd = open_socket(connection_addr, &port, probe); if (client_params_fd) { DebuggerParams params; memset(¶ms, 0, sizeof(params)); strncpy(params.exe_image, exe_image.c_str(), sizeof(params.exe_image) - 1); params.port = port; ssize_t nwritten = write(*client_params_fd, ¶ms, sizeof(params)); assert(nwritten == sizeof(params)); } else { vector options; push_default_gdb_options(options); push_target_remote_cmd(options, port); cerr << "Launch gdb with \n" << " gdb "; for (auto& opt : options) { cerr << "'" << opt << "' "; } cerr << exe_image << "\n"; } LOG(debug) << "limiting debugger traffic to tgid " << tgid; dbg->await_debugger(listen_fd); return dbg; } static string to_string(const vector& args) { stringstream ss; for (auto& a : args) { ss << "'" << a << "' "; } return ss.str(); } void GdbConnection::launch_gdb(ScopedFd& params_pipe_fd, const string& gdb_binary_file_path, const vector& gdb_options) { DebuggerParams params; ssize_t nread; while (true) { nread = read(params_pipe_fd, ¶ms, sizeof(params)); if (nread == 0) { // pipe was closed. Probably rr failed/died. return; } if (nread != -1 || errno != EINTR) { break; } } assert(nread == sizeof(params)); vector args; args.push_back(gdb_binary_file_path); // The gdb protocol uses the "vRun" packet to reload // remote targets. The packet is specified to be like // "vCont", in which gdb waits infinitely long for a // stop reply packet. But in practice, gdb client // expects the vRun to complete within the remote-reply // timeout, after which it issues vCont. The timeout // causes gdb<-->rr communication to go haywire. // // rr can take a very long time indeed to send the // stop-reply to gdb after restarting replay; the time // to reach a specified execution target is // theoretically unbounded. Timing out on vRun is // technically a gdb bug, but because the rr replay and // the gdb reload models don't quite match up, we'll // work around it on the rr side by disabling the // remote-reply timeout. push_default_gdb_options(args); args.insert(args.end(), gdb_options.begin(), gdb_options.end()); push_target_remote_cmd(args, params.port); args.push_back(params.exe_image); LOG(debug) << "launching " << to_string(args); StringVectorToCharArray c_args(args); execvp(gdb_binary_file_path.c_str(), c_args.get()); FATAL() << "Failed to exec gdb."; } /** * Poll for data to or from gdb, waiting |timeoutMs|. 0 means "don't * wait", and -1 means "wait forever". Return true if data is ready. */ static bool poll_socket(const ScopedFd& sock_fd, short events, int timeoutMs) { struct pollfd pfd; memset(&pfd, 0, sizeof(pfd)); pfd.fd = sock_fd; pfd.events = events; int ret = poll(&pfd, 1, timeoutMs); if (ret < 0 && errno != EINTR) { FATAL() << "Polling gdb socket failed"; } return ret > 0; } static bool poll_incoming(const ScopedFd& sock_fd, int timeoutMs) { return poll_socket(sock_fd, POLLIN /* TODO: |POLLERR */, timeoutMs); } static void poll_outgoing(const ScopedFd& sock_fd, int timeoutMs) { poll_socket(sock_fd, POLLOUT /* TODO: |POLLERR */, timeoutMs); } /** * read() incoming data exactly one time, successfully. May block. */ void GdbConnection::read_data_once() { ssize_t nread; /* Wait until there's data, instead of busy-looping on * EAGAIN. */ poll_incoming(sock_fd, -1 /* wait forever */); uint8_t buf[4096]; nread = read(sock_fd, buf, sizeof(buf)); if (0 == nread) { LOG(info) << "(gdb closed debugging socket, exiting)"; exit(0); } if (nread <= 0) { FATAL() << "Error reading from gdb"; } inbuf.insert(inbuf.end(), buf, buf + nread); } void GdbConnection::write_flush() { size_t write_index = 0; outbuf.push_back(0); LOG(debug) << "write_flush: '" << outbuf.data() << "'"; outbuf.pop_back(); while (write_index < outbuf.size()) { ssize_t nwritten; poll_outgoing(sock_fd, -1 /*wait forever*/); nwritten = write(sock_fd, outbuf.data() + write_index, outbuf.size() - write_index); if (nwritten < 0) { FATAL() << "Error writing to gdb"; } write_index += nwritten; } outbuf.clear(); } void GdbConnection::write_data_raw(const uint8_t* data, ssize_t len) { outbuf.insert(outbuf.end(), data, data + len); } void GdbConnection::write_hex(unsigned long hex) { char buf[32]; size_t len; len = snprintf(buf, sizeof(buf) - 1, "%02lx", hex); write_data_raw((uint8_t*)buf, len); } void GdbConnection::write_packet_bytes(const uint8_t* data, size_t num_bytes) { uint8_t checksum; size_t i; write_data_raw((uint8_t*)"$", 1); for (i = 0, checksum = 0; i < num_bytes; ++i) { checksum += data[i]; } write_data_raw((uint8_t*)data, num_bytes); write_data_raw((uint8_t*)"#", 1); write_hex(checksum); } void GdbConnection::write_packet(const char* data) { return write_packet_bytes((const uint8_t*)data, strlen(data)); } void GdbConnection::write_binary_packet(const char* pfx, const uint8_t* data, ssize_t num_bytes) { ssize_t pfx_num_chars = strlen(pfx); uint8_t buf[2 * num_bytes + pfx_num_chars]; ssize_t buf_num_bytes = 0; int i; strncpy((char*)buf, pfx, sizeof(buf) - 1); buf_num_bytes += pfx_num_chars; for (i = 0; i < num_bytes; ++i) { uint8_t b = data[i]; if (buf_num_bytes + 2 > ssize_t(sizeof(buf))) { break; } switch (b) { case '#': case '$': case '}': case '*': buf[buf_num_bytes++] = '}'; buf[buf_num_bytes++] = b ^ 0x20; break; default: buf[buf_num_bytes++] = b; break; } } LOG(debug) << " ***** NOTE: writing binary data, upcoming debug output may " "be truncated"; return write_packet_bytes(buf, buf_num_bytes); } void GdbConnection::write_hex_bytes_packet(const char* prefix, const uint8_t* bytes, size_t len) { if (prefix[0] == '\0' && 0 == len) { write_packet(""); return; } ssize_t pfx_num_chars = strlen(prefix); char buf[pfx_num_chars + 2 * len + 1]; memcpy(buf, prefix, pfx_num_chars); for (size_t i = 0; i < len; ++i) { unsigned long b = bytes[i]; snprintf(&buf[pfx_num_chars + 2 * i], 3, "%02lx", b); } write_packet(buf); } void GdbConnection::write_hex_bytes_packet(const uint8_t* bytes, size_t len) { write_hex_bytes_packet("", bytes, len); } static void parser_assert(bool cond) { if (!cond) { fputs("Failed to parse gdb request\n", stderr); assert(false); exit(2); } } static string decode_ascii_encoded_hex_str(const char* encoded) { ssize_t enc_len = strlen(encoded); parser_assert(enc_len % 2 == 0); string str; for (int i = 0; i < enc_len / 2; ++i) { char enc_byte[] = { encoded[2 * i], encoded[2 * i + 1], '\0' }; char* endp; int c = strtol(enc_byte, &endp, 16); parser_assert(c < 128); str += static_cast(c); } return str; } bool GdbConnection::skip_to_packet_start() { ssize_t end = -1; /* XXX we want memcspn() here ... */ for (size_t i = 0; i < inbuf.size(); ++i) { if (inbuf[i] == '$' || inbuf[i] == INTERRUPT_CHAR) { end = i; break; } } if (end < 0) { /* Discard all read bytes, which we don't care * about. */ inbuf.clear(); return false; } /* Discard bytes up to start-of-packet. */ inbuf.erase(inbuf.begin(), inbuf.begin() + end); parser_assert(1 <= inbuf.size()); parser_assert('$' == inbuf[0] || INTERRUPT_CHAR == inbuf[0]); return true; } bool GdbConnection::sniff_packet() { if (skip_to_packet_start()) { /* We've already seen a (possibly partial) packet. */ return true; } parser_assert(inbuf.empty()); return poll_incoming(sock_fd, 0 /*don't wait*/); } void GdbConnection::read_packet() { /* Read and discard bytes until we see the start of a * packet. * * NB: we're ignoring "+/-" responses from gdb. There doesn't * seem to be any sane reason why we would send a damaged * packet to gdb over TCP, then see a "-" reply from gdb and * somehow magically fix our bug that led to the malformed * packet in the first place. */ while (!skip_to_packet_start()) { read_data_once(); } if (inbuf[0] == INTERRUPT_CHAR) { /* Interrupts are kind of an ugly duckling in the gdb * protocol ... */ packetend = 1; return; } /* Read until we see end-of-packet. */ size_t checkedlen = 0; while (true) { uint8_t* p = (uint8_t*)memchr(inbuf.data() + checkedlen, '#', inbuf.size() - checkedlen); if (p) { packetend = p - inbuf.data(); break; } checkedlen = inbuf.size(); read_data_once(); } /* NB: we're ignoring the gdb packet checksums here too. If * gdb is corrupted enough to garble a checksum over TCP, it's * not really clear why asking for the packet again might make * the bug go away. */ parser_assert('$' == inbuf[0] && packetend < inbuf.size()); /* Acknowledge receipt of the packet. */ if (!no_ack) { write_data_raw((uint8_t*)"+", 1); write_flush(); } } static void read_binary_data(const uint8_t* payload, const uint8_t* payload_end, vector& data) { data.clear(); while (payload < payload_end) { uint8_t b = *payload++; if ('}' == b) { parser_assert(payload < payload_end); b = 0x20 ^ *payload++; } data.push_back(b); } } /** * Parse and return a gdb thread-id from |str|. |endptr| points to * the character just after the last character in the thread-id. It * may be nullptr. */ static GdbThreadId parse_threadid(const char* str, char** endptr) { GdbThreadId t; char* endp; if ('p' == *str) { ++str; } t.pid = strtol(str, &endp, 16); parser_assert(endp); if ('\0' == *endp) { t.tid = -1; *endptr = endp; return t; } parser_assert('.' == *endp); str = endp + 1; t.tid = strtol(str, &endp, 16); *endptr = endp; return t; } void GdbConnection::write_xfer_response(const void* data, size_t size, uint64_t offset, uint64_t len) { if (offset > size) { write_packet("E01"); return; } if (offset == size) { write_packet("l"); return; } if (offset + len < size) { write_binary_packet("m", static_cast(data) + offset, len); return; } write_binary_packet("l", static_cast(data) + offset, size - offset); } static string read_target_desc(const char* file_name) { string path = exe_directory() + "../share/rr/" + string(file_name); stringstream ss; FILE* f = fopen(path.c_str(), "r"); while (true) { int ch = getc(f); if (ch == EOF) { break; } ss << (char)ch; } fclose(f); return ss.str(); } static const char* target_description_name(uint32_t cpu_features) { // This doesn't scale, but it's what gdb does... switch (cpu_features) { case 0: return "i386-linux.xml"; case GdbConnection::CPU_64BIT: return "amd64-linux.xml"; case GdbConnection::CPU_AVX: return "i386-avx-linux.xml"; case GdbConnection::CPU_64BIT | GdbConnection::CPU_AVX: return "amd64-avx-linux.xml"; default: FATAL() << "Unknown features"; return nullptr; } } bool GdbConnection::xfer(const char* name, char* args) { const char* mode = args; args = strchr(args, ':'); parser_assert(args); *args++ = '\0'; if (strcmp(mode, "read") && strcmp(mode, "write")) { write_packet(""); return false; } const char* annex = args; args = strchr(args, ':'); parser_assert(args); *args++ = '\0'; uint64_t offset = strtoul(args, &args, 16); uint64_t len = 0; if (!strcmp(mode, "read")) { parser_assert(',' == *args++); len = strtoul(args, &args, 16); parser_assert(!*args); } else { parser_assert(*args == ':'); ++args; } LOG(debug) << "gdb asks us to transfer " << name << " mode=" << mode << ", annex=" << annex << ", offset=" << offset << " len=" << len; if (!strcmp(name, "auxv")) { if (strcmp(annex, "")) { write_packet("E00"); return false; } if (strcmp(mode, "read")) { write_packet(""); return false; } req = GdbRequest(DREQ_GET_AUXV); req.target = query_thread; // XXX handle offset/len here! return true; } if (!strcmp(name, "siginfo")) { if (strcmp(annex, "")) { write_packet("E00"); return false; } if (!strcmp(mode, "read")) { req = GdbRequest(DREQ_READ_SIGINFO); req.target = query_thread; req.mem().addr = offset; req.mem().len = len; return true; } req = GdbRequest(DREQ_WRITE_SIGINFO); req.target = query_thread; return true; } if (!strcmp(name, "features")) { if (strcmp(mode, "read")) { write_packet(""); return false; } string target_desc = read_target_desc((strcmp(annex, "") && strcmp(annex, "target.xml")) ? annex : target_description_name(cpu_features_)); write_xfer_response(target_desc.c_str(), target_desc.size(), offset, len); return false; } write_packet(""); return false; } /** * Format |value| into |buf| in the manner gdb expects. |buf| must * point at a buffer with at least |1 + 2*DBG_MAX_REG_SIZE| bytes * available. Fewer bytes than that may be written, but |buf| is * guaranteed to be null-terminated. */ static size_t print_reg_value(const GdbRegisterValue& reg, char* buf) { parser_assert(reg.size <= GdbRegisterValue::MAX_SIZE); if (reg.defined) { /* gdb wants the register value in native endianness. * reg.value read in native endianness is exactly that. */ for (size_t i = 0; i < reg.size; ++i) { snprintf(&buf[2 * i], 3, "%02lx", (unsigned long)reg.value[i]); } } else { for (size_t i = 0; i < reg.size; ++i) { strcpy(&buf[2 * i], "xx"); } } return reg.size * 2; } /** * Read the encoded register value in |strp| into |reg|. |strp| may * be mutated. */ static void read_reg_value(char** strp, GdbRegisterValue* reg) { char* str = *strp; if ('x' == str[0]) { reg->defined = false; reg->size = 0; return; } reg->defined = true; reg->size = strlen(str) / 2; for (size_t i = 0; i < reg->size; ++i) { char tmp = str[2]; str[2] = '\0'; reg->value[i] = strtoul(str, &str, 16); parser_assert('\0' == *str); str[0] = tmp; } *strp = str; } bool GdbConnection::query(char* payload) { const char* name; char* args; args = strchr(payload, ':'); if (args) { *args++ = '\0'; } name = payload; if (strstr(name, "RRCmd") == name) { LOG(debug) << "gdb requests rr cmd: " << name; req = GdbRequest(DREQ_RR_CMD); req.text_ = args; return true; } if (!strcmp(name, "C")) { LOG(debug) << "gdb requests current thread ID"; req = GdbRequest(DREQ_GET_CURRENT_THREAD); return true; } if (!strcmp(name, "Attached")) { LOG(debug) << "gdb asks if this is a new or existing process"; /* Tell gdb this is an existing process; it might be * (see emergency_debug()). */ write_packet("1"); return false; } if (!strcmp(name, "fThreadInfo")) { LOG(debug) << "gdb asks for thread list"; req = GdbRequest(DREQ_GET_THREAD_LIST); return true; } if (!strcmp(name, "sThreadInfo")) { write_packet("l"); /* "end of list" */ return false; } if (!strcmp(name, "GetTLSAddr")) { LOG(debug) << "gdb asks for TLS addr"; req = GdbRequest(DREQ_TLS); req.target = parse_threadid(args, &args); parser_assert(*args == ','); ++args; size_t offset = strtoul(args, &args, 16); parser_assert(*args == ','); ++args; remote_ptr load_module = strtoul(args, &args, 16); parser_assert(*args == '\0'); req.tls().offset = offset; req.tls().load_module = load_module; return true; } if (!strcmp(name, "Offsets")) { LOG(debug) << "gdb asks for section offsets"; req = GdbRequest(DREQ_GET_OFFSETS); req.target = query_thread; return true; } if ('P' == name[0]) { /* The docs say not to use this packet ... */ write_packet(""); return false; } if (!strcmp(name, "Supported")) { /* TODO process these */ LOG(debug) << "gdb supports " << args; stringstream supported; // Encourage gdb to use very large packets since we support any packet size supported << "PacketSize=1048576" ";QStartNoAckMode+" ";qXfer:features:read+" ";qXfer:auxv:read+" ";qXfer:siginfo:read+" ";qXfer:siginfo:write+" ";multiprocess+" ";ConditionalBreakpoints+"; if (features().reverse_execution) { supported << ";ReverseContinue+" ";ReverseStep+"; } write_packet(supported.str().c_str()); return false; } if (!strcmp(name, "Symbol")) { LOG(debug) << "gdb is ready for symbol lookups"; const char* colon = strchr(args, ':'); parser_assert(colon != nullptr); req = GdbRequest(DREQ_QSYMBOL); if (*args == ':') { req.sym().has_address = false; } else { req.sym().has_address = true; req.sym().address = strtoul(args, &args, 16); } parser_assert(*args == ':'); ++args; req.sym().name = decode_ascii_encoded_hex_str(args); return true; } if (strstr(name, "ThreadExtraInfo") == name) { // ThreadExtraInfo is a special snowflake that // delimits its args with ','. parser_assert(!args); args = payload; args = 1 + strchr(args, ',' /*sic*/); req = GdbRequest(DREQ_GET_THREAD_EXTRA_INFO); req.target = parse_threadid(args, &args); parser_assert('\0' == *args); return true; } if (!strcmp(name, "TStatus")) { LOG(debug) << "gdb asks for trace status"; /* XXX from the docs, it appears that we should reply * with "T0" here. But if we do, gdb keeps bothering * us with trace queries. So pretend we don't know * what it's talking about. */ write_packet(""); return false; } if (!strcmp(name, "Xfer")) { name = args; args = strchr(args, ':'); parser_assert(args); *args++ = '\0'; return xfer(name, args); } if (!strcmp(name, "Search")) { name = args; args = strchr(args, ':'); if (args) { *args++ = '\0'; } if (!strcmp(name, "memory") && args) { req = GdbRequest(DREQ_SEARCH_MEM); req.target = query_thread; req.mem().addr = strtoul(args, &args, 16); parser_assert(';' == *args++); req.mem().len = strtoul(args, &args, 16); parser_assert(';' == *args++); read_binary_data((const uint8_t*)args, inbuf.data() + packetend, req.mem().data); LOG(debug) << "gdb searching memory (addr=" << HEX(req.mem().addr) << ", len=" << req.mem().len << ")"; return true; } write_packet(""); return false; } UNHANDLED_REQ() << "Unhandled gdb query: q" << name; return false; } bool GdbConnection::set_var(char* payload) { const char* name; char* args; args = strchr(payload, ':'); if (args) { *args++ = '\0'; } name = payload; if (!strcmp(name, "StartNoAckMode")) { write_packet("OK"); no_ack = true; return false; } UNHANDLED_REQ() << "Unhandled gdb set: Q" << name; return false; } void GdbConnection::consume_request() { req = GdbRequest(); write_flush(); } bool GdbConnection::process_bpacket(char* payload) { if (strcmp(payload, "c") == 0) { req = GdbRequest(DREQ_CONT); req.cont().run_direction = RUN_BACKWARD; req.cont().actions.push_back(GdbContAction(ACTION_CONTINUE, resume_thread)); return true; } else if (strcmp(payload, "s") == 0) { req = GdbRequest(DREQ_CONT); req.cont().run_direction = RUN_BACKWARD; req.cont().actions.push_back(GdbContAction(ACTION_STEP, resume_thread)); return true; } else { UNHANDLED_REQ() << "Unhandled gdb bpacket: b" << payload; return false; } } bool GdbConnection::process_vpacket(char* payload) { const char* name; char* args; args = strchr(payload, ';'); if (args) { *args++ = '\0'; } name = payload; if (!strcmp("Cont", name)) { vector actions; bool has_default_action = false; GdbContAction default_action; while (args) { char* cmd = args; while (*args != ':' && *args != ';') { if (!*args) { args = nullptr; break; } ++args; } bool is_default = true; GdbThreadId target; if (args) { if (*args == ':') { is_default = false; *args = '\0'; target = parse_threadid(args + 1, &args); } args = strchr(args, ';'); if (args) { *args = '\0'; ++args; } } GdbActionType action; int signal_to_deliver = 0; char* endptr = NULL; switch (cmd[0]) { case 'C': action = ACTION_CONTINUE; signal_to_deliver = strtol(cmd + 1, &endptr, 16); break; case 'c': action = ACTION_CONTINUE; break; case 'S': action = ACTION_STEP; signal_to_deliver = strtol(cmd + 1, &cmd, 16); break; case 's': action = ACTION_STEP; break; default: UNHANDLED_REQ() << "Unhandled vCont command " << cmd << "(" << args << ")"; return false; } if (endptr && *endptr) { UNHANDLED_REQ() << "Unhandled vCont command parameters " << cmd; return false; } if (is_default) { if (has_default_action) { UNHANDLED_REQ() << "Unhandled vCont command with multiple default actions"; return false; } has_default_action = true; default_action = GdbContAction(action, GdbThreadId::ALL, signal_to_deliver); } else { actions.push_back(GdbContAction(action, target, signal_to_deliver)); } } if (has_default_action) { actions.push_back(default_action); } req = GdbRequest(DREQ_CONT); req.cont().run_direction = RUN_FORWARD; req.cont().actions = move(actions); return true; } if (!strcmp("Cont?", name)) { LOG(debug) << "gdb queries which continue commands we support"; write_packet("vCont;c;C;s;S;"); return false; } if (!strcmp("Kill", name)) { // We can't kill tracees or replay can diverge. We // assume that this kill request is being made because // a "vRun" restart is coming right up. We know how // to implement vRun, so we'll ignore this one. LOG(debug) << "gdb asks us to kill tracee(s); ignoring"; write_packet("OK"); return false; } if (!strcmp("Run", name)) { req = GdbRequest(DREQ_RESTART); const char* filename = args; args = strchr(args, ';'); if (args) { *args++ = '\0'; } if (strlen(filename)) { FATAL() << "gdb wants us to run the exe image `" << filename << "', but we don't support that."; } if (!args) { req.restart().type = RESTART_FROM_PREVIOUS; return true; } const char* arg1 = args; args = strchr(args, ';'); if (args) { *args++ = 0; LOG(debug) << "Ignoring extra parameters " << args; } string event_str = decode_ascii_encoded_hex_str(arg1); char* endp; if (event_str[0] == 'c') { int param = strtol(event_str.c_str() + 1, &endp, 0); req.restart().type = RESTART_FROM_CHECKPOINT; req.restart().param_str = event_str.substr(1); req.restart().param = param; LOG(debug) << "next replayer restarting from checkpoint " << req.restart().param; } else { req.restart().type = RESTART_FROM_EVENT; req.restart().param = strtol(event_str.c_str(), &endp, 0); LOG(debug) << "next replayer advancing to event " << req.restart().param; } if (!endp || *endp != '\0') { LOG(debug) << "Couldn't parse event string `" << event_str << "'" << "; restarting from previous"; req.restart().type = RESTART_FROM_PREVIOUS; req.restart().param = -1; } return true; } if (name == strstr(name, "File:")) { write_packet(""); return false; } UNHANDLED_REQ() << "Unhandled gdb vpacket: v" << name; return false; } static string to_string(const vector& bytes, size_t max_len) { stringstream ss; for (size_t i = 0; i < bytes.size(); ++i) { if (i >= max_len) { ss << "..."; break; } char buf[3]; sprintf(buf, "%02x", bytes[i]); ss << buf; } return ss.str(); } bool GdbConnection::process_packet() { parser_assert(INTERRUPT_CHAR == inbuf[0] || ('$' == inbuf[0] && (uint8_t*)memchr(inbuf.data(), '#', inbuf.size()) == inbuf.data() + packetend)); if (INTERRUPT_CHAR == inbuf[0]) { LOG(debug) << "gdb requests interrupt"; req = GdbRequest(DREQ_INTERRUPT); inbuf.erase(inbuf.begin()); return true; } char request = inbuf[1]; char* payload = (char*)&inbuf[2]; inbuf[packetend] = '\0'; LOG(debug) << "raw request " << request << payload; bool ret; switch (request) { case 'b': ret = process_bpacket(payload); break; case 'D': LOG(debug) << "gdb is detaching from us"; req = GdbRequest(DREQ_DETACH); ret = true; break; case 'g': req = GdbRequest(DREQ_GET_REGS); req.target = query_thread; LOG(debug) << "gdb requests registers"; ret = true; break; case 'G': /* XXX we can't let gdb spray registers in general, * because it may cause replay to diverge. But some * writes may be OK. Let's see how far we can get * with ignoring these requests. */ write_packet(""); ret = false; break; case 'H': if ('c' == *payload++) { req = GdbRequest(DREQ_SET_CONTINUE_THREAD); } else { req = GdbRequest(DREQ_SET_QUERY_THREAD); } req.target = parse_threadid(payload, &payload); parser_assert('\0' == *payload); LOG(debug) << "gdb selecting " << req.target; ret = true; break; case 'k': LOG(info) << "gdb requests kill, exiting"; write_packet("OK"); exit(0); case 'm': req = GdbRequest(DREQ_GET_MEM); req.target = query_thread; req.mem().addr = strtoul(payload, &payload, 16); parser_assert(',' == *payload++); req.mem().len = strtoul(payload, &payload, 16); parser_assert('\0' == *payload); LOG(debug) << "gdb requests memory (addr=" << HEX(req.mem().addr) << ", len=" << req.mem().len << ")"; ret = true; break; case 'M': /* We can't allow the debugger to write arbitrary data * to memory, or the replay may diverge. */ // TODO: parse this packet in case some oddball gdb // decides to send it instead of 'X' write_packet(""); ret = false; break; case 'p': req = GdbRequest(DREQ_GET_REG); req.target = query_thread; req.reg().name = GdbRegister(strtoul(payload, &payload, 16)); parser_assert('\0' == *payload); LOG(debug) << "gdb requests register value (" << req.reg().name << ")"; ret = true; break; case 'P': req = GdbRequest(DREQ_SET_REG); req.target = query_thread; req.reg().name = GdbRegister(strtoul(payload, &payload, 16)); parser_assert('=' == *payload++); read_reg_value(&payload, &req.reg()); parser_assert('\0' == *payload); ret = true; break; case 'q': ret = query(payload); break; case 'Q': ret = set_var(payload); break; case 'T': req = GdbRequest(DREQ_GET_IS_THREAD_ALIVE); req.target = parse_threadid(payload, &payload); parser_assert('\0' == *payload); LOG(debug) << "gdb wants to know if " << req.target << " is alive"; ret = true; break; case 'v': ret = process_vpacket(payload); break; case 'X': { req = GdbRequest(DREQ_SET_MEM); req.target = query_thread; req.mem().addr = strtoul(payload, &payload, 16); parser_assert(',' == *payload++); req.mem().len = strtoul(payload, &payload, 16); parser_assert(':' == *payload++); read_binary_data((const uint8_t*)payload, inbuf.data() + packetend, req.mem().data); parser_assert(req.mem().len == req.mem().data.size()); LOG(debug) << "gdb setting memory (addr=" << HEX(req.mem().addr) << ", len=" << req.mem().len << ", data=" << to_string(req.mem().data, 32) << ")"; ret = true; break; } case 'z': case 'Z': { int type = strtol(payload, &payload, 16); parser_assert(',' == *payload++); if (!(0 <= type && type <= 4)) { LOG(warn) << "Unknown watch type " << type; write_packet(""); ret = false; break; } req = GdbRequest(GdbRequestType( type + (request == 'Z' ? DREQ_SET_SW_BREAK : DREQ_REMOVE_SW_BREAK))); req.watch().addr = strtoul(payload, &payload, 16); parser_assert(',' == *payload); payload++; req.watch().kind = strtoul(payload, &payload, 16); if (';' == *payload) { ++payload; while ('X' == *payload) { ++payload; int len = strtol(payload, &payload, 16); parser_assert(',' == *payload); payload++; vector bytes; for (int i = 0; i < len; ++i) { parser_assert(payload[0] && payload[1]); char tmp = payload[2]; payload[2] = '\0'; bytes.push_back(strtol(payload, &payload, 16)); parser_assert('\0' == *payload); payload[0] = tmp; } req.watch().conditions.push_back(move(bytes)); } } parser_assert('\0' == *payload); LOG(debug) << "gdb requests " << ('Z' == request ? "set" : "remove") << "breakpoint (addr=" << HEX(req.watch().addr) << ", len=" << req.watch().kind << ")"; ret = true; break; } case '!': LOG(debug) << "gdb requests extended mode"; write_packet("OK"); ret = false; break; case '?': LOG(debug) << "gdb requests stop reason"; req = GdbRequest(DREQ_GET_STOP_REASON); req.target = query_thread; ret = true; break; default: UNHANDLED_REQ() << "Unhandled gdb request '" << inbuf[1] << "'"; ret = false; } /* Erase the newly processed packet from the input buffer. The checksum * after the '#' will be skipped later as we look for the next packet start. */ inbuf.erase(inbuf.begin(), inbuf.begin() + packetend + 1); /* If we processed the request internally, consume it. */ if (!ret) { consume_request(); } return ret; } void GdbConnection::notify_no_such_thread(const GdbRequest& req) { assert(!memcmp(&req, &this->req, sizeof(this->req))); /* '10' is the errno ECHILD. We use it as a magic code to * notify the user that the thread that was the target of this * request has died, and either gdb didn't notice that, or rr * didn't notify gdb. Either way, the user should restart * their debugging session. */ LOG(error) << "Targeted thread no longer exists; this is the result of " "either a gdb or\n" "rr bug. Please restart your debugging session and avoid " "doing whatever\n" "triggered this bug."; write_packet("E10"); consume_request(); } void GdbConnection::notify_restart() { assert(DREQ_RESTART == req.type); // These threads may not exist at the first trace-stop after // restart. The gdb client should reset this state, but help // it out just in case. resume_thread = GdbThreadId::ANY; query_thread = GdbThreadId::ANY; req = GdbRequest(); } GdbRequest GdbConnection::get_request() { if (DREQ_RESTART == req.type) { LOG(debug) << "consuming RESTART request"; notify_restart(); // gdb wants to be notified with a stop packet when // the process "relaunches". In rr's case, the // traceee may be very far away from process creation, // but that's OK. req = GdbRequest(DREQ_GET_STOP_REASON); req.target = query_thread; return req; } /* Can't ask for the next request until you've satisfied the * current one, for requests that need an immediate * response. */ assert(!request_needs_immediate_response(&req)); if (!sniff_packet() && req.is_resume_request()) { /* There's no new request data available and gdb has * already asked us to resume. OK, do that (or keep * doing that) now. */ return req; } while (true) { /* There's either new request data, or we have nothing * to do. Either way, block until we read a complete * packet from gdb. */ read_packet(); if (process_packet()) { /* We couldn't process the packet internally, * so the target has to do something. */ return req; } /* The packet we got was "internal", gdb details. * Nothing for the target to do yet. Keep waiting. */ } } void GdbConnection::notify_exit_code(int code) { char buf[64]; assert(req.is_resume_request() || req.type == DREQ_INTERRUPT); snprintf(buf, sizeof(buf) - 1, "W%02x", code); write_packet(buf); consume_request(); } void GdbConnection::notify_exit_signal(int sig) { char buf[64]; assert(req.is_resume_request() || req.type == DREQ_INTERRUPT); snprintf(buf, sizeof(buf) - 1, "X%02x", sig); write_packet(buf); consume_request(); } /** * Translate linux-x86 |sig| to gdb's internal numbering. Translation * made according to gdb/include/gdb/signals.def. */ static int to_gdb_signum(int sig) { switch (sig) { case 0: return 0; case SIGHUP: return 1; case SIGINT: return 2; case SIGQUIT: return 3; case SIGILL: return 4; case SIGTRAP: return 5; case SIGABRT /*case SIGIOT*/: return 6; case SIGBUS: return 10; case SIGFPE: return 8; case SIGKILL: return 9; case SIGUSR1: return 30; case SIGSEGV: return 11; case SIGUSR2: return 31; case SIGPIPE: return 13; case SIGALRM: return 14; case SIGTERM: return 15; /* gdb hasn't heard of SIGSTKFLT, so this is * arbitrarily made up. SIGDANGER just sounds cool.*/ case SIGSTKFLT: return 38 /*GDB_SIGNAL_DANGER*/; /*case SIGCLD*/ case SIGCHLD: return 20; case SIGCONT: return 19; case SIGSTOP: return 17; case SIGTSTP: return 18; case SIGTTIN: return 21; case SIGTTOU: return 22; case SIGURG: return 16; case SIGXCPU: return 24; case SIGXFSZ: return 25; case SIGVTALRM: return 26; case SIGPROF: return 27; case SIGWINCH: return 28; /*case SIGPOLL*/ case SIGIO: return 23; case SIGPWR: return 32; case SIGSYS: return 12; case 32: return 77; default: if (33 <= sig && sig <= 63) { /* GDB_SIGNAL_REALTIME_33 is numbered 45, hence this offset. */ return sig + 12; } if (64 <= sig && sig <= 127) { /* GDB_SIGNAL_REALTIME_64 is numbered 78, hence this offset. */ return sig + 14; } LOG(warn) << "Unknown signal " << sig; return 143; // GDB_SIGNAL_UNKNOWN } } void GdbConnection::send_stop_reply_packet(GdbThreadId thread, int sig, uintptr_t watch_addr) { if (sig < 0) { write_packet("E01"); return; } char watch[1024]; if (watch_addr) { snprintf(watch, sizeof(watch) - 1, "watch:%" PRIxPTR ";", watch_addr); } else { watch[0] = '\0'; } char buf[PATH_MAX]; snprintf(buf, sizeof(buf) - 1, "T%02xthread:p%02x.%02x;%s", to_gdb_signum(sig), thread.pid, thread.tid, watch); write_packet(buf); } void GdbConnection::notify_stop(GdbThreadId thread, int sig, uintptr_t watch_addr) { assert(req.is_resume_request() || req.type == DREQ_INTERRUPT); if (tgid != thread.pid) { LOG(debug) << "ignoring stop of " << thread << " because we're debugging tgid " << tgid; // Re-use the existing continue request to advance to // the next stop we're willing to tell gdb about. return; } send_stop_reply_packet(thread, sig, watch_addr); // This isn't documented in the gdb remote protocol, but if we // don't do this, gdb will sometimes continue to send requests // for the previously-stopped thread when it obviously intends // to be making requests about the stopped thread. // Setting to ANY here will make the client choose the correct default thread. LOG(debug) << "forcing query/resume thread to ANY"; query_thread = GdbThreadId::ANY; resume_thread = GdbThreadId::ANY; consume_request(); } void GdbConnection::notify_restart_failed() { assert(DREQ_RESTART == req.type); // TODO: it's not known by this author whether gdb knows how // to recover from a failed "run" request. write_packet("E01"); consume_request(); } void GdbConnection::reply_get_current_thread(GdbThreadId thread) { assert(DREQ_GET_CURRENT_THREAD == req.type); char buf[1024]; snprintf(buf, sizeof(buf), "QCp%02x.%02x", thread.pid, thread.tid); write_packet(buf); consume_request(); } void GdbConnection::reply_get_auxv(const vector& auxv) { assert(DREQ_GET_AUXV == req.type); if (!auxv.empty()) { write_binary_packet("l", auxv.data(), auxv.size()); } else { write_packet("E01"); } consume_request(); } void GdbConnection::reply_get_is_thread_alive(bool alive) { assert(DREQ_GET_IS_THREAD_ALIVE == req.type); write_packet(alive ? "OK" : "E01"); consume_request(); } void GdbConnection::reply_get_thread_extra_info(const string& info) { assert(DREQ_GET_THREAD_EXTRA_INFO == req.type); LOG(debug) << "thread extra info: '" << info.c_str() << "'"; write_hex_bytes_packet((const uint8_t*)info.c_str(), 1 + info.length()); consume_request(); } void GdbConnection::reply_select_thread(bool ok) { assert(DREQ_SET_CONTINUE_THREAD == req.type || DREQ_SET_QUERY_THREAD == req.type); if (ok && DREQ_SET_CONTINUE_THREAD == req.type) { resume_thread = req.target; } else if (ok && DREQ_SET_QUERY_THREAD == req.type) { query_thread = req.target; } write_packet(ok ? "OK" : "E01"); consume_request(); } void GdbConnection::reply_get_mem(const vector& mem) { assert(DREQ_GET_MEM == req.type); assert(mem.size() <= req.mem().len); if (req.mem().len > 0 && mem.size() == 0) { write_packet("E01"); } else { write_hex_bytes_packet(mem.data(), mem.size()); } consume_request(); } void GdbConnection::reply_set_mem(bool ok) { assert(DREQ_SET_MEM == req.type); write_packet(ok ? "OK" : "E01"); consume_request(); } void GdbConnection::reply_search_mem(bool found, remote_ptr addr) { assert(DREQ_SEARCH_MEM == req.type); if (found) { char buf[256]; sprintf(buf, "1,%llx", (long long)addr.as_int()); write_packet(buf); } else { write_packet("0"); } consume_request(); } void GdbConnection::reply_get_offsets(/* TODO */) { assert(DREQ_GET_OFFSETS == req.type); /* XXX FIXME TODO */ write_packet(""); consume_request(); } void GdbConnection::reply_get_reg(const GdbRegisterValue& reg) { char buf[2 * GdbRegisterValue::MAX_SIZE + 1]; assert(DREQ_GET_REG == req.type); print_reg_value(reg, buf); write_packet(buf); consume_request(); } void GdbConnection::reply_get_regs(const vector& file) { char buf[file.size() * 2 * GdbRegisterValue::MAX_SIZE + 1]; assert(DREQ_GET_REGS == req.type); size_t offset = 0; for (auto& reg : file) { offset += print_reg_value(reg, &buf[offset]); } write_packet(buf); consume_request(); } void GdbConnection::reply_set_reg(bool ok) { assert(DREQ_SET_REG == req.type); // TODO: what happens if we're forced to reply to a // set-register request with |ok = false|, leading us to // pretend not to understand the packet? If, later, an // experimental session needs the set-register request will it // not be sent? // // We can't reply with an error packet here because gdb thinks // that failed set-register requests are catastrophic. write_packet(ok ? "OK" : ""); consume_request(); } void GdbConnection::reply_get_stop_reason(GdbThreadId which, int sig) { assert(DREQ_GET_STOP_REASON == req.type); send_stop_reply_packet(which, sig); consume_request(); } void GdbConnection::reply_get_thread_list(const vector& threads) { assert(DREQ_GET_THREAD_LIST == req.type); if (threads.empty()) { write_packet("l"); } else { ssize_t maxlen = 1 /*m char*/ + threads.size() * (1 /*p*/ + 2 * sizeof(threads[0]) + 1 /*,*/) + 1 /*\0*/; char* str = (char*)malloc(maxlen); int offset = 0; str[offset++] = 'm'; for (size_t i = 0; i < threads.size(); ++i) { const GdbThreadId& t = threads[i]; if (tgid != t.pid) { continue; } offset += snprintf(&str[offset], maxlen - offset, "p%02x.%02x,", t.pid, t.tid); } /* Overwrite the trailing ',' */ str[offset - 1] = '\0'; write_packet(str); free(str); } consume_request(); } void GdbConnection::reply_watchpoint_request(bool ok) { assert(DREQ_WATCH_FIRST <= req.type && req.type <= DREQ_WATCH_LAST); write_packet(ok ? "OK" : "E01"); consume_request(); } void GdbConnection::reply_detach() { assert(DREQ_DETACH <= req.type); write_packet("OK"); consume_request(); } void GdbConnection::reply_read_siginfo(const vector& si_bytes) { assert(DREQ_READ_SIGINFO == req.type); if (si_bytes.empty()) { write_packet("E01"); } else { write_binary_packet("l", si_bytes.data(), si_bytes.size()); } consume_request(); } void GdbConnection::reply_write_siginfo(/* TODO*/) { assert(DREQ_WRITE_SIGINFO == req.type); write_packet("E01"); consume_request(); } void GdbConnection::reply_rr_cmd(const std::string& text) { assert(DREQ_RR_CMD == req.type); write_packet(text.c_str()); consume_request(); } void GdbConnection::send_qsymbol(const std::string& name) { assert(DREQ_QSYMBOL == req.type); const void* data = static_cast(name.c_str()); write_hex_bytes_packet("qSymbol:", static_cast(data), name.length()); consume_request(); } void GdbConnection::qsymbols_finished() { assert(DREQ_QSYMBOL == req.type); write_packet("OK"); consume_request(); } void GdbConnection::reply_tls_addr(bool ok, remote_ptr address) { assert(DREQ_TLS == req.type); if (ok) { char buf[256]; sprintf(buf, "%llx", (long long)address.as_int()); write_packet(buf); } else { write_packet("E01"); } consume_request(); } } // namespace rr rr-4.4.0/src/GdbConnection.h000066400000000000000000000430771277367620400156470ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_GDB_CONNECTION_H_ #define RR_GDB_CONNECTION_H_ #include #include #include #include #include #include #include "GdbRegister.h" #include "Registers.h" #include "ReplaySession.h" #include "ReplayTimeline.h" namespace rr { /** * Descriptor for task within a task group. Note: on linux, we can * uniquely identify any thread by its |tid| (ignoring pid * namespaces). */ struct GdbThreadId { GdbThreadId(pid_t pid = -1, pid_t tid = -1) : pid(pid), tid(tid) {} pid_t pid; pid_t tid; bool operator==(const GdbThreadId& o) const { return pid == o.pid && tid == o.tid; } static const GdbThreadId ANY; static const GdbThreadId ALL; }; inline std::ostream& operator<<(std::ostream& o, const GdbThreadId& t) { o << t.pid << "." << t.tid; return o; } /** * Represents a possibly-undefined register |name|. |size| indicates how * many bytes of |value| are valid, if any. */ struct GdbRegisterValue { enum { MAX_SIZE = Registers::MAX_SIZE }; GdbRegister name; union { uint8_t value[MAX_SIZE]; uint8_t value1; uint16_t value2; uint32_t value4; uint64_t value8; }; size_t size; bool defined; }; enum GdbRequestType { DREQ_NONE = 0, /* None of these requests have parameters. */ DREQ_GET_CURRENT_THREAD, DREQ_GET_OFFSETS, DREQ_GET_REGS, DREQ_GET_STOP_REASON, DREQ_GET_THREAD_LIST, DREQ_INTERRUPT, DREQ_DETACH, /* These use params.target. */ DREQ_GET_AUXV, DREQ_GET_IS_THREAD_ALIVE, DREQ_GET_THREAD_EXTRA_INFO, DREQ_SET_CONTINUE_THREAD, DREQ_SET_QUERY_THREAD, // TLS lookup, uses params.target and params.tls. DREQ_TLS, // gdb wants to write back siginfo_t to a tracee. More // importantly, this packet arrives before an experiment // session for a |call foo()| is about to be torn down. // // TODO: actual interface NYI. DREQ_WRITE_SIGINFO, /* These use params.mem. */ DREQ_GET_MEM, DREQ_SET_MEM, // gdb wants to read the current siginfo_t for a stopped // tracee. More importantly, this packet arrives at the very // beginning of a |call foo()| experiment. // // Uses .mem for offset/len. DREQ_READ_SIGINFO, DREQ_SEARCH_MEM, DREQ_MEM_FIRST = DREQ_GET_MEM, DREQ_MEM_LAST = DREQ_SEARCH_MEM, DREQ_REMOVE_SW_BREAK, DREQ_REMOVE_HW_BREAK, DREQ_REMOVE_WR_WATCH, DREQ_REMOVE_RD_WATCH, DREQ_REMOVE_RDWR_WATCH, DREQ_SET_SW_BREAK, DREQ_SET_HW_BREAK, DREQ_SET_WR_WATCH, DREQ_SET_RD_WATCH, DREQ_SET_RDWR_WATCH, DREQ_WATCH_FIRST = DREQ_REMOVE_SW_BREAK, DREQ_WATCH_LAST = DREQ_SET_RDWR_WATCH, /* Use params.reg. */ DREQ_GET_REG, DREQ_SET_REG, DREQ_REG_FIRST = DREQ_GET_REG, DREQ_REG_LAST = DREQ_SET_REG, /* Use params.cont. */ DREQ_CONT, /* gdb host detaching from stub. No parameters. */ /* Uses params.restart. */ DREQ_RESTART, /* Uses params.text. */ DREQ_RR_CMD, // qSymbol packet, uses params.sym. DREQ_QSYMBOL, }; enum GdbRestartType { RESTART_FROM_PREVIOUS, RESTART_FROM_EVENT, RESTART_FROM_CHECKPOINT, }; enum GdbActionType { ACTION_CONTINUE, ACTION_STEP }; struct GdbContAction { GdbContAction(GdbActionType type = ACTION_CONTINUE, const GdbThreadId& target = GdbThreadId::ANY, int signal_to_deliver = 0) : type(type), target(target), signal_to_deliver(signal_to_deliver) {} GdbActionType type; GdbThreadId target; int signal_to_deliver; }; /** * These requests are made by the debugger host and honored in proxy * by rr, the target. */ struct GdbRequest { GdbRequest(GdbRequestType type = DREQ_NONE) : type(type), suppress_debugger_stop(false) {} GdbRequest(const GdbRequest& other) : type(other.type), target(other.target), suppress_debugger_stop(other.suppress_debugger_stop), mem_(other.mem_), watch_(other.watch_), reg_(other.reg_), restart_(other.restart_), cont_(other.cont_), text_(other.text_), tls_(other.tls_), sym_(other.sym_) {} GdbRequest& operator=(const GdbRequest& other) { this->~GdbRequest(); new (this) GdbRequest(other); return *this; } const GdbRequestType type; GdbThreadId target; bool suppress_debugger_stop; struct Mem { uintptr_t addr; size_t len; // For SET_MEM requests, the |len| raw bytes that are to be written. // For SEARCH_MEM requests, the bytes to search for. std::vector data; } mem_; struct Watch { uintptr_t addr; int kind; std::vector> conditions; } watch_; GdbRegisterValue reg_; struct Restart { int param; std::string param_str; GdbRestartType type; } restart_; struct Cont { RunDirection run_direction; std::vector actions; } cont_; std::string text_; struct Tls { size_t offset; remote_ptr load_module; } tls_; struct Symbol { bool has_address; remote_ptr address; std::string name; } sym_; Mem& mem() { assert(type >= DREQ_MEM_FIRST && type <= DREQ_MEM_LAST); return mem_; } const Mem& mem() const { assert(type >= DREQ_MEM_FIRST && type <= DREQ_MEM_LAST); return mem_; } Watch& watch() { assert(type >= DREQ_WATCH_FIRST && type <= DREQ_WATCH_LAST); return watch_; } const Watch& watch() const { assert(type >= DREQ_WATCH_FIRST && type <= DREQ_WATCH_LAST); return watch_; } GdbRegisterValue& reg() { assert(type >= DREQ_REG_FIRST && type <= DREQ_REG_LAST); return reg_; } const GdbRegisterValue& reg() const { assert(type >= DREQ_REG_FIRST && type <= DREQ_REG_LAST); return reg_; } Restart& restart() { assert(type == DREQ_RESTART); return restart_; } const Restart& restart() const { assert(type == DREQ_RESTART); return restart_; } Cont& cont() { assert(type == DREQ_CONT); return cont_; } const Cont& cont() const { assert(type == DREQ_CONT); return cont_; } const std::string& text() const { assert(type == DREQ_RR_CMD); return text_; } Tls& tls() { assert(type == DREQ_TLS); return tls_; } const Tls& tls() const { assert(type == DREQ_TLS); return tls_; } Symbol& sym() { assert(type == DREQ_QSYMBOL); return sym_; } const Symbol& sym() const { assert(type == DREQ_QSYMBOL); return sym_; } /** * Return nonzero if this requires that program execution be resumed * in some way. */ bool is_resume_request() const { return type == DREQ_CONT; } }; /** * This struct wraps up the state of the gdb protocol, so that we can * offer a (mostly) stateless interface to clients. */ class GdbConnection { public: /** * Wait for exactly one gdb host to connect to this remote target on * IP address 127.0.0.1, port |port|. If |probe| is nonzero, a unique * port based on |start_port| will be searched for. Otherwise, if * |port| is already bound, this function will fail. * * Pass the |tgid| of the task on which this debug-connection request * is being made. The remaining debugging session will be limited to * traffic regarding |tgid|, but clients don't need to and shouldn't * need to assume that. * * If we're opening this connection on behalf of a known client, pass * an fd in |client_params_fd|; we'll write the allocated port and |exe_image| * through the fd before waiting for a connection. |exe_image| is the * process that will be debugged by client, or null ptr if there isn't * a client. * * This function is infallible: either it will return a valid * debugging context, or it won't return. */ enum ProbePort { DONT_PROBE = 0, PROBE_PORT }; struct Features { Features() : reverse_execution(true) {} bool reverse_execution; }; static std::unique_ptr await_client_connection( unsigned short desired_port, ProbePort probe, pid_t tgid, const std::string& exe_image, const Features& features, ScopedFd* client_params_fd = nullptr); /** * Exec gdb using the params that were written to * |params_pipe_fd|. Optionally, pre-define in the gdb client the set * of macros defined in |macros| if nonnull. */ static void launch_gdb(ScopedFd& params_pipe_fd, const std::string& gdb_binary_file_path, const std::vector& gdb_options); /** * Call this when the target of |req| is needed to fulfill the * request, but the target is dead. This situation is a symptom of a * gdb or rr bug. */ void notify_no_such_thread(const GdbRequest& req); /** * Finish a DREQ_RESTART request. Should be invoked after replay * restarts and prior GdbConnection has been restored. */ void notify_restart(); /** * Return the current request made by the debugger host, that needs to * be satisfied. This function will block until either there's a * debugger host request that needs a response, or until a request is * made to resume execution of the target. In the latter case, * calling this function multiple times will return an appropriate * resume request each time (see above). * * The target should peek at the debugger request in between execution * steps. A new request may need to be serviced. */ GdbRequest get_request(); /** * Notify the host that this process has exited with |code|. */ void notify_exit_code(int code); /** * Notify the host that this process has exited from |sig|. */ void notify_exit_signal(int sig); /** * Notify the host that a resume request has "finished", i.e., the * target has stopped executing for some reason. |sig| is the signal * that stopped execution, or 0 if execution stopped otherwise. */ void notify_stop(GdbThreadId which, int sig, uintptr_t watch_addr = 0); /** Notify the debugger that a restart request failed. */ void notify_restart_failed(); /** * Tell the host that |thread| is the current thread. */ void reply_get_current_thread(GdbThreadId thread); /** * Reply with the target thread's |auxv| pairs. |auxv.empty()| * if there was an error reading the auxiliary vector. */ void reply_get_auxv(const std::vector& auxv); /** * |alive| is true if the requested thread is alive, false if dead. */ void reply_get_is_thread_alive(bool alive); /** * |info| is a string containing data about the request target that * might be relevant to the debugger user. */ void reply_get_thread_extra_info(const std::string& info); /** * |ok| is true if req->target can be selected, false otherwise. */ void reply_select_thread(bool ok); /** * The first |mem.size()| bytes of the request were read into |mem|. * |mem.size()| must be less than or equal to the length of the request. */ void reply_get_mem(const std::vector& mem); /** * |ok| is true if a SET_MEM request succeeded, false otherwise. This * function *must* be called whenever a SET_MEM request is made, * regardless of success/failure or special interpretation. */ void reply_set_mem(bool ok); /** * Reply to the DREQ_SEARCH_MEM request. * |found| is true if we found the searched-for bytes starting at address * |addr|. */ void reply_search_mem(bool found, remote_ptr addr); /** * Reply to the DREQ_GET_OFFSETS request. */ void reply_get_offsets(/* TODO */); /** * Send |value| back to the debugger host. |value| may be undefined. */ void reply_get_reg(const GdbRegisterValue& value); /** * Send |file| back to the debugger host. |file| may contain * undefined register values. */ void reply_get_regs(const std::vector& file); /** * Pass |ok = true| iff the requested register was successfully set. */ void reply_set_reg(bool ok); /** * Reply to the DREQ_GET_STOP_REASON request. */ void reply_get_stop_reason(GdbThreadId which, int sig); /** * |threads| contains the list of live threads, of which there are * |len|. */ void reply_get_thread_list(const std::vector& threads); /** * |ok| is true if the request was successfully applied, false if * not. */ void reply_watchpoint_request(bool ok); /** * DREQ_DETACH was processed. * * There's no functional reason to reply to the detach request. * However, some versions of gdb expect a response and time out * awaiting it, wasting developer time. */ void reply_detach(); /** * Pass the siginfo_t and its size (as requested by the debugger) in * |si_bytes| and |num_bytes| if successfully read. Otherwise pass * |si_bytes = nullptr|. */ void reply_read_siginfo(const std::vector& si_bytes); /** * Not yet implemented, but call this after a WRITE_SIGINFO request * anyway. */ void reply_write_siginfo(/* TODO*/); /** * Send a manual text response to a rr cmd (maintenance) packet. */ void reply_rr_cmd(const std::string& text); /** * Send a qSymbol response to gdb, requesting the address of the * symbol |name|. */ void send_qsymbol(const std::string& name); /** * The "all done" response to a qSymbol packet from gdb. */ void qsymbols_finished(); /** * Respond to a qGetTLSAddr packet. If |ok| is true, then respond * with |address|. If |ok| is false, respond with an error. */ void reply_tls_addr(bool ok, remote_ptr address); /** * Create a checkpoint of the given Session with the given id. Delete the * existing checkpoint with that id if there is one. */ void created_checkpoint(ReplaySession::shr_ptr& checkpoint, int checkpoint_id); /** * Delete the checkpoint with the given id. Silently fail if the checkpoint * does not exist. */ void delete_checkpoint(int checkpoint_id); /** * Get the checkpoint with the given id. Return null if not found. */ ReplaySession::shr_ptr get_checkpoint(int checkpoint_id); /** * Return true if there's a new packet to be read/process (whether * incomplete or not), and false if there isn't one. */ bool sniff_packet(); const Features& features() { return features_; } enum { CPU_64BIT = 0x1, CPU_AVX = 0x2, }; void set_cpu_features(uint32_t features) { cpu_features_ = features; } uint32_t cpu_features() const { return cpu_features_; } private: GdbConnection(pid_t tgid, const Features& features); /** * Wait for a debugger client to connect to |dbg|'s socket. Blocks * indefinitely. */ void await_debugger(ScopedFd& listen_fd); /** * read() incoming data exactly one time, successfully. May block. */ void read_data_once(); /** * Send all pending output to gdb. May block. */ void write_flush(); void write_data_raw(const uint8_t* data, ssize_t len); void write_hex(unsigned long hex); void write_packet_bytes(const uint8_t* data, size_t num_bytes); void write_packet(const char* data); void write_binary_packet(const char* pfx, const uint8_t* data, ssize_t num_bytes); void write_hex_bytes_packet(const char* prefix, const uint8_t* bytes, size_t len); void write_hex_bytes_packet(const uint8_t* bytes, size_t len); void write_xfer_response(const void* data, size_t size, uint64_t offset, uint64_t len); /** * Consume bytes in the input buffer until start-of-packet ('$') or * the interrupt character is seen. Does not block. Return true if * seen, false if not. */ bool skip_to_packet_start(); /** * Block until the sequence of bytes * * "[^$]*\$[^#]*#.*" * * has been read from the client fd. This is one (or more) gdb * packet(s). */ void read_packet(); /** * Return true if we need to do something in a debugger request, * false if we already handled the packet internally. */ bool xfer(const char* name, char* args); /** * Return true if we need to do something in a debugger request, * false if we already handled the packet internally. */ bool query(char* payload); /** * Return true if we need to do something in a debugger request, * false if we already handled the packet internally. */ bool set_var(char* payload); /** * Return true if we need to do something in a debugger request, * false if we already handled the packet internally. */ bool process_vpacket(char* payload); /** * Return true if we need to do something in a debugger request, * false if we already handled the packet internally. */ bool process_bpacket(char* payload); /** * Return true if we need to do something in a debugger request, * false if we already handled the packet internally. */ bool process_packet(); void consume_request(); void send_stop_reply_packet(GdbThreadId thread, int sig, uintptr_t watch_addr = 0); // Current request to be processed. GdbRequest req; // Thread to be resumed. GdbThreadId resume_thread; // Thread for get/set requests. GdbThreadId query_thread; // gdb and rr don't work well together in multi-process and // multi-exe-image debugging scenarios, so we pretend only // this task group exists when interfacing with gdb pid_t tgid; uint32_t cpu_features_; // true when "no-ack mode" enabled, in which we don't have // to send ack packets back to gdb. This is a huge perf win. bool no_ack; ScopedFd sock_fd; std::vector inbuf; /* buffered input from gdb */ size_t packetend; /* index of '#' character */ std::vector outbuf; /* buffered output for gdb */ Features features_; }; } // namespace rr #endif /* RR_GDB_CONNECTION_H_ */ rr-4.4.0/src/GdbExpression.cc000066400000000000000000000262221277367620400160360ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "GdbExpression.h" #include "GdbServer.h" #include "Task.h" using namespace std; namespace rr { #define WORKAROUND_GDB_BUGS // Extracted from // https://sourceware.org/gdb/current/onlinedocs/gdb/Bytecode-Descriptions.html enum Opcode { OP_float = 0x01, OP_add = 0x02, OP_sub = 0x03, OP_mul = 0x04, OP_div_signed = 0x05, OP_div_unsigned = 0x06, OP_rem_signed = 0x07, OP_rem_unsigned = 0x08, OP_lsh = 0x09, OP_rsh_signed = 0x0a, OP_rsh_unsigned = 0x0b, OP_trace = 0x0c, OP_trace_quick = 0x0d, OP_log_not = 0x0e, OP_bit_and = 0x0f, OP_bit_or = 0x10, OP_bit_xor = 0x11, OP_bit_not = 0x12, OP_equal = 0x13, OP_less_signed = 0x14, OP_less_unsigned = 0x15, OP_ext = 0x16, OP_ref8 = 0x17, OP_ref16 = 0x18, OP_ref32 = 0x19, OP_ref64 = 0x1a, OP_ref_float = 0x1b, OP_ref_double = 0x1c, OP_ref_long_double = 0x1d, OP_l_to_d = 0x1e, OP_d_to_l = 0x1f, OP_if_goto = 0x20, OP_goto = 0x21, OP_const8 = 0x22, OP_const16 = 0x23, OP_const32 = 0x24, OP_const64 = 0x25, OP_reg = 0x26, OP_end = 0x27, OP_dup = 0x28, OP_pop = 0x29, OP_zero_ext = 0x2a, OP_swap = 0x2b, OP_getv = 0x2c, OP_setv = 0x2d, OP_tracev = 0x2e, OP_tracenz = 0x2f, OP_trace16 = 0x30, OP_pick = 0x32, OP_rot = 0x33, OP_printf = 0x34, }; struct ExpressionState { typedef GdbExpression::Value Value; ExpressionState(const vector& bytecode) : bytecode(bytecode), pc(0), error(false), end(false) {} void set_error() { error = true; } // Methods set error to true if there's an error and return some sentinel // Value. Value pop() { if (stack.empty()) { set_error(); return Value(-1); } Value v = stack.back(); stack.pop_back(); return v; } struct BinaryOperands { BinaryOperands(int64_t a = 0, int64_t b = 0) : a(a), b(b) {} int64_t a; int64_t b; }; BinaryOperands pop_a_b() { int64_t b = pop().i; return BinaryOperands(pop().i, b); } int64_t nonzero(int64_t v) { if (!v) { set_error(); return 1; } return v; } int64_t pop_a() { return pop().i; } void push(int64_t i) { stack.push_back(Value(i)); } template T fetch() { if (pc + sizeof(T) > bytecode.size()) { set_error(); return T(-1); } T v = 0; for (size_t i = 0; i < sizeof(T); ++i) { v = (v << 8) | bytecode[pc + i]; } pc += sizeof(T); return v; } template void load(Task* t) { uint64_t addr = pop().i; if (error) { // Don't do unnecessary syscalls if we're already in an error state. return; } bool ok = true; T v = t->read_mem(remote_ptr(addr), &ok); if (!ok) { set_error(); return; } push(v); } void pick(size_t offset) { if (offset >= stack.size()) { set_error(); return; } push(stack[stack.size() - 1 - offset].i); } void step(Task* t) { assert(!error); BinaryOperands operands; switch (fetch()) { case OP_add: operands = pop_a_b(); return push(operands.a + operands.b); case OP_sub: operands = pop_a_b(); return push(operands.a - operands.b); case OP_mul: operands = pop_a_b(); return push(operands.a * operands.b); case OP_div_signed: operands = pop_a_b(); return push(operands.a / nonzero(operands.b)); case OP_div_unsigned: operands = pop_a_b(); return push(uint64_t(operands.a) / uint64_t(nonzero(operands.b))); case OP_rem_signed: operands = pop_a_b(); return push(operands.a % nonzero(operands.b)); case OP_rem_unsigned: operands = pop_a_b(); return push(uint64_t(operands.a) % uint64_t(nonzero(operands.b))); case OP_lsh: operands = pop_a_b(); return push(operands.a << operands.b); case OP_rsh_signed: operands = pop_a_b(); return push(operands.a >> operands.b); case OP_rsh_unsigned: operands = pop_a_b(); return push(uint64_t(operands.a) >> operands.b); case OP_log_not: return push(!pop_a()); case OP_bit_and: operands = pop_a_b(); return push(operands.a & operands.b); case OP_bit_or: operands = pop_a_b(); return push(operands.a | operands.b); case OP_bit_xor: operands = pop_a_b(); return push(operands.a ^ operands.b); case OP_bit_not: return push(~pop_a()); case OP_equal: operands = pop_a_b(); return push(operands.a == operands.b); case OP_less_signed: operands = pop_a_b(); return push(operands.a < operands.b); case OP_less_unsigned: operands = pop_a_b(); return push(uint64_t(operands.a) < uint64_t(operands.b)); case OP_ext: { int64_t n = nonzero(fetch()); if (n >= 64) { return; } int64_t a = pop_a(); int64_t n_mask = (int64_t(1) << n) - 1; int sign_bit = (a >> (n - 1)) & 1; return push((sign_bit * ~n_mask) | (a & n_mask)); } case OP_zero_ext: { int64_t n = fetch(); if (n >= 64) { return; } int64_t a = pop_a(); int64_t n_mask = (int64_t(1) << n) - 1; return push(a & n_mask); } case OP_ref8: return load(t); case OP_ref16: return load(t); case OP_ref32: return load(t); case OP_ref64: return load(t); case OP_dup: return pick(0); case OP_swap: operands = pop_a_b(); push(operands.b); return push(operands.a); case OP_pop: pop_a(); return; case OP_pick: return pick(fetch()); case OP_rot: { int64_t c = pop_a(); int64_t b = pop_a(); int64_t a = pop_a(); push(c); push(b); return push(a); } case OP_if_goto: { uint16_t offset = fetch(); if (pop_a()) { pc = offset; } return; } case OP_goto: pc = fetch(); return; case OP_const8: return push(fetch()); case OP_const16: return push(fetch()); case OP_const32: return push(fetch()); case OP_const64: return push(fetch()); case OP_reg: { GdbRegisterValue v = GdbServer::get_reg(t->regs(), t->extra_regs(), GdbRegister(fetch())); if (!v.defined) { set_error(); return; } switch (v.size) { case 1: return push(v.value1); case 2: return push(v.value2); case 4: return push(v.value4); case 8: return push(v.value8); } set_error(); return; } case OP_end: end = true; return; default: set_error(); return; } } const vector& bytecode; vector stack; size_t pc; bool error; bool end; }; #ifdef WORKAROUND_GDB_BUGS /* https://sourceware.org/bugzilla/show_bug.cgi?id=18617 means that * gdb generates incorrect operands for OP_ext and OP_zero_ext. * We work around this bug by generating all the alternative programs that gdb * maybe should have generated, and evaluating all of them. If they agree on * the result, we return that as the correct result, otherwise we return * failure. */ static int count_variants(int bits) { int result = 1; if (bits > 8) { ++result; } if (bits > 16) { ++result; } if (bits > 32) { ++result; } return result; } template static T fetch(const uint8_t* data, size_t size, size_t pc) { if (pc + sizeof(T) > size) { return T(-1); } T v = 0; for (size_t i = 0; i < sizeof(T); ++i) { v = (v << 8) | data[pc + i]; } return v; } GdbExpression::GdbExpression(const uint8_t* data, size_t size) { vector instruction_starts; instruction_starts.resize(size); fill(instruction_starts.begin(), instruction_starts.end(), false); int64_t num_variants = 1; vector unvisited; unvisited.push_back(0); while (!unvisited.empty()) { size_t pc = unvisited.back(); unvisited.pop_back(); if (pc >= instruction_starts.size() || instruction_starts[pc]) { continue; } instruction_starts[pc] = true; switch (data[pc]) { case OP_ext: case OP_zero_ext: if (pc + 1 < size) { num_variants *= count_variants(data[pc + 1]); if (num_variants > 64) { // Too many variants, giving up on this expression return; } } unvisited.push_back(pc + 2); break; case OP_pick: case OP_const8: unvisited.push_back(pc + 2); break; case OP_if_goto: unvisited.push_back(fetch(data, size, pc + 1)); unvisited.push_back(pc + 3); break; case OP_goto: unvisited.push_back(fetch(data, size, pc + 1)); break; case OP_const16: case OP_reg: unvisited.push_back(pc + 3); break; case OP_const32: unvisited.push_back(pc + 5); break; case OP_const64: unvisited.push_back(pc + 9); break; case OP_end: break; default: unvisited.push_back(pc + 1); break; } } bytecode_variants.push_back(vector(data, data + size)); for (size_t i = 0; i < size; ++i) { if (!instruction_starts[i]) { continue; } if ((data[i] == OP_ext || data[i] == OP_zero_ext) && i + 1 < size) { uint8_t bits = data[i + 1]; vector> variants; for (auto& b : bytecode_variants) { // gdb perhaps should have used a smaller type width here --- 8, 16 or // 32 bits. if (bits > 8) { vector v = b; v[i + 1] = 8; variants.push_back(move(v)); } if (bits > 16) { vector v = b; v[i + 1] = 16; variants.push_back(move(v)); } if (bits > 32) { vector v = b; v[i + 1] = 32; variants.push_back(move(v)); } variants.push_back(move(b)); } bytecode_variants = move(variants); } } } #else GdbExpression::GdbExpression(const uint8_t* data, size_t size) { bytecode_variants.push_back(vector(data, data + size)); } #endif bool GdbExpression::evaluate(Task* t, Value* result) const { if (bytecode_variants.empty()) { return false; } bool first = true; for (auto& b : bytecode_variants) { ExpressionState state(b); for (int steps = 0; !state.end; ++steps) { if (steps >= 10000 || state.error) { return false; } state.step(t); } Value v = state.pop(); if (state.error) { return false; } if (first) { *result = v; first = false; } else if (*result != v) { return false; } } return true; } } // namespace rr rr-4.4.0/src/GdbExpression.h000066400000000000000000000022071277367620400156750ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_GDB_EXPRESSION_H_ #define RR_GDB_EXPRESSION_H_ #include #include #include namespace rr { class Task; /** * gdb has a simple bytecode language for writing expressions to be evaluated * in a remote target. This class implements evaluation of such expressions. * See https://sourceware.org/gdb/current/onlinedocs/gdb/Agent-Expressions.html */ class GdbExpression { public: GdbExpression(const uint8_t* data, size_t size); struct Value { Value(int64_t i = 0) : i(i) {} bool operator==(const Value& v) { return i == v.i; } bool operator!=(const Value& v) { return !(*this == v); } int64_t i; }; /** * If evaluation succeeds, store the final result in *result and return true. * Otherwise return false. */ bool evaluate(Task* t, Value* result) const; private: /** * To work around gdb bugs, we may generate and evaluate multiple versions of * the same expression program. */ std::vector> bytecode_variants; }; } // namespace rr #endif // RR_GDB_EXPRESSION_H_ rr-4.4.0/src/GdbInitCommand.cc000066400000000000000000000012101277367620400160670ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Command.h" #include "GdbServer.h" #include "main.h" using namespace std; namespace rr { class GdbInitCommand : public Command { public: virtual int run(vector& args); protected: GdbInitCommand(const char* name, const char* help) : Command(name, help) {} static GdbInitCommand singleton; }; GdbInitCommand GdbInitCommand::singleton("gdbinit", " rr gdbinit\n"); int GdbInitCommand::run(vector& args) { while (parse_global_option(args)) { } fputs(GdbServer::init_script().c_str(), stdout); return 0; } } // namespace rr rr-4.4.0/src/GdbRegister.h000066400000000000000000000056261277367620400153320ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_GDB_REGISTER_H_ #define RR_GDB_REGISTER_H_ namespace rr { /** * This is the register numbering used by GDB. */ enum GdbRegister { DREG_EAX, DREG_ECX, DREG_EDX, DREG_EBX, DREG_ESP, DREG_EBP, DREG_ESI, DREG_EDI, DREG_EIP, DREG_EFLAGS, DREG_CS, DREG_SS, DREG_DS, DREG_ES, DREG_FS, DREG_GS, DREG_FIRST_FXSAVE_REG, DREG_ST0 = DREG_FIRST_FXSAVE_REG, DREG_ST1, DREG_ST2, DREG_ST3, DREG_ST4, DREG_ST5, DREG_ST6, DREG_ST7, // These are the names GDB gives the registers. DREG_FCTRL, DREG_FSTAT, DREG_FTAG, DREG_FISEG, DREG_FIOFF, DREG_FOSEG, DREG_FOOFF, DREG_FOP, DREG_XMM0, DREG_XMM1, DREG_XMM2, DREG_XMM3, DREG_XMM4, DREG_XMM5, DREG_XMM6, DREG_XMM7, DREG_MXCSR, // XXX the last fxsave reg on *x86* DREG_LAST_FXSAVE_REG = DREG_MXCSR, DREG_ORIG_EAX, DREG_YMM0H, DREG_YMM1H, DREG_YMM2H, DREG_YMM3H, DREG_YMM4H, DREG_YMM5H, DREG_YMM6H, DREG_YMM7H, DREG_NUM_LINUX_I386, // Last register we can find in user_regs_struct // (except for orig_eax). DREG_NUM_USER_REGS = DREG_GS + 1, // x86-64 register numbers DREG_RAX = 0, DREG_RBX, DREG_RCX, DREG_RDX, DREG_RSI, DREG_RDI, DREG_RBP, DREG_RSP, DREG_R8, DREG_R9, DREG_R10, DREG_R11, DREG_R12, DREG_R13, DREG_R14, DREG_R15, DREG_RIP, // Things get a little tricky here, because x86-64 has some registers // named identically to its x86 counterpart, but we've used the names // in the x86 register definitions above, and the numbers they need // to represent are different. Hence the unique names here. DREG_64_EFLAGS, DREG_64_CS, DREG_64_SS, DREG_64_DS, DREG_64_ES, DREG_64_FS, DREG_64_GS, DREG_64_FIRST_FXSAVE_REG, DREG_64_ST0 = DREG_64_FIRST_FXSAVE_REG, DREG_64_ST1, DREG_64_ST2, DREG_64_ST3, DREG_64_ST4, DREG_64_ST5, DREG_64_ST6, DREG_64_ST7, // These are the names GDB gives the registers. DREG_64_FCTRL, DREG_64_FSTAT, DREG_64_FTAG, DREG_64_FISEG, DREG_64_FIOFF, DREG_64_FOSEG, DREG_64_FOOFF, DREG_64_FOP, DREG_64_XMM0, DREG_64_XMM1, DREG_64_XMM2, DREG_64_XMM3, DREG_64_XMM4, DREG_64_XMM5, DREG_64_XMM6, DREG_64_XMM7, DREG_64_XMM8, DREG_64_XMM9, DREG_64_XMM10, DREG_64_XMM11, DREG_64_XMM12, DREG_64_XMM13, DREG_64_XMM14, DREG_64_XMM15, DREG_64_MXCSR, DREG_64_LAST_FXSAVE_REG = DREG_64_MXCSR, DREG_ORIG_RAX, DREG_64_YMM0H, DREG_64_YMM1H, DREG_64_YMM2H, DREG_64_YMM3H, DREG_64_YMM4H, DREG_64_YMM5H, DREG_64_YMM6H, DREG_64_YMM7H, DREG_64_YMM8H, DREG_64_YMM9H, DREG_64_YMM10H, DREG_64_YMM11H, DREG_64_YMM12H, DREG_64_YMM13H, DREG_64_YMM14H, DREG_64_YMM15H, DREG_NUM_LINUX_X86_64, // Last register we can find in user_regs_struct (except for orig_rax). DREG_64_NUM_USER_REGS = DREG_64_GS + 1, }; } // namespace rr #endif /* RR_GDB_REGISTER_H_ */ rr-4.4.0/src/GdbServer.cc000066400000000000000000001345341277367620400151530ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "GdbServer.h" #include #include #include #include #include #include #include #include #include #include #include "BreakpointCondition.h" #include "GdbCommandHandler.h" #include "GdbExpression.h" #include "ReplaySession.h" #include "ScopedFd.h" #include "Task.h" #include "TaskGroup.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" using namespace std; namespace rr { GdbServer::GdbServer(std::unique_ptr& dbg, Task* t) : dbg(std::move(dbg)), debuggee_tguid(t->task_group()->tguid()), last_continue_tuid(t->tuid()), last_query_tuid(t->tuid()), final_event(UINT32_MAX), stop_reason(0), stop_replaying_to_target(false), interrupt_pending(false), emergency_debug_session(&t->session()) {} // Special-sauce macros defined by rr when launching the gdb client, // which implement functionality outside of the gdb remote protocol. // (Don't stare at them too long or you'll go blind ;).) static const string& gdb_rr_macros() { static string s; if (s.empty()) { stringstream ss; ss << "define restart\n" << " run c$arg0\n" << "end\n" // In gdb version "Fedora 7.8.1-30.fc21", a raw "run" command // issued before any user-generated resume-execution command // results in gdb hanging just after the inferior hits an internal // gdb breakpoint. This happens outside of rr, with gdb // controlling gdbserver, as well. We work around that by // ensuring *some* resume-execution command has been issued before // restarting the session. But, only if the inferior hasn't // already finished execution ($_thread != 0). If it has and we // issue the "stepi" command, then gdb refuses to restart // execution. << "define hook-run\n" << " if $_thread != 0 && !$suppress_run_hook\n" << " stepi\n" << " end\n" << "end\n" << "define hookpost-continue\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-step\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-stepi\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-next\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-nexti\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-finish\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-reverse-continue\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-reverse-step\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-reverse-stepi\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-reverse-finish\n" << " set $suppress_run_hook = 1\n" << "end\n" << "define hookpost-run\n" << " set $suppress_run_hook = 0\n" << "end\n" << "set unwindonsignal on\n" << "handle SIGURG stop\n" << "set prompt (rr) \n" << GdbCommandHandler::gdb_macros() // Try both "set target-async" and "maint set target-async" since // that changed recently. << "python-interactive\n" << "import re\n" << "m = re.compile(" << "'.* ([0-9]+)\\.([0-9]+)(\\.([0-9]+))?.*'" << ").match(gdb.execute('show version', False, True))\n" << "ver = int(m.group(1))*10000 + int(m.group(2))*100\n" << "if m.group(4):\n" << " ver = ver + int(m.group(4))\n" << "\n" << "if ver == 71100:\n" << " gdb.write(" << "'This version of gdb (7.11.0) has known bugs that break rr. " << "Install 7.11.1 or later.\\n', gdb.STDERR)\n" << "\n" << "if ver < 71101:\n" << " gdb.execute('set target-async 0')\n" << " gdb.execute('maint set target-async 0')\n"; s = ss.str(); } return s; } /** * Attempt to find the value of |regname| (a DebuggerRegister * name), and if so (i) write it to |buf|; (ii) * set |*defined = true|; (iii) return the size of written * data. If |*defined == false|, the value of |buf| is * meaningless. * * This helper can fetch the values of both general-purpose * and "extra" registers. * * NB: |buf| must be large enough to hold the largest register * value that can be named by |regname|. */ static size_t get_reg(const Registers& regs, const ExtraRegisters& extra_regs, uint8_t* buf, GdbRegister regname, bool* defined) { size_t num_bytes = regs.read_register(buf, regname, defined); if (!*defined) { num_bytes = extra_regs.read_register(buf, regname, defined); } return num_bytes; } /** * Return the register |which|, which may not have a defined value. */ GdbRegisterValue GdbServer::get_reg(const Registers& regs, const ExtraRegisters& extra_regs, GdbRegister which) { GdbRegisterValue reg; memset(®, 0, sizeof(reg)); reg.name = which; reg.size = rr::get_reg(regs, extra_regs, ®.value[0], which, ®.defined); return reg; } static GdbThreadId get_threadid(const Session& session, const TaskUid& tuid) { Task* t = session.find_task(tuid); pid_t pid = t ? t->tgid() : GdbThreadId::ANY.pid; return GdbThreadId(pid, tuid.tid()); } static GdbThreadId get_threadid(Task* t) { return GdbThreadId(t->tgid(), t->rec_tid); } static bool matches_threadid(Task* t, const GdbThreadId& target) { return (target.pid <= 0 || target.pid == t->tgid()) && (target.tid <= 0 || target.tid == t->rec_tid); } static WatchType watchpoint_type(GdbRequestType req) { switch (req) { case DREQ_SET_HW_BREAK: case DREQ_REMOVE_HW_BREAK: return WATCH_EXEC; case DREQ_SET_WR_WATCH: case DREQ_REMOVE_WR_WATCH: return WATCH_WRITE; case DREQ_REMOVE_RDWR_WATCH: case DREQ_SET_RDWR_WATCH: // NB: x86 doesn't support read-only watchpoints (who would // ever want to use one?) so we treat them as readwrite // watchpoints and hope that gdb can figure out what's going // on. That is, if a user ever tries to set a read // watchpoint. case DREQ_REMOVE_RD_WATCH: case DREQ_SET_RD_WATCH: return WATCH_READWRITE; default: FATAL() << "Unknown dbg request " << req; return WatchType(-1); // not reached } } static void maybe_singlestep_for_event(Task* t, GdbRequest* req) { if (!t->session().is_replaying()) { return; } auto rt = static_cast(t); if (trace_instructions_up_to_event( rt->session().current_trace_frame().time())) { fputs("Stepping: ", stderr); t->regs().print_register_file_compact(stderr); fprintf(stderr, " ticks:%" PRId64 "\n", t->tick_count()); *req = GdbRequest(DREQ_CONT); req->suppress_debugger_stop = true; req->cont().actions.push_back( GdbContAction(ACTION_STEP, get_threadid(t->session(), t->tuid()))); } } void GdbServer::dispatch_regs_request(const Registers& regs, const ExtraRegisters& extra_regs) { GdbRegister end; // Send values for all the registers we sent XML register descriptions for. // Those descriptions are controlled by GdbConnection::cpu_features(). bool have_AVX = dbg->cpu_features() & GdbConnection::CPU_AVX; switch (regs.arch()) { case x86: end = have_AVX ? DREG_YMM7H : DREG_ORIG_EAX; break; case x86_64: end = have_AVX ? DREG_64_YMM15H : DREG_ORIG_RAX; break; default: FATAL() << "Unknown architecture"; return; } vector rs; for (GdbRegister r = GdbRegister(0); r < end; r = GdbRegister(r + 1)) { rs.push_back(get_reg(regs, extra_regs, r)); } dbg->reply_get_regs(rs); } class GdbBreakpointCondition : public BreakpointCondition { public: GdbBreakpointCondition(const vector>& bytecodes) { for (auto& b : bytecodes) { expressions.push_back(GdbExpression(b.data(), b.size())); } } virtual bool evaluate(Task* t) const { for (auto& e : expressions) { GdbExpression::Value v; // Break if evaluation fails or the result is nonzero if (!e.evaluate(t, &v) || v.i != 0) { return true; } } return false; } private: vector expressions; }; static unique_ptr breakpoint_condition( const GdbRequest& request) { if (request.watch().conditions.empty()) { return nullptr; } return unique_ptr( new GdbBreakpointCondition(request.watch().conditions)); } static bool search_memory(Task* t, const MemoryRange& where, const vector& find, remote_ptr* result) { vector buf; buf.resize(page_size() + find.size() - 1); for (const auto& m : t->vm()->maps()) { MemoryRange r = MemoryRange(m.map.start(), m.map.end() + find.size() - 1) .intersect(where); // We basically read page by page here, but we read past the end of the // page to handle the case where a found string crosses page boundaries. // This approach isn't great for handling long search strings but gdb's find // command isn't really suited to that. // Reading page by page lets us avoid problems where some pages in a // mapping aren't readable (e.g. reading beyond end of file). while (r.size() >= find.size()) { ssize_t nread = t->read_bytes_fallible( r.start(), std::min(buf.size(), r.size()), buf.data()); if (nread >= ssize_t(find.size())) { void* found = memmem(buf.data(), nread, find.data(), find.size()); if (found) { *result = r.start() + (static_cast(found) - buf.data()); return true; } } r = MemoryRange( std::min(r.end(), floor_page_size(r.start()) + page_size()), r.end()); } } return false; } void GdbServer::dispatch_debugger_request(Session& session, const GdbRequest& req, ReportState state) { assert(!req.is_resume_request()); // These requests don't require a target task. switch (req.type) { case DREQ_RESTART: assert(false); return; // unreached case DREQ_GET_CURRENT_THREAD: dbg->reply_get_current_thread(get_threadid(session, last_continue_tuid)); return; case DREQ_GET_OFFSETS: /* TODO */ dbg->reply_get_offsets(); return; case DREQ_GET_THREAD_LIST: { vector tids; if (state != REPORT_THREADS_DEAD) { for (auto& kv : session.tasks()) { tids.push_back(get_threadid(session, kv.second->tuid())); } } dbg->reply_get_thread_list(tids); return; } case DREQ_INTERRUPT: { Task* t = session.find_task(last_continue_tuid); ASSERT(t, session.is_diversion()) << "Replay interrupts should be handled at a higher level"; assert(!t || t->task_group()->tguid() == debuggee_tguid); dbg->notify_stop(t ? get_threadid(t) : GdbThreadId(), 0); stop_reason = 0; if (t) { last_query_tuid = last_continue_tuid = t->tuid(); } return; } default: /* fall through to next switch stmt */ break; } bool is_query = req.type != DREQ_SET_CONTINUE_THREAD; Task* target = req.target.tid > 0 ? session.find_task(req.target.tid) : session.find_task(is_query ? last_query_tuid : last_continue_tuid); if (target) { if (is_query) { last_query_tuid = target->tuid(); } else { last_continue_tuid = target->tuid(); } } // These requests query or manipulate which task is the // target, so it's OK if the task doesn't exist. switch (req.type) { case DREQ_GET_IS_THREAD_ALIVE: dbg->reply_get_is_thread_alive(target != nullptr); return; case DREQ_GET_THREAD_EXTRA_INFO: dbg->reply_get_thread_extra_info(target->name()); return; case DREQ_SET_CONTINUE_THREAD: dbg->reply_select_thread(target != nullptr); return; case DREQ_SET_QUERY_THREAD: dbg->reply_select_thread(target != nullptr); return; default: // fall through to next switch stmt break; } // These requests require a valid target task. We don't trust // the debugger to use the information provided above to only // query valid tasks. if (!target) { dbg->notify_no_such_thread(req); return; } switch (req.type) { case DREQ_GET_AUXV: { dbg->reply_get_auxv(target->vm()->saved_auxv()); return; } case DREQ_GET_MEM: { vector mem; mem.resize(req.mem().len); ssize_t nread = target->read_bytes_fallible(req.mem().addr, req.mem().len, mem.data()); mem.resize(max(ssize_t(0), nread)); target->vm()->replace_breakpoints_with_original_values( mem.data(), mem.size(), req.mem().addr); dbg->reply_get_mem(mem); return; } case DREQ_SET_MEM: { // gdb has been observed to send requests of length 0 at // odd times // (e.g. before sending the magic write to create a checkpoint) if (req.mem().len == 0) { dbg->reply_set_mem(true); return; } // We only allow the debugger to write memory if the // memory will be written to an diversion session. // Arbitrary writes to replay sessions cause // divergence. if (!session.is_diversion()) { LOG(error) << "Attempt to write memory outside diversion session"; dbg->reply_set_mem(false); return; } LOG(debug) << "Writing " << req.mem().len << " bytes to " << HEX(req.mem().addr); // TODO fallible target->write_bytes_helper(req.mem().addr, req.mem().len, req.mem().data.data()); dbg->reply_set_mem(true); return; } case DREQ_SEARCH_MEM: { remote_ptr addr; bool found = search_memory(target, MemoryRange(req.mem().addr, req.mem().len), req.mem().data, &addr); dbg->reply_search_mem(found, addr); return; } case DREQ_GET_REG: { GdbRegisterValue reg = get_reg(target->regs(), target->extra_regs(), req.reg().name); dbg->reply_get_reg(reg); return; } case DREQ_GET_REGS: { dispatch_regs_request(target->regs(), target->extra_regs()); return; } case DREQ_SET_REG: { if (!session.is_diversion()) { // gdb sets orig_eax to -1 during a restart. For a // replay session this is not correct (we might be // restarting from an rr checkpoint inside a system // call, and we must not tamper with replay state), so // just ignore it. if ((target->arch() == x86 && req.reg().name == DREG_ORIG_EAX) || (target->arch() == x86_64 && req.reg().name == DREG_ORIG_RAX)) { dbg->reply_set_reg(true); return; } LOG(error) << "Attempt to write register outside diversion session"; dbg->reply_set_reg(false); return; } if (req.reg().defined) { Registers regs = target->regs(); regs.write_register(req.reg().name, req.reg().value, req.reg().size); target->set_regs(regs); } dbg->reply_set_reg(true /*currently infallible*/); return; } case DREQ_GET_STOP_REASON: { dbg->reply_get_stop_reason(get_threadid(session, last_continue_tuid), stop_reason); return; } case DREQ_SET_SW_BREAK: { ASSERT(target, req.watch().kind == sizeof(AddressSpace::breakpoint_insn)) << "Debugger setting bad breakpoint insn"; // Mirror all breakpoint/watchpoint sets/unsets to the target process // if it's not part of the timeline (i.e. it's a diversion). ReplayTask* replay_task = timeline.current_session().find_task(target->tuid()); bool ok = timeline.add_breakpoint(replay_task, req.watch().addr, breakpoint_condition(req)); if (ok && &session != &timeline.current_session()) { bool diversion_ok = target->vm()->add_breakpoint(req.watch().addr, BKPT_USER); ASSERT(target, diversion_ok); } dbg->reply_watchpoint_request(ok); return; } case DREQ_SET_HW_BREAK: case DREQ_SET_RD_WATCH: case DREQ_SET_WR_WATCH: case DREQ_SET_RDWR_WATCH: { ReplayTask* replay_task = timeline.current_session().find_task(target->tuid()); bool ok = timeline.add_watchpoint( replay_task, req.watch().addr, req.watch().kind, watchpoint_type(req.type), breakpoint_condition(req)); if (ok && &session != &timeline.current_session()) { bool diversion_ok = target->vm()->add_watchpoint( req.watch().addr, req.watch().kind, watchpoint_type(req.type)); ASSERT(target, diversion_ok); } dbg->reply_watchpoint_request(ok); return; } case DREQ_REMOVE_SW_BREAK: { ReplayTask* replay_task = timeline.current_session().find_task(target->tuid()); timeline.remove_breakpoint(replay_task, req.watch().addr); if (&session != &timeline.current_session()) { target->vm()->remove_breakpoint(req.watch().addr, BKPT_USER); } dbg->reply_watchpoint_request(true); return; } case DREQ_REMOVE_HW_BREAK: case DREQ_REMOVE_RD_WATCH: case DREQ_REMOVE_WR_WATCH: case DREQ_REMOVE_RDWR_WATCH: { ReplayTask* replay_task = timeline.current_session().find_task(target->tuid()); timeline.remove_watchpoint(replay_task, req.watch().addr, req.watch().kind, watchpoint_type(req.type)); if (&session != &timeline.current_session()) { target->vm()->remove_watchpoint(req.watch().addr, req.watch().kind, watchpoint_type(req.type)); } dbg->reply_watchpoint_request(true); return; } case DREQ_READ_SIGINFO: LOG(warn) << "READ_SIGINFO request outside of diversion session"; dbg->reply_read_siginfo(vector()); return; case DREQ_WRITE_SIGINFO: LOG(warn) << "WRITE_SIGINFO request outside of diversion session"; dbg->reply_write_siginfo(); return; case DREQ_RR_CMD: dbg->reply_rr_cmd( GdbCommandHandler::process_command(*this, target, req.text())); return; case DREQ_QSYMBOL: { // When gdb sends "qSymbol::", it means that gdb is ready to // respond to symbol requests. This can be sent multiple times // during the course of a session -- gdb sends it whenever // something in the inferior has changed, making it possible // that previous failed symbol lookups could now succeed. In // response to a qSymbol request from gdb, we either send back a // qSymbol response, requesting the address of a symbol; or we // send back OK. We have to do this as an ordinary response and // maintain our own state explicitly, as opposed to simply // reading another packet from gdb, because when gdb looks up a // symbol it might send other requests that must be served. So, // we keep a copy of the symbol names, and an iterator into this // copy. When gdb sends a plain "qSymbol::" packet, because gdb // has detected some change in the inferior state that might // enable more symbol lookups, we restart the iterator. const string& name = req.sym().name; if (req.sym().has_address) { // Got a response holding a previously-requested symbol's name // and address. target->register_symbol(name, req.sym().address); } else if (name == "") { // Plain "qSymbol::" request. symbols = target->get_symbols_and_clear_map(); symbols_iter = symbols.begin(); } if (symbols_iter == symbols.end()) { dbg->qsymbols_finished(); } else { string symbol = *symbols_iter++; dbg->send_qsymbol(symbol); } return; } case DREQ_TLS: { remote_ptr address; bool ok = target->get_tls_address(req.tls().offset, req.tls().load_module, &address); dbg->reply_tls_addr(ok, address); return; } default: FATAL() << "Unknown debugger request " << req.type; } } bool GdbServer::diverter_process_debugger_requests( DiversionSession& diversion_session, uint32_t& diversion_refcount, GdbRequest* req) { while (true) { *req = dbg->get_request(); if (req->is_resume_request()) { return diversion_refcount > 0; } switch (req->type) { case DREQ_RESTART: case DREQ_DETACH: diversion_refcount = 0; return false; case DREQ_READ_SIGINFO: { LOG(debug) << "Adding ref to diversion session"; ++diversion_refcount; // TODO: maybe share with replayer.cc? vector si_bytes; si_bytes.resize(req->mem().len); memset(si_bytes.data(), 0, si_bytes.size()); dbg->reply_read_siginfo(si_bytes); continue; } case DREQ_SET_QUERY_THREAD: { if (req->target.tid) { Task* next = diversion_session.find_task(req->target.tid); if (next) { last_query_tuid = next->tuid(); } } break; } case DREQ_WRITE_SIGINFO: LOG(debug) << "Removing reference to diversion session ..."; assert(diversion_refcount > 0); --diversion_refcount; if (diversion_refcount == 0) { LOG(debug) << " ... dying at next continue request"; } dbg->reply_write_siginfo(); continue; case DREQ_RR_CMD: { assert(req->type == DREQ_RR_CMD); Task* task = diversion_session.find_task(last_continue_tuid); if (task) { std::string reply = GdbCommandHandler::process_command(*this, task, req->text()); // Certain commands cause the diversion to end immediately // while other commands must work within a diversion. if (reply == GdbCommandHandler::cmd_end_diversion()) { diversion_refcount = 0; return false; } dbg->reply_rr_cmd(reply); continue; } else { diversion_refcount = 0; return false; } break; } default: break; } dispatch_debugger_request(diversion_session, *req, REPORT_NORMAL); } } static bool is_last_thread_exit(const BreakStatus& break_status) { return break_status.task_exit && break_status.task->task_group()->task_set().size() == 1; } static Task* is_in_exec(ReplayTimeline& timeline) { Task* t = timeline.current_session().current_task(); return t && timeline.current_session().next_step_is_syscall_exit( syscall_number_for_execve(t->arch())) ? t : nullptr; } void GdbServer::maybe_notify_stop(const GdbRequest& req, const BreakStatus& break_status) { int sig = -1; remote_ptr watch_addr; if (!break_status.watchpoints_hit.empty()) { sig = SIGTRAP; watch_addr = break_status.watchpoints_hit[0].addr; } if (break_status.breakpoint_hit || break_status.singlestep_complete) { sig = SIGTRAP; } if (break_status.signal) { sig = break_status.signal; } if (is_last_thread_exit(break_status) && dbg->features().reverse_execution) { if (req.cont().run_direction == RUN_FORWARD) { // The exit of the last task in a task group generates a fake SIGKILL, // when reverse-execution is enabled, because users often want to run // backwards from the end of the task. sig = SIGKILL; } else { // The start of the debuggee task-group should trigger a silent stop. sig = 0; } } Task* t = break_status.task; Task* in_exec_task = is_in_exec(timeline); if (in_exec_task) { sig = 0; t = in_exec_task; } if (sig >= 0 && t->task_group()->tguid() == debuggee_tguid) { /* Notify the debugger and process any new requests * that might have triggered before resuming. */ dbg->notify_stop(get_threadid(t), sig, watch_addr.as_int()); stop_reason = sig; last_query_tuid = last_continue_tuid = t->tuid(); } } static RunCommand compute_run_command_from_actions(Task* t, const GdbRequest& req, int* signal_to_deliver) { for (auto& action : req.cont().actions) { if (matches_threadid(t, action.target)) { // We can only run task |t|; neither diversion nor replay sessions // support running multiple threads. So even if gdb tells us to continue // multiple threads, we don't do that. *signal_to_deliver = action.signal_to_deliver; return action.type == ACTION_STEP ? RUN_SINGLESTEP : RUN_CONTINUE; } } // gdb told us to run (or step) some thread that's not |t|, without resuming // |t|. It sometimes does this even though its target thread is entering a // blocking syscall and |t| must run before gdb's target thread can make // progress. So, allow |t| to run anyway. *signal_to_deliver = 0; return RUN_CONTINUE; } struct AllowedTasks { TaskUid task; // tid 0 means 'any member of debuggee_tguid' RunCommand command; }; static RunCommand compute_run_command_for_reverse_exec( Session& session, const TaskGroupUid& debuggee_tguid, const GdbRequest& req, vector& allowed_tasks) { // Singlestep if any of the actions request singlestepping. RunCommand result = RUN_CONTINUE; for (auto& action : req.cont().actions) { if (action.target.pid > 0 && action.target.pid != debuggee_tguid.tid()) { continue; } AllowedTasks allowed; allowed.command = RUN_CONTINUE; if (action.type == ACTION_STEP) { allowed.command = result = RUN_SINGLESTEP; } if (action.target.tid > 0) { Task* t = session.find_task(action.target.tid); if (t) { allowed.task = t->tuid(); } } allowed_tasks.push_back(allowed); } return result; } /** * Create a new diversion session using |replay| session as the * template. The |replay| session isn't mutated. * * Execution begins in the new diversion session under the control of * |dbg| starting with initial thread target |task|. The diversion * session ends at the request of |dbg|, and |req| returns the first * request made that wasn't handled by the diversion session. That * is, the first request that should be handled by |replay| upon * resuming execution in that session. */ GdbRequest GdbServer::divert(ReplaySession& replay) { GdbRequest req; LOG(debug) << "Starting debugging diversion for " << &replay; if (timeline.is_running()) { // Ensure breakpoints and watchpoints are applied before we fork the // diversion, to ensure the diversion is consistent with the timeline // breakpoint/watchpoint state. timeline.apply_breakpoints_and_watchpoints(); } DiversionSession::shr_ptr diversion_session = replay.clone_diversion(); uint32_t diversion_refcount = 1; TaskUid saved_query_tuid = last_query_tuid; while (diverter_process_debugger_requests(*diversion_session, diversion_refcount, &req)) { assert(req.is_resume_request()); if (req.cont().run_direction == RUN_BACKWARD) { // We don't support reverse execution in a diversion. Just issue // an immediate stop. dbg->notify_stop(get_threadid(*diversion_session, last_continue_tuid), 0); stop_reason = 0; last_query_tuid = last_continue_tuid; continue; } Task* t = diversion_session->find_task(last_continue_tuid); if (!t) { diversion_refcount = 0; req = GdbRequest(DREQ_NONE); break; } int signal_to_deliver; RunCommand command = compute_run_command_from_actions(t, req, &signal_to_deliver); auto result = diversion_session->diversion_step(t, command, signal_to_deliver); if (result.status == DiversionSession::DIVERSION_EXITED) { diversion_refcount = 0; req = GdbRequest(DREQ_NONE); break; } assert(result.status == DiversionSession::DIVERSION_CONTINUE); maybe_notify_stop(req, result.break_status); } LOG(debug) << "... ending debugging diversion"; assert(diversion_refcount == 0); diversion_session->kill_all_tasks(); last_query_tuid = saved_query_tuid; return req; } /** * Reply to debugger requests until the debugger asks us to resume * execution, detach, restart, or interrupt. */ GdbRequest GdbServer::process_debugger_requests(ReportState state) { while (true) { GdbRequest req = dbg->get_request(); req.suppress_debugger_stop = false; try_lazy_reverse_singlesteps(req); if (req.type == DREQ_READ_SIGINFO) { // TODO: we send back a dummy siginfo_t to gdb // so that it thinks the request succeeded. // If we don't, then it thinks the // READ_SIGINFO failed and won't attempt to // send WRITE_SIGINFO. For |call foo()| // frames, that means we don't know when the // diversion session is ending. vector si_bytes; si_bytes.resize(req.mem().len); memset(si_bytes.data(), 0, si_bytes.size()); dbg->reply_read_siginfo(si_bytes); req = divert(timeline.current_session()); if (req.type == DREQ_NONE) { continue; } // Carry on to process the request that was rejected by // the diversion session } if (req.is_resume_request()) { Task* t = current_session().find_task(last_continue_tuid); if (t) { maybe_singlestep_for_event(t, &req); } return req; } if (req.type == DREQ_INTERRUPT) { LOG(debug) << " request to interrupt"; return req; } if (req.type == DREQ_RESTART) { // Debugger client requested that we restart execution // from the beginning. Restart our debug session. LOG(debug) << " request to restart at event " << req.restart().param; return req; } if (req.type == DREQ_DETACH) { LOG(debug) << " debugger detached"; dbg->reply_detach(); return req; } dispatch_debugger_request(current_session(), req, state); } } void GdbServer::try_lazy_reverse_singlesteps(GdbRequest& req) { if (!timeline.is_running()) { return; } ReplayTimeline::Mark now; bool need_seek = false; ReplayTask* t = timeline.current_session().current_task(); while (t && req.type == DREQ_CONT && req.cont().run_direction == RUN_BACKWARD && req.cont().actions.size() == 1 && req.cont().actions[0].type == ACTION_STEP && req.cont().actions[0].signal_to_deliver == 0 && matches_threadid(t, req.cont().actions[0].target) && !req.suppress_debugger_stop) { if (!now) { now = timeline.mark(); } ReplayTimeline::Mark previous = timeline.lazy_reverse_singlestep(now, t); if (!previous) { break; } now = previous; need_seek = true; BreakStatus break_status; break_status.task = t; break_status.singlestep_complete = true; LOG(debug) << " using lazy reverse-singlestep"; maybe_notify_stop(req, break_status); while (true) { req = dbg->get_request(); req.suppress_debugger_stop = false; if (req.type != DREQ_GET_REGS) { break; } LOG(debug) << " using lazy reverse-singlestep registers"; dispatch_regs_request(now.regs(), now.extra_regs()); } } if (need_seek) { timeline.seek_to_mark(now); } } bool GdbServer::detach_or_restart(const GdbRequest& req, ContinueOrStop* s) { if (DREQ_RESTART == req.type) { restart_session(req); *s = CONTINUE_DEBUGGING; return true; } if (DREQ_DETACH == req.type) { *s = STOP_DEBUGGING; return true; } return false; } GdbServer::ContinueOrStop GdbServer::handle_exited_state( GdbRequest& last_resume_request) { // TODO return real exit code, if it's useful. dbg->notify_exit_code(0); final_event = timeline.current_session().trace_reader().time(); GdbRequest req = process_debugger_requests(REPORT_THREADS_DEAD); ContinueOrStop s; if (detach_or_restart(req, &s)) { last_resume_request = GdbRequest(); return s; } FATAL() << "Received continue/interrupt request after end-of-trace."; return STOP_DEBUGGING; } GdbServer::ContinueOrStop GdbServer::debug_one_step( GdbRequest& last_resume_request) { ReplayResult result; GdbRequest req; if (in_debuggee_end_state) { // Treat the state where the last thread is about to exit like // termination. req = process_debugger_requests(); // If it's a forward execution request, fake the exited state. if (req.is_resume_request() && req.cont().run_direction == RUN_FORWARD) { if (interrupt_pending) { // Just process this. We're getting it after a restart. } else { return handle_exited_state(last_resume_request); } } else { in_debuggee_end_state = false; } // Otherwise (e.g. detach, restart, interrupt or reverse-exec) process // the request as normal. } else if (!interrupt_pending || last_resume_request.type == DREQ_NONE) { req = process_debugger_requests(); } else { req = last_resume_request; } ContinueOrStop s; if (detach_or_restart(req, &s)) { last_resume_request = GdbRequest(); return s; } if (req.is_resume_request()) { last_resume_request = req; } else { assert(req.type == DREQ_INTERRUPT); interrupt_pending = true; req = last_resume_request; assert(req.is_resume_request()); } if (interrupt_pending) { Task* t = timeline.current_session().current_task(); if (t->task_group()->tguid() == debuggee_tguid) { interrupt_pending = false; dbg->notify_stop(get_threadid(t), in_debuggee_end_state ? SIGKILL : 0); stop_reason = 0; return CONTINUE_DEBUGGING; } } if (req.cont().run_direction == RUN_FORWARD) { if (is_in_exec(timeline) && timeline.current_session().current_task()->task_group()->tguid() == debuggee_tguid) { // Don't go any further forward. maybe_notify_stop will generate a // stop. result = ReplayResult(); } else { int signal_to_deliver; RunCommand command = compute_run_command_from_actions( timeline.current_session().current_task(), req, &signal_to_deliver); // Ignore gdb's |signal_to_deliver|; we just have to follow the replay. result = timeline.replay_step_forward(command, target.event); } if (result.status == REPLAY_EXITED) { return handle_exited_state(last_resume_request); } } else { vector allowed_tasks; // Convert the tids in GdbContActions into TaskUids to avoid issues // if tids get reused. RunCommand command = compute_run_command_for_reverse_exec( timeline.current_session(), debuggee_tguid, req, allowed_tasks); auto stop_filter = [&](Task* t) -> bool { if (t->task_group()->tguid() != debuggee_tguid) { return false; } // If gdb's requested actions don't allow the task to run, we still // let it run (we can't do anything else, since we're replaying), but // we won't report stops in that task. for (auto& a : allowed_tasks) { if (a.task.tid() == 0 || a.task == t->tuid()) { return true; } } return false; }; auto interrupt_check = [&]() { return dbg->sniff_packet(); }; switch (command) { case RUN_CONTINUE: result = timeline.reverse_continue(stop_filter, interrupt_check); break; case RUN_SINGLESTEP: { Task* t = timeline.current_session().find_task(last_continue_tuid); assert(t); result = timeline.reverse_singlestep( last_continue_tuid, t->tick_count(), stop_filter, interrupt_check); break; } default: assert(0 && "Unknown RunCommand"); } if (result.status == REPLAY_EXITED) { return handle_exited_state(last_resume_request); } } if (!req.suppress_debugger_stop) { maybe_notify_stop(req, result.break_status); } if (req.cont().run_direction == RUN_FORWARD && is_last_thread_exit(result.break_status) && result.break_status.task->task_group()->tguid() == debuggee_tguid) { in_debuggee_end_state = true; } return CONTINUE_DEBUGGING; } bool GdbServer::at_target() { // Don't launch the debugger for the initial rr fork child. // No one ever wants that to happen. if (!timeline.current_session().done_initial_exec()) { return false; } Task* t = timeline.current_session().current_task(); if (!t) { return false; } if (!timeline.can_add_checkpoint()) { return false; } if (stop_replaying_to_target) { return true; } // When we decide to create the debugger, we may end up // creating a checkpoint. In that case, we want the // checkpoint to retain the state it had *before* we started // replaying the next frame. Otherwise, the TraceIfstream // will be one frame ahead of its tracee tree. // // So we make the decision to create the debugger based on the // frame we're *about to* replay, without modifying the // TraceIfstream. // NB: we'll happily attach to whichever task within the // group happens to be scheduled here. We don't take // "attach to process" to mean "attach to thread-group // leader". return timeline.current_session().current_trace_frame().time() > target.event && (!target.pid || t->tgid() == target.pid) && (!target.require_exec || t->execed()) && // Ensure we're at the start of processing an event. We don't // want to attach while we're finishing an exec() since that's a // slightly confusing state for ReplayTimeline's reverse execution. !timeline.current_session().current_step_key().in_execution(); } /** * The trace has reached the event at which the user wanted to start debugging. * Set up the appropriate state. */ void GdbServer::activate_debugger() { TraceFrame next_frame = timeline.current_session().current_trace_frame(); TraceFrame::Time event_now = next_frame.time(); if (!stop_replaying_to_target && (target.event > 0 || target.pid)) { fprintf(stderr, "\a\n" "--------------------------------------------------\n" " ---> Reached target process %d at event %u.\n" "--------------------------------------------------\n", target.pid, event_now); } Task* t = timeline.current_session().current_task(); // Store the current tgid and event as the "execution target" // for the next replay session, if we end up restarting. This // allows us to determine if a later session has reached this // target without necessarily replaying up to this point. target.pid = t->tgid(); target.require_exec = false; target.event = event_now; last_query_tuid = last_continue_tuid = t->tuid(); // Have the "checkpoint" be the original replay // session, and then switch over to using the cloned // session. The cloned tasks will look like children // of the clonees, so this scheme prevents |pstree| // output from getting /too/ far out of whack. const char* where = "???"; if (timeline.can_add_checkpoint()) { debugger_restart_checkpoint = Checkpoint(timeline, last_continue_tuid, Checkpoint::EXPLICIT, where); } else { debugger_restart_checkpoint = Checkpoint(timeline, last_continue_tuid, Checkpoint::NOT_EXPLICIT, where); } } void GdbServer::restart_session(const GdbRequest& req) { assert(req.type == DREQ_RESTART); assert(dbg); in_debuggee_end_state = false; timeline.remove_breakpoints_and_watchpoints(); Checkpoint checkpoint_to_restore; if (req.restart().type == RESTART_FROM_CHECKPOINT) { auto it = checkpoints.find(req.restart().param); if (it == checkpoints.end()) { cout << "Checkpoint " << req.restart().param_str << " not found.\n"; cout << "Valid checkpoints:"; for (auto& c : checkpoints) { cout << " " << c.first; } cout << "\n"; dbg->notify_restart_failed(); return; } checkpoint_to_restore = it->second; } else if (req.restart().type == RESTART_FROM_PREVIOUS) { checkpoint_to_restore = debugger_restart_checkpoint; } interrupt_pending = true; if (checkpoint_to_restore.mark) { timeline.seek_to_mark(checkpoint_to_restore.mark); last_query_tuid = last_continue_tuid = checkpoint_to_restore.last_continue_tuid; if (debugger_restart_checkpoint.is_explicit == Checkpoint::EXPLICIT) { timeline.remove_explicit_checkpoint(debugger_restart_checkpoint.mark); } debugger_restart_checkpoint = checkpoint_to_restore; if (timeline.can_add_checkpoint()) { timeline.add_explicit_checkpoint(); } return; } stop_replaying_to_target = false; assert(req.restart().type == RESTART_FROM_EVENT); // Note that we don't reset the target pid; we intentionally keep targeting // the same process no matter what is running when we hit the event. target.event = req.restart().param; target.event = min(final_event - 1, target.event); timeline.seek_to_before_event(target.event); do { ReplayResult result = timeline.replay_step_forward(RUN_CONTINUE, target.event); // We should never reach the end of the trace without hitting the stop // condition below. assert(result.status != REPLAY_EXITED); if (is_last_thread_exit(result.break_status) && result.break_status.task->task_group()->tgid == target.pid) { // Debuggee task is about to exit. Stop here. in_debuggee_end_state = true; break; } } while (!at_target()); activate_debugger(); } static uint32_t get_cpu_features(SupportedArch arch) { uint32_t cpu_features; switch (arch) { case x86: cpu_features = 0; break; case x86_64: cpu_features = GdbConnection::CPU_64BIT; break; default: FATAL() << "Unknown architecture"; return 0; } unsigned int AVX_cpuid_flags = AVX_FEATURE_FLAG | OSXSAVE_FEATURE_FLAG; auto cpuid_data = cpuid(CPUID_GETFEATURES, 0); // We're assuming here that AVX support on the system making the recording // is the same as the AVX support during replay. But if that's not true, // rr is totally broken anyway. if ((cpuid_data.ecx & AVX_cpuid_flags) == AVX_cpuid_flags) { cpu_features |= GdbConnection::CPU_AVX; } return cpu_features; } static unique_ptr await_connection( Task* t, unsigned short port, GdbConnection::ProbePort probe, const GdbConnection::Features& features, ScopedFd* client_params_fd = nullptr) { auto result = GdbConnection::await_client_connection( port, probe, t->tgid(), t->vm()->exe_image(), features, client_params_fd); result->set_cpu_features(get_cpu_features(t->arch())); return result; } void GdbServer::serve_replay(const ConnectionFlags& flags) { do { ReplayResult result = timeline.replay_step_forward(RUN_CONTINUE, target.event); if (result.status == REPLAY_EXITED) { LOG(info) << "Debugger was not launched before end of trace"; return; } } while (!at_target()); unsigned short port = flags.dbg_port > 0 ? flags.dbg_port : getpid(); // Don't probe if the user specified a port. Explicitly // selecting a port is usually done by scripts, which would // presumably break if a different port were to be selected by // rr (otherwise why would they specify a port in the first // place). So fail with a clearer error message. auto probe = flags.dbg_port > 0 ? GdbConnection::DONT_PROBE : GdbConnection::PROBE_PORT; Task* t = timeline.current_session().current_task(); dbg = await_connection(t, port, probe, GdbConnection::Features(), flags.debugger_params_write_pipe); if (flags.debugger_params_write_pipe) { flags.debugger_params_write_pipe->close(); } debuggee_tguid = t->task_group()->tguid(); TraceFrame::Time first_run_event = t->vm()->first_run_event(); if (first_run_event) { timeline.set_reverse_execution_barrier_event(first_run_event); } activate_debugger(); GdbRequest last_resume_request; while (debug_one_step(last_resume_request) == CONTINUE_DEBUGGING) { } LOG(debug) << "debugger server exiting ..."; } static string create_gdb_command_file(const string& macros) { char tmp[] = "/tmp/rr-gdb-commands-XXXXXX"; // This fd is just leaked. That's fine since we only call this once // per rr invocation at the moment. int fd = mkstemp(tmp); unlink(tmp); ssize_t len = macros.size(); int written = write(fd, macros.c_str(), len); if (written != len) { FATAL() << "Failed to write gdb command file"; } stringstream procfile; procfile << "/proc/" << getpid() << "/fd/" << fd; return procfile.str(); } void GdbServer::launch_gdb(ScopedFd& params_pipe_fd, const string& gdb_binary_file_path, const vector& gdb_options) { auto macros = gdb_rr_macros(); string gdb_command_file = create_gdb_command_file(macros); vector options = gdb_options; options.push_back("-x"); options.push_back(gdb_command_file); GdbConnection::launch_gdb(params_pipe_fd, gdb_binary_file_path, options); } void GdbServer::emergency_debug(Task* t) { // See the comment in |guard_overshoot()| explaining why we do // this. Unlike in that context though, we don't know if |t| // overshot an internal breakpoint. If it did, cover that // breakpoint up. if (t->vm()) { t->vm()->remove_all_breakpoints(); } // Don't launch a debugger on fatal errors; the user is most // likely already in a debugger, and wouldn't be able to // control another session. Instead, launch a new GdbServer and wait for // the user to connect from another window. GdbConnection::Features features; // Don't advertise reverse_execution to gdb becase a) it won't work and // b) some gdb versions will fail if the user doesn't turn off async // mode (and we don't want to require users to do that) features.reverse_execution = false; unique_ptr dbg = await_connection(t, t->tid, GdbConnection::PROBE_PORT, features); GdbServer(dbg, t).process_debugger_requests(); } string GdbServer::init_script() { return gdb_rr_macros(); } } // namespace rr rr-4.4.0/src/GdbServer.h000066400000000000000000000222261277367620400150070ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_GDB_SERVER_H_ #define RR_GDB_SERVER_H_ #include #include #include #include "DiversionSession.h" #include "GdbConnection.h" #include "ReplaySession.h" #include "ReplayTimeline.h" #include "ScopedFd.h" #include "TraceFrame.h" namespace rr { class GdbServer { // Not ideal but we can't inherit friend from GdbCommand friend std::string invoke_checkpoint(GdbServer&, Task*, const std::vector&); friend std::string invoke_delete_checkpoint(GdbServer&, Task*, const std::vector&); friend std::string invoke_info_checkpoints(GdbServer&, Task*, const std::vector&); public: struct Target { Target() : pid(0), require_exec(false), event(0) {} // Target process to debug, or 0 to just debug the first process pid_t pid; // If true, wait for the target process to exec() before attaching debugger bool require_exec; // Wait until at least 'event' has elapsed before attaching TraceFrame::Time event; }; struct ConnectionFlags { // -1 to let GdbServer choose the port, a positive integer to select a // specific port to listen on. int dbg_port; // If non-null, then when the gdbserver is set up, we write its connection // parameters through this pipe. GdbServer::launch_gdb is passed the // other end of this pipe to exec gdb with the parameters. ScopedFd* debugger_params_write_pipe; ConnectionFlags() : dbg_port(-1), debugger_params_write_pipe(nullptr) {} }; /** * Create a gdbserver serving the replay of 'session'. */ GdbServer(std::shared_ptr session, const ReplaySession::Flags& flags, const Target& target) : target(target), final_event(UINT32_MAX), stop_reason(0), in_debuggee_end_state(false), stop_replaying_to_target(false), interrupt_pending(false), timeline(std::move(session), flags), emergency_debug_session(nullptr) {} /** * Actually run the server. Returns only when the debugger disconnects. */ void serve_replay(const ConnectionFlags& flags); /** * exec()'s gdb using parameters read from params_pipe_fd (and sent through * the pipe passed to serve_replay_with_debugger). */ static void launch_gdb(ScopedFd& params_pipe_fd, const std::string& gdb_binary_file_path, const std::vector& gdb_options); /** * Start a debugging connection for |t| and return when there are no * more requests to process (usually because the debugger detaches). * * This helper doesn't attempt to determine whether blocking rr on a * debugger connection might be a bad idea. It will always open the debug * socket and block awaiting a connection. */ static void emergency_debug(Task* t); /** * A string containing the default gdbinit script that we load into gdb. */ static std::string init_script(); /** * Called from a signal handler (or other thread) during serve_replay, * this will cause the replay-to-target phase to be interrupted and * debugging started wherever the replay happens to be. */ void interrupt_replay_to_target() { stop_replaying_to_target = true; } /** * Return the register |which|, which may not have a defined value. */ static GdbRegisterValue get_reg(const Registers& regs, const ExtraRegisters& extra_regs, GdbRegister which); ReplayTimeline& get_timeline() { return timeline; } private: GdbServer(std::unique_ptr& dbg, Task* t); Session& current_session() { return timeline.is_running() ? timeline.current_session() : *emergency_debug_session; } void dispatch_regs_request(const Registers& regs, const ExtraRegisters& extra_regs); enum ReportState { REPORT_NORMAL, REPORT_THREADS_DEAD }; /** * Process the single debugger request |req|, made by |dbg| targeting * |t|, inside the session |session|. * * Callers should implement any special semantics they want for * particular debugger requests before calling this helper, to do * generic processing. */ void dispatch_debugger_request(Session& session, const GdbRequest& req, ReportState state); bool at_target(); void activate_debugger(); void restart_session(const GdbRequest& req); GdbRequest process_debugger_requests(ReportState state = REPORT_NORMAL); enum ContinueOrStop { CONTINUE_DEBUGGING, STOP_DEBUGGING }; bool detach_or_restart(const GdbRequest& req, ContinueOrStop* s); ContinueOrStop handle_exited_state(GdbRequest& last_resume_request); ContinueOrStop debug_one_step(GdbRequest& last_resume_request); /** * If 'req' is a reverse-singlestep, try to obtain the resulting state * directly from ReplayTimeline's mark database. If that succeeds, * report the singlestep break status to gdb and process any get-registers * requests. Repeat until we get a request that isn't reverse-singlestep * or get-registers, returning that request in 'req'. * During reverse-next commands, gdb tends to issue a series of * reverse-singlestep/get-registers pairs, and this makes those much * more efficient by avoiding having to actually reverse-singlestep the * session. */ void try_lazy_reverse_singlesteps(GdbRequest& req); /** * Process debugger requests made in |diversion_session| until action needs * to be taken by the caller (a resume-execution request is received). * The received request is returned through |req|. * Returns true if diversion should continue, false if it should end. */ bool diverter_process_debugger_requests(DiversionSession& diversion_session, uint32_t& diversion_refcount, GdbRequest* req); /** * Create a new diversion session using |replay| session as the * template. The |replay| session isn't mutated. * * Execution begins in the new diversion session under the control of * |dbg| starting with initial thread target |task|. The diversion * session ends at the request of |dbg|, and |divert| returns the first * request made that wasn't handled by the diversion session. That * is, the first request that should be handled by |replay| upon * resuming execution in that session. */ GdbRequest divert(ReplaySession& replay); /** * If |break_status| indicates a stop that we should report to gdb, * report it. |req| is the resume request that generated the stop. */ void maybe_notify_stop(const GdbRequest& req, const BreakStatus& break_status); /** * Return the checkpoint stored as |checkpoint_id| or nullptr if there * isn't one. */ ReplaySession::shr_ptr get_checkpoint(int checkpoint_id); /** * Delete the checkpoint stored as |checkpoint_id| if it exists, or do * nothing if it doesn't exist. */ void delete_checkpoint(int checkpoint_id); Target target; // dbg is initially null. Once the debugger connection is established, it // never changes. std::unique_ptr dbg; // When dbg is non-null, the TaskGroupUid of the task being debugged. Never // changes once the connection is established --- we don't currently // support switching gdb between debuggee processes. TaskGroupUid debuggee_tguid; // The TaskUid of the last continued task. TaskUid last_continue_tuid; // The TaskUid of the last queried task. TaskUid last_query_tuid; TraceFrame::Time final_event; // Stop reason for last notified stop. int stop_reason; bool in_debuggee_end_state; // True when the user has interrupted replaying to a target event. volatile bool stop_replaying_to_target; // True when a DREQ_INTERRUPT has been received but not handled, or when // we've restarted and want the first continue to be interrupted immediately. bool interrupt_pending; ReplayTimeline timeline; Session* emergency_debug_session; struct Checkpoint { enum Explicit { EXPLICIT, NOT_EXPLICIT }; Checkpoint(ReplayTimeline& timeline, TaskUid last_continue_tuid, Explicit e, const std::string& where) : last_continue_tuid(last_continue_tuid), is_explicit(e), where(where) { if (e == EXPLICIT) { mark = timeline.add_explicit_checkpoint(); } else { mark = timeline.mark(); } } Checkpoint() : is_explicit(NOT_EXPLICIT) {} ReplayTimeline::Mark mark; TaskUid last_continue_tuid; Explicit is_explicit; std::string where; }; // |debugger_restart_mark| is the point where we will restart from with // a no-op debugger "run" command. Checkpoint debugger_restart_checkpoint; // gdb checkpoints, indexed by ID std::map checkpoints; // Set of symbols to look up, for qSymbol. std::set symbols; // Iterator into |symbols|. std::set::iterator symbols_iter; }; } // namespace rr #endif /* RR_GDB_SERVER_H_ */ rr-4.4.0/src/HasTaskSet.cc000066400000000000000000000006611277367620400152730ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "HasTaskSet.h" #include "Task.h" #include "log.h" namespace rr { void HasTaskSet::insert_task(Task* t) { LOG(debug) << "adding " << t->tid << " to task set " << this; tasks.insert(t); } void HasTaskSet::erase_task(Task* t) { LOG(debug) << "removing " << t->tid << " from task group " << this; tasks.erase(t); } } // namespace rr rr-4.4.0/src/HasTaskSet.h000066400000000000000000000010671277367620400151360ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_HASTASKSET_H_ #define RR_HASTASKSET_H_ #include namespace rr { class Task; /** * Base class for classes that manage a set of Tasks. */ class HasTaskSet { public: typedef std::set TaskSet; const TaskSet& task_set() const { return tasks; } void insert_task(Task* t); void erase_task(Task* t); bool has_task(Task* t) const { return tasks.find(t) != tasks.end(); } protected: TaskSet tasks; }; } // namespace rr #endif /* RR_HASTASKSET_H_ */ rr-4.4.0/src/HelpCommand.cc000066400000000000000000000016061277367620400154500ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Command.h" #include "main.h" using namespace std; namespace rr { class HelpCommand : public Command { public: virtual int run(std::vector& args); protected: HelpCommand(const char* name, const char* help) : Command(name, help) {} static HelpCommand help1; static HelpCommand help2; static HelpCommand help3; }; HelpCommand HelpCommand::help1("help", " rr help [command]\n"); HelpCommand HelpCommand::help2("-h", nullptr); HelpCommand HelpCommand::help3("--help", nullptr); int HelpCommand::run(std::vector& args) { if (args.size() == 0) { print_usage(stdout); return 0; } Command* command = Command::command_for_name(args[0]); if (!command) { print_usage(stderr); return 1; } command->print_help(stdout); return 0; } } // namespace rr rr-4.4.0/src/MagicSaveDataMonitor.cc000066400000000000000000000052761277367620400172710ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "MagicSaveDataMonitor.h" #include #include #include "RecordTask.h" #include "ReplayTask.h" #include "Session.h" #include "log.h" #include "util.h" namespace rr { static void dump_path_data(Task* t, TraceFrame::Time global_time, const char* tag, char* filename, size_t filename_size, const void* buf, size_t buf_len, remote_ptr addr) { format_dump_filename(t, global_time, tag, filename, filename_size); dump_binary_data(filename, tag, (const uint32_t*)buf, buf_len / 4, addr); } static void notify_save_data_error(ReplayTask* t, remote_ptr addr, const void* rec_buf, size_t rec_buf_len, const void* rep_buf, size_t rep_buf_len) { char rec_dump[PATH_MAX]; char rep_dump[PATH_MAX]; TraceFrame::Time global_time = t->current_trace_frame().time(); dump_path_data(t, global_time, "rec_save_data", rec_dump, sizeof(rec_dump), rec_buf, rec_buf_len, addr); dump_path_data(t, global_time, "rep_save_data", rep_dump, sizeof(rep_dump), rep_buf, rep_buf_len, addr); ASSERT(t, (rec_buf_len == rep_buf_len && !memcmp(rec_buf, rep_buf, rec_buf_len))) << "Divergence in contents of 'tracee-save buffer'. Recording executed\n" "\n" " write(" << RR_MAGIC_SAVE_DATA_FD << ", " << addr << ", " << rec_buf_len << ")\n" "\n" "and replay executed\n" "\n" " write(" << RR_MAGIC_SAVE_DATA_FD << ", " << addr << ", " << rep_buf_len << ")\n" "\n" "The contents of the tracee-save buffers have been dumped to disk.\n" "Compare them by using the following command\n" "\n" "$ diff -u " << rec_dump << " " << rep_dump << " >save-data-diverge.diff\n"; } void MagicSaveDataMonitor::did_write(Task* t, const std::vector& ranges, int64_t) { for (auto& r : ranges) { if (t->session().is_recording()) { static_cast(t)->record_remote(r.data.cast(), r.length); } else if (t->session().is_replaying()) { auto rt = static_cast(t); auto bytes = rt->read_mem(r.data.cast(), r.length); auto rec = rt->trace_reader().read_raw_data(); if (rec.data != bytes) { notify_save_data_error(rt, rec.addr, rec.data.data(), rec.data.size(), bytes.data(), bytes.size()); } } } } } // namespace rr rr-4.4.0/src/MagicSaveDataMonitor.h000066400000000000000000000013131277367620400171170ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_MAGIC_SAVE_DATA_MONITOR_H_ #define RR_MAGIC_SAVE_DATA_MONITOR_H_ #include "FileMonitor.h" namespace rr { /** * A FileMonitor to track writes to RR_MAGIC_SAVE_DATA_FD. */ class MagicSaveDataMonitor : public FileMonitor { public: MagicSaveDataMonitor() {} virtual Type type() { return MagicSaveData; } /** * During recording, record the written data. * During replay, check that the written data matches what was recorded. */ virtual void did_write(Task* t, const std::vector& ranges, int64_t offset); }; } // namespace rr #endif /* RR_MAGIC_SAVE_DATA_MONITOR_H_ */ rr-4.4.0/src/MemoryRange.h000066400000000000000000000040331277367620400153450ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_MEMORY_RANGE_H_ #define RR_MEMORY_RANGE_H_ #include #include "remote_ptr.h" namespace rr { /** * Range of memory addresses that can be used as a std::map key. */ class MemoryRange { public: MemoryRange() {} MemoryRange(remote_ptr addr, size_t num_bytes) : start_(addr), end_(addr + num_bytes) { assert(start_ <= end_); } MemoryRange(remote_ptr addr, remote_ptr end) : start_(addr), end_(end) { assert(start_ <= end); } MemoryRange(const MemoryRange&) = default; MemoryRange& operator=(const MemoryRange&) = default; bool operator==(const MemoryRange& o) const { return start_ == o.start_ && end_ == o.end_; } bool operator<(const MemoryRange& o) const { return start_ != o.start_ ? start_ < o.start_ : end_ < o.end_; } /** * Return true iff |o| is an address range fully contained by * this. */ bool contains(const MemoryRange& o) const { return start_ <= o.start_ && o.end_ <= end_; } bool contains(remote_ptr p) const { return start_ <= p && p < end_; } bool intersects(const MemoryRange& other) const { remote_ptr s = std::max(start_, other.start_); remote_ptr e = std::min(end_, other.end_); return s < e; } MemoryRange intersect(const MemoryRange& other) const { remote_ptr s = std::max(start_, other.start_); remote_ptr e = std::min(end_, other.end_); return MemoryRange(s, std::max(s, e)); } remote_ptr start() const { return start_; } remote_ptr end() const { return end_; } size_t size() const { return end_ - start_; } // XXX DO NOT USE void update_start(remote_ptr s) const { const_cast(this)->start_ = s; } private: remote_ptr start_; remote_ptr end_; }; inline std::ostream& operator<<(std::ostream& o, const MemoryRange& m) { o << m.start() << "-" << m.end(); return o; } } // namespace rr #endif /* RR_MEMORY_RANGE_H_ */ rr-4.4.0/src/MmappedFileMonitor.cc000066400000000000000000000044051277367620400170140ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "MmappedFileMonitor.h" #include "RecordSession.h" #include "RecordTask.h" #include "log.h" using namespace std; namespace rr { MmappedFileMonitor::MmappedFileMonitor(Task* t, int fd) { ASSERT(t, !t->session().is_replaying()); extant_ = true; auto stat = t->stat_fd(fd); device_ = stat.st_dev; inode_ = stat.st_ino; } MmappedFileMonitor::MmappedFileMonitor(Task* t, EmuFile::shr_ptr f) { ASSERT(t, t->session().is_replaying()); extant_ = !!f; if (!extant_) { // Our only role is to disable syscall buffering for this fd. return; } device_ = f->device(); inode_ = f->inode(); } void MmappedFileMonitor::did_write(Task* t, const std::vector& ranges, int64_t offset) { if (!extant_ || ranges.empty()) { return; } ASSERT(t, offset >= 0) << "Only pwrite/pwritev supported on /proc//mem currently"; // XXX to fix that, we'd have to grab the file offset from // /proc//fdinfo. bool is_replay = t->session().is_replaying(); for (auto v : t->session().vms()) { for (auto m : v->maps()) { auto km = m.map; if (is_replay) { if (!m.emu_file || m.emu_file->device() != device_ || m.emu_file->inode() != inode_) { continue; } } else { if (km.device() != device_ || km.inode() != inode_) { continue; } } // stat matches. ASSERT(t, km.flags() & MAP_SHARED); uint64_t mapping_offset = km.file_offset_bytes(); int64_t local_offset = offset; for (auto r : ranges) { remote_ptr start = km.start() + local_offset - mapping_offset; MemoryRange mr(start, r.length); if (km.intersects(mr)) { if (is_replay) { // If we're writing beyond the EmuFile's end, resize it. m.emu_file->ensure_size(local_offset + r.length); } else { // We will record multiple writes if the file is mapped multiple // times. This is inefficient, but not wrong. static_cast(t)->record_remote(km.intersect(mr)); } } local_offset += r.length; } } } } } // namespace rr rr-4.4.0/src/MmappedFileMonitor.h000066400000000000000000000014701277367620400166550ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_MMAPPED_FILE_MONITOR_H_ #define RR_MMAPPED_FILE_MONITOR_H_ #include "EmuFs.h" #include "FileMonitor.h" #include namespace rr { /** * A FileMonitor to track writes to files that are mmapped in so they can be * replayed. */ class MmappedFileMonitor : public FileMonitor { public: MmappedFileMonitor(Task* t, int fd); MmappedFileMonitor(Task* t, EmuFile::shr_ptr f); virtual Type type() { return Mmapped; } /** * During recording, note writes to mapped segments. */ virtual void did_write(Task* t, const std::vector& ranges, int64_t offset); private: bool extant_; dev_t device_; ino_t inode_; }; } // namespace rr #endif /* RR_MMAPPED_FILE_MONITOR_H_ */ rr-4.4.0/src/MonitoredSharedMemory.cc000066400000000000000000000047431277367620400175460ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "MonitoredSharedMemory.h" #include #include "AddressSpace.h" #include "AutoRemoteSyscalls.h" #include "RecordTask.h" #include "Session.h" #include "log.h" using namespace std; namespace rr { MonitoredSharedMemory::~MonitoredSharedMemory() { munmap(real_mem, size); } static const char dconf_suffix[] = "/dconf/user"; void MonitoredSharedMemory::maybe_monitor(RecordTask* t, const string& file_name, const AddressSpace::Mapping& m, int tracee_fd, uint64_t offset) { size_t dconf_suffix_len = sizeof(dconf_suffix) - 1; if (file_name.size() < dconf_suffix_len || file_name.substr(file_name.size() - dconf_suffix_len) != dconf_suffix) { return; } AutoRemoteSyscalls remote(t); ScopedFd fd = remote.retrieve_fd(tracee_fd); uint8_t* real_mem = static_cast( mmap(NULL, m.map.size(), PROT_READ, MAP_SHARED, fd, offset)); ASSERT(t, real_mem != MAP_FAILED); auto result = shared_ptr( new MonitoredSharedMemory(real_mem, m.map.size())); const AddressSpace::Mapping& shared = Session::recreate_shared_mmap(remote, m, move(result)); // m may be invalid now memcpy(shared.local_addr, real_mem, shared.map.size()); } MonitoredSharedMemory::shr_ptr MonitoredSharedMemory::subrange(uintptr_t, uintptr_t) { assert(false && "Subranges not supported yet!"); return nullptr; } void MonitoredSharedMemory::check_all(RecordTask* t) { vector> addrs; for (auto a : t->vm()->monitored_addrs()) { addrs.push_back(a); } for (auto a : addrs) { auto m = t->vm()->mapping_of(a); if (m.monitored_shared_memory) { m.monitored_shared_memory->check_for_changes(t, m); } } } void MonitoredSharedMemory::check_for_changes(RecordTask* t, AddressSpace::Mapping& m) { ASSERT(t, m.map.size() == size); if (!m.local_addr) { // reestablish local mapping after a fork or whatever AutoRemoteSyscalls remote(t); auto msm = m.monitored_shared_memory; m = Session::recreate_shared_mmap(remote, m, move(msm)); } if (!memcmp(m.local_addr, real_mem, size)) { return; } memcpy(m.local_addr, real_mem, size); t->record_local(m.map.start(), size, real_mem); } } rr-4.4.0/src/MonitoredSharedMemory.h000066400000000000000000000034561277367620400174100ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_MONITORED_SHARED_MEMORY_H_ #define RR_MONITORED_SHARED_MEMORY_H_ #include #include "AddressSpace.h" namespace rr { class RecordTask; /** * Support tracees that share memory read-only with a non-tracee that * writes to the memory. Currently this just supports limited cases that * suffice for dconf: no remapping, coalescing or splitting of the memory is * allowed (|subrange| below just asserts). It doesn't handle mappings where * the mapping has more pages than the file. * * After such memory is mapped in the tracee, we also map it in rr at |real_mem| * and replace the tracee's mapping with a "shadow buffer" that's only shared * with rr. Then periodically rr reads the real memory, and if it doesn't match * the shadow buffer, we update the shadow buffer with the new values and * record that we did so. * * Currently we check the real memory after each syscall exit. This ensures * that if the tracee is woken up by some IPC mechanism (or after sched_yield), * it will get a chance to see updated memory values. */ class MonitoredSharedMemory { public: ~MonitoredSharedMemory(); typedef std::shared_ptr shr_ptr; static void maybe_monitor(RecordTask* t, const std::string& file_name, const AddressSpace::Mapping& m, int tracee_fd, uint64_t offset); static void check_all(RecordTask* t); shr_ptr subrange(uintptr_t start, uintptr_t size); private: void check_for_changes(RecordTask* t, AddressSpace::Mapping& m); MonitoredSharedMemory(uint8_t* real_mem, size_t size) : real_mem(real_mem), size(size) {} uint8_t* real_mem; size_t size; }; } // namespace rr #endif /* RR_MONITORED_SHARED_MEMORY_H_ */ rr-4.4.0/src/Monkeypatcher.cc000066400000000000000000000736411277367620400161020ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Monkeypatcher.h" #include #include "AddressSpace.h" #include "AutoRemoteSyscalls.h" #include "ElfReader.h" #include "RecordTask.h" #include "ReplaySession.h" #include "ScopedFd.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" using namespace std; namespace rr { #include "AssemblyTemplates.generated" static void write_and_record_bytes(RecordTask* t, remote_ptr child_addr, size_t size, const void* buf) { t->write_bytes_helper(child_addr, size, buf); t->record_local(child_addr, size, buf); } template static void write_and_record_bytes(RecordTask* t, remote_ptr child_addr, const uint8_t (&buf)[N]) { write_and_record_bytes(t, child_addr, N, buf); } template static void write_and_record_mem(RecordTask* t, remote_ptr child_addr, const T* val, int count) { t->write_bytes_helper(child_addr, sizeof(*val) * count, static_cast(val)); t->record_local(child_addr, sizeof(T) * count, val); } /** * RecordSession sets up an LD_PRELOAD environment variable with an entry * SYSCALLBUF_LIB_FILENAME_PADDED which is big enough to hold either the * 32-bit or 64-bit preload library file names. Immediately after exec we * enter this function, which patches the environment variable value with * the correct library name for the task's architecture. * * It's possible for this to fail if a tracee alters the LD_PRELOAD value * and then does an exec. That's just too bad. If we ever have to handle that, * we should modify the environment passed to the exec call. This function * failing isn't necessarily fatal; a tracee might not rely on the functions * overridden by the preload library, or might override them itself (e.g. * because we're recording an rr replay). */ template static void setup_preload_library_path(RecordTask* t) { static_assert(sizeof(SYSCALLBUF_LIB_FILENAME_PADDED) == sizeof(SYSCALLBUF_LIB_FILENAME_32), "filename length mismatch"); const char* lib_name = sizeof(typename Arch::unsigned_word) < sizeof(uintptr_t) ? SYSCALLBUF_LIB_FILENAME_32 : SYSCALLBUF_LIB_FILENAME_PADDED; auto p = t->regs().sp().cast(); auto argc = t->read_mem(p); p += 1 + argc + 1; // skip argc, argc parameters, and trailing NULL while (true) { auto envp = t->read_mem(p); if (!envp) { LOG(debug) << "LD_PRELOAD not found"; return; } string env = t->read_c_str(envp); if (env.find("LD_PRELOAD=") != 0) { ++p; continue; } size_t lib_pos = env.find(SYSCALLBUF_LIB_FILENAME_BASE); if (lib_pos == string::npos) { LOG(debug) << SYSCALLBUF_LIB_FILENAME_BASE " not found in LD_PRELOAD"; return; } size_t next_colon = env.find(':', lib_pos); if (next_colon != string::npos) { while ((next_colon + 1 < env.length()) && (env[next_colon + 1] == ':' || env[next_colon + 1] == 0)) { ++next_colon; } if (next_colon + 1 < lib_pos + sizeof(SYSCALLBUF_LIB_FILENAME_PADDED) - 1) { LOG(debug) << "Insufficient space for " << lib_name << " in LD_PRELOAD before next ':'"; return; } } if (env.length() < lib_pos + sizeof(SYSCALLBUF_LIB_FILENAME_PADDED) - 1) { LOG(debug) << "Insufficient space for " << lib_name << " in LD_PRELOAD before end of string"; return; } remote_ptr dest = envp + lib_pos; write_and_record_mem(t, dest.cast(), lib_name, sizeof(SYSCALLBUF_LIB_FILENAME_PADDED) - 1); return; } } void Monkeypatcher::init_dynamic_syscall_patching( RecordTask* t, int syscall_patch_hook_count, remote_ptr syscall_patch_hooks, remote_ptr syscall_hook_trampoline, remote_ptr syscall_hook_end) { if (syscall_patch_hook_count) { syscall_hooks = t->read_mem(syscall_patch_hooks, syscall_patch_hook_count); } this->syscall_hook_trampoline = syscall_hook_trampoline; this->syscall_hook_end = syscall_hook_end; ASSERT(t, syscall_hook_trampoline < syscall_hook_end); } template static bool patch_syscall_with_hook_arch(Monkeypatcher& patcher, RecordTask* t, const syscall_patch_hook& hook); template static void substitute(uint8_t* buffer, uint64_t return_addr, uint32_t trampoline_relative_addr); template static void substitute_extended_jump(uint8_t* buffer, uint64_t patch_addr, uint64_t return_addr, uint64_t target_addr); template <> void substitute_extended_jump( uint8_t* buffer, uint64_t patch_addr, uint64_t return_addr, uint64_t target_addr) { int64_t offset = target_addr - (patch_addr + X86SyscallStubExtendedJump::trampoline_relative_addr_end); // An offset that appears to be > 2GB is OK here, since EIP will just // wrap around. X86SyscallStubExtendedJump::substitute(buffer, (uint32_t)return_addr, (uint32_t)offset); } template <> void substitute_extended_jump( uint8_t* buffer, uint64_t, uint64_t return_addr, uint64_t target_addr) { X64SyscallStubExtendedJump::substitute(buffer, (uint32_t)return_addr, (uint32_t)(return_addr >> 32), target_addr); } /** * Allocate an extended jump in an extended jump page and return its address. * The resulting address must be within 2G of from_end, and the instruction * there must jump to to_start. */ template static remote_ptr allocate_extended_jump( RecordTask* t, vector& pages, remote_ptr from_end, remote_code_ptr return_addr, remote_code_ptr target_addr) { Monkeypatcher::ExtendedJumpPage* page = nullptr; for (auto& p : pages) { remote_ptr page_jump_start = p.addr + p.allocated; int64_t offset = page_jump_start - from_end; if ((int32_t)offset == offset && p.allocated + ExtendedJumpPatch::size <= page_size()) { page = &p; break; } } if (!page) { // We're looking for a gap of three pages --- one page to allocate and // a page on each side as a guard page. uint32_t required_space = 3 * page_size(); remote_ptr free_mem = t->vm()->find_free_memory(required_space, // Find free space after the patch site. t->vm()->mapping_of(from_end).map.start()); remote_ptr addr = (free_mem + page_size()).cast(); int64_t offset = addr - from_end; if ((int32_t)offset != offset) { LOG(debug) << "Can't find space close enough for the jump"; return nullptr; } { AutoRemoteSyscalls remote(t); int prot = PROT_READ | PROT_EXEC; int flags = MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE; remote.infallible_mmap_syscall(addr, page_size(), prot, flags, -1, 0); KernelMapping recorded(addr, addr + page_size(), string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, prot, flags); t->vm()->map(t, addr, page_size(), prot, flags, 0, string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, nullptr, &recorded); t->trace_writer().write_mapped_region(t, recorded, recorded.fake_stat(), TraceWriter::PATCH_MAPPING); } pages.push_back(Monkeypatcher::ExtendedJumpPage(addr)); page = &pages.back(); } uint8_t jump_patch[ExtendedJumpPatch::size]; remote_ptr jump_addr = page->addr + page->allocated; substitute_extended_jump(jump_patch, jump_addr.as_int(), return_addr.register_value(), target_addr.register_value()); write_and_record_bytes(t, jump_addr, jump_patch); page->allocated += sizeof(jump_patch); return jump_addr; } /** * Some functions make system calls while storing local variables in memory * below the stack pointer. We need to decrement the stack pointer by * some "safety zone" amount to get clear of those variables before we make * a call instruction. So, we allocate a stub per patched callsite, and jump * from the callsite to the stub. The stub decrements the stack pointer, * calls the appropriate syscall hook function, reincrements the stack pointer, * and jumps back to immediately after the patched callsite. * * It's important that gdb stack traces work while a thread is stopped in the * syscallbuf code. To ensure that the above manipulations don't foil gdb's * stack walking code, we add CFI data to all the stubs. To ease that, the * stubs are written in assembly and linked into the preload library. * * On x86-64 with ASLR, we need to be able to patch a call to a stub from * sites more than 2^31 bytes away. We only have space for a 5-byte jump * instruction. So, we allocate "extender pages" --- pages of memory within * 2GB of the patch site, that contain the stub code. We don't really need this * on x86, but we do it there too for consistency. * */ template static bool patch_syscall_with_hook_x86ish(Monkeypatcher& patcher, RecordTask* t, const syscall_patch_hook& hook) { uint8_t jump_patch[JumpPatch::size]; // We're patching in a relative jump, so we need to compute the offset from // the end of the jump to our actual destination. auto jump_patch_start = t->regs().ip().to_data_ptr(); auto jump_patch_end = jump_patch_start + sizeof(jump_patch); remote_ptr extended_jump_start = allocate_extended_jump( t, patcher.extended_jump_pages, jump_patch_end, jump_patch_start.as_int() + syscall_instruction_length(x86_64) + hook.next_instruction_length, hook.hook_address); if (extended_jump_start.is_null()) { return false; } intptr_t jump_offset = extended_jump_start - jump_patch_end; int32_t jump_offset32 = (int32_t)jump_offset; ASSERT(t, jump_offset32 == jump_offset) << "allocate_extended_jump didn't work"; JumpPatch::substitute(jump_patch, jump_offset32); write_and_record_bytes(t, jump_patch_start, jump_patch); // pad with NOPs to the next instruction static const uint8_t NOP = 0x90; assert(syscall_instruction_length(x86_64) == syscall_instruction_length(x86)); uint8_t nops[syscall_instruction_length(x86_64) + hook.next_instruction_length - sizeof(jump_patch)]; memset(nops, NOP, sizeof(nops)); write_and_record_mem(t, jump_patch_start + sizeof(jump_patch), nops, sizeof(nops)); return true; } template <> bool patch_syscall_with_hook_arch(Monkeypatcher& patcher, RecordTask* t, const syscall_patch_hook& hook) { return patch_syscall_with_hook_x86ish(patcher, t, hook); } template <> bool patch_syscall_with_hook_arch(Monkeypatcher& patcher, RecordTask* t, const syscall_patch_hook& hook) { return patch_syscall_with_hook_x86ish(patcher, t, hook); } static bool patch_syscall_with_hook(Monkeypatcher& patcher, RecordTask* t, const syscall_patch_hook& hook) { RR_ARCH_FUNCTION(patch_syscall_with_hook_arch, t->arch(), patcher, t, hook); } static string bytes_to_string(uint8_t* bytes, size_t size) { stringstream ss; for (size_t i = 0; i < size; ++i) { if (i > 0) { ss << ' '; } ss << HEX(bytes[i]); } return ss.str(); } bool Monkeypatcher::try_patch_syscall(RecordTask* t) { if (syscall_hooks.empty()) { // Syscall hooks not set up yet. Don't spew warnings, and don't // fill tried_to_patch_syscall_addresses with addresses that we might be // able to patch later. return false; } if (t->emulated_ptracer) { // Syscall patching can confuse ptracers, which may be surprised to see // a syscall instruction at the current IP but then when running // forwards, that the syscall occurs deep in the preload library instead. return false; } if (t->is_in_traced_syscall()) { // Never try to patch the traced-syscall in our preload library! return false; } Registers r = t->regs(); if (tried_to_patch_syscall_addresses.count(r.ip())) { return false; } // We could examine the current syscall number and if it's not one that // we support syscall buffering for, refuse to patch the syscall instruction. // This would, on the face of it, reduce overhead since patching the // instruction just means a useless trip through the syscall buffering logic. // However, it actually wouldn't help much since we'd still to a switch // on the syscall number in this function instead, and due to context // switching costs any overhead saved would be insignificant. // Also, implementing that would require keeping a buffered-syscalls // list in sync with the preload code, which is unnecessary complexity. tried_to_patch_syscall_addresses.insert(r.ip()); uint8_t following_bytes[256]; size_t bytes_count = t->read_bytes_fallible( r.ip().to_data_ptr(), sizeof(following_bytes), following_bytes); if (bytes_count < sizeof(syscall_patch_hook::next_instruction_bytes)) { return false; } intptr_t syscallno = r.original_syscallno(); for (auto& hook : syscall_hooks) { if (memcmp(following_bytes, hook.next_instruction_bytes, hook.next_instruction_length) == 0) { // Search for a following short-jump instruction that targets the zone // after the syscall. False positives are OK. // glibc-2.23.1-8.fc24.x86_64's __clock_nanosleep needs this. bool found_potential_interfering_branch = false; for (size_t i = 0; i + 2 <= bytes_count; ++i) { uint8_t b = following_bytes[i]; // Check for short conditional or unconditional jump if (b == 0xeb || (b >= 0x70 && b < 0x80)) { int offset = i + 2 + (int8_t)following_bytes[i + 1]; if (offset >= 0 && offset < hook.next_instruction_length) { LOG(debug) << "Found potential interfering branch at " << r.ip().to_data_ptr() + i; // We can't patch this because it would jump straight back into // the middle of our patch code. found_potential_interfering_branch = true; } } } if (!found_potential_interfering_branch) { LOG(debug) << "Patched syscall at " << r.ip() << " syscall " << syscall_name(syscallno, t->arch()) << " tid " << t->tid << " bytes " << bytes_to_string( following_bytes, sizeof(syscall_patch_hook::next_instruction_bytes)); // Get out of executing the current syscall before we patch it. t->exit_syscall_and_prepare_restart(); patch_syscall_with_hook(*this, t, hook); // Return to caller, which resume normal execution. return true; } } } LOG(debug) << "Failed to patch syscall at " << r.ip() << " syscall " << syscall_name(syscallno, t->arch()) << " tid " << t->tid << " bytes " << bytes_to_string( following_bytes, sizeof(syscall_patch_hook::next_instruction_bytes)); return false; } class VdsoReader : public ElfReader { public: VdsoReader(RecordTask* t) : ElfReader(t->arch()), t(t) {} virtual bool read(size_t offset, size_t size, void* buf) { bool ok = true; t->read_bytes_helper(t->vm()->vdso().start() + offset, size, buf, &ok); return ok; } RecordTask* t; }; static SymbolTable read_vdso_symbols(RecordTask* t) { return VdsoReader(t).read_symbols(".dynsym", ".dynstr"); } /** * Return true iff |addr| points to a known |__kernel_vsyscall()| * implementation. */ static bool is_kernel_vsyscall(RecordTask* t, remote_ptr addr) { uint8_t impl[X86SysenterVsyscallImplementation::size]; t->read_bytes(addr, impl); return X86SysenterVsyscallImplementation::match(impl); } /** * Return the address of a recognized |__kernel_vsyscall()| * implementation in |t|'s address space. */ static remote_ptr locate_and_verify_kernel_vsyscall( RecordTask* t, const SymbolTable& syms) { remote_ptr kernel_vsyscall = nullptr; // It is unlikely but possible that multiple, versioned __kernel_vsyscall // symbols will exist. But we can't rely on setting |kernel_vsyscall| to // catch that case, because only one of the versioned symbols will // actually match what we expect to see, and the matching one might be // the last one. Therefore, we have this separate flag to alert us to // this possibility. bool seen_kernel_vsyscall = false; for (size_t i = 0; i < syms.size(); ++i) { if (syms.is_name(i, "__kernel_vsyscall")) { remote_ptr candidate = syms.file_offset(i); // The symbol values can be absolute or relative addresses. // The first part of the assertion is for absolute // addresses, and the second part is for relative. if ((candidate.as_int() & ~uintptr_t(0xfff)) != 0xffffe000 && (candidate.as_int() & ~uintptr_t(0xfff)) != 0) { // With 4.2.8-300.fc23.x86_64, execve_loop_32 seems to once in a while // see a VDSO with a crazy file offset in it which is a duplicate // __kernel_vsyscall. Bizzarro. Ignore it. continue; } ASSERT(t, !seen_kernel_vsyscall); seen_kernel_vsyscall = true; // The ELF information in the VDSO assumes that the VDSO // is always loaded at a particular address. The kernel, // however, subjects the VDSO to ASLR, which means that // we have to adjust the offsets properly. auto vdso_start = t->vm()->vdso().start(); uintptr_t candidate_offset = candidate.as_int() & uintptr_t(0xfff); candidate = vdso_start + candidate_offset; if (is_kernel_vsyscall(t, candidate)) { kernel_vsyscall = candidate; } } } return kernel_vsyscall; } // VDSOs are filled with overhead critical functions related to getting the // time and current CPU. We need to ensure that these syscalls get redirected // into actual trap-into-the-kernel syscalls so rr can intercept them. template static void patch_after_exec_arch(RecordTask* t, Monkeypatcher& patcher); template static void patch_at_preload_init_arch(RecordTask* t, Monkeypatcher& patcher); struct named_syscall { const char* name; int syscall_number; }; // Monkeypatch x86-32 vdso syscalls immediately after exec. The vdso syscalls // will cause replay to fail if called by the dynamic loader or some library's // static constructors, so we can't wait for our preload library to be // initialized. Fortunately we're just replacing the vdso code with real // syscalls so there is no dependency on the preload library at all. template <> void patch_after_exec_arch(RecordTask* t, Monkeypatcher& patcher) { setup_preload_library_path(t); auto syms = read_vdso_symbols(t); patcher.x86_sysenter_vsyscall = locate_and_verify_kernel_vsyscall(t, syms); if (!patcher.x86_sysenter_vsyscall) { FATAL() << "Failed to monkeypatch vdso: your __kernel_vsyscall() wasn't " "recognized.\n" " Syscall buffering is now effectively disabled. If you're " "OK with\n" " running rr without syscallbuf, then run the recorder " "passing the\n" " --no-syscall-buffer arg.\n" " If you're *not* OK with that, file an issue."; } // Patch __kernel_vsyscall to use int 80 instead of sysenter. // During replay we may remap the VDSO to a new address, and the sysenter // instruction would return to the old address, so we must make sure sysenter // is never used. uint8_t patch[X86SysenterVsyscallUseInt80::size]; X86SysenterVsyscallUseInt80::substitute(patch); write_and_record_bytes(t, patcher.x86_sysenter_vsyscall, patch); LOG(debug) << "monkeypatched __kernel_vsyscall to use int $80"; auto vdso_start = t->vm()->vdso().start(); static const named_syscall syscalls_to_monkeypatch[] = { #define S(n) \ { "__vdso_" #n, X86Arch::n } S(clock_gettime), S(gettimeofday), S(time), #undef S }; for (size_t i = 0; i < syms.size(); ++i) { for (size_t j = 0; j < array_length(syscalls_to_monkeypatch); ++j) { if (syms.is_name(i, syscalls_to_monkeypatch[j].name)) { static const uintptr_t vdso_max_size = 0xffffLL; uintptr_t sym_address = syms.file_offset(i); if ((sym_address & ~vdso_max_size) != 0) { // With 4.3.3-301.fc23.x86_64, once in a while we // see a VDSO symbol with a crazy file offset in it which is a // duplicate of another symbol. Bizzarro. Ignore it. continue; } uintptr_t absolute_address = vdso_start.as_int() + sym_address; uint8_t patch[X86VsyscallMonkeypatch::size]; uint32_t syscall_number = syscalls_to_monkeypatch[j].syscall_number; X86VsyscallMonkeypatch::substitute(patch, syscall_number); write_and_record_bytes(t, absolute_address, patch); LOG(debug) << "monkeypatched " << syscalls_to_monkeypatch[j].name << " to syscall " << syscalls_to_monkeypatch[j].syscall_number; } } } } // Monkeypatch x86 vsyscall hook only after the preload library // has initialized. The vsyscall hook expects to be able to use the syscallbuf. // Before the preload library has initialized, the regular vsyscall code // will trigger ptrace traps and be handled correctly by rr. template <> void patch_at_preload_init_arch(RecordTask* t, Monkeypatcher& patcher) { auto params = t->read_mem( remote_ptr>(t->regs().arg1())); if (!params.syscallbuf_enabled) { return; } auto kernel_vsyscall = patcher.x86_sysenter_vsyscall; // Luckily, linux is happy for us to scribble directly over // the vdso mapping's bytes without mprotecting the region, so // we don't need to prepare remote syscalls here. remote_ptr syscall_hook_trampoline = params.syscall_hook_trampoline; uint8_t patch[X86SysenterVsyscallSyscallHook::size]; // We're patching in a relative jump, so we need to compute the offset from // the end of the jump to our actual destination. X86SysenterVsyscallSyscallHook::substitute( patch, syscall_hook_trampoline.as_int() - (kernel_vsyscall + sizeof(patch)).as_int()); write_and_record_bytes(t, kernel_vsyscall, patch); LOG(debug) << "monkeypatched __kernel_vsyscall to jump to " << HEX(syscall_hook_trampoline.as_int()); patcher.init_dynamic_syscall_patching( t, params.syscall_patch_hook_count, params.syscall_patch_hooks, params.syscall_hook_trampoline, params.syscall_hook_end); } // Monkeypatch x86-64 vdso syscalls immediately after exec. The vdso syscalls // will cause replay to fail if called by the dynamic loader or some library's // static constructors, so we can't wait for our preload library to be // initialized. Fortunately we're just replacing the vdso code with real // syscalls so there is no dependency on the preload library at all. template <> void patch_after_exec_arch(RecordTask* t, Monkeypatcher&) { setup_preload_library_path(t); auto vdso_start = t->vm()->vdso().start(); size_t vdso_size = t->vm()->vdso().size(); auto syms = read_vdso_symbols(t); static const named_syscall syscalls_to_monkeypatch[] = { #define S(n) \ { "__vdso_" #n, X64Arch::n } S(clock_gettime), S(gettimeofday), S(time), // getcpu isn't supported by rr, so any changes to this monkeypatching // scheme for efficiency's sake will have to ensure that getcpu gets // converted to an actual syscall so rr will complain appropriately. S(getcpu), #undef S }; for (auto& syscall : syscalls_to_monkeypatch) { for (size_t i = 0; i < syms.size(); ++i) { if (syms.is_name(i, syscall.name)) { // Absolutely-addressed symbols in the VDSO claim to start here. static const uint64_t vdso_static_base = 0xffffffffff700000LL; static const uintptr_t vdso_max_size = 0xffffLL; uint64_t sym_address = syms.file_offset(i); uint64_t sym_offset = sym_address & vdso_max_size; // In 4.4.6-301.fc23.x86_64 we occasionally see a grossly invalid // address, se.g. 0x11c6970 for __vdso_getcpu. :-( if ((sym_address >= vdso_static_base && sym_address < vdso_static_base + vdso_size) || sym_address < vdso_size) { uintptr_t absolute_address = vdso_start.as_int() + sym_offset; uint8_t patch[X64VsyscallMonkeypatch::size]; uint32_t syscall_number = syscall.syscall_number; X64VsyscallMonkeypatch::substitute(patch, syscall_number); write_and_record_bytes(t, absolute_address, patch); LOG(debug) << "monkeypatched " << syscall.name << " to syscall " << syscall.syscall_number << " at " << HEX(absolute_address) << " (" << HEX(sym_address) << ")"; // With 4.4.6-301.fc23.x86_64, once in a while we see a VDSO symbol // with an incorrect file offset (a small integer) in it // which is a duplicate of a previous symbol. Bizzarro. So, stop once // we see a valid value for the symbol. break; } } } } } template <> void patch_at_preload_init_arch(RecordTask* t, Monkeypatcher& patcher) { auto params = t->read_mem( remote_ptr>(t->regs().arg1())); if (!params.syscallbuf_enabled) { return; } patcher.init_dynamic_syscall_patching( t, params.syscall_patch_hook_count, params.syscall_patch_hooks, params.syscall_hook_trampoline, params.syscall_hook_end); } void Monkeypatcher::patch_after_exec(RecordTask* t) { ASSERT(t, 1 == t->vm()->task_set().size()) << "Can't have multiple threads immediately after exec!"; RR_ARCH_FUNCTION(patch_after_exec_arch, t->arch(), t, *this); } void Monkeypatcher::patch_at_preload_init(RecordTask* t) { ASSERT(t, 1 == t->vm()->task_set().size()) << "TODO: monkeypatch multithreaded process"; // NB: the tracee can't be interrupted with a signal while // we're processing the rrcall, because it's masked off all // signals. RR_ARCH_FUNCTION(patch_at_preload_init_arch, t->arch(), t, *this); } static void set_and_record_bytes(RecordTask* t, uint64_t file_offset, const void* bytes, size_t size, remote_ptr map_start, size_t map_size, size_t map_offset_pages) { uint64_t map_offset = uint64_t(map_offset_pages) * page_size(); if (file_offset < map_offset || file_offset + size > map_offset + map_size) { // The value(s) to be set are outside the mapped range. This happens // because code and data can be mapped in separate, partial mmaps in which // case some symbols will be outside the mapped range. return; } remote_ptr addr = map_start + uintptr_t(file_offset - map_offset); bool ok = true; t->write_bytes_helper(addr, size, bytes, &ok); // Writing can fail when the value appears to be in the mapped range, but it // actually is beyond the file length. if (ok) { t->record_local(addr, size, bytes); } } void Monkeypatcher::patch_after_mmap(RecordTask* t, remote_ptr start, size_t size, size_t offset_pages, int child_fd) { const auto& map = t->vm()->mapping_of(start); if (map.map.fsname().find("libpthread") != string::npos && (t->arch() == x86 || t->arch() == x86_64)) { ScopedFd open_fd = t->open_fd(child_fd, O_RDONLY); ASSERT(t, open_fd.is_open()) << "Failed to open child fd " << child_fd; auto syms = ElfFileReader(open_fd, t->arch()).read_symbols(".symtab", ".strtab"); for (size_t i = 0; i < syms.size(); ++i) { if (syms.is_name(i, "__elision_aconf")) { static const int zero = 0; // Setting __elision_aconf.retry_try_xbegin to zero means that // pthread rwlocks don't try to use elision at all. See ELIDE_LOCK // in glibc's elide.h. set_and_record_bytes(t, syms.file_offset(i) + 8, &zero, sizeof(zero), start, size, offset_pages); } if (syms.is_name(i, "elision_init")) { // Make elision_init return without doing anything. This means // the __elision_available and __pthread_force_elision flags will // remain zero, disabling elision for mutexes. See glibc's // elision-conf.c. static const uint8_t ret = 0xC3; set_and_record_bytes(t, syms.file_offset(i), &ret, sizeof(ret), start, size, offset_pages); } } } } } // namespace rr rr-4.4.0/src/Monkeypatcher.h000066400000000000000000000077441277367620400157450ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_MONKEYPATCHER_H_ #define RR_MONKEYPATCHER_H_ #include #include #include "preload/preload_interface.h" #include "remote_code_ptr.h" #include "remote_ptr.h" namespace rr { class RecordTask; class ScopedFd; class Task; /** * A class encapsulating patching state. There is one instance of this * class per tracee address space. Currently this class performs the following * tasks: * * 1) Patch the VDSO's user-space-only implementation of certain system calls * (e.g. gettimeofday) to do a proper kernel system call instead, so rr can * trap and record it (x86-64 only). * * 2) Patch the VDSO __kernel_vsyscall fast-system-call stub to redirect to * our syscall hook in the preload library (x86 only). * * 3) Patch syscall instructions whose following instructions match a known * pattern to call the syscall hook. * * Monkeypatcher only runs during recording, never replay. */ class Monkeypatcher { public: Monkeypatcher() {} Monkeypatcher(const Monkeypatcher&) = default; /** * Apply any necessary patching immediately after exec. * In this hook we patch everything that doesn't depend on the preload * library being loaded. */ void patch_after_exec(RecordTask* t); /** * During librrpreload initialization, apply patches that require the * preload library to be initialized. */ void patch_at_preload_init(RecordTask* t); /** * Try to patch the syscall instruction that |t| just entered. If this * returns false, patching failed and the syscall should be processed * as normal. If this returns true, patching succeeded and the syscall * was aborted; ip() has been reset to the start of the patched syscall, * and execution should resume normally to execute the patched code. * Zero or more mapping operations are also recorded to the trace and must * be replayed. */ bool try_patch_syscall(RecordTask* t); void init_dynamic_syscall_patching( RecordTask* t, int syscall_patch_hook_count, remote_ptr syscall_patch_hooks, remote_ptr syscall_hook_trampoline, remote_ptr syscall_hook_end); /** * Try to allocate a stub from the sycall patching stub buffer. Returns null * if there's no buffer or we've run out of free stubs. */ remote_ptr allocate_stub(RecordTask* t, size_t bytes); /** * Apply any necessary patching immediately after an mmap. We use this to * patch libpthread.so. */ void patch_after_mmap(RecordTask* t, remote_ptr start, size_t size, size_t offset_pages, int child_fd); remote_ptr x86_sysenter_vsyscall; /** * The list of pages we've allocated to hold our extended jumps. */ struct ExtendedJumpPage { ExtendedJumpPage(remote_ptr addr) : addr(addr), allocated(0) {} remote_ptr addr; size_t allocated; }; std::vector extended_jump_pages; /** * Returns true if the instruction at address p should be considered * "not part of the syscallbuf code", i.e. it's safe to deliver signals there * without affecting the syscall buffering logic. If not sure, return false. */ bool is_syscallbuf_excluded_instruction(remote_ptr p) { return p >= syscall_hook_trampoline && p < syscall_hook_end; } private: /** * The list of supported syscall patches obtained from the preload * library. Each one matches a specific byte signature for the instruction(s) * after a syscall instruction. */ std::vector syscall_hooks; /** * The addresses of the instructions following syscalls that we've tried * (or are currently trying) to patch. */ std::unordered_set tried_to_patch_syscall_addresses; // The addresses that contain our syscall hooks remote_ptr syscall_hook_trampoline; remote_ptr syscall_hook_end; }; } // namespace rr #endif /* RR_MONKEYPATCHER_H_ */ rr-4.4.0/src/PerfCounters.cc000066400000000000000000000224201277367620400156750ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "PerfCounters.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include "Flags.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" using namespace std; namespace rr { static bool attributes_initialized; static struct perf_event_attr ticks_attr; static struct perf_event_attr cycles_attr; static struct perf_event_attr page_faults_attr; static struct perf_event_attr hw_interrupts_attr; static struct perf_event_attr instructions_retired_attr; /* * Find out the cpu model using the cpuid instruction. * Full list of CPUIDs at http://sandpile.org/x86/cpuid.htm * Another list at * http://software.intel.com/en-us/articles/intel-architecture-and-processor-identification-with-cpuid-model-and-family-numbers */ enum CpuMicroarch { UnknownCpu, IntelMerom, IntelPenryn, IntelNehalem, IntelWestmere, IntelSandyBridge, IntelIvyBridge, IntelHaswell, IntelBroadwell, IntelSkylake }; struct PmuConfig { CpuMicroarch uarch; const char* name; unsigned rcb_cntr_event; unsigned rinsn_cntr_event; unsigned hw_intr_cntr_event; bool supported; }; // XXX please only edit this if you really know what you're doing. static const PmuConfig pmu_configs[] = { { IntelSkylake, "Intel Skylake", 0x5101c4, 0x5100c0, 0x5301cb, true }, { IntelBroadwell, "Intel Broadwell", 0x5101c4, 0x5100c0, 0x5301cb, true }, { IntelHaswell, "Intel Haswell", 0x5101c4, 0x5100c0, 0x5301cb, true }, { IntelIvyBridge, "Intel Ivy Bridge", 0x5101c4, 0x5100c0, 0x5301cb, true }, { IntelSandyBridge, "Intel Sandy Bridge", 0x5101c4, 0x5100c0, 0x5301cb, true }, { IntelNehalem, "Intel Nehalem", 0x5101c4, 0x5100c0, 0x50011d, true }, { IntelWestmere, "Intel Westmere", 0x5101c4, 0x5100c0, 0x50011d, true }, { IntelPenryn, "Intel Penryn", 0, 0, 0, false }, { IntelMerom, "Intel Merom", 0, 0, 0, false }, }; static string lowercase(const string& s) { string c = s; transform(c.begin(), c.end(), c.begin(), ::tolower); return c; } /** * Return the detected, known microarchitecture of this CPU, or don't * return; i.e. never return UnknownCpu. */ static CpuMicroarch get_cpu_microarch() { string forced_uarch = lowercase(Flags::get().forced_uarch); if (!forced_uarch.empty()) { for (size_t i = 0; i < array_length(pmu_configs); ++i) { const PmuConfig& pmu = pmu_configs[i]; string name = lowercase(pmu.name); if (name.npos != name.find(forced_uarch)) { LOG(info) << "Using forced uarch " << pmu.name; return pmu.uarch; } } FATAL() << "Forced uarch " << Flags::get().forced_uarch << " isn't known."; } auto cpuid_data = cpuid(CPUID_GETFEATURES, 0); unsigned int cpu_type = (cpuid_data.eax & 0xF0FF0); switch (cpu_type) { case 0x006F0: case 0x10660: return IntelMerom; case 0x10670: case 0x106D0: return IntelPenryn; case 0x106A0: case 0x106E0: case 0x206E0: return IntelNehalem; case 0x20650: case 0x206C0: case 0x206F0: return IntelWestmere; case 0x206A0: case 0x206D0: case 0x306e0: return IntelSandyBridge; case 0x306A0: return IntelIvyBridge; case 0x306C0: case 0x306F0: case 0x40650: case 0x40660: return IntelHaswell; case 0x306D0: case 0x406F0: case 0x50660: return IntelBroadwell; case 0x406e0: case 0x506e0: return IntelSkylake; default: FATAL() << "CPU " << HEX(cpu_type) << " unknown."; return UnknownCpu; // not reached } } static void init_perf_event_attr(struct perf_event_attr* attr, perf_type_id type, unsigned config) { memset(attr, 0, sizeof(*attr)); attr->type = type; attr->size = sizeof(*attr); attr->config = config; // rr requires that its events count userspace tracee code // only. attr->exclude_kernel = 1; attr->exclude_guest = 1; } static void init_attributes() { if (attributes_initialized) { return; } attributes_initialized = true; CpuMicroarch uarch = get_cpu_microarch(); const PmuConfig* pmu = nullptr; for (size_t i = 0; i < array_length(pmu_configs); ++i) { if (uarch == pmu_configs[i].uarch) { pmu = &pmu_configs[i]; break; } } assert(pmu); if (!pmu->supported) { FATAL() << "Microarchitecture `" << pmu->name << "' currently unsupported."; } init_perf_event_attr(&ticks_attr, PERF_TYPE_RAW, pmu->rcb_cntr_event); init_perf_event_attr(&cycles_attr, PERF_TYPE_HARDWARE, PERF_COUNT_HW_CPU_CYCLES); init_perf_event_attr(&instructions_retired_attr, PERF_TYPE_RAW, pmu->rinsn_cntr_event); init_perf_event_attr(&hw_interrupts_attr, PERF_TYPE_RAW, pmu->hw_intr_cntr_event); // libpfm encodes the event with this bit set, so we'll do the // same thing. Unclear if necessary. hw_interrupts_attr.exclude_hv = 1; init_perf_event_attr(&page_faults_attr, PERF_TYPE_SOFTWARE, PERF_COUNT_SW_PAGE_FAULTS); } const struct perf_event_attr& PerfCounters::ticks_attr() { init_attributes(); return rr::ticks_attr; } PerfCounters::PerfCounters(pid_t tid) : tid(tid), started(false) { init_attributes(); } static ScopedFd start_counter(pid_t tid, int group_fd, struct perf_event_attr* attr) { int fd = syscall(__NR_perf_event_open, attr, tid, -1, group_fd, 0); if (0 > fd) { if (errno == EACCES) { FATAL() << "Permission denied to use 'perf_event_open'; are perf events " "enabled? Try 'perf record'."; } if (errno == ENOENT) { FATAL() << "Unable to open performance counter with 'perf_event_open'; " "are perf events enabled? Try 'perf record'."; } FATAL() << "Failed to initialize counter"; } if (ioctl(fd, PERF_EVENT_IOC_ENABLE, 0)) { FATAL() << "Failed to start counter"; } return fd; } static bool has_ioc_period_bug() { static bool did_test = false; static bool bug_detected = true; if (did_test) { return bug_detected; } // Start a cycles counter struct perf_event_attr attr = rr::cycles_attr; attr.sample_period = 0xfffffff; attr.exclude_kernel = 0; attr.disabled = 0; ScopedFd bug_fd = start_counter(0, -1, &attr); uint64_t new_period = 1; if (ioctl(bug_fd, PERF_EVENT_IOC_PERIOD, &new_period)) { FATAL() << "ioctl(PERF_EVENT_IOC_PERIOD) failed"; } struct pollfd poll_bug_fd = {.fd = bug_fd, .events = POLL_IN, .revents = 0 }; poll(&poll_bug_fd, 1, 0); bug_detected = poll_bug_fd.revents == 0; did_test = true; return bug_detected; } static void make_counter_async(ScopedFd& fd, int signal) { if (fcntl(fd, F_SETFL, O_ASYNC) || fcntl(fd, F_SETSIG, signal)) { FATAL() << "Failed to make ticks counter ASYNC with sig" << signal_name(signal); } } void PerfCounters::reset(Ticks ticks_period) { assert(ticks_period >= 0); if (!started) { struct perf_event_attr attr = rr::ticks_attr; attr.sample_period = ticks_period; fd_ticks = start_counter(tid, -1, &attr); struct f_owner_ex own; own.type = F_OWNER_TID; own.pid = tid; if (fcntl(fd_ticks, F_SETOWN_EX, &own)) { FATAL() << "Failed to SETOWN_EX ticks event fd"; } make_counter_async(fd_ticks, PerfCounters::TIME_SLICE_SIGNAL); if (extra_perf_counters_enabled()) { int group_leader = fd_ticks; fd_hw_interrupts = start_counter(tid, group_leader, &hw_interrupts_attr); fd_instructions_retired = start_counter(tid, group_leader, &instructions_retired_attr); fd_page_faults = start_counter(tid, group_leader, &page_faults_attr); } } else { if (ioctl(fd_ticks, PERF_EVENT_IOC_RESET, 0)) { FATAL() << "ioctl(PERF_EVENT_IOC_RESET) failed"; } if (ioctl(fd_ticks, PERF_EVENT_IOC_PERIOD, &ticks_period)) { FATAL() << "ioctl(PERF_EVENT_IOC_PERIOD) failed"; } if (ioctl(fd_ticks, PERF_EVENT_IOC_ENABLE, 0)) { FATAL() << "ioctl(PERF_EVENT_IOC_ENABLE) failed"; } } started = true; counting = true; } void PerfCounters::set_tid(pid_t tid) { stop(); this->tid = tid; } void PerfCounters::stop() { if (!started) { return; } started = false; fd_ticks.close(); fd_page_faults.close(); fd_hw_interrupts.close(); fd_instructions_retired.close(); } void PerfCounters::stop_counting() { counting = false; if (has_ioc_period_bug()) { stop(); } else { ioctl(fd_ticks, PERF_EVENT_IOC_DISABLE, 0); } } static int64_t read_counter(ScopedFd& fd) { int64_t val; ssize_t nread = read(fd, &val, sizeof(val)); assert(nread == sizeof(val)); return val; } Ticks PerfCounters::read_ticks() { uint64_t val = started && counting ? read_counter(fd_ticks) : 0; return val; } PerfCounters::Extra PerfCounters::read_extra() { assert(extra_perf_counters_enabled()); Extra extra; if (started) { extra.page_faults = read_counter(fd_page_faults); extra.hw_interrupts = read_counter(fd_hw_interrupts); extra.instructions_retired = read_counter(fd_instructions_retired); } else { memset(&extra, 0, sizeof(extra)); } return extra; } } // namespace rr rr-4.4.0/src/PerfCounters.h000066400000000000000000000053661277367620400155510ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PERF_COUNTERS_H_ #define RR_PERF_COUNTERS_H_ #ifndef _GNU_SOURCE #define _GNU_SOURCE 1 #endif #include #include #include #include "ScopedFd.h" #include "Ticks.h" struct perf_event_attr; namespace rr { /** * A class encapsulating the performance counters we use to monitor * each task during recording and replay. * * Normally we monitor a single kind of event that we use as a proxy * for progress, which we call "ticks". Currently this is the count of retired * conditional branches. We support dispatching a signal when the counter * reaches a particular value. * * When extra_perf_counters_enabled() returns true, we monitor additional * counters of interest. */ class PerfCounters { public: /** * Create performance counters monitoring the given task. */ PerfCounters(pid_t tid); ~PerfCounters() { stop(); } void set_tid(pid_t tid); // Change this to 'true' to enable perf counters that may be interesting // for experimentation, but aren't necessary for core functionality. static bool extra_perf_counters_enabled() { return false; } /** * Reset all counter values to 0 and program the counters to send * TIME_SLICE_SIGNAL when 'ticks_period' tick events have elapsed. (In reality * the hardware triggers its interrupt some time after that.) * This must be called while the task is stopped, and it must be called * before the task is allowed to run again. */ void reset(Ticks ticks_period); /** * Close the perfcounter fds. They will be automatically reopened if/when * reset is called again. */ void stop(); /** * Suspend counting until the next reset. This may or may not actually stop * the performance counters, depending on whether or not this is required * for correctness on this kernel version. */ void stop_counting(); /** * Read the current value of the ticks counter. */ Ticks read_ticks(); /** * Return the fd we last used to monitor the ticks counter. */ int ticks_fd() const { return fd_ticks.get(); } /* This choice is fairly arbitrary; linux doesn't use SIGSTKFLT so we * hope that tracees don't either. */ enum { TIME_SLICE_SIGNAL = SIGSTKFLT }; struct Extra { Extra() : page_faults(0), hw_interrupts(0), instructions_retired(0) {} int64_t page_faults; int64_t hw_interrupts; int64_t instructions_retired; }; Extra read_extra(); static const struct perf_event_attr& ticks_attr(); bool counting; private: pid_t tid; ScopedFd fd_ticks; ScopedFd fd_page_faults; ScopedFd fd_hw_interrupts; ScopedFd fd_instructions_retired; bool started; }; } // namespace rr #endif /* RR_PERF_COUNTERS_H_ */ rr-4.4.0/src/PreserveFileMonitor.h000066400000000000000000000015301277367620400170620ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PRESERVE_FILE_MONITOR_H_ #define RR_PRESERVE_FILE_MONITOR_H_ #include "FileMonitor.h" namespace rr { /** * A FileMonitor that does no monitoring of I/O itself, but prevents the file * descriptor from being closed (except via privileged syscalls made by * preload.c) or seen in /proc/pid/fd/. * * The mere existence of this monitor disables syscall buffering for the fd, so * we get syscall traps for close() etc on the fd. Then * rec_prepare_syscall_arch calls allow_close() to check whether closing is * allowed. */ class PreserveFileMonitor : public FileMonitor { public: PreserveFileMonitor() {} virtual Type type() { return Preserve; } virtual bool is_rr_fd() { return true; } }; } // namespace rr #endif /* RR_PRESERVE_FILE_MONITOR_H_ */ rr-4.4.0/src/ProcFdDirMonitor.cc000066400000000000000000000074351277367620400164530ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ProcFdDirMonitor.h" #include #include #include "AutoRemoteSyscalls.h" #include "RecordSession.h" #include "RecordTask.h" #include "log.h" using namespace std; namespace rr { ProcFdDirMonitor::ProcFdDirMonitor(Task* t, const string& pathname) { // XXX this makes some assumptions about namespaces... Probably fails // if |t| is not the same pid namespace as rr int ends_with_slash = (pathname.back() == '/'); if (pathname.substr(0, 6) == string("/proc/") && pathname.substr(pathname.size() - 3 - ends_with_slash, 3) == string("/fd")) { string s = pathname.substr(6, pathname.size() - 9 - ends_with_slash); char* end; int tid = strtol(s.c_str(), &end, 10); if (!*end) { Task* target = t->session().find_task(tid); if (target) { tuid = target->tuid(); } } } } // returns the number of valid dirent structs left in the buffer template static int filter_dirent_structs(RecordTask* t, uint8_t* buf, size_t size) { int bytes = 0; size_t current_offset = 0; while (1) { if (current_offset == size) { break; } D* current_struct = reinterpret_cast(buf + current_offset); auto next_off = current_offset + current_struct->d_reclen; char* fname = (char*)current_struct->d_name; char* end; int fd = strtol(fname, &end, 10); if (!*end && t->fd_table()->is_rr_fd(fd)) { // Skip this entry. memmove(current_struct, buf + next_off, size - next_off); size -= (next_off - current_offset); next_off = current_offset; } else { // Either this is a tracee fd or not an fd at all (e.g. '.') bytes += current_struct->d_reclen; } current_offset = next_off; } return bytes; } template static void filter_dirents_arch(RecordTask* t) { auto regs = t->regs(); remote_ptr ptr(regs.arg2()); size_t len = regs.arg3(); if (regs.syscall_failed() || !regs.syscall_result()) { return; } while (1) { vector buf = t->read_mem(ptr, len); int bytes = regs.syscall_result(); if (regs.original_syscallno() == Arch::getdents64) { bytes = filter_dirent_structs(t, buf.data(), bytes); } else { bytes = filter_dirent_structs(t, buf.data(), bytes); } if (bytes > 0) { t->write_mem(ptr, buf.data(), bytes); regs.set_syscall_result(bytes); t->set_regs(regs); // Explicitly record what the kernel may have touched and we discarded, // because it's userspace modification that will not be caught otherwise. if (len > (size_t)bytes) { t->record_remote(ptr + bytes, len - bytes); } return; } // We filtered out all the entries, so we need to repeat the syscall. { AutoRemoteSyscalls remote(t); remote.syscall(regs.original_syscallno(), regs.arg1(), regs.arg2(), regs.arg3()); // Only copy over the syscall result. In particular, we don't want to // copy the AutoRemoteSyscalls ip(). regs.set_syscall_result(t->regs().syscall_result()); } if (regs.syscall_failed() || regs.syscall_result() == 0) { // Save the new syscall result, and record the buffer we will otherwise // ignore. t->record_remote(ptr, len); t->set_regs(regs); return; } } } static void filter_dirents(RecordTask* t) { RR_ARCH_FUNCTION(filter_dirents_arch, t->arch(), t); } void ProcFdDirMonitor::filter_getdents(RecordTask* t) { ASSERT(t, !t->session().is_replaying()); auto* target = static_cast(t->session().find_task(tuid)); if (!target) { return; } filter_dirents(t); } } // namespace rr rr-4.4.0/src/ProcFdDirMonitor.h000066400000000000000000000013221277367620400163020ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PROC_FD_DIR_MONITOR_H_ #define RR_PROC_FD_DIR_MONITOR_H_ #include "FileMonitor.h" #include "TaskishUid.h" namespace rr { /** * A FileMonitor to intercept enumerations of /proc//fd so that entries * for rr's private fds can be hidden when is a tracee. */ class ProcFdDirMonitor : public FileMonitor { public: ProcFdDirMonitor(Task* t, const std::string& pathname); virtual Type type() { return ProcFd; } virtual void filter_getdents(RecordTask* t); private: // 0 if this doesn't object doesn't refer to a tracee's proc-mem. TaskUid tuid; }; } // namespace rr #endif /* RR_PROC_FD_DIR_MONITOR_H_ */ rr-4.4.0/src/ProcMemMonitor.cc000066400000000000000000000026521277367620400161750ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ProcMemMonitor.h" #include #include "AutoRemoteSyscalls.h" #include "RecordSession.h" #include "RecordTask.h" #include "log.h" using namespace std; namespace rr { ProcMemMonitor::ProcMemMonitor(Task* t, const string& pathname) { // XXX this makes some assumptions about namespaces... Probably fails // if |t| is not the same pid namespace as rr if (pathname.substr(0, 6) == string("/proc/") && pathname.substr(pathname.size() - 4, 4) == string("/mem")) { string s = pathname.substr(6, pathname.size() - 10); char* end; int tid = strtol(s.c_str(), &end, 10); if (!*end) { Task* target = t->session().find_task(tid); if (target) { tuid = target->tuid(); } } } } void ProcMemMonitor::did_write(Task* t, const std::vector& ranges, int64_t offset) { if (t->session().is_replaying() || ranges.empty()) { return; } auto* target = static_cast(t->session().find_task(tuid)); if (!target) { return; } ASSERT(t, offset >= 0) << "Only pwrite/pwritev supported on /proc//mem currently"; // XXX to fix that, we'd have to grab the file offset from // /proc//fdinfo. for (auto& r : ranges) { target->record_remote(remote_ptr(offset), r.length); offset += r.length; } } } // namespace rr rr-4.4.0/src/ProcMemMonitor.h000066400000000000000000000014601277367620400160330ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PROC_MEM_MONITOR_H_ #define RR_PROC_MEM_MONITOR_H_ #include "FileMonitor.h" #include "TaskishUid.h" namespace rr { /** * A FileMonitor to track writes to /proc//mem so they can be replayed * when is a replayed tracee. */ class ProcMemMonitor : public FileMonitor { public: ProcMemMonitor(Task* t, const std::string& pathname); virtual Type type() { return ProcMem; } /** * During replay, copy writes to tracee |tid|'s memory. */ virtual void did_write(Task* t, const std::vector& ranges, int64_t offset); private: // 0 if this doesn't object doesn't refer to a tracee's proc-mem. TaskUid tuid; }; } // namespace rr #endif /* RR_PROC_MEM_MONITOR_H_ */ rr-4.4.0/src/PropertyTable.h000066400000000000000000000044001277367620400157120ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PROPERTY_TABLE_H_ #define RR_PROPERTY_TABLE_H_ #include #include #include #include namespace rr { template class Property; /** * A PropertyTable is a heterogenously-typed set of property values. * It maps Property (effectively, property names) to values of * type T. It owns the property values. * Property values can be created, accessed and removed in a type-safe way * via the Property class. */ class PropertyTable { public: PropertyTable() {} ~PropertyTable() { for (auto& p : values) { p.first->destroy_property(p.second); } } private: template friend class Property; class PropertyBase { public: virtual ~PropertyBase() {} virtual void destroy_property(void* v) const = 0; }; std::vector> values; }; /** * Create an instance of this class to declare a property name. * The methods of this class call properties() on their Object parameter to * get the PropertyTable. */ template class Property : protected PropertyTable::PropertyBase { public: Property() {} T& create(Object& o) const { assert(!get(o)); T* t = new T(); o.properties().values.push_back(std::make_pair( static_cast(this), t)); return *t; } T* get(Object& o) const { for (auto& p : o.properties().values) { if (p.first == this) { return static_cast(p.second); } } return nullptr; } T& get_or_create(Object& o) const { T* t = get(o); if (t) { return *t; } return create(o); } std::unique_ptr remove(Object& o) const { auto& values = o.properties().values; std::unique_ptr result; for (auto it = values.begin(); it != values.end(); ++it) { if (it->first == this) { result = std::unique_ptr(static_cast(it->second)); values.erase(it); break; } } return result; } protected: virtual void destroy_property(void* v) const { delete static_cast(v); } }; } // namespace rr #endif /* RR_PROPERTY_TABLE_H_ */ rr-4.4.0/src/PsCommand.cc000066400000000000000000000107221277367620400151410ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include #include "Command.h" #include "TraceStream.h" #include "TraceTaskEvent.h" #include "main.h" using namespace std; namespace rr { class PsCommand : public Command { public: virtual int run(vector& args); protected: PsCommand(const char* name, const char* help) : Command(name, help) {} static PsCommand singleton; }; PsCommand PsCommand::singleton("ps", " rr ps []\n"); static void print_exec_cmd_line(const TraceTaskEvent& event, FILE* out) { bool first = true; for (auto& word : event.cmd_line()) { fprintf(out, "%s%s", first ? "" : " ", word.c_str()); first = false; } fprintf(out, "\n"); } static void update_tid_to_pid_map(map& tid_to_pid, const TraceTaskEvent& e) { if (e.type() == TraceTaskEvent::CLONE) { if (e.clone_flags() & CLONE_THREAD) { // thread clone. Record thread's pid. tid_to_pid[e.tid()] = tid_to_pid[e.parent_tid()]; } else { // Some kind of fork. This task is its own pid. tid_to_pid[e.tid()] = e.tid(); } } else if (e.type() == TraceTaskEvent::EXIT) { tid_to_pid.erase(e.tid()); } } static int count_tids_for_pid(const std::map tid_to_pid, pid_t pid) { int count = 0; for (auto& tp : tid_to_pid) { if (tp.second == pid) { ++count; } } return count; } static ssize_t find_cmd_line(pid_t pid, const vector& events, size_t current_event, const map current_tid_to_pid) { map tid_to_pid = current_tid_to_pid; for (size_t i = current_event; i < events.size(); ++i) { const TraceTaskEvent& e = events[i]; if (e.type() == TraceTaskEvent::EXEC && tid_to_pid[e.tid()] == pid) { return i; } if (e.type() == TraceTaskEvent::EXIT && tid_to_pid[e.tid()] == pid && count_tids_for_pid(tid_to_pid, pid) == 1) { return -1; } update_tid_to_pid_map(tid_to_pid, e); } return -1; } static int find_exit_code(pid_t pid, const vector& events, size_t current_event, const map current_tid_to_pid) { map tid_to_pid = current_tid_to_pid; for (size_t i = current_event; i < events.size(); ++i) { const TraceTaskEvent& e = events[i]; if (e.type() == TraceTaskEvent::EXIT && tid_to_pid[e.tid()] == pid && count_tids_for_pid(tid_to_pid, pid) == 1) { WaitStatus status = e.exit_status(); if (status.type() == WaitStatus::EXIT) { return status.exit_code(); } assert(status.type() == WaitStatus::FATAL_SIGNAL); return -status.fatal_sig(); } update_tid_to_pid_map(tid_to_pid, e); } return -SIGKILL; } static int ps(const string& trace_dir, FILE* out) { TraceReader trace(trace_dir); fprintf(out, "PID\tPPID\tEXIT\tCMD\n"); vector events; while (trace.good()) { events.push_back(trace.read_task_event()); } if (events.empty() || events[0].type() != TraceTaskEvent::EXEC) { fprintf(stderr, "Invalid trace\n"); return 1; } map tid_to_pid; pid_t initial_tid = events[0].tid(); tid_to_pid[initial_tid] = initial_tid; fprintf(out, "%d\t--\t%d\t", initial_tid, find_exit_code(initial_tid, events, 0, tid_to_pid)); print_exec_cmd_line(events[0], out); for (size_t i = 1; i < events.size(); ++i) { auto& e = events[i]; update_tid_to_pid_map(tid_to_pid, e); if (e.type() == TraceTaskEvent::CLONE && !(e.clone_flags() & CLONE_THREAD)) { pid_t pid = tid_to_pid[e.tid()]; fprintf(out, "%d\t%d\t%d\t", e.tid(), tid_to_pid[e.parent_tid()], find_exit_code(pid, events, i, tid_to_pid)); ssize_t cmd_line_index = find_cmd_line(pid, events, i, tid_to_pid); if (cmd_line_index < 0) { // The main thread exited. All other threads must too, so there // is no more opportunity for e's pid to exec. fprintf(out, "(forked without exec)\n"); } else { print_exec_cmd_line(events[cmd_line_index], out); } } } return 0; } int PsCommand::run(vector& args) { while (parse_global_option(args)) { } string trace_dir; if (!parse_optional_trace_dir(args, &trace_dir)) { print_help(stderr); return 1; } return ps(trace_dir, stdout); } } // namespace rr rr-4.4.0/src/RecordCommand.cc000066400000000000000000000276231277367620400160050ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "RecordCommand.h" #include #include #include #include "preload/preload_interface.h" #include "Flags.h" #include "RecordSession.h" #include "StringVectorToCharArray.h" #include "WaitStatus.h" #include "kernel_metadata.h" #include "log.h" #include "main.h" #include "util.h" using namespace std; namespace rr { RecordCommand RecordCommand::singleton( "record", " rr record [OPTION]... [exe-args]...\n" " -b, --force-syscall-buffer force the syscall buffer preload library\n" " to be used, even if that's probably a bad\n" " idea\n" " -c, --num-cpu-ticks= maximum number of 'CPU ticks' (currently \n" " retired conditional branches) to allow a \n" " task to run before interrupting it\n" " -h, --chaos randomize scheduling decisions to try to \n" " reproduce bugs\n" " -i, --ignore-signal= block from being delivered to \n" " tracees. Probably only useful for unit \n" " tests.\n" " -n, --no-syscall-buffer disable the syscall buffer preload \n" " library even if it would otherwise be used\n" " --no-file-cloning disable file cloning for mmapped files\n" " --no-read-cloning disable file-block cloning for syscallbuf\n" " reads\n" " --syscall-buffer-size= desired size of syscall buffer in kB.\n" " Mainly for tests\n" " -s, --always-switch try to context switch at every rr event\n" " -t, --continue-through-signal=\n" " Unhandled signals will be ignored\n" " instead of terminating the program. The\n" " signal will still be delivered for user\n" " handlers and debugging.\n" " -u, --cpu-unbound allow tracees to run on any virtual CPU.\n" " Default is to bind to CPU 0. This option\n" " can cause replay divergence: use with\n" " caution.\n" " -v, --env=NAME=VALUE value to add to the environment of the\n" " tracee. There can be any number of these.\n" " -w, --wait Wait for all child processes to exit, not\n" " just the initial process.\n" " --ignore-nested Directly start child process when running\n" " under nested rr recording, instead of\n" " raising an error.\n"); struct RecordFlags { vector extra_env; /* Max counter value before the scheduler interrupts a tracee. */ Ticks max_ticks; /* Whenever |ignore_sig| is pending for a tracee, decline to * deliver it. */ int ignore_sig; /* Whenever |continue_through_sig| is delivered to a tracee, if there is no * user handler and the signal would terminate the program, just ignore it. */ int continue_through_sig; /* Whether to use syscall buffering optimization during recording. */ RecordSession::SyscallBuffering use_syscall_buffer; /* If nonzero, the desired syscall buffer size. Must be a multiple of the page * size. */ size_t syscall_buffer_size; /* Whether to use file-cloning optimization during recording. */ bool use_file_cloning; /* Whether to use read-cloning optimization during recording. */ bool use_read_cloning; /* Whether tracee processes in record and replay are allowed * to run on any logical CPU. */ RecordSession::BindCPU bind_cpu; /* True if we should context switch after every rr event */ bool always_switch; /* Whether to enable chaos mode in the scheduler */ bool chaos; /* True if we should wait for all processes to exit before finishing * recording. */ bool wait_for_all; /* Start child process directly if run under nested rr recording */ bool ignore_nested; RecordFlags() : max_ticks(Scheduler::DEFAULT_MAX_TICKS), ignore_sig(0), continue_through_sig(0), use_syscall_buffer(RecordSession::ENABLE_SYSCALL_BUF), syscall_buffer_size(0), use_file_cloning(true), use_read_cloning(true), bind_cpu(RecordSession::BIND_CPU), always_switch(false), chaos(false), wait_for_all(false), ignore_nested(false) {} }; static void parse_signal_name(ParsedOption& opt) { if (opt.int_value != INT64_MIN) { return; } for (int i = 1; i < _NSIG; i++) { std::string signame = signal_name(i); if (signame == opt.value) { opt.int_value = i; return; } assert(signame[0] == 'S' && signame[1] == 'I' && signame[2] == 'G'); if (signame.substr(3) == opt.value) { opt.int_value = i; return; } } } static bool parse_record_arg(vector& args, RecordFlags& flags) { if (parse_global_option(args)) { return true; } static const OptionSpec options[] = { { 0, "no-read-cloning", NO_PARAMETER }, { 1, "no-file-cloning", NO_PARAMETER }, { 2, "syscall-buffer-size", HAS_PARAMETER }, { 3, "ignore-nested", NO_PARAMETER }, { 'b', "force-syscall-buffer", NO_PARAMETER }, { 'c', "num-cpu-ticks", HAS_PARAMETER }, { 'h', "chaos", NO_PARAMETER }, { 'i', "ignore-signal", HAS_PARAMETER }, { 'n', "no-syscall-buffer", NO_PARAMETER }, { 's', "always-switch", NO_PARAMETER }, { 't', "continue-through-signal", HAS_PARAMETER }, { 'u', "cpu-unbound", NO_PARAMETER }, { 'v', "env", HAS_PARAMETER }, { 'w', "wait", NO_PARAMETER } }; ParsedOption opt; auto args_copy = args; if (!Command::parse_option(args_copy, options, &opt)) { return false; } switch (opt.short_name) { case 'b': flags.use_syscall_buffer = RecordSession::ENABLE_SYSCALL_BUF; break; case 'c': if (!opt.verify_valid_int(1, INT64_MAX)) { return false; } flags.max_ticks = opt.int_value; break; case 'h': LOG(info) << "Enabled chaos mode"; flags.chaos = true; break; case 'i': parse_signal_name(opt); if (!opt.verify_valid_int(1, _NSIG - 1)) { return false; } flags.ignore_sig = opt.int_value; break; case 'n': flags.use_syscall_buffer = RecordSession::DISABLE_SYSCALL_BUF; break; case 0: flags.use_read_cloning = false; break; case 1: flags.use_file_cloning = false; break; case 2: if (!opt.verify_valid_int(4, 1024 * 1024) || (opt.int_value & (page_size() / 1024 - 1))) { return false; } flags.syscall_buffer_size = opt.int_value * 1024; break; case 3: flags.ignore_nested = true; break; case 's': flags.always_switch = true; break; case 't': parse_signal_name(opt); if (!opt.verify_valid_int(1, _NSIG - 1)) { return false; } flags.continue_through_sig = opt.int_value; break; case 'u': flags.bind_cpu = RecordSession::UNBOUND_CPU; break; case 'v': flags.extra_env.push_back(opt.value); break; case 'w': flags.wait_for_all = true; break; default: assert(0 && "Unknown option"); } args = args_copy; return true; } static bool term_request; /** * A terminating signal was received. Set the |term_request| bit to * terminate the trace at the next convenient point. * * If there's already a term request pending, then assume rr is wedged * and abort(). */ static void handle_SIGTERM(__attribute__((unused)) int sig) { // Don't use LOG() here because we're in a signal handler. If we do anything // that could allocate, we could deadlock. if (term_request) { static const char msg[] = "Received SIGTERM while an earlier one was pending. We're " "probably wedged.\n"; write(STDERR_FILENO, msg, sizeof(msg) - 1); abort(); } term_request = true; } static void install_signal_handlers(void) { struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = handle_SIGTERM; sigaction(SIGTERM, &sa, nullptr); sa.sa_handler = SIG_IGN; sigaction(SIGINT, &sa, nullptr); } static void setup_session_from_flags(RecordSession& session, const RecordFlags& flags) { session.scheduler().set_max_ticks(flags.max_ticks); session.scheduler().set_always_switch(flags.always_switch); session.set_enable_chaos(flags.chaos); session.set_use_read_cloning(flags.use_read_cloning); session.set_use_file_cloning(flags.use_file_cloning); session.set_ignore_sig(flags.ignore_sig); session.set_continue_through_sig(flags.continue_through_sig); session.set_wait_for_all(flags.wait_for_all); if (flags.syscall_buffer_size > 0) { session.set_syscall_buffer_size(flags.syscall_buffer_size); } } static WaitStatus record(const vector& args, const RecordFlags& flags) { LOG(info) << "Start recording..."; auto session = RecordSession::create( args, flags.extra_env, flags.use_syscall_buffer, flags.bind_cpu); setup_session_from_flags(*session, flags); // Install signal handlers after creating the session, to ensure they're not // inherited by the tracee. install_signal_handlers(); RecordSession::RecordResult step_result; do { bool done_initial_exec = session->done_initial_exec(); step_result = session->record_step(); if (!done_initial_exec && session->done_initial_exec()) { session->trace_writer().make_latest_trace(); } } while (step_result.status == RecordSession::STEP_CONTINUE && !term_request); session->terminate_recording(); switch (step_result.status) { case RecordSession::STEP_CONTINUE: // SIGINT or something like that interrupted us. return WaitStatus::for_fatal_sig(SIGINT); case RecordSession::STEP_EXITED: return step_result.exit_status; case RecordSession::STEP_SPAWN_FAILED: cerr << "\n" << step_result.failure_message << "\n"; return WaitStatus::for_exit_code(EX_UNAVAILABLE); default: assert(0 && "Unknown exit status"); return WaitStatus(); } } static void exec_child(vector& args) { execvp(args[0].c_str(), StringVectorToCharArray(args).get()); // That failed. Try executing the file directly. execv(args[0].c_str(), StringVectorToCharArray(args).get()); switch (errno) { case ENOENT: fprintf(stderr, "execv failed: '%s' (or interpreter) not found (%s)", args[0].c_str(), errno_name(errno).c_str()); break; default: fprintf(stderr, "execv of '%s' failed (%s)", args[0].c_str(), errno_name(errno).c_str()); break; } _exit(1); // Never returns! } int RecordCommand::run(vector& args) { RecordFlags flags; while (parse_record_arg(args, flags)) { } if (running_under_rr()) { if (flags.ignore_nested) { exec_child(args); } fprintf(stderr, "rr: cannot run rr recording under rr. Exiting.\n" "Use `rr record --ignore-nested` to start the child " "process directly.\n"); return 1; } if (!verify_not_option(args) || args.size() == 0) { print_help(stderr); return 1; } assert_prerequisites(flags.use_syscall_buffer); check_performance_settings(); WaitStatus status = record(args, flags); switch (status.type()) { case WaitStatus::EXIT: return status.exit_code(); case WaitStatus::FATAL_SIGNAL: signal(status.fatal_sig(), SIG_DFL); prctl(PR_SET_DUMPABLE, 0); kill(getpid(), status.fatal_sig()); break; default: FATAL() << "Don't know why we exited: " << status; break; } return 1; } } // namespace rr rr-4.4.0/src/RecordCommand.h000066400000000000000000000007751277367620400156460ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_RECORD_COMMAND_H_ #define RR_RECORD_COMMAND_H_ #include "Command.h" namespace rr { class RecordCommand : public Command { public: virtual int run(std::vector& args); static RecordCommand* get() { return &singleton; } protected: RecordCommand(const char* name, const char* help) : Command(name, help) {} static RecordCommand singleton; }; } // namespace rr #endif // RR_RECORD_COMMAND_H_ rr-4.4.0/src/RecordSession.cc000066400000000000000000002062711277367620400160500ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "RecordSession.h" #include #include #include #include #include #include "AutoRemoteSyscalls.h" #include "ElfReader.h" #include "Flags.h" #include "RecordTask.h" #include "ftrace.h" #include "kernel_metadata.h" #include "log.h" #include "record_signal.h" #include "record_syscall.h" #include "seccomp-bpf.h" namespace rr { // Undef si_addr_lsb since it's an alias for a field name that doesn't exist, // and we need to use the actual field name. #ifdef si_addr_lsb #undef si_addr_lsb #endif using namespace rr; using namespace std; /** * Create a pulseaudio client config file with shm disabled. That may * be the cause of a mysterious divergence. Return an envpair to set * in the tracee environment. */ static string create_pulseaudio_config() { // TODO let PULSE_CLIENTCONFIG env var take precedence. static const char pulseaudio_config_path[] = "/etc/pulse/client.conf"; if (access(pulseaudio_config_path, R_OK)) { // Assume pulseaudio isn't installed return ""; } char tmp[] = "/tmp/rr-pulseaudio-client-conf-XXXXXX"; int fd = mkstemp(tmp); fcntl(fd, F_SETFD, FD_CLOEXEC); unlink(tmp); // The fd is deliberately leaked so that the /proc/fd link below works // indefinitely. But we stop it leaking into tracee processes. stringstream procfile; procfile << "/proc/" << getpid() << "/fd/" << fd; // Running cp passing the procfile path under Docker fails for some // odd filesystem-related reason, so just read/write the contents. int pulse_config_fd = open(pulseaudio_config_path, O_RDONLY, 0); if (pulse_config_fd < 0) { FATAL() << "Failed to open pulseaudio config file: '" << pulseaudio_config_path << "'"; } char buf[BUFSIZ]; while (true) { ssize_t size = read(pulse_config_fd, buf, BUFSIZ); if (size == 0) { break; } else if (size < 0) { FATAL() << "Failed to read pulseaudio config file"; } if (write(fd, buf, size) != size) { FATAL() << "Failed to write temp pulseaudio config file to " << procfile.str(); } } close(pulse_config_fd); char disable_shm[] = "disable-shm = true\n"; ssize_t nwritten = write(fd, disable_shm, sizeof(disable_shm) - 1); if (nwritten != sizeof(disable_shm) - 1) { FATAL() << "Failed to append '" << disable_shm << "' to " << procfile.str(); } stringstream envpair; envpair << "PULSE_CLIENTCONFIG=" << procfile.str(); return envpair.str(); } static int get_num_cpus() { int cpus = (int)sysconf(_SC_NPROCESSORS_ONLN); return cpus > 0 ? cpus : 1; } /** * Pick a CPU at random to bind to, unless --cpu-unbound has been given, * in which case we return -1. */ static int choose_cpu(RecordSession::BindCPU bind_cpu) { if (bind_cpu == RecordSession::UNBOUND_CPU) { return -1; } // Pin tracee tasks to logical CPU 0, both in // recording and replay. Tracees can see which HW // thread they're running on by asking CPUID, and we // don't have a way to emulate it yet. So if a tracee // happens to be scheduled on a different core in // recording than replay, it can diverge. (And // indeed, has been observed to diverge in practice, // in glibc.) // // Note that we will pin both the tracee processes *and* // the tracer process. This ends up being a tidy // performance win in certain circumstances, // presumably due to cheaper context switching and/or // better interaction with CPU frequency scaling. return random() % get_num_cpus(); } template static remote_ptr mask_low_bit(remote_ptr p) { return p.as_int() & ~uintptr_t(1); } template static void record_robust_futex_change( RecordTask* t, const typename Arch::robust_list_head& head, remote_ptr base) { if (base.is_null()) { return; } remote_ptr futex_void_ptr = base + head.futex_offset; auto futex_ptr = futex_void_ptr.cast(); // We can't just record the current futex value because at this point // in task exit the robust futex handling has not happened yet. So we have // to emulate what the kernel will do! bool ok = true; uint32_t val = t->read_mem(futex_ptr, &ok); if (!ok) { return; } if (pid_t(val & FUTEX_TID_MASK) != t->own_namespace_rec_tid) { return; } val = (val & FUTEX_WAITERS) | FUTEX_OWNER_DIED; // Update memory now so that the kernel doesn't decide to do it later, at // a time that might race with other tracee execution. t->write_mem(futex_ptr, val); t->record_local(futex_ptr, &val); } /** * Any user-space writes performed by robust futex handling are captured here. * They must be emulated during replay; the kernel will not do it for us * during replay because the TID value in each futex is the recorded * TID, not the actual TID of the dying task. */ template static void record_robust_futex_changes_arch(RecordTask* t) { auto head_ptr = t->robust_list().cast(); if (head_ptr.is_null()) { return; } ASSERT(t, t->robust_list_len() == sizeof(typename Arch::robust_list_head)); bool ok = true; auto head = t->read_mem(head_ptr, &ok); if (!ok) { return; } record_robust_futex_change(t, head, mask_low_bit(head.list_op_pending.rptr())); for (auto current = mask_low_bit(head.list.next.rptr()); current.as_int() != head_ptr.as_int();) { record_robust_futex_change(t, head, current); auto next = t->read_mem(current, &ok); if (!ok) { return; } current = mask_low_bit(next.next.rptr()); } } static void record_robust_futex_changes(RecordTask* t) { RR_ARCH_FUNCTION(record_robust_futex_changes_arch, t->arch(), t); } /** * Return true if we handle a ptrace exit event for task t. When this returns * true, t has been deleted and cannot be referenced again. */ static bool handle_ptrace_exit_event(RecordTask* t) { if (t->ptrace_event() != PTRACE_EVENT_EXIT) { return false; } if (t->stable_exit) { LOG(debug) << "stable exit"; } else { LOG(warn) << "unstable exit; may misrecord CLONE_CHILD_CLEARTID memory race"; t->task_group()->destabilize(); } record_robust_futex_changes(t); WaitStatus exit_status = t->get_ptrace_eventmsg(); t->session().trace_writer().write_task_event( TraceTaskEvent::for_exit(t->tid, exit_status)); if (t->task_group()->tgid == t->tid) { t->task_group()->exit_status = exit_status; } // Delete t. t's destructor writes the final EV_(UNSTABLE_)EXIT. t->destroy(); return true; } static void note_entering_syscall(RecordTask* t) { ASSERT(t, EV_SYSCALL == t->ev().type()); t->ev().Syscall().state = ENTERING_SYSCALL; if (!t->ev().Syscall().is_restart) { /* Save a copy of the arg registers so that we * can use them to detect later restarted * syscalls, if this syscall ends up being * restarted. We have to save the registers * in this rather awkward place because we * need the original registers; the restart * (if it's not a SYS_restart_syscall restart) * will use the original registers. */ t->ev().Syscall().regs = t->regs(); } } void RecordSession::handle_seccomp_traced_syscall(RecordTask* t, StepState* step_state, RecordResult* result, bool* did_enter_syscall) { *did_enter_syscall = false; int syscallno = t->regs().original_syscallno(); if (syscallno < 0) { // negative syscall numbers after a SECCOMP event // are treated as "skip this syscall". There will be one syscall event // reported instead of two. So fake an enter-syscall event now. t->emulate_syscall_entry(t->regs()); t->push_event(SyscallEvent(syscallno, t->arch())); note_entering_syscall(t); // Don't continue yet. At the next iteration of record_step, we'll // enter syscall_state_changed and that will trigger a continue to // the syscall exit. step_state->continue_type = RecordSession::DONT_CONTINUE; return; } if (syscall_seccomp_ordering_ == SECCOMP_BEFORE_PTRACE_SYSCALL) { // The next continue needs to be a PTRACE_SYSCALL to observe // the enter-syscall event. step_state->continue_type = RecordSession::CONTINUE_SYSCALL; } else { ASSERT(t, syscall_seccomp_ordering_ == PTRACE_SYSCALL_BEFORE_SECCOMP); if (t->ev().is_syscall_event() && t->ev().Syscall().state == PROCESSING_SYSCALL) { // We did PTRACE_SYSCALL and already saw a syscall trap. Just ignore this. LOG(debug) << "Ignoring SECCOMP syscall trap since we already got a " "PTRACE_SYSCALL trap"; // The next continue needs to be a PTRACE_SYSCALL to observe // the exit-syscall event. step_state->continue_type = RecordSession::CONTINUE_SYSCALL; } else { // We've already passed the PTRACE_SYSCALL trap for syscall entry, so // we need to handle that now. t->emulate_syscall_entry(t->regs()); process_syscall_entry(t, step_state, result); *did_enter_syscall = true; } } } static void handle_seccomp_trap(RecordTask* t, RecordSession::StepState* step_state, uint16_t seccomp_data) { int syscallno = t->regs().original_syscallno(); t->emulate_syscall_entry(t->regs()); if (!t->is_in_untraced_syscall()) { t->push_event(SyscallEvent(syscallno, t->arch())); note_entering_syscall(t); } Registers r = t->regs(); // Use NativeArch here because different versions of system headers // have inconsistent field naming. union { NativeArch::siginfo_t native_api; siginfo_t linux_api; } si; memset(&si, 0, sizeof(si)); si.native_api.si_signo = SIGSYS; si.native_api.si_errno = seccomp_data; si.native_api.si_code = SYS_SECCOMP; switch (r.arch()) { case x86: si.native_api._sifields._sigsys._arch = AUDIT_ARCH_I386; break; case x86_64: si.native_api._sifields._sigsys._arch = AUDIT_ARCH_X86_64; break; default: assert(0 && "Unknown architecture"); break; } si.native_api._sifields._sigsys._syscall = syscallno; // We don't set call_addr here, because the current ip() might not be the // ip() at which we deliver the signal, and they must match. In particular // this event might be triggered during syscallbuf processing but delivery // delayed until we exit the syscallbuf code. t->stash_synthetic_sig(si.linux_api, DETERMINISTIC_SIG); // Tests show that the current registers are preserved (on x86, eax/rax // retains the syscall number). r.set_syscallno(syscallno); // Cause kernel processing to skip the syscall r.set_original_syscallno(-1); t->set_regs(r); // Don't continue yet. At the next iteration of record_step, if we // recorded the syscall-entry we'll enter syscall_state_changed and // that will trigger a continue to the syscall exit. step_state->continue_type = RecordSession::DONT_CONTINUE; } static void handle_seccomp_errno(RecordTask* t, RecordSession::StepState* step_state, uint16_t seccomp_data) { int syscallno = t->regs().original_syscallno(); t->emulate_syscall_entry(t->regs()); if (!t->is_in_untraced_syscall()) { t->push_event(SyscallEvent(syscallno, t->arch())); note_entering_syscall(t); } Registers r = t->regs(); // Cause kernel processing to skip the syscall r.set_original_syscallno(-1); r.set_syscall_result(-seccomp_data); t->set_regs(r); // Don't continue yet. At the next iteration of record_step, if we // recorded the syscall-entry we'll enter syscall_state_changed and // that will trigger a continue to the syscall exit. step_state->continue_type = RecordSession::DONT_CONTINUE; } bool RecordSession::handle_ptrace_event(RecordTask* t, StepState* step_state, RecordResult* result, bool* did_enter_syscall) { *did_enter_syscall = false; if (t->status().group_stop()) { last_task_switchable = ALLOW_SWITCH; step_state->continue_type = DONT_CONTINUE; return true; } int event = t->ptrace_event(); if (!event) { return false; } LOG(debug) << " " << t->tid << ": handle_ptrace_event " << ptrace_event_name(event) << ": event " << t->ev(); switch (event) { case PTRACE_EVENT_SECCOMP_OBSOLETE: case PTRACE_EVENT_SECCOMP: { if (syscall_seccomp_ordering_ == PTRACE_SYSCALL_BEFORE_SECCOMP_UNKNOWN) { syscall_seccomp_ordering_ = SECCOMP_BEFORE_PTRACE_SYSCALL; } uint16_t seccomp_data = t->get_ptrace_eventmsg_seccomp_data(); if (seccomp_data == SECCOMP_RET_DATA) { LOG(debug) << " traced syscall entered: " << syscall_name(t->regs().original_syscallno(), t->arch()); handle_seccomp_traced_syscall(t, step_state, result, did_enter_syscall); } else { uint32_t real_result = seccomp_filter_rewriter().map_filter_data_to_real_result( seccomp_data); uint16_t real_result_data = real_result & SECCOMP_RET_DATA; switch (real_result & SECCOMP_RET_ACTION) { case SECCOMP_RET_TRAP: LOG(debug) << " seccomp trap"; handle_seccomp_trap(t, step_state, real_result_data); break; case SECCOMP_RET_ERRNO: LOG(debug) << " seccomp errno"; handle_seccomp_errno(t, step_state, real_result_data); break; default: ASSERT(t, false) << "Seccomp result not handled"; break; } } break; } case PTRACE_EVENT_EXEC: ASSERT(t, t->task_group()->task_set().size() == 1) << "Found lingering task which is not the task-group leader???"; t->post_exec(); // Skip past the ptrace event. step_state->continue_type = CONTINUE_SYSCALL; break; default: ASSERT(t, false) << "Unhandled ptrace event " << ptrace_event_name(event) << "(" << event << ")"; break; } return true; } static void debug_exec_state(const char* msg, RecordTask* t) { LOG(debug) << msg << ": status=" << t->status(); } void RecordSession::task_continue(const StepState& step_state) { RecordTask* t = scheduler().current(); ASSERT(t, step_state.continue_type != DONT_CONTINUE); // A task in an emulated ptrace-stop must really stay stopped ASSERT(t, !t->emulated_stop_pending); bool may_restart = t->at_may_restart_syscall(); if (may_restart && t->seccomp_bpf_enabled) { LOG(debug) << " PTRACE_SYSCALL to possibly-restarted " << t->ev(); } if (!t->vm()->first_run_event()) { t->vm()->set_first_run_event(trace_writer().time()); } TicksRequest ticks_request; ResumeRequest resume; if (step_state.continue_type == CONTINUE_SYSCALL) { ticks_request = RESUME_NO_TICKS; resume = RESUME_SYSCALL; } else { if (t->has_stashed_sig(PerfCounters::TIME_SLICE_SIGNAL)) { // timeslice signal already stashed, no point in generating another one // (and potentially slow) ticks_request = RESUME_UNLIMITED_TICKS; } else { ticks_request = (TicksRequest)max( 0, scheduler().current_timeslice_end() - t->tick_count()); } bool singlestep = t->emulated_ptrace_cont_command == PTRACE_SINGLESTEP || t->emulated_ptrace_cont_command == PTRACE_SYSEMU_SINGLESTEP; if (singlestep && is_at_syscall_instruction(t, t->ip())) { // We're about to singlestep into a syscall instruction. // Act like we're NOT singlestepping since doing a PTRACE_SINGLESTEP would // skip over the system call. LOG(debug) << "Clearing singlestep because we're about to enter a syscall"; singlestep = false; } if (singlestep) { resume = RESUME_SINGLESTEP; } else { /* We won't receive PTRACE_EVENT_SECCOMP events until * the seccomp filter is installed by the * syscall_buffer lib in the child, therefore we must * record in the traditional way (with PTRACE_SYSCALL) * until it is installed. */ /* Kernel commit https://github.com/torvalds/linux/commit/93e35efb8de45393cf61ed07f7b407629bf698ea makes PTRACE_SYSCALL traps be delivered *before* seccomp RET_TRACE traps. Detect and handle this. */ if (!t->seccomp_bpf_enabled || may_restart || syscall_seccomp_ordering_ == PTRACE_SYSCALL_BEFORE_SECCOMP_UNKNOWN) { resume = RESUME_SYSCALL; } else { /* When the seccomp filter is on, instead of capturing * syscalls by using PTRACE_SYSCALL, the filter will * generate the ptrace events. This means we allow the * process to run using PTRACE_CONT, and rely on the * seccomp filter to generate the special * PTRACE_EVENT_SECCOMP event once a syscall happens. * This event is handled here by simply allowing the * process to continue to the actual entry point of * the syscall (using cont_syscall_block()) and then * using the same logic as before. */ resume = RESUME_CONT; } } } t->resume_execution(resume, RESUME_NONBLOCKING, ticks_request); } /** * Step |t| forward until the tracee syscall that disarms the desched * event. If a signal becomes pending in the interim, we stash it. * This allows the caller to deliver the signal after this returns. * (In reality the desched event will already have been disarmed before we * enter this function.) */ static void advance_to_disarm_desched_syscall(RecordTask* t) { int old_sig = 0; LOG(debug) << "desched: DISARMING_DESCHED_EVENT"; /* TODO: send this through main loop. */ /* TODO: mask off signals and avoid this loop. */ do { t->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_UNLIMITED_TICKS); /* We can safely ignore TIME_SLICE_SIGNAL while trying to * reach the disarm-desched ioctl: once we reach it, * the desched'd syscall will be "done" and the tracee * will be at a preemption point. In fact, we *want* * to ignore this signal. Syscalls like read() can * have large buffers passed to them, and we have to * copy-out the buffered out data to the user's * buffer. This happens in the interval where we're * reaching the disarm-desched ioctl, so that code is * susceptible to receiving TIME_SLICE_SIGNAL. */ int sig = t->stop_sig(); if (PerfCounters::TIME_SLICE_SIGNAL == sig) { continue; } // We should not receive SYSCALLBUF_DESCHED_SIGNAL since it should already // have been disarmed. ASSERT(t, SYSCALLBUF_DESCHED_SIGNAL != sig); if (sig && sig == old_sig) { LOG(debug) << " coalescing pending " << signal_name(sig); continue; } if (sig) { LOG(debug) << " " << signal_name(sig) << " now pending"; t->stash_sig(); } } while (!t->is_disarm_desched_event_syscall()); // Exit the syscall. t->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); } /** * |t| is at a desched event and some relevant aspect of its state * changed. (For now, changes except the original desched'd syscall * being restarted.) */ void RecordSession::desched_state_changed(RecordTask* t) { LOG(debug) << "desched: IN_SYSCALL"; /* We need to ensure that the syscallbuf code doesn't * try to commit the current record; we've already * recorded that syscall. The following event sets * the abort-commit bit. */ t->write_mem(REMOTE_PTR_FIELD(t->syscallbuf_child, abort_commit), (uint8_t)1); t->record_event(Event(EV_SYSCALLBUF_ABORT_COMMIT, NO_EXEC_INFO, t->arch())); advance_to_disarm_desched_syscall(t); t->pop_desched(); /* The tracee has just finished sanity-checking the * aborted record, and won't touch the syscallbuf * during this (aborted) transaction again. So now * is a good time for us to reset the record counter. */ t->delay_syscallbuf_reset = false; // Run the syscallbuf exit hook. This ensures we'll be able to reset // the syscallbuf before trying to buffer another syscall. t->write_mem( REMOTE_PTR_FIELD(t->syscallbuf_child, notify_on_syscall_hook_exit), (uint8_t)1); } static void syscall_not_restarted(RecordTask* t) { LOG(debug) << " " << t->tid << ": popping abandoned interrupted " << t->ev() << "; pending events:"; #ifdef DEBUGTAG t->log_pending_events(); #endif t->pop_syscall_interruption(); t->record_event( Event(EV_INTERRUPTED_SYSCALL_NOT_RESTARTED, NO_EXEC_INFO, t->arch())); } /** * "Thaw" a frozen interrupted syscall if |t| is restarting it. * Return true if a syscall is indeed restarted. * * A postcondition of this function is that |t->ev| is no longer a * syscall interruption, whether or whether not a syscall was * restarted. */ static bool maybe_restart_syscall(RecordTask* t) { if (is_restart_syscall_syscall(t->regs().original_syscallno(), t->arch())) { LOG(debug) << " " << t->tid << ": SYS_restart_syscall'ing " << t->ev(); } if (t->is_syscall_restart()) { t->ev().transform(EV_SYSCALL); Registers regs = t->regs(); regs.set_original_syscallno(t->ev().Syscall().regs.original_syscallno()); t->set_regs(regs); return true; } if (EV_SYSCALL_INTERRUPTION == t->ev().type()) { syscall_not_restarted(t); } return false; } /** * After a SYS_sigreturn "exit" of task |t| with return value |ret|, * check to see if there's an interrupted syscall that /won't/ be * restarted, and if so, pop it off the pending event stack. */ static void maybe_discard_syscall_interruption(RecordTask* t, intptr_t ret) { int syscallno; if (EV_SYSCALL_INTERRUPTION != t->ev().type()) { /* We currently don't track syscalls interrupted with * ERESTARTSYS or ERESTARTNOHAND, so it's possible for * a sigreturn not to affect the event stack. */ LOG(debug) << " (no interrupted syscall to retire)"; return; } syscallno = t->ev().Syscall().number; if (0 > ret) { syscall_not_restarted(t); } else { ASSERT(t, syscallno == ret) << "Interrupted call was " << t->syscall_name(syscallno) << " and sigreturn claims to be restarting " << t->syscall_name(ret); } } /** * Copy the registers used for syscall arguments (not including * syscall number) from |from| to |to|. */ static void copy_syscall_arg_regs(Registers* to, const Registers& from) { to->set_arg1(from.arg1()); to->set_arg2(from.arg2()); to->set_arg3(from.arg3()); to->set_arg4(from.arg4()); to->set_arg5(from.arg5()); to->set_arg6(from.arg6()); } static void maybe_trigger_emulated_ptrace_syscall_exit_stop(RecordTask* t) { if (t->emulated_ptrace_cont_command == PTRACE_SYSCALL) { t->emulate_ptrace_stop(WaitStatus::for_syscall(t)); } else if (t->emulated_ptrace_cont_command == PTRACE_SINGLESTEP || t->emulated_ptrace_cont_command == PTRACE_SYSEMU_SINGLESTEP) { // Deliver the singlestep trap now that we've finished executing the // syscall. t->emulate_ptrace_stop(WaitStatus::for_stop_sig(SIGTRAP), nullptr, SI_KERNEL); } } static void save_interrupted_syscall_ret_in_syscallbuf(RecordTask* t, intptr_t retval) { // Record storing the return value in the syscallbuf record, where // we expect to find it during replay. auto child_rec = t->next_syscallbuf_record(); int64_t ret = retval; t->record_local(REMOTE_PTR_FIELD(child_rec, ret), &ret); } void RecordSession::syscall_state_changed(RecordTask* t, StepState* step_state) { switch (t->ev().Syscall().state) { case ENTERING_SYSCALL_PTRACE: debug_exec_state("EXEC_SYSCALL_ENTRY_PTRACE", t); step_state->continue_type = DONT_CONTINUE; last_task_switchable = ALLOW_SWITCH; if (t->emulated_stop_type != NOT_STOPPED) { // Don't go any further. return; } if (t->ev().Syscall().in_sysemu) { // We'll have recorded just the ENTERING_SYSCAL_PTRACE event and // nothing else. Resume with an invalid syscall to ensure no real // syscall runs. t->pop_syscall(); Registers r = t->regs(); Registers orig_regs = r; r.set_original_syscallno(-1); t->set_regs(r); t->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); ASSERT(t, t->ip() == r.ip()); t->set_regs(orig_regs); maybe_trigger_emulated_ptrace_syscall_exit_stop(t); return; } last_task_switchable = PREVENT_SWITCH; t->ev().Syscall().regs = t->regs(); t->ev().Syscall().state = ENTERING_SYSCALL; return; case ENTERING_SYSCALL: { debug_exec_state("EXEC_SYSCALL_ENTRY", t); ASSERT(t, !t->emulated_stop_pending); last_task_switchable = rec_prepare_syscall(t); t->record_event(t->ev(), RecordTask::FLUSH_SYSCALLBUF, &t->ev().Syscall().regs); debug_exec_state("after cont", t); t->ev().Syscall().state = PROCESSING_SYSCALL; if (t->emulated_stop_pending) { step_state->continue_type = DONT_CONTINUE; } else { // Resume the syscall execution in the kernel context. step_state->continue_type = CONTINUE_SYSCALL; } if (t->session().done_initial_exec() && Flags::get().check_cached_mmaps) { t->vm()->verify(t); } if (t->desched_rec() && t->is_in_untraced_syscall() && t->ev().Syscall().is_restart && t->has_stashed_sig()) { // We have a signal to deliver but we're about to restart an untraced // syscall that may block and the desched event has been disarmed. // Rearm the desched event so if the syscall blocks, it will be // interrupted and we'll have a chance to deliver our signal. arm_desched_event(t); } return; } case PROCESSING_SYSCALL: debug_exec_state("EXEC_IN_SYSCALL", t); // Linux kicks tasks out of syscalls before delivering // signals. ASSERT(t, !t->stop_sig()) << "Signal " << signal_name(t->stop_sig()) << " pending while in syscall???"; t->ev().Syscall().state = EXITING_SYSCALL; step_state->continue_type = DONT_CONTINUE; return; case EXITING_SYSCALL: { debug_exec_state("EXEC_SYSCALL_DONE", t); assert(t->stop_sig() == 0); int syscallno = t->ev().Syscall().number; intptr_t retval = t->regs().syscall_result_signed(); if (t->desched_rec()) { // If we enabled the desched event above, disable it. disarm_desched_event(t); // Write syscall return value to the syscallbuf now. This lets replay // get the correct value even though we're aborting the commit. This // value affects register values in the preload code (which must be // correct since register values may escape). save_interrupted_syscall_ret_in_syscallbuf(t, retval); } // sigreturn is a special snowflake, because it // doesn't actually return. Instead, it undoes the // setup for signal delivery, which possibly includes // preparing the tracee for a restart-syscall. So we // take this opportunity to possibly pop an // interrupted-syscall event. if (is_sigreturn(syscallno, t->arch())) { ASSERT(t, t->regs().original_syscallno() == -1); t->record_current_event(); t->pop_syscall(); // We've finished processing this signal now. t->pop_signal_handler(); t->record_event(Event(EV_EXIT_SIGHANDLER, NO_EXEC_INFO, t->arch())); maybe_discard_syscall_interruption(t, retval); if (EV_DESCHED == t->ev().type()) { LOG(debug) << " exiting desched critical section"; // The signal handler could have modified the apparent syscall // return handler. Save that value into the syscall buf again so // replay will pick it up later. save_interrupted_syscall_ret_in_syscallbuf(t, retval); desched_state_changed(t); } } else { LOG(debug) << " original_syscallno:" << t->regs().original_syscallno() << " (" << t->syscall_name(syscallno) << "); return val:" << HEX(t->regs().syscall_result()); /* a syscall_restart ending is equivalent to the * restarted syscall ending */ if (t->ev().Syscall().is_restart) { LOG(debug) << " exiting restarted " << t->syscall_name(syscallno); } /* TODO: is there any reason a restart_syscall can't * be interrupted by a signal and itself restarted? */ bool may_restart = !is_restart_syscall_syscall(syscallno, t->arch()) // SYS_pause is either interrupted or // never returns. It doesn't restart. && !is_pause_syscall(syscallno, t->arch()) && t->regs().syscall_may_restart(); /* no need to process the syscall in case its * restarted this will be done in the exit from the * restart_syscall */ if (!may_restart) { rec_process_syscall(t); if (t->session().done_initial_exec() && Flags::get().check_cached_mmaps) { t->vm()->verify(t); } } else { LOG(debug) << " may restart " << t->syscall_name(syscallno) << " (from retval " << HEX(retval) << ")"; rec_prepare_restart_syscall(t); /* If we may restart this syscall, we've most * likely fudged some of the argument * registers with scratch pointers. We don't * want to record those fudged registers, * because scratch doesn't exist in replay. * So cover our tracks here. */ Registers r = t->regs(); copy_syscall_arg_regs(&r, t->ev().Syscall().regs); t->set_regs(r); } t->record_current_event(); /* If we're not going to restart this syscall, we're * done with it. But if we are, "freeze" it on the * event stack until the execution point where it * might be restarted. */ if (!may_restart) { t->pop_syscall(); if (EV_DESCHED == t->ev().type()) { LOG(debug) << " exiting desched critical section"; desched_state_changed(t); } } else { t->ev().transform(EV_SYSCALL_INTERRUPTION); t->ev().Syscall().is_restart = true; } } last_task_switchable = ALLOW_SWITCH; step_state->continue_type = DONT_CONTINUE; maybe_trigger_emulated_ptrace_syscall_exit_stop(t); return; } default: FATAL() << "Unknown exec state " << t->ev().Syscall().state; } } /** If the perf counters seem to be working return, otherwise don't return. */ void RecordSession::check_initial_task_syscalls(RecordTask* t, RecordResult* step_result) { if (done_initial_exec()) { return; } if (is_write_syscall(t->ev().Syscall().number, t->arch()) && t->regs().arg1_signed() == -1) { Ticks ticks = t->tick_count(); LOG(debug) << "ticks on entry to dummy write: " << ticks; if (ticks == 0) { step_result->status = RecordSession::STEP_SPAWN_FAILED; step_result->failure_message = string( "rr internal recorder error: Performance counter doesn't seem to " "be working. Are you perhaps running rr in a VM but didn't enable " "perf-counter virtualization?"); } } if (is_exit_group_syscall(t->ev().Syscall().number, t->arch())) { step_result->status = RecordSession::STEP_SPAWN_FAILED; step_result->failure_message = read_spawned_task_error(); } } RecordTask* RecordSession::revive_task_for_exec(pid_t rec_tid) { unsigned long msg = 0; int ret = ptrace(__ptrace_request(PTRACE_GETEVENTMSG), rec_tid, nullptr, &msg); if (ret < 0) { FATAL() << "Can't get old tid for execve"; } RecordTask* t = find_task(msg); if (!t) { FATAL() << "Can't find old task for execve"; } ASSERT(t, rec_tid == t->tgid()); LOG(debug) << "Changing task tid from " << t->tid << " to " << rec_tid; // Pretend the old task cloned a new task with the right tid, and then exited trace_writer().write_task_event(TraceTaskEvent::for_clone( rec_tid, t->tid, CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM)); trace_writer().write_task_event( TraceTaskEvent::for_exit(t->tid, WaitStatus::for_exit_code(0))); // Account for tid change task_map.erase(t->tid); task_map.insert(make_pair(rec_tid, t)); // Update the serial as if this task was really created by cloning the old // task. t->set_tid_and_update_serial(rec_tid); // t probably would have been marked for unstable-exit when the old // thread-group leader died. t->unstable = false; return t; } /** * Take a NativeArch::siginfo_t& here instead of siginfo_t because different * versions of system headers have inconsistent field naming. */ template static void setup_sigframe_siginfo_arch(RecordTask* t, const siginfo_t& siginfo) { remote_ptr dest; switch (Arch::arch()) { case x86: { auto p = t->regs().sp().cast() + 2; dest = t->read_mem(p); break; } case x86_64: dest = t->regs().si(); break; default: assert(0 && "Unknown architecture"); break; } typename Arch::siginfo_t si = t->read_mem(dest); set_arch_siginfo(siginfo, t->arch(), &si, sizeof(si)); t->write_mem(dest, si); } static void setup_sigframe_siginfo(RecordTask* t, const siginfo_t& siginfo) { RR_ARCH_FUNCTION(setup_sigframe_siginfo_arch, t->arch(), t, siginfo); } /** * Get t into a state where resume_execution with a signal will actually work. */ static bool preinject_signal(RecordTask* t) { int sig = t->ev().Signal().siginfo.si_signo; /* Signal injection is tricky. Per the ptrace(2) man page, injecting * a signal while the task is not in a signal-stop is not guaranteed to work * (and indeed, we see that the kernel sometimes ignores such signals). * But some signals must be delayed until after the signal-stop that notified * us of them. * So, first we check if we're in a signal-stop that we can use to inject * a signal. Some (all?) SIGTRAP stops are *not* usable for signal injection. */ if (t->stop_sig() && t->stop_sig() != SIGTRAP) { LOG(debug) << " in signal-stop for " << signal_name(t->stop_sig()); } else { /* We're not in a usable signal-stop. Force a signal-stop by sending * a new signal with tgkill (as the ptrace(2) man page recommends). */ LOG(debug) << " maybe not in signal-stop; tgkill(" << signal_name(sig) << ")"; t->tgkill(sig); /* Now singlestep the task until we're in a signal-stop for the signal * we've just sent. We must absorb and forget that signal here since we * don't want it delivered to the task for real. */ while (true) { auto old_ip = t->ip(); t->resume_execution(RESUME_SINGLESTEP, RESUME_WAIT, RESUME_NO_TICKS); ASSERT(t, old_ip == t->ip()); if (t->status().group_stop()) { /* Sending SIGCONT (4.4.3-300.fc23.x86_64) triggers this. Unclear why * it would... */ continue; } if (t->status().ptrace_event() == PTRACE_EVENT_EXIT) { /* We raced with an exit (e.g. due to a pending SIGKILL). */ return false; } ASSERT(t, t->stop_sig()); if (t->stop_sig() == sig) { LOG(debug) << " stopped with signal " << signal_name(sig); break; } /* It's possible for other signals to arrive while we're trying to * get to the signal-stop for the signal we just sent. Stash them for * later delivery. */ if (t->stop_sig() == SYSCALLBUF_DESCHED_SIGNAL) { LOG(debug) << " stopped with signal " << signal_name(sig) << "; ignoring it and carrying on"; } else { LOG(debug) << " stopped with signal " << signal_name(sig) << "; stashing it and carrying on"; t->stash_sig(); } } /* We're now in a signal-stop (and for the right signal too, though that * doesn't really matter). */ } /* Now that we're in a signal-stop, we can inject our signal and advance * to the signal handler with one single-step. */ LOG(debug) << " injecting signal number " << t->ev().Signal().siginfo; t->set_siginfo(t->ev().Signal().siginfo); return true; } /** * Returns true if the signal should be delivered. * Returns false if this signal should not be delivered because another signal * occurred during delivery. */ static bool inject_handled_signal(RecordTask* t) { if (!preinject_signal(t)) { return false; } int sig = t->ev().Signal().siginfo.si_signo; t->resume_execution(RESUME_SINGLESTEP, RESUME_WAIT, RESUME_NO_TICKS, sig); // It's been observed that when tasks enter // sighandlers, the singlestep operation above // doesn't retire any instructions; and // indeed, if an instruction could be retired, // this code wouldn't work. This also // cross-checks the sighandler information we // maintain in |t->sighandlers|. assert(!PerfCounters::extra_perf_counters_enabled() || 0 == t->hpc.read_extra().instructions_retired); if (t->stop_sig() == SIGSEGV) { // Constructing the signal handler frame must have failed. The kernel will // kill the process after this. Stash the signal and make sure // we know to treat it as fatal when we inject it. Also disable the // signal handler to match what the kernel does. t->set_sig_blocked(SIGSEGV, false); t->set_sig_handler_default(SIGSEGV); t->stash_sig(); t->task_group()->received_sigframe_SIGSEGV = true; return false; } t->apply_sig_sa_mask(sig); if (!t->signal_handler_nodefer(sig)) { t->set_sig_blocked(sig, true); } // We stepped into a user signal handler. ASSERT(t, t->stop_sig() == SIGTRAP); ASSERT(t, t->get_signal_user_handler(sig) == t->ip()); if (t->signal_handler_takes_siginfo(sig)) { // The kernel copied siginfo into userspace so it can pass a pointer to // the signal handler. Replace the contents of that siginfo with // the exact data we want to deliver. (We called Task::set_siginfo // above to set that data, but the kernel sanitizes the passed-in data // which wipes out certain fields; e.g. we can't set SI_KERNEL in si_code.) setup_sigframe_siginfo(t, t->ev().Signal().siginfo); } return true; } static bool is_fatal_signal(RecordTask* t, int sig, SignalDeterministic deterministic) { if (t->task_group()->received_sigframe_SIGSEGV) { // Can't be blocked, caught or ignored return true; } signal_action action = default_action(sig); if (action != DUMP_CORE && action != TERMINATE) { // If the default action doesn't kill the process, it won't die. return false; } if (t->is_sig_ignored(sig)) { // Deterministic fatal signals can't be ignored. return deterministic == DETERMINISTIC_SIG; } if (!t->signal_has_user_handler(sig)) { // The default action is going to happen: killing the process. return true; } // If the signal's blocked, user handlers aren't going to run and the process // will die. return t->is_sig_blocked(sig); } /** * |t| is being delivered a signal, and its state changed. */ void RecordSession::signal_state_changed(RecordTask* t, StepState* step_state) { int sig = t->ev().Signal().siginfo.si_signo; switch (t->ev().type()) { case EV_SIGNAL: { // This event is used by the replayer to advance to // the point of signal delivery. t->record_current_event(); t->ev().transform(EV_SIGNAL_DELIVERY); ssize_t sigframe_size = 0; bool blocked = t->is_sig_blocked(sig); // If this is the signal delivered by a sigsuspend, then clear // sigsuspend_blocked_sigs to indicate that future signals are not // being delivered by sigsuspend. t->sigsuspend_blocked_sigs = nullptr; // If a signal is blocked but is still delivered (e.g. a synchronous // terminating signal such as SIGSEGV), user handlers do not run. bool has_handler = false; if (t->signal_has_user_handler(sig) && !blocked) { LOG(debug) << " " << t->tid << ": " << signal_name(sig) << " has user handler"; has_handler = true; if (!inject_handled_signal(t)) { // Signal delivery isn't happening. Prepare to process the new // signal that aborted signal delivery. t->signal_delivered(sig); t->restore_sigmask_if_saved(); t->pop_signal_delivery(); step_state->continue_type = DONT_CONTINUE; last_task_switchable = PREVENT_SWITCH; break; } // It's somewhat difficult engineering-wise to // compute the sigframe size at compile time, // and it can vary across kernel versions. So // this size is an overestimate of the real // size(s). The estimate was made by // comparing $sp before and after entering the // sighandler, for a sighandler that used the // main task stack. On linux 3.11.2, that // computed size was 1736 bytes, which is an // upper bound on the sigframe size. We don't // want to mess with this code much, so we // overapproximate the overapproximation and // round off to 2048. // // If this size becomes too small in the // future, and unit tests that use sighandlers // are run with checksumming enabled, then // they can catch errors here. sigframe_size = 2048; t->ev().transform(EV_SIGNAL_HANDLER); t->signal_delivered(sig); // We already continued! Don't continue now, and allow switching. step_state->continue_type = DONT_CONTINUE; last_task_switchable = ALLOW_SWITCH; } else { LOG(debug) << " " << t->tid << ": no user handler for " << signal_name(sig); // Don't do another task continue. We want to deliver the signal // as the next thing that the task does. step_state->continue_type = DONT_CONTINUE; // If we didn't set up the sighandler frame, we need // to ensure that this tracee is scheduled next so // that we can deliver the signal normally. We have // to do that because setting up the sighandler frame // is synchronous, but delivery otherwise is async. // But right after this, we may have to process some // syscallbuf state, so we can't let the tracee race // with us. last_task_switchable = PREVENT_SWITCH; } // We record this data regardless to simplify replay. If the addresses // are unmapped, write 0 bytes. t->record_remote_fallible(t->regs().sp(), sigframe_size); // This event is used by the replayer to set up the signal handler frame. // But if we don't have a handler, we don't want to record the event // until we deal with the EV_SIGNAL_DELIVERY. if (has_handler) { t->record_current_event(); } break; } case EV_SIGNAL_DELIVERY: { bool is_fatal = is_fatal_signal(t, sig, t->ev().Signal().deterministic); // A fatal signal or SIGSTOP requires us to allow switching to another // task. Switchable can_switch = (is_fatal || sig == SIGSTOP) ? ALLOW_SWITCH : PREVENT_SWITCH; // We didn't record this event above, so do that now. // NB: If there is no handler, and we interrupted a syscall, and there are // no more actionable signals, the kernel sets us up for a syscall // restart. But it does that *after* the ptrace trap. To replay this // correctly we need to fake those changes here. But we don't do this // if we're going to switch away at the ptrace trap, and for the moment, // 'can_switch' is actually 'will_switch'. // This is essentially copied from do_signal in arch/x86/kernel/signal.c bool has_other_signals = t->has_any_actionable_signal(); auto r = t->regs(); if (can_switch == PREVENT_SWITCH && !has_other_signals && r.original_syscallno() >= 0 && r.syscall_may_restart()) { switch (r.syscall_result_signed()) { case -ERESTARTNOHAND: case -ERESTARTSYS: case -ERESTARTNOINTR: r.set_syscallno(r.original_syscallno()); r.set_ip(r.ip().decrement_by_syscall_insn_length(t->arch())); break; case -ERESTART_RESTARTBLOCK: r.set_syscallno(syscall_number_for_restart_syscall(t->arch())); r.set_ip(r.ip().decrement_by_syscall_insn_length(t->arch())); break; } // Now that we've mucked with the registers, we can't switch tasks. That // could allow more signals to be generated, breaking our assumption // that we are the last signal. } else { // But if we didn't touch the registers switching here is ok. can_switch = ALLOW_SWITCH; } t->record_event(t->ev(), RecordTask::FLUSH_SYSCALLBUF, &r); // Don't actually set_regs(r), the kernel does these modifications. // Only inject fatal signals. Non-fatal signals with signal handlers // were taken care of above; for non-fatal signals without signal // handlers, there is no need to deliver the signal at all. In fact, // there is really no way to inject a non-fatal, non-handled signal // without letting the task execute at least one instruction, which // we don't want to do here. if (is_fatal && sig != get_continue_through_sig()) { preinject_signal(t); t->resume_execution(RESUME_CONT, RESUME_NONBLOCKING, RESUME_NO_TICKS, sig); LOG(warn) << "Delivered core-dumping signal; may misrecord " "CLONE_CHILD_CLEARTID memory race"; t->task_group()->destabilize(); } t->signal_delivered(sig); t->pop_signal_delivery(); // The mask set by ppoll/pselect6 is restored, but only if there are no // more actionable signals. The ordering is important, because there may // be pending signals that will be unblocked when we restore the sigmask. if (!has_other_signals) { t->restore_sigmask_if_saved(); } last_task_switchable = can_switch; step_state->continue_type = DONT_CONTINUE; break; } default: FATAL() << "Unhandled signal state " << t->ev().type(); break; } } bool RecordSession::handle_signal_event(RecordTask* t, StepState* step_state) { int sig = t->stop_sig(); if (!sig) { return false; } if (!done_initial_exec()) { // If the initial tracee isn't prepared to handle // signals yet, then us ignoring the ptrace // notification here will have the side effect of // declining to deliver the signal. // // This doesn't really occur in practice, only in // tests that force a degenerately low time slice. LOG(warn) << "Dropping " << signal_name(sig) << " because it can't be delivered yet"; // No events to be recorded, so no syscallbuf updates // needed. return true; } SignalDeterministic deterministic = is_deterministic_signal(t); if (deterministic || sig == SYSCALLBUF_DESCHED_SIGNAL) { // Don't stash these signals; deliver them immediately. // We don't want them to be reordered around other signals. siginfo_t siginfo = t->get_siginfo(); switch (handle_signal(t, &siginfo, deterministic)) { case SIGNAL_PTRACE_STOP: // Emulated ptrace-stop. Don't run the task again yet. last_task_switchable = ALLOW_SWITCH; step_state->continue_type = DONT_CONTINUE; return true; case DEFER_SIGNAL: ASSERT(t, false) << "Can't defer deterministic or internal signal " << siginfo << " at ip " << t->ip(); break; case SIGNAL_HANDLED: break; } return false; } if (sig == PerfCounters::TIME_SLICE_SIGNAL) { auto& si = t->get_siginfo(); /* This implementation will of course fall over if rr tries to * record itself. * * NB: we can't check that the ticks is >= the programmed * target, because this signal may have become pending before * we reset the HPC counters. There be a way to handle that * more elegantly, but bridge will be crossed in due time. * * We can't check that the fd matches t->hpc.ticks_fd() because this * signal could have been queued quite a long time ago and the PerfCounters * might have been stopped (and restarted!), perhaps even more than once, * since the signal was queued. possibly changing its fd. We could check * against all fds the PerfCounters have ever used, but that seems like * overkill. */ ASSERT(t, PerfCounters::TIME_SLICE_SIGNAL == si.si_signo && (RecordTask::SYNTHETIC_TIME_SLICE_SI_CODE == si.si_code || POLL_IN == si.si_code)) << "Tracee is using SIGSTKFLT??? (code=" << si.si_code << ", fd=" << si.si_fd << ")"; } t->stash_sig(); return true; } template static bool flush_signals_before_syscall_arch(intptr_t syscallno) { switch (syscallno) { case Arch::exit: case Arch::exit_group: case Arch::sigprocmask: case Arch::rt_sigprocmask: return true; default: return false; } } static bool flush_signals_before_syscall(intptr_t syscallno, SupportedArch arch) { RR_ARCH_FUNCTION(flush_signals_before_syscall_arch, arch, syscallno); } /** * We should not do any exit syscall while there are stashed signals, because * they'll just be thrown away, violating normal kernel behavior. So we check * here if there are stashed signals and if there are, we abort the exit * syscall so the signals can be delivered. The exit will be restarted after * signal delivery. * * We treat sigprocmask the same way in case the tracee thread blocks all * signals until it exits. */ static bool interrupt_syscall_to_handle_signals(RecordTask* t) { if (!t->has_stashed_sig() || !flush_signals_before_syscall(t->regs().original_syscallno(), t->arch())) { return false; } LOG(debug) << "interrupting syscall '" << syscall_name(t->regs().original_syscallno(), t->arch()) << "' to handle " << signal_name(t->peek_stash_sig().siginfo.si_signo); t->ev().Syscall().state = ENTERING_SYSCALL; t->ev().Syscall().regs = t->regs(); t->record_current_event(); Registers r = t->regs(); int syscallno = r.original_syscallno(); r.set_original_syscallno(syscall_number_for_gettid(r.arch())); t->set_regs(r); // This exits the hijacked SYS_gettid. Now the tracee is // ready to do our bidding. t->exit_syscall(); // Set these regs to emulate a syscall interruption. r.set_original_syscallno(syscallno); r.set_syscall_result(-ERESTARTSYS); t->set_regs(r); t->ev().Syscall().state = EXITING_SYSCALL; t->record_current_event(); t->ev().transform(EV_SYSCALL_INTERRUPTION); t->ev().Syscall().is_restart = true; return true; } /** * If interrupt_syscall_to_handle_signals has left an exit/sigprocmask * syscall interrupted that needs to be completed, set up state to * restart the syscall, because the kernel won't! */ static void maybe_do_fake_syscall_restart(RecordTask* t) { if (!t->is_syscall_restart() || !t->regs().syscall_may_restart() || !flush_signals_before_syscall(t->ev().Syscall().number, t->arch())) { return; } LOG(debug) << "Generating fake syscall restart"; Registers r = t->regs(); r.set_ip(r.ip().decrement_by_syscall_insn_length(t->arch())); r.set_syscallno(syscall_number_for_restart_syscall(t->arch())); t->set_regs(r); } void RecordSession::process_syscall_entry(RecordTask* t, StepState* step_state, RecordResult* step_result) { // We just entered a syscall. if (!maybe_restart_syscall(t)) { // Emit FLUSH_SYSCALLBUF if necessary before we do any patching work t->maybe_flush_syscallbuf(); if (syscall_seccomp_ordering_ == PTRACE_SYSCALL_BEFORE_SECCOMP_UNKNOWN && t->seccomp_bpf_enabled) { // We received a PTRACE_SYSCALL notification before the seccomp // notification. Ignore it and continue to the seccomp notification. syscall_seccomp_ordering_ = PTRACE_SYSCALL_BEFORE_SECCOMP; step_state->continue_type = CONTINUE; return; } if (t->vm()->monkeypatcher().try_patch_syscall(t)) { // Syscall was patched. Emit event and continue execution. t->record_event(Event(EV_PATCH_SYSCALL, NO_EXEC_INFO, t->arch())); return; } t->push_event(SyscallEvent(t->regs().original_syscallno(), t->arch())); if (interrupt_syscall_to_handle_signals(t)) { return; } } check_initial_task_syscalls(t, step_result); note_entering_syscall(t); if (t->emulated_ptrace_cont_command == PTRACE_SYSCALL || t->emulated_ptrace_cont_command == PTRACE_SYSEMU || t->emulated_ptrace_cont_command == PTRACE_SYSEMU_SINGLESTEP) { t->ev().Syscall().state = ENTERING_SYSCALL_PTRACE; t->emulate_ptrace_stop(WaitStatus::for_syscall(t)); t->record_current_event(); t->ev().Syscall().in_sysemu = t->emulated_ptrace_cont_command == PTRACE_SYSEMU || t->emulated_ptrace_cont_command == PTRACE_SYSEMU_SINGLESTEP; } } /** * The execution of |t| has just been resumed, and it most likely has * a new event that needs to be processed. Prepare that new event. */ void RecordSession::runnable_state_changed(RecordTask* t, StepState* step_state, RecordResult* step_result, bool can_consume_wait_status) { switch (t->ev().type()) { case EV_NOOP: t->pop_noop(); break; case EV_SEGV_RDTSC: t->record_current_event(); t->pop_event(t->ev().type()); break; case EV_SENTINEL: case EV_SIGNAL_HANDLER: case EV_SYSCALL_INTERRUPTION: if (!can_consume_wait_status) { return; } process_syscall_entry(t, step_state, step_result); break; default: return; } } bool RecordSession::prepare_to_inject_signal(RecordTask* t, StepState* step_state) { if (!t->has_stashed_sig() || !done_initial_exec() || step_state->continue_type != CONTINUE) { return false; } union { NativeArch::siginfo_t native_api; siginfo_t linux_api; } si; si.linux_api = t->peek_stash_sig().siginfo; if (si.linux_api.si_signo == get_ignore_sig()) { LOG(debug) << "Declining to deliver " << signal_name(si.linux_api.si_signo) << " by user request"; t->pop_stash_sig(); return prepare_to_inject_signal(t, step_state); } if (si.linux_api.si_signo == SIGSYS && si.linux_api.si_code == SYS_SECCOMP) { // Set call_addr to the current ip(). We don't do this when synthesizing // the SIGSYS because the SIGSYS might be triggered during syscallbuf // processing but be delivered later at a // SYS_rrcall_notify_syscall_hook_exit. // Documentation says that si_call_addr is the address of the syscall // instruction, but in tests it's immediately after the syscall // instruction. auto& native_si = si.native_api; native_si._sifields._sigsys._call_addr = t->ip().to_data_ptr(); } switch (handle_signal(t, &si.linux_api, t->peek_stash_sig().deterministic)) { case SIGNAL_PTRACE_STOP: // Emulated ptrace-stop. Don't run the task again yet. last_task_switchable = ALLOW_SWITCH; LOG(debug) << signal_name(si.linux_api.si_signo) << ", emulating ptrace stop"; break; case DEFER_SIGNAL: LOG(debug) << signal_name(si.linux_api.si_signo) << " deferred"; // Leave signal on the stack and continue task execution. We'll try again // later. return false; case SIGNAL_HANDLED: LOG(debug) << signal_name(si.linux_api.si_signo) << " handled"; if (t->ev().type() == EV_SCHED) { if (t->maybe_in_spinlock()) { LOG(debug) << "Detected possible spinlock, forcing one round-robin"; scheduler().schedule_one_round_robin(t); } // Allow switching after a SCHED. We'll flush the SCHED if and only // if we really do a switch. last_task_switchable = ALLOW_SWITCH; } break; } step_state->continue_type = DONT_CONTINUE; t->pop_stash_sig(); return true; } static string find_syscall_buffer_library() { string lib_path = exe_directory() + "../lib/"; string file_name = lib_path + SYSCALLBUF_LIB_FILENAME; if (access(file_name.c_str(), F_OK) != 0) { // File does not exist. Assume install put it in LD_LIBRARY_PATH. lib_path = ""; } return lib_path; } /** * Returns the name of the first dynamic library that |exe_file| depends on * that starts with |prefix|, or an empty string if there isn't one or * anything fails. */ static string find_needed_library_starting_with(const string& exe_file, const string& prefix) { ScopedFd fd(exe_file.c_str(), O_RDONLY); if (!fd.is_open()) { return string(); } ElfFileReader reader(fd); DynamicSection dynamic = reader.read_dynamic(); for (auto& entry : dynamic.entries) { if (entry.tag == DT_NEEDED && entry.val < dynamic.strtab.size()) { const char* name = &dynamic.strtab[entry.val]; if (!strncmp(name, prefix.c_str(), prefix.size())) { return string(name); } } } return string(); } static string lookup_by_path(const string& name) { if (name.find('/') != string::npos) { return name; } const char* env = getenv("PATH"); if (!env) { return name; } char* p = strdup(env); char* s = p; while (*s) { char* next = strchr(s, ':'); if (next) { *next = 0; } string file = string(s) + "/" + name; struct stat st; if (!stat(file.c_str(), &st) && S_ISREG(st.st_mode) && !access(file.c_str(), X_OK)) { free(p); return file; } if (!next) { break; } s = next + 1; } free(p); return name; } /*static*/ RecordSession::shr_ptr RecordSession::create( const vector& argv, const vector& extra_env, SyscallBuffering syscallbuf, BindCPU bind_cpu) { // The syscallbuf library interposes some critical // external symbols like XShmQueryExtension(), so we // preload it whether or not syscallbuf is enabled. Indicate here whether // syscallbuf is enabled. if (syscallbuf == DISABLE_SYSCALL_BUF) { unsetenv(SYSCALLBUF_ENABLED_ENV_VAR); } else { setenv(SYSCALLBUF_ENABLED_ENV_VAR, "1", 1); ScopedFd fd("/proc/sys/kernel/perf_event_paranoid", O_RDONLY); if (fd.is_open()) { char buf[100]; ssize_t size = read(fd, buf, sizeof(buf) - 1); if (size >= 0) { buf[size] = 0; int val = atoi(buf); if (val > 1) { FATAL() << "rr needs /proc/sys/kernel/perf_event_paranoid <= 1, but " "it is " << val << ".\nChange it to 1, or use 'rr record -n' (slow)."; } } } } vector env; char** envp = environ; for (; *envp; ++envp) { env.push_back(*envp); } env.insert(env.end(), extra_env.begin(), extra_env.end()); string full_path = lookup_by_path(argv[0]); // LD_PRELOAD the syscall interception lib string syscall_buffer_lib_path = find_syscall_buffer_library(); if (!syscall_buffer_lib_path.empty()) { string ld_preload = "LD_PRELOAD="; string libasan = find_needed_library_starting_with(full_path, "libasan"); if (!libasan.empty()) { LOG(debug) << "Prepending " << libasan << " to LD_PRELOAD"; // Put an LD_PRELOAD entry for it before our preload library, because // it checks that it's loaded first ld_preload += libasan + ":"; } // Our preload lib should come first if possible, because that will // speed up the loading of the other libraries. We supply a placeholder // which is then mutated to the correct filename in // Monkeypatcher::patch_after_exec. ld_preload += syscall_buffer_lib_path + SYSCALLBUF_LIB_FILENAME_PADDED; auto it = env.begin(); for (; it != env.end(); ++it) { if (it->find("LD_PRELOAD=") != 0) { continue; } // Honor old preloads too. This may cause // problems, but only in those libs, and // that's the user's problem. ld_preload += ":"; ld_preload += it->substr(it->find("=") + 1); break; } if (it == env.end()) { env.push_back(ld_preload); } else { *it = ld_preload; } } string env_pair = create_pulseaudio_config(); if (!env_pair.empty()) { env.push_back(env_pair); } env.push_back("RUNNING_UNDER_RR=1"); env.push_back("LIBGL_ALWAYS_SOFTWARE=1"); // Disable Gecko's "wait for gdb to attach on process crash" behavior, since // it is useless when running under rr. env.push_back("MOZ_GDB_SLEEP=0"); // OpenSSL uses RDRAND, but we can disable it. These bitmasks are inverted // and ANDed with the results of CPUID. The number below is 2^62, which is the // bit for RDRAND support. env.push_back("OPENSSL_ia32cap=~4611686018427387904:~0"); shr_ptr session( new RecordSession(full_path, argv, env, syscallbuf, bind_cpu)); return session; } RecordSession::RecordSession(const std::string& exe_path, const std::vector& argv, const std::vector& envp, SyscallBuffering syscallbuf, BindCPU bind_cpu) : trace_out(argv[0], choose_cpu(bind_cpu)), scheduler_(*this), ignore_sig(0), continue_through_sig(0), last_task_switchable(PREVENT_SWITCH), syscall_buffer_size_(1024 * 1024), use_syscall_buffer_(syscallbuf == ENABLE_SYSCALL_BUF), use_file_cloning_(true), use_read_cloning_(true), enable_chaos_(false), wait_for_all_(false) { ScopedFd error_fd = create_spawn_task_error_pipe(); RecordTask* t = static_cast( Task::spawn(*this, error_fd, trace_out, exe_path, argv, envp)); initial_task_group = t->task_group(); on_create(t); } bool RecordSession::can_end() { if (wait_for_all_) { return task_map.empty(); } return initial_task_group->task_set().empty(); } RecordSession::RecordResult RecordSession::record_step() { RecordResult result; if (can_end()) { result.status = STEP_EXITED; result.exit_status = initial_task_group->exit_status; return result; } result.status = STEP_CONTINUE; RecordTask* prev_task = scheduler().current(); auto rescheduled = scheduler().reschedule(last_task_switchable); if (rescheduled.interrupted_by_signal) { // The scheduler was waiting for some task to become active, but was // interrupted by a signal. Yield to our caller now to give the caller // a chance to do something triggered by the signal // (e.g. terminate the recording). return result; } RecordTask* t = scheduler().current(); if (prev_task && prev_task->ev().type() == EV_SCHED) { if (prev_task != t) { // We did do a context switch, so record the SCHED event. Otherwise // we'll just discard it. prev_task->record_current_event(); } prev_task->pop_event(EV_SCHED); } if (rescheduled.started_new_timeslice) { t->registers_at_start_of_last_timeslice = t->regs(); t->time_at_start_of_last_timeslice = trace_writer().time(); } // Have to disable context-switching until we know it's safe // to allow switching the context. last_task_switchable = PREVENT_SWITCH; LOG(debug) << "trace time " << t->trace_time() << ": Active task is " << t->tid << ". Events:"; #ifdef DEBUGTAG t->log_pending_events(); #endif if (handle_ptrace_exit_event(t)) { // t is dead and has been deleted. return result; } if (t->unstable) { // Do not record non-ptrace-exit events for tasks in // an unstable exit. We can't replay them. This happens in the // signal_deferred test; the signal gets re-reported to us. LOG(debug) << "Task in unstable exit; " "refusing to record non-ptrace events"; // Resume the task so hopefully we'll get to its exit. last_task_switchable = ALLOW_SWITCH; return result; } StepState step_state(CONTINUE); bool did_enter_syscall; if (rescheduled.by_waitpid && handle_ptrace_event(t, &step_state, &result, &did_enter_syscall)) { if (result.status != STEP_CONTINUE || step_state.continue_type == DONT_CONTINUE) { return result; } if (did_enter_syscall && t->ev().type() == EV_SYSCALL) { syscall_state_changed(t, &step_state); } } else if (rescheduled.by_waitpid && handle_signal_event(t, &step_state)) { } else { runnable_state_changed(t, &step_state, &result, rescheduled.by_waitpid); if (result.status != STEP_CONTINUE || step_state.continue_type == DONT_CONTINUE) { return result; } switch (t->ev().type()) { case EV_DESCHED: desched_state_changed(t); break; case EV_SYSCALL: syscall_state_changed(t, &step_state); break; case EV_SIGNAL: case EV_SIGNAL_DELIVERY: signal_state_changed(t, &step_state); break; default: break; } } t->verify_signal_states(); // We try to inject a signal if there's one pending; otherwise we continue // task execution. if (!prepare_to_inject_signal(t, &step_state) && step_state.continue_type != DONT_CONTINUE) { // Ensure that we aren't allowing switches away from a running task. // Only tasks blocked in a syscall can be switched away from, otherwise // we have races. ASSERT(t, last_task_switchable == PREVENT_SWITCH || t->unstable || t->may_be_blocked()); debug_exec_state("EXEC_START", t); maybe_do_fake_syscall_restart(t); t->handling_deterministic_signal = 0; task_continue(step_state); } return result; } void RecordSession::terminate_recording() { RecordTask* t = scheduler().current(); if (t) { t->maybe_flush_syscallbuf(); } LOG(info) << "Processing termination request ..."; pid_t ttid = t ? t->tid : 0; auto tticks = t ? t->tick_count() : 0; // This will write unstable exit events for all tasks. kill_all_tasks(); t = nullptr; // t is now deallocated LOG(info) << " recording final TRACE_TERMINATION event ..."; TraceFrame frame(trace_out.time(), ttid, Event(EV_TRACE_TERMINATION, NO_EXEC_INFO, RR_NATIVE_ARCH), tticks); trace_out.write_frame(frame); trace_out.close(); } Task* RecordSession::new_task(pid_t tid, pid_t, uint32_t serial, SupportedArch a) { return new RecordTask(*this, tid, serial, a); } void RecordSession::on_create(Task* t) { Session::on_create(t); scheduler().on_create(static_cast(t)); } void RecordSession::on_destroy(Task* t) { scheduler().on_destroy(static_cast(t)); Session::on_destroy(t); } RecordTask* RecordSession::find_task(pid_t rec_tid) const { return static_cast(Session::find_task(rec_tid)); } RecordTask* RecordSession::find_task(const TaskUid& tuid) const { return static_cast(Session::find_task(tuid)); } } // namespace rr rr-4.4.0/src/RecordSession.h000066400000000000000000000143401277367620400157040ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_RECORD_SESSION_H_ #define RR_RECORD_SESSION_H_ #include #include #include "Scheduler.h" #include "SeccompFilterRewriter.h" #include "Session.h" #include "TaskGroup.h" #include "TraceFrame.h" #include "WaitStatus.h" namespace rr { class RecordTask; /** Encapsulates additional session state related to recording. */ class RecordSession : public Session { public: typedef std::shared_ptr shr_ptr; /** * Create a recording session for the initial command line |argv|. */ enum SyscallBuffering { ENABLE_SYSCALL_BUF, DISABLE_SYSCALL_BUF }; enum BindCPU { BIND_CPU, UNBOUND_CPU }; static shr_ptr create( const std::vector& argv, const std::vector& extra_env = std::vector(), SyscallBuffering syscallbuf = ENABLE_SYSCALL_BUF, BindCPU bind_cpu = BIND_CPU); bool use_syscall_buffer() const { return use_syscall_buffer_; } size_t syscall_buffer_size() const { return syscall_buffer_size_; } bool use_read_cloning() const { return use_read_cloning_; } bool use_file_cloning() const { return use_file_cloning_; } void set_ignore_sig(int sig) { ignore_sig = sig; } int get_ignore_sig() const { return ignore_sig; } void set_continue_through_sig(int sig) { continue_through_sig = sig; } int get_continue_through_sig() const { return continue_through_sig; } enum RecordStatus { // Some execution was recorded. record_step() can be called again. STEP_CONTINUE, // All tracees are dead. record_step() should not be called again. STEP_EXITED, // Spawning the initial tracee failed. An error message will be in // failure_message. STEP_SPAWN_FAILED }; struct RecordResult { RecordStatus status; // When status == STEP_EXITED WaitStatus exit_status; // When status == STEP_SPAWN_FAILED std::string failure_message; }; /** * Record some tracee execution. * This may block. If blocking is interrupted by a signal, will return * STEP_CONTINUE. * Typically you'd call this in a loop until it returns something other than * STEP_CONTINUE. * Note that when this returns, some tasks may be running (not in a ptrace- * stop). In particular, up to one task may be executing user code and any * number of tasks may be blocked in syscalls. */ RecordResult record_step(); /** * Flush buffers and write a termination record to the trace. Don't call * record_step() after this. */ void terminate_recording(); virtual RecordSession* as_record() { return this; } TraceWriter& trace_writer() { return trace_out; } virtual void on_destroy(Task* t); Scheduler& scheduler() { return scheduler_; } SeccompFilterRewriter& seccomp_filter_rewriter() { return seccomp_filter_rewriter_; } enum ContinueType { DONT_CONTINUE = 0, CONTINUE, CONTINUE_SYSCALL }; struct StepState { // Continue with this continuation type. ContinueType continue_type; StepState(ContinueType continue_type) : continue_type(continue_type) {} }; void set_enable_chaos(bool enable_chaos) { scheduler().set_enable_chaos(enable_chaos); this->enable_chaos_ = enable_chaos; } bool enable_chaos() const { return enable_chaos_; } void set_use_read_cloning(bool enable) { use_read_cloning_ = enable; } void set_use_file_cloning(bool enable) { use_file_cloning_ = enable; } void set_syscall_buffer_size(size_t size) { syscall_buffer_size_ = size; } void set_wait_for_all(bool wait_for_all) { this->wait_for_all_ = wait_for_all; } virtual Task* new_task(pid_t tid, pid_t rec_tid, uint32_t serial, SupportedArch a); RecordTask* find_task(pid_t rec_tid) const; RecordTask* find_task(const TaskUid& tuid) const; /** * This gets called when we detect that a task has been revived from the * dead with a PTRACE_EVENT_EXEC. See ptrace man page under "execve(2) under * ptrace" for the horrid details. * * The task in the task-group that triggered the successful execve has changed * its tid to |rec_tid|. We mirror that, and emit TraceTaskEvents to make it * look like a new task was spawned and the old task exited. */ RecordTask* revive_task_for_exec(pid_t rec_tid); private: RecordSession(const std::string& exe_path, const std::vector& argv, const std::vector& envp, SyscallBuffering syscallbuf, BindCPU bind_cpu); virtual void on_create(Task* t); void handle_seccomp_traced_syscall(RecordTask* t, RecordSession::StepState* step_state, RecordResult* result, bool* did_enter_syscall); void process_syscall_entry(RecordTask* t, StepState* step_state, RecordResult* step_result); void check_initial_task_syscalls(RecordTask* t, RecordResult* step_result); bool handle_ptrace_event(RecordTask* t, StepState* step_state, RecordResult* result, bool* did_enter_syscall); bool handle_signal_event(RecordTask* t, StepState* step_state); void runnable_state_changed(RecordTask* t, StepState* step_state, RecordResult* step_result, bool can_consume_wait_status); void signal_state_changed(RecordTask* t, StepState* step_state); void syscall_state_changed(RecordTask* t, StepState* step_state); void desched_state_changed(RecordTask* t); bool prepare_to_inject_signal(RecordTask* t, StepState* step_state); void task_continue(const StepState& step_state); bool can_end(); TraceWriter trace_out; Scheduler scheduler_; TaskGroup::shr_ptr initial_task_group; SeccompFilterRewriter seccomp_filter_rewriter_; int ignore_sig; int continue_through_sig; Switchable last_task_switchable; size_t syscall_buffer_size_; bool use_syscall_buffer_; bool use_file_cloning_; bool use_read_cloning_; /** * When true, try to increase the probability of finding bugs. */ bool enable_chaos_; /** * When true, wait for all tracees to exit before finishing recording. */ bool wait_for_all_; }; } // namespace rr #endif // RR_RECORD_SESSION_H_ rr-4.4.0/src/RecordTask.cc000066400000000000000000001433331277367620400153260ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "RecordTask.h" #include #include #include #include #include #include #include "AutoRemoteSyscalls.h" #include "PreserveFileMonitor.h" #include "RecordSession.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" #include "record_signal.h" #include "rr/rr.h" #include "util.h" using namespace std; namespace rr { enum SignalDisposition { SIGNAL_DEFAULT, SIGNAL_IGNORE, SIGNAL_HANDLER }; /** * Stores the table of signal dispositions and metadata for an * arbitrary set of tasks. Each of those tasks must own one one of * the |refcount|s while they still refer to this. */ struct Sighandler { Sighandler() : resethand(false), takes_siginfo(false), nodefer_set(false), sa_mask(0) {} template void init_arch(const typename Arch::kernel_sigaction& ksa) { k_sa_handler = ksa.k_sa_handler; sa.resize(sizeof(ksa)); memcpy(sa.data(), &ksa, sizeof(ksa)); resethand = (ksa.sa_flags & SA_RESETHAND) != 0; takes_siginfo = (ksa.sa_flags & SA_SIGINFO) != 0; nodefer_set = (ksa.sa_flags & SA_NODEFER) != 0; static_assert(sizeof(ksa.sa_mask) == sizeof(sa_mask), "Kernel mask size grew?"); memcpy(&sa_mask, &ksa.sa_mask, sizeof(ksa.sa_mask)); } template void reset_arch() { typename Arch::kernel_sigaction ksa; memset(&ksa, 0, sizeof(ksa)); assert(uintptr_t(SIG_DFL) == 0); init_arch(ksa); } SignalDisposition disposition() const { assert(uintptr_t(SIG_DFL) == 0); assert(uintptr_t(SIG_IGN) == 1); switch (k_sa_handler.as_int()) { case 0: return SIGNAL_DEFAULT; case 1: return SIGNAL_IGNORE; default: return SIGNAL_HANDLER; } } remote_code_ptr get_user_handler() const { return disposition() == SIGNAL_HANDLER ? remote_code_ptr(k_sa_handler.as_int()) : remote_code_ptr(); } remote_ptr k_sa_handler; // Saved kernel_sigaction; used to restore handler vector sa; bool resethand; bool takes_siginfo; bool nodefer_set; uint64_t sa_mask; }; static void reset_handler(Sighandler* handler, SupportedArch arch) { RR_ARCH_FUNCTION(handler->reset_arch, arch); } struct Sighandlers { typedef shared_ptr shr_ptr; shr_ptr clone() const { shr_ptr s(new Sighandlers()); // NB: depends on the fact that Sighandler is for all // intents and purposes a POD type, though not // technically. for (size_t i = 0; i < array_length(handlers); ++i) { s->handlers[i] = handlers[i]; } return s; } Sighandler& get(int sig) { assert_valid(sig); return handlers[sig]; } const Sighandler& get(int sig) const { assert_valid(sig); return handlers[sig]; } void init_from_current_process() { for (size_t i = 1; i < array_length(handlers); ++i) { Sighandler& h = handlers[i]; NativeArch::kernel_sigaction sa; if (::syscall(SYS_rt_sigaction, i, nullptr, &sa, sizeof(uint64_t))) { /* EINVAL means we're querying an * unused signal number. */ assert(EINVAL == errno); continue; } msan_unpoison(&sa, sizeof(NativeArch::kernel_sigaction)); h.init_arch(sa); } } /** * For each signal in |table| such that is_user_handler() is * true, reset the disposition of that signal to SIG_DFL, and * clear the resethand flag if it's set. SIG_IGN signals are * not modified. * * (After an exec() call copies the original sighandler table, * this is the operation required by POSIX to initialize that * table copy.) */ void reset_user_handlers(SupportedArch arch) { for (int i = 0; i < ssize_t(array_length(handlers)); ++i) { Sighandler& h = handlers[i]; // If the handler was a user handler, reset to // default. If it was SIG_IGN or SIG_DFL, // leave it alone. if (h.disposition() == SIGNAL_HANDLER) { reset_handler(&h, arch); } } } void assert_valid(int sig) const { assert(0 < sig && sig < ssize_t(array_length(handlers))); } static shr_ptr create() { return shr_ptr(new Sighandlers()); } Sighandler handlers[_NSIG]; private: Sighandlers() {} Sighandlers(const Sighandlers&); Sighandlers operator=(const Sighandlers&); }; RecordTask::RecordTask(RecordSession& session, pid_t _tid, uint32_t serial, SupportedArch a) : Task(session, _tid, _tid, serial, a), time_at_start_of_last_timeslice(0), priority(0), in_round_robin_queue(false), emulated_ptracer(nullptr), emulated_ptrace_event_msg(0), emulated_ptrace_options(0), emulated_ptrace_cont_command(0), emulated_stop_pending(false), emulated_ptrace_SIGCHLD_pending(false), emulated_SIGCHLD_pending(false), emulated_ptrace_seized(false), emulated_ptrace_queued_exit_stop(false), in_wait_type(WAIT_TYPE_NONE), in_wait_pid(0), emulated_stop_type(NOT_STOPPED), blocked_sigs(), previously_blocked_sigs(), has_previously_blocked_sigs(false), handling_deterministic_signal(0), flushed_num_rec_bytes(0), flushed_syscallbuf(false), delay_syscallbuf_reset(false), prctl_seccomp_status(0), robust_futex_list_len(0), own_namespace_rec_tid(0), exit_code(0), termination_signal(0), tsc_mode(PR_TSC_ENABLE) { push_event(Event(EV_SENTINEL, NO_EXEC_INFO, RR_NATIVE_ARCH)); if (session.tasks().empty()) { // Initial tracee. It inherited its state from this process, so set it up. // The very first task we fork inherits the signal // dispositions of the current OS process (which should all be // default at this point, but ...). From there on, new tasks // will transitively inherit from this first task. auto sh = Sighandlers::create(); sh->init_from_current_process(); sighandlers.swap(sh); // Don't use the POSIX wrapper, because it doesn't necessarily // read the entire sigset tracked by the kernel. if (::syscall(SYS_rt_sigprocmask, SIG_SETMASK, nullptr, &blocked_sigs, sizeof(blocked_sigs))) { FATAL() << "Failed to read blocked signals"; } } } RecordTask::~RecordTask() { if (emulated_ptracer) { emulated_ptracer->emulated_ptrace_tracees.erase(this); if (emulated_ptrace_options & PTRACE_O_TRACEEXIT) { ASSERT(this, stable_exit) << "PTRACE_O_TRACEEXIT only supported for stable exits for now"; } } for (RecordTask* t : emulated_ptrace_tracees) { // XXX emulate PTRACE_O_EXITKILL ASSERT(this, t->emulated_ptracer == this); t->emulated_ptracer = nullptr; t->emulated_ptrace_options = 0; t->emulated_stop_pending = false; t->emulated_stop_type = NOT_STOPPED; } // Task::destroy has already done PTRACE_DETACH so the task can complete // exiting. // The kernel explicitly only clears the futex if the address space is shared. // If the address space has no other users then the futex will not be cleared // even if it lives in shared memory which other tasks can read. // Unstable exits may result in the kernel *not* clearing the // futex, for example for fatal signals. So we would // deadlock waiting on the futex. if (!unstable && !tid_futex.is_null() && as->task_set().size() > 1) { // clone()'d tasks can have a pid_t* |ctid| argument // that's written with the new task's pid. That // pointer can also be used as a futex: when the task // dies, the original ctid value is cleared and a // FUTEX_WAKE is done on the address. So // pthread_join() is basically a standard futex wait // loop. LOG(debug) << " waiting for tid futex " << tid_futex << " to be cleared ..."; bool ok = true; futex_wait(tid_futex, 0, &ok); if (ok) { int val = 0; record_local(tid_futex, &val); } } // Write the exit event here so that the value recorded above is captured. EventType e = unstable ? EV_UNSTABLE_EXIT : EV_EXIT; // Don't flush syscallbuf. Whatever triggered the exit (syscall, signal) // should already have flushed it, if it was running. If it was blocked, // then the syscallbuf would already have been flushed too. The exception // is kill_all_tasks() in which case it's OK to just drop the last chunk of // execution. Trying to flush syscallbuf for an exiting task could be bad, // e.g. it could be in the middle of syscallbuf code that's supposed to be // atomic. record_event(Event(e, NO_EXEC_INFO, arch()), DONT_FLUSH_SYSCALLBUF); // We expect tasks to usually exit by a call to exit() or // exit_group(), so it's not helpful to warn about that. if (EV_SENTINEL != ev().type() && (pending_events.size() > 2 || !(ev().type() == EV_SYSCALL && (is_exit_syscall(ev().Syscall().number, ev().Syscall().regs.arch()) || is_exit_group_syscall(ev().Syscall().number, ev().Syscall().regs.arch()))))) { LOG(warn) << tid << " still has pending events. From top down:"; log_pending_events(); } } void RecordTask::futex_wait(remote_ptr futex, int val, bool* ok) { // Wait for *sync_addr == sync_val. This implementation isn't // pretty, but it's pretty much the best we can do with // available kernel tools. // // TODO: find clever way to avoid busy-waiting. while (true) { int mem = read_mem(futex, ok); if (!*ok || val == mem) { // Invalid addresses are just ignored by the kernel break; } // Try to give our scheduling slot to the kernel // thread that's going to write sync_addr. sched_yield(); } } RecordSession& RecordTask::session() const { return *Task::session().as_record(); } TraceWriter& RecordTask::trace_writer() const { return session().trace_writer(); } Task* RecordTask::clone(int flags, remote_ptr stack, remote_ptr tls, remote_ptr cleartid_addr, pid_t new_tid, pid_t new_rec_tid, uint32_t new_serial, Session* other_session) { Task* t = Task::clone(flags, stack, tls, cleartid_addr, new_tid, new_rec_tid, new_serial, other_session); if (t->session().is_recording()) { RecordTask* rt = static_cast(t); rt->priority = priority; rt->blocked_sigs = get_sigmask(); rt->prctl_seccomp_status = prctl_seccomp_status; rt->robust_futex_list = robust_futex_list; rt->robust_futex_list_len = robust_futex_list_len; rt->tsc_mode = tsc_mode; if (CLONE_SHARE_SIGHANDLERS & flags) { rt->sighandlers = sighandlers; } else { auto sh = sighandlers->clone(); rt->sighandlers.swap(sh); } if (CLONE_CLEARTID & flags) { LOG(debug) << "cleartid futex is " << cleartid_addr; ASSERT(this, !cleartid_addr.is_null()); rt->tid_futex = cleartid_addr; } else { LOG(debug) << "(clone child not enabling CLEARTID)"; } } return t; } static string exe_path(RecordTask* t) { char proc_exe[PATH_MAX]; snprintf(proc_exe, sizeof(proc_exe), "/proc/%d/exe", t->tid); char exe[PATH_MAX]; ssize_t ret = readlink(proc_exe, exe, sizeof(exe) - 1); ASSERT(t, ret >= 0); exe[ret] = 0; return exe; } static SupportedArch determine_arch(RecordTask* t, const string& file_name) { ASSERT(t, file_name.size() > 0); switch (read_elf_class(file_name)) { case ELFCLASS32: return x86; case ELFCLASS64: ASSERT(t, NativeArch::arch() == x86_64) << "64-bit tracees not supported"; return x86_64; case NOT_ELF: // Probably a script. Optimistically assume the same architecture as // the rr binary. return NativeArch::arch(); default: ASSERT(t, false) << "Unknown ELF class"; return x86; } } void RecordTask::post_exec() { string exe_file = exe_path(this); SupportedArch a = determine_arch(this, exe_file); if (emulated_ptracer) { ASSERT(this, !(emulated_ptracer->arch() == x86 && a == x86_64)) << "We don't support a 32-bit process tracing a 64-bit process"; } Task::post_exec(a, exe_file); ev().set_arch(arch()); ev().Syscall().number = registers.original_syscallno(); // Clear robust_list state to match kernel state. If this task is cloned // soon after exec, we must not do a bogus set_robust_list syscall for // the clone. set_robust_list(nullptr, 0); sighandlers = sighandlers->clone(); sighandlers->reset_user_handlers(arch()); } template static void do_preload_init_arch(RecordTask* t) { auto params = t->read_mem( remote_ptr>(t->regs().arg1())); int cores = t->session().scheduler().pretend_num_cores(); auto cores_ptr = REMOTE_PTR_FIELD(params.globals.rptr(), pretend_num_cores); t->write_mem(cores_ptr, cores); t->record_local(cores_ptr, &cores); } static void do_preload_init(RecordTask* t) { RR_ARCH_FUNCTION(do_preload_init_arch, t->arch(), t); } void RecordTask::at_preload_init() { Task::at_preload_init(); do_preload_init(this); } /** * Avoid using low-numbered file descriptors since that can confuse * developers. */ static int find_free_file_descriptor(pid_t for_tid) { int fd = 300 + (for_tid % 500); while (true) { char buf[PATH_MAX]; sprintf(buf, "/proc/%d/fd/%d", for_tid, fd); if (access(buf, F_OK) == -1 && errno == ENOENT) { return fd; } ++fd; } } template void RecordTask::init_buffers_arch() { // NB: the tracee can't be interrupted with a signal while // we're processing the rrcall, because it's masked off all // signals. AutoRemoteSyscalls remote(this); // Arguments to the rrcall. remote_ptr> child_args = regs().arg1(); auto args = read_mem(child_args); args.cloned_file_data_fd = -1; if (as->syscallbuf_enabled()) { args.syscallbuf_size = syscallbuf_size = session().syscall_buffer_size(); KernelMapping syscallbuf_km = init_syscall_buffer(remote, nullptr); set_sigmask(blocked_sigs); args.syscallbuf_ptr = syscallbuf_child; desched_fd_child = args.desched_counter_fd; // Prevent the child from closing this fd fds->add_monitor(desched_fd_child, new PreserveFileMonitor()); desched_fd = remote.retrieve_fd(desched_fd_child); auto record_in_trace = trace_writer().write_mapped_region( this, syscallbuf_km, syscallbuf_km.fake_stat(), TraceWriter::RR_BUFFER_MAPPING); ASSERT(this, record_in_trace == TraceWriter::DONT_RECORD_IN_TRACE); if (trace_writer().supports_file_data_cloning() && session().use_read_cloning()) { string clone_file_name = trace_writer().file_data_clone_file_name(tuid()); AutoRestoreMem name(remote, clone_file_name.c_str()); int cloned_file_data = remote.syscall(syscall_number_for_openat(arch()), RR_RESERVED_ROOT_DIR_FD, name.get(), O_RDWR | O_CREAT | O_CLOEXEC, 0600); if (cloned_file_data >= 0) { int free_fd = find_free_file_descriptor(tid); cloned_file_data_fd_child = remote.syscall(syscall_number_for_dup3(arch()), cloned_file_data, free_fd, O_CLOEXEC); if (cloned_file_data_fd_child != free_fd) { ASSERT(this, cloned_file_data_fd_child < 0); LOG(warn) << "Couldn't dup clone-data file to free fd"; cloned_file_data_fd_child = cloned_file_data; } else { // Prevent the child from closing this fd. We're going to close it // ourselves and we don't want the child closing it and then reopening // its own file with this fd. fds->add_monitor(cloned_file_data_fd_child, new PreserveFileMonitor()); remote.infallible_syscall(syscall_number_for_close(arch()), cloned_file_data); } args.cloned_file_data_fd = cloned_file_data_fd_child; } } } else { args.syscallbuf_ptr = remote_ptr(nullptr); args.syscallbuf_size = 0; } args.scratch_buf = scratch_ptr; args.scratch_size = scratch_size; // Return the mapped buffers to the child. write_mem(child_args, args); // The tracee doesn't need this addr returned, because it's // already written to the inout |args| param, but we stash it // away in the return value slot so that we can easily check // that we map the segment at the same addr during replay. remote.regs().set_syscall_result(syscallbuf_child); } void RecordTask::init_buffers() { RR_ARCH_FUNCTION(init_buffers_arch, arch()); } template void RecordTask::on_syscall_exit_arch(int syscallno, const Registers& regs) { if (regs.syscall_failed()) { return; } switch (syscallno) { case Arch::set_robust_list: set_robust_list(regs.arg1(), (size_t)regs.arg2()); return; case Arch::sigaction: case Arch::rt_sigaction: // TODO: SYS_signal update_sigaction(regs); return; case Arch::sigprocmask: case Arch::rt_sigprocmask: update_sigmask(regs); return; case Arch::set_tid_address: set_tid_addr(regs.arg1()); return; case Arch::ppoll: { remote_ptr setp = regs.arg4(); if (!setp.is_null()) { restore_sigmask(); } return; } case Arch::pselect6: { remote_ptr setp = regs.arg6(); if (!setp.is_null()) { restore_sigmask(); } return; } } } void RecordTask::on_syscall_exit(int syscallno, const Registers& regs) { Task::on_syscall_exit(syscallno, regs); RR_ARCH_FUNCTION(on_syscall_exit_arch, arch(), syscallno, regs) } void RecordTask::set_emulated_ptracer(RecordTask* tracer) { if (tracer) { ASSERT(this, !emulated_ptracer); emulated_ptracer = tracer; emulated_ptracer->emulated_ptrace_tracees.insert(this); } else { ASSERT(this, emulated_ptracer); ASSERT(this, emulated_stop_type == NOT_STOPPED || emulated_stop_type == GROUP_STOP); emulated_ptracer->emulated_ptrace_tracees.erase(this); emulated_ptracer = nullptr; } } bool RecordTask::emulate_ptrace_stop(WaitStatus status, const siginfo_t* siginfo, int si_code) { ASSERT(this, emulated_stop_type == NOT_STOPPED); if (!emulated_ptracer) { return false; } if (siginfo) { ASSERT(this, status.ptrace_signal() == siginfo->si_signo); save_ptrace_signal_siginfo(*siginfo); } else { siginfo_t si; memset(&si, 0, sizeof(si)); si.si_signo = status.ptrace_signal(); if (status.ptrace_event() || status.is_syscall()) { si.si_code = status.get() >> 8; } else { si.si_code = si_code; } save_ptrace_signal_siginfo(si); } force_emulate_ptrace_stop(status); return true; } void RecordTask::force_emulate_ptrace_stop(WaitStatus status) { emulated_stop_type = status.group_stop() ? GROUP_STOP : SIGNAL_DELIVERY_STOP; emulated_stop_code = status; emulated_stop_pending = true; emulated_ptrace_SIGCHLD_pending = true; emulated_ptracer->send_synthetic_SIGCHLD_if_necessary(); // The SIGCHLD will eventually be reported to rr via a ptrace stop, // interrupting wake_task's syscall (probably a waitpid) if necessary. At // that point, we'll fix up the siginfo data with values that match what // the kernel would have delivered for a real ptracer's SIGCHLD. When the // signal handler (if any) returns, if wake_task was in a blocking wait that // wait will be resumed, at which point rec_prepare_syscall_arch will // discover the pending ptrace result and emulate the wait syscall to // return that result immediately. } void RecordTask::send_synthetic_SIGCHLD_if_necessary() { RecordTask* wake_task = nullptr; bool need_signal = false; for (RecordTask* tracee : emulated_ptrace_tracees) { if (tracee->emulated_ptrace_SIGCHLD_pending) { need_signal = true; // check to see if any thread in the ptracer process is in a waitpid that // could read the status of 'tracee'. If it is, we should wake up that // thread. Otherwise we send SIGCHLD to the ptracer thread. for (Task* t : task_group()->task_set()) { auto rt = static_cast(t); if (rt->is_waiting_for_ptrace(tracee)) { wake_task = rt; break; } } if (wake_task) { break; } } } if (!need_signal) { for (TaskGroup* child_tg : task_group()->children()) { for (Task* child : child_tg->task_set()) { RecordTask* rchild = static_cast(child); if (rchild->emulated_SIGCHLD_pending) { need_signal = true; // check to see if any thread in the ptracer process is in a waitpid // that // could read the status of 'tracee'. If it is, we should wake up that // thread. Otherwise we send SIGCHLD to the ptracer thread. for (Task* t : task_group()->task_set()) { auto rt = static_cast(t); if (rt->is_waiting_for(rchild)) { wake_task = rt; break; } } if (wake_task) { break; } } } } if (!need_signal) { return; } } // ptrace events trigger SIGCHLD in the ptracer's wake_task. // We can't set all the siginfo values to their correct values here, so // we'll patch this up when the signal is received. // If there's already a pending SIGCHLD, this signal will be ignored, // but at some point the pending SIGCHLD will be delivered and then // send_synthetic_SIGCHLD_if_necessary will be called again to deliver a new // SIGCHLD if necessary. siginfo_t si; memset(&si, 0, sizeof(si)); si.si_code = SI_QUEUE; si.si_value.sival_int = SIGCHLD_SYNTHETIC; int ret; if (wake_task) { LOG(debug) << "Sending synthetic SIGCHLD to tid " << wake_task->tid; // We must use the raw SYS_rt_tgsigqueueinfo syscall here to ensure the // signal is sent to the correct thread by tid. ret = syscall(SYS_rt_tgsigqueueinfo, wake_task->tgid(), wake_task->tid, SIGCHLD, &si); ASSERT(this, ret == 0); if (wake_task->is_sig_blocked(SIGCHLD)) { // Just sending SIGCHLD won't wake it up. Send it a TIME_SLICE_SIGNAL // as well to make sure it exits a blocking syscall. We ensure those // can never be blocked. // We have to send a negative code here because only the kernel can set // positive codes. We set a magic number so we can recognize it // when received. si.si_code = SYNTHETIC_TIME_SLICE_SI_CODE; ret = syscall(SYS_rt_tgsigqueueinfo, wake_task->tgid(), wake_task->tid, PerfCounters::TIME_SLICE_SIGNAL, &si); ASSERT(this, ret == 0); } } else { // Send the signal to the process as a whole and let the kernel // decide which thread gets it. ret = syscall(SYS_rt_sigqueueinfo, tgid(), SIGCHLD, &si); ASSERT(this, ret == 0); LOG(debug) << "Sending synthetic SIGCHLD to pid " << tgid(); } } bool RecordTask::set_siginfo_for_synthetic_SIGCHLD(siginfo_t* si) { if (si->si_signo != SIGCHLD || si->si_value.sival_int != SIGCHLD_SYNTHETIC) { return true; } if (is_syscall_restart()) { // ptrace generated signals don't interrupt syscalls such as wait. // Return false to tell the caller to defer the signal and resume // the syscall. return false; } for (RecordTask* tracee : emulated_ptrace_tracees) { if (tracee->emulated_ptrace_SIGCHLD_pending) { tracee->emulated_ptrace_SIGCHLD_pending = false; tracee->set_siginfo_for_waited_task( reinterpret_cast(si)); si->si_value.sival_int = 0; return true; } } for (TaskGroup* child_tg : task_group()->children()) { for (Task* child : child_tg->task_set()) { auto rchild = static_cast(child); if (rchild->emulated_SIGCHLD_pending) { rchild->emulated_SIGCHLD_pending = false; rchild->set_siginfo_for_waited_task( reinterpret_cast(si)); si->si_value.sival_int = 0; return true; } } } return true; } bool RecordTask::is_waiting_for_ptrace(RecordTask* t) { // This task's process must be a ptracer of t. if (!t->emulated_ptracer || t->emulated_ptracer->task_group() != task_group()) { return false; } // XXX need to check |options| to make sure this task is eligible!! switch (in_wait_type) { case WAIT_TYPE_NONE: return false; case WAIT_TYPE_ANY: return true; case WAIT_TYPE_SAME_PGID: return getpgid(t->tgid()) == getpgid(tgid()); case WAIT_TYPE_PGID: return getpgid(t->tgid()) == in_wait_pid; case WAIT_TYPE_PID: // When waiting for a ptracee, a specific pid is interpreted as the // exact tid. return t->tid == in_wait_pid; default: ASSERT(this, false); return false; } } bool RecordTask::is_waiting_for(RecordTask* t) { // t must be a child of this task. if (t->task_group()->parent() != task_group().get()) { return false; } switch (in_wait_type) { case WAIT_TYPE_NONE: return false; case WAIT_TYPE_ANY: return true; case WAIT_TYPE_SAME_PGID: return getpgid(t->tgid()) == getpgid(tgid()); case WAIT_TYPE_PGID: return getpgid(t->tgid()) == in_wait_pid; case WAIT_TYPE_PID: return t->tgid() == in_wait_pid; default: ASSERT(this, false); return false; } } void RecordTask::save_ptrace_signal_siginfo(const siginfo_t& si) { for (auto it = saved_ptrace_siginfos.begin(); it != saved_ptrace_siginfos.end(); ++it) { if (it->si_signo == si.si_signo) { saved_ptrace_siginfos.erase(it); break; } } saved_ptrace_siginfos.push_back(si); } siginfo_t& RecordTask::get_saved_ptrace_siginfo() { int sig = emulated_stop_code.ptrace_signal(); ASSERT(this, sig > 0); for (auto it = saved_ptrace_siginfos.begin(); it != saved_ptrace_siginfos.end(); ++it) { if (it->si_signo == sig) { return *it; } } ASSERT(this, false) << "No saved siginfo found for stop-signal???"; while (true) { // Avoid having to return anything along this (unreachable) path } } siginfo_t RecordTask::take_ptrace_signal_siginfo(int sig) { for (auto it = saved_ptrace_siginfos.begin(); it != saved_ptrace_siginfos.end(); ++it) { if (it->si_signo == sig) { siginfo_t si = *it; saved_ptrace_siginfos.erase(it); return si; } } siginfo_t si; memset(&si, 0, sizeof(si)); si.si_signo = sig; return si; } static pid_t get_ppid(pid_t pid) { auto ppid_str = read_proc_status_fields(pid, "PPid"); if (ppid_str.empty()) { return -1; } char* end; int actual_ppid = strtol(ppid_str[0].c_str(), &end, 10); return *end ? -1 : actual_ppid; } void RecordTask::apply_group_stop(int sig) { if (emulated_stop_type == NOT_STOPPED) { LOG(debug) << "setting " << tid << " to GROUP_STOP due to signal " << sig; WaitStatus status = WaitStatus::for_group_sig(sig, this); if (!emulate_ptrace_stop(status)) { emulated_stop_type = GROUP_STOP; emulated_stop_code = status; emulated_stop_pending = true; emulated_SIGCHLD_pending = true; RecordTask* t = session().find_task(get_ppid(tid)); if (t) { t->send_synthetic_SIGCHLD_if_necessary(); } } } } bool RecordTask::is_signal_pending(int sig) { auto pending_strs = read_proc_status_fields(tid, "SigPnd", "ShdPnd"); if (pending_strs.size() < 2) { return false; } char* end1; uint64_t mask1 = strtoull(pending_strs[0].c_str(), &end1, 16); char* end2; uint64_t mask2 = strtoull(pending_strs[1].c_str(), &end2, 16); return !*end1 && !*end2 && ((mask1 | mask2) & (1 << (sig - 1))); } bool RecordTask::has_any_actionable_signal() { auto sig_strs = read_proc_status_fields(tid, "SigPnd", "ShdPnd", "SigBlk"); if (sig_strs.size() < 3) { return false; } char* end1; uint64_t mask1 = strtoull(sig_strs[0].c_str(), &end1, 16); char* end2; uint64_t mask2 = strtoull(sig_strs[1].c_str(), &end2, 16); char* end3; uint64_t mask_blk = strtoull(sig_strs[2].c_str(), &end3, 16); return !*end1 && !*end2 && !*end3 && ((mask1 | mask2) & ~mask_blk); } void RecordTask::emulate_SIGCONT() { // All threads in the process are resumed. for (Task* t : task_group()->task_set()) { auto rt = static_cast(t); LOG(debug) << "setting " << tid << " to NOT_STOPPED due to SIGCONT"; rt->emulated_stop_pending = false; rt->emulated_stop_type = NOT_STOPPED; } } void RecordTask::signal_delivered(int sig) { Sighandler& h = sighandlers->get(sig); if (h.resethand) { reset_handler(&h, arch()); } if (!is_sig_ignored(sig)) { switch (sig) { case SIGTSTP: case SIGTTIN: case SIGTTOU: if (h.disposition() == SIGNAL_HANDLER) { break; } // Fall through... case SIGSTOP: // All threads in the process are stopped. for (Task* t : task_group()->task_set()) { auto rt = static_cast(t); rt->apply_group_stop(sig); } break; case SIGCONT: emulate_SIGCONT(); break; } } send_synthetic_SIGCHLD_if_necessary(); } bool RecordTask::signal_has_user_handler(int sig) const { return sighandlers->get(sig).disposition() == SIGNAL_HANDLER; } remote_code_ptr RecordTask::get_signal_user_handler(int sig) const { return sighandlers->get(sig).get_user_handler(); } const vector& RecordTask::signal_action(int sig) const { return sighandlers->get(sig).sa; } bool RecordTask::signal_handler_takes_siginfo(int sig) const { return sighandlers->get(sig).takes_siginfo; } bool RecordTask::signal_handler_nodefer(int sig) const { return sighandlers->get(sig).nodefer_set; } static bool is_unstoppable_signal(int sig) { return sig == SIGSTOP || sig == SIGKILL; } bool RecordTask::is_sig_blocked(int sig) { if (is_unstoppable_signal(sig)) { // These can never be blocked return false; } int sig_bit = sig - 1; if (sigsuspend_blocked_sigs) { return (*sigsuspend_blocked_sigs >> sig_bit) & 1; } return (get_sigmask() >> sig_bit) & 1; } void RecordTask::set_sig_blocked(int sig, bool blocked) { uint64_t mask = uint64_t(1) << (sig - 1); sig_set_t sigs = get_sigmask(); if (blocked) { sigs |= mask; } else { sigs &= ~mask; } set_sigmask(sigs); } void RecordTask::apply_sig_sa_mask(int sig) { sig_set_t sigs = get_sigmask(); sigs |= sighandlers->get(sig).sa_mask; set_sigmask(sigs); } bool RecordTask::is_sig_ignored(int sig) const { if (is_unstoppable_signal(sig)) { // These can never be ignored return false; } switch (sighandlers->get(sig).disposition()) { case SIGNAL_IGNORE: return true; case SIGNAL_DEFAULT: return IGNORE == default_action(sig); default: return false; } } void RecordTask::set_siginfo(const siginfo_t& si) { pending_siginfo = si; ptrace_if_alive(PTRACE_SETSIGINFO, nullptr, (void*)&si); } template void RecordTask::update_sigaction_arch(const Registers& regs) { int sig = regs.arg1_signed(); remote_ptr new_sigaction = regs.arg2(); if (0 == regs.syscall_result() && !new_sigaction.is_null()) { // A new sighandler was installed. Update our // sighandler table. // TODO: discard attempts to handle or ignore signals // that can't be by POSIX typename Arch::kernel_sigaction sa; memset(&sa, 0, sizeof(sa)); read_bytes_helper(new_sigaction, sizeof(sa), &sa); sighandlers->get(sig).init_arch(sa); } } void RecordTask::update_sigaction(const Registers& regs) { RR_ARCH_FUNCTION(update_sigaction_arch, regs.arch(), regs); } void RecordTask::set_new_sigmask(uint64_t new_sigmask) { set_sigmask(new_sigmask); } void RecordTask::update_sigmask(const Registers& regs) { int how = regs.arg1_signed(); remote_ptr setp = regs.arg2(); if (regs.syscall_failed() || !setp) { return; } auto set = read_mem(setp); sig_set_t sigs = get_sigmask(); // Update the blocked signals per |how|. switch (how) { case SIG_BLOCK: sigs |= set; break; case SIG_UNBLOCK: sigs &= ~set; break; case SIG_SETMASK: sigs = set; break; default: FATAL() << "Unknown sigmask manipulator " << how; } // Our signals are never blocked. uint64_t enabled_sigs = (1 << (PerfCounters::TIME_SLICE_SIGNAL - 1)) | (1 << (SYSCALLBUF_DESCHED_SIGNAL - 1)); sigs &= ~enabled_sigs; set_sigmask(sigs); } sig_set_t RecordTask::get_sigmask() { if (syscallbuf_child) { blocked_sigs = read_mem(REMOTE_PTR_FIELD(syscallbuf_child, blocked_sigs)); } return blocked_sigs; } void RecordTask::set_sigmask(sig_set_t sigs) { blocked_sigs = sigs; if (syscallbuf_child) { write_mem(REMOTE_PTR_FIELD(syscallbuf_child, blocked_sigs), blocked_sigs); } } void RecordTask::save_sigmask() { ASSERT(this, !has_previously_blocked_sigs); previously_blocked_sigs = get_sigmask(); has_previously_blocked_sigs = true; } void RecordTask::restore_sigmask() { ASSERT(this, has_previously_blocked_sigs); set_sigmask(previously_blocked_sigs); clear_saved_sigmask(); } void RecordTask::restore_sigmask_if_saved() { if (has_previously_blocked_sigs) { restore_sigmask(); } } void RecordTask::clear_saved_sigmask() { has_previously_blocked_sigs = false; } void RecordTask::set_sig_handler_default(int sig) { Sighandler& h = sighandlers->get(sig); reset_handler(&h, arch()); } void RecordTask::verify_signal_states() { #ifndef DEBUG return; #endif if (ev().is_syscall_event()) { // If the syscall event is on the event stack with PROCESSING or EXITING // states, we won't have applied the signal-state updates yet while the // kernel may have. return; } auto results = read_proc_status_fields(tid, "SigBlk", "SigIgn", "SigCgt"); ASSERT(this, results.size() == 3); uint64_t blocked = strtoull(results[0].c_str(), NULL, 16); uint64_t ignored = strtoull(results[1].c_str(), NULL, 16); uint64_t caught = strtoull(results[2].c_str(), NULL, 16); for (int sig = 1; sig < _NSIG; ++sig) { uint64_t mask = uint64_t(1) << (sig - 1); if (is_unstoppable_signal(sig)) { ASSERT(this, !(blocked & mask)) << "Expected " << signal_name(sig) << " to not be blocked, but it is"; ASSERT(this, !(ignored & mask)) << "Expected " << signal_name(sig) << " to not be ignored, but it is"; ASSERT(this, !(caught & mask)) << "Expected " << signal_name(sig) << " to not be caught, but it is"; } else if (sig != handling_deterministic_signal) { ASSERT(this, !!(blocked & mask) == is_sig_blocked(sig)) << signal_name(sig) << ((blocked & mask) ? " is blocked" : " is not blocked"); auto disposition = sighandlers->get(sig).disposition(); ASSERT(this, !!(ignored & mask) == (disposition == SIGNAL_IGNORE)) << signal_name(sig) << ((ignored & mask) ? " is ignored" : " is not ignored"); ASSERT(this, !!(caught & mask) == (disposition == SIGNAL_HANDLER)) << signal_name(sig) << ((caught & mask) ? " is caught" : " is not caught"); } } } void RecordTask::stash_sig() { int sig = stop_sig(); ASSERT(this, sig); // Callers should avoid passing SYSCALLBUF_DESCHED_SIGNAL in here. ASSERT(this, sig != SYSCALLBUF_DESCHED_SIGNAL); // multiple non-RT signals coalesce if (sig < SIGRTMIN) { for (auto it = stashed_signals.begin(); it != stashed_signals.end(); ++it) { if (it->siginfo.si_signo == sig) { LOG(debug) << "discarding stashed signal " << sig << " since we already have one pending"; return; } } } const siginfo_t& si = get_siginfo(); stashed_signals.push_back(StashedSignal(si, is_deterministic_signal(this))); wait_status = WaitStatus(); } void RecordTask::stash_synthetic_sig(const siginfo_t& si, SignalDeterministic deterministic) { int sig = si.si_signo; assert(sig); // Callers should avoid passing SYSCALLBUF_DESCHED_SIGNAL in here. assert(sig != SYSCALLBUF_DESCHED_SIGNAL); // multiple non-RT signals coalesce if (sig < SIGRTMIN) { for (auto it = stashed_signals.begin(); it != stashed_signals.end(); ++it) { if (it->siginfo.si_signo == sig) { LOG(debug) << "discarding stashed signal " << sig << " since we already have one pending"; return; } } } stashed_signals.push_back(StashedSignal(si, deterministic)); } bool RecordTask::has_stashed_sig(int sig) const { for (auto it = stashed_signals.begin(); it != stashed_signals.end(); ++it) { if (it->siginfo.si_signo == sig) { return true; } } return false; } void RecordTask::pop_stash_sig() { assert(has_stashed_sig()); stashed_signals.pop_front(); } const RecordTask::StashedSignal& RecordTask::peek_stash_sig() { assert(has_stashed_sig()); return stashed_signals.front(); } bool RecordTask::is_syscall_restart() { int syscallno = regs().original_syscallno(); bool is_restart = false; LOG(debug) << " is syscall interruption of recorded " << ev() << "? (now " << syscall_name(syscallno) << ")"; if (EV_SYSCALL_INTERRUPTION != ev().type()) { goto done; } /* It's possible for the tracee to resume after a sighandler * with a fresh syscall that happens to be the same as the one * that was interrupted. So we check here if the args are the * same. * * Of course, it's possible (but less likely) for the tracee * to incidentally resume with a fresh syscall that just * happens to have the same *arguments* too. But in that * case, we would usually set up scratch buffers etc the same * was as for the original interrupted syscall, so we just * save a step here. * * TODO: it's possible for arg structures to be mutated * between the original call and restarted call in such a way * that it might change the scratch allocation decisions. */ if (is_restart_syscall_syscall(syscallno, arch())) { is_restart = true; syscallno = ev().Syscall().number; LOG(debug) << " (SYS_restart_syscall)"; } if (ev().Syscall().number != syscallno) { LOG(debug) << " interrupted " << ev() << " != " << syscall_name(syscallno); goto done; } { const Registers& old_regs = ev().Syscall().regs; if (!(old_regs.arg1() == regs().arg1() && old_regs.arg2() == regs().arg2() && old_regs.arg3() == regs().arg3() && old_regs.arg4() == regs().arg4() && old_regs.arg5() == regs().arg5() && old_regs.arg6() == regs().arg6())) { LOG(debug) << " regs different at interrupted " << syscall_name(syscallno); goto done; } } is_restart = true; done: if (is_restart) { LOG(debug) << " restart of " << syscall_name(syscallno); } return is_restart; } bool RecordTask::at_may_restart_syscall() const { ssize_t depth = pending_events.size(); const Event* prev_ev = depth > 2 ? &pending_events[depth - 2] : nullptr; return EV_SYSCALL_INTERRUPTION == ev().type() || (EV_SIGNAL_DELIVERY == ev().type() && prev_ev && EV_SYSCALL_INTERRUPTION == prev_ev->type()); } bool RecordTask::is_arm_desched_event_syscall() { return is_desched_event_syscall() && PERF_EVENT_IOC_ENABLE == regs().arg2(); } bool RecordTask::is_disarm_desched_event_syscall() { return (is_desched_event_syscall() && PERF_EVENT_IOC_DISABLE == regs().arg2()); } bool RecordTask::may_be_blocked() const { return (EV_SYSCALL == ev().type() && PROCESSING_SYSCALL == ev().Syscall().state) || emulated_stop_type != NOT_STOPPED; } bool RecordTask::maybe_in_spinlock() { return time_at_start_of_last_timeslice == session().trace_writer().time() && regs().matches(registers_at_start_of_last_timeslice); } remote_ptr RecordTask::desched_rec() const { return (ev().is_syscall_event() ? ev().Syscall().desched_rec : (EV_DESCHED == ev().type()) ? ev().Desched().rec : nullptr); } bool RecordTask::running_inside_desched() const { for (auto& e : pending_events) { if (e.type() == EV_DESCHED) { return e.Desched().rec != desched_rec(); } } return false; } uint16_t RecordTask::get_ptrace_eventmsg_seccomp_data() { unsigned long data = 0; // in theory we could hit an assertion failure if the tracee suffers // a SIGKILL before we get here. But the SIGKILL would have to be // precisely timed between the generation of a PTRACE_EVENT_FORK/CLONE/ // SYS_clone event, and us fetching the event message here. xptrace(PTRACE_GETEVENTMSG, nullptr, &data); return data; } void RecordTask::record_local(remote_ptr addr, ssize_t num_bytes, const void* data) { maybe_flush_syscallbuf(); ASSERT(this, num_bytes >= 0); if (!addr) { return; } trace_writer().write_raw(rec_tid, data, num_bytes, addr); } bool RecordTask::record_remote_by_local_map(remote_ptr addr, size_t num_bytes) { if (uint8_t* local_addr = local_mapping(addr, num_bytes)) { record_local(addr, num_bytes, local_addr); return true; } return false; } void RecordTask::record_remote(remote_ptr addr, ssize_t num_bytes) { maybe_flush_syscallbuf(); ASSERT(this, num_bytes >= 0); if (!addr) { return; } if (record_remote_by_local_map(addr, num_bytes) != 0) return; auto buf = read_mem(addr.cast(), num_bytes); trace_writer().write_raw(rec_tid, buf.data(), num_bytes, addr); } void RecordTask::record_remote_fallible(remote_ptr addr, ssize_t num_bytes) { maybe_flush_syscallbuf(); ASSERT(this, num_bytes >= 0); if (record_remote_by_local_map(addr, num_bytes) != 0) return; vector buf; if (!addr.is_null()) { buf.resize(num_bytes); ssize_t nread = read_bytes_fallible(addr, num_bytes, buf.data()); buf.resize(max(0, nread)); } trace_writer().write_raw(rec_tid, buf.data(), buf.size(), addr); } void RecordTask::record_remote_even_if_null(remote_ptr addr, ssize_t num_bytes) { maybe_flush_syscallbuf(); assert(num_bytes >= 0); if (!addr) { trace_writer().write_raw(rec_tid, nullptr, 0, addr); return; } if (record_remote_by_local_map(addr, num_bytes) != 0) return; auto buf = read_mem(addr.cast(), num_bytes); trace_writer().write_raw(rec_tid, buf.data(), num_bytes, addr); } void RecordTask::pop_event(EventType expected_type) { ASSERT(this, pending_events.back().type() == expected_type); pending_events.pop_back(); } void RecordTask::log_pending_events() const { ssize_t depth = pending_events.size(); assert(depth > 0); if (1 == depth) { LOG(info) << "(no pending events)"; return; } /* The event at depth 0 is the placeholder event, which isn't * useful to log. Skip it. */ for (auto it = pending_events.rbegin(); it != pending_events.rend(); ++it) { it->log(); } } void RecordTask::maybe_flush_syscallbuf() { if (EV_SYSCALLBUF_FLUSH == ev().type()) { // Already flushing. return; } if (!syscallbuf_child) { return; } // This can be called while the task is not stopped, when we prematurely // terminate the trace. In that case, the tracee could be concurrently // modifying the header. We'll take a snapshot of the header now. // The syscallbuf code ensures that writes to syscallbuf records // complete before num_rec_bytes is incremented. struct syscallbuf_hdr hdr = read_mem(syscallbuf_child); ASSERT(this, !flushed_syscallbuf || flushed_num_rec_bytes == hdr.num_rec_bytes); if (!hdr.num_rec_bytes || flushed_syscallbuf) { // no records, or we've already flushed. return; } // Apply buffered mprotect operations and flush the buffer in the tracee. if (hdr.mprotect_record_count) { auto records = read_mem(REMOTE_PTR_FIELD(preload_globals, mprotect_records[0]), hdr.mprotect_record_count); for (auto& r : records) { as->protect(this, r.start, r.size, r.prot); } // We write these out because some tools might benefit from them, and // this is cheap. trace_writer().write_generic(records.data(), records.size() * sizeof(records[0])); } // Write the entire buffer in one shot without parsing it, // because replay will take care of that. push_event(Event(EV_SYSCALLBUF_FLUSH, NO_EXEC_INFO, arch())); if (is_running()) { vector buf; buf.resize(sizeof(hdr) + hdr.num_rec_bytes); memcpy(buf.data(), &hdr, sizeof(hdr)); read_bytes_helper(syscallbuf_child + 1, hdr.num_rec_bytes, buf.data() + sizeof(hdr)); record_local(syscallbuf_child, buf.size(), buf.data()); } else { record_remote(syscallbuf_child, syscallbuf_data_size()); } record_current_event(); pop_event(EV_SYSCALLBUF_FLUSH); flushed_syscallbuf = true; flushed_num_rec_bytes = hdr.num_rec_bytes; LOG(debug) << "Syscallbuf flushed with num_rec_bytes=" << (uint32_t)hdr.num_rec_bytes; } /** * If the syscallbuf has just been flushed, and resetting hasn't been * overridden with a delay request, then record the reset event for * replay. */ void RecordTask::maybe_reset_syscallbuf() { if (flushed_syscallbuf && !delay_syscallbuf_reset) { flushed_syscallbuf = false; LOG(debug) << "Syscallbuf reset"; reset_syscallbuf(); record_event(Event(EV_SYSCALLBUF_RESET, NO_EXEC_INFO, arch())); } } static bool record_extra_regs(const Event& ev) { switch (ev.type()) { case EV_SYSCALL: // sigreturn/rt_sigreturn restores register state return ev.Syscall().state == EXITING_SYSCALL && (is_sigreturn(ev.Syscall().number, ev.arch()) || is_execve_syscall(ev.Syscall().number, ev.arch())); case EV_SIGNAL_HANDLER: // entering a signal handler seems to clear FP/SSE regs, // so record these effects. return true; default: return false; } } void RecordTask::record_event(const Event& ev, FlushSyscallbuf flush, const Registers* registers) { if (flush == FLUSH_SYSCALLBUF) { maybe_flush_syscallbuf(); } TraceFrame frame(trace_writer().time(), tid, ev, tick_count()); if (ev.record_exec_info() == HAS_EXEC_INFO) { PerfCounters::Extra extra_perf_values; if (PerfCounters::extra_perf_counters_enabled()) { extra_perf_values = hpc.read_extra(); } frame.set_exec_info(registers ? *registers : regs(), PerfCounters::extra_perf_counters_enabled() ? &extra_perf_values : nullptr, record_extra_regs(ev) ? &extra_regs() : nullptr); } if (should_dump_memory(frame)) { dump_process_memory(this, frame.time(), "rec"); } if (should_checksum(frame)) { checksum_process_memory(this, frame.time()); } trace_writer().write_frame(frame); if (!ev.has_ticks_slop()) { ASSERT(this, flush == FLUSH_SYSCALLBUF || ev.type() == EV_UNSTABLE_EXIT || ev.type() == EV_EXIT); // After we've output an event, it's safe to reset the syscallbuf (if not // explicitly delayed) since we will have exited the syscallbuf code that // consumed the syscallbuf data. // This only works if the event has a reliable tick count so when we // reach it, we're done. maybe_reset_syscallbuf(); } } void RecordTask::record_current_event() { record_event(ev()); } pid_t RecordTask::find_newborn_thread() { ASSERT(this, session().is_recording()); ASSERT(this, ptrace_event() == PTRACE_EVENT_CLONE); pid_t hint = get_ptrace_eventmsg(); char path[PATH_MAX]; sprintf(path, "/proc/%d/task/%d", tid, hint); struct stat stat_buf; // This should always succeed, but may fail in old kernels due to // a kernel bug. See RecordSession::handle_ptrace_event. if (!session().find_task(hint) && 0 == stat(path, &stat_buf)) { return hint; } sprintf(path, "/proc/%d/task", tid); DIR* dir = opendir(path); ASSERT(this, dir); while (true) { struct dirent* result = readdir(dir); ASSERT(this, result); char* end; pid_t thread_tid = strtol(result->d_name, &end, 10); if (*end == '\0' && !session().find_task(thread_tid)) { closedir(dir); return thread_tid; } } } pid_t RecordTask::find_newborn_child_process() { ASSERT(this, session().is_recording()); ASSERT(this, ptrace_event() == PTRACE_EVENT_CLONE || ptrace_event() == PTRACE_EVENT_VFORK || ptrace_event() == PTRACE_EVENT_FORK); pid_t hint = get_ptrace_eventmsg(); // This should always succeed, but may fail in old kernels due to // a kernel bug. See RecordSession::handle_ptrace_event. if (!session().find_task(hint) && get_ppid(hint) == real_tgid()) { return hint; } DIR* dir = opendir("/proc"); ASSERT(this, dir); while (true) { struct dirent* result = readdir(dir); ASSERT(this, result); char* end; pid_t proc_tid = strtol(result->d_name, &end, 10); if (*end == '\0' && !session().find_task(proc_tid) && get_ppid(proc_tid) == real_tgid()) { closedir(dir); return proc_tid; } } } void RecordTask::set_tid_addr(remote_ptr tid_addr) { LOG(debug) << "updating cleartid futex to " << tid_addr; tid_futex = tid_addr; } void RecordTask::tgkill(int sig) { ASSERT(this, 0 == syscall(SYS_tgkill, real_tgid(), tid, sig)); } pid_t RecordTask::get_parent_pid() { return get_ppid(tid); } void RecordTask::set_tid_and_update_serial(pid_t tid) { hpc.set_tid(tid); this->tid = rec_tid = tid; serial = session().next_task_serial(); } } // namespace rr rr-4.4.0/src/RecordTask.h000066400000000000000000000560751277367620400151760ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_RECORD_TASK_H_ #define RR_RECORD_TASK_H_ #include "Registers.h" #include "Task.h" #include "TraceFrame.h" namespace rr { struct Sighandlers; /** Different kinds of waits a task can do. */ enum WaitType { // Not waiting for anything WAIT_TYPE_NONE, // Waiting for any child process WAIT_TYPE_ANY, // Waiting for any child with the same process group ID WAIT_TYPE_SAME_PGID, // Waiting for any child with a specific process group ID WAIT_TYPE_PGID, // Waiting for a specific process ID WAIT_TYPE_PID }; /** Reasons why we simulate stopping of a task (see ptrace(2) man page). */ enum EmulatedStopType { NOT_STOPPED, GROUP_STOP, // stopped by a signal. This applies to non-ptracees too. SIGNAL_DELIVERY_STOP // Stopped before delivering a signal. ptracees only. }; /** * Pass USE_SYSGOOD to emulate_ptrace_stop to add 0x80 to the signal * if PTRACE_O_TRACESYSGOOD is in effect. */ enum AddSysgoodFlag { IGNORE_SYSGOOD, USE_SYSGOOD }; /** * Every Task owned by a RecordSession is a RecordTask. Functionality that * only applies during recording belongs here. */ class RecordTask : public Task { public: RecordTask(RecordSession& session, pid_t _tid, uint32_t serial, SupportedArch a); virtual Task* clone(int flags, remote_ptr stack, remote_ptr tls, remote_ptr cleartid_addr, pid_t new_tid, pid_t new_rec_tid, uint32_t new_serial, Session* other_session); virtual void on_syscall_exit(int syscallno, const Registers& regs); /** * Initialize tracee buffers in this, i.e., implement * RRCALL_init_syscall_buffer. This task must be at the point * of *exit from* the rrcall. Registers will be updated with * the return value from the rrcall, which is also returned * from this call. */ void init_buffers(); void post_exec(); /** * Called when SYS_rrcall_init_preload has happened. */ virtual void at_preload_init(); RecordSession& session() const; TraceWriter& trace_writer() const; /** * Emulate 'tracer' ptracing this task. */ void set_emulated_ptracer(RecordTask* tracer); /** * Call this when an event occurs that should stop a ptraced task. * If we're emulating ptrace of the task, stop the task and wake the ptracer * if it's waiting, and queue "status" to be reported to the * ptracer. If siginfo is non-null, we'll report that siginfo, otherwise we'll * make one up based on the status (unless the status is an exit code). * Returns true if the task is stopped-for-emulated-ptrace, false otherwise. */ bool emulate_ptrace_stop(WaitStatus status, const siginfo_t* siginfo = nullptr, int si_code = 0); /** * Force the ptrace-stop state no matter what state the task is currently in. */ void force_emulate_ptrace_stop(WaitStatus status); /** * Called when we're about to deliver a signal to this task. If it's a * synthetic SIGCHLD and there's a ptraced task that needs to SIGCHLD, * update the siginfo to reflect the status and note that that * ptraced task has had its SIGCHLD sent. * Note that we can't set the correct siginfo when we send the signal, because * it requires us to set information only the kernel has permission to set. * Returns false if this signal should be deferred. */ bool set_siginfo_for_synthetic_SIGCHLD(siginfo_t* si); /** * Sets up |si| as if we're delivering a SIGCHLD/waitid for this waited task. */ template void set_siginfo_for_waited_task(typename Arch::siginfo_t* si) { // XXX handle CLD_EXITED here if (emulated_stop_type == GROUP_STOP) { si->si_code = CLD_STOPPED; si->_sifields._sigchld.si_status_ = emulated_stop_code.stop_sig(); } else { si->si_code = CLD_TRAPPED; si->_sifields._sigchld.si_status_ = emulated_stop_code.ptrace_signal(); } si->_sifields._sigchld.si_pid_ = tgid(); si->_sifields._sigchld.si_uid_ = getuid(); } /** * Return a reference to the saved siginfo record for the stop-signal * that we're currently in a ptrace-stop for. */ siginfo_t& get_saved_ptrace_siginfo(); /** * When emulating a ptrace-continue with a signal number, extract the siginfo * that was saved by |save_ptrace_signal_siginfo|. If no such siginfo was * saved, make one up. */ siginfo_t take_ptrace_signal_siginfo(int sig); /** * Returns true if this task is in a waitpid or similar that would return * when t's status changes due to a ptrace event. */ bool is_waiting_for_ptrace(RecordTask* t); /** * Returns true if this task is in a waitpid or similar that would return * when t's status changes due to a regular event (exit). */ bool is_waiting_for(RecordTask* t); /** * Call this to force a group stop for this task with signal 'sig', * notifying ptracer if necessary. */ void apply_group_stop(int sig); /** * Call this after |sig| is delivered to this task. Emulate * sighandler updates induced by the signal delivery. */ void signal_delivered(int sig); /** * Return true if |sig| is pending but hasn't been reported to ptrace yet */ bool is_signal_pending(int sig); /** * Return true if there are any signals pending that are not blocked. */ bool has_any_actionable_signal(); /** * Get all threads out of an emulated GROUP_STOP */ void emulate_SIGCONT(); /** * Return true if the disposition of |sig| in |table| isn't * SIG_IGN or SIG_DFL, that is, if a user sighandler will be * invoked when |sig| is received. */ bool signal_has_user_handler(int sig) const; /** * If signal_has_user_handler(sig) is true, return the address of the * user handler, otherwise return null. */ remote_code_ptr get_signal_user_handler(int sig) const; /** * Return true if the signal handler for |sig| takes a siginfo_t* * parameter. */ bool signal_handler_takes_siginfo(int sig) const; /** * Return true if SA_NODEFER is set for |sig| */ bool signal_handler_nodefer(int sig) const; /** * Return |sig|'s current sigaction. Returned as raw bytes since the * data is architecture-dependent. */ const std::vector& signal_action(int sig) const; /** Return true iff |sig| is blocked for this. */ bool is_sig_blocked(int sig); /** Set |sig| to be treated as |blocked|. */ void set_sig_blocked(int sig, bool blocked); /** * Return true iff |sig| is SIG_IGN, or it's SIG_DFL and the * default disposition is "ignore". */ bool is_sig_ignored(int sig) const; /** * Set the siginfo for the signal-stop of this. */ void set_siginfo(const siginfo_t& si); /** * Update this task's sigmask to be new_sigmask */ void set_new_sigmask(uint64_t new_sigmask); /** * Update this task's sigmask to block all signals specified in sa_mask of * |sig|'s current sigaction */ void apply_sig_sa_mask(int sig); /** * Reset the signal handler for this signal to the default. */ void set_sig_handler_default(int sig); /** * Check that our status for |sig| matches what's in /proc//status. */ void verify_signal_states(); /** * Stashed-signal API: if a signal becomes pending at an * awkward time, but could be handled "soon", call * |stash_sig()| to stash the current pending-signal state. * * |has_stashed_sig()| obviously returns true if |stash_sig()| * has been called successfully. * * |pop_stash_sig()| restores the (relevant) state of this * Task to what was saved in |stash_sig()|, and returns the * saved siginfo. After this call, |has_stashed_sig()| is * false. * * NB: |get_siginfo()| will always return the "real" siginfo, * regardless of stash popped-ness state. Callers must ensure * they do the right thing with the popped siginfo. * * If the process unexpectedly died (due to SIGKILL), we don't * stash anything. */ void stash_sig(); void stash_synthetic_sig(const siginfo_t& si, SignalDeterministic deterministic); bool has_stashed_sig() const { return !stashed_signals.empty(); } bool has_stashed_sig(int sig) const; struct StashedSignal { StashedSignal(const siginfo_t& siginfo, SignalDeterministic deterministic) : siginfo(siginfo), deterministic(deterministic) {} siginfo_t siginfo; SignalDeterministic deterministic; }; const StashedSignal& peek_stash_sig(); void pop_stash_sig(); /** * Return true if the current state of this looks like the * interrupted syscall at the top of our event stack, if there * is one. */ bool is_syscall_restart(); /** * Return true iff this is at an execution state where * resuming execution may lead to the restart of an * interrupted syscall. * * For example, if a signal without a user handler is about to * be delivered to this just after a syscall interruption, * then delivering the signal may restart the first syscall * and this method will return true. */ bool at_may_restart_syscall() const; /** * Return true if this is at an arm-desched-event syscall. */ bool is_arm_desched_event_syscall(); /** * Return true if this is at a disarm-desched-event syscall. */ bool is_disarm_desched_event_syscall(); /** * Return true if |t| may not be immediately runnable, * i.e., resuming execution and then |waitpid()|'ing may block * for an unbounded amount of time. When the task is in this * state, the tracer must await a |waitpid()| notification * that the task is no longer possibly-blocked before resuming * its execution. */ bool may_be_blocked() const; /** * Returns true if it looks like this task has been spinning on an atomic * access/lock. */ bool maybe_in_spinlock(); /** * Return true if this is within the syscallbuf library. This * *does not* imply that $ip is at a buffered syscall; see * below. */ bool is_in_syscallbuf() { if (!as->syscallbuf_enabled()) { // Even if we're in the rr page, if syscallbuf isn't enabled then the // rr page is not being used by syscallbuf. return false; } remote_ptr p = ip().to_data_ptr(); return (as->syscallbuf_lib_start() <= p && p < as->syscallbuf_lib_end() && !as->monkeypatcher().is_syscallbuf_excluded_instruction(p)) || is_in_rr_page(); } /** * Shortcut to the most recent |pending_event->desched.rec| when * there's a desched event on the stack, and nullptr otherwise. * Exists just so that clients don't need to dig around in the * event stack to find this record. */ remote_ptr desched_rec() const; /** * Returns true when the task is in a signal handler in an interrupted * system call being handled by syscall buffering. */ bool running_inside_desched() const; uint16_t get_ptrace_eventmsg_seccomp_data(); /** * Save tracee data to the trace. |addr| is the address in * the address space of this task. The |record_local*()| * variants record data that's already been read from this, * and the |record_remote*()| variants read the data and then * record it. * If 'addr' is null then no record is written. */ void record_local(remote_ptr addr, ssize_t num_bytes, const void* buf); template void record_local(remote_ptr addr, const T* buf, size_t count = 1) { record_local(addr, sizeof(T) * count, buf); } void record_remote(remote_ptr addr, ssize_t num_bytes); template void record_remote(remote_ptr addr) { record_remote(addr, sizeof(T)); } void record_remote(const MemoryRange& range) { record_remote(range.start(), range.size()); } // Record as much as we can of the bytes in this range. void record_remote_fallible(remote_ptr addr, ssize_t num_bytes); // Simple helper that attempts to use the local mapping to record if one // exists bool record_remote_by_local_map(remote_ptr addr, size_t num_bytes); /** * Save tracee data to the trace. |addr| is the address in * the address space of this task. * If 'addr' is null then a zero-length record is written. */ void record_remote_even_if_null(remote_ptr addr, ssize_t num_bytes); template void record_remote_even_if_null(remote_ptr addr) { record_remote_even_if_null(addr, sizeof(T)); } /** * Manage pending events. |push_event()| pushes the given * event onto the top of the event stack. The |pop_*()| * helpers pop the event at top of the stack, which must be of * the specified type. */ void push_event(const Event& ev) { pending_events.push_back(ev); } void pop_event(EventType expected_type); void pop_noop() { pop_event(EV_NOOP); } void pop_desched() { pop_event(EV_DESCHED); } void pop_signal_delivery() { pop_event(EV_SIGNAL_DELIVERY); } void pop_signal_handler() { pop_event(EV_SIGNAL_HANDLER); } void pop_syscall() { pop_event(EV_SYSCALL); } void pop_syscall_interruption() { pop_event(EV_SYSCALL_INTERRUPTION); } virtual void log_pending_events() const; /** Return the event at the top of this's stack. */ Event& ev() { return pending_events.back(); } const Event& ev() const { return pending_events.back(); } /** * Call this before recording events or data. Records * syscallbuf data and flushes the buffer, if there's buffered * data. * * The timing of calls to this is tricky. We must flush the syscallbuf * before recording any data associated with events that happened after the * buffered syscalls. But we don't support flushing a syscallbuf twice with * no intervening reset, i.e. after flushing we have to be sure we'll get * a chance to reset the syscallbuf (i.e. record some other kind of event) * before the tracee runs again in a way that might append another buffered * syscall --- so we can't flush too early */ void maybe_flush_syscallbuf(); /** * Call this after recording an event when it might be safe to reset the * syscallbuf. It must be after recording an event to ensure during replay * we run past any syscallbuf after-syscall code that uses the buffer data. */ void maybe_reset_syscallbuf(); /** * Record an event on behalf of this. Record the registers of * this (and other relevant execution state) so that it can be * used or verified during replay, if that state is available * and meaningful at this's current execution point. * |record_current_event()| record |this->ev()|, and * |record_event()| records the specified event. */ void record_current_event(); enum FlushSyscallbuf { FLUSH_SYSCALLBUF, /* Pass this if it's safe to replay the event before we process the * syscallbuf records. */ DONT_FLUSH_SYSCALLBUF }; void record_event(const Event& ev, FlushSyscallbuf flush = FLUSH_SYSCALLBUF, const Registers* registers = nullptr); /** * Return the pid of the newborn thread created by this task. * Called when this task has a PTRACE_CLONE_EVENT with CLONE_THREAD. */ pid_t find_newborn_thread(); /** * Return the pid of the newborn process created by this task. * Called when this task has a PTRACE_CLONE_EVENT without CLONE_THREAD, * or PTRACE_FORK_EVENT. */ pid_t find_newborn_child_process(); /** * Do a tgkill to send a specific signal to this task. */ void tgkill(int sig); remote_ptr robust_list() const { return robust_futex_list; } size_t robust_list_len() const { return robust_futex_list_len; } /** Uses /proc so not trivially cheap. */ pid_t get_parent_pid(); /** * Return true if this is a "clone child" per the wait(2) man page. */ bool is_clone_child() { return termination_signal != SIGCHLD; } void set_termination_signal(int sig) { termination_signal = sig; } /** * When a signal triggers an emulated a ptrace-stop for this task, * save the siginfo so a later emulated ptrace-continue with this signal * number can use it. */ void save_ptrace_signal_siginfo(const siginfo_t& si); enum { SYNTHETIC_TIME_SLICE_SI_CODE = -9999 }; /** * Tasks normally can't change their tid. There is one very special situation * where they can: when a non-main-thread does an execve, its tid changes * to the tid of the thread-group leader. */ void set_tid_and_update_serial(pid_t tid); /** * Save or restore the current sigmask (reloading it if necessary) to handle * ppoll/pselect. If the sigmask is restored another way (e.g. because a * signal handler was invoked) clear_saved_sigmask must be called. */ void save_sigmask(); void restore_sigmask(); void restore_sigmask_if_saved(); void clear_saved_sigmask(); private: ~RecordTask(); /** * Wait for |futex| in this address space to have the value * |val|. * * WARNING: this implementation semi-busy-waits for the value * change. This must only be used in contexts where the futex * will change "soon". */ void futex_wait(remote_ptr futex, int val, bool* ok); /** * Called when this task is able to receive a SIGCHLD (e.g. because * we completed delivery of a signal). Sends a new synthetic * SIGCHLD to the task if there are still tasks that need a SIGCHLD * sent for them. * May queue signals for specific tasks. */ void send_synthetic_SIGCHLD_if_necessary(); /** * Reload, resp. write back the current mask of blocked signals to the shadow * copy in this tasks's preload globals such that we can effectively track, * changes made to the mask by buffered syscalls. */ sig_set_t get_sigmask(); void set_sigmask(sig_set_t mask); /** * Call this when SYS_sigaction is finishing with |regs|. */ void update_sigaction(const Registers& regs); /** * Call this when the tracee is about to complete a * SYS_rt_sigprocmask syscall with |regs|. */ void update_sigmask(const Registers& regs); /** * Update the futex robust list head pointer to |list| (which * is of size |len|). */ void set_robust_list(remote_ptr list, size_t len) { robust_futex_list = list; robust_futex_list_len = len; } template void init_buffers_arch(); template void on_syscall_exit_arch(int syscallno, const Registers& regs); /** Helper function for update_sigaction. */ template void update_sigaction_arch(const Registers& regs); /** Update the clear-tid futex to |tid_addr|. */ void set_tid_addr(remote_ptr tid_addr); public: // Scheduler state Registers registers_at_start_of_last_timeslice; TraceFrame::Time time_at_start_of_last_timeslice; /* Task 'nice' value set by setpriority(2). We use this to drive scheduling decisions. rr's scheduler is deliberately simple and unfair; a task never runs as long as there's another runnable task with a lower nice value. */ int priority; /* Tasks with in_round_robin_queue set are in the session's * in_round_robin_queue instead of its task_priority_set. */ bool in_round_robin_queue; // ptrace emulation state // Task for which we're emulating ptrace of this task, or null RecordTask* emulated_ptracer; std::set emulated_ptrace_tracees; uintptr_t emulated_ptrace_event_msg; // Saved emulated-ptrace signals std::vector saved_ptrace_siginfos; // Code to deliver to ptracer/waiter when it waits. Note that zero can be a // valid code! Reset to zero when leaving the stop due to PTRACE_CONT etc. WaitStatus emulated_stop_code; // Always zero while no ptracer is attached. int emulated_ptrace_options; // One of PTRACE_CONT, PTRACE_SYSCALL --- or 0 if the tracee has not been // continued by its ptracer yet, or has no ptracer. int emulated_ptrace_cont_command; // true when a ptracer/waiter wait() can return |emulated_stop_code|. bool emulated_stop_pending; // true if this task needs to send a SIGCHLD to its ptracer for its // emulated ptrace stop bool emulated_ptrace_SIGCHLD_pending; // true if this task needs to send a SIGCHLD to its parent for its // emulated stop bool emulated_SIGCHLD_pending; // tracer attached via PTRACE_SEIZE bool emulated_ptrace_seized; bool emulated_ptrace_queued_exit_stop; WaitType in_wait_type; pid_t in_wait_pid; // Signal handler state // Points to the signal-hander table of this task. If this // task is a non-fork clone child, then the table will be // shared with all its "thread" siblings. Any updates made to // that shared table are immediately visible to all sibling // threads. // // fork children always get their own copies of the table. // And if this task exec()s, the table is copied and stripped // of user sighandlers (see below). */ std::shared_ptr sighandlers; // The set of signals that were blocked during a sigsuspend. Only present // during the first EV_SIGNAL during an interrupted sigsuspend. std::unique_ptr sigsuspend_blocked_sigs; // If not NOT_STOPPED, then the task is logically stopped and this is the type // of stop. EmulatedStopType emulated_stop_type; // Most accesses to this should use set_sigmask and get_sigmask to ensure // the mirroring to syscallbuf is correct. sig_set_t blocked_sigs; sig_set_t previously_blocked_sigs; bool has_previously_blocked_sigs; int handling_deterministic_signal; // Syscallbuf state ScopedFd desched_fd; /* Value of hdr->num_rec_bytes when the buffer was flushed */ uint32_t flushed_num_rec_bytes; /* Nonzero after the trace recorder has flushed the * syscallbuf. When this happens, the recorder must prepare a * "reset" of the buffer, to zero the record count, at the * next available slow (taking |desched| into * consideration). */ bool flushed_syscallbuf; /* This bit is set when code wants to prevent the syscall * record buffer from being reset when it normally would be. * Currently, the desched'd syscall code uses this. */ bool delay_syscallbuf_reset; // Value to return from PR_GET_SECCOMP uint8_t prctl_seccomp_status; // Mirrored kernel state // This state agrees with kernel-internal values // Futex list passed to |set_robust_list()|. We could keep a // strong type for this list head and read it if we wanted to, // but for now we only need to remember its address / size at // the time of the most recent set_robust_list() call. remote_ptr robust_futex_list; size_t robust_futex_list_len; // The memory cell the kernel will clear and notify on exit, // if our clone parent requested it. remote_ptr tid_futex; /* This is the recorded tid of the tracee *in its own pid namespace*. */ pid_t own_namespace_rec_tid; int exit_code; // Signal delivered by the kernel when this task terminates, or zero int termination_signal; // Our value for PR_GET/SET_TSC (one of PR_TSC_ENABLED, PR_TSC_SIGSEGV). int tsc_mode; // The current stack of events being processed. (We use a // deque instead of a stack because we need to iterate the // events.) std::deque pending_events; // Stashed signal-delivery state, ready to be delivered at // next opportunity. std::deque stashed_signals; }; } // namespace rr #endif /* RR_RECORD_TASK_H_ */ rr-4.4.0/src/Registers.cc000066400000000000000000000577221277367620400152420ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Registers.h" #include #include #include #include #include #include "ReplayTask.h" #include "log.h" using namespace std; namespace rr { struct RegisterValue { // The name of this register. const char* name; // The offsetof the register in user_regs_struct. size_t offset; // The size of the register. 0 means we cannot read it. size_t nbytes; // Mask to be applied to register values prior to comparing them. Will // typically be ((1 << nbytes) - 1), but some registers may have special // comparison semantics. uint64_t comparison_mask; constexpr RegisterValue() : name(nullptr), offset(0), nbytes(0), comparison_mask(0) {} RegisterValue(const char* name_, size_t offset_, size_t nbytes_) : name(name_), offset(offset_), nbytes(nbytes_) { comparison_mask = mask_for_nbytes(nbytes_); } RegisterValue(const char* name_, size_t offset_, size_t nbytes_, uint64_t comparison_mask_) : name(name_), offset(offset_), nbytes(nbytes_), comparison_mask(comparison_mask_) { // Ensure no bits are set outside of the register's bitwidth. assert((comparison_mask_ & ~mask_for_nbytes(nbytes_)) == 0); } // Returns a pointer to the register in |regs| represented by |offset|. // |regs| is assumed to be a pointer to the user_struct_regs for the // appropriate architecture. void* pointer_into(void* regs) { return static_cast(regs) + offset; } const void* pointer_into(const void* regs) { return static_cast(regs) + offset; } static uint64_t mask_for_nbytes(size_t nbytes) { assert(nbytes <= sizeof(comparison_mask)); return ((nbytes == sizeof(comparison_mask)) ? uint64_t(0) : (uint64_t(1) << nbytes * 8)) - 1; } }; typedef std::pair RegisterInit; template struct RegisterTable : std::array { RegisterTable(std::initializer_list list) { for (auto& ri : list) { (*this)[ri.first] = ri.second; } } }; template struct RegisterInfo; template <> struct RegisterInfo { static bool ignore_undefined_register(GdbRegister regno) { return regno == DREG_FOSEG || regno == DREG_MXCSR; } static const size_t num_registers = DREG_NUM_LINUX_I386; typedef RegisterTable Table; static Table registers; static RegisterValue non_gdb_registers[0]; }; template <> struct RegisterInfo { static bool ignore_undefined_register(GdbRegister regno) { return regno == DREG_64_FOSEG || regno == DREG_64_MXCSR; } static const size_t num_registers = DREG_NUM_LINUX_X86_64; typedef RegisterTable Table; static Table registers; static RegisterValue non_gdb_registers[2]; }; #define RV_ARCH(gdb_suffix, name, arch, extra_ctor_args) \ RegisterInit(DREG_##gdb_suffix, \ RegisterValue(#name, offsetof(arch::user_regs_struct, name), \ sizeof(((arch::user_regs_struct*)0)->name) \ extra_ctor_args)) #define RV_X86(gdb_suffix, name) \ RV_ARCH(gdb_suffix, name, rr::X86Arch, /* empty */) #define RV_X64(gdb_suffix, name) \ RV_ARCH(gdb_suffix, name, rr::X64Arch, /* empty */) #define COMMA , #define RV_X86_WITH_MASK(gdb_suffix, name, comparison_mask) \ RV_ARCH(gdb_suffix, name, rr::X86Arch, COMMA comparison_mask) #define RV_X64_WITH_MASK(gdb_suffix, name, comparison_mask) \ RV_ARCH(gdb_suffix, name, rr::X64Arch, COMMA comparison_mask) const uint64_t deterministic_eflags_mask = ~uint32_t( /* The following are eflags that have been observed to be non-deterministic in practice. We need to mask them off when comparing registers to prevent replay from diverging. */ /* The linux kernel has been observed to report this as zero in some states during system calls. It always seems to be 1 during user-space execution so we should be able to ignore it. */ X86_RESERVED_FLAG | /* This is usually set but we have observed cases where it's clear. It * shouldn't be modifiable by user space so we don't know why it would * change. */ X86_IF_FLAG | /* According to http://www.logix.cz/michal/doc/i386/chp04-01.htm: The RF flag temporarily disables debug exceptions so that an instruction can be restarted after a debug exception without immediately causing another debug exception. Refer to Chapter 12 for details. Chapter 12 isn't particularly clear on the point, but the flag appears to be set by |int3| exceptions. This divergence has been observed when continuing a tracee to an execution target by setting an |int3| breakpoint, which isn't used during recording. No single-stepping was used during the recording either. */ X86_RF_FLAG | /* It is no longer known why this bit is ignored. */ X86_ID_FLAG); RegisterInfo::Table RegisterInfo::registers = { RV_X86(EAX, eax), RV_X86(ECX, ecx), RV_X86(EDX, edx), RV_X86(EBX, ebx), RV_X86(ESP, esp), RV_X86(EBP, ebp), RV_X86(ESI, esi), RV_X86(EDI, edi), RV_X86(EIP, eip), RV_X86_WITH_MASK(EFLAGS, eflags, deterministic_eflags_mask), RV_X86_WITH_MASK(CS, xcs, 0), RV_X86_WITH_MASK(SS, xss, 0), RV_X86_WITH_MASK(DS, xds, 0), RV_X86_WITH_MASK(ES, xes, 0), RV_X86(FS, xfs), RV_X86(GS, xgs), // The comparison for this is handled specially elsewhere. RV_X86_WITH_MASK(ORIG_EAX, orig_eax, 0), }; RegisterValue RegisterInfo::non_gdb_registers[0] = {}; RegisterInfo::Table RegisterInfo::registers = { RV_X64(RAX, rax), RV_X64(RCX, rcx), RV_X64(RDX, rdx), RV_X64(RBX, rbx), RV_X64_WITH_MASK(RSP, rsp, 0), RV_X64(RBP, rbp), RV_X64(RSI, rsi), RV_X64(RDI, rdi), RV_X64(R8, r8), RV_X64(R9, r9), RV_X64(R10, r10), RV_X64(R11, r11), RV_X64(R12, r12), RV_X64(R13, r13), RV_X64(R14, r14), RV_X64(R15, r15), RV_X64(RIP, rip), RV_X64_WITH_MASK(64_EFLAGS, eflags, deterministic_eflags_mask), RV_X64_WITH_MASK(64_CS, cs, 0), RV_X64_WITH_MASK(64_SS, ss, 0), RV_X64_WITH_MASK(64_DS, ds, 0), RV_X64_WITH_MASK(64_ES, es, 0), RV_X64(64_FS, fs), RV_X64(64_GS, gs), // The comparison for this is handled specially // elsewhere. RV_X64_WITH_MASK(ORIG_RAX, orig_rax, 0), }; RegisterValue RegisterInfo::non_gdb_registers[2] = { { "fs_base", offsetof(rr::X64Arch::user_regs_struct, fs_base), 8, RegisterValue::mask_for_nbytes(8) }, { "gs_base", offsetof(rr::X64Arch::user_regs_struct, gs_base), 8, RegisterValue::mask_for_nbytes(8) } }; #undef RV_X64 #undef RV_X86 #undef RV_ARCH // 32-bit format, 64-bit format for all of these. // format_index in RegisterPrinting depends on the ordering here. static const char* hex_format_leading_0x[] = { "0x%" PRIx32, "0x%" PRIx64 }; // static const char* decimal_format[] = { "%" PRId32, "%" PRId64 }; template struct RegisterPrinting; template <> struct RegisterPrinting<4> { typedef uint32_t type; static const size_t format_index = 0; }; template <> struct RegisterPrinting<8> { typedef uint64_t type; static const size_t format_index = 1; }; template void print_single_register(FILE* f, const char* name, const void* register_ptr, const char* formats[]) { typename RegisterPrinting::type val; memcpy(&val, register_ptr, nbytes); if (name) { fprintf(f, "%s:", name); } else { fprintf(f, " "); } fprintf(f, formats[RegisterPrinting::format_index], val); } template void Registers::print_register_file_arch(FILE* f, const char* formats[]) const { fprintf(f, "Printing register file:\n"); const void* user_regs = &u; for (auto& rv : RegisterInfo::registers) { if (rv.nbytes == 0) { continue; } switch (rv.nbytes) { case 8: print_single_register<8>(f, rv.name, rv.pointer_into(user_regs), formats); break; case 4: print_single_register<4>(f, rv.name, rv.pointer_into(user_regs), formats); break; default: assert(0 && "bad register size"); } fprintf(f, "\n"); } fprintf(f, "\n"); } void Registers::print_register_file(FILE* f) const { RR_ARCH_FUNCTION(print_register_file_arch, arch(), f, hex_format_leading_0x); } template void Registers::print_register_file_for_trace_arch( FILE* f, TraceStyle style, const char* formats[]) const { const void* user_regs = &u; for (auto& rv : RegisterInfo::registers) { if (rv.nbytes == 0) { continue; } fprintf(f, " "); const char* name = (style == Annotated ? rv.name : nullptr); switch (rv.nbytes) { case 8: print_single_register<8>(f, name, rv.pointer_into(user_regs), formats); break; case 4: print_single_register<4>(f, name, rv.pointer_into(user_regs), formats); break; default: assert(0 && "bad register size"); } } for (auto& rv : RegisterInfo::non_gdb_registers) { fprintf(f, " "); const char* name = (style == Annotated ? rv.name : nullptr); switch (rv.nbytes) { case 8: print_single_register<8>(f, name, rv.pointer_into(user_regs), formats); break; case 4: print_single_register<4>(f, name, rv.pointer_into(user_regs), formats); break; default: assert(0 && "bad register size"); } } } void Registers::print_register_file_compact(FILE* f) const { RR_ARCH_FUNCTION(print_register_file_for_trace_arch, arch(), f, Annotated, hex_format_leading_0x); } void Registers::print_register_file_for_trace_raw(FILE* f) const { fprintf(f, " %d %d %d %d %d %d %d" " %d %d %d %d", u.x86regs.eax, u.x86regs.ebx, u.x86regs.ecx, u.x86regs.edx, u.x86regs.esi, u.x86regs.edi, u.x86regs.ebp, u.x86regs.orig_eax, u.x86regs.esp, u.x86regs.eip, u.x86regs.eflags); } static void maybe_print_reg_mismatch(MismatchBehavior mismatch_behavior, const char* regname, const char* label1, uint64_t val1, const char* label2, uint64_t val2) { if (mismatch_behavior >= BAIL_ON_MISMATCH) { LOG(error) << regname << " " << HEX(val1) << " != " << HEX(val2) << " (" << label1 << " vs. " << label2 << ")"; } else if (mismatch_behavior >= LOG_MISMATCHES) { LOG(info) << regname << " " << HEX(val1) << " != " << HEX(val2) << " (" << label1 << " vs. " << label2 << ")"; } } template bool Registers::compare_registers_core(const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior) { bool match = true; for (auto& rv : RegisterInfo::registers) { if (rv.nbytes == 0) { continue; } // Disregard registers that will trivially compare equal. if (rv.comparison_mask == 0) { continue; } // XXX correct but oddly displayed for big-endian processors. uint64_t val1 = 0, val2 = 0; memcpy(&val1, rv.pointer_into(®1.u), rv.nbytes); memcpy(&val2, rv.pointer_into(®2.u), rv.nbytes); if ((val1 ^ val2) & rv.comparison_mask) { maybe_print_reg_mismatch(mismatch_behavior, rv.name, name1, val1, name2, val2); match = false; } } return match; } // A handy macro for compare_registers_arch specializations. #define REGCMP(user_regs, _reg) \ do { \ if (reg1.user_regs._reg != reg2.user_regs._reg) { \ maybe_print_reg_mismatch(mismatch_behavior, #_reg, name1, \ reg1.user_regs._reg, name2, \ reg2.user_regs._reg); \ match = false; \ } \ } while (0) #define X86_REGCMP(_reg) REGCMP(u.x86regs, _reg) #define X64_REGCMP(_reg) REGCMP(u.x64regs, _reg) // A wrapper around compare_registers_core so registers requiring special // processing can be handled via template specialization. template /* static */ bool Registers::compare_registers_arch( const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior) { // Default behavior. return compare_registers_core(name1, reg1, name2, reg2, mismatch_behavior); } template <> /* static */ bool Registers::compare_registers_arch( const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior) { bool match = compare_registers_core(name1, reg1, name2, reg2, mismatch_behavior); /* Negative orig_eax values, observed at SCHED events and signals, seemingly can vary between recording and replay on some kernels (e.g. Linux ubuntu 3.13.0-24-generic). They probably reflect signals sent or something like that. */ if (reg1.u.x86regs.orig_eax >= 0 || reg2.u.x86regs.orig_eax >= 0) { X86_REGCMP(orig_eax); } return match; } template <> /* static */ bool Registers::compare_registers_arch( const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior) { bool match = compare_registers_core(name1, reg1, name2, reg2, mismatch_behavior); // XXX haven't actually observed this to be true on x86-64 yet, but // assuming that it follows the x86 behavior. if ((intptr_t)reg1.u.x64regs.orig_rax >= 0 || (intptr_t)reg2.u.x64regs.orig_rax >= 0) { X64_REGCMP(orig_rax); } // Check the _upper bits of various registers we defined more conveniently // for our gdb support. X64_REGCMP(cs_upper); X64_REGCMP(ds_upper); X64_REGCMP(es_upper); X64_REGCMP(fs_upper); X64_REGCMP(gs_upper); X64_REGCMP(ss_upper); X64_REGCMP(eflags_upper); return match; } /*static*/ bool Registers::compare_register_files_internal( const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior) { assert(reg1.arch() == reg2.arch()); RR_ARCH_FUNCTION(compare_registers_arch, reg1.arch(), name1, reg1, name2, reg2, mismatch_behavior); } /*static*/ bool Registers::compare_register_files( ReplayTask* t, const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior) { bool bail_error = mismatch_behavior >= BAIL_ON_MISMATCH; bool match = compare_register_files_internal(name1, reg1, name2, reg2, mismatch_behavior); if (t) { ASSERT(t, !bail_error || match) << "Fatal register mismatch (ticks/rec:" << t->tick_count() << "/" << t->current_trace_frame().ticks() << ")"; } else { assert(!bail_error || match); } if (match && mismatch_behavior == LOG_MISMATCHES) { LOG(info) << "(register files are the same for " << name1 << " and " << name2 << ")"; } return match; } template size_t Registers::read_register_arch(uint8_t* buf, GdbRegister regno, bool* defined) const { if (regno >= array_length(RegisterInfo::registers)) { *defined = false; return 0; } RegisterValue& rv = RegisterInfo::registers[regno]; if (rv.nbytes == 0) { *defined = false; } else { *defined = true; memcpy(buf, rv.pointer_into(&u), rv.nbytes); } return rv.nbytes; } size_t Registers::read_register(uint8_t* buf, GdbRegister regno, bool* defined) const { RR_ARCH_FUNCTION(read_register_arch, arch(), buf, regno, defined); } template size_t Registers::read_register_by_user_offset_arch(uint8_t* buf, uintptr_t offset, bool* defined) const { for (size_t regno = 0; regno < RegisterInfo::num_registers; ++regno) { RegisterValue& rv = RegisterInfo::registers[regno]; if (rv.offset == offset) { return read_register_arch(buf, GdbRegister(regno), defined); } } *defined = false; return 0; } size_t Registers::read_register_by_user_offset(uint8_t* buf, uintptr_t offset, bool* defined) const { RR_ARCH_FUNCTION(read_register_by_user_offset_arch, arch(), buf, offset, defined); } template void Registers::write_register_arch(GdbRegister regno, const void* value, size_t value_size) { RegisterValue& rv = RegisterInfo::registers[regno]; if (rv.nbytes == 0) { // TODO: can we get away with not writing these? if (RegisterInfo::ignore_undefined_register(regno)) { return; } LOG(warn) << "Unhandled register name " << regno; } else { assert(value_size == rv.nbytes); memcpy(rv.pointer_into(&u), value, value_size); } } void Registers::write_register(GdbRegister regno, const void* value, size_t value_size) { RR_ARCH_FUNCTION(write_register_arch, arch(), regno, value, value_size); } template void Registers::write_register_by_user_offset_arch(uintptr_t offset, uintptr_t value) { for (size_t regno = 0; regno < RegisterInfo::num_registers; ++regno) { RegisterValue& rv = RegisterInfo::registers[regno]; if (rv.offset == offset) { assert(rv.nbytes <= sizeof(value)); memcpy(rv.pointer_into(&u), &value, rv.nbytes); return; } } } void Registers::write_register_by_user_offset(uintptr_t offset, uintptr_t value) { RR_ARCH_FUNCTION(write_register_by_user_offset_arch, arch(), offset, value); } // In theory it doesn't matter how 32-bit register values are sign extended // to 64 bits for PTRACE_SETREGS. However: // -- When setting up a signal handler frame, the kernel does some arithmetic // on the 64-bit SP value and validates that the result points to writeable // memory. This validation fails if SP has been sign-extended to point // outside the 32-bit address space. // -- Some kernels (e.g. 4.3.3-301.fc23.x86_64) with commmit // c5c46f59e4e7c1ab244b8d38f2b61d317df90bba have a bug where if you clear // the upper 32 bits of %rax while in the kernel, syscalls may fail to // restart. So sign-extension is necessary for %eax in this case. We may as // well sign-extend %eax in all cases. typedef void (*NarrowConversion)(int32_t& r32, uint64_t& r64); typedef void (*SameConversion)(int32_t& r32, uint32_t& r64); template void convert_x86(X86Arch::user_regs_struct& x86, X64Arch::user_regs_struct& x64) { narrow_signed(x86.eax, x64.rax); narrow(x86.ebx, x64.rbx); narrow(x86.ecx, x64.rcx); narrow(x86.edx, x64.rdx); narrow(x86.esi, x64.rsi); narrow(x86.edi, x64.rdi); narrow(x86.esp, x64.rsp); narrow(x86.ebp, x64.rbp); narrow(x86.eip, x64.rip); narrow(x86.orig_eax, x64.orig_rax); same(x86.eflags, x64.eflags); same(x86.xcs, x64.cs); same(x86.xds, x64.ds); same(x86.xes, x64.es); same(x86.xfs, x64.fs); same(x86.xgs, x64.gs); same(x86.xss, x64.ss); } void to_x86_narrow(int32_t& r32, uint64_t& r64) { r32 = r64; } void to_x86_same(int32_t& r32, uint32_t& r64) { r32 = r64; } void from_x86_narrow(int32_t& r32, uint64_t& r64) { r64 = (uint32_t)r32; } void from_x86_narrow_signed(int32_t& r32, uint64_t& r64) { r64 = (int64_t)r32; } void from_x86_same(int32_t& r32, uint32_t& r64) { r64 = r32; } void Registers::set_from_ptrace(const struct user_regs_struct& ptrace_regs) { if (arch() == NativeArch::arch()) { memcpy(&u, &ptrace_regs, sizeof(ptrace_regs)); return; } assert(arch() == x86 && NativeArch::arch() == x86_64); convert_x86( u.x86regs, *reinterpret_cast( const_cast(&ptrace_regs))); } /** * Get a user_regs_struct from these Registers. If the tracee architecture * is not rr's native architecture, then it must be a 32-bit tracee with a * 64-bit rr. In that case the user_regs_struct is 64-bit and we copy * the 32-bit register values from u.x86regs into it. */ struct user_regs_struct Registers::get_ptrace() const { union { struct user_regs_struct linux_api; struct X64Arch::user_regs_struct x64arch_api; } result; if (arch() == NativeArch::arch()) { memcpy(&result, &u, sizeof(result)); return result.linux_api; } assert(arch() == x86 && NativeArch::arch() == x86_64); memset(&result, 0, sizeof(result)); convert_x86( const_cast(this)->u.x86regs, result.x64arch_api); return result.linux_api; } vector Registers::get_ptrace_for_arch(SupportedArch arch) const { Registers tmp_regs(arch); tmp_regs.set_from_ptrace(get_ptrace()); vector result; switch (arch) { case x86: result.resize(sizeof(tmp_regs.u.x86regs)); memcpy(result.data(), &tmp_regs.u.x86regs, result.size()); break; case x86_64: result.resize(sizeof(tmp_regs.u.x64regs)); memcpy(result.data(), &tmp_regs.u.x64regs, result.size()); break; default: assert(0 && "Unknown arch"); break; } return result; } void Registers::set_from_ptrace_for_arch(SupportedArch a, const void* data, size_t size) { if (a == NativeArch::arch()) { assert(size == sizeof(struct user_regs_struct)); set_from_ptrace(*static_cast(data)); return; } assert(a == x86 && NativeArch::arch() == x86_64); // We don't support a 32-bit tracee trying to set registers of a 64-bit tracee assert(arch() == x86); assert(size == sizeof(u.x86regs)); memcpy(&u.x86regs, data, sizeof(u.x86regs)); } uintptr_t Registers::flags() const { switch (arch()) { case x86: return u.x86regs.eflags; case x86_64: return u.x64regs.eflags | (uint64_t(u.x64regs.eflags_upper) << 32); default: assert(0 && "Unknown arch"); return false; } } void Registers::set_flags(uintptr_t value) { switch (arch()) { case x86: u.x86regs.eflags = value; break; case x86_64: u.x64regs.eflags = value; u.x64regs.eflags_upper = uint64_t(value) >> 32; break; default: assert(0 && "Unknown arch"); break; } } bool Registers::syscall_failed() const { auto result = syscall_result_signed(); return -4096 < result && result < 0; } bool Registers::syscall_may_restart() const { switch (-syscall_result_signed()) { case ERESTART_RESTARTBLOCK: case ERESTARTNOINTR: case ERESTARTNOHAND: case ERESTARTSYS: return true; default: return false; } } ostream& operator<<(ostream& stream, const Registers& r) { stream << "{ args:(" << HEX(r.arg1()) << "," << HEX(r.arg2()) << "," << HEX(r.arg3()) << "," << HEX(r.arg4()) << "," << HEX(r.arg5()) << "," << r.arg6() << ") orig_syscall:" << r.original_syscallno() << " }"; return stream; } } // namespace rr rr-4.4.0/src/Registers.h000066400000000000000000000360771277367620400151040ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REGISTERS_H_ #define RR_REGISTERS_H_ #include #include #include #include #include #include #include #include "GdbRegister.h" #include "kernel_abi.h" #include "kernel_supplement.h" #include "remote_code_ptr.h" #include "remote_ptr.h" namespace rr { class ReplayTask; enum MismatchBehavior { EXPECT_MISMATCHES = 0, LOG_MISMATCHES, BAIL_ON_MISMATCH }; const uintptr_t X86_RESERVED_FLAG = 1 << 1; const uintptr_t X86_TF_FLAG = 1 << 8; const uintptr_t X86_IF_FLAG = 1 << 9; const uintptr_t X86_DF_FLAG = 1 << 10; const uintptr_t X86_RF_FLAG = 1 << 16; const uintptr_t X86_ID_FLAG = 1 << 21; /** * A Registers object contains values for all general-purpose registers. * These must include all registers used to pass syscall parameters and return * syscall results. * * When reading register values, be sure to cast the result to the correct * type according to the kernel docs. E.g. int values should be cast * to int explicitly (or implicitly, by assigning to an int-typed variable), * size_t should be cast to size_t, etc. If the type is signed, call the * _signed getter. This ensures that when building rr 64-bit we will use the * right number of register bits whether the tracee is 32-bit or 64-bit, and * get sign-extension right. * * We have different register sets for different architectures. To ensure a * trace can be dumped/processed by an rr build on any platform, we allow * Registers to contain registers for any architecture. So we store them * in a union of Arch::user_regs_structs for each known Arch. */ class Registers { public: enum { MAX_SIZE = 16 }; Registers(SupportedArch a = SupportedArch(-1)) : arch_(a) { memset(&u, 0, sizeof(u)); } SupportedArch arch() const { return arch_; } void set_arch(SupportedArch a) { arch_ = a; } /** * Copy a user_regs_struct into these Registers. If the tracee architecture * is not rr's native architecture, then it must be a 32-bit tracee with a * 64-bit rr. In that case the user_regs_struct is 64-bit and we extract * the 32-bit register values from it into u.x86regs. * It's invalid to call this when the Registers' arch is 64-bit and the * rr build is 32-bit, or when the Registers' arch is completely different * to the rr build (e.g. ARM vs x86). */ void set_from_ptrace(const struct ::user_regs_struct& ptrace_regs); /** * Get a user_regs_struct from these Registers. If the tracee architecture * is not rr's native architecture, then it must be a 32-bit tracee with a * 64-bit rr. In that case the user_regs_struct is 64-bit and we copy * the 32-bit register values from u.x86regs into it. * It's invalid to call this when the Registers' arch is 64-bit and the * rr build is 32-bit, or when the Registers' arch is completely different * to the rr build (e.g. ARM vs x86). */ struct ::user_regs_struct get_ptrace() const; /** * Get a user_regs_struct for a particular Arch from these Registers. * It's invalid to call this when 'arch' is 64-bit and the * rr build is 32-bit, or when the Registers' arch is completely different * to the rr build (e.g. ARM vs x86). */ std::vector get_ptrace_for_arch(SupportedArch arch) const; /** * Copy an arch-specific user_regs_struct into these Registers. * It's invalid to call this when 'arch' is 64-bit and the * rr build is 32-bit, or when the Registers' arch is completely different * to the rr build (e.g. ARM vs x86). */ void set_from_ptrace_for_arch(SupportedArch arch, const void* data, size_t size); #define RR_GET_REG(x86case, x64case) \ (arch() == x86 ? (uint32_t)u.x86regs.x86case \ : arch() == x86_64 \ ? u.x64regs.x64case \ : (assert(0 && "unknown architecture"), uintptr_t(-1))) #define RR_GET_REG_SIGNED(x86case, x64case) \ (arch() == x86 ? u.x86regs.x86case \ : arch() == x86_64 \ ? u.x64regs.x64case \ : (assert(0 && "unknown architecture"), uintptr_t(-1))) #define RR_SET_REG(x86case, x64case, value) \ switch (arch()) { \ case x86: \ u.x86regs.x86case = (value); \ break; \ case x86_64: \ u.x64regs.x64case = (value); \ break; \ default: \ assert(0 && "unknown architecture"); \ } remote_code_ptr ip() const { return RR_GET_REG(eip, rip); } void set_ip(remote_code_ptr addr) { RR_SET_REG(eip, rip, addr.register_value()); } remote_ptr sp() const { return RR_GET_REG(esp, rsp); } void set_sp(remote_ptr addr) { RR_SET_REG(esp, rsp, addr.as_int()); } // Access the registers holding system-call numbers, results, and // parameters. intptr_t syscallno() const { return RR_GET_REG(eax, rax); } void set_syscallno(intptr_t syscallno) { RR_SET_REG(eax, rax, syscallno); } uintptr_t syscall_result() const { return RR_GET_REG(eax, rax); } intptr_t syscall_result_signed() const { return RR_GET_REG_SIGNED(eax, rax); } void set_syscall_result(uintptr_t syscall_result) { RR_SET_REG(eax, rax, syscall_result); } template void set_syscall_result(remote_ptr syscall_result) { RR_SET_REG(eax, rax, syscall_result.as_int()); } /** * Returns true if syscall_result() indicates failure. */ bool syscall_failed() const; /** * Returns true if syscall_result() indicates a syscall restart. */ bool syscall_may_restart() const; /** * This pseudo-register holds the system-call number when we get ptrace * enter-system-call and exit-system-call events. Setting it changes * the system-call executed when resuming after an enter-system-call * event. */ intptr_t original_syscallno() const { return RR_GET_REG_SIGNED(orig_eax, orig_rax); } void set_original_syscallno(intptr_t syscallno) { RR_SET_REG(orig_eax, orig_rax, syscallno); } uintptr_t arg1() const { return RR_GET_REG(ebx, rdi); } intptr_t arg1_signed() const { return RR_GET_REG_SIGNED(ebx, rdi); } void set_arg1(uintptr_t value) { RR_SET_REG(ebx, rdi, value); } template void set_arg1(remote_ptr value) { RR_SET_REG(ebx, rdi, value.as_int()); } uintptr_t arg2() const { return RR_GET_REG(ecx, rsi); } intptr_t arg2_signed() const { return RR_GET_REG_SIGNED(ecx, rsi); } void set_arg2(uintptr_t value) { RR_SET_REG(ecx, rsi, value); } template void set_arg2(remote_ptr value) { RR_SET_REG(ecx, rsi, value.as_int()); } uintptr_t arg3() const { return RR_GET_REG(edx, rdx); } intptr_t arg3_signed() const { return RR_GET_REG_SIGNED(edx, rdx); } void set_arg3(uintptr_t value) { RR_SET_REG(edx, rdx, value); } template void set_arg3(remote_ptr value) { RR_SET_REG(edx, rdx, value.as_int()); } uintptr_t arg4() const { return RR_GET_REG(esi, r10); } intptr_t arg4_signed() const { return RR_GET_REG_SIGNED(esi, r10); } void set_arg4(uintptr_t value) { RR_SET_REG(esi, r10, value); } template void set_arg4(remote_ptr value) { RR_SET_REG(esi, r10, value.as_int()); } uintptr_t arg5() const { return RR_GET_REG(edi, r8); } intptr_t arg5_signed() const { return RR_GET_REG_SIGNED(edi, r8); } void set_arg5(uintptr_t value) { RR_SET_REG(edi, r8, value); } template void set_arg5(remote_ptr value) { RR_SET_REG(edi, r8, value.as_int()); } uintptr_t arg6() const { return RR_GET_REG(ebp, r9); } intptr_t arg6_signed() const { return RR_GET_REG_SIGNED(ebp, r9); } void set_arg6(uintptr_t value) { RR_SET_REG(ebp, r9, value); } template void set_arg6(remote_ptr value) { RR_SET_REG(ebp, r9, value.as_int()); } uintptr_t arg(int index) const { switch (index) { case 1: return arg1(); case 2: return arg2(); case 3: return arg3(); case 4: return arg4(); case 5: return arg5(); case 6: return arg6(); default: assert(0 && "Argument index out of range"); return 0; } } /** * Set the register containing syscall argument |Index| to * |value|. */ template void set_arg(std::nullptr_t) { set_arg(Index, 0); } template void set_arg(remote_ptr value) { set_arg(Index, value.as_int()); } template void set_arg(T value) { set_arg(Index, uintptr_t(value)); } void set_arg(int index, uintptr_t value) { switch (index) { case 1: return set_arg1(value); case 2: return set_arg2(value); case 3: return set_arg3(value); case 4: return set_arg4(value); case 5: return set_arg5(value); case 6: return set_arg6(value); default: assert(0 && "Argument index out of range"); } } // Some X86-specific stuff follows. Use of these accessors should be guarded // by an architecture test. /** * Set the output registers of the |rdtsc| instruction. */ void set_rdtsc_output(uint64_t value) { RR_SET_REG(eax, rax, value & 0xffffffff); RR_SET_REG(edx, rdx, value >> 32); } void set_r11(uintptr_t value) { assert(arch() == x86_64); u.x64regs.r11 = value; } uintptr_t di() const { return RR_GET_REG(edi, rdi); } void set_di(uintptr_t value) { RR_SET_REG(edi, rdi, value); } uintptr_t si() const { return RR_GET_REG(esi, rsi); } void set_si(uintptr_t value) { RR_SET_REG(esi, rsi, value); } uintptr_t cx() const { return RR_GET_REG(ecx, rcx); } void set_cx(uintptr_t value) { RR_SET_REG(ecx, rcx, value); } uintptr_t bp() const { return RR_GET_REG(ebp, rbp); } uintptr_t flags() const; void set_flags(uintptr_t value); bool singlestep_flag() { return flags() & X86_TF_FLAG; } void clear_singlestep_flag() { set_flags(flags() & ~X86_TF_FLAG); } bool df_flag() const { return flags() & X86_DF_FLAG; } uintptr_t fs_base() const { assert(arch() == x86_64); return u.x64regs.fs_base; } uintptr_t gs_base() const { assert(arch() == x86_64); return u.x64regs.gs_base; } // End of X86-specific stuff void print_register_file(FILE* f) const; void print_register_file_compact(FILE* f) const; void print_register_file_for_trace_raw(FILE* f) const; /** * Return true if |reg1| matches |reg2|. Passing EXPECT_MISMATCHES * indicates that the caller is using this as a general register * compare and nothing special should be done if the register files * mismatch. Passing LOG_MISMATCHES will log the registers that don't * match. Passing BAIL_ON_MISMATCH will additionally abort on * mismatch. */ static bool compare_register_files(ReplayTask* t, const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior); bool matches(const Registers& other) const { return compare_register_files(nullptr, nullptr, *this, nullptr, other, EXPECT_MISMATCHES); } // TODO: refactor me to use the GdbRegisterValue helper from // GdbConnection.h. /** * Write the value for register |regno| into |buf|, which should * be large enough to hold any register supported by the target. * Return the size of the register in bytes and set |defined| to * indicate whether a useful value has been written to |buf|. */ size_t read_register(uint8_t* buf, GdbRegister regno, bool* defined) const; /** * Write the value for register |offset| into |buf|, which should * be large enough to hold any register supported by the target. * Return the size of the register in bytes and set |defined| to * indicate whether a useful value has been written to |buf|. * |offset| is the offset of the register within a user_regs_struct. */ size_t read_register_by_user_offset(uint8_t* buf, uintptr_t offset, bool* defined) const; /** * Update the register named |reg_name| to |value| with * |value_size| number of bytes. */ void write_register(GdbRegister reg_name, const void* value, size_t value_size); /** * Update the register at user offset |offset| to |value|, taking the low * bytes if necessary. */ void write_register_by_user_offset(uintptr_t offset, uintptr_t value); private: template void print_register_file_arch(FILE* f, const char* formats[]) const; enum TraceStyle { Annotated, Raw, }; template void print_register_file_for_trace_arch(FILE* f, TraceStyle style, const char* formats[]) const; template static bool compare_registers_core(const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior); template static bool compare_registers_arch(const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior); static bool compare_register_files_internal( const char* name1, const Registers& reg1, const char* name2, const Registers& reg2, MismatchBehavior mismatch_behavior); template size_t read_register_arch(uint8_t* buf, GdbRegister regno, bool* defined) const; template size_t read_register_by_user_offset_arch(uint8_t* buf, uintptr_t offset, bool* defined) const; template void write_register_arch(GdbRegister regno, const void* value, size_t value_size); template void write_register_by_user_offset_arch(uintptr_t offset, uintptr_t value); template size_t total_registers_arch() const; SupportedArch arch_; union { rr::X86Arch::user_regs_struct x86regs; rr::X64Arch::user_regs_struct x64regs; } u; }; std::ostream& operator<<(std::ostream& stream, const Registers& r); } // namespace rr #endif /* RR_REGISTERS_H_ */ rr-4.4.0/src/ReplayCommand.cc000066400000000000000000000375001277367620400160160ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include #include #include #include #include #include "Command.h" #include "Flags.h" #include "GdbServer.h" #include "ReplaySession.h" #include "ScopedFd.h" #include "kernel_metadata.h" #include "log.h" #include "main.h" using namespace std; namespace rr { static int DUMP_STATS_PERIOD = 0; class ReplayCommand : public Command { public: virtual int run(vector& args); protected: ReplayCommand(const char* name, const char* help) : Command(name, help) {} static ReplayCommand singleton; }; ReplayCommand ReplayCommand::singleton( "replay", " rr replay [OPTION]... []\n" " -a, --autopilot replay without debugger server\n" " -f, --onfork= start a debug server when has been\n" " fork()d, AND the target event has been\n" " reached.\n" " -g, --goto= start a debug server on reaching " "\n" " in the trace. See -M in the general " "options.\n" " -p, --onprocess=|\n" " start a debug server when or " "\n" " has been exec()d, AND the target event has " "been\n" " reached.\n" " -d, --debugger= use as the gdb command\n" " -q, --no-redirect-output don't replay writes to stdout/stderr\n" " -s, --dbgport= only start a debug server on ;\n" " don't automatically launch the debugger\n" " client too.\n" " -t, --trace= singlestep instructions and dump register\n" " states when replaying towards or\n" " later\n" " -x, --gdb-x= execute gdb commands from \n"); struct ReplayFlags { // Start a debug server for the task scheduled at the first // event at which reached this event AND target_process has // been "created". TraceFrame::Time goto_event; TraceFrame::Time singlestep_to_event; pid_t target_process; string target_command; // We let users specify which process should be "created" before // starting a debug session for it. Problem is, "process" in this // context is ambiguous. It could mean the "thread group", which is // created at fork(). Or it could mean the "address space", which is // created at exec() (after the fork). // // We force choosers to specify which they mean. enum { CREATED_NONE, CREATED_EXEC, CREATED_FORK } process_created_how; // Only open a debug socket, don't launch the debugger too. bool dont_launch_debugger; // IP port to listen on for debug connections. int dbg_port; // Pass this file name to debugger with -x string gdb_command_file_path; // Specify a custom gdb binary with -d string gdb_binary_file_path; /* When true, echo tracee stdout/stderr writes to console. */ bool redirect; // When true make all private mappings shared with the tracee by default // to test the corresponding code. bool share_private_mappings; ReplayFlags() : goto_event(0), singlestep_to_event(0), target_process(0), process_created_how(CREATED_NONE), dont_launch_debugger(false), dbg_port(-1), gdb_binary_file_path("gdb"), redirect(true), share_private_mappings(false) {} }; static bool parse_replay_arg(vector& args, ReplayFlags& flags) { if (parse_global_option(args)) { return true; } static const OptionSpec options[] = { { 'a', "autopilot", NO_PARAMETER }, { 'd', "debugger", HAS_PARAMETER }, { 's', "dbgport", HAS_PARAMETER }, { 'g', "goto", HAS_PARAMETER }, { 't', "trace", HAS_PARAMETER }, { 'q', "no-redirect-output", NO_PARAMETER }, { 'f', "onfork", HAS_PARAMETER }, { 'p', "onprocess", HAS_PARAMETER }, { 'x', "gdb-x", HAS_PARAMETER }, { 0, "share-private-mappings", NO_PARAMETER } }; ParsedOption opt; if (!Command::parse_option(args, options, &opt)) { return false; } switch (opt.short_name) { case 'a': flags.goto_event = numeric_limits::max(); flags.dont_launch_debugger = true; break; case 'd': flags.gdb_binary_file_path = opt.value; break; case 'f': if (!opt.verify_valid_int(1, INT32_MAX)) { return false; } flags.target_process = opt.int_value; flags.process_created_how = ReplayFlags::CREATED_FORK; break; case 'g': if (!opt.verify_valid_int(1, UINT32_MAX)) { return false; } flags.goto_event = opt.int_value; break; case 'p': if (opt.int_value > 0) { if (!opt.verify_valid_int(1, INT32_MAX)) { return false; } flags.target_process = opt.int_value; } else { flags.target_command = opt.value; } flags.process_created_how = ReplayFlags::CREATED_EXEC; break; case 'q': flags.redirect = false; break; case 's': if (!opt.verify_valid_int(1, INT32_MAX)) { return false; } flags.dbg_port = opt.int_value; flags.dont_launch_debugger = true; break; case 't': if (!opt.verify_valid_int(1, INT32_MAX)) { return false; } flags.singlestep_to_event = opt.int_value; break; case 'x': flags.gdb_command_file_path = opt.value; break; case 0: flags.share_private_mappings = true; break; default: assert(0 && "Unknown option"); } return true; } static int find_pid_for_command(const string& trace_dir, const string& command) { TraceReader trace(trace_dir); while (trace.good()) { auto e = trace.read_task_event(); if (e.type() != TraceTaskEvent::EXEC) { continue; } if (e.cmd_line().empty()) { continue; } auto& cmd = e.cmd_line()[0]; if (cmd == command || (cmd.size() > command.size() && cmd.substr(cmd.size() - command.size() - 1) == ('/' + command))) { return e.tid(); } } return -1; } static bool pid_exists(const string& trace_dir, pid_t pid) { TraceReader trace(trace_dir); while (trace.good()) { auto e = trace.read_task_event(); if (e.tid() == pid) { return true; } } return false; } static bool pid_execs(const string& trace_dir, pid_t pid) { TraceReader trace(trace_dir); while (trace.good()) { auto e = trace.read_task_event(); if (e.tid() == pid && e.type() == TraceTaskEvent::EXEC) { return true; } } return false; } // The parent process waits until the server, |waiting_for_child|, creates a // debug socket. Then the parent exec()s the debugger over itself. While it's // waiting for the child, this is the child's pid. // This needs to be global because it's used by a signal handler. static pid_t waiting_for_child; static ReplaySession::Flags session_flags(const ReplayFlags& flags) { ReplaySession::Flags result; result.redirect_stdio = flags.redirect; result.share_private_mappings = flags.share_private_mappings; return result; } static uint64_t to_microseconds(const struct timeval& tv) { return (uint64_t)tv.tv_sec * 1000000 + tv.tv_usec; } static void serve_replay_no_debugger(const string& trace_dir, const ReplayFlags& flags) { ReplaySession::shr_ptr replay_session = ReplaySession::create(trace_dir); replay_session->set_flags(session_flags(flags)); uint32_t step_count = 0; struct timeval last_dump_time; Session::Statistics last_stats; gettimeofday(&last_dump_time, NULL); while (true) { RunCommand cmd = RUN_CONTINUE; if (flags.singlestep_to_event > 0 && replay_session->trace_reader().time() >= flags.singlestep_to_event) { cmd = RUN_SINGLESTEP; fputs("Stepping from:", stderr); Task* t = replay_session->current_task(); t->regs().print_register_file_compact(stderr); fputs(" ", stderr); t->extra_regs().print_register_file_compact(stderr); fprintf(stderr, " ticks:%" PRId64 "\n", t->tick_count()); } TraceFrame::Time before_time = replay_session->trace_reader().time(); auto result = replay_session->replay_step(cmd); TraceFrame::Time after_time = replay_session->trace_reader().time(); assert(after_time >= before_time && after_time <= before_time + 1); ++step_count; if (DUMP_STATS_PERIOD > 0 && step_count % DUMP_STATS_PERIOD == 0) { struct timeval now; gettimeofday(&now, NULL); Session::Statistics stats = replay_session->statistics(); printf( "[ReplayStatistics] ticks %lld syscalls %lld bytes_written %lld " "microseconds %lld\n", (long long)(stats.ticks_processed - last_stats.ticks_processed), (long long)(stats.syscalls_performed - last_stats.syscalls_performed), (long long)(stats.bytes_written - last_stats.bytes_written), (long long)(to_microseconds(now) - to_microseconds(last_dump_time))); last_dump_time = now; last_stats = stats; } if (result.status == REPLAY_EXITED) { break; } assert(result.status == REPLAY_CONTINUE); assert(result.break_status.watchpoints_hit.empty()); assert(!result.break_status.breakpoint_hit); assert(cmd == RUN_SINGLESTEP || !result.break_status.singlestep_complete); } LOG(info) << ("Replayer successfully finished."); } /* Handling ctrl-C during replay: * We want the entire group of processes to remain a single process group * since that allows shell job control to work best. * We want ctrl-C to not reach tracees, because that would disturb replay. * That's taken care of by Task::set_up_process. * We allow terminal SIGINT to go directly to the parent and the child (rr). * rr's SIGINT handler |handle_SIGINT_in_child| just interrupts the replay * if we're in the process of replaying to a target event, otherwise it * does nothing. * Before the parent execs gdb, its SIGINT handler does nothing. After exec, * the signal handler is reset to default so gdb behaves as normal (which is * why we use a signal handler instead of SIG_IGN). */ static void handle_SIGINT_in_parent(int sig) { assert(sig == SIGINT); // Just ignore it. } static GdbServer* server_ptr = nullptr; static void handle_SIGINT_in_child(int sig) { assert(sig == SIGINT); if (server_ptr) { server_ptr->interrupt_replay_to_target(); } } static int replay(const string& trace_dir, const ReplayFlags& flags) { GdbServer::Target target; switch (flags.process_created_how) { case ReplayFlags::CREATED_EXEC: target.pid = flags.target_process; target.require_exec = true; break; case ReplayFlags::CREATED_FORK: target.pid = flags.target_process; target.require_exec = false; break; case ReplayFlags::CREATED_NONE: break; } target.event = flags.goto_event; // If we're not going to autolaunch the debugger, don't go // through the rigamarole to set that up. All it does is // complicate the process tree and confuse users. if (flags.dont_launch_debugger) { if (target.event == numeric_limits::max()) { serve_replay_no_debugger(trace_dir, flags); } else { auto session = ReplaySession::create(trace_dir); GdbServer::ConnectionFlags conn_flags; conn_flags.dbg_port = flags.dbg_port; GdbServer(session, session_flags(flags), target).serve_replay(conn_flags); } return 0; } int debugger_params_pipe[2]; if (pipe2(debugger_params_pipe, O_CLOEXEC)) { FATAL() << "Couldn't open debugger params pipe."; } if (0 == (waiting_for_child = fork())) { // Ensure only the parent has the read end of the pipe open. Then if // the parent dies, our writes to the pipe will error out. close(debugger_params_pipe[0]); ScopedFd debugger_params_write_pipe(debugger_params_pipe[1]); auto session = ReplaySession::create(trace_dir); GdbServer::ConnectionFlags conn_flags; conn_flags.dbg_port = flags.dbg_port; conn_flags.debugger_params_write_pipe = &debugger_params_write_pipe; GdbServer server(session, session_flags(flags), target); server_ptr = &server; struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_flags = SA_RESTART; sa.sa_handler = handle_SIGINT_in_child; if (sigaction(SIGINT, &sa, nullptr)) { FATAL() << "Couldn't set sigaction for SIGINT."; } server.serve_replay(conn_flags); return 0; } // Ensure only the child has the write end of the pipe open. Then if // the child dies, our reads from the pipe will return EOF. close(debugger_params_pipe[1]); LOG(debug) << getpid() << ": forked debugger server " << waiting_for_child; struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_flags = SA_RESTART; sa.sa_handler = handle_SIGINT_in_parent; if (sigaction(SIGINT, &sa, nullptr)) { FATAL() << "Couldn't set sigaction for SIGINT."; } { ScopedFd params_pipe_read_fd(debugger_params_pipe[0]); vector options; if (!flags.gdb_command_file_path.empty()) { options.push_back("-x"); options.push_back(flags.gdb_command_file_path); } GdbServer::launch_gdb(params_pipe_read_fd, flags.gdb_binary_file_path, options); } // Child must have died before we were able to get debugger parameters // and exec gdb. Exit with the exit status of the child. while (true) { int status; int ret = waitpid(waiting_for_child, &status, 0); int err = errno; LOG(debug) << getpid() << ": waitpid(" << waiting_for_child << ") returned " << errno_name(err) << "(" << err << "); status:" << HEX(status); if (waiting_for_child != ret) { if (EINTR == err) { continue; } FATAL() << getpid() << ": waitpid(" << waiting_for_child << ") failed"; } if (WIFEXITED(status) || WIFSIGNALED(status)) { LOG(info) << ("Debugger server died. Exiting."); exit(WIFEXITED(status) ? WEXITSTATUS(status) : 1); } } return 0; } int ReplayCommand::run(vector& args) { bool found_dir = false; string trace_dir; ReplayFlags flags; while (!args.empty()) { if (parse_replay_arg(args, flags)) { continue; } if (!found_dir && parse_optional_trace_dir(args, &trace_dir)) { found_dir = true; continue; } print_help(stderr); return 1; } if (!flags.target_command.empty()) { flags.target_process = find_pid_for_command(trace_dir, flags.target_command); if (flags.target_process <= 0) { fprintf(stderr, "No process '%s' found. Try 'rr ps'.\n", flags.target_command.c_str()); return 2; } } if (flags.process_created_how != ReplayFlags::CREATED_NONE) { if (!pid_exists(trace_dir, flags.target_process)) { fprintf(stderr, "No process %d found in trace. Try 'rr ps'.\n", flags.target_process); return 2; } if (flags.process_created_how == ReplayFlags::CREATED_EXEC && !pid_execs(trace_dir, flags.target_process)) { fprintf(stderr, "Process %d never exec()ed. Try 'rr ps', or use " "'-f'.\n", flags.target_process); return 2; } } assert_prerequisites(); check_performance_settings(); if (running_under_rr()) { if (!Flags::get().suppress_environment_warnings) { fprintf(stderr, "rr: rr pid %d running under parent %d. Good luck.\n", getpid(), getppid()); } if (trace_dir.empty()) { fprintf(stderr, "rr: No trace-dir supplied. You'll try to replay the " "recording of this rr and have a bad time. Bailing out.\n"); return 3; } } return replay(trace_dir, flags); } } // namespace rr rr-4.4.0/src/ReplaySession.cc000066400000000000000000001523761277367620400160740ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define USE_BREAKPOINT_TARGET 1 #include "ReplaySession.h" #include #include #include #include #include "AutoRemoteSyscalls.h" #include "Flags.h" #include "ReplayTask.h" #include "TaskGroup.h" #include "fast_forward.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" #include "replay_syscall.h" #include "util.h" using namespace std; namespace rr { /* Why a skid region? Interrupts generated by perf counters don't * fire at exactly the programmed point (as of 2013 kernel/HW); * there's a variable slack region, which is technically unbounded. * This means that an interrupt programmed for retired branch k might * fire at |k + 50|, for example. To counteract the slack, we program * interrupts just short of our target, by the |SKID_SIZE| region * below, and then more slowly advance to the real target. * * How was this magic number determined? Trial and error: we want it * to be as small as possible for efficiency, but not so small that * overshoots are observed. If all other possible causes of overshoot * have been ruled out, like memory divergence, then you'll know that * this magic number needs to be increased if the following symptom is * observed during replay. Running with DEBUGLOG enabled (see above), * a sequence of log messages like the following will appear * * 1. programming interrupt for [target - SKID_SIZE] ticks * 2. Error: Replay diverged. Dumping register comparison. * 3. Error: [list of divergent registers; arbitrary] * 4. Error: overshot target ticks=[target] by [i] * * The key is that no other replayer log messages occur between (1) * and (2). This spew means that the replayer programmed an interrupt * for ticks=[target-SKID_SIZE], but the tracee was actually interrupted * at ticks=[target+i]. And that in turn means that the kernel/HW * skidded too far past the programmed target for rr to handle it. * * If that occurs, the SKID_SIZE needs to be increased by at least * [i]. * * NB: there are probably deeper reasons for the target slack that * could perhaps let it be deduced instead of arrived at empirically; * perhaps pipeline depth and things of that nature are involved. But * those reasons if they exit are currently not understood. */ static const int SKID_SIZE = 70; static void debug_memory(ReplayTask* t) { if (should_dump_memory(t->current_trace_frame())) { dump_process_memory(t, t->current_trace_frame().time(), "rep"); } if (t->session().done_initial_exec() && should_checksum(t->current_trace_frame())) { /* Validate the checksum we computed during the * recording phase. */ validate_process_memory(t, t->current_trace_frame().time()); } } static void split_at_address(ReplaySession::MemoryRanges& ranges, remote_ptr addr) { ReplaySession::MemoryRanges::iterator it = ranges.lower_bound(MemoryRange(addr, addr + 1)); if (it != ranges.end() && it->contains(addr) && it->start() != addr) { MemoryRange r1(it->start(), addr); MemoryRange r2(addr, it->end()); ranges.erase(it); ranges.insert(r1); ranges.insert(r2); } } static void delete_range(ReplaySession::MemoryRanges& ranges, const MemoryRange& r) { split_at_address(ranges, r.start()); split_at_address(ranges, r.end()); auto first = ranges.lower_bound(MemoryRange(r.start(), r.start() + 1)); auto last = ranges.lower_bound(MemoryRange(r.end(), r.end() + 1)); ranges.erase(first, last); } ReplaySession::MemoryRanges ReplaySession::always_free_address_space( const TraceReader& reader) { MemoryRanges result; remote_ptr addressable_min = remote_ptr(64 * 1024); // Assume 64-bit address spaces with the 47-bit user-space limitation, // for now. remote_ptr addressable_max = uintptr_t( sizeof(void*) == 8 ? uint64_t(1) << 47 : (uint64_t(1) << 32) - PAGE_SIZE); result.insert(MemoryRange(addressable_min, addressable_max)); TraceReader tmp_reader(reader); bool found; while (true) { KernelMapping km = tmp_reader.read_mapped_region( nullptr, &found, TraceReader::DONT_VALIDATE, TraceReader::ANY_TIME); if (!found) { break; } delete_range(result, km); } delete_range(result, MemoryRange(AddressSpace::rr_page_start(), AddressSpace::rr_page_end())); return result; } ReplaySession::ReplaySession(const std::string& dir) : emu_fs(EmuFs::create()), trace_in(dir), trace_frame(), current_step(), ticks_at_start_of_event(0) { advance_to_next_trace_frame(); } ReplaySession::ReplaySession(const ReplaySession& other) : Session(other), emu_fs(EmuFs::create()), trace_in(other.trace_in), trace_frame(other.trace_frame), current_step(other.current_step), ticks_at_start_of_event(other.ticks_at_start_of_event), cpuid_bug_detector(other.cpuid_bug_detector), flags(other.flags) {} ReplaySession::~ReplaySession() { // We won't permanently leak any OS resources by not ensuring // we've cleaned up here, but sessions can be created and // destroyed many times, and we don't want to temporarily hog // resources. kill_all_tasks(); syscall_bp_vm = nullptr; assert(task_map.empty() && vm_map.empty()); assert(emufs().size() == 0); } ReplaySession::shr_ptr ReplaySession::clone() { LOG(debug) << "Deepforking ReplaySession " << this << " ..."; finish_initializing(); clear_syscall_bp(); shr_ptr session(new ReplaySession(*this)); LOG(debug) << " deepfork session is " << session.get(); copy_state_to(*session, emufs(), session->emufs()); return session; } /** * Return true if it's possible/meaningful to make a checkpoint at the * |frame| that |t| will replay. */ static bool can_checkpoint_at(const TraceFrame& frame) { const Event& ev = frame.event(); if (ev.has_ticks_slop()) { return false; } switch (ev.type()) { case EV_EXIT: case EV_UNSTABLE_EXIT: // At exits, we can't clone the exiting tasks, so // don't event bother trying to checkpoint. case EV_SYSCALLBUF_RESET: // RESETs are usually inserted in between syscall // entry/exit. Do not attempting to checkpoint at // RESETs. Users would never want to do that anyway. case EV_TRACE_TERMINATION: // There's nothing to checkpoint at the end of an // early-terminated trace. return false; default: return true; } } bool ReplaySession::can_clone() { finish_initializing(); ReplayTask* t = current_task(); return t && done_initial_exec() && can_checkpoint_at(current_trace_frame()); } DiversionSession::shr_ptr ReplaySession::clone_diversion() { finish_initializing(); clear_syscall_bp(); LOG(debug) << "Deepforking ReplaySession " << this << " to DiversionSession..."; DiversionSession::shr_ptr session(new DiversionSession()); LOG(debug) << " deepfork session is " << session.get(); copy_state_to(*session, emufs(), session->emufs()); session->finish_initializing(); return session; } Task* ReplaySession::new_task(pid_t tid, pid_t rec_tid, uint32_t serial, SupportedArch a) { return new ReplayTask(*this, tid, rec_tid, serial, a); } /*static*/ ReplaySession::shr_ptr ReplaySession::create(const string& dir) { shr_ptr session(new ReplaySession(dir)); // It doesn't really matter what we use for argv/env here, since // replay_syscall's process_execve is going to follow the recording and // ignore the parameters. string exe_path; vector argv; vector env; ScopedFd error_fd = session->create_spawn_task_error_pipe(); ReplayTask* t = static_cast( Task::spawn(*session, error_fd, session->trace_in, exe_path, argv, env, session->trace_reader().peek_frame().tid())); session->on_create(t); return session; } void ReplaySession::advance_to_next_trace_frame() { if (trace_in.at_end()) { return; } trace_frame = trace_in.read_frame(); } bool ReplaySession::is_ignored_signal(int sig) { switch (sig) { // TIME_SLICE_SIGNALs can be queued but not delivered before we stop // execution for some other reason. Ignore them. case PerfCounters::TIME_SLICE_SIGNAL: return true; default: return false; } } static bool compute_ticks_request( ReplayTask* t, const ReplaySession::StepConstraints& constraints, TicksRequest* ticks_request) { *ticks_request = RESUME_UNLIMITED_TICKS; if (constraints.ticks_target > 0) { Ticks ticks_period = constraints.ticks_target - SKID_SIZE - t->tick_count(); if (ticks_period <= 0) { // Behave as if we actually executed something. Callers assume we did. t->clear_wait_status(); return false; } *ticks_request = (TicksRequest)ticks_period; } return true; } /** * Continue until reaching either the "entry" of an emulated syscall, * or the entry or exit of an executed syscall. |emu| is nonzero when * we're emulating the syscall. Return COMPLETE when the next syscall * boundary is reached, or INCOMPLETE if advancing to the boundary was * interrupted by an unknown trap. * When |syscall_trace_frame| is non-null, we continue to the syscall by * setting a breakpoint instead of running until we execute a system * call instruction. In that case we will not actually enter the kernel. */ Completion ReplaySession::cont_syscall_boundary( ReplayTask* t, const StepConstraints& constraints) { TicksRequest ticks_request; if (!compute_ticks_request(t, constraints, &ticks_request)) { return INCOMPLETE; } if (constraints.command == RUN_SINGLESTEP_FAST_FORWARD) { // ignore ticks_period. We can't add more than one tick during a // fast_forward so it doesn't matter. did_fast_forward |= fast_forward_through_instruction( t, RESUME_SYSEMU_SINGLESTEP, constraints.stop_before_states); } else { ResumeRequest resume_how = constraints.is_singlestep() ? RESUME_SYSEMU_SINGLESTEP : RESUME_SYSEMU; t->resume_execution(resume_how, RESUME_WAIT, ticks_request); } if (t->stop_sig() == PerfCounters::TIME_SLICE_SIGNAL) { // This would normally be triggered by constraints.ticks_target but it's // also possible to get stray signals here. return INCOMPLETE; } if (is_ignored_signal(t->stop_sig())) { return cont_syscall_boundary(t, constraints); } if (SIGTRAP == t->stop_sig()) { return INCOMPLETE; } ASSERT(t, !t->stop_sig()) << "Replay got unrecorded signal " << t->stop_sig() << " (" << signal_name(t->stop_sig()) << ")"; if (t->seccomp_bpf_enabled && syscall_seccomp_ordering_ == PTRACE_SYSCALL_BEFORE_SECCOMP_UNKNOWN) { ASSERT(t, !constraints.is_singlestep()); if (t->ptrace_event() == PTRACE_EVENT_SECCOMP) { syscall_seccomp_ordering_ = SECCOMP_BEFORE_PTRACE_SYSCALL; } else { syscall_seccomp_ordering_ = PTRACE_SYSCALL_BEFORE_SECCOMP; } // Eat the following event, either a seccomp or syscall notification t->resume_execution(RESUME_SYSEMU, RESUME_WAIT, ticks_request); } auto type = AddressSpace::rr_page_syscall_from_exit_point(t->ip()); if (type && type->traced == AddressSpace::UNTRACED && type->enabled == AddressSpace::REPLAY_ONLY) { t->finish_emulated_syscall(); // Actually perform it. We can hit these when replaying through syscallbuf // code that was interrupted. { AutoRemoteSyscalls remote(t); const Registers& r = t->regs(); long ret = remote.syscall(r.original_syscallno(), r.arg1(), r.arg2(), r.arg3(), r.arg4(), r.arg5(), r.arg6()); remote.regs().set_syscall_result(ret); } return cont_syscall_boundary(t, constraints); } return COMPLETE; } void ReplaySession::clear_syscall_bp() { if (syscall_bp_vm) { syscall_bp_vm->remove_breakpoint(syscall_bp_addr, BKPT_INTERNAL); syscall_bp_vm = nullptr; syscall_bp_addr = nullptr; } } /** * Advance to the next syscall entry (or virtual entry) according to * |step|. Return COMPLETE if successful, or INCOMPLETE if an unhandled trap * occurred. */ Completion ReplaySession::enter_syscall(ReplayTask* t, const StepConstraints& constraints) { if (t->regs().matches(trace_frame.regs()) && t->tick_count() == trace_frame.ticks()) { // We already entered the syscall via an ENTERING_SYSCALL_PTRACE ASSERT(t, current_trace_frame().event().Syscall().state == ENTERING_SYSCALL); } else { remote_code_ptr syscall_instruction; if (done_initial_exec()) { syscall_instruction = current_trace_frame().regs().ip().decrement_by_syscall_insn_length( t->arch()); // If the breakpoint already exists, it must have been from a previous // invocation of this function for the same event (once the event // completes, the breakpoint is cleared). assert(!syscall_bp_vm || (syscall_bp_vm == t->vm() && syscall_instruction == syscall_bp_addr && t->vm()->get_breakpoint_type_at_addr( syscall_instruction) != BKPT_NONE)); // Skip this optimization if we can't set the breakpoint, or if it's // in writeable or shared memory, since in those cases it could be // overwritten by the tracee. It could even be dynamically generated and // not generated yet. if (!syscall_bp_vm && t->vm()->is_breakpoint_in_private_read_only_memory( syscall_instruction) && t->vm()->add_breakpoint(syscall_instruction, BKPT_INTERNAL)) { syscall_bp_vm = t->vm(); syscall_bp_addr = syscall_instruction; } } if (cont_syscall_boundary(t, constraints) == INCOMPLETE) { bool reached_target = syscall_bp_vm && SIGTRAP == t->stop_sig() && t->ip().decrement_by_bkpt_insn_length(t->arch()) == syscall_instruction && t->vm()->get_breakpoint_type_at_addr( syscall_instruction) == BKPT_INTERNAL; if (reached_target) { // Emulate syscall state change Registers r = t->regs(); r.set_ip( syscall_instruction.increment_by_syscall_insn_length(t->arch())); r.set_original_syscallno(r.syscallno()); r.set_syscall_result(-ENOSYS); t->emulate_syscall_entry(r); t->validate_regs(); clear_syscall_bp(); } else { return INCOMPLETE; } } else { // If we use the breakpoint optimization, we must get a SIGTRAP before // reaching a syscall, so cont_syscall_boundary must return INCOMPLETE. ASSERT(t, !syscall_bp_vm); t->validate_regs(); t->finish_emulated_syscall(); } } if (current_trace_frame().event().Syscall().state == ENTERING_SYSCALL) { rep_after_enter_syscall(t); } return COMPLETE; } /** * Advance past the reti (or virtual reti) according to |step|. * Return COMPLETE if successful, or INCOMPLETE if an unhandled trap occurred. */ Completion ReplaySession::exit_syscall(ReplayTask* t) { t->on_syscall_exit(current_step.syscall.number, current_trace_frame().regs()); t->apply_all_data_records_from_trace(); t->set_return_value_from_trace(); uint32_t flags = 0; if (t->arch() == SupportedArch::x86 && (X86Arch::pwrite64 == current_step.syscall.number || X86Arch::pread64 == current_step.syscall.number)) { flags |= ReplayTask::IGNORE_ESI; } t->validate_regs(flags); return COMPLETE; } void ReplaySession::check_pending_sig(ReplayTask* t) { ASSERT(t, 0 < t->stop_sig()) << "Replaying `" << trace_frame.event() << "': expecting tracee signal or trap, but instead at `" << t->syscall_name(t->regs().original_syscallno()) << "' (ticks: " << t->tick_count() << ")"; } /** * Advance |t| to the next signal or trap according to |constraints.command|. * * Default |resume_how| is RESUME_SYSEMU for error checking: * since the next event is supposed to be a signal, entering a syscall here * means divergence. There shouldn't be any straight-line execution overhead * for SYSEMU vs. CONT, so the difference in cost should be negligible. * * Some callers pass RESUME_CONT because they want to execute any syscalls * encountered. */ void ReplaySession::continue_or_step(ReplayTask* t, const StepConstraints& constraints, TicksRequest tick_request, ResumeRequest resume_how) { if (constraints.command == RUN_SINGLESTEP) { t->resume_execution(RESUME_SINGLESTEP, RESUME_WAIT, tick_request); } else if (constraints.command == RUN_SINGLESTEP_FAST_FORWARD) { did_fast_forward |= fast_forward_through_instruction( t, RESUME_SINGLESTEP, constraints.stop_before_states); } else { t->resume_execution(resume_how, RESUME_WAIT, tick_request); } check_pending_sig(t); } static void guard_overshoot(ReplayTask* t, const Registers& target_regs, Ticks target_ticks, Ticks remaining_ticks, const Registers* closest_matching_regs) { if (remaining_ticks < 0) { remote_code_ptr target_ip = target_regs.ip(); /* Cover up the internal breakpoint that we may have * set, and restore the tracee's $ip to what it would * have been had it not hit the breakpoint (if it did * hit the breakpoint).*/ t->vm()->remove_breakpoint(target_ip, BKPT_INTERNAL); if (t->regs().ip() == target_ip.increment_by_bkpt_insn_length(t->arch())) { t->move_ip_before_breakpoint(); } if (closest_matching_regs) { LOG(error) << "Replay diverged; target registers at ticks target mismatched: "; Registers::compare_register_files(t, "rep overshoot", t->regs(), "rec", *closest_matching_regs, LOG_MISMATCHES); } else { LOG(error) << "Replay diverged; target registers mismatched: "; Registers::compare_register_files(t, "rep overshoot", t->regs(), "rec", target_regs, LOG_MISMATCHES); } ASSERT(t, false) << "overshot target ticks=" << target_ticks << " by " << -remaining_ticks; } } static void guard_unexpected_signal(ReplayTask* t) { if (ReplaySession::is_ignored_signal(t->stop_sig()) || SIGTRAP == t->stop_sig()) { return; } if (t->stop_sig()) { ASSERT(t, false) << "Replay got unrecorded signal " << signal_name(t->stop_sig()) << " while awaiting signal"; } else { ASSERT(t, false) << "Replay got unrecorded syscall " << syscall_name(t->regs().original_syscallno(), t->arch()) << " while awaiting signal"; } } static bool is_same_execution_point(ReplayTask* t, const Registers& rec_regs, Ticks ticks_left, Registers* mismatched_regs, const Registers** mismatched_regs_ptr) { MismatchBehavior behavior = #ifdef DEBUGTAG LOG_MISMATCHES #else EXPECT_MISMATCHES #endif ; if (ticks_left != 0) { LOG(debug) << " not same execution point: " << ticks_left << " ticks left (@" << rec_regs.ip() << ")"; #ifdef DEBUGTAG Registers::compare_register_files(t, "(rep)", t->regs(), "(rec)", rec_regs, LOG_MISMATCHES); #endif return false; } if (!Registers::compare_register_files(t, "rep", t->regs(), "rec", rec_regs, behavior)) { LOG(debug) << " not same execution point: regs differ (@" << rec_regs.ip() << ")"; *mismatched_regs = t->regs(); *mismatched_regs_ptr = mismatched_regs; return false; } LOG(debug) << " same execution point"; return true; } /** * Run execution forwards for |t| until |ticks| is reached, and the $ip * reaches the recorded $ip. Return COMPLETE if successful or INCOMPLETE if an * unhandled interrupt occurred. |sig| is the pending signal to be * delivered; it's only used to distinguish debugger-related traps * from traps related to replaying execution. |ticks| is an inout param * that will be decremented by branches retired during this attempted * step. */ Completion ReplaySession::emulate_async_signal( ReplayTask* t, const StepConstraints& constraints, Ticks ticks) { const Registers& regs = trace_frame.regs(); remote_code_ptr ip = regs.ip(); bool did_set_internal_breakpoint = false; /* Step 1: advance to the target ticks (minus a slack region) as * quickly as possible by programming the hpc. */ Ticks ticks_left = ticks - t->tick_count(); LOG(debug) << "advancing " << ticks_left << " ticks to reach " << ticks << "/" << ip; /* XXX should we only do this if (ticks > 10000)? */ while (ticks_left - SKID_SIZE > SKID_SIZE) { LOG(debug) << " programming interrupt for " << (ticks_left - SKID_SIZE) << " ticks"; continue_or_step(t, constraints, (TicksRequest)(ticks_left - SKID_SIZE)); guard_unexpected_signal(t); ticks_left = ticks - t->tick_count(); if (SIGTRAP == t->stop_sig()) { /* We proved we're not at the execution * target, and we haven't set any internal * breakpoints, and we're not temporarily * internally single-stepping, so we must have * hit a debugger breakpoint or the debugger * was single-stepping the tracee. (The * debugging code will verify that.) */ return INCOMPLETE; } } guard_overshoot(t, regs, ticks, ticks_left, NULL); /* True when our advancing has triggered a tracee SIGTRAP that needs to * be dealt with. */ bool pending_SIGTRAP = false; RunCommand SIGTRAP_run_command = RUN_CONTINUE; /* Step 2: more slowly, find our way to the target ticks and * execution point. We set an internal breakpoint on the * target $ip and then resume execution. When that *internal* * breakpoint is hit (i.e., not one incidentally also set on * that $ip by the debugger), we check again if we're at the * target ticks and execution point. If not, we temporarily * remove the breakpoint, single-step over the insn, and * repeat. * * What we really want to do is set a (precise) * retired-instruction interrupt and do away with all this * cruft. */ Registers mismatched_regs; const Registers* mismatched_regs_ptr = NULL; while (true) { /* Invariants here are * o ticks_left is up-to-date * o ticks_left >= 0 * * Possible state of the execution of |t| * 0. at a debugger trap (breakpoint, watchpoint, stepi) * 1. at an internal breakpoint * 2. at the execution target * 3. not at the execution target, but incidentally * at the target $ip * 4. otherwise not at the execution target * * Determining whether we're at a debugger trap is * surprisingly complicated. */ bool at_target = is_same_execution_point( t, regs, ticks_left, &mismatched_regs, &mismatched_regs_ptr); if (pending_SIGTRAP) { TrapReasons trap_reasons = t->compute_trap_reasons(); BreakpointType breakpoint_type = t->vm()->get_breakpoint_type_for_retired_insn(t->ip()); if (constraints.is_singlestep()) { ASSERT(t, trap_reasons.singlestep); } if (constraints.is_singlestep() || (trap_reasons.watchpoint && t->vm()->has_any_watchpoint_changes()) || (trap_reasons.breakpoint && BKPT_USER == breakpoint_type)) { /* Case (0) above: interrupt for the debugger. */ LOG(debug) << " trap was debugger singlestep/breakpoint"; if (did_set_internal_breakpoint) { t->vm()->remove_breakpoint(ip, BKPT_INTERNAL); } return INCOMPLETE; } if (trap_reasons.breakpoint) { // We didn't hit a user breakpoint, and executing an explicit // breakpoint instruction in the tracee would have triggered a // deterministic signal instead of an async one. // So we must have hit our internal breakpoint. ASSERT(t, did_set_internal_breakpoint); ASSERT(t, regs.ip().increment_by_bkpt_insn_length(t->arch()) == t->ip()); // We didn't do an internal singlestep, and if we'd done a // user-requested singlestep we would have hit the above case. ASSERT(t, !trap_reasons.singlestep); /* Case (1) above: cover the tracks of * our internal breakpoint, and go * check again if we're at the * target. */ LOG(debug) << " trap was for target $ip"; /* (The breakpoint would have trapped * at the $ip one byte beyond the * target.) */ assert(!at_target); pending_SIGTRAP = false; t->move_ip_before_breakpoint(); /* We just backed up the $ip, but * rewound it over an |int $3| * instruction, which couldn't have * retired a branch. So we don't need * to adjust |ticks_count()|. */ continue; } /* Otherwise, either we did an internal singlestep or a hardware * watchpoint fired but values didn't change. */ if (trap_reasons.singlestep) { ASSERT(t, is_singlestep(SIGTRAP_run_command)); LOG(debug) << " (SIGTRAP; stepi'd target $ip)"; } else { ASSERT(t, trap_reasons.watchpoint); LOG(debug) << " (SIGTRAP; HW watchpoint fired without changes)"; } } /* We had to keep the internal breakpoint set (if it * was when we entered the loop) for the checks above. * But now we're either done (at the target) or about * to resume execution in one of a variety of ways, * and it's simpler to start out knowing that the * breakpoint isn't set. */ if (did_set_internal_breakpoint) { t->vm()->remove_breakpoint(ip, BKPT_INTERNAL); did_set_internal_breakpoint = false; } if (at_target) { /* Case (2) above: done. */ return COMPLETE; } /* At this point, we've proven that we're not at the * target execution point, and we've ensured the * internal breakpoint is unset. */ if (USE_BREAKPOINT_TARGET && regs.ip() != t->regs().ip()) { /* Case (4) above: set a breakpoint on the * target $ip and PTRACE_CONT in an attempt to * execute as many non-trapped insns as we * can. (Unless the debugger is stepping, of * course.) Trapping and checking * are-we-at-target is slow. It bears * repeating that the ideal implementation * would be programming a precise counter * interrupt (insns-retired best of all), but * we're forced to be conservative by observed * imprecise counters. This should still be * no slower than single-stepping our way to * the target execution point. */ LOG(debug) << " breaking on target $ip"; t->vm()->add_breakpoint(ip, BKPT_INTERNAL); did_set_internal_breakpoint = true; continue_or_step(t, constraints, RESUME_UNLIMITED_TICKS); SIGTRAP_run_command = constraints.command; } else { /* Case (3) above: we can't put a breakpoint * on the $ip, because resuming execution * would just trap and we'd be back where we * started. Single-step or fast-forward past it. */ LOG(debug) << " (fast-forwarding over target $ip)"; /* Just do whatever the user asked for if the user requested * singlestepping * or there is user breakpoint at the run address. The latter is safe * because the breakpoint will be triggered immediately. This gives us the * invariant that an internal singlestep never triggers a user breakpoint. */ if (constraints.command == RUN_SINGLESTEP || t->vm()->get_breakpoint_type_at_addr(t->regs().ip()) == BKPT_USER) { continue_or_step(t, constraints, RESUME_UNLIMITED_TICKS); SIGTRAP_run_command = constraints.command; } else { vector states = constraints.stop_before_states; // This state may not be relevant if we don't have the correct tick // count yet. But it doesn't hurt to push it on anyway. states.push_back(®s); did_fast_forward |= fast_forward_through_instruction(t, RESUME_SINGLESTEP, states); SIGTRAP_run_command = RUN_SINGLESTEP_FAST_FORWARD; check_pending_sig(t); } } pending_SIGTRAP = SIGTRAP == t->stop_sig(); /* Maintain the "'ticks_left'-is-up-to-date" * invariant. */ ticks_left = ticks - t->tick_count(); /* Sometimes (e.g. in the ptrace_signal_32 test), we're in almost * the correct state when we enter |advance_to|, except that exotic * registers (i.e. segment registers) need to be normalized by the kernel * by continuing and hitting a deterministic signal without actually * advancing execution. So we allow |advance_to| to proceed and actually * reach the desired state. */ if (!is_same_execution_point(t, regs, ticks_left, &mismatched_regs, &mismatched_regs_ptr)) { guard_unexpected_signal(t); } guard_overshoot(t, regs, ticks, ticks_left, mismatched_regs_ptr); } } static bool is_fatal_default_action(int sig) { signal_action action = default_action(sig); return action == DUMP_CORE || action == TERMINATE; } /** * Emulates delivery of |sig| to |oldtask|. Returns INCOMPLETE if * emulation was interrupted, COMPLETE if completed. */ Completion ReplaySession::emulate_signal_delivery(ReplayTask* oldtask, int sig) { ReplayTask* t = current_task(); if (!t) { // Trace terminated abnormally. We'll pop out to code // that knows what to do. return INCOMPLETE; } ASSERT(oldtask, t == oldtask) << "emulate_signal_delivery changed task"; const Event& ev = trace_frame.event(); ASSERT(t, ev.type() == EV_SIGNAL_DELIVERY || ev.type() == EV_SIGNAL_HANDLER) << "Unexpected signal disposition"; // Entering a signal handler seems to clear FP/SSE registers for some // reason. So we saved those cleared values, and now we restore that // state so they're cleared during replay. if (ev.type() == EV_SIGNAL_HANDLER) { t->set_extra_regs(trace_frame.extra_regs()); } /* Restore the signal-hander frame data, if there was one. */ bool restored_sighandler_frame = 0 < t->set_data_from_trace(); if (restored_sighandler_frame) { LOG(debug) << "--> restoring sighandler frame for " << signal_name(sig); } // Note that fatal signals are not actually injected into the task! // This is very important; we must never actually inject fatal signals // into a task. All replay task death must go through exit_task. /* If this signal had a user handler, and we just set up the * callframe, and we need to restore the $sp for continued * execution. */ t->set_regs(trace_frame.regs()); t->validate_regs(); return COMPLETE; } void ReplaySession::check_ticks_consistency(ReplayTask* t, const Event& ev) { if (!done_initial_exec()) { return; } Ticks ticks_now = t->tick_count(); Ticks trace_ticks = trace_frame.ticks(); ASSERT(t, ticks_now == trace_ticks) << "ticks mismatch for '" << ev << "'; expected " << trace_ticks << ", got " << ticks_now << ""; } static bool treat_signal_event_as_deterministic(const SignalEvent& ev) { return ev.deterministic == DETERMINISTIC_SIG; } /** * Advance to the delivery of the deterministic signal |sig| and * update registers to what was recorded. Return COMPLETE if successful or * INCOMPLETE if an unhandled interrupt occurred. */ Completion ReplaySession::emulate_deterministic_signal( ReplayTask* t, int sig, const StepConstraints& constraints) { if (t->regs().matches(trace_frame.regs()) && t->tick_count() == trace_frame.ticks()) { // We're already at the target. This can happen when multiple signals // are delivered with no intervening execution. return COMPLETE; } continue_or_step(t, constraints, RESUME_UNLIMITED_TICKS); if (is_ignored_signal(t->stop_sig())) { return emulate_deterministic_signal(t, sig, constraints); } if (SIGTRAP == t->stop_sig()) { TrapReasons trap_reasons = t->compute_trap_reasons(); if (trap_reasons.singlestep || trap_reasons.watchpoint) { // Singlestep or watchpoint must have been debugger-requested return INCOMPLETE; } if (trap_reasons.breakpoint) { // An explicit breakpoint instruction in the tracee would produce a // |breakpoint| reason as we emulate the deterministic SIGTRAP. BreakpointType type = t->vm()->get_breakpoint_type_for_retired_insn(t->ip()); if (BKPT_NONE != type) { ASSERT(t, BKPT_USER == type); return INCOMPLETE; } } } ASSERT(t, t->stop_sig() == sig) << "Replay got unrecorded signal " << signal_name(t->stop_sig()) << " (expecting " << signal_name(sig) << ")"; const Event& ev = trace_frame.event(); check_ticks_consistency(t, ev); if (EV_SEGV_RDTSC == ev.type()) { t->set_regs(trace_frame.regs()); } return COMPLETE; } /** * Restore the recorded syscallbuf data to the tracee, preparing the * tracee for replaying the records. */ void ReplaySession::prepare_syscallbuf_records(ReplayTask* t) { // Read the recorded syscall buffer back into the buffer // region. auto buf = t->trace_reader().read_raw_data(); ASSERT(t, buf.data.size() >= sizeof(struct syscallbuf_hdr)); ASSERT(t, buf.data.size() <= t->syscallbuf_size); ASSERT(t, buf.addr == t->syscallbuf_child.cast()); struct syscallbuf_hdr recorded_hdr; memcpy(&recorded_hdr, buf.data.data(), sizeof(struct syscallbuf_hdr)); // Don't overwrite syscallbuf_hdr. That needs to keep tracking the current // syscallbuf state. t->write_bytes_helper(t->syscallbuf_child + 1, buf.data.size() - sizeof(struct syscallbuf_hdr), buf.data.data() + sizeof(struct syscallbuf_hdr)); ASSERT(t, recorded_hdr.num_rec_bytes + sizeof(struct syscallbuf_hdr) <= t->syscallbuf_size); current_step.flush.stop_breakpoint_addr = t->stopping_breakpoint_table.to_data_ptr().as_int() + (recorded_hdr.num_rec_bytes / 8) * t->stopping_breakpoint_table_entry_size; LOG(debug) << "Prepared " << (uint32_t)recorded_hdr.num_rec_bytes << " bytes of syscall records"; } /** * Returns mprotect_record_count */ static uint32_t apply_mprotect_records(ReplayTask* t, uint32_t skip_mprotect_records) { uint32_t final_mprotect_record_count = t->read_mem(REMOTE_PTR_FIELD(t->syscallbuf_child, mprotect_record_count)); if (skip_mprotect_records < final_mprotect_record_count) { auto records = t->read_mem(REMOTE_PTR_FIELD(t->preload_globals, mprotect_records[0]) + skip_mprotect_records, final_mprotect_record_count - skip_mprotect_records); for (size_t i = 0; i < records.size(); ++i) { auto& r = records[i]; uint32_t completed_count = t->read_mem(REMOTE_PTR_FIELD( t->syscallbuf_child, mprotect_record_count_completed)); if (i >= completed_count) { auto km = t->vm()->read_kernel_mapping(t, r.start); if (km.prot() != r.prot) { // mprotect didn't happen yet. continue; } } t->vm()->protect(t, r.start, r.size, r.prot); } } return final_mprotect_record_count; } /** * Replay all the syscalls recorded in the interval between |t|'s * current execution point and the next non-syscallbuf event (the one * that flushed the buffer). Return COMPLETE if successful or INCOMPLETE if an * unhandled interrupt occurred. */ Completion ReplaySession::flush_syscallbuf(ReplayTask* t, const StepConstraints& constraints) { auto next_rec = t->next_syscallbuf_record(); uint32_t skip_mprotect_records = t->read_mem( REMOTE_PTR_FIELD(t->syscallbuf_child, mprotect_record_count_completed)); TicksRequest ticks_request; if (!compute_ticks_request(t, constraints, &ticks_request)) { return INCOMPLETE; } bool added = t->vm()->add_breakpoint(current_step.flush.stop_breakpoint_addr, BKPT_INTERNAL); ASSERT(t, added); continue_or_step(t, constraints, ticks_request, RESUME_CONT); bool user_breakpoint_at_addr = t->vm()->get_breakpoint_type_at_addr( current_step.flush.stop_breakpoint_addr) != BKPT_INTERNAL; t->vm()->remove_breakpoint(current_step.flush.stop_breakpoint_addr, BKPT_INTERNAL); // Account for buffered syscalls just completed auto end_rec = t->next_syscallbuf_record(); while (next_rec != end_rec) { accumulate_syscall_performed(); next_rec = next_rec.as_int() + t->stored_record_size(next_rec); } // Apply the mprotect records we just completed. uint32_t final_mprotect_record_count = apply_mprotect_records(t, skip_mprotect_records); if (t->stop_sig() == PerfCounters::TIME_SLICE_SIGNAL) { // This would normally be triggered by constraints.ticks_target but it's // also possible to get stray signals here. return INCOMPLETE; } if (is_ignored_signal(t->stop_sig())) { return flush_syscallbuf(t, constraints); } ASSERT(t, t->stop_sig() == SIGTRAP) << "Replay got unexpected signal (or none) " << t->stop_sig(); if (t->ip().decrement_by_bkpt_insn_length(t->arch()) == remote_code_ptr(current_step.flush.stop_breakpoint_addr) && !user_breakpoint_at_addr) { Registers r = t->regs(); r.set_ip(current_step.flush.stop_breakpoint_addr); t->set_regs(r); if (final_mprotect_record_count) { // Skip mprotect records in trace. We don't need them for replay, but // they could be useful for other trace consumers that want a complete // view of VM layout without having to do a full replay. // We delay this skipping to here because we don't want to do it more // than once if a syscallbuf flush is incomplete. vector ignored; t->trace_reader().read_generic(ignored); } return COMPLETE; } return INCOMPLETE; } Completion ReplaySession::patch_next_syscall( ReplayTask* t, const StepConstraints& constraints) { if (cont_syscall_boundary(t, constraints) == INCOMPLETE) { return INCOMPLETE; } t->exit_syscall_and_prepare_restart(); // All patching effects have been recorded to the trace. // First, replay any memory mapping done by Monkeypatcher. There should be // at most one but we might as well be general. while (true) { TraceReader::MappedData data; bool found; KernelMapping km = t->trace_reader().read_mapped_region(&data, &found); if (!found) { break; } AutoRemoteSyscalls remote(t); ASSERT(t, km.flags() & MAP_ANONYMOUS); remote.infallible_mmap_syscall(km.start(), km.size(), km.prot(), km.flags() | MAP_FIXED, -1, 0); t->vm()->map(t, km.start(), km.size(), km.prot(), km.flags(), 0, string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, nullptr, &km); } // Now replay all data records. t->apply_all_data_records_from_trace(); return COMPLETE; } /** * Return true if replaying |ev| by running |step| should result in * the target task having the same ticks value as it did during * recording. */ static bool has_deterministic_ticks(const Event& ev, const ReplayTraceStep& step) { if (ev.has_ticks_slop()) { return false; } // We won't necessarily reach the same ticks when replaying an // async signal, due to debugger interrupts and other // implementation details. This is checked in |advance_to()| // anyway. return TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT != step.action; } void ReplaySession::check_approaching_ticks_target( ReplayTask* t, const StepConstraints& constraints, BreakStatus& break_status) { if (constraints.ticks_target > 0) { Ticks ticks_left = constraints.ticks_target - t->tick_count(); if (ticks_left <= SKID_SIZE) { break_status.approaching_ticks_target = true; } } } Completion ReplaySession::advance_to_ticks_target( ReplayTask* t, const StepConstraints& constraints) { while (true) { TicksRequest ticks_request; if (!compute_ticks_request(t, constraints, &ticks_request)) { return INCOMPLETE; } continue_or_step(t, constraints, ticks_request); if (SIGTRAP == t->stop_sig()) { return INCOMPLETE; } } } /** * Try to execute |step|, adjusting for |req| if needed. Return COMPLETE if * |step| was made, or INCOMPLETE if there was a trap or |step| needs * more work. */ Completion ReplaySession::try_one_trace_step( ReplayTask* t, const StepConstraints& constraints) { if (constraints.ticks_target > 0 && !trace_frame.event().has_ticks_slop() && t->current_trace_frame().ticks() > constraints.ticks_target) { // Instead of doing this step, just advance to the ticks_target, since // that happens before this event completes. // Unfortunately we can't do this for TSTEP_FLUSH_SYSCALLBUF // because its tick count can't be trusted. // cont_syscall_boundary handles the ticks constraint for those cases. return advance_to_ticks_target(t, constraints); } switch (current_step.action) { case TSTEP_RETIRE: return COMPLETE; case TSTEP_ENTER_SYSCALL: return enter_syscall(t, constraints); case TSTEP_EXIT_SYSCALL: return exit_syscall(t); case TSTEP_DETERMINISTIC_SIGNAL: return emulate_deterministic_signal(t, current_step.target.signo, constraints); case TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT: return emulate_async_signal(t, constraints, current_step.target.ticks); case TSTEP_DELIVER_SIGNAL: return emulate_signal_delivery(t, current_step.target.signo); case TSTEP_FLUSH_SYSCALLBUF: return flush_syscallbuf(t, constraints); case TSTEP_PATCH_SYSCALL: return patch_next_syscall(t, constraints); case TSTEP_EXIT_TASK: return exit_task(t); default: FATAL() << "Unhandled step type " << current_step.action; return COMPLETE; } } /** * Task death during replay always goes through here (except for * Session::kill_all_tasks when we forcibly kill all tasks in the session at * once). |exit| and |exit_group| syscalls are both emulated so the real * task doesn't die until we reach the EXIT/UNSTABLE_EXIT events in the trace. * This ensures the real tasks are alive and available as long as our Task * object exists, which simplifies code like Session cloning. * * Killing tasks with fatal signals doesn't work because a fatal signal will * try to kill all the tasks in the task group. Instead we inject an |exit| * syscall, which is apparently the only way to kill one specific thread. */ static void end_task(ReplayTask* t) { ASSERT(t, t->ptrace_event() != PTRACE_EVENT_EXIT); t->destroy_buffers(); Registers r = t->regs(); r.set_ip(t->vm()->privileged_traced_syscall_ip()); r.set_syscallno(syscall_number_for_exit(t->arch())); t->set_regs(r); // Enter the syscall. t->resume_execution(RESUME_CONT, RESUME_WAIT, RESUME_NO_TICKS); ASSERT(t, t->ptrace_event() == PTRACE_EVENT_EXIT); t->stable_exit = true; t->destroy(); } Completion ReplaySession::exit_task(ReplayTask* t) { ASSERT(t, !t->seen_ptrace_exit_event); // Apply robust-futex updates captured during recording. t->apply_all_data_records_from_trace(); end_task(t); /* |t| is dead now. */ return COMPLETE; } ReplayTask* ReplaySession::revive_task_for_exec() { const Event& ev = trace_frame.event(); if (!ev.is_syscall_event() || !is_execve_syscall(ev.Syscall().number, ev.arch())) { FATAL() << "Can't find task, but we're not in an execve"; } TaskGroup* tg = nullptr; for (auto& p : task_group_map) { if (p.second->tgid == trace_frame.tid()) { tg = p.second; break; } } if (!tg) { FATAL() << "Dead task tid should be task-group leader, but we can't find it"; } if (tg->task_set().size() != 1) { FATAL() << "Should only be one task left in the taskgroup"; } ReplayTask* t = static_cast(*tg->task_set().begin()); LOG(debug) << "Changing task tid from " << t->rec_tid << " to " << trace_frame.tid(); task_map.erase(t->rec_tid); t->rec_tid = trace_frame.tid(); task_map.insert(make_pair(t->rec_tid, t)); // The real tid is not changing yet. It will, in process_execve. return t; } /** * Set up rep_trace_step state in t's Session to start replaying towards * the event given by the session's current_trace_frame --- but only if * it's not already set up. * Return true if we should continue replaying, false if the debugger * requested a restart. If this returns false, t's Session state was not * modified. */ ReplayTask* ReplaySession::setup_replay_one_trace_frame(ReplayTask* t) { const Event& ev = trace_frame.event(); if (!t) { t = revive_task_for_exec(); } LOG(debug) << "[event " << trace_frame.time() << "] " << t->rec_tid << ": replaying " << Event(ev) << "; state " << (ev.is_syscall_event() ? state_name(ev.Syscall().state) : " (none)"); if (t->syscallbuf_child) { LOG(debug) << " (syscllbufsz:" << (uint32_t)t->read_mem( REMOTE_PTR_FIELD(t->syscallbuf_child, num_rec_bytes)) << ", abrtcmt:" << bool(t->read_mem(REMOTE_PTR_FIELD( t->syscallbuf_child, abort_commit))) << ", locked:" << bool(t->read_mem(REMOTE_PTR_FIELD( t->syscallbuf_child, locked))) << ")"; } /* Ask the trace-interpretation code what to do next in order * to retire the current frame. */ memset(¤t_step, 0, sizeof(current_step)); switch (ev.type()) { case EV_UNSTABLE_EXIT: case EV_EXIT: current_step.action = TSTEP_EXIT_TASK; break; case EV_SYSCALLBUF_ABORT_COMMIT: t->write_mem(REMOTE_PTR_FIELD(t->syscallbuf_child, abort_commit), (uint8_t)1); t->apply_all_data_records_from_trace(); current_step.action = TSTEP_RETIRE; break; case EV_SYSCALLBUF_FLUSH: current_step.action = TSTEP_FLUSH_SYSCALLBUF; prepare_syscallbuf_records(t); break; case EV_SYSCALLBUF_RESET: // Reset syscallbuf_hdr->num_rec_bytes and zero out the recorded data. // Zeroing out the data is important because we only save and restore // the recorded data area when making checkpoints. We want the checkpoint // to have the same syscallbuf contents as its original, i.e. zero outside // the recorded data area. This is important because stray reads such // as those performed by return_addresses should be consistent. t->reset_syscallbuf(); current_step.action = TSTEP_RETIRE; break; case EV_PATCH_SYSCALL: current_step.action = TSTEP_PATCH_SYSCALL; break; case EV_SCHED: current_step.action = TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT; current_step.target.ticks = trace_frame.ticks(); current_step.target.signo = 0; break; case EV_SEGV_RDTSC: current_step.action = TSTEP_DETERMINISTIC_SIGNAL; current_step.target.ticks = -1; current_step.target.signo = SIGSEGV; break; case EV_GROW_MAP: process_grow_map(t); current_step.action = TSTEP_RETIRE; break; case EV_INTERRUPTED_SYSCALL_NOT_RESTARTED: LOG(debug) << " popping interrupted but not restarted syscall"; current_step.action = TSTEP_RETIRE; break; case EV_EXIT_SIGHANDLER: LOG(debug) << "<-- sigreturn"; current_step.action = TSTEP_RETIRE; break; case EV_SIGNAL: if (treat_signal_event_as_deterministic(ev.Signal())) { current_step.action = TSTEP_DETERMINISTIC_SIGNAL; current_step.target.signo = ev.Signal().siginfo.si_signo; current_step.target.ticks = -1; } else { current_step.action = TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT; current_step.target.signo = ev.Signal().siginfo.si_signo; current_step.target.ticks = trace_frame.ticks(); } break; case EV_SIGNAL_DELIVERY: case EV_SIGNAL_HANDLER: current_step.action = TSTEP_DELIVER_SIGNAL; current_step.target.signo = ev.Signal().siginfo.si_signo; break; case EV_SYSCALL: if (trace_frame.event().Syscall().state == ENTERING_SYSCALL || trace_frame.event().Syscall().state == ENTERING_SYSCALL_PTRACE) { rep_prepare_run_to_syscall(t, ¤t_step); } else { rep_process_syscall(t, ¤t_step); if (current_step.action == TSTEP_RETIRE) { t->on_syscall_exit(current_step.syscall.number, trace_frame.regs()); } } break; default: FATAL() << "Unexpected event " << ev; } return t; } bool ReplaySession::next_step_is_syscall_exit(int syscallno) { return current_step.action == TSTEP_NONE && trace_frame.event().is_syscall_event() && trace_frame.event().Syscall().number == syscallno && trace_frame.event().Syscall().state == EXITING_SYSCALL; } ReplayResult ReplaySession::replay_step(const StepConstraints& constraints) { finish_initializing(); ReplayResult result(REPLAY_CONTINUE); ReplayTask* t = current_task(); if (EV_TRACE_TERMINATION == trace_frame.event().type()) { result.status = REPLAY_EXITED; return result; } /* If we restored from a checkpoint, the steps might have been * computed already in which case step.action will not be TSTEP_NONE. */ if (current_step.action == TSTEP_NONE) { t = setup_replay_one_trace_frame(t); if (current_step.action == TSTEP_NONE) { // Already at the destination event. advance_to_next_trace_frame(); } if (current_step.action == TSTEP_EXIT_TASK) { result.break_status.task = t; result.break_status.task_exit = true; } return result; } did_fast_forward = false; // Now we know |t| hasn't died, so save it in break_status. result.break_status.task = t; /* Advance towards fulfilling |current_step|. */ if (try_one_trace_step(t, constraints) == INCOMPLETE) { if (EV_TRACE_TERMINATION == trace_frame.event().type()) { // An irregular trace step had to read the // next trace frame, and that frame was an // early-termination marker. Otherwise we // would have seen the marker above. result.status = REPLAY_EXITED; return result; } // We got INCOMPLETE because there was some kind of debugger trap or // we got close to ticks_target. result.break_status = diagnose_debugger_trap(t, constraints.command); ASSERT(t, !result.break_status.signal) << "Expected either SIGTRAP at $ip " << t->ip() << " or USER breakpoint just after it"; ASSERT(t, !result.break_status.singlestep_complete || constraints.is_singlestep()); check_approaching_ticks_target(t, constraints, result.break_status); result.did_fast_forward = did_fast_forward; return result; } result.did_fast_forward = did_fast_forward; switch (current_step.action) { case TSTEP_DETERMINISTIC_SIGNAL: case TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT: if (trace_frame.event().type() != EV_SEGV_RDTSC) { result.break_status.signal = current_step.target.signo; } if (constraints.is_singlestep()) { result.break_status.singlestep_complete = true; } break; case TSTEP_DELIVER_SIGNAL: // When we deliver a terminating signal, do not let the singlestep // complete; proceed on to report our synthetic SIGKILL or task death. if (constraints.is_singlestep() && !(trace_frame.event().type() == EV_SIGNAL_DELIVERY && is_fatal_default_action(current_step.target.signo))) { result.break_status.singlestep_complete = true; } break; case TSTEP_EXIT_TASK: result.break_status.task = nullptr; t = nullptr; assert(!result.break_status.any_break()); break; case TSTEP_ENTER_SYSCALL: cpuid_bug_detector.notify_reached_syscall_during_replay(t); break; default: break; } if (t) { const Event& ev = trace_frame.event(); if (done_initial_exec() && ev.is_syscall_event() && rr::Flags::get().check_cached_mmaps) { t->vm()->verify(t); } if (has_deterministic_ticks(ev, current_step)) { check_ticks_consistency(t, ev); } debug_memory(t); check_for_watchpoint_changes(t, result.break_status); check_approaching_ticks_target(t, constraints, result.break_status); } advance_to_next_trace_frame(); // Record that this step completed successfully. current_step.action = TSTEP_NONE; ReplayTask* next_task = current_task(); if (next_task && !next_task->vm()->first_run_event() && done_initial_exec()) { next_task->vm()->set_first_run_event(trace_frame.time()); } if (next_task) { ticks_at_start_of_event = next_task->tick_count(); } return result; } ReplayTask* ReplaySession::find_task(pid_t rec_tid) const { return static_cast(Session::find_task(rec_tid)); } ReplayTask* ReplaySession::find_task(const TaskUid& tuid) const { return static_cast(Session::find_task(tuid)); } } // namespace rr rr-4.4.0/src/ReplaySession.h000066400000000000000000000250701277367620400157240ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REPLAY_SESSION_H_ #define RR_REPLAY_SESSION_H_ #include #include #include "AddressSpace.h" #include "CPUIDBugDetector.h" #include "DiversionSession.h" #include "EmuFs.h" #include "Session.h" #include "Task.h" struct syscallbuf_hdr; namespace rr { class ReplayTask; /** * ReplayFlushBufferedSyscallState is saved in Session and cloned with its * Session, so it needs to be simple data, i.e. not holding pointers to * per-Session data. */ struct ReplayFlushBufferedSyscallState { /* An internal breakpoint is set at this address */ uintptr_t stop_breakpoint_addr; }; /** * Describes the next step to be taken in order to replay a trace * frame. */ enum ReplayTraceStepType { TSTEP_NONE, /* Enter/exit a syscall. |syscall| describe what should be * done at entry/exit. */ TSTEP_ENTER_SYSCALL, TSTEP_EXIT_SYSCALL, /* Advance to the deterministic signal |signo|. */ TSTEP_DETERMINISTIC_SIGNAL, /* Advance until |target.ticks| have been retired and then * |target.ip| is reached. */ TSTEP_PROGRAM_ASYNC_SIGNAL_INTERRUPT, /* Deliver signal |signo|. */ TSTEP_DELIVER_SIGNAL, /* Replay the upcoming buffered syscalls. |flush| tracks the * replay state.*/ TSTEP_FLUSH_SYSCALLBUF, /* Replay until we enter the next syscall, then patch it. */ TSTEP_PATCH_SYSCALL, /* Exit the task */ TSTEP_EXIT_TASK, /* Frame has been replayed, done. */ TSTEP_RETIRE, }; /** * rep_trace_step is saved in Session and cloned with its Session, so it needs * to be simple data, i.e. not holding pointers to per-Session data. */ struct ReplayTraceStep { ReplayTraceStepType action; union { struct { /* The syscall number we expect to * enter/exit. */ int number; } syscall; struct { Ticks ticks; int signo; } target; ReplayFlushBufferedSyscallState flush; }; }; enum ReplayStatus { // Some execution was replayed. replay_step() can be called again. REPLAY_CONTINUE, // All tracees are dead. replay_step() should not be called again. REPLAY_EXITED }; struct ReplayResult { ReplayResult(ReplayStatus status = REPLAY_CONTINUE) : status(status), did_fast_forward(false) {} ReplayStatus status; BreakStatus break_status; // True if we did a fast-forward operation, in which case // break_status.singlestep_complete might indicate the completion of more // than one instruction. bool did_fast_forward; }; /** * An indicator of how much progress the ReplaySession has made within a given * (TraceFrame::Time, Ticks) pair. These can only be used for comparisons, to * check whether two ReplaySessions are in the same state and to help * order their states temporally. */ class ReplayStepKey { public: /** * Construct the "none" key; this value is before or equal to every other * key value. */ ReplayStepKey() : action(TSTEP_NONE) {} explicit ReplayStepKey(ReplayTraceStepType action) : action(action) {} bool operator==(const ReplayStepKey& other) const { return action == other.action; } bool operator<(const ReplayStepKey& other) const { return action < other.action; } bool in_execution() const { return action != TSTEP_NONE; } int as_int() const { return (int)action; } private: ReplayTraceStepType action; }; /** Encapsulates additional session state related to replay. */ class ReplaySession : public Session { public: typedef std::shared_ptr shr_ptr; ~ReplaySession(); virtual Task* new_task(pid_t tid, pid_t rec_tid, uint32_t serial, SupportedArch a); using Session::clone; /** * Return a semantic copy of all the state managed by this, * that is the entire tracee tree and the state it depends on. * Any mutations of the returned Session can't affect the * state of this, and vice versa. * * This operation is also called "checkpointing" the replay * session. * * The returned clone is only partially initialized. This uses less * system resources than a fully-initialized session, so if you're going * to keep a session around inactive, keep the clone and not the original * session. Partially initialized sessions automatically finish * initializing when necessary. */ shr_ptr clone(); /** * Return true if we're in a state where it's OK to clone. For example, * we can't clone in some syscalls. */ bool can_clone(); /** * Like |clone()|, but return a session in "diversion" mode, * which allows free execution. */ DiversionSession::shr_ptr clone_diversion(); EmuFs& emufs() const { return *emu_fs; } TraceReader& trace_reader() { return trace_in; } const TraceReader& trace_reader() const { return trace_in; } /** * The trace record that we are working on --- the next event * for replay to reach. */ const TraceFrame& current_trace_frame() const { return trace_frame; } /** * The Task for the current trace record. */ ReplayTask* current_task() { finish_initializing(); return find_task(trace_frame.tid()); } ReplayTask* find_task(pid_t rec_tid) const; ReplayTask* find_task(const TaskUid& tuid) const; /** * Returns true if the next step for this session is to exit a syscall with * the given number. */ bool next_step_is_syscall_exit(int syscallno); /** * The current ReplayStepKey. */ ReplayStepKey current_step_key() const { return ReplayStepKey(current_step.action); } Ticks ticks_at_start_of_current_event() const { return ticks_at_start_of_event; } /** * Create a replay session that will use the trace directory specified * by 'dir', or the latest trace if 'dir' is not supplied. */ static shr_ptr create(const std::string& dir); struct StepConstraints { explicit StepConstraints(RunCommand command) : command(command), stop_at_time(0), ticks_target(0) {} RunCommand command; TraceFrame::Time stop_at_time; Ticks ticks_target; // When the RunCommand is RUN_SINGLESTEP_FAST_FORWARD, stop if the next // singlestep would enter one of the register states in this list. // RUN_SINGLESTEP_FAST_FORWARD will always singlestep at least once // regardless. std::vector stop_before_states; bool is_singlestep() const { return command == RUN_SINGLESTEP || command == RUN_SINGLESTEP_FAST_FORWARD; } }; /** * Take a single replay step. * Ensure we stop at event stop_at_time. If this is not specified, * optimizations may cause a replay_step to pass straight through * stop_at_time. * Outside of replay_step, no internal breakpoints will be set for any * task in this session. * Stop when the current event reaches stop_at_time (i.e. this event has * is the next event to be replayed). * If ticks_target is nonzero, stop before the current task's ticks * reaches ticks_target (but not too far before, unless we hit a breakpoint * or stop_at_time). Only useful for RUN_CONTINUE. * Always stops on a switch to a new task. */ ReplayResult replay_step(const StepConstraints& constraints); ReplayResult replay_step(RunCommand command) { return replay_step(StepConstraints(command)); } virtual ReplaySession* as_replay() { return this; } /** * Return true if |sig| is a signal that may be generated during * replay but should be ignored. For example, SIGCHLD can be * delivered at almost point during replay when tasks exit, but it's * not part of the recording and shouldn't be delivered. * * TODO: can we do some clever sigprocmask'ing to avoid pending * signals altogether? */ static bool is_ignored_signal(int sig); struct Flags { Flags() : redirect_stdio(false), share_private_mappings(false) {} Flags(const Flags& other) = default; bool redirect_stdio; bool share_private_mappings; }; bool redirect_stdio() { return flags.redirect_stdio; } bool share_private_mappings() { return flags.share_private_mappings; } void set_flags(const Flags& flags) { this->flags = flags; } typedef std::set MemoryRanges; /** * Returns an ordered set of MemoryRanges representing the address space * that is never allocated by any process in the whole lifetime of the trace. */ static MemoryRanges always_free_address_space(const TraceReader& reader); private: ReplaySession(const std::string& dir); ReplaySession(const ReplaySession& other); ReplayTask* revive_task_for_exec(); ReplayTask* setup_replay_one_trace_frame(ReplayTask* t); void advance_to_next_trace_frame(); Completion emulate_signal_delivery(ReplayTask* oldtask, int sig); Completion try_one_trace_step(ReplayTask* t, const StepConstraints& step_constraints); Completion cont_syscall_boundary(ReplayTask* t, const StepConstraints& constraints); Completion enter_syscall(ReplayTask* t, const StepConstraints& constraints); Completion exit_syscall(ReplayTask* t); Completion exit_task(ReplayTask* t); void check_ticks_consistency(ReplayTask* t, const Event& ev); void check_pending_sig(ReplayTask* t); void continue_or_step(ReplayTask* t, const StepConstraints& constraints, TicksRequest tick_request, ResumeRequest resume_how = RESUME_SYSEMU); Completion advance_to_ticks_target(ReplayTask* t, const StepConstraints& constraints); Completion emulate_deterministic_signal(ReplayTask* t, int sig, const StepConstraints& constraints); Completion emulate_async_signal(ReplayTask* t, const StepConstraints& constraints, Ticks ticks); void prepare_syscallbuf_records(ReplayTask* t); Completion flush_syscallbuf(ReplayTask* t, const StepConstraints& constraints); Completion patch_next_syscall(ReplayTask* t, const StepConstraints& constraints); void check_approaching_ticks_target(ReplayTask* t, const StepConstraints& constraints, BreakStatus& break_status); void clear_syscall_bp(); std::shared_ptr emu_fs; TraceReader trace_in; TraceFrame trace_frame; ReplayTraceStep current_step; Ticks ticks_at_start_of_event; CPUIDBugDetector cpuid_bug_detector; Flags flags; bool did_fast_forward; std::shared_ptr syscall_bp_vm; remote_code_ptr syscall_bp_addr; }; } // namespace rr #endif // RR_REPLAY_SESSION_H_ rr-4.4.0/src/ReplayTask.cc000066400000000000000000000127201277367620400153370ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ReplayTask.h" #include "AutoRemoteSyscalls.h" #include "PreserveFileMonitor.h" #include "ReplaySession.h" #include "log.h" #include "rr/rr.h" using namespace std; namespace rr { ReplayTask::ReplayTask(ReplaySession& session, pid_t _tid, pid_t _rec_tid, uint32_t serial, SupportedArch a) : Task(session, _tid, _rec_tid, serial, a) {} ReplaySession& ReplayTask::session() const { return *Task::session().as_replay(); } TraceReader& ReplayTask::trace_reader() const { return session().trace_reader(); } template void ReplayTask::init_buffers_arch(remote_ptr map_hint) { apply_all_data_records_from_trace(); AutoRemoteSyscalls remote(this); remote_ptr> child_args = regs().arg1(); auto args = read_mem(child_args); if (args.syscallbuf_ptr) { syscallbuf_size = args.syscallbuf_size; init_syscall_buffer(remote, map_hint); desched_fd_child = args.desched_counter_fd; // Prevent the child from closing this fd fds->add_monitor(desched_fd_child, new PreserveFileMonitor()); // Skip mmap record. It exists mainly to inform non-replay code // (e.g. RemixModule) that this memory will be mapped. trace_reader().read_mapped_region(); if (args.cloned_file_data_fd >= 0) { cloned_file_data_fd_child = args.cloned_file_data_fd; string clone_file_name = trace_reader().file_data_clone_file_name(tuid()); AutoRestoreMem name(remote, clone_file_name.c_str()); int fd = remote.infallible_syscall(syscall_number_for_openat(arch()), RR_RESERVED_ROOT_DIR_FD, name.get(), O_RDONLY | O_CLOEXEC); if (fd != cloned_file_data_fd_child) { long ret = remote.infallible_syscall(syscall_number_for_dup3(arch()), fd, cloned_file_data_fd_child, O_CLOEXEC); ASSERT(this, ret == cloned_file_data_fd_child); remote.infallible_syscall(syscall_number_for_close(arch()), fd); } fds->add_monitor(cloned_file_data_fd_child, new PreserveFileMonitor()); } } remote.regs().set_syscall_result(syscallbuf_child); } void ReplayTask::init_buffers(remote_ptr map_hint) { RR_ARCH_FUNCTION(init_buffers_arch, arch(), map_hint); } void ReplayTask::post_exec_syscall(const string& replay_exe, TraceTaskEvent& tte) { Task::post_exec(current_trace_frame().regs().arch(), replay_exe); // Perform post-exec-syscall tasks now (e.g. opening mem_fd) before we // switch registers. This lets us perform AutoRemoteSyscalls using the // regular stack instead of having to search the address space for usable // pages (which is error prone, e.g. if we happen to find the scratch space // allocated by an rr recorder under which we're running). Task::post_exec_syscall(tte); // Delay setting the replay_regs until here so the original registers // are set while we populate AddressSpace. We need that for the kernel // to identify the original stack region correctly. registers = current_trace_frame().regs(); extra_registers = current_trace_frame().extra_regs(); ASSERT(this, !extra_registers.empty()); set_regs(registers); set_extra_regs(extra_registers); } void ReplayTask::validate_regs(uint32_t flags) { /* don't validate anything before execve is done as the actual * process did not start prior to this point */ if (!session().done_initial_exec()) { return; } Registers rec_regs = current_trace_frame().regs(); if (flags & IGNORE_ESI) { if (regs().arg4() != rec_regs.arg4()) { LOG(warn) << "Probably saw kernel bug mutating $esi across pread/write64 " "call: recorded:" << HEX(rec_regs.arg4()) << "; replaying:" << regs().arg4() << ". Fudging registers."; rec_regs.set_arg4(regs().arg4()); } } /* TODO: add perf counter validations (hw int, page faults, insts) */ Registers::compare_register_files(this, "replaying", regs(), "recorded", rec_regs, BAIL_ON_MISMATCH); } const TraceFrame& ReplayTask::current_trace_frame() { return session().current_trace_frame(); } ssize_t ReplayTask::set_data_from_trace() { auto buf = trace_reader().read_raw_data(); if (!buf.addr.is_null() && buf.data.size() > 0) { auto t = session().find_task(buf.rec_tid); t->write_bytes_helper(buf.addr, buf.data.size(), buf.data.data()); } return buf.data.size(); } void ReplayTask::apply_all_data_records_from_trace() { TraceReader::RawData buf; while (trace_reader().read_raw_data_for_frame(current_trace_frame(), buf)) { if (!buf.addr.is_null() && buf.data.size() > 0) { auto t = session().find_task(buf.rec_tid); t->write_bytes_helper(buf.addr, buf.data.size(), buf.data.data()); } } } void ReplayTask::set_return_value_from_trace() { Registers r = regs(); r.set_syscall_result(current_trace_frame().regs().syscall_result()); // In some cases (e.g. syscalls forced to return an error by tracee // seccomp filters) we need to emulate a change to the original_syscallno // (to -1 in that case). r.set_original_syscallno(current_trace_frame().regs().original_syscallno()); set_regs(r); } void ReplayTask::set_real_tid_and_update_serial(pid_t tid) { hpc.set_tid(tid); this->tid = tid; serial = session().next_task_serial(); } } // namespace rr rr-4.4.0/src/ReplayTask.h000066400000000000000000000045511277367620400152040ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REPLAY_TASK_H_ #define RR_REPLAY_TASK_H_ #include "Task.h" namespace rr { class TraceFrame; /** * Every Task owned by a ReplaySession is a ReplayTask. Functionality that * only applies during replay belongs here. */ class ReplayTask : public Task { public: ReplayTask(ReplaySession& session, pid_t _tid, pid_t _rec_tid, uint32_t serial, SupportedArch a); ReplaySession& session() const; TraceReader& trace_reader() const; /** * Initialize tracee buffers in this, i.e., implement * RRCALL_init_syscall_buffer. This task must be at the point * of *exit from* the rrcall. Registers will be updated with * the return value from the rrcall, which is also returned * from this call. |map_hint| suggests where to map the * region; see |init_syscallbuf_buffer()|. */ void init_buffers(remote_ptr map_hint); /** * Call this method when the exec has completed. */ void post_exec_syscall(const std::string& replay_exe, TraceTaskEvent& tte); enum { /* The x86 linux 3.5.0-36 kernel packaged with Ubuntu * 12.04 has been observed to mutate $esi across * syscall entry/exit. (This has been verified * outside of rr as well; not an rr bug.) It's not * clear whether this is a ptrace bug or a kernel bug, * but either way it's not supposed to happen. So we * allow validate_args to cover up that bug. */ IGNORE_ESI = 0x01 }; /** Assert that the current register values match the values in the * current trace record. */ void validate_regs(uint32_t flags = 0); const TraceFrame& current_trace_frame(); /** Restore the next chunk of saved data from the trace to this. */ ssize_t set_data_from_trace(); /** Restore all remaining chunks of saved data for the current trace frame. */ void apply_all_data_records_from_trace(); /** * Set the syscall-return-value register of this to what was * saved in the current trace frame. */ void set_return_value_from_trace(); /** * Used when an execve changes the tid of a non-main-thread to the * thread-group leader. */ void set_real_tid_and_update_serial(pid_t tid); private: template void init_buffers_arch(remote_ptr map_hint); ~ReplayTask() {} }; } // namespace rr #endif /* RR_REPLAY_TASK_H_ */ rr-4.4.0/src/ReplayTimeline.cc000066400000000000000000001565631277367620400162210ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ReplayTimeline.h" #include #include "fast_forward.h" #include "log.h" using namespace std; namespace rr { ReplayTimeline::InternalMark::~InternalMark() { if (owner && checkpoint) { owner->remove_mark_with_checkpoint(proto.key); } } ostream& operator<<(ostream& s, const ReplayTimeline::MarkKey& o) { return s << "time:" << o.trace_time << ",ticks:" << o.ticks << ",st:" << o.step_key.as_int(); } ostream& operator<<(ostream& s, const ReplayTimeline::InternalMark& o) { return s << o.proto; } ostream& operator<<(ostream& s, const ReplayTimeline::Mark& o) { if (!o.ptr) { return s << "{null}"; } return s << *o.ptr.get(); } ostream& operator<<(ostream& s, const ReplayTimeline::ProtoMark& o) { return s << "{" << o.key << ",regs_ip:" << o.regs.ip() << "}"; } bool ReplayTimeline::less_than(const Mark& m1, const Mark& m2) { assert(m1.ptr->owner == m2.ptr->owner); if (m1.ptr->proto.key < m2.ptr->proto.key) { return true; } if (m2.ptr->proto.key < m1.ptr->proto.key) { return false; } if (!m1.ptr->owner) { return false; } for (shared_ptr& m : m1.ptr->owner->marks[m1.ptr->proto.key]) { if (m == m2.ptr) { return false; } if (m == m1.ptr) { return true; } } assert(0 && "Marks missing from vector, invariants broken!"); return false; } ReplayTimeline::ReplayTimeline(std::shared_ptr session, const ReplaySession::Flags& session_flags) : session_flags(session_flags), current(std::move(session)), breakpoints_applied(false), reverse_execution_barrier_event(0) { current->set_visible_execution(false); current->set_flags(session_flags); } ReplayTimeline::~ReplayTimeline() { for (auto it : marks) { for (shared_ptr& itv : it.second) { itv->owner = nullptr; itv->checkpoint = nullptr; } } } static bool equal_regs(const Registers& r1, const Registers& r2) { // Compare ip()s first since they will usually fail to match, especially // when we're comparing InternalMarks with the same MarkKey return r1.ip() == r2.ip() && r1.matches(r2); } bool ReplayTimeline::InternalMark::equal_states(ReplaySession& session) const { return proto.equal_states(session); } bool ReplayTimeline::ProtoMark::equal_states(ReplaySession& session) const { if (session_mark_key(session) != key) { return false; } ReplayTask* t = session.current_task(); return equal_regs(regs, t->regs()) && return_addresses == ReturnAddressList(t); } ReplayTimeline::ProtoMark ReplayTimeline::proto_mark() const { return ProtoMark(current_mark_key(), current->current_task()); } shared_ptr ReplayTimeline::current_mark() { auto it = marks.find(current_mark_key()); // Avoid creating an entry in 'marks' if it doesn't already exist if (it != marks.end()) { for (shared_ptr& m : it->second) { if (m->equal_states(*current)) { return m; } } } return shared_ptr(); } ReplayTimeline::Mark ReplayTimeline::mark() { Mark result; auto cm = current_mark(); if (cm) { swap(cm, result.ptr); return result; } MarkKey key = current_mark_key(); shared_ptr m = make_shared(this, *current, key); auto& mark_vector = marks[key]; if (mark_vector.empty()) { mark_vector.push_back(m); } else if (mark_vector[mark_vector.size() - 1] == current_at_or_after_mark) { mark_vector.push_back(m); } else { // Now the hard part: figuring out where to put it in the list of existing // marks. unapply_breakpoints_and_watchpoints(); ReplaySession::shr_ptr tmp_session = current->clone(); vector>::iterator mark_index = mark_vector.end(); // We could set breakpoints at the marks and then continue with an // interrupt set to fire when our tick-count increases. But that requires // new replay functionality (probably a new RunCommand), so for now, do the // simplest thing and just single-step until we find where to put the new // mark(s). vector> new_marks; new_marks.push_back(m); LOG(debug) << "mark() replaying to find mark location"; // Allow coalescing of multiple repetitions of a single x86 string // instruction (as long as we don't reach one of our mark_vector states). ReplaySession::StepConstraints constraints(RUN_SINGLESTEP_FAST_FORWARD); for (auto& mv : mark_vector) { constraints.stop_before_states.push_back(&mv->proto.regs); } while (true) { auto result = tmp_session->replay_step(constraints); if (session_mark_key(*tmp_session) != key || result.status != REPLAY_CONTINUE) { break; } if (!result.break_status.singlestep_complete) { continue; } for (auto it = mark_vector.begin(); it != mark_vector.end(); ++it) { shared_ptr& existing_mark = *it; if (existing_mark->equal_states(*tmp_session)) { if (!result.did_fast_forward && !result.break_status.signal) { new_marks.back()->singlestep_to_next_mark_no_signal = true; } mark_index = it; break; } } if (mark_index != mark_vector.end()) { break; } // Some callers singlestep through N instructions, all with the same // MarkKey, requesting a Mark after each step. If there's a Mark at the // end of the N instructions, this could mean N(N+1)/2 singlestep // operations total. To avoid that, add all the intermediate states to // the mark map now, so the first mark() call will perform N singlesteps // and the rest will perform none. if (!result.did_fast_forward && !result.break_status.signal) { new_marks.back()->singlestep_to_next_mark_no_signal = true; } new_marks.push_back(make_shared(this, *tmp_session, key)); } LOG(debug) << "Mark location found"; // mark_index is the current index of the next mark after 'current'. So // insert our new marks at mark_index. mark_vector.insert(mark_index, new_marks.begin(), new_marks.end()); } swap(m, result.ptr); current_at_or_after_mark = result.ptr; return result; } void ReplayTimeline::mark_after_singlestep(const Mark& from, const ReplayResult& result) { Mark m = mark(); if (!result.did_fast_forward && m.ptr->proto.key == from.ptr->proto.key && !result.break_status.signal) { auto& mark_vector = marks[m.ptr->proto.key]; for (size_t i = 0; i < mark_vector.size(); ++i) { if (mark_vector[i] == from.ptr) { assert(i + 1 < mark_vector.size() && mark_vector[i + 1] == m.ptr); break; } } from.ptr->singlestep_to_next_mark_no_signal = true; } } ReplayTimeline::Mark ReplayTimeline::find_singlestep_before(const Mark& mark) { auto& mark_vector = marks[mark.ptr->proto.key]; ssize_t i; for (i = mark_vector.size() - 1; i >= 0; --i) { if (mark_vector[i] == mark.ptr) { break; } } assert(i >= 0 && "Mark not in vector???"); Mark m; if (i == 0) { return m; } if (!mark_vector[i - 1]->singlestep_to_next_mark_no_signal) { return m; } m.ptr = mark_vector[i - 1]; return m; } ReplayTimeline::Mark ReplayTimeline::lazy_reverse_singlestep(const Mark& from, ReplayTask* t) { if (!no_watchpoints_hit_interval_start || !no_watchpoints_hit_interval_end) { return Mark(); } Mark m = find_singlestep_before(from); if (m && m >= no_watchpoints_hit_interval_start && m < no_watchpoints_hit_interval_end && !has_breakpoint_at_address(t, from.ptr->proto.regs.ip())) { return m; } return Mark(); } ReplayTimeline::Mark ReplayTimeline::add_explicit_checkpoint() { assert(current->can_clone()); Mark m = mark(); if (!m.ptr->checkpoint) { unapply_breakpoints_and_watchpoints(); m.ptr->checkpoint = current->clone(); auto key = m.ptr->proto.key; if (marks_with_checkpoints.find(key) == marks_with_checkpoints.end()) { marks_with_checkpoints[key] = 1; } else { marks_with_checkpoints[key]++; } } ++m.ptr->checkpoint_refcount; return m; } void ReplayTimeline::remove_mark_with_checkpoint(const MarkKey& key) { assert(marks_with_checkpoints[key] > 0); if (--marks_with_checkpoints[key] == 0) { marks_with_checkpoints.erase(key); } } void ReplayTimeline::remove_explicit_checkpoint(const Mark& mark) { assert(mark.ptr->checkpoint_refcount > 0); if (--mark.ptr->checkpoint_refcount == 0) { mark.ptr->checkpoint = nullptr; remove_mark_with_checkpoint(mark.ptr->proto.key); } } void ReplayTimeline::seek_to_before_key(const MarkKey& key) { auto it = marks_with_checkpoints.lower_bound(key); // 'it' points to the first value equivalent to or greater than 'key'. auto current_key = current_mark_key(); if (it == marks_with_checkpoints.begin()) { if (current_key < key) { // We can use the current session, so do nothing. } else { // nowhere earlier to go, so restart from beginning. current = ReplaySession::create(current->trace_reader().dir()); breakpoints_applied = false; current_at_or_after_mark = nullptr; current->set_flags(session_flags); } } else { --it; // 'it' is now at the last checkpoint before 'key' if (it->first < current_key && current_key < key) { // Current state is closer to the destination than any checkpoint we // have, so do nothing. } else { // Return one of the checkpoints at *it. current = nullptr; for (auto mark_it : marks[it->first]) { shared_ptr m(mark_it); if (m->checkpoint) { current = m->checkpoint->clone(); // At this point, m->checkpoint is fully initialized but current // is not. Swap them so that m->checkpoint is not fully // initialized, to reduce resource usage. swap(current, m->checkpoint); break; } } assert(current); breakpoints_applied = false; current_at_or_after_mark = nullptr; } } } void ReplayTimeline::seek_up_to_mark(const Mark& mark) { if (current_mark_key() == mark.ptr->proto.key) { Mark cm = this->mark(); if (cm <= mark) { // close enough, stay where we are return; } } // Check if any of the marks with the same key as 'mark', but not after // 'mark', are usable. auto& mark_vector = marks[mark.ptr->proto.key]; bool at_or_before_mark = false; for (ssize_t i = mark_vector.size() - 1; i >= 0; --i) { auto& m = mark_vector[i]; if (m == mark.ptr) { at_or_before_mark = true; } if (at_or_before_mark && m->checkpoint) { current = m->checkpoint->clone(); // At this point, m->checkpoint is fully initialized but current // is not. Swap them so that m->checkpoint is not fully // initialized, to reduce resource usage. swap(current, m->checkpoint); breakpoints_applied = false; current_at_or_after_mark = m; return; } } return seek_to_before_key(mark.ptr->proto.key); } ReplaySession::StepConstraints ReplayTimeline::ReplayStepToMarkStrategy::setup_step_constraints() { ReplaySession::StepConstraints constraints(RUN_CONTINUE); if (singlesteps_to_perform > 0) { constraints.command = RUN_SINGLESTEP_FAST_FORWARD; --singlesteps_to_perform; } return constraints; } void ReplayTimeline::update_strategy_and_fix_watchpoint_quirk( ReplayStepToMarkStrategy& strategy, const ReplaySession::StepConstraints& constraints, ReplayResult& result, const ProtoMark& before) { if (constraints.command == RUN_CONTINUE && fix_watchpoint_coalescing_quirk(result, before)) { // It's quite common for x86 string instructions to trigger the same // watchpoint several times in consecutive instructions, e.g. if we're // doing a "rep movsb" over an 8-byte watchpoint. 8 invocations of // fix_watchpoint_coalescing_quirk could require 8 replays from some // previous checkpoint. To avoid that, after // fix_watchpoint_coalescing_quirk has fired once, singlestep the // next 7 times. strategy.singlesteps_to_perform = 7; } } ReplayResult ReplayTimeline::replay_step_to_mark( const Mark& mark, ReplayStepToMarkStrategy& strategy) { ProtoMark before = proto_mark(); ReplayResult result; if (current->trace_reader().time() < mark.ptr->proto.key.trace_time) { // Easy case: each RUN_CONTINUE can only advance by at most one // trace event, so do one. But do a singlestep if our strategy suggests // we should. ReplaySession::StepConstraints constraints = strategy.setup_step_constraints(); constraints.stop_at_time = mark.ptr->proto.key.trace_time; result = current->replay_step(constraints); update_strategy_and_fix_watchpoint_quirk(strategy, constraints, result, before); return result; } ReplayTask* t = current->current_task(); ASSERT(t, current->trace_reader().time() == mark.ptr->proto.key.trace_time); // t must remain valid through here since t can only die when we complete // an event, and we're not going to complete another event before // reaching the mark ... apart from where we call // fix_watchpoint_coalescing_quirk. if (t->tick_count() < mark.ptr->proto.key.ticks) { // Try to make progress by just continuing with a ticks constraint // set to stop us before the mark. This is efficient in the worst case, // when we must execute lots of instructions to reach the mark. ReplaySession::StepConstraints constraints = strategy.setup_step_constraints(); constraints.ticks_target = mark.ptr->proto.key.ticks - 1; result = current->replay_step(constraints); bool approaching_ticks_target = result.break_status.approaching_ticks_target; result.break_status.approaching_ticks_target = false; // We can't be at the mark yet. ASSERT(t, t->tick_count() < mark.ptr->proto.key.ticks); // If there's a break indicated, we should return that to the // caller without doing any more work if (!approaching_ticks_target || result.break_status.any_break()) { update_strategy_and_fix_watchpoint_quirk(strategy, constraints, result, before); return result; } // We may not have made any progress so we'll need to try another strategy } remote_code_ptr mark_addr_code = mark.ptr->proto.regs.ip(); remote_ptr mark_addr = mark_addr_code.to_data_ptr(); // Try adding a breakpoint at the required IP and running to it. // We can't do this if we're currently at the IP, since we'd make no progress. // However, we need to be careful, since there are two related situations when // the instruction at the mark ip is never actually executed. The first // happens if the IP is invalid entirely, the second if it is valid, but // not executable. In either case we need to fall back to the (slower, but // more generic) code below. if (t->regs().ip() != mark_addr_code && t->vm()->has_mapping(mark_addr) && (t->vm()->mapping_of(mark_addr).map.prot() & PROT_EXEC)) { bool succeeded = t->vm()->add_breakpoint(mark_addr_code, BKPT_USER); ASSERT(t, succeeded); ReplaySession::StepConstraints constraints = strategy.setup_step_constraints(); result = current->replay_step(constraints); t->vm()->remove_breakpoint(mark_addr_code, BKPT_USER); // If we hit our breakpoint and there is no client breakpoint there, // pretend we didn't hit it. if (result.break_status.breakpoint_hit && !has_breakpoint_at_address(t, t->ip())) { result.break_status.breakpoint_hit = false; } update_strategy_and_fix_watchpoint_quirk(strategy, constraints, result, before); return result; } // At required IP, but not in the correct state. Singlestep over this IP. // We need the FAST_FORWARD option in case the mark state occurs after // many iterations of a string instruction at this address. ReplaySession::StepConstraints constraints(RUN_SINGLESTEP_FAST_FORWARD); // We don't want to fast-forward past the mark state, so give the mark // state as a state we should stop before. FAST_FORWARD always does at // least one singlestep so one call to replay_step_to_mark will fast-forward // to the state before the mark and return, then the next call to // replay_step_to_mark will singlestep into the mark state. constraints.stop_before_states.push_back(&mark.ptr->proto.regs); result = current->replay_step(constraints); // Hide internal singlestep but preserve other break statuses result.break_status.singlestep_complete = false; return result; } void ReplayTimeline::seek_to_proto_mark(const ProtoMark& pmark) { seek_to_before_key(pmark.key); unapply_breakpoints_and_watchpoints(); while (!pmark.equal_states(*current)) { if (current->trace_reader().time() < pmark.key.trace_time) { ReplaySession::StepConstraints constraints(RUN_CONTINUE); constraints.stop_at_time = pmark.key.trace_time; current->replay_step(constraints); } else { ReplayTask* t = current->current_task(); remote_code_ptr mark_addr = pmark.regs.ip(); if (t->regs().ip() == mark_addr && current->current_step_key().in_execution()) { // At required IP, but not in the correct state. Singlestep over // this IP. ReplaySession::StepConstraints constraints(RUN_SINGLESTEP_FAST_FORWARD); constraints.stop_before_states.push_back(&pmark.regs); current->replay_step(constraints); } else { // Get a shared reference to t->vm() in case t dies during replay_step shared_ptr vm = t->vm(); vm->add_breakpoint(mark_addr, BKPT_USER); current->replay_step(RUN_CONTINUE); vm->remove_breakpoint(mark_addr, BKPT_USER); } } } } void ReplayTimeline::seek_to_mark(const Mark& mark) { seek_up_to_mark(mark); while (current_mark() != mark.ptr) { unapply_breakpoints_and_watchpoints(); ReplayStepToMarkStrategy strategy; replay_step_to_mark(mark, strategy); } current_at_or_after_mark = mark.ptr; // XXX handle cases where breakpoints can't yet be applied } /** * Intel CPUs (and maybe others) coalesce iterations of REP-prefixed string * instructions so that a watchpoint on a byte at location L can fire after * the iteration that writes byte L+63 (or possibly more?). * This causes problems for rr since this coalescing doesn't happen when we * single-step. * This function is called after doing a ReplaySession::replay_step with * command == RUN_CONTINUE. RUN_SINGLESTEP and RUN_SINGLESTEP_FAST_FORWARD * disable this coalescing (the latter, because it's aware of watchpoints * and single-steps when it gets too close to them). * |before| is the state before we did the replay_step. * If a watchpoint fired, and it looks like it could have fired during a * string instruction, we'll backup to |before| and replay forward, stopping * before the breakpoint could fire and single-stepping to make sure the * coalescing quirk doesn't happen. * Returns true if we might have fixed something. */ bool ReplayTimeline::fix_watchpoint_coalescing_quirk(ReplayResult& result, const ProtoMark& before) { if (result.status == REPLAY_EXITED || result.break_status.watchpoints_hit.empty()) { // no watchpoint hit. Nothing to fix. return false; } if (!maybe_at_or_after_x86_string_instruction(result.break_status.task)) { return false; } TaskUid after_tuid = result.break_status.task->tuid(); Ticks after_ticks = result.break_status.task->tick_count(); LOG(debug) << "Fixing x86-string coalescing quirk from " << before << " to " << proto_mark() << " (final cx " << result.break_status.task->regs().cx() << ")"; seek_to_proto_mark(before); // Keep going until the watchpoint fires. It will either fire early, or at // the same time as some other break. apply_breakpoints_and_watchpoints(); bool approaching_ticks_target = false; while (true) { ReplayTask* t = current->current_task(); if (t->tuid() == after_tuid) { if (approaching_ticks_target) { // We don't need to set any stop_before_states here. // RUN_SINGLESTEP_FAST_FORWARD always avoids the coalescing quirk, so // if a watchpoint is triggered by the string instruction at // string_instruction_ip, it will have the correct timing. result = current->replay_step(RUN_SINGLESTEP_FAST_FORWARD); if (!result.break_status.watchpoints_hit.empty()) { LOG(debug) << "Fixed x86-string coalescing quirk; now at " << current_mark_key() << " (new cx " << result.break_status.task->regs().cx() << ")"; break; } } else { ReplaySession::StepConstraints constraints(RUN_CONTINUE); constraints.ticks_target = after_ticks - 1; result = current->replay_step(constraints); approaching_ticks_target = result.break_status.approaching_ticks_target; } ASSERT(t, t->tick_count() <= after_ticks) << "We went too far!"; } else { current->replay_step(RUN_CONTINUE); } } return true; } bool ReplayTimeline::add_breakpoint( ReplayTask* t, remote_code_ptr addr, std::unique_ptr condition) { if (has_breakpoint_at_address(t, addr)) { remove_breakpoint(t, addr); } // Apply breakpoints now; we need to actually try adding this breakpoint // to see if it works. apply_breakpoints_and_watchpoints(); if (!t->vm()->add_breakpoint(addr, BKPT_USER)) { return false; } breakpoints.insert(make_tuple(t->vm()->uid(), addr, move(condition))); return true; } void ReplayTimeline::remove_breakpoint(ReplayTask* t, remote_code_ptr addr) { if (breakpoints_applied) { t->vm()->remove_breakpoint(addr, BKPT_USER); } ASSERT(t, has_breakpoint_at_address(t, addr)); auto it = breakpoints.lower_bound(make_tuple(t->vm()->uid(), addr, nullptr)); breakpoints.erase(it); } bool ReplayTimeline::has_breakpoint_at_address(ReplayTask* t, remote_code_ptr addr) { auto it = breakpoints.lower_bound(make_tuple(t->vm()->uid(), addr, nullptr)); return it != breakpoints.end() && get<0>(*it) == t->vm()->uid() && get<1>(*it) == addr; } bool ReplayTimeline::add_watchpoint(ReplayTask* t, remote_ptr addr, size_t num_bytes, WatchType type, unique_ptr condition) { if (has_watchpoint_at_address(t, addr, num_bytes, type)) { remove_watchpoint(t, addr, num_bytes, type); } // Apply breakpoints now; we need to actually try adding this breakpoint // to see if it works. apply_breakpoints_and_watchpoints(); if (!t->vm()->add_watchpoint(addr, num_bytes, type)) { return false; } watchpoints.insert( make_tuple(t->vm()->uid(), addr, num_bytes, type, move(condition))); no_watchpoints_hit_interval_start = no_watchpoints_hit_interval_start = Mark(); return true; } void ReplayTimeline::remove_watchpoint(ReplayTask* t, remote_ptr addr, size_t num_bytes, WatchType type) { if (breakpoints_applied) { t->vm()->remove_watchpoint(addr, num_bytes, type); } ASSERT(t, has_watchpoint_at_address(t, addr, num_bytes, type)); auto it = watchpoints.lower_bound( make_tuple(t->vm()->uid(), addr, num_bytes, type, nullptr)); watchpoints.erase(it); } bool ReplayTimeline::has_watchpoint_at_address(ReplayTask* t, remote_ptr addr, size_t num_bytes, WatchType type) { auto it = watchpoints.lower_bound( make_tuple(t->vm()->uid(), addr, num_bytes, type, nullptr)); return it != watchpoints.end() && get<0>(*it) == t->vm()->uid() && get<1>(*it) == addr && get<2>(*it) == num_bytes && get<3>(*it) == type; } void ReplayTimeline::remove_breakpoints_and_watchpoints() { unapply_breakpoints_and_watchpoints(); breakpoints.clear(); watchpoints.clear(); } void ReplayTimeline::apply_breakpoints_internal() { for (auto& bp : breakpoints) { AddressSpace* vm = current->find_address_space(get<0>(bp)); // XXX handle cases where we can't apply a breakpoint right now. Later // during replay the address space might be created (or new mappings might // be created) and we should reapply breakpoints then. if (vm) { vm->add_breakpoint(get<1>(bp), BKPT_USER); } } } void ReplayTimeline::apply_breakpoints_and_watchpoints() { if (breakpoints_applied) { return; } breakpoints_applied = true; apply_breakpoints_internal(); for (auto& wp : watchpoints) { AddressSpace* vm = current->find_address_space(get<0>(wp)); // XXX handle cases where we can't apply a watchpoint right now. Later // during replay the address space might be created (or new mappings might // be created) and we should reapply watchpoints then. // XXX we could make this more efficient by providing a method to set // several watchpoints at once on a given AddressSpace. if (vm) { vm->add_watchpoint(get<1>(wp), get<2>(wp), get<3>(wp)); } } } void ReplayTimeline::unapply_breakpoints_internal() { for (auto& bp : breakpoints) { AddressSpace* vm = current->find_address_space(get<0>(bp)); if (vm) { vm->remove_breakpoint(get<1>(bp), BKPT_USER); } } } void ReplayTimeline::unapply_breakpoints_and_watchpoints() { if (!breakpoints_applied) { return; } breakpoints_applied = false; unapply_breakpoints_internal(); for (auto& wp : watchpoints) { AddressSpace* vm = current->find_address_space(get<0>(wp)); if (vm) { vm->remove_watchpoint(get<1>(wp), get<2>(wp), get<3>(wp)); } } } ReplayResult ReplayTimeline::singlestep_with_breakpoints_disabled() { apply_breakpoints_and_watchpoints(); unapply_breakpoints_internal(); auto result = current->replay_step(RUN_SINGLESTEP); apply_breakpoints_internal(); return result; } bool ReplayTimeline::is_start_of_reverse_execution_barrier_event() { if (current->trace_reader().time() != reverse_execution_barrier_event || current->current_step_key().in_execution()) { return false; } LOG(debug) << "Found reverse execution barrier at " << mark(); return true; } bool ReplayTimeline::run_forward_to_intermediate_point(const Mark& end, ForceProgress force) { unapply_breakpoints_and_watchpoints(); LOG(debug) << "Trying to find intermediate point between " << current_mark_key() << " and " << end << (force == FORCE_PROGRESS ? " (forced)" : ""); TraceFrame::Time now = current->trace_reader().time(); TraceFrame::Time mid = (now + end.ptr->proto.key.trace_time) / 2; if (now < mid && mid < end.ptr->proto.key.trace_time) { ReplaySession::StepConstraints constraints(RUN_CONTINUE); constraints.stop_at_time = mid; while (current->trace_reader().time() < mid) { current->replay_step(constraints); } assert(current->trace_reader().time() == mid); LOG(debug) << "Ran forward to mid event " << current_mark_key(); return true; } if (current->trace_reader().time() < end.ptr->proto.key.trace_time && end.ptr->ticks_at_event_start < end.ptr->proto.key.ticks) { ReplaySession::StepConstraints constraints(RUN_CONTINUE); constraints.stop_at_time = end.ptr->proto.key.trace_time; while (current->trace_reader().time() < end.ptr->proto.key.trace_time) { current->replay_step(constraints); } assert(current->trace_reader().time() == end.ptr->proto.key.trace_time); LOG(debug) << "Ran forward to event " << current_mark_key(); return true; } ReplayTask* t = current->current_task(); if (t) { Ticks start_ticks = t->tick_count(); Ticks end_ticks = current->current_trace_frame().ticks(); if (end.ptr->proto.key.trace_time == current->trace_reader().time()) { end_ticks = min(end_ticks, end.ptr->proto.key.ticks); } ASSERT(t, start_ticks <= end_ticks); Ticks target = min(end_ticks, (start_ticks + end_ticks) / 2); ReplaySession::StepConstraints constraints(RUN_CONTINUE); constraints.ticks_target = target; ProtoMark m = proto_mark(); ReplayResult result = current->replay_step(constraints); if (m.equal_states(*current)) { assert(result.break_status.approaching_ticks_target); assert(t->tick_count() == start_ticks); // We didn't make any progress that way. // Normally we should just give up now and let reverse_continue keep // running and hitting breakpoints etc since we're pretty close to the // target already and the overhead of what we have to do here otherwise // can be high. But there's a pathological case where reverse_continue // is hitting a breakpoint on each iteration of a string instruction. // If that's happening then we will be told to force progress. if (force == FORCE_PROGRESS) { // Let's try a fast-forward singlestep to jump over an x86 string // instruction that may be triggering a lot of breakpoint hits. Make // sure // we stop before |end|. ReplaySession::shr_ptr tmp_session; if (start_ticks + 1 >= end_ticks) { // This singlestep operation might leave us at |end|, which is not // allowed. So make a backup of the current state. tmp_session = current->clone(); LOG(debug) << "Created backup tmp_session"; } constraints = ReplaySession::StepConstraints(RUN_SINGLESTEP_FAST_FORWARD); constraints.stop_before_states.push_back(&end.ptr->proto.regs); result = current->replay_step(constraints); if (at_mark(end)) { assert(tmp_session); current = move(tmp_session); LOG(debug) << "Singlestepping arrived at |end|, restoring session"; } else if (!m.equal_states(*current)) { LOG(debug) << "Did fast-singlestep forward to " << current_mark_key(); return true; } } } else { while (t->tick_count() < target && !result.break_status.approaching_ticks_target) { result = current->replay_step(constraints); } LOG(debug) << "Ran forward to " << current_mark_key(); return true; } } LOG(debug) << "Made no progress"; return false; } /** * Don't allow more than this number of breakpoint/watchpoint stops * in a given replay interval. If we hit more than this, try to split * the interval in half and replay with watchpoints/breakpoints in the latter * half. */ static const int stop_count_limit = 20; static ReplayTask* to_replay_task(const BreakStatus& status) { return static_cast(status.task); } ReplayResult ReplayTimeline::reverse_continue( const std::function& stop_filter, const std::function& interrupt_check) { Mark end = mark(); LOG(debug) << "ReplayTimeline::reverse_continue from " << end; bool last_stop_is_watch_or_signal = false; ReplayResult final_result; TaskUid final_tuid; Ticks final_ticks = 0; Mark dest; vector restart_points; while (!dest) { Mark start = mark(); bool checkpoint_at_first_break; if (start >= end) { checkpoint_at_first_break = true; if (restart_points.empty()) { seek_to_before_key(end.ptr->proto.key); start = mark(); if (start >= end) { LOG(debug) << "Couldn't seek to before " << end << ", returning exit"; // Can't go backwards. Call this an exit. final_result.status = REPLAY_EXITED; final_result.break_status = BreakStatus(); return final_result; } LOG(debug) << "Seeked backward from " << end << " to " << start; } else { Mark seek = restart_points.back(); restart_points.pop_back(); seek_to_mark(seek); LOG(debug) << "Seeked directly backward from " << start << " to " << seek; start = move(seek); } } else { checkpoint_at_first_break = false; } maybe_add_reverse_exec_checkpoint(EXPECT_SHORT_REVERSE_EXECUTION); bool at_breakpoint = false; ReplayStepToMarkStrategy strategy; int stop_count = 0; bool made_progress_between_stops = false; remote_code_ptr avoidable_stop_ip; Ticks avoidable_stop_ticks = 0; while (true) { apply_breakpoints_and_watchpoints(); ReplayResult result; if (at_breakpoint) { result = singlestep_with_breakpoints_disabled(); } else { result = replay_step_to_mark(end, strategy); // This will remove all reverse-exec checkpoints ahead of the // current time, and add new ones if necessary. This should be // helpful if we have to reverse-continue far back in time, where // the interval between 'start' and 'end' could be lengthy; we'll // populate the interval with new checkpoints, speeding up // the following seek and possibly future operations. } at_breakpoint = result.break_status.breakpoint_hit; bool avoidable_stop = result.break_status.breakpoint_hit || !result.break_status.watchpoints_hit.empty(); if (avoidable_stop) { made_progress_between_stops = avoidable_stop_ip != result.break_status.task->ip() || avoidable_stop_ticks != result.break_status.task->tick_count(); avoidable_stop_ip = result.break_status.task->ip(); avoidable_stop_ticks = result.break_status.task->tick_count(); } evaluate_conditions(result); if (result.break_status.any_break() && !stop_filter(to_replay_task(result.break_status))) { result.break_status = BreakStatus(); } maybe_add_reverse_exec_checkpoint(EXPECT_SHORT_REVERSE_EXECUTION); if (checkpoint_at_first_break && dest != start && result.break_status.any_break()) { checkpoint_at_first_break = false; set_short_checkpoint(); } if (!result.break_status.watchpoints_hit.empty() || result.break_status.signal) { dest = mark(); LOG(debug) << "Found " << (result.break_status.signal ? "signal" : "watch") << " break at " << dest; final_result = result; final_tuid = result.break_status.task ? result.break_status.task->tuid() : TaskUid(); final_ticks = result.break_status.task ? result.break_status.task->tick_count() : 0; last_stop_is_watch_or_signal = true; } assert(result.status == REPLAY_CONTINUE); if (is_start_of_reverse_execution_barrier_event()) { dest = mark(); final_result = result; final_result.break_status.task = current->current_task(); final_result.break_status.task_exit = true; final_tuid = final_result.break_status.task->tuid(); final_ticks = result.break_status.task->tick_count(); last_stop_is_watch_or_signal = false; } if (at_mark(end)) { // In the next iteration, retry from an earlier checkpoint. end = start; break; } // If there is a breakpoint at the current ip() where we start a // reverse-continue, gdb expects us to skip it. if (result.break_status.breakpoint_hit) { dest = mark(); LOG(debug) << "Found breakpoint break at " << dest; final_result = result; final_tuid = result.break_status.task ? result.break_status.task->tuid() : TaskUid(); final_ticks = result.break_status.task ? result.break_status.task->tick_count() : 0; last_stop_is_watch_or_signal = false; } if (interrupt_check()) { LOG(debug) << "Interrupted at " << end; seek_to_mark(end); final_result = ReplayResult(); final_result.break_status.task = current->current_task(); return final_result; } if (avoidable_stop) { ++stop_count; if (stop_count > stop_count_limit) { Mark before_running = mark(); if (run_forward_to_intermediate_point(end, made_progress_between_stops ? DONT_FORCE_PROGRESS : FORCE_PROGRESS)) { assert(!at_mark(end)); // We made some progress towards |end| with breakpoints/watchpoints // disabled, without reaching |end|. Continuing running forward from // here with breakpoints/watchpoints enabled. If we need to seek // backwards again, try resuming from the point where we disabled // breakpoints/watchpoints. if (dest) { restart_points.push_back(start); } restart_points.push_back(before_running); dest = Mark(); break; } } } } } if (last_stop_is_watch_or_signal) { LOG(debug) << "Performing final reverse-singlestep to pass over watch/signal"; auto stop_filter = [&](ReplayTask* t) { return t->tuid() == final_tuid; }; reverse_singlestep(dest, final_tuid, final_ticks, stop_filter, interrupt_check); } else { LOG(debug) << "Seeking to final destination " << dest; seek_to_mark(dest); } // fix break_status.task since the actual ReplayTask* may have changed // since we saved final_result final_result.break_status.task = current->find_task(final_tuid); // Hide any singlestepping we did, since a continue operation should // never return a singlestep status final_result.break_status.singlestep_complete = false; return final_result; } void ReplayTimeline::update_observable_break_status( ReplayTimeline::Mark& now, const ReplayResult& result) { now = mark(); if (!no_watchpoints_hit_interval_start || !result.break_status.watchpoints_hit.empty()) { no_watchpoints_hit_interval_start = now; } } ReplayResult ReplayTimeline::reverse_singlestep( const Mark& origin, const TaskUid& step_tuid, Ticks step_ticks, const std::function& stop_filter, const std::function& interrupt_check) { LOG(debug) << "ReplayTimeline::reverse_singlestep from " << origin; Mark outer = origin; Ticks ticks_target = step_ticks - 1; while (true) { Mark end = outer; Mark start; bool seen_barrier; while (true) { MarkKey current_key = end.ptr->proto.key; while (true) { if (end.ptr->proto.key.trace_time != current_key.trace_time || end.ptr->proto.key.ticks != current_key.ticks) { break; } seek_to_before_key(current_key); maybe_add_reverse_exec_checkpoint(EXPECT_SHORT_REVERSE_EXECUTION); if (current_mark_key() == current_key) { // Can't go further back. Treat this as an exit. LOG(debug) << "Couldn't seek to before " << end << ", returning exit"; ReplayResult result; result.status = REPLAY_EXITED; result.break_status = BreakStatus(); return result; } LOG(debug) << "Seeked backward from " << current_key << " to " << current_mark_key(); current_key = current_mark_key(); } start = mark(); LOG(debug) << "Running forward from " << start; // Now run forward until we're reasonably close to the correct tick value. ReplaySession::StepConstraints constraints(RUN_CONTINUE); bool approaching_ticks_target = false; bool seen_other_task_break = false; while (!at_mark(end)) { ReplayTask* t = current->current_task(); if (stop_filter(t) && current->done_initial_exec()) { if (t->tuid() == step_tuid) { if (t->tick_count() >= ticks_target) { // Don't step any further. LOG(debug) << "Approaching ticks target"; approaching_ticks_target = true; break; } unapply_breakpoints_and_watchpoints(); constraints.ticks_target = constraints.command == RUN_CONTINUE ? ticks_target : 0; ReplayResult result; result = current->replay_step(constraints); if (result.break_status.approaching_ticks_target) { LOG(debug) << " approached ticks target at " << current_mark_key(); constraints = ReplaySession::StepConstraints(RUN_SINGLESTEP_FAST_FORWARD); } } else { if (seen_other_task_break) { unapply_breakpoints_and_watchpoints(); } else { apply_breakpoints_and_watchpoints(); } constraints.ticks_target = 0; ReplayResult result = current->replay_step(RUN_CONTINUE); if (result.break_status.any_break()) { seen_other_task_break = true; } } } else { unapply_breakpoints_and_watchpoints(); constraints.ticks_target = 0; current->replay_step(RUN_CONTINUE); } if (is_start_of_reverse_execution_barrier_event()) { seen_barrier = true; } maybe_add_reverse_exec_checkpoint(EXPECT_SHORT_REVERSE_EXECUTION); } if (approaching_ticks_target || seen_barrier) { break; } if (seen_other_task_break) { // We saw a break in another task that the debugger cares about, but // that's not the stepping task. At this point reverse-singlestep // will move back past that break, so We'll need to report that break // instead of the singlestep. return reverse_continue(stop_filter, interrupt_check); } end = start; } assert(stop_filter(current->current_task()) || seen_barrier); Mark destination_candidate; Mark step_start = set_short_checkpoint(); ReplayResult destination_candidate_result; TaskUid destination_candidate_tuid; if (is_start_of_reverse_execution_barrier_event()) { destination_candidate = mark(); destination_candidate_result.break_status.task_exit = true; destination_candidate_tuid = current->current_task()->tuid(); } no_watchpoints_hit_interval_start = Mark(); bool seen_other_task_break = false; while (true) { Mark now; ReplayResult result; if (stop_filter(current->current_task())) { apply_breakpoints_and_watchpoints(); if (current->current_task()->tuid() == step_tuid) { Mark before_step = mark(); ReplaySession::StepConstraints constraints( RUN_SINGLESTEP_FAST_FORWARD); constraints.stop_before_states.push_back(&end.ptr->proto.regs); result = current->replay_step(constraints); update_observable_break_status(now, result); if (result.break_status.breakpoint_hit) { // If we hit a breakpoint while singlestepping, we didn't // make any progress. unapply_breakpoints_and_watchpoints(); result = current->replay_step(constraints); update_observable_break_status(now, result); } if (result.break_status.singlestep_complete) { mark_after_singlestep(before_step, result); if (now > end) { // This last step is not usable. LOG(debug) << " not usable, stopping now"; break; } destination_candidate = step_start; destination_candidate_result = result; destination_candidate_tuid = result.break_status.task->tuid(); seen_other_task_break = false; step_start = now; } } else { result = current->replay_step(RUN_CONTINUE); update_observable_break_status(now, result); if (result.break_status.any_break()) { seen_other_task_break = true; } if (result.break_status.breakpoint_hit) { unapply_breakpoints_and_watchpoints(); result = current->replay_step(RUN_SINGLESTEP_FAST_FORWARD); update_observable_break_status(now, result); if (result.break_status.any_break()) { seen_other_task_break = true; } } } } else { unapply_breakpoints_and_watchpoints(); result = current->replay_step(RUN_CONTINUE); no_watchpoints_hit_interval_start = Mark(); now = mark(); } if (is_start_of_reverse_execution_barrier_event()) { destination_candidate = mark(); destination_candidate_result = result; destination_candidate_result.break_status.task_exit = true; destination_candidate_tuid = current->current_task()->tuid(); seen_other_task_break = false; } if (now >= end) { break; } maybe_add_reverse_exec_checkpoint(EXPECT_SHORT_REVERSE_EXECUTION); } no_watchpoints_hit_interval_end = no_watchpoints_hit_interval_start ? end : Mark(); if (seen_other_task_break) { // We saw a break in another task that the debugger cares about, but // that's not the stepping task. Report that break instead of the // singlestep. return reverse_continue(stop_filter, interrupt_check); } if (destination_candidate) { LOG(debug) << "Found destination " << destination_candidate; seek_to_mark(destination_candidate); destination_candidate_result.break_status.task = current->find_task(destination_candidate_tuid); assert(destination_candidate_result.break_status.task); evaluate_conditions(destination_candidate_result); return destination_candidate_result; } // No destination candidate found. Search further backward. outer = start; } } void ReplayTimeline::evaluate_conditions(ReplayResult& result) { ReplayTask* t = to_replay_task(result.break_status); if (!t) { return; } auto auid = t->vm()->uid(); if (result.break_status.breakpoint_hit) { auto addr = t->ip(); auto it = breakpoints.lower_bound(make_tuple(auid, addr, nullptr)); bool hit = false; while (it != breakpoints.end() && get<0>(*it) == auid && get<1>(*it) == addr) { const unique_ptr& cond = get<2>(*it); if (!cond || cond->evaluate(t)) { hit = true; break; } ++it; } if (!hit) { result.break_status.breakpoint_hit = false; } } for (auto i = result.break_status.watchpoints_hit.begin(); i != result.break_status.watchpoints_hit.end(); ++i) { auto& w = *i; auto it = watchpoints.lower_bound( make_tuple(auid, w.addr, w.num_bytes, w.type, nullptr)); bool hit = false; while (it != watchpoints.end() && get<0>(*it) == auid && get<1>(*it) == w.addr && get<2>(*it) == w.num_bytes && get<3>(*it) == w.type) { const unique_ptr& cond = get<4>(*it); if (!cond || cond->evaluate(t)) { hit = true; break; } ++it; } if (!hit) { i = result.break_status.watchpoints_hit.erase(i); } } } ReplayResult ReplayTimeline::replay_step_forward( RunCommand command, TraceFrame::Time stop_at_time) { assert(command != RUN_SINGLESTEP_FAST_FORWARD); ReplayResult result; apply_breakpoints_and_watchpoints(); ProtoMark before = proto_mark(); current->set_visible_execution(true); ReplaySession::StepConstraints constraints(command); constraints.stop_at_time = stop_at_time; result = current->replay_step(constraints); current->set_visible_execution(false); if (command == RUN_CONTINUE) { // Since it's easy for us to fix the coalescing quirk for forward // execution, we may as well do so. It's nice to have forward execution // behave consistently with reverse execution. fix_watchpoint_coalescing_quirk(result, before); // Hide any singlestepping we did result.break_status.singlestep_complete = false; } maybe_add_reverse_exec_checkpoint(LOW_OVERHEAD); bool did_hit_breakpoint = result.break_status.breakpoint_hit; evaluate_conditions(result); if (did_hit_breakpoint && !result.break_status.any_break()) { // Singlestep past the breakpoint current->set_visible_execution(true); result = singlestep_with_breakpoints_disabled(); if (command == RUN_CONTINUE) { result.break_status.singlestep_complete = false; } current->set_visible_execution(false); } return result; } ReplayResult ReplayTimeline::reverse_singlestep( const TaskUid& tuid, Ticks tuid_ticks, const std::function& stop_filter, const std::function& interrupt_check) { return reverse_singlestep(mark(), tuid, tuid_ticks, stop_filter, interrupt_check); } ReplayTimeline::Progress ReplayTimeline::estimate_progress() { Session::Statistics stats = current->statistics(); // The following parameters were estimated by running Firefox startup // and shutdown in an opt build on a Lenovo W530 laptop, replaying with // DUMP_STATS_PERIOD set to 100 (twice, and using only values from the // second run, to ensure caches are warm), and then minimizing least-squares // error. static const double microseconds_per_tick = 0.0020503143; static const double microseconds_per_syscall = 39.6793587609; static const double microseconds_per_byte_written = 0.001833611; static const double microseconds_constant = 997.8257239043; return Progress(microseconds_per_tick * stats.ticks_processed + microseconds_per_syscall * stats.syscalls_performed + microseconds_per_byte_written * stats.bytes_written + microseconds_constant); } /* * Checkpointing strategy: * * We define a series of intervals of increasing length, each one ending at * the current replay position. In each interval N, we allow at most N * checkpoints. We ensure that interval lengths grow exponentially (in the * limit), so the maximum number of checkpoints for a given execution length * L is O(log L). * * Interval N has length inter_checkpoint_interval to the * power of checkpoint_interval_exponent. * We allow at most N checkpoints in interval N. * To discard excess checkpoints, first pick the smallest interval N with * too many checkpoints, and discard the latest checkpoint in interval N * that is not in interval N-1. Repeat until there are no excess checkpoints. * All checkpoints after the current replay point are always discarded. * The script checkpoint-visualizer.html simulates this algorithm and * visualizes its results. * The implementation here is quite naive, but that's OK because we will * never have a large number of checkpoints. */ /** * Try to space out our checkpoints by a minimum of this much in LOW_OVERHEAD * mode. * This is currently aiming for about 0.5s of replay time, so a reverse step or * continue whose destination is within 0.5 should take at most a second. * Also, based on a guesstimate that taking checkpoints of Firefox requires * about 50ms, this would make checkpointing overhead about 10% of replay time, * which sounds reasonable. */ static ReplayTimeline::Progress low_overhead_inter_checkpoint_interval = 500000; /** * Space out checkpoints linearly by this much in * EXPECT_SHORT_REVERSE_EXECUTION mode, until we reach * low_overhead_inter_checkpoint_interval. */ static ReplayTimeline::Progress expecting_reverse_exec_inter_checkpoint_interval = 100000; /** * Make each interval this much bigger than the previous. */ static float checkpoint_interval_exponent = 2; static ReplayTimeline::Progress inter_checkpoint_interval( ReplayTimeline::CheckpointStrategy strategy) { return strategy == ReplayTimeline::LOW_OVERHEAD ? low_overhead_inter_checkpoint_interval : expecting_reverse_exec_inter_checkpoint_interval; } static ReplayTimeline::Progress next_interval_length( ReplayTimeline::Progress len) { if (len >= low_overhead_inter_checkpoint_interval) { return (ReplayTimeline::Progress)ceil(checkpoint_interval_exponent * len); } return len + expecting_reverse_exec_inter_checkpoint_interval; } void ReplayTimeline::maybe_add_reverse_exec_checkpoint( CheckpointStrategy strategy) { discard_future_reverse_exec_checkpoints(); Progress now = estimate_progress(); auto it = reverse_exec_checkpoints.rbegin(); if (it != reverse_exec_checkpoints.rend() && it->second >= now - inter_checkpoint_interval(strategy)) { // Latest checkpoint is close enough; we don't need to do anything. return; } if (!current->can_clone()) { // We can't create a checkpoint right now. return; } // We always discard checkpoints before adding the new one to reduce the // maximum checkpoint count by one. discard_past_reverse_exec_checkpoints(strategy); Mark m = add_explicit_checkpoint(); LOG(debug) << "Creating reverse-exec checkpoint at " << m; reverse_exec_checkpoints[m] = now; } void ReplayTimeline::discard_future_reverse_exec_checkpoints() { Progress now = estimate_progress(); while (true) { auto it = reverse_exec_checkpoints.rbegin(); if (it == reverse_exec_checkpoints.rend() || it->second <= now) { break; } LOG(debug) << "Discarding reverse-exec future checkpoint at " << *it->first.ptr; remove_explicit_checkpoint(it->first); reverse_exec_checkpoints.erase(it->first); } } void ReplayTimeline::discard_past_reverse_exec_checkpoints( CheckpointStrategy strategy) { Progress now = estimate_progress(); // No checkpoints are allowed in the first interval, since we're about to // add one there. int checkpoints_allowed = 0; int checkpoints_in_range = 0; auto it = reverse_exec_checkpoints.rbegin(); vector checkpoints_to_delete; for (Progress len = inter_checkpoint_interval(strategy);; len = next_interval_length(len)) { Progress start = now - len; // Count checkpoints >= start, starting at 'it', and leave the first // checkpoint entry < start in 'tmp_it'. auto tmp_it = it; while (tmp_it != reverse_exec_checkpoints.rend() && tmp_it->second >= start) { ++checkpoints_in_range; ++tmp_it; } // Delete excess checkpoints starting with 'it'. while (checkpoints_in_range > checkpoints_allowed) { checkpoints_to_delete.push_back(it->first); --checkpoints_in_range; ++it; } ++checkpoints_allowed; it = tmp_it; if (it == reverse_exec_checkpoints.rend()) { break; } } for (auto& m : checkpoints_to_delete) { LOG(debug) << "Discarding reverse-exec checkpoint at " << m; remove_explicit_checkpoint(m); reverse_exec_checkpoints.erase(m); } } ReplayTimeline::Mark ReplayTimeline::set_short_checkpoint() { if (!can_add_checkpoint()) { return mark(); } // Add checkpoint before removing one in case m == // reverse_exec_short_checkpoint Mark m = add_explicit_checkpoint(); LOG(debug) << "Creating short-checkpoint at " << m; if (reverse_exec_short_checkpoint) { LOG(debug) << "Discarding old short-checkpoint at " << reverse_exec_short_checkpoint; remove_explicit_checkpoint(reverse_exec_short_checkpoint); } swap(m, reverse_exec_short_checkpoint); return reverse_exec_short_checkpoint; } } // namespace rr rr-4.4.0/src/ReplayTimeline.h000066400000000000000000000443231277367620400160510ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REPLAY_TIMELINE_H_ #define RR_REPLAY_TIMELINE_H_ #include #include #include #include #include #include "BreakpointCondition.h" #include "Registers.h" #include "ReplaySession.h" #include "ReplayTask.h" #include "ReturnAddressList.h" #include "TraceFrame.h" namespace rr { enum RunDirection { RUN_FORWARD, RUN_BACKWARD }; /** * This class manages a set of ReplaySessions corresponding to different points * in the same recording. It provides an API for explicitly managing * checkpoints along this timeline and navigating to specific events. */ class ReplayTimeline { private: struct InternalMark; public: ReplayTimeline(std::shared_ptr session, const ReplaySession::Flags& session_flags); ReplayTimeline() : breakpoints_applied(false) {} ~ReplayTimeline(); bool is_running() const { return current != nullptr; } /** * An estimate of how much progress a session has made. This should roughly * correlate to the time required to replay from the start of a session * to the current point, in microseconds. */ typedef int64_t Progress; /** * A Mark references a precise point in time during the replay. * It may or may not have an associated ReplaySession checkpoint. */ class Mark { public: Mark() {} bool operator<(const Mark& other) const { return ReplayTimeline::less_than(*this, other); } bool operator>(const Mark& other) const { return other < *this; } bool operator<=(const Mark& other) const { return !(*this > other); } bool operator>=(const Mark& other) const { return !(*this < other); } bool operator==(const Mark& other) const { return ptr == other.ptr; } bool operator!=(const Mark& other) const { return !(*this == other); } operator bool() const { return ptr != nullptr; } /** * Return the values of the general-purpose registers at this mark. */ const Registers& regs() const { return ptr->proto.regs; } const ExtraRegisters& extra_regs() const { return ptr->extra_regs; } TraceFrame::Time time() const { return ptr->proto.key.trace_time; } private: friend class ReplayTimeline; friend std::ostream& operator<<(std::ostream& s, const Mark& o); Mark(std::shared_ptr& weak) { swap(ptr, weak); } std::shared_ptr ptr; }; /** * The current state. The current state can be moved forward or backward * using ReplaySession's APIs. Do not set breakpoints on its tasks directly. * Use ReplayTimeline's breakpoint methods. */ ReplaySession& current_session() { return *current; } /** * Return a mark for the current state. A checkpoint need not be retained, * but this mark can be seeked to later. * This can be expensive in some (perhaps unusual) situations since we * may need to clone the current session and run it a bit, to figure out * where we are relative to other Marks. So don't call this unless you * need it. */ Mark mark(); /** * Indicates that the current replay position is the result of * singlestepping from 'from'. */ void mark_after_singlestep(const Mark& from, const ReplayResult& result); /** * Returns true if it's safe to add a checkpoint here. */ bool can_add_checkpoint() { return current->can_clone(); } /** * Ensure that the current session is explicitly checkpointed. * Explicit checkpoints are reference counted. * Only call this if can_add_checkpoint would return true. */ Mark add_explicit_checkpoint(); /** * Remove an explicit checkpoint reference count for this mark. */ void remove_explicit_checkpoint(const Mark& mark); /** * Return true if we're currently at the given mark. */ bool at_mark(const Mark& mark) { return current_mark() == mark.ptr; } // Add/remove breakpoints and watchpoints. Use these APIs instead // of operating on the task directly, so that ReplayTimeline can track // breakpoints and automatically move them across sessions as necessary. // Only one breakpoint for a given address space/addr combination can be set; // setting another for the same address space/addr will replace the first. // Likewise only one watchpoint for a given task/addr/num_bytes/type can be // set. gdb expects that setting two breakpoints on the same address and then // removing one removes both. bool add_breakpoint(ReplayTask* t, remote_code_ptr addr, std::unique_ptr condition = nullptr); // You can't remove a breakpoint with a specific condition, so don't // place multiple breakpoints with conditions on the same location. void remove_breakpoint(ReplayTask* t, remote_code_ptr addr); bool add_watchpoint(ReplayTask* t, remote_ptr addr, size_t num_bytes, WatchType type, std::unique_ptr condition = nullptr); // You can't remove a watchpoint with a specific condition, so don't // place multiple breakpoints with conditions on the same location. void remove_watchpoint(ReplayTask* t, remote_ptr addr, size_t num_bytes, WatchType type); void remove_breakpoints_and_watchpoints(); bool has_breakpoint_at_address(ReplayTask* t, remote_code_ptr addr); bool has_watchpoint_at_address(ReplayTask* t, remote_ptr addr, size_t num_bytes, WatchType type); /** * Ensure that reverse execution never proceeds into an event before * |event|. Reverse execution will stop with a |task_exit| break status when * at the beginning of this event. */ void set_reverse_execution_barrier_event(TraceFrame::Time event) { reverse_execution_barrier_event = event; } // State-changing APIs. These may alter state associated with // current_session(). /** * Reset the current session to the last available session before event * 'time'. Useful if you want to run up to that event. */ void seek_to_before_event(TraceFrame::Time time) { return seek_to_before_key(MarkKey(time, 0, ReplayStepKey())); } /** * Reset the current session to the last checkpointed session before (or at) * the mark. Will return at the mark if this mark was explicitly checkpointed * previously (and not deleted). */ void seek_up_to_mark(const Mark& mark); /** * Sets current session to 'mark' by restoring the nearest useful checkpoint * and executing forwards if necessary. */ void seek_to_mark(const Mark& mark); /** * Replay 'current'. * If there is a breakpoint at the current task's current ip(), then * when running forward we will immediately break at the breakpoint. When * running backward we will ignore the initial "hit" of the breakpoint --- * this is the behavior gdb expects. * Likewise, if there is a breakpoint at the current task's current ip(), * then running forward will immediately break at the breakpoint, but * running backward will ignore the initial "hit" of the breakpoint; this is * what gdb expects. * * replay_step_forward only does one replay step. That means we'll only * execute code in current_session().current_task(). */ ReplayResult replay_step_forward(RunCommand command, TraceFrame::Time stop_at_time); ReplayResult reverse_continue( const std::function& stop_filter, const std::function& interrupt_check); ReplayResult reverse_singlestep( const TaskUid& tuid, Ticks tuid_ticks, const std::function& stop_filter, const std::function& interrupt_check); /** * Try to identify an existing Mark which is known to be one singlestep * before 'from', and for which we know singlestepping to 'from' would * trigger no break statuses other than "singlestep_complete". * If we can't, return a null Mark. * Will only return a Mark for the same executing task as 'from', which * must be 't'. */ Mark lazy_reverse_singlestep(const Mark& from, ReplayTask* t); /** * Different strategies for placing automatic checkpoints. */ enum CheckpointStrategy { /** * Use this when we want to bound the overhead of checkpointing to be * insignificant relative to the cost of forward execution. */ LOW_OVERHEAD, /** * Use this when we expect reverse execution to happen soon, to a * destination not far behind the current execution point. In this case * it's worth increasing checkpoint density. * We pass this when we have opportunities to make checkpoints during * reverse_continue or reverse_singlestep, since it's common for short * reverse-executions to follow other reverse-execution. */ EXPECT_SHORT_REVERSE_EXECUTION }; /** * We track the set of breakpoints/watchpoints requested by the client. * When we switch to a new ReplaySession, these need to be reapplied before * replaying that session, but we do this lazily. * apply_breakpoints_and_watchpoints() forces the breakpoints/watchpoints * to be applied to the current session. * Our checkpoints never have breakpoints applied. */ void apply_breakpoints_and_watchpoints(); private: /** * TraceFrame::Time + Ticks + ReplayStepKey does not uniquely identify * a program state, but they're intrinsically totally ordered. */ struct MarkKey { MarkKey(TraceFrame::Time trace_time, Ticks ticks, ReplayStepKey step_key) : trace_time(trace_time), ticks(ticks), step_key(step_key) {} MarkKey(const MarkKey& other) = default; TraceFrame::Time trace_time; Ticks ticks; ReplayStepKey step_key; bool operator<(const MarkKey& other) const { if (trace_time < other.trace_time) { return true; } if (trace_time > other.trace_time) { return false; } if (ticks < other.ticks) { return true; } if (ticks > other.ticks) { return false; } return step_key < other.step_key; } bool operator>(const MarkKey& other) const { return other < *this; } bool operator>=(const MarkKey& other) const { return !(*this < other); } bool operator<=(const MarkKey& other) const { return !(other < *this); } bool operator==(const MarkKey& other) const { return trace_time == other.trace_time && ticks == other.ticks && step_key == other.step_key; } bool operator!=(const MarkKey& other) const { return !(*this == other); } }; friend std::ostream& operator<<(std::ostream& s, const MarkKey& o); /** * All the information we'll need to construct a mark lazily. */ struct ProtoMark { ProtoMark(const MarkKey& key, ReplayTask* t) : key(key), regs(t->regs()), return_addresses(ReturnAddressList(t)) {} ProtoMark(const MarkKey& key) : key(key) {} bool equal_states(ReplaySession& session) const; MarkKey key; Registers regs; ReturnAddressList return_addresses; }; /** * MarkKey + Registers are assumed to identify a unique program state. * We can't order these states directly based on this data, so we have to * record the ordering in the ReplayTimeline. */ struct InternalMark { InternalMark(ReplayTimeline* owner, ReplaySession& session, const MarkKey& key) : owner(owner), proto(key), ticks_at_event_start(session.ticks_at_start_of_current_event()), checkpoint_refcount(0), singlestep_to_next_mark_no_signal(false) { ReplayTask* t = session.current_task(); if (t) { proto = ProtoMark(key, t); extra_regs = t->extra_regs(); } } ~InternalMark(); bool operator<(const std::shared_ptr other); bool equal_states(ReplaySession& session) const; ReplayTimeline* owner; ProtoMark proto; ExtraRegisters extra_regs; ReplaySession::shr_ptr checkpoint; Ticks ticks_at_event_start; uint32_t checkpoint_refcount; // The next InternalMark in the mark vector is the result of singlestepping // from this mark *and* no signal is reported in the break_status. bool singlestep_to_next_mark_no_signal; }; friend struct InternalMark; friend std::ostream& operator<<(std::ostream& s, const InternalMark& o); friend std::ostream& operator<<(std::ostream& s, const ProtoMark& o); /** * unapply_breakpoints_and_watchpoints() forces the breakpoints/watchpoints * to not be applied to the current session. Use this when we need to * clone the current session or replay the current session without * triggering breakpoints. */ void unapply_breakpoints_and_watchpoints(); void apply_breakpoints_internal(); void unapply_breakpoints_internal(); static MarkKey session_mark_key(ReplaySession& session) { ReplayTask* t = session.current_task(); return MarkKey(session.trace_reader().time(), t ? t->tick_count() : 0, session.current_step_key()); } MarkKey current_mark_key() const { return session_mark_key(*current); } ProtoMark proto_mark() const; void seek_to_proto_mark(const ProtoMark& pmark); // Returns a shared pointer to the mark if there is one for the current state. std::shared_ptr current_mark(); void remove_mark_with_checkpoint(const MarkKey& key); void seek_to_before_key(const MarkKey& key); enum ForceProgress { FORCE_PROGRESS, DONT_FORCE_PROGRESS }; // Run forward towards the midpoint of the current position and |end|. // Must stop before we reach |end|. // Returns false if we made no progress. bool run_forward_to_intermediate_point(const Mark& end, ForceProgress force); struct ReplayStepToMarkStrategy { ReplayStepToMarkStrategy() : singlesteps_to_perform(0) {} ReplaySession::StepConstraints setup_step_constraints(); uint32_t singlesteps_to_perform; }; void update_strategy_and_fix_watchpoint_quirk( ReplayStepToMarkStrategy& strategy, const ReplaySession::StepConstraints& constraints, ReplayResult& result, const ProtoMark& before); // Take a single replay step towards |mark|. Stop before or at |mark|, and // stop if any breakpoint/watchpoint/signal is hit. // Maintain current strategy state in |strategy|. Passing the same // |strategy| object to consecutive replay_step_to_mark invocations helps // optimize performance. ReplayResult replay_step_to_mark(const Mark& mark, ReplayStepToMarkStrategy& strategy); ReplayResult singlestep_with_breakpoints_disabled(); bool fix_watchpoint_coalescing_quirk(ReplayResult& result, const ProtoMark& before); Mark find_singlestep_before(const Mark& mark); bool is_start_of_reverse_execution_barrier_event(); void update_observable_break_status(ReplayTimeline::Mark& now, const ReplayResult& result); ReplayResult reverse_singlestep( const Mark& origin, const TaskUid& step_tuid, Ticks step_ticks, const std::function& stop_filter, const std::function& interrupt_check); // Reasonably fast since it just relies on checking the mark map. static bool less_than(const Mark& m1, const Mark& m2); Progress estimate_progress(); /** * Called when the current session has moved forward to a new execution * point and we might want to make a checkpoint to support reverse-execution. * If this adds a checkpoint, it will call * discard_past_reverse_exec_checkpoints * first. */ void maybe_add_reverse_exec_checkpoint(CheckpointStrategy strategy); /** * Discard some reverse-exec checkpoints in the past, if necessary. We do * this to stop the number of checkpoints growing out of control. */ void discard_past_reverse_exec_checkpoints(CheckpointStrategy strategy); /** * Discard all reverse-exec checkpoints that are in the future (they're * useless). */ void discard_future_reverse_exec_checkpoints(); Mark set_short_checkpoint(); /** * If result.break_status hit watchpoints or breakpoints, evaluate their * conditions and clear the break_status flags if the conditions don't hold. */ void evaluate_conditions(ReplayResult& result); ReplaySession::Flags session_flags; ReplaySession::shr_ptr current; // current is known to be at or after this mark std::shared_ptr current_at_or_after_mark; /** * All known marks. * * An InternalMark appears in a ReplayTimeline 'marks' map if and only if * that ReplayTimeline is the InternalMark's 'owner'. ReplayTimeline's * destructor clears the 'owner' of all marks in the map. * * For each MarkKey, the InternalMarks are stored in execution order. * * We assume there will be a limited number of InternalMarks per MarkKey. * This should be true because ReplayTask::tick_count() should increment * frequently during execution. In some cases we see hundreds of elements * but that's not too bad. */ std::map>> marks; /** * All mark keys with at least one checkpoint. The value is the number of * checkpoints. There can be multiple checkpoints for a given MarkKey * because a MarkKey may have multiple corresponding Marks. */ std::map marks_with_checkpoints; std::set>> breakpoints; std::set, size_t, WatchType, std::unique_ptr>> watchpoints; bool breakpoints_applied; TraceFrame::Time reverse_execution_barrier_event; /** * Checkpoints used to accelerate reverse execution. */ std::map reverse_exec_checkpoints; /** * When these are non-null, then when singlestepping from * no_break_interval_start to no_break_interval_end, none of the currently * set watchpoints fire. */ Mark no_watchpoints_hit_interval_start; Mark no_watchpoints_hit_interval_end; /** * A single checkpoint that's very close to the current point, used to * accelerate a sequence of reverse singlestep operations. */ Mark reverse_exec_short_checkpoint; }; std::ostream& operator<<(std::ostream& s, const ReplayTimeline::Mark& o); } // namespace rr #endif // RR_REPLAY_TIMELINE_H_ rr-4.4.0/src/ReturnAddressList.cc000066400000000000000000000030311277367620400166740ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ReturnAddressList.h" #include "Task.h" namespace rr { template static void return_addresses_x86ish(ReturnAddressList* result, Task* t) { // Immediately after a function call the return address is on the stack at // SP. After BP is pushed, but before it's initialized for the new stack // frame, the return address is on the stack at SP+wordsize. Just // capture those words now. We could inspect the code for known prologs/ // epilogs but that misses cases such as calling into optimized code // or PLT stubs (which start with 'jmp'). Since it doesn't matter if we // capture addresses that aren't real return addresses, just capture those // words unconditionally. typename Arch::size_t frame[2]; int next_address = 0; if (t->read_bytes_fallible(t->regs().sp(), sizeof(frame), frame) == sizeof(frame)) { result->addresses[0] = frame[0]; result->addresses[1] = frame[1]; next_address = 2; } remote_ptr bp = t->regs().bp(); for (int i = next_address; i < ReturnAddressList::COUNT; ++i) { if (t->read_bytes_fallible(bp, sizeof(frame), frame) != sizeof(frame)) { break; } result->addresses[i] = frame[1]; bp = frame[0]; } } static void compute_return_addresses(ReturnAddressList* result, Task* t) { RR_ARCH_FUNCTION(return_addresses_x86ish, t->arch(), result, t); } ReturnAddressList::ReturnAddressList(Task* t) { compute_return_addresses(this, t); } } // namespace rr rr-4.4.0/src/ReturnAddressList.h000066400000000000000000000023561277367620400165470ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_RETURNADDRESSLIST_H_ #define RR_RETURNADDRESSLIST_H_ #include #include "remote_ptr.h" namespace rr { class Task; /** * A list of return addresses extracted from the stack. The tuple * (perfcounter ticks, regs, return addresses) may be needed to disambiguate * states that aren't unique in (perfcounter ticks, regs). * When return addresses can't be extracted, some suffix of the list may be * all zeroes. */ struct ReturnAddressList { enum { COUNT = 8 }; remote_ptr addresses[COUNT]; /** * Capture return addresses from |t|'s stack. The returned * address list may not be actual return addresses (in optimized code, * will probably not be), but they will be a function of the task's current * state, so may be useful for distinguishing this state from other states. */ ReturnAddressList() {} explicit ReturnAddressList(Task* t); bool operator==(const ReturnAddressList& other) const { return memcmp(addresses, other.addresses, sizeof(addresses)) == 0; } bool operator!=(const ReturnAddressList& other) const { return !(*this == other); } }; } // namespace rr #endif /* RR_RETURNADDRESSLIST_H_ */ rr-4.4.0/src/Scheduler.cc000066400000000000000000000540411277367620400152000ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ //#define MONITOR_UNSWITCHABLE_WAITS #include "Scheduler.h" #include #include #include #include #include #include #include #include #include #include #include #include #include "Flags.h" #include "RecordSession.h" #include "RecordTask.h" #include "log.h" using namespace std; namespace rr { // Probability of making a thread low priority. Keep this reasonably low // because the goal is to victimize some specific threads static double low_priority_probability = 0.1; // Give main threads a higher probability of being low priority because // many tests are basically main-thread-only static double main_thread_low_priority_probability = 0.3; static double very_short_timeslice_probability = 0.1; static Ticks very_short_timeslice_max_duration = 100; static double short_timeslice_probability = 0.1; static Ticks short_timeslice_max_duration = 10000; // Time between priority refreshes is uniformly distributed from 0 to 20s static double priorities_refresh_max_interval = 20; /* * High-Priority-Only Intervals * * We assume that for a test failure we want to reproduce, we will reproduce a * failure if we completely avoid scheduling a certain thread for a period of * D seconds, where the start of that period must fall between S and S+T * seconds since the start of the test. All these constants are unknown to * rr, but we assume 1ms <= D <= 2s. * * Since we only need to reproduce any particular bug once, it would be best * to have roughly similar probabilities for reproducing each bug given its * unknown parameters. It's unclear what is the optimal approach here, but * here's ours: * * First we have to pick the right thread to treat as low priority --- without * making many other threads low priority, since they might need to run while * our victim thread is being starved. So we give each thread a 0.1 probability * of being low priority, except for the main thread which we make 0.3, since * starving the main thread is often very interesting. * Then we guess a value D' for D. We uniformly choose between 1ms, 2ms, 4ms, * 8ms, ..., 1s, 2s. Out of these 12 possibilities, one is between D and 2xD. * We adopt the goal of high-priority-only intervals consume at most 20% of * running time. Then to maximise the probability of triggering the test * failure, we start high-priority-only intervals as often as possible, * i.e. one for D' seconds starting every 5xD' seconds. * The start time of the first interval is chosen uniformly randomly to be * between 0 and 4xD'. * Then, if we guessed D' and the low-priority thread correctly, the * probability of triggering the test failure is 1 if T >= 4xD', T/4xD' * otherwise, i.e. >= T/8xD. (Higher values of D' than optimal can also trigger * failures, but at reduced probabilities since we can schedule them less * often.) */ static double min_high_priority_only_duration = 0.001; static int high_priority_only_duration_steps = 12; static double high_priority_only_duration_step_factor = 2; // Allow this much of overall runtime to be in the "high priority only" interval static double high_priority_only_fraction = 0.2; Scheduler::Scheduler(RecordSession& session) : session(session), current_(nullptr), current_timeslice_end_(0), high_priority_only_intervals_refresh_time(0), high_priority_only_intervals_start(0), high_priority_only_intervals_duration(0), high_priority_only_intervals_period(0), priorities_refresh_time(0), pretend_num_cores_(1), max_ticks_(DEFAULT_MAX_TICKS), always_switch(false), enable_chaos(false), enable_poll(false), last_reschedule_in_high_priority_only_interval(false), must_run_task(nullptr) {} void Scheduler::set_enable_chaos(bool enable_chaos) { this->enable_chaos = enable_chaos; /* When chaos mode is enabled, pretend to have 1-8 cores at random, otherwise * return 1 to maximize throughput (since effectively we really only have * one core). */ pretend_num_cores_ = enable_chaos ? (random() % 8 + 1) : 1; } RecordTask* Scheduler::get_next_task_with_same_priority(RecordTask* t) { if (!t || t->in_round_robin_queue) { return nullptr; } auto it = task_priority_set.find(make_pair(t->priority, t)); assert(it != task_priority_set.end()); ++it; if (it == task_priority_set.end() || it->first != t->priority) { it = task_priority_set.lower_bound(make_pair(t->priority, nullptr)); } return it->second; } static double random_frac() { return double(random() % INT32_MAX) / INT32_MAX; } int Scheduler::choose_random_priority(RecordTask* t) { double prob = t->tgid() == t->tid ? main_thread_low_priority_probability : low_priority_probability; return random_frac() < prob; } static bool treat_syscall_as_nonblocking(int syscallno, SupportedArch arch) { return is_sched_yield_syscall(syscallno, arch) || is_exit_syscall(syscallno, arch) || is_exit_group_syscall(syscallno, arch); } /** * Returns true if we should return t as the runnable task. Otherwise we * should check the next task. Note that if this returns true get_next_thread * |must| return t as the runnable task, otherwise we will lose an event and * probably deadlock!!! */ bool Scheduler::is_task_runnable(RecordTask* t, bool* by_waitpid) { ASSERT(t, !must_run_task) << "is_task_runnable called again after it " "returned a task that must run!"; if (t->unstable) { LOG(debug) << " " << t->tid << " is unstable"; return true; } if (!t->may_be_blocked()) { LOG(debug) << " " << t->tid << " isn't blocked"; return true; } if (t->emulated_stop_type != NOT_STOPPED) { if (t->is_signal_pending(SIGCONT)) { // We have to do this here. RecordTask::signal_delivered can't always // do it because if we don't PTRACE_CONT the task, we'll never see the // SIGCONT. t->emulate_SIGCONT(); // We shouldn't run any user code since there is at least one signal // pending. t->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); *by_waitpid = true; must_run_task = t; LOG(debug) << " Got " << t->tid << " out of emulated stop due to pending SIGCONT"; return true; } else { LOG(debug) << " " << t->tid << " is stopped by ptrace or signal"; // We have no way to detect a SIGCONT coming from outside the tracees. // We just have to poll SigPnd in /proc//status. enable_poll = true; return false; } } if (EV_SYSCALL == t->ev().type() && PROCESSING_SYSCALL == t->ev().Syscall().state && treat_syscall_as_nonblocking(t->ev().Syscall().number, t->arch())) { // These syscalls never really block but the kernel may report that // the task is not stopped yet if we pass WNOHANG. To make them // behave predictably, do a blocking wait. t->wait(); *by_waitpid = true; must_run_task = t; LOG(debug) << " sched_yield ready with status " << t->status(); return true; } LOG(debug) << " " << t->tid << " is blocked on " << t->ev() << "; checking status ..."; bool did_wait_for_t; did_wait_for_t = t->try_wait(); if (did_wait_for_t) { *by_waitpid = true; must_run_task = t; LOG(debug) << " ready with status " << t->status(); return true; } LOG(debug) << " still blocked"; // Try next task return false; } RecordTask* Scheduler::find_next_runnable_task(RecordTask* t, bool* by_waitpid, int priority_threshold) { *by_waitpid = false; // The outer loop has one iteration per unique priority value. // The inner loop iterates over all tasks with that priority. for (auto same_priority_start = task_priority_set.begin(); same_priority_start != task_priority_set.end();) { int priority = same_priority_start->first; if (priority > priority_threshold) { return nullptr; } auto same_priority_end = task_priority_set.lower_bound( make_pair(same_priority_start->first + 1, nullptr)); if (enable_chaos) { vector tasks; for (auto it = same_priority_start; it != same_priority_end; ++it) { tasks.push_back(it->second); } random_shuffle(tasks.begin(), tasks.end()); for (RecordTask* next : tasks) { if (is_task_runnable(next, by_waitpid)) { return next; } } } else { auto begin_at = same_priority_start; if (t && priority == t->priority) { begin_at = task_priority_set.find(make_pair(priority, t)); ++begin_at; if (begin_at == same_priority_end) { begin_at = same_priority_start; } } auto task_iterator = begin_at; do { RecordTask* next = task_iterator->second; if (is_task_runnable(next, by_waitpid)) { return next; } ++task_iterator; if (task_iterator == same_priority_end) { task_iterator = same_priority_start; } } while (task_iterator != begin_at); } same_priority_start = same_priority_end; } return nullptr; } void Scheduler::setup_new_timeslice() { Ticks max_timeslice_duration = max_ticks_; if (enable_chaos) { // Hypothesis: some bugs require short timeslices to expose. But we don't // want the average timeslice to be too small. So make 10% of timeslices // very short, 10% short-ish, and the rest uniformly distributed between 0 // and |max_ticks_|. double timeslice_kind_frac = random_frac(); if (timeslice_kind_frac < very_short_timeslice_probability) { max_timeslice_duration = very_short_timeslice_max_duration; } else if (timeslice_kind_frac < very_short_timeslice_probability + short_timeslice_probability) { max_timeslice_duration = short_timeslice_max_duration; } else { max_timeslice_duration = max_ticks_; } } current_timeslice_end_ = current_->tick_count() + (random() % min(max_ticks_, max_timeslice_duration)); } static void sleep_time(double t) { struct timespec ts; ts.tv_sec = (time_t)floor(t); ts.tv_nsec = (long)((t - ts.tv_sec) * 1e9); nanosleep(&ts, NULL); } void Scheduler::maybe_reset_priorities(double now) { if (!enable_chaos || priorities_refresh_time > now) { return; } // Reset task priorities again at some point in the future. priorities_refresh_time = now + random_frac() * priorities_refresh_max_interval; vector tasks; for (auto p : task_priority_set) { tasks.push_back(p.second); } for (RecordTask* t : task_round_robin_queue) { tasks.push_back(t); } for (RecordTask* t : tasks) { update_task_priority_internal(t, choose_random_priority(t)); } } void Scheduler::maybe_reset_high_priority_only_intervals(double now) { if (!enable_chaos || high_priority_only_intervals_refresh_time > now) { return; } int duration_step = random() % high_priority_only_duration_steps; high_priority_only_intervals_duration = min_high_priority_only_duration * pow(high_priority_only_duration_step_factor, duration_step); high_priority_only_intervals_period = high_priority_only_intervals_duration / high_priority_only_fraction; high_priority_only_intervals_start = now + random_frac() * (high_priority_only_intervals_period - high_priority_only_intervals_duration); high_priority_only_intervals_refresh_time = now + min_high_priority_only_duration * pow(high_priority_only_duration_step_factor, high_priority_only_duration_steps - 1) / high_priority_only_fraction; } bool Scheduler::in_high_priority_only_interval(double now) { if (now < high_priority_only_intervals_start) { return false; } double mod = fmod(now - high_priority_only_intervals_start, high_priority_only_intervals_period); return mod < high_priority_only_intervals_duration; } bool Scheduler::treat_as_high_priority(RecordTask* t) { return task_priority_set.size() > 1 && t->priority == 0; } Scheduler::Rescheduled Scheduler::reschedule(Switchable switchable) { Rescheduled result; result.interrupted_by_signal = false; result.by_waitpid = false; result.started_new_timeslice = false; LOG(debug) << "Scheduling next task"; must_run_task = nullptr; enable_poll = false; double now = monotonic_now_sec(); maybe_reset_priorities(now); if (current_ && switchable == PREVENT_SWITCH) { LOG(debug) << " (" << current_->tid << " is un-switchable at " << current_->ev() << ")"; if (current_->is_running()) { LOG(debug) << " and running; waiting for state change"; /* |current| is un-switchable, but already running. Wait for it to change * state before "scheduling it", so avoid busy-waiting with our client. */ current_->wait(interrupt_after_elapsed_time()); #ifdef MONITOR_UNSWITCHABLE_WAITS double wait_duration = monotonic_now_sec() - now; if (wait_duration >= 0.010) { log_warn("Waiting for unswitchable %s took %g ms", strevent(current_->event), 1000.0 * wait_duration); } #endif result.by_waitpid = true; LOG(debug) << " new status is " << current_->status(); } return result; } RecordTask* next; while (true) { maybe_reset_high_priority_only_intervals(now); last_reschedule_in_high_priority_only_interval = in_high_priority_only_interval(now); if (current_) { next = get_round_robin_task() ? nullptr : find_next_runnable_task(current_, &result.by_waitpid, current_->priority - 1); if (next) { break; } if (!current_->unstable && !always_switch && (treat_as_high_priority(current_) || !last_reschedule_in_high_priority_only_interval) && current_->tick_count() < current_timeslice_end() && is_task_runnable(current_, &result.by_waitpid)) { LOG(debug) << " Carrying on with task " << current_->tid; ASSERT(current_, !must_run_task || must_run_task == current_); return result; } maybe_pop_round_robin_task(current_); } LOG(debug) << " need to reschedule"; next = get_round_robin_task(); if (next) { LOG(debug) << "Trying task " << next->tid << " from yield queue"; if (is_task_runnable(next, &result.by_waitpid)) { break; } maybe_pop_round_robin_task(next); continue; } if (!next) { next = find_next_runnable_task(current_, &result.by_waitpid, INT32_MAX); } // When there's only one thread, treat it as low priority for the // purposes of high-priority-only-intervals. Otherwise single-threaded // workloads mostly don't get any chaos mode effects. if (next && !treat_as_high_priority(next) && last_reschedule_in_high_priority_only_interval) { if (result.by_waitpid) { LOG(debug) << "Waking up low-priority task with by_waitpid; not sleeping"; // We must run this low-priority task. Fortunately it's just waking // up from a blocking syscall; we'll record the syscall event and then // (unless it was an interrupted syscall) we'll return to // get_next_thread, which will either run a higher priority thread // or (more likely) reach here again but in the !*by_waitpid case. } else { LOG(debug) << "Waking up low-priority task without by_waitpid; sleeping"; sleep_time(0.001); now = monotonic_now_sec(); continue; } } break; } if (next && !next->unstable) { LOG(debug) << " selecting task " << next->tid; } else { // All the tasks are blocked (or we found an unstable-exit task). // Wait for the next one to change state. WaitStatus status; pid_t tid; LOG(debug) << " all tasks blocked or some unstable, waiting for runnable (" << task_priority_set.size() << " total)"; do { int raw_status; if (enable_poll) { struct itimerval timer = { { 0, 0 }, { 1, 0 } }; if (setitimer(ITIMER_REAL, &timer, nullptr) < 0) { FATAL() << "Failed to set itimer"; } LOG(debug) << " Arming one-second timer for polling"; } tid = waitpid(-1, &raw_status, __WALL | WSTOPPED | WUNTRACED); if (enable_poll) { struct itimerval timer = { { 0, 0 }, { 0, 0 } }; if (setitimer(ITIMER_REAL, &timer, nullptr) < 0) { FATAL() << "Failed to set itimer"; } LOG(debug) << " Disarming one-second timer for polling"; } status = WaitStatus(raw_status); now = -1; // invalid, don't use if (-1 == tid) { if (EINTR == errno) { LOG(debug) << " waitpid(-1) interrupted"; ASSERT(current_, !must_run_task); result.interrupted_by_signal = true; return result; } FATAL() << "Failed to waitpid()"; } LOG(debug) << " " << tid << " changed status to " << status; next = session.find_task(tid); if (status.ptrace_event() == PTRACE_EVENT_EXEC) { if (next) { // Other threads may have unexpectedly died, in which case this // will be marked as unstable even though it's actually not. There's // no way to know until we see the EXEC event that we weren't really // in an unstable exit. next->unstable = false; } else { // The thread-group-leader died and now the exec'ing thread has // changed its thread ID to be thread-group leader. next = session.revive_task_for_exec(tid); } } if (!next) { LOG(debug) << " ... but it's dead"; } } while (!next); ASSERT(next, next->unstable || next->may_be_blocked() || status.ptrace_event() == PTRACE_EVENT_EXIT) << "Scheduled task should have been blocked or unstable"; next->did_waitpid(status); result.by_waitpid = true; must_run_task = next; } if (current_ && current_ != next) { LOG(debug) << "Switching from " << current_->tid << "(" << current_->name() << ") to " << next->tid << "(" << next->name() << ") (priority " << current_->priority << " to " << next->priority << ") at " << current_->trace_writer().time(); } maybe_reset_high_priority_only_intervals(now); current_ = next; ASSERT(current_, !must_run_task || must_run_task == current_); setup_new_timeslice(); result.started_new_timeslice = true; return result; } double Scheduler::interrupt_after_elapsed_time() const { // Where does the 3 seconds come from? No especially // good reason. We want this to be pretty high, // because it's a last-ditch recovery mechanism, not a // primary thread scheduler. Though in theory the // PTRACE_INTERRUPT's shouldn't interfere with other // events, that's hard to test thoroughly so try to // avoid it. double delay = 3; if (enable_chaos) { double now = monotonic_now_sec(); if (high_priority_only_intervals_start) { double next_interval_start = (floor((now - high_priority_only_intervals_start) / high_priority_only_intervals_period) + 1) * high_priority_only_intervals_period + high_priority_only_intervals_start; delay = min(delay, next_interval_start - now); } if (high_priority_only_intervals_refresh_time) { delay = min(delay, high_priority_only_intervals_refresh_time - now); } if (priorities_refresh_time) { delay = min(delay, priorities_refresh_time - now); } } return max(0.001, delay); } void Scheduler::on_create(RecordTask* t) { assert(!t->in_round_robin_queue); if (enable_chaos) { // new tasks get a random priority t->priority = choose_random_priority(t); } task_priority_set.insert(make_pair(t->priority, t)); } void Scheduler::on_destroy(RecordTask* t) { if (t == current_) { current_ = nullptr; } if (t->in_round_robin_queue) { auto iter = find(task_round_robin_queue.begin(), task_round_robin_queue.end(), t); task_round_robin_queue.erase(iter); } else { task_priority_set.erase(make_pair(t->priority, t)); } } void Scheduler::update_task_priority(RecordTask* t, int value) { if (!enable_chaos) { update_task_priority_internal(t, value); } } void Scheduler::in_stable_exit(RecordTask* t) { update_task_priority_internal(t, t->priority); } void Scheduler::update_task_priority_internal(RecordTask* t, int value) { if (t->stable_exit) { // Tasks in a stable exit have the highest priority. We should force them // to complete exiting ASAP to clean up resources. They may not be runnable // due to waiting for PTRACE_EVENT_EXIT to complete. value = -9999; } if (t->priority == value) { return; } if (t->in_round_robin_queue) { t->priority = value; return; } task_priority_set.erase(make_pair(t->priority, t)); t->priority = value; task_priority_set.insert(make_pair(t->priority, t)); } void Scheduler::schedule_one_round_robin(RecordTask* t) { maybe_pop_round_robin_task(t); ASSERT(t, !t->in_round_robin_queue); for (auto iter : task_priority_set) { if (iter.second != t && !iter.second->in_round_robin_queue) { task_round_robin_queue.push_back(iter.second); iter.second->in_round_robin_queue = true; } } task_priority_set.clear(); task_round_robin_queue.push_back(t); t->in_round_robin_queue = true; expire_timeslice(); } RecordTask* Scheduler::get_round_robin_task() { return task_round_robin_queue.empty() ? nullptr : task_round_robin_queue.front(); } void Scheduler::maybe_pop_round_robin_task(RecordTask* t) { if (task_round_robin_queue.empty() || t != task_round_robin_queue.front()) { return; } task_round_robin_queue.pop_front(); t->in_round_robin_queue = false; task_priority_set.insert(make_pair(t->priority, t)); } } // namespace rr rr-4.4.0/src/Scheduler.h000066400000000000000000000202701277367620400150370ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REC_SCHED_H_ #define RR_REC_SCHED_H_ #include #include #include "Ticks.h" #include "TraceFrame.h" #include "util.h" namespace rr { class RecordSession; class RecordTask; /** * Overview of rr scheduling: * * rr honours priorities set by setpriority(2) --- even in situations where the * kernel doesn't, e.g. when a non-privileged task tries to increase its * priority. Normally rr honors priorities strictly by scheduling the highest * priority runnable task; tasks with equal priorities are scheduled in * round-robin fashion. Strict priority scheduling helps find bugs due to * starvation. * * When a task calls sched_yield we temporarily switch to a completely * fair scheduler that ignores priorities. All tasks are placed on a queue * and while the queue is non-empty we take the next task from the queue and * run it for a quantum if it's runnable. We do this because tasks calling * sched_yield are often expecting some kind of fair scheduling and may deadlock * (e.g. trying to acquire a spinlock) if some other tasks don't get a chance * to run. * * The scheduler only runs during recording. During replay we're just replaying * the recorded scheduling decisions. * * The main interface to the scheduler is |get_next_thread|. This gets called * after every rr event to decide which task to run next. * * The scheduler gives the current task a 'timeslice', a ticks deadline after * which we will try to switch to another task. So |get_next_thread| first * checks whether the currently running task has exceeded that deadline. If * not, and the current task is runnable, we schedule it again. If it's blocked * or has exceeded its deadline, we search for another task to run: * taking tasks from the round-robin queue until we find one that's runnable, * and then if the round-robin queue is empty, choosing the highest-priority * task that's runnable. If the highest-priority runnable task has the same * priority as the current task, choose the next runnable task after the * current task (so equal priority tasks run in round-robin order). * * The main parameter to the scheduler is |max_ticks|, which controls the * length of each timeslice. */ class Scheduler { public: /** * Like most task schedulers, there are conflicting goals to balance. Lower * max-ticks generally makes the application more "interactive", generally * speaking lower latency. (And wrt catching bugs, this setting generally * creates more opportunity for bugs to arise in multi-threaded/process * applications.) This comes at the cost of more overhead from scheduling and * context switching. Context switches during recording are expensive because * we must context switch to the rr process and then to the next tracee task. * Increasing max-ticks generally gives the application higher throughput. * * Using ticks (retired conditional branches) to compute timeslices is quite * crude, since they don't correspond to any unit of time in general. * Hopefully that can be improved, but empirical data from Firefox * demonstrate, surprisingly consistently, a distribution of insns/rcb massed * around 10. Somewhat arbitrarily guessing ~4cycles/insn on average * (fair amount of pointer chasing), that implies for a nominal 2GHz CPU * 50,000 ticks per millisecond. We choose the default max ticks to give us * 10ms timeslices, i.e. 500,000 ticks. */ enum { DEFAULT_MAX_TICKS = 500000 }; Scheduler(RecordSession& session); void set_max_ticks(Ticks max_ticks) { max_ticks_ = max_ticks; } void set_always_switch(bool always_switch) { this->always_switch = always_switch; } void set_enable_chaos(bool enable_chaos); /** * Schedule a new runnable task (which may be the same as current()). * * The new current() task is guaranteed to either have already been * runnable, or have been made runnable by a waitpid status change (in * which case, result.by_waitpid will be true. */ struct Rescheduled { bool interrupted_by_signal; bool by_waitpid; bool started_new_timeslice; }; Rescheduled reschedule(Switchable switchable); /** * Set the priority of |t| to |value| and update related * state. */ void update_task_priority(RecordTask* t, int value); /** * Do one round of round-robin scheduling if we're not already doing one. * If we start round-robin scheduling now, make last_task the last * task to be scheduled. * If the task_round_robin_queue is empty this moves all tasks into it, * putting last_task last. */ void schedule_one_round_robin(RecordTask* last_task); void on_create(RecordTask* t); /** * De-register a thread. This function should be called when a thread exits. */ void on_destroy(RecordTask* t); RecordTask* current() const { return current_; } Ticks current_timeslice_end() const { return current_timeslice_end_; } void expire_timeslice() { current_timeslice_end_ = 0; } double interrupt_after_elapsed_time() const; /** * Return the number of cores we should report to applications. */ int pretend_num_cores() const { return pretend_num_cores_; } void in_stable_exit(RecordTask* t); private: // Tasks sorted by priority. typedef std::set> TaskPrioritySet; typedef std::deque TaskQueue; /** * Pull a task from the round-robin queue if available. Otherwise, * find the highest-priority task that is runnable. If the highest-priority * runnable task has the same priority as 't', return 't' or * the next runnable task after 't' in round-robin order. * Sets 'by_waitpid' to true if we determined the task was runnable by * calling waitpid on it and observing a state change. This task *must* * be returned by get_next_thread, and is_runnable_task must not be called * on it again until it has run. * Considers only tasks with priority <= priority_threshold. */ RecordTask* find_next_runnable_task(RecordTask* t, bool* by_waitpid, int priority_threshold); /** * Returns the first task in the round-robin queue or null if it's empty, * removing it from the round-robin queue. */ RecordTask* get_round_robin_task(); void maybe_pop_round_robin_task(RecordTask* t); RecordTask* get_next_task_with_same_priority(RecordTask* t); void setup_new_timeslice(); void maybe_reset_priorities(double now); int choose_random_priority(RecordTask* t); void update_task_priority_internal(RecordTask* t, int value); void maybe_reset_high_priority_only_intervals(double now); bool in_high_priority_only_interval(double now); bool treat_as_high_priority(RecordTask* t); bool is_task_runnable(RecordTask* t, bool* by_waitpid); RecordSession& session; /** * Every task of this session is either in task_priority_set * (when in_round_robin_queue is false), or in task_round_robin_queue * (when in_round_robin_queue is true). * * task_priority_set is a set of pairs of (task->priority, task). This * lets us efficiently iterate over the tasks with a given priority, or * all tasks in priority order. */ TaskPrioritySet task_priority_set; TaskQueue task_round_robin_queue; /** * The currently scheduled task. This may be nullptr if the last scheduled * task * has been destroyed. */ RecordTask* current_; Ticks current_timeslice_end_; /** * At this time (or later) we should refresh these values. */ double high_priority_only_intervals_refresh_time; double high_priority_only_intervals_start; double high_priority_only_intervals_duration; double high_priority_only_intervals_period; /** * At this time (or later) we should rerandomize RecordTask priorities. */ double priorities_refresh_time; int pretend_num_cores_; Ticks max_ticks_; /** * When true, context switch at every possible point. */ bool always_switch; /** * When true, make random scheduling decisions to try to increase the * probability of finding buggy schedules. */ bool enable_chaos; bool enable_poll; bool last_reschedule_in_high_priority_only_interval; RecordTask* must_run_task; }; } // namespace rr #endif /* RR_REC_SCHED_H_ */ rr-4.4.0/src/ScopedFd.h000066400000000000000000000017071277367620400146140ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_SCOPED_FD_H_ #define RR_SCOPED_FD_H_ #include #include #include #include namespace rr { /** * RAII helper to open a file and then close the fd when the helper * goes out of scope. */ class ScopedFd { public: ScopedFd() : fd(-1) {} ScopedFd(int fd) : fd(fd) {} ScopedFd(const char* pathname, int flags, mode_t mode = 0) : fd(open(pathname, flags, mode)) {} ScopedFd(ScopedFd&& other) : fd(other.fd) { other.fd = -1; } ~ScopedFd() { close(); } ScopedFd& operator=(ScopedFd&& other) { fd = other.fd; other.fd = -1; return *this; } operator int() const { return get(); } int get() const { return fd; } bool is_open() { return fd >= 0; } void close() { if (fd >= 0) { ::close(fd); } fd = -1; } private: int fd; }; } // namespace rr #endif // RR_SCOPED_FD_H rr-4.4.0/src/SeccompFilterRewriter.cc000066400000000000000000000100141277367620400175350ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "SeccompFilterRewriter.h" #include #include #include #include "AddressSpace.h" #include "AutoRemoteSyscalls.h" #include "RecordTask.h" #include "Registers.h" #include "TaskGroup.h" #include "kernel_abi.h" #include "log.h" #include "seccomp-bpf.h" using namespace std; namespace rr { static void set_syscall_result(RecordTask* t, long ret) { Registers r = t->regs(); r.set_syscall_result(ret); t->set_regs(r); } static void pass_through_seccomp_filter(RecordTask* t) { long ret; { AutoRemoteSyscalls remote(t); ret = remote.syscall(t->regs().original_syscallno(), t->regs().arg1(), t->regs().arg2(), t->regs().arg3()); } set_syscall_result(t, ret); ASSERT(t, t->regs().syscall_failed()); } template static void install_patched_seccomp_filter_arch( RecordTask* t, unordered_map& result_to_index, vector& index_to_result) { // Take advantage of the fact that the filter program is arg3() in both // prctl and seccomp syscalls. bool ok = true; auto prog = t->read_mem(remote_ptr(t->regs().arg3()), &ok); if (!ok) { // We'll probably return EFAULT but a kernel that doesn't support // seccomp(2) should return ENOSYS instead, so just run the original // system call to get the correct error. pass_through_seccomp_filter(t); return; } auto code = t->read_mem(prog.filter.rptr(), prog.len, &ok); if (!ok) { pass_through_seccomp_filter(t); return; } // Convert all returns to TRACE returns so that rr can handle them. // See handle_ptrace_event in RecordSession. for (auto& u : code) { if (BPF_CLASS(u.code) == BPF_RET) { ASSERT(t, BPF_RVAL(u.code) == BPF_K) << "seccomp-bpf program uses BPF_RET with A/X register, not " "supported"; if (u.k != SECCOMP_RET_ALLOW) { if (result_to_index.find(u.k) == result_to_index.end()) { ASSERT(t, index_to_result.size() < SECCOMP_RET_DATA) << "Too many distinct constants used in seccomp-bpf programs"; result_to_index[u.k] = index_to_result.size(); index_to_result.push_back(u.k); } u.k = result_to_index[u.k] | SECCOMP_RET_TRACE; } } } SeccompFilter f; for (auto& e : AddressSpace::rr_page_syscalls()) { if (e.privileged == AddressSpace::PRIVILEGED) { auto ip = AddressSpace::rr_page_syscall_exit_point(e.traced, e.privileged, e.enabled); f.allow_syscalls_from_callsite(ip); } } f.filters.insert(f.filters.end(), code.begin(), code.end()); long ret; { AutoRemoteSyscalls remote(t); AutoRestoreMem mem( remote, nullptr, sizeof(prog) + f.filters.size() * sizeof(typename Arch::sock_filter)); auto code_ptr = mem.get().cast(); t->write_mem(code_ptr, f.filters.data(), f.filters.size()); prog.len = f.filters.size(); prog.filter = code_ptr; auto prog_ptr = remote_ptr(code_ptr + f.filters.size()) .cast(); t->write_mem(prog_ptr, prog); ret = remote.syscall(t->regs().original_syscallno(), t->regs().arg1(), t->regs().arg2(), prog_ptr); } set_syscall_result(t, ret); if (!t->regs().syscall_failed()) { if (is_seccomp_syscall(t->regs().original_syscallno(), t->arch()) && (t->regs().arg2() & SECCOMP_FILTER_FLAG_TSYNC)) { for (Task* tt : t->task_group()->task_set()) { static_cast(tt)->prctl_seccomp_status = 2; } } else { t->prctl_seccomp_status = 2; } } } void SeccompFilterRewriter::install_patched_seccomp_filter(RecordTask* t) { RR_ARCH_FUNCTION(install_patched_seccomp_filter_arch, t->arch(), t, result_to_index, index_to_result); } } // namespace rr rr-4.4.0/src/SeccompFilterRewriter.h000066400000000000000000000026101277367620400174020ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_SECCOMP_FILTER_REWRITER_H_ #define RR_SECCOMP_FILTER_REWRITER_H_ #include #include #include #include namespace rr { class RecordTask; /** * Object to support install_patched_seccomp_filter. */ class SeccompFilterRewriter { public: /** * Assuming |t| is set up for a prctl or seccomp syscall that * installs a seccomp-bpf filter, patch the filter to signal the tracer * instead of silently delivering an errno, and install it. */ void install_patched_seccomp_filter(RecordTask* t); uint32_t map_filter_data_to_real_result(uint16_t value) { assert(value < index_to_result.size()); return index_to_result[value]; } private: /** * Seccomp filters can return 32-bit result values. We need to map all of * them into a single 16 bit data field. Fortunately (so far) all the * filters we've seen return constants, so there aren't too many distinct * values we need to deal with. For each constant value that gets returned, * we'll add it as the key in |result_map|, with the corresponding value * being the 16-bit data value that our rewritten filter returns. */ std::unordered_map result_to_index; std::vector index_to_result; }; } // namespace rr #endif // RR_SECCOMP_FILTER_REWRITER_H_ rr-4.4.0/src/Session.cc000066400000000000000000000573611277367620400147150ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Session.h" #include #include #include #include #include #include #include #include "rr/rr.h" #include "AutoRemoteSyscalls.h" #include "EmuFs.h" #include "Task.h" #include "TaskGroup.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" using namespace std; namespace rr { struct Session::CloneCompletion { struct TaskGroup { Task* clone_leader; Task::CapturedState clone_leader_state; vector member_states; vector, vector>> captured_memory; }; vector task_groups; }; Session::Session() : next_task_serial_(1), syscall_seccomp_ordering_(PTRACE_SYSCALL_BEFORE_SECCOMP_UNKNOWN), done_initial_exec_(false), visible_execution_(true) { LOG(debug) << "Session " << this << " created"; } Session::~Session() { kill_all_tasks(); LOG(debug) << "Session " << this << " destroyed"; for (auto tg : task_group_map) { tg.second->forget_session(); } } Session::Session(const Session& other) { statistics_ = other.statistics_; next_task_serial_ = other.next_task_serial_; done_initial_exec_ = other.done_initial_exec_; visible_execution_ = other.visible_execution_; } void Session::on_create(TaskGroup* tg) { task_group_map[tg->tguid()] = tg; } void Session::on_destroy(TaskGroup* tg) { task_group_map.erase(tg->tguid()); } void Session::post_exec() { assert_fully_initialized(); if (done_initial_exec_) { return; } done_initial_exec_ = true; assert(tasks().size() == 1); tasks().begin()->second->flush_inconsistent_state(); spawned_task_error_fd_.close(); } AddressSpace::shr_ptr Session::create_vm(Task* t, const std::string& exe, uint32_t exec_count) { assert_fully_initialized(); AddressSpace::shr_ptr as(new AddressSpace(t, exe, exec_count)); as->insert_task(t); vm_map[as->uid()] = as.get(); return as; } AddressSpace::shr_ptr Session::clone(Task* t, AddressSpace::shr_ptr vm) { assert_fully_initialized(); // If vm already belongs to our session this is a fork, otherwise it's // a session-clone AddressSpace::shr_ptr as; if (this == vm->session()) { as = AddressSpace::shr_ptr( new AddressSpace(this, *vm, t->rec_tid, t->tuid().serial(), 0)); } else { as = AddressSpace::shr_ptr(new AddressSpace(this, *vm, vm->uid().tid(), vm->uid().serial(), vm->uid().exec_count())); } vm_map[as->uid()] = as.get(); return as; } TaskGroup::shr_ptr Session::create_tg(Task* t) { TaskGroup::shr_ptr tg( new TaskGroup(this, nullptr, t->rec_tid, t->tid, t->tuid().serial())); tg->insert_task(t); return tg; } TaskGroup::shr_ptr Session::clone(Task* t, TaskGroup::shr_ptr tg) { assert_fully_initialized(); // If tg already belongs to our session this is a fork to create a new // taskgroup, otherwise it's a session-clone of an existing taskgroup if (this == tg->session()) { return TaskGroup::shr_ptr( new TaskGroup(this, tg.get(), t->rec_tid, t->tid, t->tuid().serial())); } TaskGroup* parent = tg->parent() ? find_task_group(tg->parent()->tguid()) : nullptr; return TaskGroup::shr_ptr( new TaskGroup(this, parent, tg->tgid, t->tid, tg->tguid().serial())); } Task* Session::new_task(pid_t tid, pid_t rec_tid, uint32_t serial, SupportedArch a) { return new Task(*this, tid, rec_tid, serial, a); } vector Session::vms() const { vector result; for (auto& vm : vm_map) { result.push_back(vm.second); } return result; } Task* Session::clone(Task* p, int flags, remote_ptr stack, remote_ptr tls, remote_ptr cleartid_addr, pid_t new_tid, pid_t new_rec_tid) { assert_fully_initialized(); Task* c = p->clone(flags, stack, tls, cleartid_addr, new_tid, new_rec_tid, next_task_serial()); on_create(c); return c; } Task* Session::find_task(pid_t rec_tid) const { finish_initializing(); auto it = tasks().find(rec_tid); return tasks().end() != it ? it->second : nullptr; } Task* Session::find_task(const TaskUid& tuid) const { Task* t = find_task(tuid.tid()); return t && t->tuid() == tuid ? t : nullptr; } TaskGroup* Session::find_task_group(const TaskGroupUid& tguid) const { finish_initializing(); auto it = task_group_map.find(tguid); if (task_group_map.end() == it) { return nullptr; } return it->second; } AddressSpace* Session::find_address_space(const AddressSpaceUid& vmuid) const { finish_initializing(); auto it = vm_map.find(vmuid); if (vm_map.end() == it) { return nullptr; } return it->second; } void Session::kill_all_tasks() { for (auto& v : task_map) { Task* t = v.second; if (!t->is_stopped) { // During recording we might be aborting the recording, in which case // one or more tasks might not be stopped. We haven't got any really // good options here so we'll just skip detaching and try killing // it with SIGKILL below. rr will usually exit immediately after this // so the likelihood that we'll leak a zombie task isn't too bad. continue; } /* * Prepare to forcibly kill this task by detaching it first. To ensure * the task doesn't continue executing, we first set its ip() to an * invalid value. We need to do this for all tasks in the Session before * kill() is guaranteed to work properly. SIGKILL on ptrace-attached tasks * seems to not work very well, and after sending SIGKILL we can't seem to * reliably detach. */ LOG(debug) << "safely detaching from " << t->tid << " ..."; // Detaching from the process lets it continue. We don't want a replaying // process to perform syscalls or do anything else observable before we // get around to SIGKILLing it. So we move its ip() to an address // which will cause it to do an exit() syscall if it runs at all. // We used to set this to an invalid address, but that causes a SIGSEGV // to be raised which can cause core dumps after we detach from ptrace. // Making the process undumpable with PR_SET_DUMPABLE turned out not to // be practical because that has a side effect of triggering various // security measures blocking inspection of the process (PTRACE_ATTACH, // access to /proc//fd). // Disabling dumps via setrlimit(RLIMIT_CORE, 0) doesn't stop dumps // if /proc/sys/kernel/core_pattern is set to pipe the core to a process // (e.g. to systemd-coredump). // We also tried setting ip() to an address that does an infinite loop, // but that leaves a runaway process if something happens to kill rr // after detaching but before we get a chance to SIGKILL the tracee. Registers r = t->regs(); r.set_ip(t->vm()->privileged_traced_syscall_ip()); r.set_syscallno(syscall_number_for_exit(r.arch())); r.set_arg1(0); t->set_regs(r); long result; do { // We have observed this failing with an ESRCH when the thread clearly // still exists and is ptraced. Retrying the PTRACE_DETACH seems to // work around it. result = t->fallible_ptrace(PTRACE_DETACH, nullptr, nullptr); ASSERT(t, result >= 0 || errno == ESRCH); } while (result < 0); } while (!task_map.empty()) { Task* t = task_map.rbegin()->second; if (!t->unstable) { /** * Destroy the OS task backing this by sending it SIGKILL and * ensuring it was delivered. After |kill()|, the only * meaningful thing that can be done with this task is to * delete it. */ LOG(debug) << "sending SIGKILL to " << t->tid << " ..."; // If we haven't already done a stable exit via syscall, // kill the task and note that the entire task group is unstable. // The task may already have exited due to the preparation above, // so we might accidentally shoot down the wrong task :-(, but we // have to do this because the task might be in a state where it's not // going to run and exit by itself. // Linux doesn't seem to give us a reliable way to detach and kill // the tracee without races. syscall(SYS_tgkill, t->real_tgid(), t->tid, SIGKILL); t->task_group()->destabilize(); } t->destroy(); } } void Session::on_destroy(AddressSpace* vm) { assert(vm->task_set().size() == 0); assert(vm_map.count(vm->uid()) == 1); vm_map.erase(vm->uid()); } void Session::on_destroy(Task* t) { assert(task_map.count(t->rec_tid) == 1); task_map.erase(t->rec_tid); } void Session::on_create(Task* t) { task_map[t->rec_tid] = t; } ScopedFd Session::create_spawn_task_error_pipe() { int fds[2]; if (0 != pipe2(fds, O_CLOEXEC)) { FATAL(); } spawned_task_error_fd_ = fds[0]; return ScopedFd(fds[1]); } string Session::read_spawned_task_error() const { char buf[1024] = ""; ssize_t len = read(spawned_task_error_fd_, buf, sizeof(buf)); if (len <= 0) { return string(); } buf[len] = 0; return string(buf, len); } BreakStatus Session::diagnose_debugger_trap(Task* t, RunCommand run_command) { assert_fully_initialized(); BreakStatus break_status; break_status.task = t; int stop_sig = t->stop_sig(); if (!stop_sig) { // This can happen if we were INCOMPLETE because we're close to // the ticks_target. return break_status; } if (SIGTRAP != stop_sig) { BreakpointType pending_bp = t->vm()->get_breakpoint_type_at_addr(t->ip()); if (BKPT_USER == pending_bp) { // A signal was raised /just/ before a trap // instruction for a SW breakpoint. This is // observed when debuggers write trap // instructions into no-exec memory, for // example the stack. // // We report the breakpoint before any signal // that might have been raised in order to let // the debugger do something at the breakpoint // insn; possibly clearing the breakpoint and // changing the $ip. Otherwise, we expect the // debugger to clear the breakpoint and resume // execution, which should raise the original // signal again. LOG(debug) << "hit debugger breakpoint BEFORE ip " << t->ip() << " for " << t->get_siginfo(); break_status.breakpoint_hit = true; } else if (stop_sig && stop_sig != PerfCounters::TIME_SLICE_SIGNAL) { break_status.signal = stop_sig; } } else { TrapReasons trap_reasons = t->compute_trap_reasons(); // Conceal any internal singlestepping if (trap_reasons.singlestep && is_singlestep(run_command)) { LOG(debug) << " finished debugger stepi"; break_status.singlestep_complete = true; } if (trap_reasons.watchpoint) { check_for_watchpoint_changes(t, break_status); } if (trap_reasons.breakpoint) { BreakpointType retired_bp = t->vm()->get_breakpoint_type_for_retired_insn(t->ip()); if (BKPT_USER == retired_bp) { LOG(debug) << "hit debugger breakpoint at ip " << t->ip(); // SW breakpoint: $ip is just past the // breakpoint instruction. Move $ip back // right before it. t->move_ip_before_breakpoint(); break_status.breakpoint_hit = true; } } } return break_status; } void Session::check_for_watchpoint_changes(Task* t, BreakStatus& break_status) { assert_fully_initialized(); break_status.watchpoints_hit = t->vm()->consume_watchpoint_changes(); } void Session::assert_fully_initialized() const { assert(!clone_completion && "Session not fully initialized"); } void Session::finish_initializing() const { if (!clone_completion) { return; } Session* self = const_cast(this); for (auto& tgleader : clone_completion->task_groups) { AutoRemoteSyscalls remote(tgleader.clone_leader); for (auto m : tgleader.clone_leader->vm()->maps()) { // Creating this mapping was delayed in capture_state for performance if (m.flags & AddressSpace::Mapping::IS_SYSCALLBUF) { self->recreate_shared_mmap(remote, m); } } for (auto& mem : tgleader.captured_memory) { tgleader.clone_leader->write_bytes_helper(mem.first, mem.second.size(), mem.second.data()); } for (auto& tgmember : tgleader.member_states) { Task* t_clone = Task::os_clone_into(tgmember, tgleader.clone_leader, remote); self->on_create(t_clone); t_clone->copy_state(tgmember); } tgleader.clone_leader->copy_state(tgleader.clone_leader_state); } self->clone_completion = nullptr; } static void remap_shared_mmap(AutoRemoteSyscalls& remote, EmuFs& emu_fs, EmuFs& dest_emu_fs, const AddressSpace::Mapping& m_in_mem) { AddressSpace::Mapping m = m_in_mem; LOG(debug) << " remapping shared region at " << m.map.start() << "-" << m.map.end(); remote.infallible_syscall(syscall_number_for_munmap(remote.arch()), m.map.start(), m.map.size()); EmuFile::shr_ptr emu_file; if (dest_emu_fs.has_file_for(m.recorded_map)) { emu_file = dest_emu_fs.at(m.recorded_map); } else { emu_file = dest_emu_fs.clone_file(emu_fs.at(m.recorded_map)); } // TODO: this duplicates some code in replay_syscall.cc, but // it's somewhat nontrivial to factor that code out. int remote_fd; { string path = emu_file->proc_path(); AutoRestoreMem child_path(remote, path.c_str()); // Always open the emufs file O_RDWR, even if the current mapping prot // is read-only. We might mprotect it to read-write later. // skip leading '/' since we want the path to be relative to the root fd remote_fd = remote.infallible_syscall( syscall_number_for_openat(remote.arch()), RR_RESERVED_ROOT_DIR_FD, child_path.get() + 1, O_RDWR); if (0 > remote_fd) { FATAL() << "Couldn't open " << path << " in tracee"; } } struct stat real_file = remote.task()->stat_fd(remote_fd); string real_file_name = remote.task()->file_name_of_fd(remote_fd); // XXX this condition is x86/x64-specific, I imagine. remote.infallible_mmap_syscall(m.map.start(), m.map.size(), m.map.prot(), // The remapped segment *must* be // remapped at the same address, // or else many things will go // haywire. (m.map.flags() & ~MAP_ANONYMOUS) | MAP_FIXED, remote_fd, m.map.file_offset_bytes() / page_size()); // We update the AddressSpace mapping too, since that tracks the real file // name and we need to update that. remote.task()->vm()->map( remote.task(), m.map.start(), m.map.size(), m.map.prot(), m.map.flags(), m.map.file_offset_bytes(), real_file_name, real_file.st_dev, real_file.st_ino, nullptr, &m.recorded_map, emu_file); remote.infallible_syscall(syscall_number_for_close(remote.arch()), remote_fd); } #define RR_MAPPING_PREFIX "/tmp/rr-shared-" KernelMapping Session::create_shared_mmap( AutoRemoteSyscalls& remote, size_t size, remote_ptr map_hint, const char* name, int tracee_prot, int tracee_flags, MonitoredSharedMemory::shr_ptr&& monitored) { static int nonce = 0; // Create the segment we'll share with the tracee. char path[PATH_MAX]; snprintf(path, sizeof(path) - 1, RR_MAPPING_PREFIX "%s-%d-%d", name, remote.task()->real_tgid(), nonce++); // Let the child create the shmem block and then send the fd back to us. // This lets us avoid having to make the file world-writeable so that // the child can read it when it's in a different user namespace (which // would be a security hole, letting other users abuse rr users). int child_shmem_fd; { AutoRestoreMem child_path(remote, path); // skip leading '/' since we want the path to be relative to the root fd child_shmem_fd = remote.infallible_syscall( syscall_number_for_openat(remote.arch()), RR_RESERVED_ROOT_DIR_FD, child_path.get() + 1, O_CREAT | O_EXCL | O_RDWR | O_CLOEXEC, 0600); } /* Remove the fs name so that we don't have to worry about * cleaning up this segment in error conditions. */ unlink(path); ScopedFd shmem_fd = remote.retrieve_fd(child_shmem_fd); resize_shmem_segment(shmem_fd, size); LOG(debug) << "created shmem segment " << path; // Map the segment in ours and the tracee's address spaces. void* map_addr; int flags = MAP_SHARED; if ((void*)-1 == (map_addr = mmap(nullptr, size, PROT_READ | PROT_WRITE, flags, shmem_fd, 0))) { FATAL() << "Failed to mmap shmem region"; } if (!map_hint.is_null()) { flags |= MAP_FIXED; } remote_ptr child_map_addr = remote.infallible_mmap_syscall( map_hint, size, tracee_prot, flags, child_shmem_fd, 0); struct stat st; ASSERT(remote.task(), 0 == ::fstat(shmem_fd, &st)); KernelMapping km = remote.task()->vm()->map( remote.task(), child_map_addr, size, tracee_prot, flags | tracee_flags, 0, path, st.st_dev, st.st_ino, nullptr, nullptr, nullptr, map_addr, std::move(monitored)); shmem_fd.close(); remote.infallible_syscall(syscall_number_for_close(remote.arch()), child_shmem_fd); return km; } static char* extract_name(char* name_buffer, size_t buffer_size) { // Recover the name that was originally chosen by finding the part of the // name between RR_MAPPING_PREFIX and the -%d-%d at the end. char* name_end = name_buffer + strnlen(name_buffer, buffer_size); char* name_start = name_buffer + strlen(RR_MAPPING_PREFIX); int hyphens_seen = 0; while (name_end > name_start) { --name_end; if (*name_end == '-') { ++hyphens_seen; } if (hyphens_seen == 2) { break; } } *name_end = '\0'; return name_start; } // Recreate an mmap region that is shared between rr and the tracee. The caller // is responsible for recreating the data in the new mmap. const AddressSpace::Mapping& Session::recreate_shared_mmap( AutoRemoteSyscalls& remote, const AddressSpace::Mapping& m, MonitoredSharedMemory::shr_ptr&& monitored) { char name[PATH_MAX]; strncpy(name, m.map.fsname().c_str(), sizeof(name)); uint32_t flags = m.flags; remote_ptr new_addr = create_shared_mmap(remote, m.map.size(), m.map.start(), extract_name(name, sizeof(name)), m.map.prot(), 0, std::move(monitored)) .start(); // m may be invalid now remote.task()->vm()->mapping_flags_of(new_addr) = flags; return remote.task()->vm()->mapping_of(new_addr); } // Replace a MAP_PRIVATE segment by one that is shared between rr and the // tracee. Returns true on success bool Session::make_private_shared(AutoRemoteSyscalls& remote, const AddressSpace::Mapping m) { if (!(m.map.flags() & MAP_PRIVATE)) { return false; } // Find a place to map the current segment to temporarily remote_ptr start = m.map.start(); size_t sz = m.map.size(); remote_ptr free_mem = remote.task()->vm()->find_free_memory(sz); remote.infallible_syscall(syscall_number_for_mremap(remote.arch()), start, sz, sz, MREMAP_MAYMOVE | MREMAP_FIXED, free_mem); remote.task()->vm()->remap(remote.task(), start, sz, free_mem, sz); // AutoRemoteSyscalls may have gotten unlucky and picked the old stack // segment as it's scratch space, reevaluate that choice AutoRemoteSyscalls remote2(remote.task()); // We will include the name of the full path of the original mapping in the // name of the shared mapping, replacing slashes by dashes. char name[PATH_MAX - 40]; strncpy(name, m.map.fsname().c_str(), sizeof(name)); name[sizeof(name) - 1] = '\0'; for (char* ptr = name; *ptr != '\0'; ++ptr) { if (*ptr == '/') *ptr = '-'; } // Now create the new mapping in its place const AddressSpace::Mapping& new_m = remote.task()->vm()->mapping_of( create_shared_mmap(remote2, sz, start, name, m.map.prot(), m.map.flags() & (MAP_GROWSDOWN | MAP_STACK)) .start()); // And copy over the contents. Since we can't just call memcpy in the // inferior, just copy directly from the remote private into the local // reference of the shared mapping. We use the fallible read method to // handle the case where the mapping is larger than the backing file, which // would otherwise cause a short read. remote2.task()->read_bytes_fallible(free_mem, sz, new_m.local_addr); // Finally unmap the original segment remote2.infallible_syscall(syscall_number_for_munmap(remote.arch()), free_mem, sz); remote.task()->vm()->unmap(remote.task(), free_mem, sz); return true; } static vector capture_syscallbuf(const AddressSpace::Mapping& m, Task* clone_leader) { remote_ptr start = m.map.start().cast(); auto syscallbuf_hdr = start.cast(); size_t data_size; if (clone_leader->read_mem(REMOTE_PTR_FIELD(syscallbuf_hdr, locked))) { // There may be an incomplete syscall record after num_rec_bytes that // we need to capture here. We don't know how big that record is, // so just record the entire buffer. This should not be common. data_size = m.map.size(); } else { data_size = clone_leader->read_mem( REMOTE_PTR_FIELD(syscallbuf_hdr, num_rec_bytes)) + sizeof(struct syscallbuf_hdr); } return clone_leader->read_mem(start, data_size); } void Session::copy_state_to(Session& dest, EmuFs& emu_fs, EmuFs& dest_emu_fs) { assert_fully_initialized(); assert(!dest.clone_completion); auto completion = unique_ptr(new CloneCompletion()); for (auto vm : vm_map) { // Pick an arbitrary task to be group leader. The actual group leader // might have died already. Task* group_leader = *vm.second->task_set().begin(); LOG(debug) << " forking tg " << group_leader->tgid() << " (real: " << group_leader->real_tgid() << ")"; completion->task_groups.push_back(CloneCompletion::TaskGroup()); auto& group = completion->task_groups.back(); group.clone_leader = group_leader->os_fork_into(&dest); dest.on_create(group.clone_leader); LOG(debug) << " forked new group leader " << group.clone_leader->tid; { AutoRemoteSyscalls remote(group.clone_leader); for (auto m : group.clone_leader->vm()->maps()) { // Special case the syscallbuf as a performance optimization. The amount // of data we need to capture is usually significantly smaller than the // size of the mapping, so allocating the whole mapping here would be // wasteful. if (m.flags & AddressSpace::Mapping::IS_SYSCALLBUF) { group.captured_memory.push_back(make_pair( m.map.start(), capture_syscallbuf(m, group.clone_leader))); } else if (m.local_addr != nullptr) { memcpy(recreate_shared_mmap(remote, m).local_addr, m.local_addr, m.map.size()); } else if ((m.recorded_map.flags() & MAP_SHARED) && emu_fs.has_file_for(m.recorded_map)) { remap_shared_mmap(remote, emu_fs, dest_emu_fs, m); } } for (auto t : group_leader->task_group()->task_set()) { if (group_leader == t) { continue; } LOG(debug) << " cloning " << t->rec_tid; group.member_states.push_back(t->capture_state()); } } group.clone_leader_state = group_leader->capture_state(); } dest.clone_completion = move(completion); assert(dest.vms().size() > 0); } } // namespace rr rr-4.4.0/src/Session.h000066400000000000000000000234321277367620400145470ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_SESSION_H_ #define RR_SESSION_H_ #include #include #include #include #include #include #include "AddressSpace.h" #include "MonitoredSharedMemory.h" #include "TaskishUid.h" #include "TraceStream.h" namespace rr { class AddressSpace; class DiversionSession; class EmuFs; class RecordSession; class ReplaySession; class ReplayTask; class Task; class TaskGroup; class AutoRemoteSyscalls; // The following types are used by step() APIs in Session subclasses. /** * In general, multiple break reasons can apply simultaneously. */ struct BreakStatus { BreakStatus() : task(nullptr), signal(0), breakpoint_hit(false), singlestep_complete(false), approaching_ticks_target(false), task_exit(false) {} // The triggering Task. This may be different from session->current_task() // when replay switches to a new task when ReplaySession::replay_step() ends. Task* task; // List of watchpoints hit; any watchpoint hit causes a stop after the // instruction that triggered the watchpoint has completed. std::vector watchpoints_hit; // When nonzero, we stopped because a signal was delivered to |task|. int signal; // True when we stopped because we hit a breakpoint at |task|'s current // ip(). bool breakpoint_hit; // True when we stopped because a singlestep completed in |task|. bool singlestep_complete; // True when we stopped because we got too close to the specified ticks // target. bool approaching_ticks_target; // True when we stopped because |task| is about to exit. bool task_exit; bool any_break() { return !watchpoints_hit.empty() || signal || breakpoint_hit || singlestep_complete || approaching_ticks_target; } }; enum RunCommand { // Continue until we hit a breakpoint or a new replay event RUN_CONTINUE, // Execute a single instruction (unless at a breakpoint or a replay event) RUN_SINGLESTEP, // Like RUN_SINGLESTEP, but a single-instruction loop is allowed (but not // required) to execute multiple times if we don't reach a different // instruction. Usable with ReplaySession::replay_step only. RUN_SINGLESTEP_FAST_FORWARD }; inline bool is_singlestep(RunCommand command) { return command == RUN_SINGLESTEP || command == RUN_SINGLESTEP_FAST_FORWARD; } /** * Sessions track the global state of a set of tracees corresponding * to an rr recorder or replayer. During recording, the tracked * tracees will all write to the same TraceWriter, and during * replay, the tracees that will be tracked will all be created based * on the same TraceReader. * * Multiple sessions can coexist in the same process. This * is required when using replay checkpoints, for example. */ class Session { friend class ReplaySession; public: // AddressSpaces and TaskGroups are indexed by their first task's TaskUid // (effectively), so that if the first task dies and its tid is recycled, // we don't get confused. TaskMap is indexed by tid since there can never be // two Tasks with the same tid at the same time. typedef std::map AddressSpaceMap; typedef std::map TaskMap; typedef std::map TaskGroupMap; /** * Call |post_exec()| immediately after a tracee has successfully * |execve()|'d. After that, |can_validate()| returns true. * This is called while we're still in the execve syscall so it's not safe * to perform remote syscalls in this method. * * Tracee state can't be validated before the first exec, * because the address space inside the rr process for |rr * replay| will be different than it was for |rr record|. * After the first exec, we're running tracee code, and * everything must be the same. */ void post_exec(); /** * Returns true after the tracee has done the initial exec in Task::spawn. * Before then, tracee state can be inconsistent; from the exec exit-event * onwards, the tracee state much be consistent. */ bool done_initial_exec() const { return done_initial_exec_; } /** * Create and return a new address space that's constructed * from |t|'s actual OS address space. When spawning, |exe| is the empty * string; it will be replaced during the first execve(), when we first * start running real tracee code. */ std::shared_ptr create_vm( Task* t, const std::string& exe = std::string(), uint32_t exec_count = 0); /** * Return a copy of |vm| with the same mappings. If any * mapping is changed, only the |clone()|d copy is updated, * not its origin (i.e. copy-on-write semantics). */ std::shared_ptr clone(Task* t, std::shared_ptr vm); std::shared_ptr create_tg(Task* t); /** * Return a copy of |tg| with the same mappings. */ std::shared_ptr clone(Task* t, std::shared_ptr tg); /** See Task::clone(). */ Task* clone(Task* p, int flags, remote_ptr stack, remote_ptr tls, remote_ptr cleartid_addr, pid_t new_tid, pid_t new_rec_tid = -1); uint32_t next_task_serial() { return next_task_serial_++; } /** * Return the task created with |rec_tid|, or nullptr if no such * task exists. */ Task* find_task(pid_t rec_tid) const; Task* find_task(const TaskUid& tuid) const; /** * Return the task group whose unique ID is |tguid|, or nullptr if no such * task group exists. */ TaskGroup* find_task_group(const TaskGroupUid& tguid) const; /** * Return the AddressSpace whose unique ID is |vmuid|, or nullptr if no such * address space exists. */ AddressSpace* find_address_space(const AddressSpaceUid& vmuid) const; /** * |tasks().size()| will be zero and all the OS tasks will be * gone when this returns, or this won't return. */ void kill_all_tasks(); /** * Call these functions from the objects' destructors in order * to notify this session that the objects are dying. */ void on_destroy(AddressSpace* vm); virtual void on_destroy(Task* t); void on_create(TaskGroup* tg); void on_destroy(TaskGroup* tg); /** Return the set of Tasks being tracekd in this session. */ const TaskMap& tasks() const { finish_initializing(); return task_map; } /** * Return the set of AddressSpaces being tracked in this session. */ std::vector vms() const; virtual RecordSession* as_record() { return nullptr; } virtual ReplaySession* as_replay() { return nullptr; } virtual DiversionSession* as_diversion() { return nullptr; } bool is_recording() { return as_record() != nullptr; } bool is_replaying() { return as_replay() != nullptr; } bool is_diversion() { return as_diversion() != nullptr; } bool visible_execution() const { return visible_execution_; } void set_visible_execution(bool visible) { visible_execution_ = visible; } struct Statistics { Statistics() : bytes_written(0), ticks_processed(0), syscalls_performed(0) {} uint64_t bytes_written; Ticks ticks_processed; uint32_t syscalls_performed; }; void accumulate_bytes_written(uint64_t bytes_written) { statistics_.bytes_written += bytes_written; } void accumulate_syscall_performed() { statistics_.syscalls_performed += 1; } void accumulate_ticks_processed(Ticks ticks) { statistics_.ticks_processed += ticks; } Statistics statistics() { return statistics_; } virtual Task* new_task(pid_t tid, pid_t rec_tid, uint32_t serial, SupportedArch a); std::string read_spawned_task_error() const; static KernelMapping create_shared_mmap( AutoRemoteSyscalls& remote, size_t size, remote_ptr map_hint, const char* name, int tracee_prot = PROT_READ | PROT_WRITE, int tracee_flags = 0, MonitoredSharedMemory::shr_ptr&& monitored = nullptr); static bool make_private_shared(AutoRemoteSyscalls& remote, const AddressSpace::Mapping m); static const AddressSpace::Mapping& recreate_shared_mmap( AutoRemoteSyscalls& remote, const AddressSpace::Mapping& m, MonitoredSharedMemory::shr_ptr&& monitored = nullptr); enum PtraceSyscallBeforeSeccomp { PTRACE_SYSCALL_BEFORE_SECCOMP, SECCOMP_BEFORE_PTRACE_SYSCALL, PTRACE_SYSCALL_BEFORE_SECCOMP_UNKNOWN, }; PtraceSyscallBeforeSeccomp syscall_seccomp_ordering() { return syscall_seccomp_ordering_; } protected: Session(); virtual ~Session(); ScopedFd create_spawn_task_error_pipe(); Session(const Session& other); Session& operator=(const Session&) = delete; virtual void on_create(Task* t); BreakStatus diagnose_debugger_trap(Task* t, RunCommand run_command); void check_for_watchpoint_changes(Task* t, BreakStatus& break_status); void copy_state_to(Session& dest, EmuFs& emu_fs, EmuFs& dest_emu_fs); struct CloneCompletion; // Call this before doing anything that requires access to the full set // of tasks (i.e., almost anything!). Not really const! void finish_initializing() const; void assert_fully_initialized() const; AddressSpaceMap vm_map; TaskMap task_map; TaskGroupMap task_group_map; // If non-null, data required to finish initializing the tasks of this // session. std::unique_ptr clone_completion; Statistics statistics_; uint32_t next_task_serial_; ScopedFd spawned_task_error_fd_; PtraceSyscallBeforeSeccomp syscall_seccomp_ordering_; /** * True if we've done an exec so tracees are now in a state that will be * consistent across record and replay. */ bool done_initial_exec_; /** * True while the execution of this session is visible to users. */ bool visible_execution_; }; } // namespace rr #endif // RR_SESSION_H_ rr-4.4.0/src/StdioMonitor.cc000066400000000000000000000022641277367620400157140ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "StdioMonitor.h" #include "Flags.h" #include "ReplaySession.h" #include "ReplayTask.h" #include "Session.h" #include "log.h" namespace rr { Switchable StdioMonitor::will_write(Task* t) { if (Flags::get().mark_stdio && t->session().visible_execution()) { char buf[256]; snprintf(buf, sizeof(buf) - 1, "[rr %d %d]", t->tgid(), t->trace_time()); ssize_t len = strlen(buf); if (write(original_fd, buf, len) != len) { ASSERT(t, false) << "Couldn't write to " << original_fd; } } return PREVENT_SWITCH; } void StdioMonitor::did_write(Task* t, const std::vector& ranges, int64_t) { if (!t->session().is_replaying()) { return; } auto rt = static_cast(t); if (rt->session().redirect_stdio() && rt->session().visible_execution()) { for (auto& r : ranges) { auto bytes = t->read_mem(r.data.cast(), r.length); if (bytes.size() != (size_t)write(original_fd, bytes.data(), bytes.size())) { ASSERT(t, false) << "Couldn't write to " << original_fd; } } } } } // namespace rr rr-4.4.0/src/StdioMonitor.h000066400000000000000000000031371277367620400155560ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_STDIO_MONITOR_H_ #define RR_STDIO_MONITOR_H_ #include "FileMonitor.h" namespace rr { /** * A FileMonitor to track writes to rr's stdout/stderr fds. * StdioMonitor prevents syscallbuf from buffering output to those fds. It * adds the optional stdio markers. During replay, it echoes stdio writes. */ class StdioMonitor : public FileMonitor { public: /** * Create a StdioMonitor that monitors writes to rr's original_fd * (STDOUT_FILENO or STDERR_FILENO). * Note that it's possible for a tracee to have a StdioMonitor associated * with a different fd, thanks to dup() etc. */ StdioMonitor(int original_fd) : original_fd(original_fd) {} virtual Type type() { return Stdio; } /** * Make writes to stdout/stderr blocking, to avoid nondeterminism in the * order in which the kernel actually performs such writes. * This theoretically introduces the possibility of deadlock between rr's * tracee and some external program reading rr's output * via a pipe ... but that seems unlikely to bite in practice. * * Also, if stdio-marking is enabled, prepend the stdio write with * "[rr ]". This allows users to more easily correlate * stdio with trace event numbers. */ virtual Switchable will_write(Task* t); /** * During replay, echo writes to stdout/stderr. */ virtual void did_write(Task* t, const std::vector& ranges, int64_t offset); private: int original_fd; }; } // namespace rr #endif /* RR_STDIO_MONITOR_H_ */ rr-4.4.0/src/StringVectorToCharArray.h000066400000000000000000000012131277367620400176460ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_STRING_VECTOR_TO_CHAR_ARRAY_H_ #define RR_STRING_VECTOR_TO_CHAR_ARRAY_H_ #include #include namespace rr { /** * Converts a vector of strings to a POSIX-style array of char*s terminated * by a nullptr. */ class StringVectorToCharArray { public: StringVectorToCharArray(const std::vector& vs) { for (auto& v : vs) { array.push_back(const_cast(v.c_str())); } array.push_back(nullptr); } char** get() { return array.data(); } private: std::vector array; }; } // namespace rr #endif rr-4.4.0/src/Task.cc000066400000000000000000002460031277367620400141650ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "Task.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "preload/preload_interface.h" #include "AutoRemoteSyscalls.h" #include "CPUIDBugDetector.h" #include "MagicSaveDataMonitor.h" #include "PreserveFileMonitor.h" #include "RecordSession.h" #include "RecordTask.h" #include "ReplaySession.h" #include "ScopedFd.h" #include "StdioMonitor.h" #include "StringVectorToCharArray.h" #include "ThreadDb.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "kernel_supplement.h" #include "log.h" #include "record_signal.h" #include "seccomp-bpf.h" #include "util.h" using namespace std; namespace rr { static const unsigned int NUM_X86_DEBUG_REGS = 8; static const unsigned int NUM_X86_WATCHPOINTS = 4; Task::Task(Session& session, pid_t _tid, pid_t _rec_tid, uint32_t serial, SupportedArch a) : unstable(false), stable_exit(false), scratch_ptr(), scratch_size(), // This will be initialized when the syscall buffer is. desched_fd_child(-1), // This will be initialized when the syscall buffer is. cloned_file_data_fd_child(-1), hpc(_tid), tid(_tid), rec_tid(_rec_tid > 0 ? _rec_tid : _tid), syscallbuf_size(0), stopping_breakpoint_table_entry_size(0), serial(serial), prname("???"), ticks(0), registers(a), how_last_execution_resumed(RESUME_CONT), is_stopped(false), seccomp_bpf_enabled(false), detected_unexpected_exit(false), extra_registers(a), extra_registers_known(false), session_(&session), top_of_stack(), seen_ptrace_exit_event(false), expecting_ptrace_interrupt_stop(0) { memset(&thread_locals, 0, sizeof(thread_locals)); } void Task::destroy() { LOG(debug) << "task " << tid << " (rec:" << rec_tid << ") is dying ..."; // child_mem_fd needs to be valid since we won't be able to open // it for futex_wait after we've detached. ASSERT(this, as->mem_fd().is_open()); fallible_ptrace(PTRACE_DETACH, nullptr, nullptr); // Subclasses can do something in their destructors after we've detached delete this; } Task::~Task() { if (unstable) { LOG(warn) << tid << " is unstable; not blocking on its termination"; // This will probably leak a zombie process for rr's lifetime. // Destroying a Session may result in unstable exits during which // Task::destroy_buffers() will not have been called. if (!syscallbuf_child.is_null()) { uint8_t* local_mapping = vm()->mapping_of(syscallbuf_child).local_addr; vm()->unmap(this, syscallbuf_child, syscallbuf_size); int ret = munmap(local_mapping, syscallbuf_size); ASSERT(this, ret >= 0); } } else { ASSERT(this, seen_ptrace_exit_event); ASSERT(this, syscallbuf_child.is_null()); if (tg->task_set().empty() && !session().is_recording()) { // Reap the zombie. int ret = waitpid(tg->real_tgid, NULL, __WALL); if (ret == -1) { ASSERT(this, errno == ECHILD || errno == ESRCH); } else { ASSERT(this, ret == tg->real_tgid); } } } session().on_destroy(this); tg->erase_task(this); as->erase_task(this); fds->erase_task(this); LOG(debug) << " dead"; } void Task::finish_emulated_syscall() { // We need to execute something to get us out of a SYSEMU syscall-stop into a // signal-stop. SINGLESTEP/SYSEMU_SINGLESTEP works, but sometimes executes // instruction after the syscall as well, so we need to be able to undo that. // XXX verify that this can't be interrupted by a breakpoint trap Registers r = regs(); remote_code_ptr ip = r.ip(); bool known_idempotent_insn_after_syscall = (is_in_traced_syscall() || is_in_untraced_syscall()); // We're about to single-step the tracee at its $ip just past // the syscall insn, then back up the $ip to where it started. // This is problematic because it will execute the insn at the // current $ip twice. If that insns isn't idempotent, then // replay will create side effects that diverge from // recording. // // To prevent that, we insert a breakpoint trap at the current // $ip. We can execute that without creating side effects. // After the single-step, we remove the breakpoint, which // restores the original insn at the $ip. // // Syscalls made from the syscallbuf are known to execute an // idempotent insn after the syscall trap (restore register // from stack), so we don't have to pay this expense. if (!known_idempotent_insn_after_syscall) { bool ok = vm()->add_breakpoint(ip, BKPT_INTERNAL); ASSERT(this, ok) << "Can't add breakpoint???"; } // Passing RESUME_NO_TICKS here is not only a small performance optimization, // but also avoids counting an event if the instruction immediately following // a syscall instruction is a conditional branch. resume_execution(RESUME_SYSEMU_SINGLESTEP, RESUME_WAIT, RESUME_NO_TICKS); if (!known_idempotent_insn_after_syscall) { // The breakpoint should raise SIGTRAP, but we can also see // any of the host of replay-ignored signals. ASSERT(this, (stop_sig() == SIGTRAP || ReplaySession::is_ignored_signal(stop_sig()))) << "PENDING SIG IS " << signal_name(stop_sig()); vm()->remove_breakpoint(ip, BKPT_INTERNAL); } set_regs(r); wait_status = WaitStatus(); } void Task::dump(FILE* out) const { out = out ? out : stderr; stringstream ss; ss << wait_status; fprintf(out, " %s(tid:%d rec_tid:%d status:0x%s%s)<%p>\n", prname.c_str(), tid, rec_tid, ss.str().c_str(), unstable ? " UNSTABLE" : "", this); if (session().is_recording()) { // TODO pending events are currently only meaningful // during recording. We should change that // eventually, to have more informative output. log_pending_events(); } } struct stat Task::stat_fd(int fd) { char path[PATH_MAX]; snprintf(path, sizeof(path) - 1, "/proc/%d/fd/%d", tid, fd); struct stat result; auto ret = ::stat(path, &result); ASSERT(this, ret == 0); return result; } ScopedFd Task::open_fd(int fd, int flags) { char path[PATH_MAX]; snprintf(path, sizeof(path) - 1, "/proc/%d/fd/%d", tid, fd); return ScopedFd(path, flags); } string Task::file_name_of_fd(int fd) { char path[PATH_MAX]; snprintf(path, sizeof(path) - 1, "/proc/%d/fd/%d", tid, fd); ssize_t nbytes = readlink(path, path, sizeof(path) - 1); if (nbytes < 0) { path[0] = 0; } else { path[nbytes] = 0; } return path; } const siginfo_t& Task::get_siginfo() { assert(stop_sig()); return pending_siginfo; } /** * Must be idempotent. */ void Task::destroy_buffers() { AutoRemoteSyscalls remote(this); unmap_buffers_for(remote, this); scratch_ptr = nullptr; syscallbuf_child = nullptr; close_buffers_for(remote, this); desched_fd_child = -1; cloned_file_data_fd_child = -1; } void Task::unmap_buffers_for(AutoRemoteSyscalls& remote, Task* other) { if (other->scratch_ptr) { remote.infallible_syscall(syscall_number_for_munmap(arch()), other->scratch_ptr, other->scratch_size); vm()->unmap(this, other->scratch_ptr, other->scratch_size); } if (!other->syscallbuf_child.is_null()) { uint8_t* local_mapping = vm()->mapping_of(other->syscallbuf_child).local_addr; remote.infallible_syscall(syscall_number_for_munmap(arch()), other->syscallbuf_child, other->syscallbuf_size); vm()->unmap(this, other->syscallbuf_child, other->syscallbuf_size); if (local_mapping) { int ret = munmap(local_mapping, other->syscallbuf_size); ASSERT(this, ret >= 0); } } } /** * Must be idempotent. */ void Task::close_buffers_for(AutoRemoteSyscalls& remote, Task* other) { if (other->desched_fd_child >= 0) { if (session().is_recording()) { remote.infallible_syscall(syscall_number_for_close(arch()), other->desched_fd_child); } fds->did_close(other->desched_fd_child); } if (other->cloned_file_data_fd_child >= 0) { remote.infallible_syscall(syscall_number_for_close(arch()), other->cloned_file_data_fd_child); fds->did_close(other->cloned_file_data_fd_child); } } bool Task::is_desched_event_syscall() { return is_ioctl_syscall(regs().original_syscallno(), arch()) && desched_fd_child != -1 && desched_fd_child == (int)regs().arg1_signed(); } bool Task::is_ptrace_seccomp_event() const { int event = ptrace_event(); return (PTRACE_EVENT_SECCOMP_OBSOLETE == event || PTRACE_EVENT_SECCOMP == event); } template static vector ptrace_get_regs_set(Task* t, const Registers& regs, size_t min_size) { auto iov = t->read_mem(remote_ptr(regs.arg4())); ASSERT(t, iov.iov_len >= min_size) << "Should have been caught during prepare_ptrace"; return t->read_mem(iov.iov_base.rptr().template cast(), iov.iov_len); } template static int64_t get_io_offset_arch(int syscallno, const Registers& regs) { switch (syscallno) { case Arch::pwrite64: case Arch::pwritev: case Arch::pread64: case Arch::preadv: if (sizeof(typename Arch::unsigned_word) == 4) { return regs.arg4() | (uint64_t(regs.arg5_signed()) << 32); } return regs.arg4_signed(); default: return -1; } } int64_t Task::get_io_offset(int syscallno, const Registers& regs) { RR_ARCH_FUNCTION(get_io_offset_arch, arch(), syscallno, regs); } template void Task::on_syscall_exit_arch(int syscallno, const Registers& regs) { session().accumulate_syscall_performed(); // mprotect can change the protection status of some mapped regions before // failing. if (regs.syscall_failed() && !is_mprotect_syscall(syscallno, arch())) { return; } switch (syscallno) { case Arch::brk: case Arch::mmap: case Arch::mmap2: case Arch::mremap: { LOG(debug) << "(brk/mmap/mmap2/mremap will receive / has received direct " "processing)"; return; } case Arch::mprotect: { remote_ptr addr = regs.arg1(); size_t num_bytes = regs.arg2(); int prot = regs.arg3_signed(); return vm()->protect(this, addr, num_bytes, prot); } case Arch::munmap: { remote_ptr addr = regs.arg1(); size_t num_bytes = regs.arg2(); return vm()->unmap(this, addr, num_bytes); } case Arch::shmdt: { remote_ptr addr = regs.arg1(); auto mapping = vm()->mapping_of(addr); ASSERT(this, mapping.map.start() == addr); return vm()->unmap(this, addr, mapping.map.end() - addr); } case Arch::madvise: { remote_ptr addr = regs.arg1(); size_t num_bytes = regs.arg2(); int advice = regs.arg3(); return vm()->advise(this, addr, num_bytes, advice); } case Arch::ipc: { switch ((int)regs.arg1_signed()) { case SHMDT: { remote_ptr addr = regs.arg5(); auto mapping = vm()->mapping_of(addr); ASSERT(this, mapping.map.start() == addr); return vm()->unmap(this, addr, mapping.map.end() - addr); } default: break; } break; } case Arch::set_thread_area: set_thread_area(regs.arg1()); return; case Arch::prctl: switch ((int)regs.arg1_signed()) { case PR_SET_SECCOMP: if (regs.arg2() == SECCOMP_MODE_FILTER && session().is_recording()) { seccomp_bpf_enabled = true; } break; case PR_SET_NAME: { update_prname(regs.arg2()); break; } } return; case Arch::dup: case Arch::dup2: case Arch::dup3: fd_table()->did_dup(regs.arg1(), regs.syscall_result()); return; case Arch::fcntl64: case Arch::fcntl: if (regs.arg2() == Arch::DUPFD || regs.arg2() == Arch::DUPFD_CLOEXEC) { fd_table()->did_dup(regs.arg1(), regs.syscall_result()); } return; case Arch::close: fd_table()->did_close(regs.arg1()); return; case Arch::unshare: if (regs.arg1() & CLONE_FILES) { fds->erase_task(this); fds = fds->clone(this); } return; case Arch::pwrite64: case Arch::write: { int fd = (int)regs.arg1_signed(); vector ranges; ssize_t amount = regs.syscall_result_signed(); if (amount > 0) { ranges.push_back(FileMonitor::Range(regs.arg2(), amount)); } fd_table()->did_write(this, fd, ranges, get_io_offset_arch(syscallno, regs)); return; } case Arch::pwritev: case Arch::writev: { int fd = (int)regs.arg1_signed(); vector ranges; auto iovecs = read_mem(remote_ptr(regs.arg2()), regs.arg3()); ssize_t written = regs.syscall_result_signed(); ASSERT(this, written >= 0); for (auto& v : iovecs) { ssize_t amount = min(written, v.iov_len); if (amount > 0) { ranges.push_back(FileMonitor::Range(v.iov_base, amount)); written -= amount; } } fd_table()->did_write(this, fd, ranges, get_io_offset_arch(syscallno, regs)); return; } case Arch::ptrace: { pid_t pid = (pid_t)regs.arg2_signed(); Task* tracee = session().find_task(pid); switch ((int)regs.arg1_signed()) { case PTRACE_SETREGS: { auto data = read_mem( remote_ptr(regs.arg4())); Registers r = tracee->regs(); r.set_from_ptrace_for_arch(Arch::arch(), &data, sizeof(data)); tracee->set_regs(r); break; } case PTRACE_SETFPREGS: { auto data = read_mem( remote_ptr(regs.arg4())); auto r = extra_regs(); r.set_user_fpregs_struct(Arch::arch(), &data, sizeof(data)); set_extra_regs(r); break; } case PTRACE_SETFPXREGS: { auto data = read_mem(remote_ptr(regs.arg4())); auto r = extra_regs(); r.set_user_fpxregs_struct(data); set_extra_regs(r); break; } case PTRACE_SETREGSET: { switch ((int)regs.arg3()) { case NT_PRSTATUS: { auto set = ptrace_get_regs_set( this, regs, sizeof(typename Arch::user_regs_struct)); Registers r = tracee->regs(); r.set_from_ptrace_for_arch(Arch::arch(), set.data(), set.size()); tracee->set_regs(r); break; } case NT_FPREGSET: { auto set = ptrace_get_regs_set( this, regs, sizeof(typename Arch::user_fpregs_struct)); ExtraRegisters r = tracee->extra_regs(); r.set_user_fpregs_struct(Arch::arch(), set.data(), set.size()); tracee->set_extra_regs(r); break; } case NT_X86_XSTATE: { switch (tracee->extra_regs().format()) { case ExtraRegisters::XSAVE: { auto set = ptrace_get_regs_set( this, regs, tracee->extra_regs().data_size()); ExtraRegisters r; r.set_to_raw_data(tracee->arch(), ExtraRegisters::XSAVE, set); tracee->set_extra_regs(r); break; } default: ASSERT(this, false) << "Unknown ExtraRegisters format; " "Should have been caught during " "prepare_ptrace"; } break; } default: ASSERT(this, false) << "Unknown regset type; Should have been " "caught during prepare_ptrace"; break; } break; } case PTRACE_POKEUSER: { size_t addr = regs.arg3(); typename Arch::unsigned_word data = regs.arg4(); if (addr < sizeof(typename Arch::user_regs_struct)) { Registers r = tracee->regs(); r.write_register_by_user_offset(addr, data); tracee->set_regs(r); } else if (addr >= offsetof(typename Arch::user, u_debugreg[0]) && addr < offsetof(typename Arch::user, u_debugreg[8])) { size_t regno = (addr - offsetof(typename Arch::user, u_debugreg[0])) / sizeof(data); tracee->set_debug_reg(regno, data); } break; } } return; } } } void Task::on_syscall_exit(int syscallno, const Registers& regs) { RR_ARCH_FUNCTION(on_syscall_exit_arch, arch(), syscallno, regs) } void Task::move_ip_before_breakpoint() { // TODO: assert that this is at a breakpoint trap. Registers r = regs(); r.set_ip(r.ip().decrement_by_bkpt_insn_length(arch())); set_regs(r); } void Task::enter_syscall() { bool need_ptrace_syscall_event = !seccomp_bpf_enabled || session().syscall_seccomp_ordering() == Session::SECCOMP_BEFORE_PTRACE_SYSCALL; bool need_seccomp_event = seccomp_bpf_enabled; while (need_ptrace_syscall_event || need_seccomp_event) { resume_execution(need_ptrace_syscall_event ? RESUME_SYSCALL : RESUME_CONT, RESUME_WAIT, RESUME_NO_TICKS); if (is_ptrace_seccomp_event()) { ASSERT(this, need_seccomp_event); need_seccomp_event = false; continue; } ASSERT(this, !ptrace_event()); if (!stop_sig()) { ASSERT(this, need_ptrace_syscall_event); need_ptrace_syscall_event = false; continue; } if (ReplaySession::is_ignored_signal(stop_sig()) && session().is_replaying()) { continue; } ASSERT(this, session().is_recording()); static_cast(this)->stash_sig(); } } void Task::exit_syscall() { while (true) { resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); ASSERT(this, !ptrace_event()); if (!stop_sig()) { break; } if (ReplaySession::is_ignored_signal(stop_sig()) && session().is_replaying()) { continue; } ASSERT(this, session().is_recording()); static_cast(this)->stash_sig(); } } void Task::exit_syscall_and_prepare_restart() { Registers r = regs(); int syscallno = r.original_syscallno(); LOG(debug) << "exit_syscall_and_prepare_restart from syscall " << rr::syscall_name(syscallno, r.arch()); r.set_original_syscallno(syscall_number_for_gettid(r.arch())); set_regs(r); // This exits the hijacked SYS_gettid. Now the tracee is // ready to do our bidding. exit_syscall(); LOG(debug) << "exit_syscall_and_prepare_restart done"; // Restore these regs to what they would have been just before // the tracee trapped at the syscall. r.set_original_syscallno(-1); r.set_syscallno(syscallno); r.set_ip(r.ip() - syscall_instruction_length(r.arch())); set_regs(r); } static string prname_from_exe_image(const string& e) { size_t last_slash = e.rfind('/'); return e.substr(last_slash == e.npos ? 0 : last_slash + 1); } void Task::post_exec(SupportedArch a, const string& exe_file) { /* We just saw a successful exec(), so from now on we know * that the address space layout for the replay tasks will * (should!) be the same as for the recorded tasks. So we can * start validating registers at events. */ session().post_exec(); as->erase_task(this); fds->erase_task(this); registers.set_arch(a); struct user_regs_struct ptrace_regs; ptrace_if_alive(PTRACE_GETREGS, nullptr, &ptrace_regs); registers.set_from_ptrace(ptrace_regs); // Change syscall number to execve *for the new arch*. If we don't do this, // and the arch changes, then the syscall number for execve in the old arch/ // is treated as the syscall we're executing in the new arch, with hilarious // results. registers.set_original_syscallno(syscall_number_for_execve(arch())); set_regs(registers); extra_registers = ExtraRegisters(a); extra_registers_known = false; ExtraRegisters e = extra_regs(); e.reset(); set_extra_regs(e); syscallbuf_child = nullptr; cloned_file_data_fd_child = -1; desched_fd_child = -1; preload_globals = nullptr; task_group()->execed = true; thread_areas_.clear(); memset(&thread_locals, 0, sizeof(thread_locals)); as = session().create_vm(this, exe_file, as->uid().exec_count() + 1); // It's barely-documented, but Linux unshares the fd table on exec fds = fds->clone(this); prname = prname_from_exe_image(as->exe_image()); } void Task::post_exec_syscall(TraceTaskEvent& event) { as->post_exec_syscall(this); fds->update_for_cloexec(this, event); } bool Task::execed() const { return tg->execed; } void Task::flush_inconsistent_state() { ticks = 0; } string Task::read_c_str(remote_ptr child_addr) { // XXX handle invalid C strings remote_ptr p = child_addr; string str; while (true) { // We're only guaranteed that [child_addr, // end_of_page) is mapped. remote_ptr end_of_page = ceil_page_size(p + 1); ssize_t nbytes = end_of_page - p; char buf[nbytes]; read_bytes_helper(p, nbytes, buf); for (int i = 0; i < nbytes; ++i) { if ('\0' == buf[i]) { return str; } str += buf[i]; } p = end_of_page; } } const Registers& Task::regs() const { ASSERT(this, is_stopped); return registers; } // 0 means XSAVE not detected static unsigned int xsave_area_size = 0; static bool xsave_initialized = false; static void init_xsave() { if (xsave_initialized) { return; } xsave_initialized = true; auto cpuid_data = cpuid(CPUID_GETFEATURES, 0); if (!(cpuid_data.ecx & (1 << 26))) { // XSAVE not present return; } // We'll use the largest possible area all the time // even when it might not be needed. Simpler that way. cpuid_data = cpuid(CPUID_GETXSAVE, 0); xsave_area_size = cpuid_data.ecx; } const ExtraRegisters& Task::extra_regs() { if (!extra_registers_known) { init_xsave(); if (xsave_area_size) { LOG(debug) << " (refreshing extra-register cache using XSAVE)"; extra_registers.format_ = ExtraRegisters::XSAVE; extra_registers.data_.resize(xsave_area_size); struct iovec vec = { extra_registers.data_.data(), extra_registers.data_.size() }; xptrace(PTRACE_GETREGSET, NT_X86_XSTATE, &vec); extra_registers.data_.resize(vec.iov_len); // The kernel may return less than the full XSTATE extra_registers.validate(this); } else { #if defined(__i386__) LOG(debug) << " (refreshing extra-register cache using FPXREGS)"; extra_registers.format_ = ExtraRegisters::XSAVE; extra_registers.data_.resize(sizeof(user_fpxregs_struct)); xptrace(PTRACE_GETFPXREGS, nullptr, extra_registers.data_.data()); #elif defined(__x86_64__) // x86-64 that doesn't support XSAVE; apparently Xeon E5620 (Westmere) // is in this class. LOG(debug) << " (refreshing extra-register cache using FPREGS)"; extra_registers.format_ = ExtraRegisters::XSAVE; extra_registers.data_.resize(sizeof(user_fpregs_struct)); xptrace(PTRACE_GETFPREGS, nullptr, extra_registers.data_.data()); #else #error need to define new extra_regs support #endif } extra_registers_known = true; } return extra_registers; } static ssize_t dr_user_word_offset(size_t i) { assert(i < NUM_X86_DEBUG_REGS); return offsetof(struct user, u_debugreg[0]) + sizeof(void*) * i; } uintptr_t Task::debug_status() { return fallible_ptrace(PTRACE_PEEKUSER, dr_user_word_offset(6), nullptr); } void Task::set_debug_status(uintptr_t status) { fallible_ptrace(PTRACE_POKEUSER, dr_user_word_offset(6), (void*)status); } TrapReasons Task::compute_trap_reasons() { ASSERT(this, stop_sig() == SIGTRAP); TrapReasons reasons; uintptr_t status = debug_status(); // During replay we execute syscall instructions in certain cases, e.g. // mprotect with syscallbuf. The kernel does not set DS_SINGLESTEP when we // step over those instructions so we need to detect that here. if (how_last_execution_resumed == RESUME_SINGLESTEP && is_at_syscall_instruction(this, address_of_last_execution_resume) && ip() == address_of_last_execution_resume + syscall_instruction_length(arch())) { reasons.singlestep = true; } else { reasons.singlestep = (status & DS_SINGLESTEP) != 0; } // In VMWare Player 6.0.4 build-2249910, 32-bit Ubuntu x86 guest, // single-stepping does not trigger watchpoints :-(. So we have to // check watchpoints here. fast_forward also hides watchpoint changes. // Write-watchpoints will detect that their value has changed and trigger. // XXX Read/exec watchpoints can't be detected this way so they're still // broken in the above configuration :-(. if ((DS_WATCHPOINT_ANY | DS_SINGLESTEP) & status) { as->notify_watchpoint_fired(status); } reasons.watchpoint = as->has_any_watchpoint_changes() || (DS_WATCHPOINT_ANY & status); // If we triggered a breakpoint, this would be the address of the breakpoint remote_code_ptr ip_at_breakpoint = ip().decrement_by_bkpt_insn_length(arch()); // Don't trust siginfo to report execution of a breakpoint if singlestep or // watchpoint triggered. if (reasons.singlestep) { reasons.breakpoint = as->is_breakpoint_instruction(this, address_of_last_execution_resume); if (reasons.breakpoint) { ASSERT(this, address_of_last_execution_resume == ip_at_breakpoint); } } else if (reasons.watchpoint) { // We didn't singlestep, so watchpoint state is completely accurate. // The only way the last instruction could have triggered a watchpoint // and be a breakpoint instruction is if an EXEC watchpoint fired // at the breakpoint address. reasons.breakpoint = as->has_exec_watchpoint_fired(ip_at_breakpoint) && as->is_breakpoint_instruction(this, ip_at_breakpoint); } else { const siginfo_t& si = get_siginfo(); ASSERT(this, SIGTRAP == si.si_signo) << " expected SIGTRAP, got " << si; /* XXX unable to find docs on which of these "should" be * right. The SI_KERNEL code is seen in the int3 test, so we * at least need to handle that. */ reasons.breakpoint = SI_KERNEL == si.si_code || TRAP_BRKPT == si.si_code; if (reasons.breakpoint) { ASSERT(this, as->is_breakpoint_instruction(this, ip_at_breakpoint)) << " expected breakpoint at " << ip_at_breakpoint << ", got siginfo " << si; } } return reasons; } const Task::ThreadLocals& Task::fetch_preload_thread_locals() { if (tuid() == as->thread_locals_tuid()) { if (as->has_mapping(AddressSpace::preload_thread_locals_start())) { memcpy(thread_locals, as->mapping_of(AddressSpace::preload_thread_locals_start()) .local_addr, PRELOAD_THREAD_LOCALS_SIZE); } else { // The mapping might have been removed by crazy application code. // That's OK, assuming the preload library was removed too. memset(&thread_locals, 0, sizeof(thread_locals)); } } return thread_locals; } void Task::activate_preload_thread_locals() { // Switch thread-locals to the new task. if (tuid() != as->thread_locals_tuid() && as->has_mapping(AddressSpace::preload_thread_locals_start())) { Task* t = session().find_task(as->thread_locals_tuid()); if (t) { t->fetch_preload_thread_locals(); } memcpy( as->mapping_of(AddressSpace::preload_thread_locals_start()).local_addr, thread_locals, PRELOAD_THREAD_LOCALS_SIZE); as->set_thread_locals_tuid(tuid()); } } void Task::resume_execution(ResumeRequest how, WaitRequest wait_how, TicksRequest tick_period, int sig) { // Treat a RESUME_NO_TICKS tick_period as a very large but finite number. // Always resetting here, and always to a nonzero number, improves // consistency between recording and replay and hopefully // makes counting bugs behave similarly between recording and // replay. // Accumulate any unknown stuff in tick_count(). if (tick_period != RESUME_NO_TICKS) { hpc.reset(tick_period == RESUME_UNLIMITED_TICKS ? 0xffffffff : max(1, tick_period)); activate_preload_thread_locals(); } LOG(debug) << "resuming execution of " << tid << " with " << ptrace_req_name(how) << (sig ? string(", signal ") + signal_name(sig) : string()); address_of_last_execution_resume = ip(); how_last_execution_resumed = how; set_debug_status(0); pid_t wait_ret = 0; if (session().is_recording()) { /* There's a nasty race where a stopped task gets woken up by a SIGKILL * and advances to the PTRACE_EXIT_EVENT ptrace-stop just before we * send a PTRACE_CONT. Our PTRACE_CONT will cause it to continue and exit, * which means we don't get a chance to clean up robust futexes etc. * Avoid that by doing a waitpid() here to see if it has exited. * This doesn't fully close the race since in theory we could be preempted * between the waitpid and the ptrace_if_alive, giving another task * a chance to SIGKILL our tracee and advance it to the PTRACE_EXIT_EVENT, * or just letting the tracee be scheduled to process its pending SIGKILL. */ int raw_status = 0; wait_ret = waitpid(tid, &raw_status, WNOHANG | __WALL | WSTOPPED); ASSERT(this, 0 <= wait_ret) << "waitpid(" << tid << ", NOHANG) failed with " << wait_ret; WaitStatus status(raw_status); if (wait_ret == tid) { ASSERT(this, status.ptrace_event() == PTRACE_EVENT_EXIT); } else { ASSERT(this, 0 == wait_ret) << "waitpid(" << tid << ", NOHANG) failed with " << wait_ret; } } if (wait_ret == tid) { // wait() will see this and report the ptrace-exit event. detected_unexpected_exit = true; } else { ptrace_if_alive(how, nullptr, (void*)(uintptr_t)sig); } is_stopped = false; extra_registers_known = false; if (RESUME_WAIT == wait_how) { wait(); } } void Task::set_regs(const Registers& regs) { ASSERT(this, is_stopped); registers = regs; auto ptrace_regs = registers.get_ptrace(); ptrace_if_alive(PTRACE_SETREGS, nullptr, &ptrace_regs); } void Task::set_extra_regs(const ExtraRegisters& regs) { ASSERT(this, !regs.empty()) << "Trying to set empty ExtraRegisters"; extra_registers = regs; extra_registers_known = true; init_xsave(); switch (extra_registers.format()) { case ExtraRegisters::XSAVE: { if (xsave_area_size) { struct iovec vec = { extra_registers.data_.data(), extra_registers.data_.size() }; ptrace_if_alive(PTRACE_SETREGSET, NT_X86_XSTATE, &vec); } else { #if defined(__i386__) ptrace_if_alive(PTRACE_SETFPXREGS, nullptr, extra_registers.data_.data()); #elif defined(__x86_64__) ptrace_if_alive(PTRACE_SETFPREGS, nullptr, extra_registers.data_.data()); #else #error Unsupported architecture #endif } break; } default: ASSERT(this, false) << "Unexpected ExtraRegisters format"; } } enum WatchBytesX86 { BYTES_1 = 0x00, BYTES_2 = 0x01, BYTES_4 = 0x03, BYTES_8 = 0x02 }; static WatchBytesX86 num_bytes_to_dr_len(size_t num_bytes) { switch (num_bytes) { case 1: return BYTES_1; case 2: return BYTES_2; case 4: return BYTES_4; case 8: return BYTES_8; default: FATAL() << "Unsupported breakpoint size " << num_bytes; return WatchBytesX86(-1); // not reached } } bool Task::set_debug_regs(const DebugRegs& regs) { struct DebugControl { uintptr_t packed() { return *(uintptr_t*)this; } uintptr_t dr0_local : 1; uintptr_t dr0_global : 1; uintptr_t dr1_local : 1; uintptr_t dr1_global : 1; uintptr_t dr2_local : 1; uintptr_t dr2_global : 1; uintptr_t dr3_local : 1; uintptr_t dr3_global : 1; uintptr_t ignored : 8; WatchType dr0_type : 2; WatchBytesX86 dr0_len : 2; WatchType dr1_type : 2; WatchBytesX86 dr1_len : 2; WatchType dr2_type : 2; WatchBytesX86 dr2_len : 2; WatchType dr3_type : 2; WatchBytesX86 dr3_len : 2; } dr7; memset(&dr7, 0, sizeof(dr7)); static_assert(sizeof(DebugControl) == sizeof(uintptr_t), "Can't pack DebugControl"); // Reset the debug status since we're about to change the set // of programmed watchpoints. ptrace_if_alive(PTRACE_POKEUSER, dr_user_word_offset(6), 0); // Ensure that we clear the programmed watchpoints in case // enabling one of them fails. We guarantee atomicity to the // caller. ptrace_if_alive(PTRACE_POKEUSER, dr_user_word_offset(7), 0); if (regs.size() > NUM_X86_WATCHPOINTS) { return false; } size_t dr = 0; for (auto reg : regs) { if (fallible_ptrace(PTRACE_POKEUSER, dr_user_word_offset(dr), (void*)reg.addr.as_int())) { return false; } switch (dr++) { #define CASE_ENABLE_DR(_dr7, _i, _reg) \ case _i: \ _dr7.dr##_i##_local = 1; \ _dr7.dr##_i##_type = _reg.type; \ _dr7.dr##_i##_len = num_bytes_to_dr_len(_reg.num_bytes); \ break CASE_ENABLE_DR(dr7, 0, reg); CASE_ENABLE_DR(dr7, 1, reg); CASE_ENABLE_DR(dr7, 2, reg); CASE_ENABLE_DR(dr7, 3, reg); #undef CASE_ENABLE_DR default: FATAL() << "There's no debug register " << dr; } } return 0 == fallible_ptrace(PTRACE_POKEUSER, dr_user_word_offset(7), (void*)dr7.packed()); } uintptr_t Task::get_debug_reg(size_t regno) { errno = 0; auto result = fallible_ptrace(PTRACE_PEEKUSER, dr_user_word_offset(regno), nullptr); if (errno == ESRCH) { return 0; } return result; } void Task::set_debug_reg(size_t regno, uintptr_t value) { fallible_ptrace(PTRACE_POKEUSER, dr_user_word_offset(regno), (void*)value); } void Task::set_thread_area(remote_ptr tls) { // We rely on the fact that user_desc is word-size-independent. auto desc = read_mem(tls); for (auto& t : thread_areas_) { if (t.entry_number == desc.entry_number) { t = desc; return; } } thread_areas_.push_back(desc); } pid_t Task::tgid() const { return tg->tgid; } pid_t Task::real_tgid() const { return tg->real_tgid; } const string& Task::trace_dir() const { const TraceStream* trace = trace_stream(); ASSERT(this, trace) << "Trace directory not available"; return trace->dir(); } uint32_t Task::trace_time() const { const TraceStream* trace = trace_stream(); return trace ? trace->time() : 0; } void Task::update_prname(remote_ptr child_addr) { struct prname_buf { char chars[16]; }; auto name = read_mem(child_addr.cast()); name.chars[sizeof(name.chars) - 1] = '\0'; prname = name.chars; } static bool is_zombie_process(pid_t pid) { auto state = read_proc_status_fields(pid, "State"); return state.empty() || state[0] == "Z"; } static bool is_signal_triggered_by_ptrace_interrupt(int group_stop_sig) { switch (group_stop_sig) { case SIGTRAP: // We sometimes see SIGSTOP at interrupts, though the // docs don't mention that. case SIGSTOP: return true; default: return false; } } // This function doesn't really need to do anything. The signal will cause // waitpid to return EINTR and that's all we need. static void handle_alarm_signal(__attribute__((unused)) int sig) {} static struct timeval to_timeval(double t) { struct timeval v; v.tv_sec = (time_t)floor(t); v.tv_usec = (int)floor((t - v.tv_sec) * 1000000); return v; } void Task::wait(double interrupt_after_elapsed) { LOG(debug) << "going into blocking waitpid(" << tid << ") ..."; ASSERT(this, !unstable) << "Don't wait for unstable tasks"; ASSERT(this, session().is_recording() || interrupt_after_elapsed == 0); if (detected_unexpected_exit) { LOG(debug) << "Unexpected (SIGKILL) exit was detected; reporting it now"; did_waitpid(WaitStatus::for_ptrace_event(PTRACE_EVENT_EXIT)); detected_unexpected_exit = false; return; } WaitStatus status; bool sent_wait_interrupt = false; pid_t ret; while (true) { if (interrupt_after_elapsed) { struct itimerval timer = { { 0, 0 }, to_timeval(interrupt_after_elapsed) }; setitimer(ITIMER_REAL, &timer, nullptr); } int raw_status = 0; ret = waitpid(tid, &raw_status, __WALL); status = WaitStatus(raw_status); if (interrupt_after_elapsed) { struct itimerval timer = { { 0, 0 }, { 0, 0 } }; setitimer(ITIMER_REAL, &timer, nullptr); } if (ret >= 0 || errno != EINTR) { // waitpid was not interrupted by the alarm. break; } if (is_zombie_process(tg->real_tgid)) { // The process is dead. We must stop waiting on it now // or we might never make progress. // XXX it's not clear why the waitpid() syscall // doesn't return immediately in this case, but in // some cases it doesn't return normally at all! // Fake a PTRACE_EVENT_EXIT for this task. status = WaitStatus::for_ptrace_event(PTRACE_EVENT_EXIT); ret = tid; // XXX could this leave unreaped zombies lying around? break; } if (!sent_wait_interrupt && interrupt_after_elapsed) { ptrace_if_alive(PTRACE_INTERRUPT, nullptr, nullptr); sent_wait_interrupt = true; expecting_ptrace_interrupt_stop = 2; } } if (ret >= 0 && status.exit_code() >= 0) { // Unexpected non-stopping exit code returned in wait_status. // This shouldn't happen; a PTRACE_EXIT_EVENT for this task // should be observed first, and then we would kill the task // before wait()ing again, so we'd only see the exit // code in detach_and_reap. But somehow we see it here in // grandchild_threads and async_kill_with_threads tests (and // maybe others), when a PTRACE_EXIT_EVENT has not been sent. // Verify that we have not actually seen a PTRACE_EXIT_EVENT. ASSERT(this, !seen_ptrace_exit_event) << "A PTRACE_EXIT_EVENT was observed " "for this task, but somehow " "forgotten"; // Turn this into a PTRACE_EXIT_EVENT. status = WaitStatus::for_ptrace_event(PTRACE_EVENT_EXIT); } LOG(debug) << " waitpid(" << tid << ") returns " << ret << "; status " << status; ASSERT(this, tid == ret) << "waitpid(" << tid << ") failed with " << ret; if (sent_wait_interrupt) { LOG(warn) << "Forced to PTRACE_INTERRUPT tracee"; if (!is_signal_triggered_by_ptrace_interrupt(status.group_stop())) { LOG(warn) << " PTRACE_INTERRUPT raced with another event " << status; } } did_waitpid(status); } static bool is_in_non_sigreturn_exit_syscall(Task* t) { if (!t->status().is_syscall()) { return false; } if (t->session().is_recording()) { auto rt = static_cast(t); return !rt->ev().is_syscall_event() || !is_sigreturn(rt->ev().Syscall().number, t->arch()); } return true; } /** * Call this when we've trapped in a syscall (entry or exit) in the kernel, * to normalize registers. */ static void fixup_syscall_registers(Registers& registers) { if (registers.arch() == x86_64) { // x86-64 'syscall' instruction copies RFLAGS to R11 on syscall entry. // If we single-stepped into the syscall instruction, the TF flag will be // set in R11. We don't want the value in R11 to depend on whether we // were single-stepping during record or replay, possibly causing // divergence. // This doesn't matter when exiting a sigreturn syscall, since it // restores the original flags. // For untraced syscalls, the untraced-syscall entry point code (see // write_rr_page) does this itself. // We tried just clearing %r11, but that caused hangs in // Ubuntu/Debian kernels. // Making this match the flags makes this operation idempotent, which is // helpful. registers.set_r11(0x246); // x86-64 'syscall' instruction copies return address to RCX on syscall // entry. rr-related kernel activity normally sets RCX to -1 at some point // during syscall execution, but apparently in some (unknown) situations // probably involving untraced syscalls, that doesn't happen. To avoid // potential issues, forcibly replace RCX with -1 always. // This doesn't matter (and we should not do this) when exiting a // sigreturn syscall, since it will restore the original RCX and we don't // want to clobber that. // For untraced syscalls, the untraced-syscall entry point code (see // write_rr_page) does this itself. registers.set_cx((intptr_t)-1); // On kernel 3.13.0-68-generic #111-Ubuntu SMP we have observed a failed // execve() clearing all flags during recording. During replay we emulate // the exec so this wouldn't happen. Just reset all flags so everything's // consistent. // 0x246 is ZF+PF+IF+reserved, the result clearing a register using // "xor reg, reg". registers.set_flags(0x246); } else if (registers.arch() == x86) { // The x86 SYSENTER handling in Linux modifies EBP and EFLAGS on entry. // EBP is the potential sixth syscall parameter, stored on the user stack. // The EFLAGS changes are described here: // http://linux-kernel.2935.n7.nabble.com/ia32-sysenter-target-does-not-preserve-EFLAGS-td1074164.html // In a VMWare guest, the modifications to EFLAGS appear to be // nondeterministic. Cover that up by setting EFLAGS to reasonable values // now. registers.set_flags(0x246); } } void Task::emulate_syscall_entry(const Registers& regs) { Registers r = regs; fixup_syscall_registers(r); set_regs(r); } void Task::did_waitpid(WaitStatus status) { Ticks more_ticks = hpc.counting ? hpc.read_ticks() : 0; // We stop counting here because there may be things we want to do to the // tracee that would otherwise generate ticks. hpc.stop_counting(); session().accumulate_ticks_processed(more_ticks); ticks += more_ticks; // After PTRACE_INTERRUPT, any next two stops may be a group stop caused by // that PTRACE_INTERRUPT (or neither may be). This is because PTRACE_INTERRUPT // generally lets other stops win (and thus doesn't inject it's own stop), but // if the other stop was already done processing, even we didn't see it yet, // the stop will still be queued, so we could see the other stop and then the // PTRACE_INTERRUPT group stop. // When we issue PTRACE_INTERRUPT, we this set this counter to 2, and here // we decrement it on every stop such that while this counter is positive, // any group-stop could be one induced by PTRACE_INTERRUPT bool siginfo_overriden = false; if (expecting_ptrace_interrupt_stop > 0) { expecting_ptrace_interrupt_stop--; if (is_signal_triggered_by_ptrace_interrupt(status.group_stop())) { // Assume this was PTRACE_INTERRUPT and thus treat this as // TIME_SLICE_SIGNAL instead. if (session().is_recording()) { // Force this timeslice to end session().as_record()->scheduler().expire_timeslice(); } status = WaitStatus::for_stop_sig(PerfCounters::TIME_SLICE_SIGNAL); memset(&pending_siginfo, 0, sizeof(pending_siginfo)); pending_siginfo.si_signo = PerfCounters::TIME_SLICE_SIGNAL; pending_siginfo.si_fd = hpc.ticks_fd(); pending_siginfo.si_code = POLL_IN; siginfo_overriden = true; expecting_ptrace_interrupt_stop = 0; } } LOG(debug) << " (refreshing register cache)"; intptr_t original_syscallno = registers.original_syscallno(); // Skip reading registers in a PTRACE_EVENT_EXEC, since // we may not know the correct architecture. bool did_read_regs = false; if (status.ptrace_event() != PTRACE_EVENT_EXEC) { struct user_regs_struct ptrace_regs; if (ptrace_if_alive(PTRACE_GETREGS, nullptr, &ptrace_regs)) { registers.set_from_ptrace(ptrace_regs); did_read_regs = true; } else { LOG(debug) << "Unexpected process death for " << tid; status = WaitStatus::for_ptrace_event(PTRACE_EVENT_EXIT); } } if (!siginfo_overriden && status.stop_sig()) { if (!ptrace_if_alive(PTRACE_GETSIGINFO, nullptr, &pending_siginfo)) { LOG(debug) << "Unexpected process death for " << tid; status = WaitStatus::for_ptrace_event(PTRACE_EVENT_EXIT); } } is_stopped = true; wait_status = status; if (ptrace_event() == PTRACE_EVENT_EXIT) { seen_ptrace_exit_event = true; } bool need_to_set_regs = false; if (registers.singlestep_flag()) { registers.clear_singlestep_flag(); need_to_set_regs = true; } // We might have singlestepped at the resumption address and just exited // the kernel without executing the breakpoint at that address. // The kernel usually (always?) singlesteps an extra instruction when // we do this with PTRACE_SYSEMU_SINGLESTEP, but rr's ptrace emulation doesn't // and it's kind of a kernel bug. if (as->get_breakpoint_type_at_addr(address_of_last_execution_resume) != BKPT_NONE && stop_sig() == SIGTRAP && !ptrace_event() && ip() == address_of_last_execution_resume.increment_by_bkpt_insn_length( arch())) { ASSERT(this, more_ticks == 0); // When we resume execution and immediately hit a breakpoint, the original // syscall number can be reset to -1. Undo that, so that the register // state matches the state we'd be in if we hadn't resumed. ReplayTimeline // depends on resume-at-a-breakpoint being a noop. registers.set_original_syscallno(original_syscallno); need_to_set_regs = true; } // When exiting a syscall, we need to normalize nondeterministic registers. // We also need to do this when we receive a signal in the rr page, since // we may have just returned from an untraced syscall there and while in the // rr page registers need to be consistent between record and replay. // During replay most untraced syscalls are replaced with "xor eax,eax" so // rcx is always -1, but during recording it sometimes isn't after we've // done a real syscall. if (is_in_non_sigreturn_exit_syscall(this) || is_in_rr_page()) { fixup_syscall_registers(registers); need_to_set_regs = true; } if (need_to_set_regs && did_read_regs) { // If we couldn't read registers, don't fix them up! set_regs(registers); } } bool Task::try_wait() { int raw_status = 0; pid_t ret = waitpid(tid, &raw_status, WNOHANG | __WALL | WSTOPPED); ASSERT(this, 0 <= ret) << "waitpid(" << tid << ", NOHANG) failed with " << ret; LOG(debug) << "waitpid(" << tid << ", NOHANG) returns " << ret << ", status " << WaitStatus(raw_status); if (ret == tid) { did_waitpid(WaitStatus(raw_status)); return true; } return false; } template static void set_thread_area_from_clone_arch(Task* t, remote_ptr tls) { if (Arch::clone_tls_type == Arch::UserDescPointer) { t->set_thread_area(tls.cast()); } } static void set_thread_area_from_clone(Task* t, remote_ptr tls) { RR_ARCH_FUNCTION(set_thread_area_from_clone_arch, t->arch(), t, tls); } Task* Task::clone(int flags, remote_ptr stack, remote_ptr tls, remote_ptr, pid_t new_tid, pid_t new_rec_tid, uint32_t new_serial, Session* other_session) { auto& sess = other_session ? *other_session : session(); Task* t = sess.new_task(new_tid, new_rec_tid, new_serial, arch()); bool unmap_buffers = false; bool close_buffers = false; if (CLONE_SHARE_TASK_GROUP & flags) { t->tg = tg; } else { t->tg = sess.clone(t, tg); } t->tg->insert_task(t); if (CLONE_SHARE_VM & flags) { t->as = as; if (!stack.is_null()) { remote_ptr last_stack_byte = stack - 1; if (t->as->has_mapping(last_stack_byte)) { auto mapping = t->as->mapping_of(last_stack_byte); if (!mapping.recorded_map.is_heap()) { const KernelMapping& m = mapping.map; LOG(debug) << "mapping stack for " << new_tid << " at " << m; t->as->map(t, m.start(), m.size(), m.prot(), m.flags(), m.file_offset_bytes(), "[stack]", m.device(), m.inode()); } } } } else { t->as = sess.clone(t, as); unmap_buffers = as->task_set().size() > 1; } t->syscallbuf_size = syscallbuf_size; t->stopping_breakpoint_table = stopping_breakpoint_table; t->stopping_breakpoint_table_entry_size = stopping_breakpoint_table_entry_size; t->preload_globals = preload_globals; t->seccomp_bpf_enabled = seccomp_bpf_enabled; // FdTable is either shared or copied, so the contents of // syscallbuf_fds_disabled_child are still valid. if (CLONE_SHARE_FILES & flags) { t->fds = fds; t->fds->insert_task(t); } else { t->fds = fds->clone(t); close_buffers = fds->task_set().size() > 1; } t->top_of_stack = stack; // Clone children, both thread and fork, inherit the parent // prname. t->prname = prname; // wait() before trying to do anything that might need to // use ptrace to access memory t->wait(); t->open_mem_fd_if_needed(); t->thread_areas_ = thread_areas_; if (CLONE_SET_TLS & flags) { set_thread_area_from_clone(t, tls); } t->as->insert_task(t); if (&session() == &t->session()) { if (unmap_buffers) { // Unmap syscallbuf and scratch for tasks that were not cloned into // the new address space AutoRemoteSyscalls remote(t); for (Task* tt : as->task_set()) { if (tt != this) { t->unmap_buffers_for(remote, tt); } } } if (close_buffers) { // Close syscallbuf fds for tasks that were not cloned into // the new fd table AutoRemoteSyscalls remote(t); for (Task* tt : fds->task_set()) { if (tt != this) { t->close_buffers_for(remote, tt); } } } if (!(CLONE_SHARE_VM & flags)) { as->did_fork_into(t); } if (CLONE_SHARE_FILES & flags) { // Clear our desched_fd_child so that we don't try to close it. // It should only be closed in |this|. t->desched_fd_child = -1; t->cloned_file_data_fd_child = -1; } } if (!(CLONE_SHARE_VM & flags)) { t->as->post_vm_clone(t); } return t; } Task* Task::os_fork_into(Session* session) { AutoRemoteSyscalls remote(this, AutoRemoteSyscalls::DISABLE_MEMORY_PARAMS); Task* child = os_clone(this, session, remote, rec_tid, serial, // Most likely, we'll be setting up a // CLEARTID futex. That's not done // here, but rather later in // |copy_state()|. // // We also don't use any of the SETTID // flags because that earlier work will // be copied by fork()ing the address // space. SIGCHLD); // When we forked ourselves, the child inherited the setup we // did to make the clone() call. So we have to "finish" the // remote calls (i.e. undo fudged state) in the child too, // even though we never made any syscalls there. remote.restore_state_to(child); return child; } Task* Task::os_clone_into(const CapturedState& state, Task* task_leader, AutoRemoteSyscalls& remote) { return os_clone(task_leader, &task_leader->session(), remote, state.rec_tid, state.serial, // We don't actually /need/ to specify the // SIGHAND/SYSVMEM flags because those things // are emulated in the tracee. But we use the // same flags as glibc to be on the safe side // wrt kernel bugs. // // We don't pass CLONE_SETTLS here *only* // because we'll do it later in // |copy_state()|. // // See |os_fork_into()| above for discussion // of the CTID flags. (CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_SIGHAND | CLONE_THREAD | CLONE_SYSVSEM), state.top_of_stack); } template static void copy_tls_arch(const Task::CapturedState& state, AutoRemoteSyscalls& remote) { if (Arch::clone_tls_type == Arch::UserDescPointer) { for (const auto& t : state.thread_areas) { AutoRestoreMem remote_tls(remote, (const uint8_t*)&t, sizeof(t)); LOG(debug) << " setting tls " << remote_tls.get(); remote.infallible_syscall( syscall_number_for_set_thread_area(remote.arch()), remote_tls.get().as_int()); } } } static void copy_tls(const Task::CapturedState& state, AutoRemoteSyscalls& remote) { RR_ARCH_FUNCTION(copy_tls_arch, remote.arch(), state, remote); } static int64_t get_fd_offset(Task* t, int fd) { char buf[PATH_MAX]; sprintf(buf, "/proc/%d/fdinfo/%d", t->tid, fd); ScopedFd info(buf, O_RDONLY); ASSERT(t, info.is_open()) << "Can't open " << buf; ssize_t bytes = read(info, buf, sizeof(buf) - 1); ASSERT(t, bytes > 0); buf[bytes] = 0; char* p = buf; while (*p) { if (strncmp(p, "pos:", 4) == 0) { char* end; long long int r = strtoll(p + 4, &end, 10); ASSERT(t, *end == 0 || *end == '\n'); return r; } while (*p && *p != '\n') { ++p; } } return -1; } Task::CapturedState Task::capture_state() { CapturedState state; state.rec_tid = rec_tid; state.serial = serial; state.regs = regs(); state.extra_regs = extra_regs(); state.prname = prname; state.thread_areas = thread_areas_; state.desched_fd_child = desched_fd_child; state.cloned_file_data_fd_child = cloned_file_data_fd_child; state.cloned_file_data_offset = cloned_file_data_fd_child >= 0 ? get_fd_offset(this, cloned_file_data_fd_child) : 0; memcpy(&state.thread_locals, fetch_preload_thread_locals(), PRELOAD_THREAD_LOCALS_SIZE); state.syscallbuf_child = syscallbuf_child; state.syscallbuf_size = syscallbuf_size; state.preload_globals = preload_globals; state.scratch_ptr = scratch_ptr; state.scratch_size = scratch_size; state.wait_status = wait_status; state.ticks = ticks; state.top_of_stack = top_of_stack; return state; } void Task::copy_state(const CapturedState& state) { set_regs(state.regs); set_extra_regs(state.extra_regs); { AutoRemoteSyscalls remote(this); { char prname[16]; strncpy(prname, state.prname.c_str(), sizeof(prname)); AutoRestoreMem remote_prname(remote, (const uint8_t*)prname, sizeof(prname)); LOG(debug) << " setting name to " << prname; remote.infallible_syscall(syscall_number_for_prctl(arch()), PR_SET_NAME, remote_prname.get().as_int()); update_prname(remote_prname.get()); } copy_tls(state, remote); thread_areas_ = state.thread_areas; syscallbuf_size = state.syscallbuf_size; ASSERT(this, !syscallbuf_child) << "Syscallbuf should not already be initialized in clone"; if (!state.syscallbuf_child.is_null()) { // All these fields are preserved by the fork. desched_fd_child = state.desched_fd_child; cloned_file_data_fd_child = state.cloned_file_data_fd_child; if (cloned_file_data_fd_child >= 0) { remote.infallible_lseek_syscall( cloned_file_data_fd_child, state.cloned_file_data_offset, SEEK_SET); } syscallbuf_child = state.syscallbuf_child; } } preload_globals = state.preload_globals; memcpy(&thread_locals, &state.thread_locals, PRELOAD_THREAD_LOCALS_SIZE); // The scratch buffer (for now) is merely a private mapping in // the remote task. The CoW copy made by fork()'ing the // address space has the semantics we want. It's not used in // replay anyway. scratch_ptr = state.scratch_ptr; scratch_size = state.scratch_size; // Whatever |from|'s last wait status was is what ours would // have been. wait_status = state.wait_status; ticks = state.ticks; } remote_ptr Task::next_syscallbuf_record() { return ((syscallbuf_child + 1).cast() + read_mem(REMOTE_PTR_FIELD(syscallbuf_child, num_rec_bytes))) .cast(); } long Task::stored_record_size( remote_ptr record) { return ::stored_record_size(read_mem(REMOTE_PTR_FIELD(record, size))); } long Task::fallible_ptrace(int request, remote_ptr addr, void* data) { return ptrace(__ptrace_request(request), tid, addr, data); } void Task::open_mem_fd() { // Use ptrace to read/write during open_mem_fd as->set_mem_fd(ScopedFd()); // We could try opening /proc//mem directly first and // only do this dance if that fails. But it's simpler to // always take this path, and gives better test coverage. On Ubuntu // the child has to open its own mem file (unless rr is root). static const char path[] = "/proc/self/mem"; AutoRemoteSyscalls remote(this); long remote_fd; { AutoRestoreMem remote_path(remote, (const uint8_t*)path, sizeof(path)); // skip leading '/' since we want the path to be relative to the root fd remote_fd = remote.syscall(syscall_number_for_openat(arch()), RR_RESERVED_ROOT_DIR_FD, remote_path.get() + 1, O_RDWR); } if (remote_fd < 0) { // This can happen when a process fork()s after setuid; it can no longer // open its own /proc/self/mem. Hopefully we can read the child's // mem file in this case (because rr is probably running as root). char buf[PATH_MAX]; sprintf(buf, "/proc/%d/mem", tid); ScopedFd fd(buf, O_RDWR); ASSERT(this, fd.is_open()); as->set_mem_fd(move(fd)); } else { as->set_mem_fd(remote.retrieve_fd(remote_fd)); ASSERT(this, as->mem_fd().is_open()); remote.infallible_syscall(syscall_number_for_close(arch()), remote_fd); } } void Task::open_mem_fd_if_needed() { if (!as->mem_fd().is_open()) { open_mem_fd(); } } KernelMapping Task::init_syscall_buffer(AutoRemoteSyscalls& remote, remote_ptr map_hint) { char name[50]; sprintf(name, "syscallbuf.%d", rec_tid); KernelMapping km = Session::create_shared_mmap(remote, syscallbuf_size, map_hint, name); auto& m = remote.task()->vm()->mapping_of(km.start()); remote.task()->vm()->mapping_flags_of(km.start()) |= AddressSpace::Mapping::IS_SYSCALLBUF; ASSERT(this, !syscallbuf_child) << "Should not already have syscallbuf initialized!"; syscallbuf_child = km.start().cast(); // No entries to begin with. memset(m.local_addr, 0, sizeof(struct syscallbuf_hdr)); return km; } void Task::reset_syscallbuf() { if (!syscallbuf_child) return; // Memset is easiest to do by using the local mapping which should always // exist for the syscallbuf uint32_t num_rec = read_mem(REMOTE_PTR_FIELD(syscallbuf_child, num_rec_bytes)); uint8_t* ptr = local_mapping(syscallbuf_child + 1, num_rec); assert(ptr != nullptr); memset(ptr, 0, num_rec); write_mem(REMOTE_PTR_FIELD(syscallbuf_child, num_rec_bytes), (uint32_t)0); write_mem(REMOTE_PTR_FIELD(syscallbuf_child, mprotect_record_count), (uint32_t)0); write_mem(REMOTE_PTR_FIELD(syscallbuf_child, mprotect_record_count_completed), (uint32_t)0); } ssize_t Task::read_bytes_ptrace(remote_ptr addr, ssize_t buf_size, void* buf) { ssize_t nread = 0; // ptrace operates on the word size of the host, so we really do want // to use sizes of host types here. uintptr_t word_size = sizeof(long); errno = 0; // Only read aligned words. This ensures we can always read the last // byte before an unmapped region. while (nread < buf_size) { uintptr_t start = addr.as_int() + nread; uintptr_t start_word = start & ~(word_size - 1); uintptr_t end_word = start_word + word_size; uintptr_t length = std::min(end_word - start, uintptr_t(buf_size - nread)); long v = fallible_ptrace(PTRACE_PEEKDATA, start_word, nullptr); if (errno) { break; } memcpy(static_cast(buf) + nread, reinterpret_cast(&v) + (start - start_word), length); nread += length; } return nread; } ssize_t Task::write_bytes_ptrace(remote_ptr addr, ssize_t buf_size, const void* buf) { ssize_t nwritten = 0; // ptrace operates on the word size of the host, so we really do want // to use sizes of host types here. uintptr_t word_size = sizeof(long); errno = 0; // Only write aligned words. This ensures we can always write the last // byte before an unmapped region. while (nwritten < buf_size) { uintptr_t start = addr.as_int() + nwritten; uintptr_t start_word = start & ~(word_size - 1); uintptr_t end_word = start_word + word_size; uintptr_t length = std::min(end_word - start, uintptr_t(buf_size - nwritten)); long v; if (length < word_size) { v = fallible_ptrace(PTRACE_PEEKDATA, start_word, nullptr); if (errno) { break; } } memcpy(reinterpret_cast(&v) + (start - start_word), static_cast(buf) + nwritten, length); fallible_ptrace(PTRACE_POKEDATA, start_word, reinterpret_cast(v)); nwritten += length; } return nwritten; } uint8_t* Task::local_mapping(remote_ptr addr, size_t size) { if (vm()->has_mapping(addr)) { const AddressSpace::Mapping& map = vm()->mapping_of(addr); // Fall back to the slow path if we can't get the entire region if (size > static_cast(map.map.end() - addr)) { return nullptr; } if (map.local_addr != nullptr) { size_t offset = addr - map.map.start(); return static_cast(map.local_addr) + offset; } } return nullptr; } ssize_t Task::read_bytes_fallible(remote_ptr addr, ssize_t buf_size, void* buf) { ASSERT_ACTIONS(this, buf_size >= 0, << "Invalid buf_size " << buf_size); if (0 == buf_size) { return 0; } if (uint8_t* local_addr = local_mapping(addr, buf_size)) { memcpy(buf, local_addr, buf_size); return buf_size; } if (!as->mem_fd().is_open()) { return read_bytes_ptrace(addr, buf_size, static_cast(buf)); } ssize_t all_read = 0; while (all_read < buf_size) { errno = 0; ssize_t nread = pread64(as->mem_fd(), static_cast(buf) + all_read, buf_size - all_read, addr.as_int() + all_read); // We open the mem_fd just after being notified of // exec(), when the Task is created. Trying to read from that // fd seems to return 0 with errno 0. Reopening the mem fd // allows the pwrite to succeed. It seems that the first mem // fd we open, very early in exec, refers to some resource // that's different than the one we see after reopening the // fd, after exec. if (0 == nread && 0 == all_read && 0 == errno) { open_mem_fd(); continue; } if (nread <= 0) { if (all_read > 0) { // We did successfully read some data, so return success and ignore // any error. errno = 0; return all_read; } return nread; } // We read some data. We should try again in case we get short reads. all_read += nread; } return all_read; } void Task::read_bytes_helper(remote_ptr addr, ssize_t buf_size, void* buf, bool* ok) { // pread64 etc can't handle addresses that appear to be negative ... // like [vsyscall]. ssize_t nread = read_bytes_fallible(addr, buf_size, buf); if (nread != buf_size) { if (ok) { *ok = false; } else { ASSERT(this, false) << "Should have read " << buf_size << " bytes from " << addr << ", but only read " << nread; } } } /** * This function exists to work around * https://bugzilla.kernel.org/show_bug.cgi?id=99101. * On some kernels pwrite() to /proc/.../mem fails when writing to a region * that's PROT_NONE. * Also, writing through MAP_SHARED readonly mappings fails (even if the * file was opened read-write originally), so we handle that here too. */ static ssize_t safe_pwrite64(Task* t, const void* buf, ssize_t buf_size, remote_ptr addr) { vector mappings_to_fix; for (auto m : t->vm()->maps_containing_or_after(floor_page_size(addr))) { if (m.map.start() >= ceil_page_size(addr + buf_size)) { break; } if (m.map.prot() & PROT_WRITE) { continue; } if (!(m.map.prot() & PROT_READ) || (m.map.flags() & MAP_SHARED)) { mappings_to_fix.push_back(m.map); } }; if (mappings_to_fix.empty()) { return pwrite64(t->vm()->mem_fd(), buf, buf_size, addr.as_int()); } AutoRemoteSyscalls remote(t); int mprotect_syscallno = syscall_number_for_mprotect(t->arch()); for (auto& m : mappings_to_fix) { remote.infallible_syscall(mprotect_syscallno, m.start(), m.size(), m.prot() | PROT_WRITE); } ssize_t nwritten = pwrite64(t->vm()->mem_fd(), buf, buf_size, addr.as_int()); for (auto& m : mappings_to_fix) { remote.infallible_syscall(mprotect_syscallno, m.start(), m.size(), m.prot()); } return nwritten; } void Task::write_bytes_helper(remote_ptr addr, ssize_t buf_size, const void* buf, bool* ok) { ASSERT(this, buf_size >= 0) << "Invalid buf_size " << buf_size; if (0 == buf_size) { return; } if (uint8_t* local_addr = local_mapping(addr, buf_size)) { memcpy(local_addr, buf, buf_size); return; } if (!as->mem_fd().is_open()) { ssize_t nwritten = write_bytes_ptrace(addr, buf_size, static_cast(buf)); if (nwritten > 0) { vm()->notify_written(addr, nwritten); } if (ok && nwritten < buf_size) { *ok = false; } return; } errno = 0; ssize_t nwritten = safe_pwrite64(this, buf, buf_size, addr.as_int()); // See comment in read_bytes_helper(). if (0 == nwritten && 0 == errno) { open_mem_fd(); return write_bytes_helper(addr, buf_size, buf, ok); } if (errno == EPERM) { FATAL() << "Can't write to /proc/" << tid << "/mem\n" << "Maybe you need to disable grsecurity MPROTECT with:\n" << " setfattr -n user.pax.flags -v 'emr' "; } if (ok) { if (nwritten < buf_size) { *ok = false; } } else { ASSERT(this, nwritten == buf_size) << "Should have written " << buf_size << " bytes to " << addr << ", but only wrote " << nwritten; } if (nwritten > 0) { vm()->notify_written(addr, nwritten); } } const TraceStream* Task::trace_stream() const { if (session().as_record()) { return &session().as_record()->trace_writer(); } if (session().as_replay()) { return &session().as_replay()->trace_reader(); } return nullptr; } void Task::xptrace(int request, remote_ptr addr, void* data) { errno = 0; fallible_ptrace(request, addr, data); ASSERT(this, !errno) << "ptrace(" << ptrace_req_name(request) << ", " << tid << ", addr=" << addr << ", data=" << data << ") failed with errno " << errno; } bool Task::ptrace_if_alive(int request, remote_ptr addr, void* data) { errno = 0; fallible_ptrace(request, addr, data); if (errno == ESRCH) { return false; } ASSERT(this, !errno) << "ptrace(" << ptrace_req_name(request) << ", " << tid << ", addr=" << addr << ", data=" << data << ") failed with errno " << errno; return true; } bool Task::clone_syscall_is_complete() { int event = ptrace_event(); if (PTRACE_EVENT_CLONE == event || PTRACE_EVENT_FORK == event || PTRACE_EVENT_VFORK == event) { return true; } ASSERT(this, !event) << "Unexpected ptrace event " << ptrace_event_name(event); // EAGAIN can happen here due to fork failing under load. The caller must // handle this. // XXX ENOSYS shouldn't happen here. intptr_t result = regs().syscall_result_signed(); ASSERT(this, regs().syscall_may_restart() || -ENOSYS == result || -EAGAIN == result || -ENOMEM == result) << "Unexpected task status " << status() << " (" << syscall_name(regs().original_syscallno()) << " syscall errno: " << errno_name(-result) << ")"; return false; } template static void do_preload_init_arch(Task* t) { auto params = t->read_mem( remote_ptr>(t->regs().arg1())); t->preload_globals = params.globals.rptr(); t->stopping_breakpoint_table = params.breakpoint_table.rptr().as_int(); t->stopping_breakpoint_table_entry_size = params.breakpoint_table_entry_size; t->write_mem(REMOTE_PTR_FIELD(t->preload_globals, in_replay), (unsigned char)t->session().is_replaying()); } static void do_preload_init(Task* t) { RR_ARCH_FUNCTION(do_preload_init_arch, t->arch(), t); } void Task::at_preload_init() { as->at_preload_init(this); do_preload_init(this); fd_table()->init_syscallbuf_fds_disabled(this); } template static void perform_remote_clone_arch( AutoRemoteSyscalls& remote, unsigned base_flags, remote_ptr stack, remote_ptr ptid, remote_ptr tls, remote_ptr ctid) { switch (Arch::clone_parameter_ordering) { case Arch::FlagsStackParentTLSChild: remote.syscall(Arch::clone, base_flags, stack, ptid.as_int(), tls.as_int(), ctid.as_int()); break; case Arch::FlagsStackParentChildTLS: remote.syscall(Arch::clone, base_flags, stack, ptid.as_int(), ctid.as_int(), tls.as_int()); break; } } static void perform_remote_clone(Task* parent, AutoRemoteSyscalls& remote, unsigned base_flags, remote_ptr stack, remote_ptr ptid, remote_ptr tls, remote_ptr ctid) { RR_ARCH_FUNCTION(perform_remote_clone_arch, parent->arch(), remote, base_flags, stack, ptid, tls, ctid); } /*static*/ Task* Task::os_clone(Task* parent, Session* session, AutoRemoteSyscalls& remote, pid_t rec_child_tid, uint32_t new_serial, unsigned base_flags, remote_ptr stack, remote_ptr ptid, remote_ptr tls, remote_ptr ctid) { perform_remote_clone(parent, remote, base_flags, stack, ptid, tls, ctid); while (!parent->clone_syscall_is_complete()) { // clone syscalls can fail with EAGAIN due to temporary load issues. // Just retry the system call until it succeeds. if (parent->regs().syscall_result_signed() == -EAGAIN) { perform_remote_clone(parent, remote, base_flags, stack, ptid, tls, ctid); } else { // XXX account for ReplaySession::is_ignored_signal? parent->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); } } pid_t new_tid = parent->get_ptrace_eventmsg(); parent->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); Task* child = parent->clone(clone_flags_to_task_flags(base_flags), stack, tls, ctid, new_tid, rec_child_tid, new_serial, session); return child; } static void setup_fd_table(FdTable& fds) { fds.add_monitor(STDOUT_FILENO, new StdioMonitor(STDOUT_FILENO)); fds.add_monitor(STDERR_FILENO, new StdioMonitor(STDERR_FILENO)); fds.add_monitor(RR_MAGIC_SAVE_DATA_FD, new MagicSaveDataMonitor()); fds.add_monitor(RR_RESERVED_ROOT_DIR_FD, new PreserveFileMonitor()); } static void set_cpu_affinity(int cpu) { assert(cpu >= 0); cpu_set_t mask; CPU_ZERO(&mask); CPU_SET(cpu, &mask); if (0 > sched_setaffinity(0, sizeof(mask), &mask)) { FATAL() << "Couldn't bind to CPU " << cpu; } } static void spawned_child_fatal_error(const ScopedFd& err_fd, const char* format, ...) { va_list args; va_start(args, format); char* buf; vasprintf(&buf, format, args); char* buf2; asprintf(&buf2, "%s (%s)", buf, errno_name(errno).c_str()); write(err_fd, buf2, strlen(buf2)); _exit(1); } /** * Prepare this process and its ancestors for recording/replay by * preventing direct access to sources of nondeterminism, and ensuring * that rr bugs don't adversely affect the underlying system. */ static void set_up_process(Session& session, const ScopedFd& err_fd) { /* TODO tracees can probably undo some of the setup below * ... */ /* CLOEXEC so that the original fd here will be closed by the exec that's * about to happen. */ int fd = open("/dev/null", O_WRONLY | O_CLOEXEC); if (0 > fd) { spawned_child_fatal_error(err_fd, "error opening /dev/null"); } if (RR_MAGIC_SAVE_DATA_FD != dup2(fd, RR_MAGIC_SAVE_DATA_FD)) { spawned_child_fatal_error(err_fd, "error duping to RR_MAGIC_SAVE_DATA_FD"); } // If we're running under rr then don't try to set up RR_RESERVED_ROOT_DIR_FD; // it should already be correct (unless someone chrooted in between, // which would be crazy ... though we could fix it by dynamically // assigning RR_RESERVED_ROOT_DIR_FD.) if (!running_under_rr()) { /* CLOEXEC so that the original fd here will be closed by the exec that's * about to happen. */ fd = open("/", O_PATH | O_DIRECTORY | O_CLOEXEC); if (0 > fd) { spawned_child_fatal_error(err_fd, "error opening root directory"); } if (RR_RESERVED_ROOT_DIR_FD != dup2(fd, RR_RESERVED_ROOT_DIR_FD)) { spawned_child_fatal_error(err_fd, "error duping to RR_RESERVED_ROOT_DIR_FD"); } } if (session.is_replaying()) { // This task and all its descendants should silently reap any terminating // children. if (SIG_ERR == signal(SIGCHLD, SIG_IGN)) { spawned_child_fatal_error(err_fd, "error doing signal()"); } // If the rr process dies, prevent runaway tracee processes // from dragging down the underlying system. // // TODO: this isn't inherited across fork(). if (0 > prctl(PR_SET_PDEATHSIG, SIGKILL)) { spawned_child_fatal_error(err_fd, "Couldn't set parent-death signal"); } // Put the replaying processes into their own session. This will stop // signals being sent to these processes by the terminal --- in particular // SIGTSTP/SIGINT/SIGWINCH. setsid(); } /* Trap to the rr process if a 'rdtsc' instruction is issued. * That allows rr to record the tsc and replay it * deterministically. */ if (0 > prctl(PR_SET_TSC, PR_TSC_SIGSEGV, 0, 0, 0)) { spawned_child_fatal_error(err_fd, "error setting up prctl"); } if (0 > prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { spawned_child_fatal_error( err_fd, "prctl(NO_NEW_PRIVS) failed, SECCOMP_FILTER is not available: your " "kernel is too old. Use `record -n` to disable the filter."); } } /** * This is called (and must be called) in the tracee after rr has taken * ptrace control. Otherwise, once we've installed the seccomp filter, * things go wrong because we have no ptracer and the seccomp filter demands * one. */ static void set_up_seccomp_filter(Session& session, int err_fd) { SeccompFilter f; if (session.is_recording() && session.as_record()->use_syscall_buffer()) { for (auto& e : AddressSpace::rr_page_syscalls()) { if (e.traced == AddressSpace::UNTRACED) { auto ip = AddressSpace::rr_page_syscall_exit_point( e.traced, e.privileged, e.enabled); f.allow_syscalls_from_callsite(ip); } } f.trace(); } else { // Use a dummy filter that always generates ptrace traps. Supplying this // dummy filter makes ptrace-event behavior consistent whether or not // we enable syscall buffering, and more importantly, consistent whether // or not the tracee installs its own seccomp filter. f.trace(); } struct sock_fprog prog = { (unsigned short)f.filters.size(), f.filters.data() }; /* Note: the filter is installed only for record. This call * will be emulated in the replay */ if (0 > prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, (uintptr_t)&prog, 0, 0)) { spawned_child_fatal_error( err_fd, "prctl(SECCOMP) failed, SECCOMP_FILTER is not available: your " "kernel is too old."); } /* anything that happens from this point on gets filtered! */ } static void run_initial_child(Session& session, const ScopedFd& error_fd, const string& exe_path, const vector& argv, const vector& envp) { set_up_process(session, error_fd); // The preceding code must run before sending SIGSTOP here, // since after SIGSTOP replay emulates almost all syscalls, but // we need the above syscalls to run "for real". // Signal to tracer that we're configured. ::kill(getpid(), SIGSTOP); // This code must run after rr has taken ptrace control. set_up_seccomp_filter(session, error_fd); // We do a small amount of dummy work here to retire // some branches in order to ensure that the ticks value is // non-zero. The tracer can then check the ticks value // at the first ptrace-trap to see if it seems to be // working. int start = random() % 5; int num_its = start + 5; int sum = 0; for (int i = start; i < num_its; ++i) { sum += i; } syscall(SYS_write, -1, &sum, sizeof(sum)); CPUIDBugDetector::run_detection_code(); execve(exe_path.c_str(), StringVectorToCharArray(argv).get(), StringVectorToCharArray(envp).get()); switch (errno) { case ENOENT: spawned_child_fatal_error( error_fd, "execve failed: '%s' (or interpreter) not found", exe_path.c_str()); break; default: spawned_child_fatal_error(error_fd, "execve of '%s' failed", exe_path.c_str()); break; } // Never returns! } /*static*/ Task* Task::spawn(Session& session, const ScopedFd& error_fd, const TraceStream& trace, const std::string& exe_path, const std::vector& argv, const std::vector& envp, pid_t rec_tid) { assert(session.tasks().size() == 0); if (trace.bound_to_cpu() >= 0) { // Set CPU affinity now, after we've created any helper threads // (so they aren't affected), but before we create any // tracees (so they are all affected). // Note that we're binding rr itself to the same CPU as the // tracees, since this seems to help performance. set_cpu_affinity(trace.bound_to_cpu()); } pid_t tid; do { tid = fork(); // fork() can fail with EAGAIN due to temporary load issues. In such // cases, retry the fork(). } while (0 > tid && errno == EAGAIN); if (0 == tid) { run_initial_child(session, error_fd, exe_path, argv, envp); // run_initial_child never returns } if (0 > tid) { FATAL() << "Failed to fork"; } // Sync with the child process. // We minimize the code we run between fork()ing and PTRACE_SEIZE, because // any abnormal exit of the rr process will leave the child paused and // parented by the init process, i.e. effectively leaked. After PTRACE_SEIZE // with PTRACE_O_EXITKILL, the tracee will die if rr dies. intptr_t options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEFORK | PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXIT; if (session.is_recording()) { options |= PTRACE_O_TRACEVFORK | PTRACE_O_TRACESECCOMP | PTRACE_O_TRACEEXEC; } long ret = ptrace(PTRACE_SEIZE, tid, nullptr, (void*)(options | PTRACE_O_EXITKILL)); if (ret < 0 && errno == EINVAL) { // PTRACE_O_EXITKILL was added in kernel 3.8, and we only need // it for more robust cleanup, so tolerate not having it. ret = ptrace(PTRACE_SEIZE, tid, nullptr, (void*)options); } if (ret) { // Note that although the tracee may have died due to some fatal error, // we haven't reaped its exit code so there's no danger of killing // (or PTRACE_SEIZEing) the wrong process. int tmp_errno = errno; kill(tid, SIGKILL); errno = tmp_errno; string hint; if (errno == EPERM) { hint = "; child probably died before reaching SIGSTOP\n" "Child's message: " + session.read_spawned_task_error(); } FATAL() << "PTRACE_SEIZE failed for tid " << tid << hint; } Task* t = session.new_task(tid, rec_tid, session.next_task_serial(), NativeArch::arch()); auto tg = session.create_tg(t); t->tg.swap(tg); auto as = session.create_vm(t); t->as.swap(as); t->fds = FdTable::create(t); setup_fd_table(*t->fds); // Install signal handler here, so that when creating the first RecordTask // it sees the exact same signal state in the parent as will be in the child. struct sigaction sa; sa.sa_handler = handle_alarm_signal; sigemptyset(&sa.sa_mask); sa.sa_flags = 0; // No SA_RESTART, so waitpid() will be interrupted sigaction(SIGALRM, &sa, nullptr); t->wait(); if (t->ptrace_event() == PTRACE_EVENT_EXIT) { FATAL() << "Tracee died before reaching SIGSTOP\n" "Child's message: " << session.read_spawned_task_error(); } // SIGSTOP can be reported as a signal-stop or group-stop depending on // whether PTRACE_SEIZE happened before or after it was delivered. if (SIGSTOP != t->status().stop_sig() && SIGSTOP != t->status().group_stop()) { FATAL() << "Unexpected stop " << t->status() << "\n" "Child's message: " << session.read_spawned_task_error(); } t->clear_wait_status(); t->open_mem_fd(); return t; } string Task::syscall_name(int syscall) const { return rr::syscall_name(syscall, arch()); } // namespace rr bool Task::get_tls_address(size_t offset, remote_ptr load_module, remote_ptr* result) { return tg->thread_db()->get_tls_address(rec_tid, offset, load_module, result); } void Task::register_symbol(const std::string& name, remote_ptr address) { tg->thread_db()->register_symbol(name, address); } const std::set Task::get_symbols_and_clear_map() { return tg->thread_db()->get_symbols_and_clear_map(); } } rr-4.4.0/src/Task.h000066400000000000000000001007051277367620400140250ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TASK_H_ #define RR_TASK_H_ #include #include #include #include "preload/preload_interface.h" #include "AddressSpace.h" #include "Event.h" #include "ExtraRegisters.h" #include "FdTable.h" #include "PerfCounters.h" #include "PropertyTable.h" #include "Registers.h" #include "TaskishUid.h" #include "TraceStream.h" #include "WaitStatus.h" #include "kernel_abi.h" #include "kernel_supplement.h" #include "remote_code_ptr.h" #include "util.h" struct syscallbuf_hdr; struct syscallbuf_record; struct user_desc; namespace rr { class AutoRemoteSyscalls; class RecordSession; class RecordTask; class ReplaySession; class ScopedFd; class Session; class TaskGroup; enum CloneFlags { /** * The child gets a semantic copy of all parent resources (and * becomes a new task group). This is the semantics of the * fork() syscall. */ CLONE_SHARE_NOTHING = 0, /** * Child will share the table of signal dispositions with its * parent. */ CLONE_SHARE_SIGHANDLERS = 1 << 0, /** Child will join its parent's task group. */ CLONE_SHARE_TASK_GROUP = 1 << 1, /** Child will share its parent's address space. */ CLONE_SHARE_VM = 1 << 2, /** Child will share its parent's file descriptor table. */ CLONE_SHARE_FILES = 1 << 3, /** Kernel will clear and notify tid futex on task exit. */ CLONE_CLEARTID = 1 << 4, // Set the thread area to what's specified by the |tls| arg. CLONE_SET_TLS = 1 << 5, }; /** * Enumeration of ways to resume execution. See the ptrace manual for * details of the semantics of these. * * We define a new datatype because the PTRACE_SYSEMU* requests aren't * part of the official ptrace API, and we want to use a strong type * for these resume requests to ensure callers don't confuse their * arguments. */ enum ResumeRequest { RESUME_CONT = PTRACE_CONT, RESUME_SINGLESTEP = PTRACE_SINGLESTEP, RESUME_SYSCALL = PTRACE_SYSCALL, RESUME_SYSEMU = PTRACE_SYSEMU, RESUME_SYSEMU_SINGLESTEP = PTRACE_SYSEMU_SINGLESTEP, }; enum WaitRequest { // After resuming, blocking-waitpid() until tracee status // changes. RESUME_WAIT, // Don't wait after resuming. RESUME_NONBLOCKING }; enum TicksRequest { // We don't expect to see any ticks (though we seem to on the odd buggy // system...). Using this is a small performance optimization because we don't // have to stop and restart the performance counters. This may also avoid // bugs on some systems that report performance counter advances while // in the kernel... RESUME_NO_TICKS = -2, RESUME_UNLIMITED_TICKS = -1 // Positive values are a request for an interrupt // after that number of ticks }; /** Reasons why a SIGTRAP might have been delivered. Multiple reasons can * apply. Also, none can apply, e.g. if someone sent us a SIGTRAP via kill(). */ struct TrapReasons { /* Singlestep completed (RESUME_SINGLESTEP, RESUME_SYSEMU_SINGLESTEP). */ bool singlestep; /* Hardware watchpoint fired. This includes cases where the actual values * did not change (i.e. AddressSpace::has_any_watchpoint_changes may return * false even though this is set). */ bool watchpoint; /* Breakpoint instruction was executed. */ bool breakpoint; }; /** * A "task" is a task in the linux usage: the unit of scheduling. (OS * people sometimes call this a "thread control block".) Multiple * tasks may share the same address space and file descriptors, in * which case they're commonly called "threads". Or two tasks may * have their own address spaces and file descriptors, in which case * they're called "processes". Both look the same to rr (on linux), * so no distinction is made here. */ class Task { friend class Session; friend class RecordSession; friend class ReplaySession; public: typedef std::vector DebugRegs; /** * We hide the destructor and require clients to call this instead. This * lets us make virtual calls from within the destruction code. This * does the actual PTRACE_DETACH and then calls the real destructor. */ void destroy(); /** * This must be in an emulated syscall, entered through * |cont_sysemu()| or |cont_sysemu_singlestep()|, but that's * not checked. If so, step over the system call instruction * to "exit" the emulated syscall. */ void finish_emulated_syscall(); size_t syscallbuf_data_size() { return read_mem(REMOTE_PTR_FIELD(syscallbuf_child, num_rec_bytes)) + sizeof(struct syscallbuf_hdr); } /** * Dump attributes of this process, including pending events, * to |out|, which defaults to LOG_FILE. */ void dump(FILE* out = nullptr) const; /** * Called after the first exec in a session, when the session first * enters a consistent state. Prior to that, the task state * can vary based on how rr set up the child process. We have to flush * out any state that might have been affected by that. */ void flush_inconsistent_state(); /** * Return total number of ticks ever executed by this task. * Updates tick count from the current performance counter values if * necessary. */ Ticks tick_count() { return ticks; } /** * Stat |fd| in the context of this task's fd table. */ struct stat stat_fd(int fd); /** * Open |fd| in the context of this task's fd table. */ ScopedFd open_fd(int fd, int flags); /** * Get the name of the file referenced by |fd| in the context of this * task's fd table. */ std::string file_name_of_fd(int fd); /** * Force the wait status of this to |status|, as if * |wait()/try_wait()| had returned it. Call this whenever a waitpid * returned activity for this past. */ void did_waitpid(WaitStatus status); /** * Syscalls have side effects on registers (e.g. setting the flags register). * Perform those side effects on |regs| and do set_regs() on that to make it * look like a syscall happened. */ void emulate_syscall_entry(const Registers& regs); /** * Return the ptrace message pid associated with the current ptrace * event, f.e. the new child's pid at PTRACE_EVENT_CLONE. */ template T get_ptrace_eventmsg() { unsigned long msg = 0; // in theory we could hit an assertion failure if the tracee suffers // a SIGKILL before we get here. But the SIGKILL would have to be // precisely timed between the generation of a PTRACE_EVENT_FORK/CLONE/ // SYS_clone event, and us fetching the event message here. xptrace(PTRACE_GETEVENTMSG, nullptr, &msg); return T(msg); } /** * Return the siginfo at the signal-stop of this. * Not meaningful unless this is actually at a signal stop. */ const siginfo_t& get_siginfo(); /** * Destroy in the tracee task the scratch buffer and syscallbuf (if * syscallbuf_child is non-null). * This task must already be at a state in which remote syscalls can be * executed; if it's not, results are undefined. */ void destroy_buffers(); void unmap_buffers_for(AutoRemoteSyscalls& remote, Task* t); void close_buffers_for(AutoRemoteSyscalls& remote, Task* t); remote_ptr next_syscallbuf_record(); long stored_record_size(remote_ptr record); /** Return the current $ip of this. */ remote_code_ptr ip() { return regs().ip(); } /** * Return true if this is at an arm-desched-event or * disarm-desched-event syscall. */ bool is_desched_event_syscall(); /** * Return true when this task is in a traced syscall made by the * syscallbuf code. Callers may assume |is_in_syscallbuf()| * is implied by this. Note that once we've entered the traced syscall, * ip() is immediately after the syscall instruction. */ bool is_in_traced_syscall() { return ip() == as->traced_syscall_ip().increment_by_syscall_insn_length( arch()) || ip() == as->privileged_traced_syscall_ip() .increment_by_syscall_insn_length(arch()); } /** * Return true when this task is in an untraced syscall, i.e. one * initiated by a function in the syscallbuf. Callers may * assume |is_in_syscallbuf()| is implied by this. Note that once we've * entered the traced syscall, ip() is immediately after the syscall * instruction. */ bool is_in_untraced_syscall() { auto t = AddressSpace::rr_page_syscall_from_exit_point(ip()); return t && t->traced == AddressSpace::UNTRACED; } bool is_in_rr_page() { auto p = ip().to_data_ptr(); return AddressSpace::rr_page_start() <= p && p < AddressSpace::rr_page_end(); } /** * Return true if |ptrace_event()| is the trace event * generated by the syscallbuf seccomp-bpf when a traced * syscall is entered. */ bool is_ptrace_seccomp_event() const; /** Dump all pending events to the RecordTask INFO log. */ virtual void log_pending_events() const {} /** * Call this hook just before exiting a syscall. Often Task * attributes need to be updated based on the finishing syscall. * Use 'regs' instead of this->regs() because some registers may not be * set properly in the task yet. */ virtual void on_syscall_exit(int syscallno, const Registers& regs); /** * Assuming ip() is just past a breakpoint instruction, adjust * ip() backwards to point at that breakpoint insn. */ void move_ip_before_breakpoint(); /** * Assuming we've just entered a syscall, exit that syscall and reset * state to reenter the syscall just as it was called the first time. */ void exit_syscall_and_prepare_restart(); /** * We're currently in user-space with registers set up to perform a system * call. Continue into the kernel and stop where we can modify the syscall * state. */ void enter_syscall(); /** * We have observed entry to a syscall (either by PTRACE_EVENT_SECCOMP or * a syscall, depending on the value of Session::syscall_seccomp_ordering()). * Continue into the kernel to perform the syscall and stop at the * PTRACE_SYSCALL syscall-exit trap. */ void exit_syscall(); /** * Return the "task name"; i.e. what |prctl(PR_GET_NAME)| or * /proc/tid/comm would say that the task's name is. */ const std::string& name() const { return prname; } /** * Call this method when this task has just performed an |execve()| * (so we're in the new address space), but before the system call has * returned. * |arch| is the architecture of the new address space. */ void post_exec(SupportedArch arch, const std::string& exe_file); /** * Call this method when this task has exited a successful execve() syscall. * At this point it is safe to make remote syscalls. * |event| is the TraceTaskEvent (EXEC) that will be recorded or is being * replayed. */ void post_exec_syscall(TraceTaskEvent& event); /** * Return true if this task has execed. */ bool execed() const; /** * Read |N| bytes from |child_addr| into |buf|, or don't * return. */ template void read_bytes(remote_ptr child_addr, uint8_t (&buf)[N]) { return read_bytes_helper(child_addr, N, buf); } /** Return the current regs of this. */ const Registers& regs() const; /** Return the extra registers of this. */ const ExtraRegisters& extra_regs(); /** Return the current arch of this. This can change due to exec(). */ SupportedArch arch() const { // Use 'registers' directly instead of calling regs(), since this can // be called while the task is not stopped. return registers.arch(); } /** * Return the debug status (DR6 on x86). The debug status is always cleared * in resume_execution() before we resume, so it always only reflects the * events since the last resume. */ uintptr_t debug_status(); /** * Set the debug status (DR6 on x86). */ void set_debug_status(uintptr_t status); /** * Determine why a SIGTRAP occurred. Uses debug_status() but doesn't * consume it. */ TrapReasons compute_trap_reasons(); /** * Read |val| from |child_addr|. * If the data can't all be read, then if |ok| is non-null * sets *ok to false, otherwise asserts. */ template T read_mem(remote_ptr child_addr, bool* ok = nullptr) { typename std::remove_cv::type val; read_bytes_helper(child_addr, sizeof(val), &val, ok); return val; } /** * Read |count| values from |child_addr|. */ template std::vector read_mem(remote_ptr child_addr, size_t count, bool* ok = nullptr) { std::vector v; v.resize(count); read_bytes_helper(child_addr, sizeof(T) * count, v.data(), ok); return v; } /** * Read and return the C string located at |child_addr| in * this address space. */ std::string read_c_str(remote_ptr child_addr); /** * Resume execution |how|, deliverying |sig| if nonzero. * After resuming, |wait_how|. In replay, reset hpcs and * request a tick period of tick_period. The default value * of tick_period is 0, which means effectively infinite. * If interrupt_after_elapsed is nonzero, we interrupt the task * after that many seconds have elapsed. * * You probably want to use one of the cont*() helpers above, * and not this. */ void resume_execution(ResumeRequest how, WaitRequest wait_how, TicksRequest tick_period, int sig = 0); /** Return the session this is part of. */ Session& session() const { return *session_; } /** Set the tracee's registers to |regs|. */ void set_regs(const Registers& regs); /** Set the tracee's extra registers to |regs|. */ void set_extra_regs(const ExtraRegisters& regs); /** * Program the debug registers to the vector of watchpoint * configurations in |reg| (also updating the debug control * register appropriately). Return true if all registers were * successfully programmed, false otherwise. Any time false * is returned, the caller is guaranteed that no watchpoint * has been enabled; either all of |regs| is enabled and true * is returned, or none are and false is returned. */ bool set_debug_regs(const DebugRegs& regs); uintptr_t get_debug_reg(size_t regno); void set_debug_reg(size_t regno, uintptr_t value); /** Update the thread area to |addr|. */ void set_thread_area(remote_ptr tls); const std::vector& thread_areas() { return thread_areas_; } /** * Return true when the task is running, false if it's stopped. */ bool is_running() const { return !is_stopped; } /** * Return the status of this as of the last successful wait()/try_wait() call. */ WaitStatus status() const { return wait_status; } /** * Return the ptrace event as of the last call to |wait()/try_wait()|. */ int ptrace_event() const { return wait_status.ptrace_event(); } /** * Return the signal that's pending for this as of the last * call to |wait()/try_wait()|. The signal 0 means "no signal". */ int stop_sig() const { return wait_status.stop_sig(); } void clear_wait_status() { wait_status = WaitStatus(); } /** Return the task group this belongs to. */ std::shared_ptr task_group() { return tg; } /** Return the id of this task's recorded thread group. */ pid_t tgid() const; /** Return id of real OS task group. */ pid_t real_tgid() const; TaskUid tuid() const { return TaskUid(rec_tid, serial); } /** Return the dir of the trace we're using. */ const std::string& trace_dir() const; /** * Get the current "time" measured as ticks on recording trace * events. |task_time()| returns that "time" wrt this task * only. */ uint32_t trace_time() const; /** * Call this after the tracee successfully makes a * |prctl(PR_SET_NAME)| call to change the task name to the * string pointed at in the tracee's address space by * |child_addr|. */ void update_prname(remote_ptr child_addr); /** * Call this to reset syscallbuf_hdr->num_rec_bytes and zero out the data * recorded in the syscall buffer. This makes for more deterministic behavior * especially during replay, where during checkpointing we only save and * restore the recorded data area. */ void reset_syscallbuf(); /** * Compute the offset used by a read/write syscall. Returns -1 if the * syscall doesn't pass an offset. */ int64_t get_io_offset(int syscallno, const Registers& regs); /** * Return the virtual memory mapping (address space) of this * task. */ AddressSpace::shr_ptr vm() { return as; } FdTable::shr_ptr fd_table() { return fds; } /** * Block until the status of this changes. wait() expects the wait to end * with the process in a stopped() state. If interrupt_after_elapsed > 0, * interrupt the task after that many seconds have elapsed. */ void wait(double interrupt_after_elapsed = 0); /** * Return true if the status of this has changed, but don't * block. */ bool try_wait(); /** * Currently we don't allow recording across uid changes, so we can just * return rr's uid. */ uid_t getuid() { return ::getuid(); } /** * Write |N| bytes from |buf| to |child_addr|, or don't return. */ template void write_bytes(remote_ptr child_addr, const uint8_t (&buf)[N]) { write_bytes_helper(child_addr, N, buf); } /** * Write |val| to |child_addr|. */ template void write_mem(remote_ptr child_addr, const T& val, bool* ok = nullptr) { assert(type_has_no_holes()); write_bytes_helper(child_addr, sizeof(val), static_cast(&val), ok); } /** * This is not the helper you're looking for. See above: you * probably accidentally wrote |write_mem(addr, &foo)| when * you meant |write_mem(addr, foo)|. */ template void write_mem(remote_ptr child_addr, const T* val) = delete; template void write_mem(remote_ptr child_addr, const T* val, int count) { assert(type_has_no_holes()); write_bytes_helper(child_addr, sizeof(*val) * count, static_cast(val)); } /** * Don't use these helpers directly; use the safer and more * convenient variants above. * * Read/write the number of bytes that the template wrapper * inferred. */ ssize_t read_bytes_fallible(remote_ptr addr, ssize_t buf_size, void* buf); /** * If the data can't all be read, then if |ok| is non-null, sets *ok to * false, otherwise asserts. */ void read_bytes_helper(remote_ptr addr, ssize_t buf_size, void* buf, bool* ok = nullptr); void write_bytes_helper(remote_ptr addr, ssize_t buf_size, const void* buf, bool* ok = nullptr); /** * Call this when performing a clone syscall in this task. Returns * true if the call completed, false if it was interrupted and * needs to be resumed. When the call returns true, the task is * stopped at a PTRACE_EVENT_CLONE or PTRACE_EVENT_FORK. */ bool clone_syscall_is_complete(); /** * Called when SYS_rrcall_init_preload has happened. */ virtual void at_preload_init(); /** * Open /proc/[tid]/mem fd for our AddressSpace, closing the old one * first. * This never fails. If necessary we force the tracee to open the file * itself and smuggle the fd back to us. */ void open_mem_fd(); /** * Calls open_mem_fd if this task's AddressSpace doesn't already have one. */ void open_mem_fd_if_needed(); /** * Return the name of the given syscall. */ std::string syscall_name(int syscallno) const; /** * Look up a TLS address for this thread. |offset| and * |load_module| are as specified in the qGetTLSAddr packet. If the * address is found, set |*result| and return true. Otherwise, * return false. */ bool get_tls_address(size_t offset, remote_ptr load_module, remote_ptr* result); /** * Indicate that the symbol |name| has the given address. */ void register_symbol(const std::string& name, remote_ptr address); /** * Return a set of the names of all the symbols that might be needed * by libthread_db. Also clears the current mapping of symbol names * to addresses. */ const std::set get_symbols_and_clear_map(); /* True when any assumptions made about the status of this * process have been invalidated, and must be re-established * with a waitpid() call. Only applies to tasks which are dying, usually * due to a signal sent to the entire task group. */ bool unstable; /* exit(), or exit_group() with one task, has been called, so * the exit can be treated as stable. */ bool stable_exit; /* Imagine that task A passes buffer |b| to the read() * syscall. Imagine that, after A is switched out for task B, * task B then writes to |b|. Then B is switched out for A. * Since rr doesn't schedule the kernel code, the result is * nondeterministic. To avoid that class of replay * divergence, we "redirect" (in)outparams passed to may-block * syscalls, to "scratch memory". The kernel writes to * scratch deterministically, and when A (in the example * above) exits its read() syscall, rr copies the scratch data * back to the original buffers, serializing A and B in the * example above. * * Syscalls can "nest" due to signal handlers. If a syscall A * is interrupted by a signal, and the sighandler calls B, * then we can have scratch buffers set up for args of both A * and B. In linux, B won't actually re-enter A; A is exited * with a "will-restart" error code and its args are saved for * when (or if) it's restarted after the signal. But that * doesn't really matter wrt scratch space. (TODO: in the * future, we may be able to use that fact to simplify * things.) * * Because of nesting, at first blush it seems we should push * scratch allocations onto a stack and pop them as syscalls * (or restarts thereof) complete. But under a critical * assumption, we can actually skip that. The critical * assumption is that the kernel writes its (in)outparams * atomically wrt signal interruptions, and only writes them * on successful exit. Each syscall will complete in stack * order, and it's invariant that the syscall processors must * only write back to user buffers *only* the data that was * written by the kernel. So as long as the atomicity * assumption holds, the completion of syscalls higher in the * event stack may overwrite scratch space, but the completion * of each syscall will overwrite those overwrites again, and * that over-overwritten data is exactly and only what we'll * write back to the tracee. * * |scratch_ptr| points at the mapped address in the child, * and |size| is the total available space. */ remote_ptr scratch_ptr; ssize_t scratch_size; /* The child's desched counter event fd number */ int desched_fd_child; /* The child's cloned_file_data_fd */ int cloned_file_data_fd_child; PerfCounters hpc; /* This is always the "real" tid of the tracee. */ pid_t tid; /* This is always the recorded tid of the tracee. During * recording, it's synonymous with |tid|, and during replay * it's the tid that was recorded. */ pid_t rec_tid; size_t syscallbuf_size; /* Points at the tracee's mapping of the buffer. */ remote_ptr syscallbuf_child; remote_code_ptr stopping_breakpoint_table; int stopping_breakpoint_table_entry_size; remote_ptr preload_globals; typedef uint8_t ThreadLocals[PRELOAD_THREAD_LOCALS_SIZE]; ThreadLocals thread_locals; PropertyTable& properties() { return properties_; } struct CapturedState { Ticks ticks; Registers regs; ExtraRegisters extra_regs; std::string prname; std::vector thread_areas; remote_ptr syscallbuf_child; size_t syscallbuf_size; size_t num_syscallbuf_bytes; remote_ptr preload_globals; remote_ptr scratch_ptr; ssize_t scratch_size; remote_ptr top_of_stack; uint64_t cloned_file_data_offset; ThreadLocals thread_locals; pid_t rec_tid; uint32_t serial; int desched_fd_child; int cloned_file_data_fd_child; WaitStatus wait_status; }; protected: Task(Session& session, pid_t tid, pid_t rec_tid, uint32_t serial, SupportedArch a); virtual ~Task(); /** * Return a new Task cloned from |p|. |flags| are a set of * CloneFlags (see above) that determine which resources are * shared or copied to the new child. |new_tid| is the tid * assigned to the new task by the kernel. |new_rec_tid| is * only relevant to replay, and is the pid that was assigned * to the task during recording. */ virtual Task* clone(int flags, remote_ptr stack, remote_ptr tls, remote_ptr cleartid_addr, pid_t new_tid, pid_t new_rec_tid, uint32_t new_serial, Session* other_session = nullptr); template void on_syscall_exit_arch(int syscallno, const Registers& regs); /** Helper function for init_buffers. */ template void init_buffers_arch(remote_ptr map_hint); /** * Grab state from this task into a structure that we can use to * initialize a new task via os_clone_into/os_fork_into and copy_state. */ CapturedState capture_state(); /** * Make this task look like an identical copy of the task whose state * was captured by capture_task_state(), in * every way relevant to replay. This task should have been * created by calling os_clone_into() or os_fork_into(), * and if it wasn't results are undefined. * * Some task state must be copied into this by injecting and * running syscalls in this task. Other state is metadata * that can simply be copied over in local memory. */ void copy_state(const CapturedState& state); const ThreadLocals& fetch_preload_thread_locals(); void activate_preload_thread_locals(); /** * Make the ptrace |request| with |addr| and |data|, return * the ptrace return value. */ long fallible_ptrace(int request, remote_ptr addr, void* data); /** * Like |fallible_ptrace()| but infallible for most purposes. * Errors other than ESRCH are treated as fatal. Returns false if * we got ESRCH. This can happen any time during recording when the * task gets a SIGKILL from outside. */ bool ptrace_if_alive(int request, remote_ptr addr, void* data); /** * Like |fallible_ptrace()| but completely infallible. * All errors are treated as fatal. */ void xptrace(int request, remote_ptr addr, void* data); /** * If the given memory region is mapped into the local address space, obtain * the local address from which the `size` bytes at `addr` can be accessed. */ uint8_t* local_mapping(remote_ptr addr, size_t size); /** * Read tracee memory using PTRACE_PEEKDATA calls. Slow, only use * as fallback. Returns number of bytes actually read. */ ssize_t read_bytes_ptrace(remote_ptr addr, ssize_t buf_size, void* buf); /** * Write tracee memory using PTRACE_POKEDATA calls. Slow, only use * as fallback. Returns number of bytes actually written. */ ssize_t write_bytes_ptrace(remote_ptr addr, ssize_t buf_size, const void* buf); /** * Try writing 'buf' to 'addr' by replacing pages in the tracee * address-space using a temporary file. This may work around PaX issues. */ bool try_replace_pages(remote_ptr addr, ssize_t buf_size, const void* buf); /** * Map the syscallbuffer for this, shared with this process. * |map_hint| is the address where the syscallbuf is expected * to be mapped --- and this is asserted --- or nullptr if * there are no expectations. * Initializes syscallbuf_child. */ KernelMapping init_syscall_buffer(AutoRemoteSyscalls& remote, remote_ptr map_hint); /** * Make the OS-level calls to create a new fork or clone that * will eventually be a copy of this task and return that Task * metadata. These methods are used in concert with * |Task::copy_state()| to create task copies during * checkpointing. * * For |os_fork_into()|, |session| will be tracking the * returned fork child. * * For |os_clone_into()|, |task_leader| is the "main thread" * in the process into which the copy of this task will be * created. |task_leader| will perform the actual OS calls to * create the new child. */ Task* os_fork_into(Session* session); static Task* os_clone_into(const CapturedState& state, Task* task_leader, AutoRemoteSyscalls& remote); /** * Return the TraceStream that we're using, if in recording or replay. * Returns null if we're not in record or replay. */ const TraceStream* trace_stream() const; /** * Make the OS-level calls to clone |parent| into |session| * and return the resulting Task metadata for that new * process. This is as opposed to |Task::clone()|, which only * attaches Task metadata to an /existing/ process. * * The new clone will be tracked in |session|. The other * arguments are as for |Task::clone()| above. */ static Task* os_clone(Task* parent, Session* session, AutoRemoteSyscalls& remote, pid_t rec_child_tid, uint32_t new_serial, unsigned base_flags, remote_ptr stack = nullptr, remote_ptr ptid = nullptr, remote_ptr tls = nullptr, remote_ptr ctid = nullptr); /** * Fork and exec the initial task. If something goes wrong later * (i.e. an exec does not occur before an exit), an error may be * readable from the other end of the pipe whose write end is error_fd. */ static Task* spawn(Session& session, const ScopedFd& error_fd, const TraceStream& trace, const std::string& exe_path, const std::vector& argv, const std::vector& envp, pid_t rec_tid = -1); uint32_t serial; // The address space of this task. AddressSpace::shr_ptr as; // The file descriptor table of this task. FdTable::shr_ptr fds; // Task's OS name. std::string prname; // Count of all ticks seen by this task since tracees became // consistent and the task last wait()ed. Ticks ticks; // When |is_stopped|, these are our child registers. Registers registers; // Where we last resumed execution remote_code_ptr address_of_last_execution_resume; ResumeRequest how_last_execution_resumed; // True when we know via waitpid() that the task is stopped and we haven't // resumed it. bool is_stopped; /* True when the seccomp filter has been enabled via prctl(). This happens * in the first system call issued by the initial tracee (after it returns * from kill(SIGSTOP) to synchronize with the tracer). */ bool seccomp_bpf_enabled; // True when we consumed a PTRACE_EVENT_EXIT that was about to race with // a resume_execution, that was issued while stopped (i.e. SIGKILL). bool detected_unexpected_exit; // When |extra_registers_known|, we have saved our extra registers. ExtraRegisters extra_registers; bool extra_registers_known; // The session we're part of. Session* session_; // The task group this belongs to. std::shared_ptr tg; // Entries set by |set_thread_area()| or the |tls| argument to |clone()| // (when that's a user_desc). May be more than one due to different // entry_numbers. std::vector thread_areas_; // The |stack| argument passed to |clone()|, which for // "threads" is the top of the user-allocated stack. remote_ptr top_of_stack; // The most recent status of this task as returned by // waitpid(). WaitStatus wait_status; // The most recent siginfo (captured when wait_status shows pending_sig()) siginfo_t pending_siginfo; // True when a PTRACE_EXIT_EVENT has been observed in the wait_status // for this task. bool seen_ptrace_exit_event; PropertyTable properties_; // A counter for the number of stops for which the stop may have been caused // by PTRACE_INTERRUPT. See description in do_waitpid int expecting_ptrace_interrupt_stop; Task(Task&) = delete; Task operator=(Task&) = delete; }; } // namespace rr #endif /* RR_TASK_H_ */ rr-4.4.0/src/TaskGroup.cc000066400000000000000000000025101277367620400151730ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "TaskGroup.h" #include "Session.h" #include "Task.h" #include "ThreadDb.h" #include "log.h" namespace rr { TaskGroup::TaskGroup(Session* session, TaskGroup* parent, pid_t tgid, pid_t real_tgid, uint32_t serial) : tgid(tgid), real_tgid(real_tgid), dumpable(true), execed(false), received_sigframe_SIGSEGV(false), session_(session), parent_(parent), serial(serial) { LOG(debug) << "creating new task group " << tgid << " (real tgid:" << real_tgid << ")"; if (parent) { parent->children_.insert(this); } session->on_create(this); } TaskGroup::~TaskGroup() { if (session_) { session_->on_destroy(this); } for (TaskGroup* tg : children()) { tg->parent_ = nullptr; } if (parent_) { parent_->children_.erase(this); } } void TaskGroup::destabilize() { LOG(debug) << "destabilizing task group " << tgid; for (auto it = task_set().begin(); it != task_set().end(); ++it) { Task* t = *it; t->unstable = true; LOG(debug) << " destabilized task " << t->tid; } } ThreadDb* TaskGroup::thread_db() { if (!thread_db_) { thread_db_ = std::unique_ptr(new ThreadDb(this)); } return thread_db_.get(); } } // namespace rr rr-4.4.0/src/TaskGroup.h000066400000000000000000000111471277367620400150430ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TASKGROUP_H_ #define RR_TASKGROUP_H_ #include #include #include #include #include "HasTaskSet.h" #include "TaskishUid.h" #include "WaitStatus.h" namespace rr { class Session; class ThreadDb; /** * Tracks a group of tasks with an associated ID, set from the * original "thread group leader", the child of |fork()| which became * the ancestor of all other threads in the group. Each constituent * task must own a reference to this. */ class TaskGroup : public HasTaskSet { public: TaskGroup(Session* session, TaskGroup* parent, pid_t tgid, pid_t real_tgid, uint32_t serial); ~TaskGroup(); typedef std::shared_ptr shr_ptr; /** * Mark the members of this task group as "unstable", * meaning that even though a task may look runnable, it * actually might not be. (And so |waitpid(-1)| should be * used to schedule the next task.) * * This is needed to handle the peculiarities of mass Task * death at exit_group() and upon receiving core-dumping * signals. The reason it's needed is easier to understand if * you keep in mind that the "main loop" of ptrace tracers is * /supposed/ to look like * * while (true) { * int tid = waitpid(-1, ...); * // do something with tid * ptrace(tid, PTRACE_SYSCALL, ...); * } * * That is, the tracer is supposed to let the kernel schedule * threads and then respond to notifications generated by the * kernel. * * Obviously this isn't how rr's recorder loop looks, because, * among other things, rr has to serialize thread execution. * Normally this isn't much of a problem. However, mass task * death is an exception. What happens at a mass task death * is a sequence of events like the following * * 1. A task calls exit_group() or is sent a core-dumping * signal. * 2. rr receives a PTRACE_EVENT_EXIT notification for the * task. * 3. rr detaches from the dying/dead task. * 4. Successive calls to waitpid(-1) generate additional * PTRACE_EVENT_EXIT notifications for each also-dead task * in the original task's thread group. Repeat (2) / (3) * for each notified task. * * So why destabilization? After (2), rr can't block on the * task shutting down (|waitpid(tid)|), because the kernel * harvests the LWPs of the dying task group in an unknown * order (which we shouldn't assume, even if we could guess * it). If rr blocks on the task harvest, it will (usually) * deadlock. * * And because rr doesn't know the order of tasks that will be * reaped, it doesn't know which of the dying tasks to * "schedule". If it guesses and blocks on another task in * the group's status-change, it will (usually) deadlock. * * So destabilizing a task group, from rr's perspective, means * handing scheduling control back to the kernel and not * trying to harvest tasks before detaching from them. * * NB: an invariant of rr scheduling is that all process * status changes happen as a result of rr resuming the * execution of a task. This is required to keep tracees in * known states, preventing events from happening "behind rr's * back". However, destabilizing a task group means that * these kinds of changes are possible, in theory. * * Currently, instability is a one-way street; it's only used * needed for death signals and exit_group(). */ void destabilize(); const pid_t tgid; const pid_t real_tgid; WaitStatus exit_status; Session* session() const { return session_; } void forget_session() { session_ = nullptr; } TaskGroup* parent() { return parent_; } const std::set& children() { return children_; } TaskGroupUid tguid() const { return TaskGroupUid(tgid, serial); } // We don't allow tasks to make themselves undumpable. If they try, // record that here and lie about it if necessary. bool dumpable; // Whether this task group has execed bool execed; // True when a task in the task-group received a SIGSEGV because we // couldn't push a signal handler frame. Only used during recording. bool received_sigframe_SIGSEGV; ThreadDb* thread_db(); private: TaskGroup(const TaskGroup&) = delete; TaskGroup operator=(const TaskGroup&) = delete; Session* session_; /** Parent TaskGroup, or nullptr if it's not a tracee (rr or init). */ TaskGroup* parent_; std::set children_; uint32_t serial; std::unique_ptr thread_db_; }; } // namespace rr #endif /* RR_TASKGROUP_H_ */ rr-4.4.0/src/TaskishUid.h000066400000000000000000000042211277367620400151670ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TASKISH_UID_H_ #define RR_TASKISH_UID_H_ #include #include namespace rr { class AddressSpace; class Task; class TaskGroup; /** * An ID that's unique within a Session (but consistent across * multiple ReplaySessions for the same trace), used by Tasks, TaskGroups * and AddressSpaces. * This is needed because tids can be recycled during a long-running session. */ template class TaskishUid { public: TaskishUid() : tid_(0), serial_(0) {} TaskishUid(pid_t tid, uint32_t serial) : tid_(tid), serial_(serial) {} TaskishUid(const TaskishUid& other) = default; bool operator==(const TaskishUid& other) const { return tid_ == other.tid_ && serial_ == other.serial_; } bool operator!=(const TaskishUid& other) const { return !(*this == other); } bool operator<(const TaskishUid& other) const { if (tid_ < other.tid_) { return true; } if (tid_ > other.tid_) { return false; } return serial_ < other.serial_; } pid_t tid() const { return tid_; } uint32_t serial() const { return serial_; } private: pid_t tid_; uint32_t serial_; }; typedef TaskishUid TaskUid; typedef TaskishUid TaskGroupUid; class AddressSpaceUid : public TaskishUid { public: AddressSpaceUid() : exec_count_(0) {} AddressSpaceUid(pid_t tid, uint32_t serial, uint32_t exec_count) : TaskishUid(tid, serial), exec_count_(exec_count) {} AddressSpaceUid(const AddressSpaceUid& other) = default; bool operator==(const AddressSpaceUid& other) const { return TaskishUid::operator==(other) && exec_count_ == other.exec_count_; } bool operator<(const AddressSpaceUid& other) const { if (TaskishUid::operator<(other)) { return true; } if (other.TaskishUid::operator<(*this)) { return false; } return exec_count_ < other.exec_count_; } uint32_t exec_count() const { return exec_count_; } private: uint32_t exec_count_; }; } // namespace rr #endif // RR_TASKISH_UID_H_ rr-4.4.0/src/ThreadDb.cc000066400000000000000000000157751277367620400147520ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ThreadDb.h" #include "GdbServer.h" #include "Task.h" #include "TaskGroup.h" #include "log.h" extern "C" { // The proc_service/thread_db library has a very weird API. It // requires the user of the library to provide certain functions which // it links to (rather than, say, having the library user supply a // struct of function pointers). We have to ensure that these // functions have C linkage, so that libthread_db can find them. #include "proc_service.h" } #include #include #include #include #define LIBRARY_NAME "libthread_db.so.1" // Needed for the logging API. using namespace rr; ps_err_e ps_pglobal_lookup(struct ps_prochandle* h, const char*, const char* symbol, psaddr_t* sym_addr) { rr::remote_ptr addr; if (!h->db->query_symbol(symbol, &addr)) { LOG(debug) << "ps_pglobal_lookup " << symbol << " failed"; return PS_NOSYM; } *sym_addr = reinterpret_cast(addr.as_int()); LOG(debug) << "ps_pglobal_lookup " << symbol << " OK"; return PS_OK; } ps_err_e ps_pdread(struct ps_prochandle* h, psaddr_t addr, void* buffer, size_t len) { bool ok = true; uintptr_t uaddr = reinterpret_cast(addr); // We need any task associated with the task group. Here we assume // that all the tasks in the task group share VM, which is enforced // by clone(2). rr::Task* task = *h->task_group->task_set().begin(); task->read_bytes_helper(uaddr, len, buffer, &ok); LOG(debug) << "ps_pdread " << ok; return ok ? PS_OK : PS_ERR; } ps_err_e ps_pdwrite(struct ps_prochandle*, psaddr_t, const void*, size_t) { FATAL() << "ps_pdwrite not implemented"; return PS_ERR; } ps_err_e ps_lgetregs(struct ps_prochandle* h, lwpid_t rec_tid, prgregset_t result) { rr::Task* task = h->task_group->session()->find_task(rec_tid); assert(task != nullptr); struct ::user_regs_struct regs = task->regs().get_ptrace(); memcpy(result, static_cast(®s), sizeof(regs)); LOG(debug) << "ps_lgetregs OK"; return PS_OK; } ps_err_e ps_lsetregs(struct ps_prochandle*, lwpid_t, const prgregset_t) { FATAL() << "ps_lsetregs not implemented"; return PS_ERR; } ps_err_e ps_lgetfpregs(struct ps_prochandle*, lwpid_t, prfpregset_t*) { FATAL() << "ps_lgetfpregs not implemented"; return PS_ERR; } ps_err_e ps_lsetfpregs(struct ps_prochandle*, lwpid_t, const prfpregset_t*) { FATAL() << "ps_lsetfpregs not implemented"; return PS_ERR; } pid_t ps_getpid(struct ps_prochandle* h) { LOG(debug) << "ps_getpid " << h->task_group->tgid; return h->task_group->tgid; } ps_err_e ps_get_thread_area(const struct ps_prochandle* h, lwpid_t rec_tid, int val, psaddr_t* base) { rr::Task* task = h->task_group->session()->find_task(rec_tid); assert(task != nullptr); if (task->arch() == rr::x86) { unsigned int uval = static_cast(val); for (auto& area : task->thread_areas()) { if (area.entry_number == uval) { uintptr_t result = static_cast(area.base_addr); *base = reinterpret_cast(result); return PS_OK; } } LOG(debug) << "ps_get_thread_area 32 failed"; return PS_ERR; } uintptr_t result; switch (val) { case FS: result = task->regs().fs_base(); break; case GS: result = task->regs().gs_base(); break; default: LOG(debug) << "ps_get_thread_area PS_BADADDR"; return PS_BADADDR; } *base = reinterpret_cast(result); return PS_OK; } rr::ThreadDb::ThreadDb(TaskGroup* task_group) : internal_handle(nullptr), thread_db_library(nullptr), td_ta_delete_fn(nullptr), td_thr_tls_get_addr_fn(nullptr), td_ta_map_lwp2thr_fn(nullptr) { prochandle.task_group = task_group; prochandle.db = this; } rr::ThreadDb::~ThreadDb() { if (internal_handle) { td_ta_delete_fn(internal_handle); } if (thread_db_library) { dlclose(thread_db_library); } } const std::set rr::ThreadDb::get_symbols_and_clear_map() { // If we think the symbol locations might have changed, then we // probably need to recreate the handle. if (internal_handle) { td_ta_delete_fn(internal_handle); internal_handle = nullptr; } symbols.clear(); load_library(); return symbol_names; } void rr::ThreadDb::register_symbol(const std::string& name, remote_ptr address) { LOG(debug) << "register_symbol " << name; symbols[name] = address; } bool rr::ThreadDb::query_symbol(const char* name, remote_ptr* address) { auto it = symbols.find(name); if (it == symbols.end()) { return false; } *address = it->second; return true; } bool rr::ThreadDb::get_tls_address(pid_t rec_tid, size_t offset, remote_ptr load_module, remote_ptr* result) { if (!initialize()) { return false; } td_thrhandle_t th; if (td_ta_map_lwp2thr_fn(internal_handle, rec_tid, &th) != TD_OK) { return false; } psaddr_t load_module_addr = reinterpret_cast(load_module.as_int()); psaddr_t addr; if (td_thr_tls_get_addr_fn(&th, load_module_addr, offset, &addr) != TD_OK) { return false; } *result = remote_ptr(reinterpret_cast(addr)); return true; } bool rr::ThreadDb::initialize() { if (internal_handle) { return true; } if (!load_library()) { return false; } if (!td_ta_new_fn || td_ta_new_fn(&prochandle, &internal_handle) != TD_OK) { LOG(debug) << "initialize td_ta_new_fn failed"; return false; } LOG(debug) << "initialize OK"; return true; } bool rr::ThreadDb::load_library() { if (thread_db_library) { LOG(debug) << "load_library already loaded: " << loaded; return loaded; } thread_db_library = dlopen(LIBRARY_NAME, RTLD_NOW); if (!thread_db_library) { LOG(debug) << "load_library dlopen failed"; return false; } decltype(td_symbol_list)* td_symbol_list_fn; #define FIND_FUNCTION(Name) \ do { \ Name##_fn = (decltype(Name)*)(dlsym(thread_db_library, #Name)); \ if (!Name##_fn) { \ LOG(debug) << "load_library failed to find " << #Name; \ return false; \ } \ } while (0) FIND_FUNCTION(td_thr_tls_get_addr); FIND_FUNCTION(td_ta_delete); FIND_FUNCTION(td_symbol_list); FIND_FUNCTION(td_ta_new); FIND_FUNCTION(td_ta_map_lwp2thr); #undef FIND_FUNCTION for (const char** syms = td_symbol_list_fn(); *syms; ++syms) { symbol_names.insert(*syms); } // Good to go. loaded = true; LOG(debug) << "load_library OK"; return true; } rr-4.4.0/src/ThreadDb.h000066400000000000000000000064771277367620400146130ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_THREADDB_H_ #define RR_THREADDB_H_ #include "remote_ptr.h" #include #include #include extern "C" { #include } namespace rr { class TaskGroup; class ThreadDb; } // This is declared as incomplete by the libthread_db API and is // expected to be defined by the API user. We define it to hold just // pointers back to the task group and to the ThreadDb object. struct ps_prochandle { rr::TaskGroup* task_group; rr::ThreadDb* db; }; namespace rr { /** * This provides an interface to libthread_db.so to help with TLS * lookup. There is one instance per process, attached to the * TaskGroup. * * The overall approach is that a libthread_db.so is loaded into rr * when this class is initialized (see |load_library|). This provides * the GdbServer with a list of symbols whose addresses might be * needed in order to resolve TLS accesses. * * Then, when the address of a TLS variable is requested by the * debugger, GdbServer calls |get_tls_address|. This uses the * libthread_db "new" function ("td_ta_new"); if this succeeds then * ThreadDb proceeds to use other APIs to find the desired address. * * ThreadDb works on a callback model, using symbols provided by the * hosting application. These are all defined in ThreadDb.cc. */ class ThreadDb { public: explicit ThreadDb(TaskGroup*); ~ThreadDb(); /** * Return a set of the names of all the symbols that might be needed * by libthread_db. Also clears the current mapping of symbol names * to addresses. */ const std::set get_symbols_and_clear_map(); /** * Note that the symbol |name| has the given address. */ void register_symbol(const std::string& name, remote_ptr address); /** * Look up the symbol |name|. If found, set |*address| and return * true. If not found, return false. */ bool query_symbol(const char* name, remote_ptr* address); /** * Look up a TLS address for thread |rec_tid|. |offset| and * |load_module| are as specified in the qGetTLSAddr packet. If the * address is found, set |*result| and return true. Otherwise, * return false. */ bool get_tls_address(pid_t rec_tid, size_t offset, remote_ptr load_module, remote_ptr* result); private: bool load_library(); bool initialize(); ThreadDb(ThreadDb&) = delete; ThreadDb operator=(ThreadDb&) = delete; // True if libthread_db has been successfully initialized, if all // the functions exist, and if the list of needed symbol names has // been computed. bool loaded; // The external handle for this thread, for libthread_db. struct ps_prochandle prochandle; // The internal handle for this thread, from libthread_db. td_thragent_t* internal_handle; // Handle on the libthread_db library itself. void* thread_db_library; // Functions from libthread_db. decltype(td_ta_delete)* td_ta_delete_fn; decltype(td_thr_tls_get_addr)* td_thr_tls_get_addr_fn; decltype(td_ta_map_lwp2thr)* td_ta_map_lwp2thr_fn; decltype(td_ta_new)* td_ta_new_fn; // Set of all symbol names. std::set symbol_names; // Map from symbol names to addresses. std::map> symbols; }; } // namespace rr #endif // RR_THREADDB_H_ rr-4.4.0/src/Ticks.h000066400000000000000000000003441277367620400141760ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TICKS_H_ #define RR_TICKS_H_ #include namespace rr { typedef int64_t Ticks; } // namespace rr #endif /* RR_TICKS_H_ */ rr-4.4.0/src/TraceFrame.cc000066400000000000000000000043731277367620400152760ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "TraceFrame.h" #include #include #include "util.h" namespace rr { TraceFrame::TraceFrame(Time global_time, pid_t tid, const Event& event, Ticks tick_count, double monotonic_time) : global_time(global_time), tid_(tid), ev(event), ticks_(tick_count), monotonic_time_(monotonic_time ? monotonic_time : monotonic_now_sec()) {} void TraceFrame::set_exec_info(const Registers& regs, const PerfCounters::Extra* extra_perf_values, const ExtraRegisters* extra_regs) { assert(event().record_exec_info() == HAS_EXEC_INFO); recorded_regs = regs; if (extra_perf_values) { extra_perf = *extra_perf_values; } if (extra_regs) { recorded_extra_regs = *extra_regs; } } void TraceFrame::dump(FILE* out) const { out = out ? out : stdout; fprintf(out, "{\n real_time:%f global_time:%u, event:`%s' ", monotonic_time(), time(), event().str().c_str()); if (event().is_syscall_event()) { fprintf(out, "(state:%s) ", state_name(event().Syscall().state)); } fprintf(out, "tid:%d, ticks:%" PRId64 "\n", tid(), ticks()); if (event().has_exec_info() != HAS_EXEC_INFO) { return; } if (PerfCounters::extra_perf_counters_enabled()) { fprintf(out, " hw_ints:%" PRId64 " faults:%" PRId64 " insns:%" PRId64 "\n", extra_perf.hw_interrupts, extra_perf.page_faults, extra_perf.instructions_retired); } regs().print_register_file_compact(out); if (recorded_extra_regs.format() != ExtraRegisters::NONE) { fputc(' ', out); recorded_extra_regs.print_register_file_compact(out); } fprintf(out, "\n"); } void TraceFrame::dump_raw(FILE* out) const { out = out ? out : stdout; fprintf(out, " %d %d %d %" PRId64, time(), tid(), event().encode().encoded, ticks()); if (event().has_exec_info() != HAS_EXEC_INFO) { fprintf(out, "\n"); return; } fprintf(out, " %" PRId64 " %" PRId64 " %" PRId64, extra_perf.hw_interrupts, extra_perf.page_faults, extra_perf.instructions_retired); regs().print_register_file_for_trace_raw(out); fprintf(out, "\n"); } } // namespace rr rr-4.4.0/src/TraceFrame.h000066400000000000000000000047721277367620400151430ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TRACE_FRAME_H_ #define RR_TRACE_FRAME_H_ #include #include #include #include "Event.h" #include "ExtraRegisters.h" #include "PerfCounters.h" #include "Registers.h" #include "Ticks.h" namespace rr { class TraceReader; class TraceWriter; /** * A trace_frame is one "trace event" from a complete trace. During * recording, a trace_frame is recorded upon each significant event, * for example a context-switch or syscall. During replay, a * trace_frame represents a "next state" that needs to be transitioned * into, and the information recorded in the frame dictates the nature * of the transition. */ class TraceFrame { public: typedef uint32_t Time; TraceFrame(Time global_time, pid_t tid, const Event& event, Ticks tick_count, double monotonic_time = 0); TraceFrame() : global_time(0), tid_(0), ticks_(0), monotonic_time_(0) {} void set_exec_info(const Registers& regs, const PerfCounters::Extra* extra_perf_values, const ExtraRegisters* extra_regs); Time time() const { return global_time; } pid_t tid() const { return tid_; } const Event& event() const { return ev; } Ticks ticks() const { return ticks_; } double monotonic_time() const { return monotonic_time_; } const Registers& regs() const { return recorded_regs; } const ExtraRegisters& extra_regs() const { return recorded_extra_regs; } const PerfCounters::Extra& extra_perf_values() const { return extra_perf; } /** * Log a human-readable representation of this to |out| * (defaulting to stdout), including a newline character. * A human-friendly format is used. Does not emit a trailing '}' * (so the caller can add more fields to the record). */ void dump(FILE* out = nullptr) const; /** * Log a human-readable representation of this to |out| * (defaulting to stdout), including a newline character. An * easily machine-parseable format is dumped. */ void dump_raw(FILE* out = nullptr) const; private: friend class TraceReader; friend class TraceWriter; Time global_time; pid_t tid_; Event ev; Ticks ticks_; double monotonic_time_; PerfCounters::Extra extra_perf; Registers recorded_regs; // Only used when has_exec_info, but variable length (and usually not // present) so we don't want to stuff it into exec_info ExtraRegisters recorded_extra_regs; }; } // namespace rr #endif /* RR_TRACE_FRAME_H_ */ rr-4.4.0/src/TraceStream.cc000066400000000000000000000555011277367620400154760ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "TraceStream.h" #include #include #include #include #include #include #include "AddressSpace.h" #include "RecordSession.h" #include "Task.h" #include "TaskishUid.h" #include "kernel_supplement.h" #include "log.h" #include "util.h" using namespace std; namespace rr { // // This represents the format and layout of recorded traces. This // version number doesn't track the rr version number, because changes // to the trace format will be rare. // // NB: if you *do* change the trace format for whatever reason, you // MUST increment this version number. Otherwise users' old traces // will become unreplayable and they won't know why. // #define TRACE_VERSION 65 struct SubstreamData { const char* name; size_t block_size; int threads; }; static SubstreamData substreams[TraceStream::SUBSTREAM_COUNT] = { { "events", 1024 * 1024, 1 }, { "data_header", 1024 * 1024, 1 }, { "data", 1024 * 1024, 0 }, { "mmaps", 64 * 1024, 1 }, { "tasks", 64 * 1024, 1 }, { "generic", 64 * 1024, 1 }, }; static const SubstreamData& substream(TraceStream::Substream s) { if (!substreams[TraceStream::RAW_DATA].threads) { substreams[TraceStream::RAW_DATA].threads = sysconf(_SC_NPROCESSORS_ONLN); } return substreams[s]; } static TraceStream::Substream operator++(TraceStream::Substream& s) { s = (TraceStream::Substream)(s + 1); return s; } static bool dir_exists(const string& dir) { struct stat dummy; return !dir.empty() && stat(dir.c_str(), &dummy) == 0; } static string default_rr_trace_dir() { static string cached_dir; if (!cached_dir.empty()) { return cached_dir; } string dot_dir; const char* home = getenv("HOME"); if (home) { dot_dir = string(home) + "/.rr"; } string xdg_dir; const char* xdg_data_home = getenv("XDG_DATA_HOME"); if (xdg_data_home) { xdg_dir = string(xdg_data_home) + "/rr"; } else if (home) { xdg_dir = string(home) + "/.local/share/rr"; } // If XDG dir does not exist but ~/.rr does, prefer ~/.rr for backwards // compatibility. if (dir_exists(xdg_dir)) { cached_dir = xdg_dir; } else if (dir_exists(dot_dir)) { cached_dir = dot_dir; } else if (!xdg_dir.empty()) { cached_dir = xdg_dir; } else { cached_dir = "/tmp/rr"; } return cached_dir; } static string trace_save_dir() { const char* output_dir = getenv("_RR_TRACE_DIR"); return output_dir ? output_dir : default_rr_trace_dir(); } static string latest_trace_symlink() { return trace_save_dir() + "/latest-trace"; } static void ensure_dir(const string& dir, mode_t mode) { string d = dir; while (!d.empty() && d[d.length() - 1] == '/') { d = d.substr(0, d.length() - 1); } struct stat st; if (0 > stat(d.c_str(), &st)) { if (errno != ENOENT) { FATAL() << "Error accessing trace directory `" << dir << "'"; } size_t last_slash = d.find_last_of('/'); if (last_slash == string::npos || last_slash == 0) { FATAL() << "Can't find trace directory `" << dir << "'"; } ensure_dir(d.substr(0, last_slash), mode); // Allow for a race condition where someone else creates the directory if (0 > mkdir(d.c_str(), mode) && errno != EEXIST) { FATAL() << "Can't create trace directory `" << dir << "'"; } if (0 > stat(d.c_str(), &st)) { FATAL() << "Can't stat trace directory `" << dir << "'"; } } if (!(S_IFDIR & st.st_mode)) { FATAL() << "`" << dir << "' exists but isn't a directory."; } if (access(d.c_str(), W_OK)) { FATAL() << "Can't write to `" << dir << "'."; } } /** * Create the default ~/.rr directory if it doesn't already exist. */ static void ensure_default_rr_trace_dir() { ensure_dir(default_rr_trace_dir(), S_IRWXU); } string TraceStream::file_data_clone_file_name(const TaskUid& tuid) { stringstream ss; ss << trace_dir << "/cloned_data_" << tuid.tid() << "_" << tuid.serial(); return ss.str(); } string TraceStream::path(Substream s) { return trace_dir + "/" + substream(s).name; } bool TraceWriter::good() const { for (auto& w : writers) { if (!w->good()) { return false; } } return true; } bool TraceReader::good() const { for (auto& r : readers) { if (!r->good()) { return false; } } return true; } struct BasicInfo { TraceFrame::Time global_time; pid_t tid_; EncodedEvent ev; Ticks ticks_; double monotonic_sec; }; void TraceWriter::write_frame(const TraceFrame& frame) { auto& events = writer(EVENTS); BasicInfo basic_info; memset(&basic_info, 0, sizeof(BasicInfo)); basic_info.global_time = frame.time(); basic_info.tid_ = frame.tid(); basic_info.ev = frame.event().encode(); basic_info.ticks_ = frame.ticks(); basic_info.monotonic_sec = frame.monotonic_time(); events << basic_info; if (!events.good()) { FATAL() << "Tried to save " << sizeof(basic_info) << " bytes to the trace, but failed"; } if (frame.event().has_exec_info() == HAS_EXEC_INFO) { events << (char)frame.regs().arch(); auto raw_regs = frame.regs().get_ptrace_for_arch(frame.regs().arch()); events.write(raw_regs.data(), raw_regs.size()); events << frame.extra_perf_values(); if (!events.good()) { FATAL() << "Tried to save registers to the trace, but failed"; } int extra_reg_bytes = frame.extra_regs().data_size(); char extra_reg_format = (char)frame.extra_regs().format(); events << extra_reg_format << extra_reg_bytes; if (!events.good()) { FATAL() << "Tried to save " << sizeof(extra_reg_bytes) + sizeof(extra_reg_format) << " bytes to the trace, but failed"; } if (extra_reg_bytes > 0) { events.write((const char*)frame.extra_regs().data_bytes(), extra_reg_bytes); if (!events.good()) { FATAL() << "Tried to save " << extra_reg_bytes << " bytes to the trace, but failed"; } } } if (frame.event().is_signal_event()) { events << frame.event().Signal().signal_data(); } tick_time(); } TraceFrame TraceReader::read_frame() { // Read the common event info first, to see if we also have // exec info to read. auto& events = reader(EVENTS); BasicInfo basic_info; events >> basic_info; TraceFrame frame(basic_info.global_time, basic_info.tid_, Event(basic_info.ev), basic_info.ticks_, basic_info.monotonic_sec); if (frame.event().has_exec_info() == HAS_EXEC_INFO) { char a; events >> a; uint8_t buf[sizeof(X64Arch::user_regs_struct)]; frame.recorded_regs.set_arch((SupportedArch)a); switch (frame.recorded_regs.arch()) { case x86: events.read(buf, sizeof(X86Arch::user_regs_struct)); frame.recorded_regs.set_from_ptrace_for_arch( x86, buf, sizeof(X86Arch::user_regs_struct)); break; case x86_64: events.read(buf, sizeof(X64Arch::user_regs_struct)); frame.recorded_regs.set_from_ptrace_for_arch( x86_64, buf, sizeof(X64Arch::user_regs_struct)); break; default: FATAL() << "Unknown arch"; } events >> frame.extra_perf; int extra_reg_bytes; char extra_reg_format; events >> extra_reg_format >> extra_reg_bytes; if (extra_reg_bytes > 0) { vector data; data.resize(extra_reg_bytes); events.read((char*)data.data(), extra_reg_bytes); frame.recorded_extra_regs.set_to_raw_data( frame.event().arch(), (ExtraRegisters::Format)extra_reg_format, data); } else { assert(extra_reg_format == ExtraRegisters::NONE); frame.recorded_extra_regs = ExtraRegisters(frame.event().arch()); } } if (frame.event().is_signal_event()) { uint64_t signal_data; events >> signal_data; frame.ev.Signal().set_signal_data(signal_data); } tick_time(); assert(time() == frame.time()); return frame; } void TraceWriter::write_task_event(const TraceTaskEvent& event) { auto& tasks = writer(TASKS); tasks << global_time << (char)event.type() << event.tid(); switch (event.type()) { case TraceTaskEvent::CLONE: tasks << event.parent_tid() << event.clone_flags(); break; case TraceTaskEvent::EXEC: tasks << event.file_name() << event.cmd_line() << event.fds_to_close(); break; case TraceTaskEvent::EXIT: tasks << event.exit_status_; break; case TraceTaskEvent::NONE: assert(0 && "Writing NONE TraceTaskEvent"); break; } } TraceTaskEvent TraceReader::read_task_event() { auto& tasks = reader(TASKS); TraceTaskEvent r; TraceFrame::Time time; char type = TraceTaskEvent::NONE; tasks >> time >> type >> r.tid_; r.type_ = (TraceTaskEvent::Type)type; switch (r.type()) { case TraceTaskEvent::CLONE: tasks >> r.parent_tid_ >> r.clone_flags_; break; case TraceTaskEvent::EXEC: tasks >> r.file_name_ >> r.cmd_line_ >> r.fds_to_close_; break; case TraceTaskEvent::EXIT: tasks >> r.exit_status_; break; case TraceTaskEvent::NONE: // Should be EOF only assert(!tasks.good()); break; default: assert(false && "Corrupt Trace?"); } return r; } static string base_file_name(const string& file_name) { size_t last_slash = file_name.rfind('/'); return (last_slash != file_name.npos) ? file_name.substr(last_slash + 1) : file_name; } string TraceWriter::try_hardlink_file(const string& file_name) { char count_str[20]; sprintf(count_str, "%d", mmap_count); string path = string("mmap_hardlink_") + count_str + "_" + base_file_name(file_name); int ret = link(file_name.c_str(), (dir() + "/" + path).c_str()); if (ret < 0) { // maybe tried to link across filesystems? return file_name; } return path; } bool TraceWriter::try_clone_file(const string& file_name, string* new_name) { char count_str[20]; sprintf(count_str, "%d", mmap_count); string path = string("mmap_clone_") + count_str + "_" + base_file_name(file_name); ScopedFd src(file_name.c_str(), O_RDONLY); if (!src.is_open()) { return false; } string dest_path = dir() + "/" + path; ScopedFd dest(dest_path.c_str(), O_WRONLY | O_CREAT | O_EXCL, 0700); if (!dest.is_open()) { return false; } int ret = ioctl(dest, BTRFS_IOC_CLONE, src.get()); if (ret < 0) { // maybe not on the same filesystem, or filesystem doesn't support clone? unlink(dest_path.c_str()); return false; } *new_name = path; return true; } TraceWriter::RecordInTrace TraceWriter::write_mapped_region( Task* t, const KernelMapping& km, const struct stat& stat, MappingOrigin origin) { auto& mmaps = writer(MMAPS); TraceReader::MappedDataSource source; string backing_file_name; if (origin == REMAP_MAPPING || origin == PATCH_MAPPING) { source = TraceReader::SOURCE_ZERO; } else if (km.fsname().find("/SYSV") == 0) { source = TraceReader::SOURCE_TRACE; } else if (origin == SYSCALL_MAPPING && (km.inode() == 0 || km.fsname() == "/dev/zero (deleted)")) { source = TraceReader::SOURCE_ZERO; } else if (origin == RR_BUFFER_MAPPING) { source = TraceReader::SOURCE_ZERO; } else if ((km.flags() & MAP_PRIVATE) && t->session().as_record()->use_file_cloning() && try_clone_file(km.fsname(), &backing_file_name)) { source = TraceReader::SOURCE_FILE; } else if (should_copy_mmap_region(km, stat) && files_assumed_immutable.find(make_pair( stat.st_dev, stat.st_ino)) == files_assumed_immutable.end()) { source = TraceReader::SOURCE_TRACE; } else { source = TraceReader::SOURCE_FILE; // Try hardlinking file into the trace directory. This will avoid // replay failures if the original file is deleted or replaced (but not // if it is overwritten in-place). If try_hardlink_file fails it // just returns the original file name. // A relative backing_file_name is relative to the trace directory. backing_file_name = try_hardlink_file(km.fsname()); files_assumed_immutable.insert(make_pair(stat.st_dev, stat.st_ino)); } mmaps << global_time << source << km.start() << km.end() << km.fsname() << km.device() << km.inode() << km.prot() << km.flags() << km.file_offset_bytes() << backing_file_name << (uint32_t)stat.st_mode << (uint32_t)stat.st_uid << (uint32_t)stat.st_gid << (int64_t)stat.st_size << (int64_t)stat.st_mtime; ++mmap_count; return source == TraceReader::SOURCE_TRACE ? RECORD_IN_TRACE : DONT_RECORD_IN_TRACE; } KernelMapping TraceReader::read_mapped_region(MappedData* data, bool* found, ValidateSourceFile validate, TimeConstraint time_constraint) { if (found) { *found = false; } auto& mmaps = reader(MMAPS); if (mmaps.at_end()) { return KernelMapping(); } TraceFrame::Time time; if (time_constraint == CURRENT_TIME_ONLY) { mmaps.save_state(); mmaps >> time; mmaps.restore_state(); if (time != global_time) { return KernelMapping(); } } string original_file_name; string backing_file_name; MappedDataSource source; remote_ptr start, end; dev_t device; ino_t inode; int prot, flags; uint32_t uid, gid, mode; uint64_t file_offset_bytes; int64_t mtime, file_size; mmaps >> time >> source >> start >> end >> original_file_name >> device >> inode >> prot >> flags >> file_offset_bytes >> backing_file_name >> mode >> uid >> gid >> file_size >> mtime; assert(time_constraint == ANY_TIME || time == global_time); if (data) { data->source = source; if (data->source == SOURCE_FILE) { static const string clone_prefix("mmap_clone_"); bool is_clone = backing_file_name.substr(0, clone_prefix.size()) == clone_prefix; if (backing_file_name[0] != '/') { backing_file_name = dir() + "/" + backing_file_name; } if (!is_clone && validate == VALIDATE) { struct stat backing_stat; if (stat(backing_file_name.c_str(), &backing_stat)) { FATAL() << "Failed to stat " << backing_file_name << ": replay is impossible"; } if (backing_stat.st_ino != inode || backing_stat.st_mode != mode || backing_stat.st_uid != uid || backing_stat.st_gid != gid || backing_stat.st_size != file_size || backing_stat.st_mtime != mtime) { LOG(error) << "Metadata of " << original_file_name << " changed: replay divergence likely, but continuing " "anyway ..."; } } data->file_name = backing_file_name; data->data_offset_bytes = file_offset_bytes; } else { data->data_offset_bytes = 0; } data->file_size_bytes = file_size; } if (found) { *found = true; } return KernelMapping(start, end, original_file_name, device, inode, prot, flags, file_offset_bytes); } void TraceWriter::write_raw(pid_t rec_tid, const void* d, size_t len, remote_ptr addr) { auto& data = writer(RAW_DATA); auto& data_header = writer(RAW_DATA_HEADER); data_header << global_time << rec_tid << addr.as_int() << len; data.write(d, len); } TraceReader::RawData TraceReader::read_raw_data() { auto& data = reader(RAW_DATA); auto& data_header = reader(RAW_DATA_HEADER); TraceFrame::Time time; RawData d; size_t num_bytes; data_header >> time >> d.rec_tid >> d.addr >> num_bytes; assert(time == global_time); d.data.resize(num_bytes); data.read((char*)d.data.data(), num_bytes); return d; } bool TraceReader::read_raw_data_for_frame(const TraceFrame& frame, RawData& d) { auto& data_header = reader(RAW_DATA_HEADER); if (data_header.at_end()) { return false; } TraceFrame::Time time; data_header.save_state(); data_header >> time; data_header.restore_state(); assert(time >= frame.time()); if (time > frame.time()) { return false; } d = read_raw_data(); return true; } void TraceWriter::write_generic(const void* d, size_t len) { auto& generic = writer(GENERIC); generic << global_time << len; generic.write(d, len); } void TraceReader::read_generic(vector& out) { auto& generic = reader(GENERIC); TraceFrame::Time time; size_t num_bytes; generic >> time >> num_bytes; assert(time == global_time); out.resize(num_bytes); generic.read((char*)out.data(), num_bytes); } bool TraceReader::read_generic_for_frame(const TraceFrame& frame, vector& out) { auto& generic = reader(GENERIC); if (generic.at_end()) { return false; } TraceFrame::Time time; generic.save_state(); generic >> time; generic.restore_state(); assert(time >= frame.time()); if (time > frame.time()) { return false; } read_generic(out); return true; } void TraceWriter::close() { for (auto& w : writers) { w->close(); } } static string make_trace_dir(const string& exe_path) { ensure_default_rr_trace_dir(); // Find a unique trace directory name. int nonce = 0; int ret; string dir; do { stringstream ss; ss << trace_save_dir() << "/" << basename(exe_path.c_str()) << "-" << nonce++; dir = ss.str(); ret = mkdir(dir.c_str(), S_IRWXU | S_IRWXG); } while (ret && EEXIST == errno); if (ret) { FATAL() << "Unable to create trace directory `" << dir << "'"; } return dir; } TraceWriter::TraceWriter(const std::string& file_name, int bind_to_cpu) : TraceStream(make_trace_dir(file_name), // Somewhat arbitrarily start the // global time from 1. 1), mmap_count(0), supports_file_data_cloning_(false) { this->bind_to_cpu = bind_to_cpu; for (Substream s = SUBSTREAM_FIRST; s < SUBSTREAM_COUNT; ++s) { writers[s] = unique_ptr(new CompressedWriter( path(s), substream(s).block_size, substream(s).threads)); } string ver_path = version_path(); ScopedFd version_fd(ver_path.c_str(), O_RDWR | O_CREAT, 0600); if (!version_fd.is_open()) { FATAL() << "Unable to create " << ver_path; } char buf[10]; sprintf(buf, "%d\n", TRACE_VERSION); ssize_t buf_len = strlen(buf); if (write(version_fd, buf, buf_len) != buf_len) { FATAL() << "Unable to write " << ver_path; } // Test if file data cloning is supported string version_clone_path = trace_dir + "/tmp_clone"; ScopedFd version_clone_fd(version_clone_path.c_str(), O_WRONLY | O_CREAT, 0600); if (!version_clone_fd.is_open()) { FATAL() << "Unable to create " << version_clone_path; } btrfs_ioctl_clone_range_args clone_args; clone_args.src_fd = version_fd; clone_args.src_offset = 0; clone_args.src_length = buf_len; clone_args.dest_offset = 0; if (ioctl(version_clone_fd, BTRFS_IOC_CLONE_RANGE, &clone_args) == 0) { supports_file_data_cloning_ = true; } unlink(version_clone_path.c_str()); if (!probably_not_interactive(STDOUT_FILENO)) { printf("rr: Saving execution to trace directory `%s'.\n", trace_dir.c_str()); } write_generic(&bind_to_cpu, sizeof(bind_to_cpu)); } void TraceWriter::make_latest_trace() { string link_name = latest_trace_symlink(); // Try to update the symlink to |this|. We only try attempt // to set the symlink once. If the link is re-created after // we |unlink()| it, then another rr process is racing with us // and it "won". The link is then valid and points at some // very-recent trace, so that's good enough. unlink(link_name.c_str()); int ret = symlink(trace_dir.c_str(), link_name.c_str()); if (ret < 0 && errno != EEXIST) { FATAL() << "Failed to update symlink `" << link_name << "' to `" << trace_dir << "'."; } } TraceFrame TraceReader::peek_frame() { auto& events = reader(EVENTS); events.save_state(); auto saved_time = global_time; TraceFrame frame; if (!at_end()) { frame = read_frame(); } events.restore_state(); global_time = saved_time; return frame; } void TraceReader::rewind() { for (Substream s = SUBSTREAM_FIRST; s < SUBSTREAM_COUNT; ++s) { reader(s).rewind(); } global_time = 0; assert(good()); } TraceReader::TraceReader(const string& dir) : TraceStream(dir.empty() ? latest_trace_symlink() : dir, 1) { for (Substream s = SUBSTREAM_FIRST; s < SUBSTREAM_COUNT; ++s) { readers[s] = unique_ptr(new CompressedReader(path(s))); } string path = version_path(); fstream vfile(path.c_str(), fstream::in); if (!vfile.good()) { fprintf( stderr, "\n" "rr: error: Version file for recorded trace `%s' not found. Did you " "record\n" " `%s' with an older version of rr? If so, you'll need to " "replay\n" " `%s' with that older version. Otherwise, your trace is\n" " likely corrupted.\n" "\n", path.c_str(), path.c_str(), path.c_str()); exit(EX_DATAERR); } int version = 0; vfile >> version; if (vfile.fail() || TRACE_VERSION != version) { fprintf(stderr, "\n" "rr: error: Recorded trace `%s' has an incompatible " "version %d; expected\n" " %d. Did you record `%s' with an older version " "of rr? If so,\n" " you'll need to replay `%s' with that older " "version. Otherwise,\n" " your trace is likely corrupted.\n" "\n", path.c_str(), version, TRACE_VERSION, path.c_str(), path.c_str()); exit(EX_DATAERR); } vector bind_to_cpu_bytes; read_generic(bind_to_cpu_bytes); assert(bind_to_cpu_bytes.size() == sizeof(bind_to_cpu)); memcpy(&bind_to_cpu, bind_to_cpu_bytes.data(), sizeof(bind_to_cpu)); // Set the global time at 0, so that when we tick it for the first // event, it matches the initial global time at recording, 1. global_time = 0; } /** * Create a copy of this stream that has exactly the same * state as 'other', but for which mutations of this * clone won't affect the state of 'other' (and vice versa). */ TraceReader::TraceReader(const TraceReader& other) : TraceStream(other.dir(), other.time()) { for (Substream s = SUBSTREAM_FIRST; s < SUBSTREAM_COUNT; ++s) { readers[s] = unique_ptr(new CompressedReader(other.reader(s))); } bind_to_cpu = other.bind_to_cpu; } uint64_t TraceReader::uncompressed_bytes() const { uint64_t total = 0; for (Substream s = SUBSTREAM_FIRST; s < SUBSTREAM_COUNT; ++s) { total += reader(s).uncompressed_bytes(); } return total; } uint64_t TraceReader::compressed_bytes() const { uint64_t total = 0; for (Substream s = SUBSTREAM_FIRST; s < SUBSTREAM_COUNT; ++s) { total += reader(s).compressed_bytes(); } return total; } } // namespace rr rr-4.4.0/src/TraceStream.h000066400000000000000000000212741277367620400153400ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TRACE_H_ #define RR_TRACE_H_ #include #include #include #include #include #include "CompressedReader.h" #include "CompressedWriter.h" #include "Event.h" #include "TaskishUid.h" #include "TraceFrame.h" #include "TraceTaskEvent.h" #include "remote_ptr.h" namespace rr { class KernelMapping; class Task; /** * TraceStream stores all the data common to both recording and * replay. TraceWriter deals with recording-specific logic, and * TraceReader handles replay-specific details. * * These classes are all in the same .h/.cc file to keep trace reading and * writing code together for easier coordination. */ class TraceStream { protected: typedef std::string string; public: /** * Update |substreams| and TRACE_VERSION when you update this list. */ enum Substream { SUBSTREAM_FIRST, // Substream that stores events (trace frames). EVENTS = SUBSTREAM_FIRST, // Substreams that store raw data saved from tracees (|RAW_DATA|), and // metadata about the stored data (|RAW_DATA_HEADER|). RAW_DATA_HEADER, RAW_DATA, // Substream that stores metadata about files mmap'd during // recording. MMAPS, // Substream that stores task creation and exec events TASKS, // Substream that stores arbitrary per-event records GENERIC, SUBSTREAM_COUNT }; /** Return the directory storing this trace's files. */ const string& dir() const { return trace_dir; } int bound_to_cpu() const { return bind_to_cpu; } /** * Return the current "global time" (event count) for this * trace. */ TraceFrame::Time time() const { return global_time; } std::string file_data_clone_file_name(const TaskUid& tuid); protected: TraceStream(const string& trace_dir, TraceFrame::Time initial_time) : trace_dir(trace_dir), global_time(initial_time) {} /** * Return the path of the file for the given substream. */ string path(Substream s); /** * Return the path of "version" file, into which the current * trace format version of rr is stored upon creation of the * trace. */ string version_path() const { return trace_dir + "/version"; } /** * Increment the global time and return the incremented value. */ void tick_time() { ++global_time; } // Directory into which we're saving the trace files. string trace_dir; // CPU core# that the tracees are bound to int32_t bind_to_cpu; // Arbitrary notion of trace time, ticked on the recording of // each event (trace frame). TraceFrame::Time global_time; }; class TraceWriter : public TraceStream { public: bool supports_file_data_cloning() { return supports_file_data_cloning_; } /** * Write trace frame to the trace. * * Recording a trace frame has the side effect of ticking * the global time. */ void write_frame(const TraceFrame& frame); enum RecordInTrace { DONT_RECORD_IN_TRACE, RECORD_IN_TRACE }; enum MappingOrigin { SYSCALL_MAPPING, // Just memory moved from one place to another, so no recording needed. REMAP_MAPPING, EXEC_MAPPING, PATCH_MAPPING, RR_BUFFER_MAPPING }; /** * Write mapped-region record to the trace. * If this returns RECORD_IN_TRACE, then the data for the map should be * recorded in the trace raw-data. */ RecordInTrace write_mapped_region(Task* t, const KernelMapping& map, const struct stat& stat, MappingOrigin origin = SYSCALL_MAPPING); /** * Write a raw-data record to the trace. * 'addr' is the address in the tracee where the data came from/will be * restored to. */ void write_raw(pid_t tid, const void* data, size_t len, remote_ptr addr); /** * Write a task event (clone or exec record) to the trace. */ void write_task_event(const TraceTaskEvent& event); /** * Write a generic data record to the trace. */ void write_generic(const void* data, size_t len); /** * Return true iff all trace files are "good". */ bool good() const; /** Call close() on all the relevant trace files. * Normally this will be called by the destructor. It's helpful to * call this before a crash that won't call the destructor, to ensure * buffered data is flushed. */ void close(); /** * Create a trace where the tracess are bound to cpu |bind_to_cpu|. This * data is recorded in the trace. * The trace name is determined by |file_name| and _RR_TRACE_DIR (if set). */ TraceWriter(const std::string& file_name, int bind_to_cpu); /** * We got far enough into recording that we should set this as the latest * trace. */ void make_latest_trace(); private: std::string try_hardlink_file(const std::string& file_name); bool try_clone_file(const std::string& file_name, std::string* new_name); CompressedWriter& writer(Substream s) { return *writers[s]; } const CompressedWriter& writer(Substream s) const { return *writers[s]; } std::unique_ptr writers[SUBSTREAM_COUNT]; /** * Files that have already been mapped without being copied to the trace, * i.e. that we have already assumed to be immutable. */ std::set> files_assumed_immutable; uint32_t mmap_count; bool supports_file_data_cloning_; }; class TraceReader : public TraceStream { public: /** * A parcel of recorded tracee data. |data| contains the data read * from |addr| in the tracee. */ struct RawData { std::vector data; remote_ptr addr; pid_t rec_tid; }; /** * Read relevant data from the trace. * * NB: reading a trace frame has the side effect of ticking * the global time to match the time recorded in the trace * frame. */ TraceFrame read_frame(); /** * For REMAP_MAPPING maps, the memory contents are preserved so we don't * need a source. We use SOURCE_ZERO for that case and it's ignored. */ enum MappedDataSource { SOURCE_TRACE, SOURCE_FILE, SOURCE_ZERO }; /** * Where to obtain data for the mapped region. */ struct MappedData { MappedDataSource source; /** Name of file to map the data from. */ string file_name; /** Data offset within |file_name|. */ uint64_t data_offset_bytes; /** Original size of mapped file. */ uint64_t file_size_bytes; }; /** * Read the next mapped region descriptor and return it. * Also returns where to get the mapped data in |*data|, if it's non-null. * If |found| is non-null, set |*found| to indicate whether a descriptor * was found for the current event. */ enum ValidateSourceFile { VALIDATE, DONT_VALIDATE }; enum TimeConstraint { CURRENT_TIME_ONLY, ANY_TIME }; KernelMapping read_mapped_region( MappedData* data = nullptr, bool* found = nullptr, ValidateSourceFile validate = VALIDATE, TimeConstraint time_constraint = CURRENT_TIME_ONLY); /** * Read a task event (clone or exec record) from the trace. * Returns a record of type NONE at the end of the trace. */ TraceTaskEvent read_task_event(); /** * Read the next raw data record and return it. */ RawData read_raw_data(); /** * Reads the next raw data record for 'frame' from the current point in * the trace. If there are no more raw data records for 'frame', returns * false. */ bool read_raw_data_for_frame(const TraceFrame& frame, RawData& d); void read_generic(std::vector& out); bool read_generic_for_frame(const TraceFrame& frame, std::vector& out); /** * Return true iff all trace files are "good". * for more details. */ bool good() const; /** * Return true if we're at the end of the trace file. */ bool at_end() const { return reader(EVENTS).at_end(); } /** * Return the next trace frame, without mutating any stream * state. */ TraceFrame peek_frame(); /** * Restore the state of this to what it was just after * |open()|. */ void rewind(); uint64_t uncompressed_bytes() const; uint64_t compressed_bytes() const; /** * Open the trace in 'dir'. When 'dir' is the empty string, open the * latest trace. */ TraceReader(const string& dir); /** * Create a copy of this stream that has exactly the same * state as 'other', but for which mutations of this * clone won't affect the state of 'other' (and vice versa). */ TraceReader(const TraceReader& other); private: CompressedReader& reader(Substream s) { return *readers[s]; } const CompressedReader& reader(Substream s) const { return *readers[s]; } std::unique_ptr readers[SUBSTREAM_COUNT]; }; } // namespace rr #endif /* RR_TRACE_H_ */ rr-4.4.0/src/TraceTaskEvent.h000066400000000000000000000047521277367620400160130ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_TRACE_TASK_EVENT_H_ #define RR_TRACE_TASK_EVENT_H_ #include #include #include #include "Event.h" #include "ExtraRegisters.h" #include "PerfCounters.h" #include "TraceFrame.h" #include "WaitStatus.h" namespace rr { class TraceReader; class TraceWriter; class TraceTaskEvent { public: enum Type { NONE, CLONE, // created by clone(2), fork(2), vfork(2) syscalls EXEC, EXIT }; TraceTaskEvent(Type type = NONE, pid_t tid = 0) : type_(type), tid_(tid) {} static TraceTaskEvent for_clone(pid_t tid, pid_t parent_tid, uint64_t clone_flags) { TraceTaskEvent result(CLONE, tid); result.parent_tid_ = parent_tid; result.clone_flags_ = clone_flags; return result; } static TraceTaskEvent for_exec(pid_t tid, const std::string& file_name, const std::vector cmd_line) { TraceTaskEvent result(EXEC, tid); result.file_name_ = file_name; result.cmd_line_ = cmd_line; return result; } static TraceTaskEvent for_exit(pid_t tid, WaitStatus exit_status) { TraceTaskEvent result(EXIT, tid); result.exit_status_ = exit_status; return result; } Type type() const { return type_; } pid_t tid() const { return tid_; } pid_t parent_tid() const { assert(type() == CLONE); return parent_tid_; } uint64_t clone_flags() const { assert(type() == CLONE); return clone_flags_; } const std::string& file_name() const { assert(type() == EXEC); return file_name_; } const std::vector& cmd_line() const { assert(type() == EXEC); return cmd_line_; } const std::vector& fds_to_close() const { assert(type() == EXEC); return fds_to_close_; } WaitStatus exit_status() const { assert(type() == EXIT); return exit_status_; } void set_fds_to_close(const std::vector fds) { assert(type() == EXEC); fds_to_close_ = fds; } private: friend class TraceReader; friend class TraceWriter; Type type_; pid_t tid_; pid_t parent_tid_; // CLONE only uint64_t clone_flags_; // CLONE only std::string file_name_; // EXEC only std::vector cmd_line_; // EXEC only std::vector fds_to_close_; // EXEC only WaitStatus exit_status_; // EXIT only }; } // namespace rr #endif /* RR_TRACE_TASK_EVENT_H_ */ rr-4.4.0/src/VirtualPerfCounterMonitor.cc000066400000000000000000000070261277367620400204360ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "VirtualPerfCounterMonitor.h" #include #include #include "AutoRemoteSyscalls.h" #include "RecordSession.h" #include "RecordTask.h" #include "log.h" using namespace std; namespace rr { bool VirtualPerfCounterMonitor::should_virtualize( const struct perf_event_attr& attr) { auto ticks_attr = PerfCounters::ticks_attr(); ticks_attr.sample_period = attr.sample_period; return !memcmp(&ticks_attr, &attr, sizeof(attr)); } VirtualPerfCounterMonitor::VirtualPerfCounterMonitor( Task* t, Task* target, const struct perf_event_attr& attr) : initial_ticks(target->tick_count()), target_tuid(target->tuid()), owner_tid(0), flags(0), sig(0), enabled(false) { ASSERT(t, should_virtualize(attr)); // XXX When we support interrupts, we need to add code for signal dispatching ASSERT(t, attr.sample_period == 0xffffffff) << "Don't support interrupts yet"; } bool VirtualPerfCounterMonitor::emulate_ioctl(RecordTask* t, uint64_t* result) { switch ((int)t->regs().arg2()) { case PERF_EVENT_IOC_ENABLE: *result = 0; enabled = true; break; case PERF_EVENT_IOC_DISABLE: *result = 0; enabled = false; break; case PERF_EVENT_IOC_RESET: { *result = 0; RecordTask* target = t->session().find_task(target_tuid); initial_ticks = target->tick_count(); break; } case PERF_EVENT_IOC_PERIOD: *result = 0; // Nominally we'd reset the interrupt here, but since we don't support // that yet, just ignore it. break; default: ASSERT(t, false) << "Unsupported perf event ioctl " << HEX((int)t->regs().arg2()); break; } return true; } bool VirtualPerfCounterMonitor::emulate_fcntl(RecordTask* t, uint64_t* result) { *result = -(int64_t)EINVAL; switch ((int)t->regs().arg2()) { case F_SETOWN_EX: { auto owner = t->read_mem(remote_ptr(t->regs().arg3())); ASSERT(t, owner.type == F_OWNER_TID) << "Unsupported perf event F_SETOWN_EX type " << owner.type; owner_tid = owner.pid; *result = 0; break; } case F_SETFL: ASSERT(t, !(t->regs().arg3() & ~O_ASYNC)) << "Unsupported perf event flags " << HEX((int)t->regs().arg3()); flags = (int)t->regs().arg3(); *result = 0; break; case F_SETSIG: sig = (int)t->regs().arg3(); *result = 0; break; default: ASSERT(t, false) << "Unsupported perf event fnctl " << HEX((int)t->regs().arg2()); break; } return true; } static size_t write_ranges(RecordTask* t, const vector& ranges, void* data, size_t size) { uint8_t* p = static_cast(data); size_t s = size; size_t result = 0; for (auto& r : ranges) { size_t bytes = min(s, r.length); t->write_bytes_helper(r.data, bytes, p); s -= bytes; result += bytes; } return result; } bool VirtualPerfCounterMonitor::emulate_read(RecordTask* t, const vector& ranges, int64_t, uint64_t* result) { RecordTask* target = t->session().find_task(target_tuid); if (target) { int64_t val = target->tick_count() - initial_ticks; *result = write_ranges(t, ranges, &val, sizeof(val)); } else { *result = 0; } return true; } } // namespace rr rr-4.4.0/src/VirtualPerfCounterMonitor.h000066400000000000000000000020241277367620400202710ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_VIRTUAL_PERF_COUNTER_MONITOR_H_ #define RR_VIRTUAL_PERF_COUNTER_MONITOR_H_ #include "FileMonitor.h" #include "TaskishUid.h" struct perf_event_attr; namespace rr { /** * A FileMonitor to */ class VirtualPerfCounterMonitor : public FileMonitor { public: static bool should_virtualize(const struct perf_event_attr& attr); VirtualPerfCounterMonitor(Task* t, Task* target, const struct perf_event_attr& attr); virtual Type type() { return VirtualPerfCounter; } virtual bool emulate_ioctl(RecordTask* t, uint64_t* result); virtual bool emulate_fcntl(RecordTask* t, uint64_t* result); virtual bool emulate_read(RecordTask* t, const std::vector& ranges, int64_t offset, uint64_t* result); private: Ticks initial_ticks; TaskUid target_tuid; pid_t owner_tid; int flags; int sig; bool enabled; }; } // namespace rr #endif /* RR_VIRTUAL_PERF_COUNTER_MONITOR_H_ */ rr-4.4.0/src/WaitStatus.cc000066400000000000000000000067451277367620400154020ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "WaitStatus.h" #include #include #include #include "RecordTask.h" #include "kernel_metadata.h" #include "kernel_supplement.h" #include "log.h" using namespace std; namespace rr { WaitStatus::Type WaitStatus::type() const { if (exit_code() >= 0) { return EXIT; } if (fatal_sig() > 0) { return FATAL_SIGNAL; } if (stop_sig() > 0) { return SIGNAL_STOP; } if (group_stop() > 0) { return GROUP_STOP; } if (is_syscall()) { return SYSCALL_STOP; } if (ptrace_event() > 0) { return PTRACE_EVENT; } FATAL() << "Status " << HEX(status) << " not understood"; return EXIT; } int WaitStatus::exit_code() const { return WIFEXITED(status) ? WEXITSTATUS(status) : -1; } int WaitStatus::fatal_sig() const { return WIFSIGNALED(status) ? WTERMSIG(status) : 0; } int WaitStatus::stop_sig() const { if (!WIFSTOPPED(status) || ((status >> 16) & 0xff)) { return 0; } int sig = WSTOPSIG(status); if (sig == (SIGTRAP | 0x80)) { return 0; } sig &= ~0x80; return sig ? sig : SIGSTOP; } int WaitStatus::group_stop() const { if (!WIFSTOPPED(status) || ((status >> 16) & 0xff) != PTRACE_EVENT_STOP) { return 0; } int sig = WSTOPSIG(status); sig &= ~0x80; return sig ? sig : SIGSTOP; } bool WaitStatus::is_syscall() const { if (!WIFSTOPPED(status) || ptrace_event()) { return 0; } return WSTOPSIG(status) == (SIGTRAP | 0x80); } int WaitStatus::ptrace_event() const { int event = (status >> 16) & 0xff; return event == PTRACE_EVENT_STOP ? 0 : event; } int WaitStatus::ptrace_signal() const { return WIFSTOPPED(status) ? (WSTOPSIG(status) & 0x7f) : 0; } WaitStatus WaitStatus::for_exit_code(int code) { assert(code >= 0 && code < 0x100); return WaitStatus(code << 8); } WaitStatus WaitStatus::for_fatal_sig(int sig) { assert(sig >= 1 && sig < 0x80); return WaitStatus(sig); } WaitStatus WaitStatus::for_stop_sig(int sig) { assert(sig >= 1 && sig < 0x80); return WaitStatus((sig << 8) | 0x7f); } WaitStatus WaitStatus::for_group_sig(int sig, RecordTask* t) { assert(sig >= 1 && sig < 0x80); int code = (sig << 8) | 0x7f; if (t->emulated_ptrace_seized) { code |= PTRACE_EVENT_STOP << 16; } return WaitStatus(code); } WaitStatus WaitStatus::for_syscall(RecordTask* t) { int code = (SIGTRAP << 8) | 0x7f; if (t->emulated_ptrace_options & PTRACE_O_TRACESYSGOOD) { code |= 0x80 << 8; } return WaitStatus(code); } WaitStatus WaitStatus::for_ptrace_event(int ptrace_event) { assert(ptrace_event >= 1 && ptrace_event < 0x100); return WaitStatus((ptrace_event << 16) | (SIGTRAP << 8) | 0x7f); } ostream& operator<<(ostream& stream, WaitStatus status) { stream << HEX(status.get()); switch (status.type()) { case WaitStatus::EXIT: stream << " (EXIT-" << status.exit_code() << ")"; break; case WaitStatus::FATAL_SIGNAL: stream << " (FATAL-" << signal_name(status.fatal_sig()) << ")"; break; case WaitStatus::SIGNAL_STOP: stream << " (STOP-" << signal_name(status.stop_sig()) << ")"; break; case WaitStatus::GROUP_STOP: stream << " (GROUP-STOP-" << signal_name(status.group_stop()) << ")"; break; case WaitStatus::SYSCALL_STOP: stream << " (SYSCALL)"; break; case WaitStatus::PTRACE_EVENT: stream << " (" << ptrace_event_name(status.ptrace_event()) << ")"; break; } return stream; } } // namespace rr rr-4.4.0/src/WaitStatus.h000066400000000000000000000041561277367620400152360ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_WAIT_STATUS_H_ #define RR_WAIT_STATUS_H_ #include #include #include namespace rr { class RecordTask; class WaitStatus { public: explicit WaitStatus(int status = 0) : status(status) {} enum Type { // Task exited normally. EXIT, // Task exited due to fatal signal. FATAL_SIGNAL, // Task is in a signal-delivery-stop. SIGNAL_STOP, // Task is in a group-stop. (See ptrace man page.) // You must use PTRACE_SEIZE to generate PTRACE_EVENT_STOPs, or these // will be treated as STOP_SIGNAL. GROUP_STOP, // Task is in a syscall-stop triggered by PTRACE_SYSCALL // and PTRACE_O_TRACESYSGOOD. SYSCALL_STOP, // Task is in a PTRACE_EVENT stop, except for PTRACE_EVENT_STOP // which is treated as GROUP_STOP. PTRACE_EVENT }; Type type() const; // Exit code if type() == EXIT, otherwise -1. int exit_code() const; // Fatal signal if type() == FATAL_SIGNAL, otherwise zero. int fatal_sig() const; // Stop signal if type() == STOP_SIGNAL, otherwise zero. A zero signal // (rare but observed via PTRACE_INTERRUPT) is converted to SIGSTOP. int stop_sig() const; // Stop signal if type() == GROUP_STOP, otherwise zero. A zero signal // (rare but observed via PTRACE_INTERRUPT) is converted to SIGSTOP. int group_stop() const; bool is_syscall() const; // ptrace event if type() == PTRACE_EVENT, otherwise zero. int ptrace_event() const; // For exit_code() and fatal_sig(), returns 0. For all other types // returns the signal involved. int ptrace_signal() const; int get() const { return status; } static WaitStatus for_exit_code(int code); static WaitStatus for_fatal_sig(int sig); static WaitStatus for_stop_sig(int sig); static WaitStatus for_group_sig(int sig, RecordTask* t); static WaitStatus for_syscall(RecordTask* t); static WaitStatus for_ptrace_event(int ptrace_event); private: int status; }; std::ostream& operator<<(std::ostream& stream, WaitStatus status); } // namespace rr #endif /* RR_WAIT_STATUS_H_ */ rr-4.4.0/src/assembly_templates.py000066400000000000000000000212221277367620400172150ustar00rootroot00000000000000import StringIO import sys class RawBytes(object): """A sequence of literal bytes to appear in an assembly language template.""" def __init__(self, *bytes): self.bytes = bytes def __len__(self): return len(self.bytes) class Field(object): """A variable field of bytes.""" def __init__(self, name, byte_length): self.name = name self.byte_length = byte_length def __len__(self): return self.byte_length def c_type(self): types = { 8: 'uint64_t', 4: 'uint32_t', 2: 'uint16_t', 1: 'uint8_t' } return types[self.byte_length] class AssemblyTemplate(object): """A sequence of RawBytes and Field objects, which can be used to verify that a given sequence of assembly instructions matches the RawBytes while pulling out the Field values for inspection. Or for creating custom assembly stubs, filling out Fields with runtime-determined values.""" def __init__(self, *chunks): # Merge consecutive RawBytes elements together for efficiency of # matching and for simplicity of template expansion. merged_chunks = [] current_raw_bytes = [] for c in chunks: if isinstance(c, Field): # Push any raw bytes before this. if current_raw_bytes: merged_chunks.append(RawBytes(*current_raw_bytes)) current_raw_bytes = [] merged_chunks.append(c) else: current_raw_bytes.extend(c.bytes) # Merge in trailing raw bytes. if current_raw_bytes: merged_chunks.append(RawBytes(*current_raw_bytes)) self.chunks = merged_chunks def fields(self): return [c for c in self.chunks if isinstance(c, Field)] def bytes(self): bytes = [] for c in self.chunks: if isinstance(c, Field): bytes.extend([0] * len(c)) else: bytes.extend(c.bytes) return bytes templates = { 'X86SysenterVsyscallImplementation': AssemblyTemplate( RawBytes(0x51), # push %ecx RawBytes(0x52), # push %edx RawBytes(0x55), # push %ebp RawBytes(0x89, 0xe5), # mov %esp,%ebp RawBytes(0x0f, 0x34), # sysenter ), 'X86SysenterVsyscallUseInt80': AssemblyTemplate( RawBytes(0xcd, 0x80), # int $0x80 RawBytes(0xc3), # ret ), 'X86SysenterVsyscallSyscallHook': AssemblyTemplate( RawBytes(0xe9), # jmp $syscall_hook_trampoline Field('syscall_hook_trampoline', 4), ), 'X86VsyscallMonkeypatch': AssemblyTemplate( RawBytes(0x53), # push %ebx RawBytes(0xb8), # mov $syscall_number,%eax Field('syscall_number', 4), # __vdso functions use the C calling convention, so # we have to set up the syscall parameters here. # No x86-32 __vdso functions take more than two parameters. RawBytes(0x8b, 0x5c, 0x24, 0x08), # mov 0x8(%esp),%ebx RawBytes(0x8b, 0x4c, 0x24, 0x0c), # mov 0xc(%esp),%ecx RawBytes(0xcd, 0x80), # int $0x80 # pad with NOPs to make room to dynamically patch the syscall # with a call to the preload library, once syscall buffering # has been initialized. RawBytes(0x90), # nop RawBytes(0x90), # nop RawBytes(0x90), # nop RawBytes(0x5b), # pop %ebx RawBytes(0xc3), # ret ), 'X86SyscallStubExtendedJump': AssemblyTemplate( # This code must match the stubs in syscall_hook.S. # We must adjust the stack pointer without modifying flags, # at least on the return path. RawBytes(0x81, 0xec, 0x00, 0x01, 0x00, 0x00), # sub $256,%esp RawBytes(0xc7, 0x04, 0x24), # movl $fake_return_addr,(%esp) Field('fake_return_addr', 4), RawBytes(0x89, 0x64, 0x24, 0x04), # mov %esp,4(%esp) RawBytes(0x81, 0x44, 0x24, 0x04, 0x00, 0x01, 0x00, 0x00), # addl $256,4(%esp) RawBytes(0xe9), # jmp $trampoline_relative_addr Field('trampoline_relative_addr', 4) ), 'X64JumpMonkeypatch': AssemblyTemplate( RawBytes(0xe9), # jmp $relative_addr Field('relative_addr', 4), ), 'X64VsyscallMonkeypatch': AssemblyTemplate( RawBytes(0xb8), # mov $syscall_number,%eax Field('syscall_number', 4), RawBytes(0x0f, 0x05), # syscall # pad with NOPs to make room to dynamically patch the syscall # with a call to the preload library, once syscall buffering # has been initialized. RawBytes(0x90), # nop RawBytes(0x90), # nop RawBytes(0x90), # nop RawBytes(0xc3), # ret ), 'X64SyscallStubExtendedJump': AssemblyTemplate( # This code must match the stubs in syscall_hook.S. RawBytes(0x48, 0x81, 0xec, 0x00, 0x01, 0x00, 0x00), # sub $256,%rsp RawBytes(0xc7, 0x04, 0x24), # movl $return_addr_lo,(%rsp) Field('return_addr_lo', 4), RawBytes(0xc7, 0x44, 0x24, 0x04), # movl $return_addr_hi,4(%rsp) Field('return_addr_hi', 4), RawBytes(0x48, 0x89, 0x64, 0x24, 0x08), # mov %rsp,8(%rsp) RawBytes(0x48, 0x81, 0x44, 0x24, 0x08, 0x00, 0x01, 0x00, 0x00), # addq $256,8(%rsp) RawBytes(0xff, 0x25, 0x00, 0x00, 0x00, 0x00), # jmp *0(%rip) Field('jump_target', 8), ), } def byte_array_name(name): return '%s_bytes' % name def generate_match_method(byte_array, template): s = StringIO.StringIO() fields = template.fields() field_types = [f.c_type() for f in fields] field_names = [f.name for f in fields] args = ', ' + ', '.join("%s* %s" % (t, n) for t, n in zip(field_types, field_names)) \ if fields else '' s.write(' static bool match(const uint8_t* buffer %s) {\n' % (args,)) offset = 0 for chunk in template.chunks: if isinstance(chunk, Field): field_name = chunk.name s.write(' memcpy(%s, &buffer[%d], sizeof(*%s));\n' % (field_name, offset, field_name)) else: s.write(' if (memcmp(&buffer[%d], &%s[%d], %d) != 0) { return false; }\n' % (offset, byte_array, offset, len(chunk))) offset += len(chunk) s.write(' return true;\n') s.write(' }') return s.getvalue() def generate_substitute_method(byte_array, template): s = StringIO.StringIO() fields = template.fields() field_types = [f.c_type() for f in fields] field_names = [f.name for f in fields] args = ', ' + ', '.join("%s %s" % (t, n) for t, n in zip(field_types, field_names)) \ if fields else '' s.write(' static void substitute(uint8_t* buffer %s) {\n' % (args,)) offset = 0 for chunk in template.chunks: if isinstance(chunk, Field): field_name = chunk.name s.write(' memcpy(&buffer[%d], &%s, sizeof(%s));\n' % (offset, field_name, field_name)) else: s.write(' memcpy(&buffer[%d], &%s[%d], %d);\n' % (offset, byte_array, offset, len(chunk))) offset += len(chunk) s.write(' }') return s.getvalue() def generate_field_end_methods(byte_array, template): s = StringIO.StringIO() offset = 0 for chunk in template.chunks: offset += len(chunk) if isinstance(chunk, Field): s.write(' static const size_t %s_end = %d;\n' % (chunk.name, offset)) return s.getvalue() def generate_size_member(byte_array): s = StringIO.StringIO() s.write(' static const size_t size = sizeof(%s);' % byte_array) return s.getvalue() def generate(f): # Raw bytes. for name, template in templates.iteritems(): bytes = template.bytes() f.write('static const uint8_t %s[] = { %s };\n' % (byte_array_name(name), ', '.join(['0x%x' % b for b in bytes]))) f.write('\n') # Objects representing assembly templates. for name, template in templates.iteritems(): byte_array = byte_array_name(name) f.write("""class %(class_name)s { public: %(match_method)s %(substitute_method)s %(field_end_methods)s %(size_member)s }; """ % { 'class_name': name, 'match_method': generate_match_method(byte_array, template), 'substitute_method': generate_substitute_method(byte_array, template), 'field_end_methods': generate_field_end_methods(byte_array, template), 'size_member': generate_size_member(byte_array), }) f.write('\n\n') rr-4.4.0/src/chaos-test/000077500000000000000000000000001277367620400150215ustar00rootroot00000000000000rr-4.4.0/src/chaos-test/chaos-test.sh000077500000000000000000000014401277367620400174310ustar00rootroot00000000000000#!/bin/sh # Chaos tests take a long time to run, and by their very nature they're # nondeterministic and may fail intermittently, so they aren't part of 'make # check'. For realistic results, run the tests on a machine that's otherwise # idle. # # Usage: chaos-test.sh cd `dirname $0` python harness.py $1 40 40 core_count 3 echo python harness.py $1 500 500 mmap_bits 7 echo python harness.py $1 500 500 mmap_adjacent 10 echo python harness.py $1 100 200 starvation_singlethreaded 200000 202000 2000 1000000 echo python harness.py $1 100 200 starvation_singlethreaded 2000000 2400000 500000 5000000 echo python harness.py $1 400 800 starvation_multithreaded 200000 202000 2000 1000000 echo python harness.py $1 400 1600 starvation_multithreaded 2000000 2400000 500000 5000000 rr-4.4.0/src/chaos-test/chaosutil.h000066400000000000000000000034641277367620400171740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_CHAOSUTIL_H #define RR_CHAOSUTIL_H #define _GNU_SOURCE 1 #define _POSIX_C_SOURCE 2 #include #include #include #include #include #include #include #include #include #include #include #include /** * Print the printf-like arguments to stdout as atomic-ly as we can * manage. Async-signal-safe. Does not flush stdio buffers (doing so * isn't signal safe). */ __attribute__((format(printf, 1, 2))) inline static int atomic_printf( const char* fmt, ...) { va_list args; char buf[1024]; int len; va_start(args, fmt); len = vsnprintf(buf, sizeof(buf) - 1, fmt, args); va_end(args); return write(STDOUT_FILENO, buf, len); } inline static int check_cond(int cond) { if (!cond) { atomic_printf("FAILED: errno=%d (%s)\n", errno, strerror(errno)); } return cond; } /** * Write |str| on its own line to stdout as atomic-ly as we can * manage. Async-signal-safe. Does not flush stdio buffers (doing so * isn't signal safe). */ inline static int atomic_puts(const char* str) { return atomic_printf("%s\n", str); } #define test_assert(cond) assert("FAILED: !" && check_cond(cond)) __attribute__((format(printf, 1, 2))) inline static void caught_test_failure( const char* fmt, ...) { va_list args; char buf[1024]; int len; atomic_printf("EXIT-FAIL: "); va_start(args, fmt); len = vsnprintf(buf, sizeof(buf) - 2, fmt, args); va_end(args); buf[len] = '\n'; write(STDOUT_FILENO, buf, len + 1); exit(77); } inline static double now_double(void) { struct timespec ts; clock_gettime(CLOCK_MONOTONIC, &ts); return ts.tv_sec + ts.tv_nsec / 1000000000.0; } #endif rr-4.4.0/src/chaos-test/core_count.c000066400000000000000000000007371277367620400173340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "chaosutil.h" /* Given command-line parameter , test fails if sysconf() reports 'c' cores. */ int main(__attribute__((unused)) int argc, char** argv) { int cores = atoi(argv[1]); if (sysconf(_SC_NPROCESSORS_ONLN) == cores && sysconf(_SC_NPROCESSORS_CONF) == cores) { caught_test_failure("got core count: %d", cores); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/chaos-test/harness.py000066400000000000000000000052241277367620400170410ustar00rootroot00000000000000import sys import multiprocessing import tempfile import subprocess import copy import shutil import os import itertools objdir = sys.argv[1] sanity_runs = eval(sys.argv[2]) runs = eval(sys.argv[3]) name = sys.argv[4] params = sys.argv[5:] GOOD_FAIL = 77 # Runs test, returns True if the test passed, False if it # expectedly fails. Exits with code 1 if test unexpectedly failed. def run(rr_params): d = tempfile.mkdtemp(prefix='rr-chaos-') try: env = copy.copy(os.environ) env['_RR_TRACE_DIR'] = d with open(d + "/out", 'w') as out: p = subprocess.Popen(["%s/bin/rr"%objdir, "record"] + rr_params + ["%s/bin/%s"%(objdir, name)] + params, env=env, stdout=out, stderr=out) ret = p.wait() if ret != 0 and ret != GOOD_FAIL: print "Test %s failed unexpectedly; leaving behind trace in %s"%(name, d) out_array = [] with open(d + "/out", 'r') as out: for line in out: out_array.append(line) return [ret, out_array] finally: shutil.rmtree(d) # Use only half the cores. Otherwise tests will induce starvation # themselves; we want to measure starvation induced by rr. pool = multiprocessing.Pool(max(1, multiprocessing.cpu_count()/2)) def safe_exit(code): pool.terminate() pool.join() sys.exit(code) print "Running %d iterations of %s/bin/%s %s without chaos mode"%(sanity_runs, objdir, name, ' '.join(params)) sanity_failed = 0 for r in pool.imap_unordered(run, itertools.repeat([], sanity_runs)): if r[0] == 0: continue if r[0] != GOOD_FAIL: safe_exit(r[0]) break sanity_failed = sanity_failed + 1 if sanity_failed == sanity_runs: print "PROBLEM: %d runs of %s all failed; not a good chaos mode test"%(sanity_failed, name) safe_exit(2) print "Without chaos mode, %d runs of %s failed out of %d"%(sanity_failed, name, sanity_runs) print "Running %d iterations of %s/bin/%s %s in chaos mode"%(runs, objdir, name, ' '.join(params)) failed = 0 for r in pool.imap_unordered(run, itertools.repeat(["--chaos"], runs)): if r[0] == 0: continue if r[0] != GOOD_FAIL: safe_exit(r[0]) break if failed == 0: print "First test failure detected, output:" for line in r[1]: print line, failed = failed + 1 if failed == 0: print "PROBLEM: With chaos mode, test %s did not fail in %d runs"%(name, runs) safe_exit(1) print "With chaos mode, %d runs of %s failed out of %d"%(failed, name, runs) if float(failed)/runs < 3*float(sanity_failed)/sanity_runs: print "PROBLEM: Chaos mode didn't really help!" safe_exit(3) safe_exit(0) rr-4.4.0/src/chaos-test/mmap_adjacent.c000066400000000000000000000016131277367620400177510ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "chaosutil.h" /* Given command-line parameter , mmaps n pages independently. The test only fails if the first page is after the last page. */ int main(__attribute__((unused)) int argc, char** argv) { int page_count = atoi(argv[1]); char* p1 = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); char* p2; int i; for (i = 0; i < page_count - 2; ++i) { char* p = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); } p2 = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); if (p2 + PAGE_SIZE == p1) { caught_test_failure("maps are adjacent: %p %p", p2, p1); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/chaos-test/mmap_bits.c000066400000000000000000000016371277367620400171470ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "chaosutil.h" /* Given command-line parameter , mmaps two pages independently; test only fails if bits 16...16+b-1 of the two addresses match. Probability of failure is therefore 2^(-b). */ int main(__attribute__((unused)) int argc, char** argv) { int bits_match = atoi(argv[1]); char* p1 = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); char* p2 = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); intptr_t delta = p2 - p1; intptr_t mask = ((1 << bits_match) - 1) << 12; test_assert(PAGE_SIZE == (1 << 12)); test_assert(p1 != MAP_FAILED); test_assert(p2 != MAP_FAILED); if (!(delta & mask)) { caught_test_failure("map bits match: %p %p", p1, p2); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/chaos-test/starvation_multithreaded.c000066400000000000000000000035471277367620400223030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "chaosutil.h" static double samples[10000000]; static size_t sample_count = 0; /* Given command-line parameters , , and : Spin the CPU on one thread until L microseconds have elapsed, while other threads frequently sleep. The test fails if, at some point starting between S and T microseconds, the spinning thread fails to be scheduled for D microseconds. */ static double start, S, T, D, L; static void* spinning_thread(__attribute__((unused)) void* p) { int k = 0; double last = 0; while (1) { int i; double t; for (i = 0; i < 10000; ++i) { k += i * i; } t = now_double(); samples[sample_count++] = t; if (sample_count >= sizeof(samples) / sizeof(samples[0])) { atomic_puts("OVERFLOW"); exit(1); } if (t > L) { break; } if (last >= S && last < T && t >= last + D) { caught_test_failure("time wasn't checked between %f and %f", last - start, t - start); } last = t; } return (void*)(intptr_t)k; } static void* aux_thread(__attribute__((unused)) void* p) { /* Repeatedly sleep for a millisecond */ struct timespec ts = { 0, 1000000 }; while (1) { nanosleep(&ts, NULL); } return NULL; } int main(__attribute__((unused)) int argc, char** argv) { int i; pthread_t thread; start = now_double(); S = atoi(argv[1]) / 1000000.0 + start; T = atoi(argv[2]) / 1000000.0 + start; D = atoi(argv[3]) / 1000000.0; L = atoi(argv[4]) / 1000000.0 + start; atomic_printf("Critical range is %f to %f\n", S, T); pthread_create(&thread, NULL, spinning_thread, NULL); for (i = 0; i < 4; ++i) { pthread_t t; pthread_create(&t, NULL, aux_thread, NULL); } pthread_join(thread, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/chaos-test/starvation_singlethreaded.c000066400000000000000000000025241277367620400224240ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "chaosutil.h" static double samples[10000000]; static size_t sample_count = 0; /* Given command-line parameters , , and : Spins the CPU on a single thread until L microseconds have elapsed. The test fails if, at some point starting between S and T microseconds, we fail to be scheduled for D microseconds */ int main(__attribute__((unused)) int argc, char** argv) { double start = now_double(); double S = atoi(argv[1]) / 1000000.0 + start; double T = atoi(argv[2]) / 1000000.0 + start; double D = atoi(argv[3]) / 1000000.0; double L = atoi(argv[4]) / 1000000.0 + start; int k = 0; double last = 0; atomic_printf("Critical range is %f to %f\n", S, T); while (1) { int i; double t; for (i = 0; i < 10000; ++i) { k += i * i; } t = now_double(); samples[sample_count++] = t; if (sample_count >= sizeof(samples) / sizeof(samples[0])) { atomic_puts("OVERFLOW"); exit(1); } if (t > L) { break; } if (last >= S && last < T && t >= last + D) { caught_test_failure("time wasn't checked between %f and %f", last - start, t - start); } last = t; } atomic_printf("dummy = %d\n", k); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/drm.h000066400000000000000000000105131277367620400137020ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_DRM_H #define RR_DRM_H 1 #include #include #include // TODO this should all move to kernel_abi.h #ifdef __cplusplus extern "C" { #endif /** * The *drm.h headers don't play well when included by external code. * They don't compile without hacks when included by either C or C++ * code, and additionally have version-specific quirks. So we get * ourselves off that treadmill by creating a clean "shadow header". * * TODO: add checks that these shadow definitions are consistent with * the system headers'. */ /*---------------------------------------------------------------------------*/ typedef unsigned int drm_magic_t; struct drm_version { int version_major; int version_minor; int version_patchlevel; size_t name_len; char* name; size_t date_len; char* date; size_t desc_len; char* desc; }; struct drm_auth { drm_magic_t magic; }; struct drm_gem_open { __u32 name; __u32 handle; __u64 size; }; #define DRM_IOCTL_BASE 'd' #define DRM_IO(nr) _IO(DRM_IOCTL_BASE, nr) #define DRM_IOR(nr, type) _IOR(DRM_IOCTL_BASE, nr, type) #define DRM_IOW(nr, type) _IOW(DRM_IOCTL_BASE, nr, type) #define DRM_IOWR(nr, type) _IOWR(DRM_IOCTL_BASE, nr, type) #define DRM_COMMAND_BASE 0x40 #define DRM_IOCTL_VERSION DRM_IOWR(0x00, struct drm_version) #define DRM_IOCTL_GET_MAGIC DRM_IOR(0x02, struct drm_auth) #define DRM_IOCTL_GEM_OPEN DRM_IOWR(0x0b, struct drm_gem_open) /*---------------------------------------------------------------------------*/ struct drm_i915_gem_pwrite { __u32 handle; __u32 pad; __u64 offset; __u64 size; __u64 data_ptr; }; struct drm_i915_gem_mmap { __u32 handle; __u32 pad; __u64 offset; __u64 size; __u64 addr_ptr; }; #define DRM_I915_GEM_PWRITE 0x1d #define DRM_I915_GEM_MMAP 0x1e #define DRM_IOCTL_I915_GEM_PWRITE \ DRM_IOW(DRM_COMMAND_BASE + DRM_I915_GEM_PWRITE, struct drm_i915_gem_pwrite) #define DRM_IOCTL_I915_GEM_MMAP \ DRM_IOWR(DRM_COMMAND_BASE + DRM_I915_GEM_MMAP, struct drm_i915_gem_mmap) /*---------------------------------------------------------------------------*/ struct drm_nouveau_gem_info { uint32_t handle; uint32_t domain; uint64_t size; uint64_t offset; uint64_t map_handle; uint32_t tile_mode; uint32_t tile_flags; }; struct drm_nouveau_gem_new { struct drm_nouveau_gem_info info; uint32_t channel_hint; uint32_t align; }; struct drm_nouveau_gem_pushbuf { uint32_t channel; uint32_t nr_buffers; uint64_t buffers; uint32_t nr_relocs; uint32_t nr_push; uint64_t relocs; uint64_t push; uint32_t suffix0; uint32_t suffix1; uint64_t vram_available; uint64_t gart_available; }; #define DRM_NOUVEAU_GEM_NEW 0x40 #define DRM_NOUVEAU_GEM_PUSHBUF 0x41 #define DRM_IOCTL_NOUVEAU_GEM_NEW \ DRM_IOWR(DRM_COMMAND_BASE + DRM_NOUVEAU_GEM_NEW, struct drm_nouveau_gem_new) #define DRM_IOCTL_NOUVEAU_GEM_PUSHBUF \ DRM_IOWR(DRM_COMMAND_BASE + DRM_NOUVEAU_GEM_PUSHBUF, \ struct drm_nouveau_gem_pushbuf) /*---------------------------------------------------------------------------*/ struct drm_radeon_info { uint32_t request; uint32_t pad; uint64_t value; }; struct drm_radeon_gem_create { uint64_t size; uint64_t alignment; uint32_t handle; uint32_t initial_domain; uint32_t flags; }; struct drm_radeon_gem_get_tiling { uint32_t handle; uint32_t tiling_flags; uint32_t pitch; }; #define DRM_RADEON_INFO 0x27 #define DRM_RADEON_GEM_CREATE 0x1d #define DRM_RADEON_GEM_GET_TILING 0x29 #define DRM_IOCTL_RADEON_INFO \ DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_INFO, struct drm_radeon_info) #define DRM_IOCTL_RADEON_GEM_CREATE \ DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_CREATE, \ struct drm_radeon_gem_create) #define DRM_IOCTL_RADEON_GEM_GET_TILING \ DRM_IOWR(DRM_COMMAND_BASE + DRM_RADEON_GEM_GET_TILING, \ struct drm_radeon_gem_get_tiling) #ifdef __cplusplus } /* extern "C" */ #endif #endif /* RR_DRM_H */ rr-4.4.0/src/exec_stub.c000066400000000000000000000001451277367620400150740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ void _start(void) {} rr-4.4.0/src/fast_forward.cc000066400000000000000000000375561277367620400157570ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "fast_forward.h" #include "log.h" using namespace std; namespace rr { struct InstructionBuf { SupportedArch arch; uint8_t code_buf[32]; int code_buf_len; }; static InstructionBuf read_instruction(Task* t, remote_code_ptr ip) { InstructionBuf result; result.arch = t->arch(); result.code_buf_len = (int)t->read_bytes_fallible( ip.to_data_ptr(), sizeof(result.code_buf), result.code_buf); return result; } struct DecodedInstruction { int operand_size; int length; bool modifies_flags; bool uses_si; }; /** * This can be conservative: for weird prefix combinations that make valid * string instructions, but aren't ever used in practice, we can return false. */ static bool decode_x86_string_instruction(const InstructionBuf& code, DecodedInstruction* decoded) { bool found_operand_prefix = false; bool found_REP_prefix = false; bool found_REXW_prefix = false; decoded->modifies_flags = false; decoded->uses_si = false; int i; bool done = false; for (i = 0; i < code.code_buf_len; ++i) { switch (code.code_buf[i]) { case 0x66: found_operand_prefix = true; break; case 0x48: if (code.arch == x86_64) { found_REXW_prefix = true; break; } return false; case 0xF2: case 0xF3: found_REP_prefix = true; break; case 0xA4: // MOVSB case 0xA5: // MOVSW decoded->uses_si = true; done = true; break; case 0xAA: // STOSB case 0xAB: // STOSW case 0xAC: // LODSB case 0xAD: // LODSW done = true; break; case 0xA6: // CMPSB case 0xA7: // CMPSW decoded->modifies_flags = true; decoded->uses_si = true; done = true; break; case 0xAE: // SCASB case 0xAF: // SCASW decoded->modifies_flags = true; done = true; break; default: return false; } if (done) { break; } } if (!found_REP_prefix) { return false; } decoded->length = i + 1; if (code.code_buf[i] & 1) { decoded->operand_size = found_REXW_prefix ? 8 : (found_operand_prefix ? 2 : 4); } else { decoded->operand_size = 1; } return true; } static bool mem_intersect(remote_ptr a1, int s1, remote_ptr a2, int s2) { assert(a1 + s1 > a1); assert(a2 + s2 > a2); return max(a1, a2) < min(a1 + s1, a2 + s2); } static void bound_iterations_for_watchpoint(Task* t, remote_ptr reg, const DecodedInstruction& decoded, const WatchConfig& watch, uintptr_t* iterations) { // Compute how many iterations it will take before we hit the watchpoint. // 0 means the first iteration will hit the watchpoint. int size = decoded.operand_size; int direction = t->regs().df_flag() ? -1 : 1; if (mem_intersect(reg, size, watch.addr, watch.num_bytes)) { *iterations = 0; return; } // Number of iterations we can perform without triggering the watchpoint uintptr_t steps; if (direction > 0) { if (watch.addr < reg) { // We're assuming wraparound can't happpen! return; } // We'll hit the first byte of the watchpoint moving forward. steps = (watch.addr - reg) / size; } else { if (watch.addr > reg) { // We're assuming wraparound can't happpen! return; } // We'll hit the last byte of the watchpoint moving backward. steps = (reg - (watch.addr + watch.num_bytes)) / size + 1; } *iterations = min(*iterations, steps); } static bool is_x86ish(Task* t) { return t->arch() == x86 || t->arch() == x86_64; } bool fast_forward_through_instruction(Task* t, ResumeRequest how, const vector& states) { assert(how == RESUME_SINGLESTEP || how == RESUME_SYSEMU_SINGLESTEP); remote_code_ptr ip = t->ip(); t->resume_execution(how, RESUME_WAIT, RESUME_UNLIMITED_TICKS); if (t->stop_sig() != SIGTRAP) { // we might have stepped into a system call... return false; } if (t->ip() != ip) { return false; } if (t->vm()->get_breakpoint_type_at_addr(ip) != BKPT_NONE) { // breakpoint must have fired return false; } if (t->vm()->notify_watchpoint_fired(t->debug_status())) { // watchpoint fired return false; } for (auto& state : states) { if (state->matches(t->regs())) { return false; } } if (!is_x86ish(t)) { return false; } InstructionBuf instruction_buf = read_instruction(t, ip); DecodedInstruction decoded; if (!decode_x86_string_instruction(instruction_buf, &decoded)) { return false; } remote_code_ptr limit_ip = ip + decoded.length; // At this point we can be sure the instruction didn't trigger a syscall, // so we no longer care about the value of |how|. Registers extra_state_to_avoid; vector states_copy; auto using_states = &states; bool did_execute = false; while (true) { // This string instruction should execute until CX reaches 0 and // we move to the next instruction, or we hit one of the states in // |states|, or the ZF flag changes so that the REP stops, or we hit // a watchpoint. (We can't hit a breakpoint during the loop since we // already verified there isn't one set here.) // We'll compute an upper bound on the number of string instruction // iterations to execute, and set a watchpoint on the memory location // accessed through DI in the iteration we want to stop at. We'll also // set a breakpoint after the string instruction to catch cases where it // ends due to a ZF change. // Keep in mind that it's possible that states in |states| might // belong to multiple independent loops of this string instruction, with // registers reset in between the loops. uintptr_t cur_cx = t->regs().cx(); if (cur_cx == 0) { // Fake singlestep status for trap diagnosis t->set_debug_status(DS_SINGLESTEP); // This instruction will be skipped entirely. return did_execute; } // Don't execute the last iteration of the string instruction. That // simplifies code below that tries to emulate the register effects // of singlestepping to predict if the next singlestep would result in a // mark_vector state. uintptr_t iterations = cur_cx - 1; // Bound |iterations| to ensure we stop before reaching any |states|. for (auto& state : *using_states) { if (state->ip() == ip) { uintptr_t dest_cx = state->cx(); if (dest_cx == 0) { // This state represents entering the string instruction with CX==0, // so we can't reach this state in the current loop. continue; } if (dest_cx >= cur_cx) { // This can't be reached in the current loop. continue; } iterations = min(iterations, cur_cx - dest_cx - 1); } else if (state->ip() == limit_ip) { uintptr_t dest_cx = state->cx(); if (dest_cx >= cur_cx) { // This can't be reached in the current loop. continue; } iterations = min(iterations, cur_cx - dest_cx - 1); } } // To stop before the ZF changes and we exit the loop, we don't bound // the iterations here. Instead we run the loop, observe the ZF change, // and then rerun the loop with the loop-exit state added to the |states| // list. See below. // A code watchpoint would already be hit if we're going to hit it. // Check for data watchpoints that we might hit when reading/writing // memory. // Make conservative assumptions about the watchpoint type. Applying // unnecessary watchpoints here will only result in a few more singlesteps. // We do have to ignore SI if the instruction doesn't use it; otherwise // a watchpoint which happens to match SI will appear to be hit on every // iteration of the string instruction, which would be devastating. for (auto& watch : t->vm()->all_watchpoints()) { if (decoded.uses_si) { bound_iterations_for_watchpoint(t, t->regs().si(), decoded, watch, &iterations); } bound_iterations_for_watchpoint(t, t->regs().di(), decoded, watch, &iterations); } if (iterations == 0) { // Fake singlestep status for trap diagnosis t->set_debug_status(DS_SINGLESTEP); return did_execute; } LOG(debug) << "x86-string fast-forward: " << iterations << " iterations required (ip==" << t->ip() << ")"; Registers r = t->regs(); int direction = t->regs().df_flag() ? -1 : 1; // Figure out the address to set a watchpoint at. This address must // be accessed at or before the last iteration we want to perform. // We have to account for a CPU quirk: Intel CPUs may coalesce iterations // to write up to 64 bytes at a time (observed for "rep stosb" on Ivy // Bridge). Assume 128 bytes to be safe. static const unsigned BYTES_COALESCED = 128; uintptr_t watch_offset = decoded.operand_size * (iterations - 1); if (watch_offset > BYTES_COALESCED) { watch_offset -= BYTES_COALESCED; t->vm()->save_watchpoints(); t->vm()->remove_all_watchpoints(); remote_ptr watch_di = t->regs().di() + direction * watch_offset; LOG(debug) << "Set x86-string fast-forward watchpoint at " << watch_di; bool ok = t->vm()->add_watchpoint(watch_di, 1, WATCH_READWRITE); ASSERT(t, ok) << "Can't even handle one watchpoint???"; ok = t->vm()->add_breakpoint(limit_ip, BKPT_INTERNAL); ASSERT(t, ok) << "Failed to add breakpoint"; t->resume_execution(RESUME_CONT, RESUME_WAIT, RESUME_UNLIMITED_TICKS); did_execute = true; ASSERT(t, t->stop_sig() == SIGTRAP); // Grab debug_status before restoring watchpoints, since the latter // clears the debug status bool triggered_watchpoint = t->vm()->notify_watchpoint_fired(t->debug_status()); t->vm()->remove_breakpoint(limit_ip, BKPT_INTERNAL); t->vm()->restore_watchpoints(); ASSERT(t, cur_cx > t->regs().cx()); uintptr_t iterations_performed = cur_cx - t->regs().cx(); // we shoudn't execute more iterations than we asked for. // In Ubuntu-14 4.2.0-27-generic in a KVM guest we have seen watchpoints // failing to fire during string_instructions_replay. We plow through // and hit the backup breakpoint. triggered_watchpoint is true because // the memory has changed. This assertion should catch such errors. ASSERT(t, iterations >= iterations_performed); iterations -= iterations_performed; // instructions that don't modify flags should not terminate too early ASSERT(t, decoded.modifies_flags || iterations <= BYTES_COALESCED); if (!triggered_watchpoint) { // watchpoint didn't fire. We must have exited the loop early and // hit the breakpoint. IP will be after the breakpoint instruction. ASSERT(t, t->ip() == limit_ip.increment_by_bkpt_insn_length(t->arch()) && decoded.modifies_flags); // Undo the execution of the breakpoint instruction. Registers tmp = t->regs(); tmp.set_ip(limit_ip); t->set_regs(tmp); } else { ASSERT(t, t->ip() == limit_ip || t->ip() == ip); watch_offset = decoded.operand_size * (iterations - 1); if (watch_offset > BYTES_COALESCED) { // Fake singlestep status for trap diagnosis t->set_debug_status(DS_SINGLESTEP); // We fired the watchpoint too early, perhaps because reads through SI // triggered it. Let's just bail out now; better for the caller to // retry // fast_forward_through_instruction than for us to try singlestepping // all the rest of the way. LOG(debug) << "x86-string fast-forward: " << iterations << " iterations to go, but watchpoint hit early; aborted"; return did_execute; } } } LOG(debug) << "x86-string fast-forward: " << iterations << " iterations to go"; // Singlestep through the remaining iterations. while (iterations > 0 && t->ip() == ip) { t->resume_execution(RESUME_SINGLESTEP, RESUME_WAIT, RESUME_UNLIMITED_TICKS); did_execute = true; ASSERT(t, t->stop_sig() == SIGTRAP); // Watchpoints can fire spuriously because configure_watch_registers // can increase the size of the watched area to conserve watch registers. --iterations; } if (t->ip() != ip) { // We exited the loop early due to flags being modified. ASSERT(t, t->ip() == limit_ip && decoded.modifies_flags); // String instructions that modify flags don't have non-register side // effects, so we can reset registers to effectively unwind the loop. // Then we try rerunning the loop again, adding this state as one to // avoid stepping into. We shouldn't need to do this more than once! ASSERT(t, states_copy.empty()); extra_state_to_avoid = t->regs(); states_copy = states; states_copy.push_back(&extra_state_to_avoid); using_states = &states_copy; t->set_regs(r); } else { LOG(debug) << "x86-string fast-forward done; ip()==" << t->ip(); // Fake singlestep status for trap diagnosis t->set_debug_status(DS_SINGLESTEP); return did_execute; } } } static bool is_ignorable_prefix(Task* t, uint8_t byte) { if (byte >= 0x40 && byte <= 0x4f) { // REX prefix return t->arch() == x86_64; } switch (byte) { case 0x26: // ES override case 0x2E: // CS override case 0x36: // SS override case 0x3E: // DS override case 0x64: // FS override case 0x65: // GS override case 0x66: // operand-size override case 0x67: // address-size override case 0xF0: // LOCK return true; default: return false; } } static bool is_rep_prefix(uint8_t byte) { return byte == 0xF2 || byte == 0xF3; } static bool is_string_instruction(uint8_t byte) { switch (byte) { case 0xA4: // MOVSB case 0xA5: // MOVSW case 0xA6: // CMPSB case 0xA7: // CMPSW case 0xAA: // STOSB case 0xAB: // STOSW case 0xAC: // LODSB case 0xAD: // LODSW case 0xAE: // SCASB case 0xAF: // SCASW return true; default: return false; } } static int fallible_read_byte(Task* t, remote_ptr ip) { uint8_t byte; if (t->read_bytes_fallible(ip, 1, &byte) == 0) { return -1; } return byte; } static bool is_string_instruction_at(Task* t, remote_code_ptr ip) { bool found_rep = false; remote_ptr bare_ip = ip.to_data_ptr(); while (true) { int byte = fallible_read_byte(t, bare_ip); if (byte < 0) { return false; } else if (is_rep_prefix(byte)) { found_rep = true; } else if (is_string_instruction(byte)) { return found_rep; } else if (!is_ignorable_prefix(t, byte)) { return false; } ++bare_ip; } } static bool is_string_instruction_before(Task* t, remote_code_ptr ip) { remote_ptr bare_ip = ip.to_data_ptr(); --bare_ip; int byte = fallible_read_byte(t, bare_ip); if (byte < 0 || !is_string_instruction(byte)) { return false; } while (true) { --bare_ip; int byte = fallible_read_byte(t, bare_ip); if (byte < 0) { return false; } else if (is_rep_prefix(byte)) { return true; } else if (!is_ignorable_prefix(t, byte)) { return false; } } } bool maybe_at_or_after_x86_string_instruction(Task* t) { if (!is_x86ish(t)) { return false; } return is_string_instruction_at(t, t->ip()) || is_string_instruction_before(t, t->ip()); } } // namespace rr rr-4.4.0/src/fast_forward.h000066400000000000000000000030701277367620400156010ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_FAST_FORWARD_H_ #define RR_FAST_FORWARD_H_ #include #include "Task.h" namespace rr { class Registers; /** * Perform one or more synchronous singlesteps of |t|. Usually just does * one singlestep, except when a singlestep leaves the IP unchanged (i.e. a * single instruction represents a loop, such as an x86 REP-prefixed string * instruction). * * |how| must be either RESUME_SINGLESTEP or RESUME_SYSEMU_SINGLESTEP. * * We always perform at least one singlestep. We stop after a singlestep if * one of the following is true, or will be true after one more singlestep: * -- Any breakpoint or watchpoint has been triggered * -- IP has advanced to the next instruction * -- One of the register states in |states| (a null-terminated list) * has been reached. * * Spurious returns after any singlestep are also allowed. * * This will not add more than one tick to t->tick_count(). * * Returns true if we did a fast-forward, false if we just did one regular * singlestep. */ bool fast_forward_through_instruction( Task* t, ResumeRequest how, const std::vector& states); /** * Return true if the instruction at t->ip(), or the instruction immediately * before t->ip(), could be a REP-prefixed string instruction. It's OK to * return true if it's not really a string instruction (though for performance * reasons, this should be rare). */ bool maybe_at_or_after_x86_string_instruction(Task* t); } // namespace rr #endif // RR_FAST_FORWARD_H_ rr-4.4.0/src/ftrace.cc000066400000000000000000000062701277367620400145270ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "ftrace.h" #include #include #include #include #include #include #include "ScopedFd.h" #include "Session.h" #include "Task.h" #include "log.h" using namespace std; namespace rr { namespace ftrace { static ScopedFd control_fd; static ScopedFd marker_fd; static bool tracing = false; static void open_socket() { string s = string(getenv("HOME")) + "/.local/share/rr/ftrace"; control_fd = socket(AF_UNIX, SOCK_STREAM, 0); if (control_fd < 0) { FATAL() << "Cannot create socket"; } assert(control_fd >= 0); struct sockaddr_un addr; addr.sun_family = AF_UNIX; if (s.size() + 1 > sizeof(addr.sun_path)) { FATAL() << "Pathname '" << s << "' too long"; } strcpy(addr.sun_path, s.c_str()); int ret = connect(control_fd, (struct sockaddr*)&addr, sizeof(addr)); if (ret < 0 && (errno == ENOENT || errno == ECONNREFUSED)) { FATAL() << "ftrace-helper not running. Run ftrace-helper first."; } if (ret < 0) { FATAL() << "Can't connect to socket " << s; } } static void write_control_message(const string& s) { ssize_t ret = ::write(control_fd, s.c_str(), s.size()); if (ret != (ssize_t)s.size()) { FATAL() << "Can't write line to socket " << s; } } static void wait_for_reply() { char ch; if (read(control_fd, &ch, 1) != 1) { FATAL() << "Can't read reply from socket"; } } static void receive_marker_fd() { char received_data; struct iovec msgdata; msgdata.iov_base = &received_data; msgdata.iov_len = 1; char cmsgbuf[CMSG_SPACE(sizeof(int))]; struct msghdr msg; memset(&msg, 0, sizeof(msg)); msg.msg_control = cmsgbuf; msg.msg_controllen = sizeof(cmsgbuf); msg.msg_iov = &msgdata; msg.msg_iovlen = 1; if (0 > recvmsg(control_fd, &msg, 0)) { FATAL() << "Failed to receive fd"; } assert(received_data == 'F'); struct cmsghdr* cmsg = CMSG_FIRSTHDR(&msg); assert(cmsg && cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS); marker_fd = ScopedFd(*(int*)CMSG_DATA(cmsg)); assert(marker_fd.is_open()); } void start_function_graph(const Session& session, const TraceStream& trace) { if (tracing) { return; } if (!control_fd.is_open()) { open_socket(); } stringstream ss; ss << trace.bound_to_cpu() << "\n"; ss << getpid() << "\n"; for (auto& it : session.tasks()) { ss << it.second->tid << "\n"; } ss << "\n"; write_control_message(ss.str()); receive_marker_fd(); wait_for_reply(); tracing = true; } void write(const string& str) { if (!marker_fd.is_open()) { return; } size_t last_start = 0; for (size_t i = 0; i < str.size(); ++i) { if (str[i] == '\n') { if (i > last_start) { string s = str.substr(last_start, i + 1 - last_start); ssize_t ret = ::write(marker_fd, s.c_str(), s.size()); if (ret != (ssize_t)s.size()) { FATAL() << "Can't write line to socket " << s; } } last_start = i + 1; } } } void stop() { if (tracing) { marker_fd.close(); write_control_message("end\n"); wait_for_reply(); tracing = false; } } } } rr-4.4.0/src/ftrace.h000066400000000000000000000015201277367620400143620ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_FTRACE_H_ #define RR_FTRACE_H_ #include #include #include "TraceStream.h" namespace rr { class Session; /* * API for starting/stopping the Linux ftrace API. This uses the support * process 'ftrace_helper'. It's only for debugging rr. */ namespace ftrace { /** * Start kernel function-graph tracing. The processes of 'session', plus * rr itself, are traced. bin/ftrace_helper must have been started manually * before this gets called. */ void start_function_graph(const Session& session, const TraceStream& trace); /** * Write a marker to the ftrace file. 'str' should be newline-terminated. */ void write(const std::string& str); /** * Stop tracing. */ void stop(); } } // namespace rr #endif /* RR_FTRACE_H_ */ rr-4.4.0/src/ftrace/000077500000000000000000000000001277367620400142135ustar00rootroot00000000000000rr-4.4.0/src/ftrace/ftrace_helper.c000066400000000000000000000310611277367620400171630ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef NDEBUG #undef NDEBUG #endif #include /* * ftrace_helper is a small server providing an interface to ftrace. It needs * to run as root, and lets non-root applications connect to it to control * ftracing. * * 'ftrace_helper ' creates an AF_UNIX socket at and makes it * world-writable. Only one connection is allowed to this socket, then the * socket name is removed. * 'trace_helper' without arguments spawns itself with 'sudo' and creates the * socket at $HOME/.local/share/rr/ftrace. * * Over this connection the client can establish a series of sessions. All * messages from the client are newline-terminated and acked with a single * 'K' character. * To start a session the client sends a CPU number which is the only CPU * which will be traced (all traced processes must be affinity-bound to this * CPU). Then the client sends a series of PIDs, one per line, ending in * a blank line; these PIDs are the ones that will be traced. ftrace_helper * starts tracing those processes with the function_graph tracer. * ftrace_helper then sends the client a single 'F' character with a file * descriptor attached using SCM_RIGHTS. This fd is for the trace_marker file. * The client sends the string "end" to stop the session. * * Trace output is dumped to /tmp/ftrace_helper_out, owned by root but * world-readable, in trace-cmd raw format. Producing raw output is a bit * fiddly but it reduces overhead and lets us use "splice" to move data from * the kernel to the output file. On my laptop, at least, this is necessary * because saving "trace_pipe" loses events due to ringbuffer overrun and * using "trace_pipe_raw" does not. * * To view the output install trace-cmd and run * trace-cmd report /tmp/ftrace_helper_out|less */ inline static int check_cond(int cond) { if (!cond) { fprintf(stderr, "FAILED: errno=%d (%s)\n", errno, strerror(errno)); } return cond; } static void drop_sig(__attribute__((unused)) int sig) {} #define check(cond) assert("FAILED: !" && check_cond(cond)) static int out_fd; static void* do_echo(void* arg) { int fd = *(int*)arg; int pipe_fds[2]; ssize_t size; check(0 == pipe(pipe_fds)); size = fcntl(pipe_fds[1], F_GETPIPE_SZ); check(size > 0); while (1) { ssize_t ret2; ssize_t ret = splice(fd, NULL, pipe_fds[1], NULL, size, SPLICE_F_MOVE); if (ret == -1 && (errno == EBADF || errno == EINTR)) { return NULL; } check(ret >= 0); ret2 = splice(pipe_fds[0], NULL, out_fd, NULL, ret, SPLICE_F_MOVE | SPLICE_F_NONBLOCK); if (ret2 == -1 && (errno == EBADF || errno == EINTR)) { return NULL; } check(ret2 == ret); } } static void chdir_to_tracing(void) { int ret = chdir("/sys/kernel/debug"); if (ret < 0 && errno == ENOENT) { fprintf(stderr, "/sys/kernel/debug not found; debugfs not mounted?\n"); exit(1); } if (ret < 0 && errno == EACCES) { fprintf(stderr, "Cannot chdir to /sys/kernel/debug; run this as root\n"); exit(1); } check(ret == 0); ret = chdir("tracing"); if (ret < 0 && errno == ENOENT) { fprintf(stderr, "/sys/kernel/debug/tracing not found; tracing not enabled?\n"); exit(1); } check(ret == 0); } static void copy_file_data(int final_fd, int in_fd) { char buf[64 * 1024]; while (1) { ssize_t ret = read(in_fd, buf, sizeof(buf)); check(ret >= 0); if (!ret) { break; } check(ret == write(final_fd, buf, ret)); } } static void copy_trace_file(int final_fd, const char* name, int size_len) { char buf[1024]; int fd = open(name, O_RDONLY); check(fd >= 0); uint64_t len = 0; while (1) { ssize_t ret = read(fd, buf, sizeof(buf)); check(ret >= 0); if (!ret) { break; } len += ret; } check(0 == lseek(fd, 0, SEEK_SET)); /* XXX assumes little-endian */ check(size_len == write(final_fd, &len, size_len)); copy_file_data(final_fd, fd); check(0 == close(fd)); } static void copy_trace_file_with_name(int final_fd, const char* name, int size_len) { const char* bare_name = strrchr(name, '/'); if (bare_name) { ++bare_name; } else { bare_name = name; } check((ssize_t)strlen(bare_name) + 1 == write(final_fd, bare_name, strlen(bare_name) + 1)); copy_trace_file(final_fd, name, size_len); } static int iterate_events(int final_fd, const char* dir, int write) { int count = 0; DIR* d = opendir(dir); check(d != NULL); while (1) { char* buf; struct dirent* e = readdir(d); if (!e) { break; } asprintf(&buf, "%s/%s/format", dir, e->d_name); if (access(buf, F_OK) == 0) { if (write) { copy_trace_file(final_fd, buf, 8); } ++count; } free(buf); } check(0 == closedir(d)); return count; } static void open_output_fd(void) { out_fd = open("/tmp/ftrace_helper_out", O_RDWR | O_TRUNC | O_CREAT, 0644); check(out_fd >= 0); } static uint64_t file_offset(int fd) { off_t offset = lseek(fd, 0, SEEK_CUR); check(offset != (off_t)-1); return offset; } static uint64_t pad_output_to_page_size(int fd) { char buf[PAGE_SIZE]; uint64_t offset = file_offset(fd); memset(buf, 0, sizeof(buf)); ssize_t pad = ((offset + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1)) - offset; check(pad == write(fd, buf, pad)); return offset + pad; } static void write_final_output(void) { int final_fd; static const char magic[] = { 23, 8, 68, 't', 'r', 'a', 'c', 'i', 'n', 'g', '6', 0, /* file version */ 0, /* little-endian */ sizeof(long) }; const uint32_t page_size = PAGE_SIZE; uint32_t ftrace_count; static const uint32_t zero = 0; static const uint32_t cpus = 1; static const char options[] = "options "; static const uint16_t options_done = 0; static const char fly_record[] = "flyrecord"; uint64_t cpu_data[2] = { 0, 0 }; uint64_t cpu_data_offset; check(0 == unlink("/tmp/ftrace_helper_out")); final_fd = open("/tmp/ftrace_helper_out", O_WRONLY | O_TRUNC | O_CREAT, 0644); check(final_fd >= 0); check(sizeof(magic) == write(final_fd, magic, sizeof(magic))); check(sizeof(page_size) == write(final_fd, &page_size, sizeof(page_size))); copy_trace_file_with_name(final_fd, "events/header_page", 8); copy_trace_file_with_name(final_fd, "events/header_event", 8); ftrace_count = iterate_events(final_fd, "events/ftrace", 0); check(sizeof(ftrace_count) == write(final_fd, &ftrace_count, sizeof(ftrace_count))); iterate_events(final_fd, "events/ftrace", 1); /* Write no events (for now) */ check(sizeof(zero) == write(final_fd, &zero, sizeof(zero))); copy_trace_file(final_fd, "/proc/kallsyms", 4); copy_trace_file(final_fd, "printk_formats", 4); copy_trace_file(final_fd, "saved_cmdlines", 8); check(sizeof(cpus) == write(final_fd, &cpus, sizeof(cpus))); check(sizeof(options) == write(final_fd, &options, sizeof(options))); check(sizeof(options_done) == write(final_fd, &options_done, sizeof(options_done))); check(sizeof(fly_record) == write(final_fd, fly_record, sizeof(fly_record))); cpu_data_offset = file_offset(final_fd); check(sizeof(cpu_data) == write(final_fd, cpu_data, sizeof(cpu_data))); copy_trace_file(final_fd, "trace_clock", 8); cpu_data[0] = pad_output_to_page_size(final_fd); cpu_data[1] = file_offset(out_fd); check(0 == lseek(out_fd, 0, SEEK_SET)); copy_file_data(final_fd, out_fd); check(cpu_data_offset == (uint64_t)lseek(final_fd, cpu_data_offset, SEEK_SET)); check(sizeof(cpu_data) == write(final_fd, cpu_data, sizeof(cpu_data))); check(0 == close(final_fd)); } static int control_fd = -1; static char control_buf[1024]; static size_t control_buf_len = 0; static void open_control_fd(const char* path) { struct sockaddr_un addr; int listen_fd = socket(AF_UNIX, SOCK_STREAM, 0); check(listen_fd >= 0); addr.sun_family = AF_UNIX; if (strlen(path) + 1 > sizeof(addr.sun_path)) { fprintf(stderr, "Socket path %s too long\n", path); exit(1); } strcpy(addr.sun_path, path); unlink(path); check(0 == bind(listen_fd, &addr, sizeof(addr))); check(0 == chmod(path, 0666)); check(0 == listen(listen_fd, 1)); control_fd = accept(listen_fd, NULL, NULL); check(control_fd >= 0); check(0 == close(listen_fd)); check(0 == unlink(path)); } static int trace_pipe_fd = -1; static pthread_t echo_thread; static void write_file(const char* file, const char* value) { int fd = open(file, O_WRONLY | O_TRUNC); ssize_t ret; check(fd >= 0); ret = write(fd, value, strlen(value)); check((ssize_t)strlen(value) == ret); check(0 == close(fd)); } static void stop_tracing(void) { write_file("tracing_on", "0"); if (trace_pipe_fd >= 0) { check(0 == close(trace_pipe_fd)); trace_pipe_fd = -1; } if (echo_thread) { /* The thread might already have exited */ pthread_kill(echo_thread, SIGUSR1); check(0 == pthread_join(echo_thread, NULL)); memset(&echo_thread, 0, sizeof(echo_thread)); } /* Do this last; we can't change current_tracer while those files are open */ write_file("current_tracer", "nop"); } #define MAX_LINE_SIZE 65536 static void read_control_line(char out[MAX_LINE_SIZE]) { size_t out_pos = 0; while (1) { size_t i; if (!control_buf_len) { int ret = read(control_fd, control_buf, sizeof(control_buf)); check(ret >= 0); if (!ret) { stop_tracing(); write_final_output(); exit(2); } control_buf_len = ret; } for (i = 0; i < control_buf_len; ++i) { check(out_pos < MAX_LINE_SIZE); if (control_buf[i] == '\n') { out[out_pos] = 0; ++i; memmove(control_buf, control_buf + i, control_buf_len - i); control_buf_len -= i; return; } out[out_pos] = control_buf[i]; ++out_pos; } } } static void ack_control_message(void) { check(1 == write(control_fd, "K", 1)); } static void send_marker_fd(void) { char cmsgbuf[CMSG_SPACE(sizeof(int))]; struct msghdr msg; struct iovec data; struct cmsghdr* cmsg = (struct cmsghdr*)cmsgbuf; int trace_marker_fd = open("trace_marker", O_WRONLY); check(trace_marker_fd >= 0); data.iov_base = "F"; data.iov_len = 1; memset(&msg, 0, sizeof(msg)); msg.msg_control = cmsgbuf; msg.msg_controllen = sizeof(cmsgbuf); msg.msg_iov = &data; msg.msg_iovlen = 1; cmsg->cmsg_len = CMSG_LEN(sizeof(int)); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; memcpy(CMSG_DATA(cmsg), &trace_marker_fd, sizeof(int)); check(1 == sendmsg(control_fd, &msg, 0)); check(0 == close(trace_marker_fd)); } static void process_control_session(void) { char buf[MAX_LINE_SIZE]; char path[PATH_MAX]; int cpu; int ftrace_pid_fd; char buf_out[65536]; char* buf_out_ptr = buf_out; read_control_line(buf); cpu = atoi(buf); while (1) { read_control_line(buf); if (buf[0] == 0) { break; } if (buf_out_ptr + strlen(buf) >= buf_out + sizeof(buf_out)) { break; } buf_out_ptr += sprintf(buf_out_ptr, "%s ", buf); } ftrace_pid_fd = open("set_ftrace_pid", O_WRONLY); check(ftrace_pid_fd >= 0); check(buf_out_ptr - buf_out == write(ftrace_pid_fd, buf_out, buf_out_ptr - buf_out)); check(0 == close(ftrace_pid_fd)); write_file("current_tracer", "function_graph"); send_marker_fd(); sprintf(path, "per_cpu/cpu%d/trace_pipe_raw", cpu); trace_pipe_fd = open(path, O_RDONLY); check(trace_pipe_fd >= 0); check(0 == pthread_create(&echo_thread, NULL, do_echo, &trace_pipe_fd)); write_file("tracing_on", "1"); ack_control_message(); read_control_line(buf); check(!strcmp(buf, "end")); ack_control_message(); stop_tracing(); } int main(int argc, const char** argv) { if (argc == 1) { char* control_path; asprintf(&control_path, "%s/.local/share/rr/ftrace", getenv("HOME")); execlp("sudo", "sudo", argv[0], control_path, NULL); fprintf(stderr, "Can't exec 'sudo'\n"); return 1; } signal(SIGUSR1, drop_sig); chdir_to_tracing(); open_control_fd(argv[1]); open_output_fd(); while (1) { process_control_session(); } return 0; } rr-4.4.0/src/generate_rr_page.py000077500000000000000000000040251277367620400166160ustar00rootroot00000000000000#!/usr/bin/env python2 import io import os import sys def write_rr_page(f, is_64, is_replay): # The length of each code sequence must be RR_PAGE_SYSCALL_STUB_SIZE. # The end of each syscall instruction must be at offset # RR_PAGE_SYSCALL_INSTRUCTION_END. if is_64: bytes = bytearray([ 0x0f, 0x05, # syscall 0xc3, # ret ]) else: bytes = bytearray([ 0xcd, 0x80, # int 0x80 0xc3, # ret ]) nocall_bytes = bytearray([ 0x31, 0xc0, # xor %eax,%eax 0xc3, # ret ]) # traced f.write(bytes) # privileged traced f.write(bytes) # untraced f.write(bytes) # untraced replay-only if is_replay: f.write(bytes) else: f.write(nocall_bytes) # untraced record-only if is_replay: f.write(nocall_bytes) else: f.write(bytes) # privileged untraced f.write(bytes) # privileged untraced replay-only if is_replay: f.write(bytes) else: f.write(nocall_bytes) # privileged untraced record-only if is_replay: f.write(nocall_bytes) else: f.write(bytes) ff_bytes = bytearray([0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff]) f.write(ff_bytes) generators_for = { 'rr_page_32': lambda stream: write_rr_page(stream, False, False), 'rr_page_64': lambda stream: write_rr_page(stream, True, False), 'rr_page_32_replay': lambda stream: write_rr_page(stream, False, True), 'rr_page_64_replay': lambda stream: write_rr_page(stream, True, True), } def main(argv): filename = argv[0] base = os.path.basename(filename) if os.access(filename, os.F_OK): with open(filename, 'r') as f: before = f.read() else: before = "" stream = io.BytesIO() generators_for[base](stream) after = stream.getvalue() stream.close() if before != after: with open(filename, 'w') as f: f.write(after) if __name__ == '__main__': main(sys.argv[1:]) rr-4.4.0/src/generate_syscalls.py000077500000000000000000000124551277367620400170420ustar00rootroot00000000000000#!/usr/bin/env python2 import assembly_templates import StringIO import os import string import sys import syscalls def write_syscall_enum(f, arch): f.write("enum Syscalls {\n") undefined_syscall = -1 for name, obj in sorted(syscalls.all(), key=lambda x: getattr(x[1], arch)): syscall_number = getattr(obj, arch) if syscall_number is not None: enum_number = syscall_number else: enum_number = undefined_syscall undefined_syscall -= 1 f.write(" %s = %d,\n" % (name, enum_number)) f.write(" SYSCALL_COUNT,\n") f.write("};\n") f.write("\n") def write_syscall_enum_for_tests(f, arch): f.write("enum Syscalls {\n") undefined_syscall = -1 for name, obj in sorted(syscalls.all(), key=lambda x: getattr(x[1], arch)): syscall_number = getattr(obj, arch) if syscall_number is not None: enum_number = syscall_number else: enum_number = undefined_syscall undefined_syscall -= 1 f.write(" RR_%s = %d,\n" % (name, enum_number)) f.write("};\n") f.write("\n") def write_syscallname_arch(f): f.write("template static std::string syscallname_arch(int syscall);\n") f.write("\n"); for specializer, arch in [("X86Arch", "x86"), ("X64Arch", "x64")]: f.write("template <> std::string syscallname_arch<%s>(int syscall) {\n" % specializer) f.write(" switch (syscall) {\n"); def write_case(name): f.write(" case %(specializer)s::%(syscall)s: return \"%(syscall)s\";\n" % { 'specializer': specializer, 'syscall': name }) for name, _ in syscalls.for_arch(arch): write_case(name) f.write(" default: {") f.write(" char buf[100];") f.write(" sprintf(buf, \"\", syscall);") f.write(" return buf;\n") f.write(" }\n") f.write(" }\n") f.write("}\n") f.write("\n") def write_syscall_record_cases(f): def write_recorder_for_arg(syscall, arg): arg_descriptor = getattr(syscall, 'arg' + str(arg), None) if isinstance(arg_descriptor, str): f.write(" syscall_state.reg_parameter<%s>(%d);\n" % (arg_descriptor, arg)) for name, obj in syscalls.all(): # Irregular syscalls will be handled by hand-written code elsewhere. if isinstance(obj, syscalls.RegularSyscall): f.write(" case Arch::%s:\n" % name) for arg in range(1,6): write_recorder_for_arg(obj, arg) f.write(" return PREVENT_SWITCH;\n") has_syscall = string.Template("""inline bool has_${syscall}_syscall(SupportedArch arch) { switch (arch) { case x86: return X86Arch::${syscall} >= 0; case x86_64: return X64Arch::${syscall} >= 0; default: assert(0 && "unsupported architecture"); } } """) is_syscall = string.Template("""inline bool is_${syscall}_syscall(int syscallno, SupportedArch arch) { switch (arch) { case x86: return syscallno >= 0 && syscallno == X86Arch::${syscall}; case x86_64: return syscallno >= 0 && syscallno == X64Arch::${syscall}; default: assert(0 && "unsupported architecture"); } } """) syscall_number = string.Template("""inline int syscall_number_for_${syscall}(SupportedArch arch) { switch (arch) { case x86: assert(X86Arch::${syscall} >= 0); return X86Arch::${syscall}; case x86_64: assert(X64Arch::${syscall} >= 0); return X64Arch::${syscall}; default: assert(0 && "unsupported architecture"); } } """) def write_syscall_helper_functions(f): def write_helpers(syscall): subs = { 'syscall': syscall } f.write(has_syscall.safe_substitute(subs)) f.write(is_syscall.safe_substitute(subs)) f.write(syscall_number.safe_substitute(subs)) for name, obj in syscalls.all(): write_helpers(name) def write_check_syscall_numbers(f): for name, obj in syscalls.all(): # XXX hard-coded to x86 currently if not obj.x86: continue f.write("""static_assert(X86Arch::%s == SYS_%s, "Incorrect syscall number for %s");\n""" % (name, name, name)) generators_for = { 'AssemblyTemplates': lambda f: assembly_templates.generate(f), 'CheckSyscallNumbers': write_check_syscall_numbers, 'SyscallEnumsX86': lambda f: write_syscall_enum(f, 'x86'), 'SyscallEnumsX64': lambda f: write_syscall_enum(f, 'x64'), 'SyscallEnumsForTestsX86': lambda f: write_syscall_enum_for_tests(f, 'x86'), 'SyscallEnumsForTestsX64': lambda f: write_syscall_enum_for_tests(f, 'x64'), 'SyscallnameArch': write_syscallname_arch, 'SyscallRecordCase': write_syscall_record_cases, 'SyscallHelperFunctions': write_syscall_helper_functions, } def main(argv): filename = argv[0] base, extension = os.path.splitext(os.path.basename(filename)) if os.access(filename, os.F_OK): with open(filename, 'r') as f: before = f.read() else: before = "" stream = StringIO.StringIO() generators_for[base](stream) after = stream.getvalue() stream.close() if before != after: with open(filename, 'w') as f: f.write(after) if __name__ == '__main__': main(sys.argv[1:]) rr-4.4.0/src/kernel_abi.cc000066400000000000000000000163221277367620400153550ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ // Include remote_ptr.h first since it (indirectly) requires a definition of // ERANGE, which other headers below #undef :-( #include "remote_ptr.h" // Get all the kernel definitions so we can verify our alternative versions. #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include // Used to verify definitions in kernel_abi.h namespace rr { #define RR_VERIFY_TYPE_ARCH(arch_, system_type_, rr_type_) \ static_assert(Verifier::same_size, \ "type " #system_type_ " not correctly defined"); // For instances where the system type and the rr type are named differently. #define RR_VERIFY_TYPE_EXPLICIT(system_type_, rr_type_) \ RR_VERIFY_TYPE_ARCH(arch_, system_type_, rr_type_) // For instances where the system type and the rr type are named identically. #define RR_VERIFY_TYPE(type_) RR_VERIFY_TYPE_EXPLICIT(::type_, type_) } #include "kernel_abi.h" #include #include "Task.h" using namespace std; namespace rr { #define CHECK_ELF(cond) \ static_assert(cond, "ELF constant defined incorrectly" #cond) CHECK_ELF(ELFCLASSNONE == ELFCLASS::CLASSNONE); CHECK_ELF(ELFCLASS32 == ELFCLASS::CLASS32); CHECK_ELF(ELFCLASS64 == ELFCLASS::CLASS64); CHECK_ELF(EM_386 == EM::I386); CHECK_ELF(EM_X86_64 == EM::X86_64); CHECK_ELF(ELFDATA2LSB == ELFENDIAN::DATA2LSB); static const uint8_t int80_insn[] = { 0xcd, 0x80 }; static const uint8_t sysenter_insn[] = { 0x0f, 0x34 }; static const uint8_t syscall_insn[] = { 0x0f, 0x05 }; bool is_at_syscall_instruction(Task* t, remote_code_ptr ptr) { bool ok = true; vector code = t->read_mem(ptr.to_data_ptr(), 2, &ok); if (!ok) { return false; } switch (t->arch()) { case x86: return memcmp(code.data(), int80_insn, sizeof(int80_insn)) == 0 || memcmp(code.data(), sysenter_insn, sizeof(sysenter_insn)) == 0; case x86_64: return memcmp(code.data(), syscall_insn, sizeof(syscall_insn)) == 0 || memcmp(code.data(), sysenter_insn, sizeof(sysenter_insn)) == 0; default: assert(0 && "Need to define syscall instructions"); return false; } } vector syscall_instruction(SupportedArch arch) { switch (arch) { case x86: return vector(int80_insn, int80_insn + sizeof(int80_insn)); case x86_64: return vector(syscall_insn, syscall_insn + sizeof(syscall_insn)); default: assert(0 && "Need to define syscall instruction"); return vector(); } } ssize_t syscall_instruction_length(SupportedArch arch) { switch (arch) { case x86: case x86_64: return 2; default: assert(0 && "Need to define syscall instruction length"); return 0; } } template static void assign_sigval(typename Arch::sigval_t& to, const NativeArch::sigval_t& from) { // si_ptr/si_int are a union and we don't know which part is valid. // The only case where it matters is when we're mapping 64->32, in which // case we can just assign the ptr first (which is bigger) and then the // int (to be endian-independent). to.sival_ptr = from.sival_ptr.rptr(); to.sival_int = from.sival_int; } template static void set_arch_siginfo_arch(const siginfo_t& src, void* dest, size_t dest_size) { // Copying this structure field-by-field instead of just memcpy'ing // siginfo into si serves two purposes: performs 64->32 conversion if // necessary, and ensures garbage in any holes in signfo isn't copied to the // tracee. auto si = static_cast(dest); assert(dest_size == sizeof(*si)); union { NativeArch::siginfo_t native_api; siginfo_t linux_api; } u; u.linux_api = src; auto& siginfo = u.native_api; si->si_signo = siginfo.si_signo; si->si_errno = siginfo.si_errno; si->si_code = siginfo.si_code; switch (siginfo.si_code) { case SI_USER: case SI_TKILL: si->_sifields._kill.si_pid_ = siginfo._sifields._kill.si_pid_; si->_sifields._kill.si_uid_ = siginfo._sifields._kill.si_uid_; break; case SI_QUEUE: case SI_MESGQ: si->_sifields._rt.si_pid_ = siginfo._sifields._rt.si_pid_; si->_sifields._rt.si_uid_ = siginfo._sifields._rt.si_uid_; assign_sigval(si->_sifields._rt.si_sigval_, siginfo._sifields._rt.si_sigval_); break; case SI_TIMER: si->_sifields._timer.si_overrun_ = siginfo._sifields._timer.si_overrun_; si->_sifields._timer.si_tid_ = siginfo._sifields._timer.si_tid_; assign_sigval(si->_sifields._timer.si_sigval_, siginfo._sifields._timer.si_sigval_); break; default: switch (siginfo.si_signo) { case SIGCHLD: si->_sifields._sigchld.si_pid_ = siginfo._sifields._sigchld.si_pid_; si->_sifields._sigchld.si_uid_ = siginfo._sifields._sigchld.si_uid_; si->_sifields._sigchld.si_status_ = siginfo._sifields._sigchld.si_status_; si->_sifields._sigchld.si_utime_ = siginfo._sifields._sigchld.si_utime_; si->_sifields._sigchld.si_stime_ = siginfo._sifields._sigchld.si_stime_; break; case SIGILL: case SIGBUS: case SIGFPE: case SIGSEGV: case SIGTRAP: si->_sifields._sigfault.si_addr_ = siginfo._sifields._sigfault.si_addr_.rptr(); si->_sifields._sigfault.si_addr_lsb_ = siginfo._sifields._sigfault.si_addr_lsb_; break; case SIGIO: si->_sifields._sigpoll.si_band_ = siginfo._sifields._sigpoll.si_band_; si->_sifields._sigpoll.si_fd_ = siginfo._sifields._sigpoll.si_fd_; break; case SIGSYS: si->_sifields._sigsys._call_addr = siginfo._sifields._sigsys._call_addr.rptr(); si->_sifields._sigsys._syscall = siginfo._sifields._sigsys._syscall; si->_sifields._sigsys._arch = siginfo._sifields._sigsys._arch; break; } } } void set_arch_siginfo(const siginfo_t& siginfo, SupportedArch a, void* dest, size_t dest_size) { RR_ARCH_FUNCTION(set_arch_siginfo_arch, a, siginfo, dest, dest_size); } } rr-4.4.0/src/kernel_abi.h000066400000000000000000001265431277367620400152260ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_KERNEL_ABI_H #define RR_KERNEL_ABI_H #include #include #include #include "remote_ptr.h" namespace rr { class remote_code_ptr; class Task; enum SupportedArch { x86, x86_64, SupportedArch_MAX = x86_64 }; #if defined(__i386__) const SupportedArch RR_NATIVE_ARCH = SupportedArch::x86; #elif defined(__x86_64__) const SupportedArch RR_NATIVE_ARCH = SupportedArch::x86_64; #else #error need to define new SupportedArch enum #endif template struct Verifier { // Optimistically say we are the same size. static const bool same_size = true; }; template struct Verifier { static const bool same_size = sizeof(system_type) == sizeof(rr_type); }; template struct Verifier { // Prevent us from accidentally verifying the size of rr's structure // with itself or (unlikely) the system's structure with itself. }; // We want verify that the types have the same size as their // counterparts in the system header. To avoid having to include // all system headers here, we instead make the verification macros // a no-op unless inlcuded from kernel_abi.cc. #ifndef RR_VERIFY_TYPE #define RR_VERIFY_TYPE_ARCH(arch_, system_type_, rr_type_) // no-op #define RR_VERIFY_TYPE_EXPLICIT(system_type_, rr_type_) // no-op #define RR_VERIFY_TYPE(x) // no-op #endif struct KernelConstants { static const ::size_t SIGINFO_MAX_SIZE = 128; // These types are the same size everywhere. typedef int32_t pid_t; typedef uint32_t uid_t; typedef uint32_t gid_t; typedef uint32_t socklen_t; typedef uint64_t dev_t; typedef uint32_t mode_t; typedef int32_t __kernel_timer_t; }; // These duplicate the matching F_* constants for commands for fcntl, with two // small differences: we unconditionally define the *64 variants to their values // for 32-bit systems. This change enables us to always use our constants in // switch cases without worrying about duplicated case values and makes dealing // with 32-bit and 64-bit tracees in the same rr process simpler. // // The other small difference is that we define these constants without the F_ // prefix, so as to not run afoul of the C preprocessor. struct FcntlConstants { enum FcntlOperation { DUPFD = 0, GETFD = 1, SETFD = 2, GETFL = 3, SETFL = 4, GETLK = 5, SETLK = 6, SETLKW = 7, SETOWN = 8, GETOWN = 9, SETSIG = 10, GETSIG = 11, GETLK64 = 12, SETLK64 = 13, SETLKW64 = 14, SETOWN_EX = 15, GETOWN_EX = 16, // Linux-specific operations DUPFD_CLOEXEC = 0x400 + 6, ADD_SEALS = 0x400 + 9 }; }; // Various ELF constants we use. These are verified to be the same // as those in the system headers by kernel_abi.cc enum ELFCLASS { CLASSNONE = 0, CLASS32 = 1, CLASS64 = 2 }; enum ELFENDIAN { DATA2LSB = 1 }; enum EM { I386 = 3, X86_64 = 62, }; struct WordSize32Defs { static const ::size_t SIGINFO_PAD_SIZE = (KernelConstants::SIGINFO_MAX_SIZE / sizeof(int32_t)) - 3; typedef int16_t signed_short; typedef uint16_t unsigned_short; typedef int32_t signed_int; typedef uint32_t unsigned_int; typedef int32_t signed_long; typedef uint32_t unsigned_long; typedef int32_t signed_word; typedef uint32_t unsigned_word; typedef uint32_t size_t; typedef int32_t ssize_t; // These really only exist as proper abstractions so that adding x32 // (x86-64's ILP32 ABI) support is relatively easy. typedef int32_t syscall_slong_t; typedef uint32_t syscall_ulong_t; typedef int32_t sigchld_clock_t; typedef uint32_t __statfs_word; static const size_t elfclass = ELFCLASS::CLASS32; typedef struct { uint8_t e_ident[16]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; uint32_t e_entry; uint32_t e_phoff; uint32_t e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfEhdr; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf32_Ehdr, ElfEhdr); typedef struct { uint32_t sh_name; uint32_t sh_type; uint32_t sh_flags; uint32_t sh_addr; uint32_t sh_offset; uint32_t sh_size; uint32_t sh_link; uint32_t sh_info; uint32_t sh_addralign; uint32_t sh_entsize; } ElfShdr; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf32_Shdr, ElfShdr); typedef struct { uint32_t st_name; uint32_t st_value; uint32_t st_size; uint8_t st_info; uint8_t st_other; uint16_t st_shndx; } ElfSym; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf32_Sym, ElfSym); typedef struct { int32_t d_tag; uint32_t d_val; } ElfDyn; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf32_Dyn, ElfDyn); }; struct WordSize64Defs { static const ::size_t SIGINFO_PAD_SIZE = (KernelConstants::SIGINFO_MAX_SIZE / sizeof(int32_t)) - 4; typedef int16_t signed_short; typedef uint16_t unsigned_short; typedef int32_t signed_int; typedef uint32_t unsigned_int; typedef int64_t signed_long; typedef uint64_t unsigned_long; typedef int64_t signed_word; typedef uint64_t unsigned_word; typedef uint64_t size_t; typedef int64_t ssize_t; // These really only exist as proper abstractions so that adding x32 // (x86-64's ILP32 ABI) support is relatively easy. typedef int64_t syscall_slong_t; typedef uint64_t syscall_ulong_t; typedef int64_t sigchld_clock_t; typedef signed_long __statfs_word; static const size_t elfclass = ELFCLASS::CLASS64; typedef struct { uint8_t e_ident[16]; uint16_t e_type; uint16_t e_machine; uint32_t e_version; uint64_t e_entry; uint64_t e_phoff; uint64_t e_shoff; uint32_t e_flags; uint16_t e_ehsize; uint16_t e_phentsize; uint16_t e_phnum; uint16_t e_shentsize; uint16_t e_shnum; uint16_t e_shstrndx; } ElfEhdr; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf64_Ehdr, ElfEhdr); typedef struct { uint32_t sh_name; uint32_t sh_type; uint64_t sh_flags; uint64_t sh_addr; uint64_t sh_offset; uint64_t sh_size; uint32_t sh_link; uint32_t sh_info; uint64_t sh_addralign; uint64_t sh_entsize; } ElfShdr; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf64_Shdr, ElfShdr); typedef struct { uint32_t st_name; uint8_t st_info; uint8_t st_other; uint16_t st_shndx; uint64_t st_value; uint64_t st_size; } ElfSym; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf64_Sym, ElfSym); typedef struct { uint64_t d_tag; uint64_t d_val; } ElfDyn; RR_VERIFY_TYPE_ARCH(RR_NATIVE_ARCH, ::Elf64_Dyn, ElfDyn); }; /** * Structs defined in BaseArch and its derivatives should not contain any * holes. Holes can cause divergence if such structs are copied from rr to * the tracee. */ template struct BaseArch : public wordsize, public FcntlConstants, public KernelConstants { static SupportedArch arch() { return arch_; } typedef typename wordsize::syscall_slong_t syscall_slong_t; typedef typename wordsize::syscall_ulong_t syscall_ulong_t; typedef typename wordsize::signed_int signed_int; typedef typename wordsize::unsigned_int unsigned_int; typedef typename wordsize::signed_short signed_short; typedef typename wordsize::unsigned_short unsigned_short; typedef typename wordsize::signed_long signed_long; typedef typename wordsize::unsigned_long unsigned_long; typedef typename wordsize::unsigned_word unsigned_word; typedef typename wordsize::size_t size_t; typedef typename wordsize::ssize_t ssize_t; typedef typename wordsize::sigchld_clock_t sigchld_clock_t; typedef typename wordsize::__statfs_word __statfs_word; typedef syscall_slong_t time_t; typedef syscall_slong_t off_t; typedef syscall_slong_t blkcnt_t; typedef syscall_slong_t blksize_t; typedef syscall_ulong_t rlim_t; typedef syscall_ulong_t fsblkcnt_t; typedef syscall_ulong_t fsfilcnt_t; typedef syscall_ulong_t ino_t; typedef syscall_ulong_t nlink_t; typedef int64_t off64_t; typedef uint64_t rlim64_t; typedef uint64_t ino64_t; typedef int64_t blkcnt64_t; typedef syscall_slong_t clock_t; typedef signed_int __kernel_key_t; typedef signed_int __kernel_uid32_t; typedef signed_int __kernel_gid32_t; typedef unsigned_int __kernel_mode_t; typedef unsigned_long __kernel_ulong_t; typedef signed_long __kernel_long_t; typedef __kernel_long_t __kernel_time_t; typedef __kernel_long_t __kernel_suseconds_t; typedef signed_int __kernel_pid_t; typedef int64_t __kernel_loff_t; typedef unsigned_int __u32; template struct ptr { typedef T Referent; unsigned_word val; template operator remote_ptr() const { return rptr(); } /** * Sometimes you need to call rptr() directly to resolve ambiguous * overloading. */ remote_ptr rptr() const { return remote_ptr(val); } template ptr& operator=(remote_ptr p) { remote_ptr pt = p; val = pt.as_int(); assert(val == pt.as_int()); return *this; } operator bool() const { return val; } static size_t referent_size() { return sizeof(T); } }; union sigval_t { signed_int sival_int; ptr sival_ptr; }; struct sockaddr { unsigned_short sa_family; char sa_data[14]; }; RR_VERIFY_TYPE(sockaddr); struct sockaddr_un { unsigned_short sun_family; char sun_path[108]; }; RR_VERIFY_TYPE(sockaddr_un); struct timeval { __kernel_time_t tv_sec; __kernel_suseconds_t tv_usec; }; RR_VERIFY_TYPE(timeval); struct timespec { __kernel_time_t tv_sec; syscall_slong_t tv_nsec; }; RR_VERIFY_TYPE(timespec); struct pollfd { signed_int fd; signed_short events; signed_short revents; }; RR_VERIFY_TYPE(pollfd); struct iovec { ptr iov_base; size_t iov_len; }; RR_VERIFY_TYPE(iovec); struct msghdr { ptr msg_name; socklen_t msg_namelen; char _padding[sizeof(ptr) - sizeof(socklen_t)]; ptr msg_iov; size_t msg_iovlen; ptr msg_control; size_t msg_controllen; signed_int msg_flags; }; RR_VERIFY_TYPE(msghdr); struct cmsghdr { size_t cmsg_len; int cmsg_level; int cmsg_type; }; RR_VERIFY_TYPE(cmsghdr); struct mmsghdr { msghdr msg_hdr; unsigned_int msg_len; }; RR_VERIFY_TYPE(mmsghdr); // x86-64 is the only architecture to pack this structure, and it does // so to make the x86 and x86-64 definitions identical. So even if // we're compiling on an x86-64 host that will support recording // 32-bit and 64-bit programs, this is the correct way to declare // epoll_event for both kinds of recordees. // See . #if defined(__x86_64__) #define RR_EPOLL_PACKED __attribute__((packed)) #else #define RR_EPOLL_PACKED #endif struct epoll_event { union epoll_data { ptr ptr_; signed_int fd; uint32_t u32; uint64_t u64; }; uint32_t events; epoll_data data; } RR_EPOLL_PACKED; RR_VERIFY_TYPE(epoll_event); #undef RR_EPOLL_PACKED struct rusage { timeval ru_utime; timeval ru_stime; signed_long ru_maxrss; signed_long ru_ixrss; signed_long ru_idrss; signed_long ru_isrss; signed_long ru_minflt; signed_long ru_majflt; signed_long ru_nswap; signed_long ru_inblock; signed_long ru_oublock; signed_long ru_msgnsd; signed_long ru_msgrcv; signed_long ru_nsignals; signed_long ru_nvcsw; signed_long ru_nivcsw; }; RR_VERIFY_TYPE(rusage); struct siginfo_t { signed_int si_signo; signed_int si_errno; signed_int si_code; union { signed_int padding[wordsize::SIGINFO_PAD_SIZE]; // #defines all the field names belong due to X/Open // requirements, so we append '_'. struct { pid_t si_pid_; uid_t si_uid_; } _kill; struct { signed_int si_tid_; signed_int si_overrun_; sigval_t si_sigval_; } _timer; struct { pid_t si_pid_; uid_t si_uid_; sigval_t si_sigval_; } _rt; struct { pid_t si_pid_; uid_t si_uid_; signed_int si_status_; sigchld_clock_t si_utime_; sigchld_clock_t si_stime_; } _sigchld; struct { ptr si_addr_; signed_short si_addr_lsb_; } _sigfault; struct { signed_long si_band_; signed_int si_fd_; } _sigpoll; struct { ptr _call_addr; signed_int _syscall; unsigned_int _arch; } _sigsys; } _sifields; }; RR_VERIFY_TYPE_EXPLICIT(siginfo_t, ::siginfo_t) typedef unsigned char cc_t; typedef unsigned_int speed_t; typedef unsigned_int tcflag_t; struct termios { tcflag_t c_iflag; tcflag_t c_oflag; tcflag_t c_cflag; tcflag_t c_lflag; cc_t c_line; cc_t c_cc[32]; char _padding[3]; speed_t c_ispeed; speed_t c_ospeed; }; RR_VERIFY_TYPE(termios); struct termio { unsigned_short c_iflag; unsigned_short c_oflag; unsigned_short c_cflag; unsigned_short c_lflag; unsigned char c_line; unsigned char c_cc[8]; }; RR_VERIFY_TYPE(termio); struct winsize { unsigned_short ws_row; unsigned_short ws_col; unsigned_short ws_xpixel; unsigned_short ws_ypixel; }; RR_VERIFY_TYPE(winsize); struct ipc64_perm { __kernel_key_t key; __kernel_uid32_t uid; __kernel_gid32_t gid; __kernel_uid32_t cuid; __kernel_gid32_t cgid; __kernel_mode_t mode; unsigned_short seq; unsigned_short __pad2; char __pad3[sizeof(__kernel_ulong_t) - 2 * sizeof(unsigned_short)]; __kernel_ulong_t unused1; __kernel_ulong_t unused2; }; RR_VERIFY_TYPE(ipc64_perm); struct msqid64_ds { ipc64_perm msg_perm; // These msg*time fields are really __kernel_time_t plus // appropriate padding. We don't touch the fields, though. // // We do, however, suffix them with _only_little_endian to // urge anybody who does touch them to make sure the right // thing is done for big-endian systems. uint64_t msg_stime_only_little_endian; uint64_t msg_rtime_only_little_endian; uint64_t msg_ctime_only_little_endian; __kernel_ulong_t msg_cbytes; __kernel_ulong_t msg_qnum; __kernel_ulong_t msg_qbytes; __kernel_pid_t msg_lspid; __kernel_pid_t msg_lrpid; __kernel_ulong_t unused1; __kernel_ulong_t unused2; }; RR_VERIFY_TYPE(msqid64_ds); struct msginfo { signed_int msgpool; signed_int msgmap; signed_int msgmax; signed_int msgmnb; signed_int msgmni; signed_int msgssz; signed_int msgtql; unsigned_short msgseg; }; RR_VERIFY_TYPE(msginfo); struct shmid64_ds { ipc64_perm shm_perm; size_t shm_segsz; uint64_t shm_atime_only_little_endian; uint64_t shm_dtime_only_little_endian; uint64_t shm_ctime_only_little_endian; __kernel_pid_t shm_cpid; __kernel_pid_t shm_lpid; __kernel_ulong_t shm_nattch; __kernel_ulong_t unused4; __kernel_ulong_t unused5; }; RR_VERIFY_TYPE(shmid64_ds); struct shminfo64 { __kernel_ulong_t shmmax; __kernel_ulong_t shmmin; __kernel_ulong_t shmmni; __kernel_ulong_t shmseg; __kernel_ulong_t shmall; __kernel_ulong_t unused1; __kernel_ulong_t unused2; __kernel_ulong_t unused3; __kernel_ulong_t unused4; }; RR_VERIFY_TYPE(shminfo64); struct shm_info { int used_ids; char __pad[sizeof(__kernel_ulong_t) - sizeof(int)]; __kernel_ulong_t shm_tot; __kernel_ulong_t shm_rss; __kernel_ulong_t shm_swp; __kernel_ulong_t swap_attempts; __kernel_ulong_t swap_successes; }; RR_VERIFY_TYPE(shm_info); struct semid64_ds { ipc64_perm sem_perm; __kernel_time_t sem_otime; __kernel_ulong_t __unused1; __kernel_time_t sem_ctime; __kernel_ulong_t __unused2; __kernel_ulong_t sem_nsems; __kernel_ulong_t __unused3; __kernel_ulong_t __unused4; }; RR_VERIFY_TYPE(semid64_ds); struct seminfo { int semmap; int semmni; int semmns; int semmnu; int semmsl; int semopm; int semume; int semusz; int semvmx; int semaem; }; RR_VERIFY_TYPE(seminfo); // The clone(2) syscall has four (!) different calling conventions, // depending on what architecture it's being compiled for. We describe // the orderings for x86oids here. enum CloneParameterOrdering { FlagsStackParentTLSChild, FlagsStackParentChildTLS, }; // Despite the clone(2) manpage describing the clone syscall as taking a // pointer to |struct user_desc*|, the actual kernel interface treats the // TLS value as a opaque cookie, which architectures are then free to do // whatever they like with. See for instance the definition of TLS_VALUE // in nptl/sysdeps/pthread/createthread.c in the glibc source. We need to // describe what the architecture uses so we can record things accurately. enum CloneTLSType { // |struct user_desc*| UserDescPointer, // This is the default choice for TLS_VALUE in the glibc source. PthreadStructurePointer, }; struct user_desc { unsigned_int entry_number; unsigned_int base_addr; unsigned_int limit; unsigned_int seg_32bit : 1; unsigned_int contents : 2; unsigned_int read_exec_only : 1; unsigned_int limit_in_pages : 1; unsigned_int seg_not_present : 1; unsigned_int useable : 1; unsigned_int lm : 1; }; RR_VERIFY_TYPE(user_desc); struct __user_cap_header_struct { __u32 version; int pid; }; RR_VERIFY_TYPE(__user_cap_header_struct); struct __user_cap_data_struct { __u32 effective; __u32 permitted; __u32 inheritable; }; RR_VERIFY_TYPE(__user_cap_data_struct); // This structure uses fixed-size fields, but the padding rules // for 32-bit vs. 64-bit architectures dictate that it be // defined in full. struct dqblk { uint64_t dqb_bhardlimit; uint64_t dqb_bsoftlimit; uint64_t dqb_curspace; uint64_t dqb_ihardlimit; uint64_t dqb_isoftlimit; uint64_t dqb_curinodes; uint64_t dqb_btime; uint64_t dqb_itime; uint32_t dqb_valid; }; RR_VERIFY_TYPE(dqblk); struct dqinfo { uint64_t dqi_bgrace; uint64_t dqi_igrace; uint32_t dqi_flags; uint32_t dqi_valid; }; RR_VERIFY_TYPE(dqinfo); struct ifmap { unsigned_long mem_start; unsigned_long mem_end; unsigned_short base_addr; unsigned char irq; unsigned char dma; unsigned char port; }; RR_VERIFY_TYPE(ifmap); struct if_settings { unsigned_int type; unsigned_int size; union { ptr raw_hdlc; ptr cisco; ptr fr; ptr fr_pvc; ptr fr_pvc_info; ptr sync; ptr tel; } ifs_ifsu; }; RR_VERIFY_TYPE(if_settings); struct ifreq { union { char ifrn_name[16]; } ifr_ifrn; union { sockaddr ifru_addr; sockaddr ifru_dstaddr; sockaddr ifru_broadaddr; sockaddr ifru_netmask; sockaddr ifru_hwaddr; signed_short ifru_flags; signed_int ifru_ivalue; signed_int ifru_mtu; ifmap ifru_map; char ifru_slave[16]; char ifru_newname[16]; ptr ifru_data; if_settings ifru_settings; } ifr_ifru; }; RR_VERIFY_TYPE(ifreq); struct ifconf { signed_int ifc_len; char __pad[sizeof(ptr) - sizeof(int)]; union { ptr ifcu_buf; ptr ifcu_req; } ifc_ifcu; }; RR_VERIFY_TYPE(ifconf); struct iw_param { int32_t value; uint8_t fixed; uint8_t disabled; uint16_t flags; }; RR_VERIFY_TYPE(iw_param); struct iw_point { ptr pointer; uint16_t length; uint16_t flags; }; RR_VERIFY_TYPE(iw_point); struct iw_freq { int32_t m; int16_t e; uint8_t i; uint8_t flags; }; RR_VERIFY_TYPE(iw_freq); struct iw_quality { uint8_t qual; uint8_t level; uint8_t noise; uint8_t updated; }; RR_VERIFY_TYPE(iw_quality); union iwreq_data { char name[16]; iw_point essid; iw_param nwid; iw_freq freq; iw_param sens; iw_param bitrate; iw_param txpower; iw_param rts; iw_param frag; uint32_t mode; iw_param retry; iw_point encoding; iw_param power; iw_quality qual; sockaddr ap_addr; sockaddr addr; iw_param param; iw_point data; }; RR_VERIFY_TYPE(iwreq_data); struct iwreq { union { char ifrn_name[16]; } ifr_ifrn; iwreq_data u; }; RR_VERIFY_TYPE(iwreq); struct ethtool_cmd { uint32_t cmd; uint32_t supported; uint32_t advertising; uint16_t speed; uint8_t duplex; uint8_t port; uint8_t phy_address; uint8_t transceiver; uint8_t autoneg; uint8_t mdio_support; uint32_t maxtxpkt; uint32_t maxrxpkt; uint16_t speed_hi; uint8_t eth_tp_mdix; uint8_t eth_tp_mdix_ctrl; uint32_t lp_advertising; uint32_t reserved[2]; }; RR_VERIFY_TYPE(ethtool_cmd); struct _flock { signed_short l_type; signed_short l_whence; char __pad[sizeof(off_t) - 2 * sizeof(short)]; off_t l_start; off_t l_len; pid_t l_pid; }; RR_VERIFY_TYPE_EXPLICIT(struct ::flock, _flock); struct flock64 { signed_short l_type; signed_short l_whence; // No padding on 32-bit, 4 bytes of padding on 64-bit char __pad[sizeof(uint32_t) - 2 * sizeof(short)]; uint64_t l_start; uint64_t l_len; pid_t l_pid; }; RR_VERIFY_TYPE(flock64); struct f_owner_ex { signed_int type; __kernel_pid_t pid; }; RR_VERIFY_TYPE(f_owner_ex); // Define various structures that package up syscall arguments. // The types of their members are part of the ABI, and defining // them here makes their definitions more concise. struct accept_args { signed_int sockfd; char __pad[sizeof(ptr) - sizeof(int)]; ptr addr; ptr addrlen; }; struct accept4_args { signed_int sockfd; char __pad[sizeof(ptr) - sizeof(int)]; ptr addr; ptr addrlen; signed_long flags; }; struct getsockname_args { signed_int sockfd; char __pad[sizeof(ptr) - sizeof(int)]; ptr addr; ptr addrlen; }; struct getsockopt_args { signed_int sockfd; signed_int level; signed_int optname; char __pad[sizeof(ptr) - sizeof(int)]; ptr optval; ptr optlen; }; struct setsockopt_args { signed_int sockfd; signed_int level; signed_int optname; char __pad[sizeof(ptr) - sizeof(int)]; ptr optval; ptr optlen; }; struct recv_args { signed_int sockfd; char __pad[sizeof(ptr) - sizeof(int)]; ptr buf; size_t len; signed_int flags; }; struct recvfrom_args { signed_long sockfd; ptr buf; size_t len; signed_long flags; ptr src_addr; ptr addrlen; }; struct recvmsg_args { signed_int fd; char __pad[sizeof(ptr) - sizeof(int)]; ptr msg; signed_int flags; }; struct recvmmsg_args { signed_int sockfd; char __pad[sizeof(ptr) - sizeof(int)]; ptr msgvec; unsigned_int vlen; unsigned_int flags; ptr timeout; }; struct sendmsg_args { signed_int fd; char __pad[sizeof(ptr) - sizeof(int)]; ptr msg; signed_int flags; }; struct sendmmsg_args { signed_int sockfd; char __pad[sizeof(ptr) - sizeof(int)]; ptr msgvec; unsigned_int vlen; unsigned_int flags; }; struct socketpair_args { signed_int domain; signed_int type; signed_int protocol; char __pad[sizeof(ptr) - sizeof(int)]; ptr sv; // int sv[2] }; // All architectures have an mmap syscall, but it has architecture-specific // calling semantics. We describe those here, and specializations need to // indicate which semantics they use. enum MmapCallingSemantics { StructArguments, // x86-ish, packaged into mmap_args, below RegisterArguments, // arguments passed in registers, the offset // is assumed to be in bytes, not in pages. }; struct mmap_args { ptr addr; size_t len; signed_int prot; signed_int flags; signed_int fd; char __pad[sizeof(off_t) - sizeof(int)]; off_t offset; }; // All architectures have a select syscall, but like mmap, there are two // different calling styles: one that packages the args into a structure, // and one that handles the args in registers. (Architectures using the // first style, like the x86, sometimes support the register-args version // as a separate syscall.) // // (Yes, we'd like to call these StructArguments and RegisterArguments, but // that would conflict with MmapCallingSemantics, above.) enum SelectCallingSemantics { SelectStructArguments, SelectRegisterArguments, }; static const size_t MAX_FDS = 1024; struct fd_set { unsigned_long fds_bits[MAX_FDS / (8 * sizeof(unsigned_long))]; }; struct select_args { signed_int n_fds; char __pad[sizeof(ptr) - sizeof(int)]; ptr read_fds; ptr write_fds; ptr except_fds; ptr timeout; }; /** * Some ipc calls require 7 params, so two of them are stashed into * one of these structs and a pointer to this is passed instead. */ struct ipc_kludge_args { ptr msgbuf; signed_long msgtype; }; struct __sysctl_args { ptr name; signed_int nlen; char __pad[sizeof(ptr) - sizeof(int)]; ptr oldval; ptr oldlenp; ptr newval; ptr newlen; unsigned_long __unused[4]; }; RR_VERIFY_TYPE(__sysctl_args); typedef struct { unsigned_long __val[64 / (8 * sizeof(unsigned_long))]; } kernel_sigset_t; // libc reserves some space in the user facing structures for future // extensibility. typedef struct { unsigned_long __val[1024 / (8 * sizeof(unsigned_long))]; } __sigset_t; typedef __sigset_t sigset_t; RR_VERIFY_TYPE(sigset_t); typedef struct { ptr ss; size_t ss_len; } pselect6_arg6; struct kernel_sigaction { ptr k_sa_handler; unsigned_long sa_flags; ptr sa_restorer; kernel_sigset_t sa_mask; }; struct tms { clock_t tms_utime; clock_t tms_stime; clock_t tms_cutime; clock_t tms_cstime; }; RR_VERIFY_TYPE(tms); struct rlimit { rlim_t rlim_cur; rlim_t rlim_max; }; RR_VERIFY_TYPE(rlimit); struct rlimit64 { rlim64_t rlim_cur; rlim64_t rlim_max; }; RR_VERIFY_TYPE(rlimit64); struct timezone { int tz_minuteswest; int tz_dsttime; }; RR_VERIFY_TYPE_EXPLICIT(struct ::timezone, timezone); struct statfs { __statfs_word f_type; __statfs_word f_bsize; __statfs_word f_blocks; __statfs_word f_bfree; __statfs_word f_bavail; __statfs_word f_files; __statfs_word f_ffree; struct { int __val[2]; } f_fsid; __statfs_word f_namelen; __statfs_word f_frsize; __statfs_word f_flags; __statfs_word f_spare[4]; }; RR_VERIFY_TYPE_EXPLICIT(struct ::statfs, statfs); struct statfs64 { __statfs_word f_type; __statfs_word f_bsize; uint64_t f_blocks; uint64_t f_bfree; uint64_t f_bavail; uint64_t f_files; uint64_t f_ffree; struct { int __val[2]; } f_fsid; __statfs_word f_namelen; __statfs_word f_frsize; __statfs_word f_flags; __statfs_word f_spare[4]; }; RR_VERIFY_TYPE_EXPLICIT(struct ::statfs64, statfs64); struct itimerval { timeval it_interval; timeval it_value; }; RR_VERIFY_TYPE(itimerval); struct itimerspec { timespec it_interval; timespec it_value; }; RR_VERIFY_TYPE(itimerspec); typedef struct sigaltstack { ptr ss_sp; int ss_flags; char __pad[sizeof(size_t) - sizeof(int)]; size_t ss_size; } stack_t; RR_VERIFY_TYPE(stack_t); struct sysinfo { __kernel_long_t uptime; __kernel_ulong_t loads[3]; __kernel_ulong_t totalram; __kernel_ulong_t freeram; __kernel_ulong_t sharedram; __kernel_ulong_t bufferram; __kernel_ulong_t totalswap; __kernel_ulong_t freeswap; uint16_t procs; uint16_t pad; char __pad[sizeof(__kernel_ulong_t) - 2 * sizeof(uint16_t)]; __kernel_ulong_t totalhigh; __kernel_ulong_t freehigh; uint32_t mem_unit; char _f[20 - 2 * sizeof(__kernel_ulong_t) - sizeof(uint32_t)]; }; RR_VERIFY_TYPE_EXPLICIT(struct ::sysinfo, sysinfo); static const ::size_t UTSNAME_LENGTH = 65; struct utsname { char sysname[UTSNAME_LENGTH]; char nodename[UTSNAME_LENGTH]; char release[UTSNAME_LENGTH]; char version[UTSNAME_LENGTH]; char machine[UTSNAME_LENGTH]; char domainname[UTSNAME_LENGTH]; }; RR_VERIFY_TYPE(utsname); struct sched_param { int __sched_priority; }; RR_VERIFY_TYPE(sched_param); static void* cmsg_data(cmsghdr* cmsg) { return cmsg + 1; } static size_t cmsg_align(size_t len) { return (len + sizeof(size_t) - 1) & ~(sizeof(size_t) - 1); } static size_t cmsg_space(size_t len) { return cmsg_align(sizeof(cmsghdr)) + cmsg_align(len); } static size_t cmsg_len(size_t len) { return cmsg_align(sizeof(cmsghdr)) + len; } struct v4l2_timecode { uint32_t type; uint32_t flags; uint8_t frames; uint8_t seconds; uint8_t minutes; uint8_t hours; uint8_t userbits[4]; }; RR_VERIFY_TYPE(v4l2_timecode); struct v4l2_buffer { uint32_t index; uint32_t type; uint32_t bytesused; uint32_t flags; uint32_t field; char __pad[sizeof(__kernel_ulong_t) - sizeof(uint32_t)]; struct timeval timestamp; struct v4l2_timecode timecode; uint32_t sequence; uint32_t memory; union { uint32_t offset; unsigned_long userptr; ptr planes; int32_t fd; } m; uint32_t length; uint32_t reserved2; uint32_t reserved; }; RR_VERIFY_TYPE(v4l2_buffer); struct sock_filter { uint16_t code; uint8_t jt; uint8_t jf; uint32_t k; }; RR_VERIFY_TYPE(sock_filter); struct sock_fprog { uint16_t len; char _padding[sizeof(ptr) - sizeof(uint16_t)]; ptr filter; }; RR_VERIFY_TYPE(sock_fprog); struct robust_list { ptr next; }; RR_VERIFY_TYPE(robust_list); struct robust_list_head { robust_list list; signed_long futex_offset; ptr list_op_pending; }; RR_VERIFY_TYPE(robust_list_head); struct snd_ctl_card_info { int card; int pad; unsigned char id[16]; unsigned char driver[16]; unsigned char name[32]; unsigned char longname[80]; unsigned char reserved_[16]; unsigned char mixername[80]; unsigned char components[128]; }; RR_VERIFY_TYPE(snd_ctl_card_info); struct usbdevfs_iso_packet_desc { unsigned int length; unsigned int actual_length; unsigned int status; }; RR_VERIFY_TYPE(usbdevfs_iso_packet_desc); struct usbdevfs_urb { unsigned char type; unsigned char endpoint; int status; unsigned int flags; ptr buffer; int buffer_length; int actual_length; int start_frame; union { int number_of_packets; unsigned int stream_id; }; int error_count; unsigned int signr; ptr usercontext; struct usbdevfs_iso_packet_desc iso_frame_desc[0]; }; RR_VERIFY_TYPE(usbdevfs_urb); struct usbdevfs_ioctl { int ifno; int ioctl_code; ptr data; }; RR_VERIFY_TYPE(usbdevfs_ioctl); struct usbdevfs_ctrltransfer { uint8_t bRequestType; uint8_t bRequest; uint16_t wValue; uint16_t wIndex; uint16_t wLength; uint32_t timeout; ptr data; }; RR_VERIFY_TYPE(usbdevfs_ctrltransfer); struct dirent { ino_t d_ino; off_t d_off; uint16_t d_reclen; // uint8_t d_type; uint8_t d_name[256]; }; RR_VERIFY_TYPE(dirent); struct dirent64 { ino64_t d_ino; off64_t d_off; uint16_t d_reclen; uint8_t d_type; uint8_t d_name[256]; }; RR_VERIFY_TYPE(dirent64); struct mq_attr { signed_long mq_flags; signed_long mq_maxmsg; signed_long mq_msgsize; signed_long mq_curmsgs; signed_long __reserved[4]; }; RR_VERIFY_TYPE(mq_attr); }; struct X86Arch : public BaseArch { static const size_t elfmachine = EM::I386; static const size_t elfendian = ELFENDIAN::DATA2LSB; static const MmapCallingSemantics mmap_semantics = StructArguments; static const CloneTLSType clone_tls_type = UserDescPointer; static const CloneParameterOrdering clone_parameter_ordering = FlagsStackParentTLSChild; static const SelectCallingSemantics select_semantics = SelectStructArguments; // The getgroups syscall (as well as several others) differs between // architectures depending on whether they ever supported 16-bit // {U,G}IDs or not. Architectures such as x86, which did support // 16-bit {U,G}IDs, have a getgroups syscall for the 16-bit GID case // and a getgroups32 syscall for the 32-bit GID case. Architectures // such as as x86-64, which support 32-bit GIDs exclusively, have only // a getgroups syscall. We need to know which one we're dealing with // when recording and replaying getgroups and related syscalls. typedef uint16_t legacy_uid_t; typedef uint16_t legacy_gid_t; #include "SyscallEnumsX86.generated" struct user_regs_struct { int32_t ebx; int32_t ecx; int32_t edx; int32_t esi; int32_t edi; int32_t ebp; int32_t eax; int32_t xds; int32_t xes; int32_t xfs; int32_t xgs; int32_t orig_eax; int32_t eip; int32_t xcs; int32_t eflags; int32_t esp; int32_t xss; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86, ::user_regs_struct, user_regs_struct); struct user_fpregs_struct { int32_t cwd; int32_t swd; int32_t twd; int32_t fip; int32_t fcs; int32_t foo; int32_t fos; int32_t st_space[20]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86, ::user_fpregs_struct, user_fpregs_struct); struct user_fpxregs_struct { uint16_t cwd; uint16_t swd; uint16_t twd; uint16_t fop; int32_t fip; int32_t fcs; int32_t foo; int32_t fos; int32_t mxcsr; int32_t reserved; int32_t st_space[32]; int32_t xmm_space[32]; int32_t padding[56]; }; #if defined(__i386__) RR_VERIFY_TYPE_ARCH(SupportedArch::x86, ::user_fpxregs_struct, user_fpxregs_struct); #endif struct sigcontext { uint16_t gs, __gsh; uint16_t fs, __fsh; uint16_t es, __esh; uint16_t ds, __dsh; uint32_t di; uint32_t si; uint32_t bp; uint32_t sp; uint32_t bx; uint32_t dx; uint32_t cx; uint32_t ax; uint32_t trapno; uint32_t err; uint32_t ip; uint16_t cs, __csh; uint32_t flags; uint32_t sp_at_signal; uint16_t ss, __ssh; uint32_t fpstate; uint32_t oldmask; uint32_t cr2; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86, ::sigcontext, sigcontext); struct ucontext { uint32_t uc_flags; uint32_t uc_link; stack_t uc_stack; sigcontext uc_mcontext; kernel_sigset_t uc_sigmask; }; struct rt_sigframe { uint32_t pretcode; int sig; uint32_t pinfo; uint32_t puc; siginfo_t info; struct ucontext uc; }; struct _fpstate_32 { uint32_t cw, sw, tag, ipoff, cssel, dataoff, datasel; uint16_t _st[40]; uint16_t status, magic; uint32_t _fxsr_env[6], mxcsr, reserved; uint32_t _fxsr_st[32]; uint32_t _xmm[32]; uint32_t padding[56]; }; struct sigframe { uint32_t pretcode; int sig; sigcontext sc; _fpstate_32 unused; uint32_t extramask; char retcode[8]; }; struct user { user_regs_struct regs; int u_fpvalid; user_fpregs_struct i387; uint32_t u_tsize; uint32_t u_dsize; uint32_t u_ssize; uint32_t start_code; uint32_t start_stack; int32_t signal; int reserved; ptr u_ar0; ptr u_fpstate; uint32_t magic; char u_comm[32]; int u_debugreg[8]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86, ::user, user); struct stat { dev_t st_dev; unsigned_short __pad1; ino_t st_ino; mode_t st_mode; nlink_t st_nlink; uid_t st_uid; gid_t st_gid; dev_t st_rdev; unsigned_short __pad2; off_t st_size; blksize_t st_blksize; blkcnt_t st_blocks; timespec st_atim; timespec st_mtim; timespec st_ctim; unsigned_long __unused4; unsigned_long __unused5; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86, struct ::stat, struct stat); struct stat64 { dev_t st_dev; unsigned_int __pad1; ino_t __st_ino; mode_t st_mode; nlink_t st_nlink; uid_t st_uid; gid_t st_gid; dev_t st_rdev; unsigned_int __pad2; off64_t st_size; blksize_t st_blksize; blkcnt64_t st_blocks; timespec st_atim; timespec st_mtim; timespec st_ctim; ino64_t st_ino; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86, struct ::stat64, struct stat64); }; struct X64Arch : public BaseArch { static const size_t elfmachine = EM::X86_64; static const size_t elfendian = ELFENDIAN::DATA2LSB; static const MmapCallingSemantics mmap_semantics = RegisterArguments; static const CloneTLSType clone_tls_type = PthreadStructurePointer; static const CloneParameterOrdering clone_parameter_ordering = FlagsStackParentChildTLS; static const SelectCallingSemantics select_semantics = SelectRegisterArguments; typedef uint32_t legacy_uid_t; typedef uint32_t legacy_gid_t; #include "SyscallEnumsX64.generated" // The kernel defines the segment registers and eflags as 64-bit quantities, // even though the segment registers are really 16-bit and eflags is // architecturally defined as 32-bit. GDB wants the segment registers and // eflags to appear as 32-bit quantities. From the perspective of providing // registers to GDB, it's easier if we define these registers as uint32_t // with extra padding. struct user_regs_struct { uint64_t r15; uint64_t r14; uint64_t r13; uint64_t r12; uint64_t rbp; uint64_t rbx; uint64_t r11; uint64_t r10; uint64_t r9; uint64_t r8; uint64_t rax; uint64_t rcx; uint64_t rdx; uint64_t rsi; uint64_t rdi; // Unsigned type matches , but we need to treat this as // signed in practice. uint64_t orig_rax; uint64_t rip; uint32_t cs; uint32_t cs_upper; uint32_t eflags; uint32_t eflags_upper; uint64_t rsp; uint32_t ss; uint32_t ss_upper; // These _base registers are architecturally defined MSRs and really do // need to be 64-bit. uint64_t fs_base; uint64_t gs_base; uint32_t ds; uint32_t ds_upper; uint32_t es; uint32_t es_upper; uint32_t fs; uint32_t fs_upper; uint32_t gs; uint32_t gs_upper; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, ::user_regs_struct, user_regs_struct); struct sigcontext { uint64_t r8; uint64_t r9; uint64_t r10; uint64_t r11; uint64_t r12; uint64_t r13; uint64_t r14; uint64_t r15; uint64_t di; uint64_t si; uint64_t bp; uint64_t bx; uint64_t dx; uint64_t ax; uint64_t cx; uint64_t sp; uint64_t ip; uint64_t flags; uint16_t cs; uint16_t gs; uint16_t fs; uint16_t __pad0; uint64_t err; uint64_t trapno; uint64_t oldmask; uint64_t cr2; uint64_t fpstate; uint64_t reserved[8]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, ::sigcontext, sigcontext); struct user_fpregs_struct { uint16_t cwd; uint16_t swd; uint16_t ftw; uint16_t fop; uint64_t rip; uint64_t rdp; uint32_t mxcsr; uint32_t mxcr_mask; uint32_t st_space[32]; uint32_t xmm_space[64]; uint32_t padding[24]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, ::user_fpregs_struct, user_fpregs_struct); struct ucontext { uint64_t ucflags; ptr uc_link; stack_t uc_stack; struct sigcontext uc_mcontext; sigset_t uc_sigmask; user_fpregs_struct uc_fpregs; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, ::ucontext, ucontext); struct rt_sigframe { ptr pretcode; struct ucontext uc; siginfo_t info; }; struct user { struct user_regs_struct regs; int u_fpvalid; struct user_fpregs_struct i387; uint64_t u_tsize; uint64_t u_dsize; uint64_t u_ssize; uint64_t start_code; uint64_t start_stack; int64_t signal; int reserved; union { struct user_regs_struct* u_ar0; uint64_t __u_ar0_word; }; union { struct user_fpregs_struct* u_fpstate; uint64_t __u_fpstate_word; }; uint64_t magic; char u_comm[32]; uint64_t u_debugreg[8]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, ::user, user); struct stat { dev_t st_dev; ino_t st_ino; nlink_t st_nlink; mode_t st_mode; uid_t st_uid; gid_t st_gid; int __pad0; dev_t st_rdev; off_t st_size; blksize_t st_blksize; blkcnt_t st_blocks; struct timespec st_atim; struct timespec st_mtim; struct timespec st_ctim; syscall_slong_t __unused[3]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, struct ::stat, struct stat); struct stat64 { dev_t st_dev; ino_t st_ino; nlink_t st_nlink; mode_t st_mode; uid_t st_uid; gid_t st_gid; int __pad0; dev_t st_rdev; off_t st_size; blksize_t st_blksize; blkcnt_t st_blocks; struct timespec st_atim; struct timespec st_mtim; struct timespec st_ctim; syscall_slong_t __unused[3]; }; RR_VERIFY_TYPE_ARCH(SupportedArch::x86_64, struct ::stat64, struct stat64); }; #define RR_ARCH_FUNCTION(f, arch, args...) \ switch (arch) { \ default: \ assert(0 && "Unknown architecture"); \ case x86: \ return f(args); \ case x86_64: \ return f(args); \ } #include "SyscallHelperFunctions.generated" /** * Return true if |ptr| in task |t| points to an invoke-syscall instruction. */ bool is_at_syscall_instruction(Task* t, remote_code_ptr ptr); /** * Return the code bytes of an invoke-syscall instruction. The vector must * have the length given by |syscall_instruction_length|. */ std::vector syscall_instruction(SupportedArch arch); /** * Return the length of all invoke-syscall instructions. Currently, * they must all have the same length! */ ssize_t syscall_instruction_length(SupportedArch arch); void set_arch_siginfo(const siginfo_t& siginfo, SupportedArch a, void* dest, size_t dest_size); #if defined(__i386__) typedef X86Arch NativeArch; #elif defined(__x86_64__) typedef X64Arch NativeArch; #else #error need to define new NativeArch #endif } // namespace rr // New in the 4.6 kernel. #ifndef CLONE_NEWCGROUP #define CLONE_NEWCGROUP 0x02000000 #endif #endif /* RR_KERNEL_ABI_H */ rr-4.4.0/src/kernel_metadata.cc000066400000000000000000000212671277367620400164060ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "kernel_metadata.h" #include #include #include #include #include #include #include "kernel_abi.h" #include "kernel_supplement.h" #include "log.h" using namespace std; namespace rr { #include "SyscallnameArch.generated" string syscall_name(int syscall, SupportedArch arch) { RR_ARCH_FUNCTION(syscallname_arch, arch, syscall) } #define CASE(_id) \ case _id: \ return #_id; string ptrace_event_name(int event) { switch (event) { CASE(PTRACE_EVENT_FORK); CASE(PTRACE_EVENT_VFORK); CASE(PTRACE_EVENT_CLONE); CASE(PTRACE_EVENT_EXEC); CASE(PTRACE_EVENT_VFORK_DONE); CASE(PTRACE_EVENT_EXIT); /* XXX Ubuntu 12.04 defines a "PTRACE_EVENT_STOP", but that * has the same value as the newer EVENT_SECCOMP, so we'll * ignore STOP. */ CASE(PTRACE_EVENT_SECCOMP_OBSOLETE); CASE(PTRACE_EVENT_SECCOMP); CASE(PTRACE_EVENT_STOP); default: { char buf[100]; sprintf(buf, "PTRACE_EVENT(%d)", event); return string(buf); } } } string ptrace_req_name(int request) { switch (request) { CASE(PTRACE_TRACEME); CASE(PTRACE_PEEKTEXT); CASE(PTRACE_PEEKDATA); CASE(PTRACE_PEEKUSER); CASE(PTRACE_POKETEXT); CASE(PTRACE_POKEDATA); CASE(PTRACE_POKEUSER); CASE(PTRACE_CONT); CASE(PTRACE_KILL); CASE(PTRACE_SINGLESTEP); CASE(PTRACE_GETREGS); CASE(PTRACE_SETREGS); CASE(PTRACE_GETFPREGS); CASE(PTRACE_SETFPREGS); CASE(PTRACE_ATTACH); CASE(PTRACE_DETACH); CASE(PTRACE_GETFPXREGS); CASE(PTRACE_SETFPXREGS); CASE(PTRACE_SYSCALL); CASE(PTRACE_SETOPTIONS); CASE(PTRACE_GETEVENTMSG); CASE(PTRACE_GETSIGINFO); CASE(PTRACE_SETSIGINFO); CASE(PTRACE_GETREGSET); CASE(PTRACE_SETREGSET); CASE(PTRACE_SEIZE); CASE(PTRACE_INTERRUPT); CASE(PTRACE_LISTEN); // These aren't part of the official ptrace-request enum. CASE(PTRACE_SYSEMU); CASE(PTRACE_SYSEMU_SINGLESTEP); default: { char buf[100]; sprintf(buf, "PTRACE_REQUEST(%d)", request); return string(buf); } } } string signal_name(int sig) { /* strsignal() would be nice to use here, but it provides TMI. */ if (32 <= sig && sig <= 64) { char buf[100]; snprintf(buf, sizeof(buf) - 1, "SIGRT%d", sig); return buf; } switch (sig) { CASE(SIGHUP); CASE(SIGINT); CASE(SIGQUIT); CASE(SIGILL); CASE(SIGTRAP); CASE(SIGABRT); /*CASE(SIGIOT);*/ CASE(SIGBUS); CASE(SIGFPE); CASE(SIGKILL); CASE(SIGUSR1); CASE(SIGSEGV); CASE(SIGUSR2); CASE(SIGPIPE); CASE(SIGALRM); CASE(SIGTERM); CASE(SIGSTKFLT); /*CASE(SIGCLD);*/ CASE(SIGCHLD); CASE(SIGCONT); CASE(SIGSTOP); CASE(SIGTSTP); CASE(SIGTTIN); CASE(SIGTTOU); CASE(SIGURG); CASE(SIGXCPU); CASE(SIGXFSZ); CASE(SIGVTALRM); CASE(SIGPROF); CASE(SIGWINCH); /*CASE(SIGPOLL);*/ CASE(SIGIO); CASE(SIGPWR); CASE(SIGSYS); default: { char buf[100]; sprintf(buf, "signal(%d)", sig); return string(buf); } } } bool is_sigreturn(int syscallno, SupportedArch arch) { return is_sigreturn_syscall(syscallno, arch) || is_rt_sigreturn_syscall(syscallno, arch); } string errno_name(int err) { switch (err) { case 0: return "SUCCESS"; CASE(EPERM); CASE(ENOENT); CASE(ESRCH); CASE(EINTR); CASE(EIO); CASE(ENXIO); CASE(E2BIG); CASE(ENOEXEC); CASE(EBADF); CASE(ECHILD); CASE(EAGAIN); CASE(ENOMEM); CASE(EACCES); CASE(EFAULT); CASE(ENOTBLK); CASE(EBUSY); CASE(EEXIST); CASE(EXDEV); CASE(ENODEV); CASE(ENOTDIR); CASE(EISDIR); CASE(EINVAL); CASE(ENFILE); CASE(EMFILE); CASE(ENOTTY); CASE(ETXTBSY); CASE(EFBIG); CASE(ENOSPC); CASE(ESPIPE); CASE(EROFS); CASE(EMLINK); CASE(EPIPE); CASE(EDOM); CASE(ERANGE); CASE(EDEADLK); CASE(ENAMETOOLONG); CASE(ENOLCK); CASE(ENOSYS); CASE(ENOTEMPTY); CASE(ELOOP); CASE(ENOMSG); CASE(EIDRM); CASE(ECHRNG); CASE(EL2NSYNC); CASE(EL3HLT); CASE(EL3RST); CASE(ELNRNG); CASE(EUNATCH); CASE(ENOCSI); CASE(EL2HLT); CASE(EBADE); CASE(EBADR); CASE(EXFULL); CASE(ENOANO); CASE(EBADRQC); CASE(EBADSLT); CASE(EBFONT); CASE(ENOSTR); CASE(ENODATA); CASE(ETIME); CASE(ENOSR); CASE(ENONET); CASE(ENOPKG); CASE(EREMOTE); CASE(ENOLINK); CASE(EADV); CASE(ESRMNT); CASE(ECOMM); CASE(EPROTO); CASE(EMULTIHOP); CASE(EDOTDOT); CASE(EBADMSG); CASE(EOVERFLOW); CASE(ENOTUNIQ); CASE(EBADFD); CASE(EREMCHG); CASE(ELIBACC); CASE(ELIBBAD); CASE(ELIBSCN); CASE(ELIBMAX); CASE(ELIBEXEC); CASE(EILSEQ); CASE(ERESTART); CASE(ESTRPIPE); CASE(EUSERS); CASE(ENOTSOCK); CASE(EDESTADDRREQ); CASE(EMSGSIZE); CASE(EPROTOTYPE); CASE(ENOPROTOOPT); CASE(EPROTONOSUPPORT); CASE(ESOCKTNOSUPPORT); CASE(EOPNOTSUPP); CASE(EPFNOSUPPORT); CASE(EAFNOSUPPORT); CASE(EADDRINUSE); CASE(EADDRNOTAVAIL); CASE(ENETDOWN); CASE(ENETUNREACH); CASE(ENETRESET); CASE(ECONNABORTED); CASE(ECONNRESET); CASE(ENOBUFS); CASE(EISCONN); CASE(ENOTCONN); CASE(ESHUTDOWN); CASE(ETOOMANYREFS); CASE(ETIMEDOUT); CASE(ECONNREFUSED); CASE(EHOSTDOWN); CASE(EHOSTUNREACH); CASE(EALREADY); CASE(EINPROGRESS); CASE(ESTALE); CASE(EUCLEAN); CASE(ENOTNAM); CASE(ENAVAIL); CASE(EISNAM); CASE(EREMOTEIO); CASE(EDQUOT); CASE(ENOMEDIUM); CASE(EMEDIUMTYPE); CASE(ECANCELED); CASE(ENOKEY); CASE(EKEYEXPIRED); CASE(EKEYREVOKED); CASE(EKEYREJECTED); CASE(EOWNERDEAD); CASE(ENOTRECOVERABLE); CASE(ERFKILL); CASE(EHWPOISON); default: { char buf[100]; sprintf(buf, "errno(%d)", err); return string(buf); } } } string sicode_name(int code, int sig) { switch (code) { CASE(SI_USER); CASE(SI_KERNEL); CASE(SI_QUEUE); CASE(SI_TIMER); CASE(SI_MESGQ); CASE(SI_ASYNCIO); CASE(SI_SIGIO); CASE(SI_TKILL); CASE(SI_ASYNCNL); } switch (sig) { case SIGSEGV: switch (code) { CASE(SEGV_MAPERR); CASE(SEGV_ACCERR); } break; case SIGTRAP: switch (code) { CASE(TRAP_BRKPT); CASE(TRAP_TRACE); } break; case SIGILL: switch (code) { CASE(ILL_ILLOPC); CASE(ILL_ILLOPN); CASE(ILL_ILLADR); CASE(ILL_ILLTRP); CASE(ILL_PRVOPC); CASE(ILL_PRVREG); CASE(ILL_COPROC); CASE(ILL_BADSTK); } break; case SIGFPE: switch (code) { CASE(FPE_INTDIV); CASE(FPE_INTOVF); CASE(FPE_FLTDIV); CASE(FPE_FLTOVF); CASE(FPE_FLTUND); CASE(FPE_FLTRES); CASE(FPE_FLTINV); CASE(FPE_FLTSUB); } break; case SIGBUS: switch (code) { CASE(BUS_ADRALN); CASE(BUS_ADRERR); CASE(BUS_OBJERR); CASE(BUS_MCEERR_AR); CASE(BUS_MCEERR_AO); } break; case SIGCHLD: switch (code) { CASE(CLD_EXITED); CASE(CLD_KILLED); CASE(CLD_DUMPED); CASE(CLD_TRAPPED); CASE(CLD_STOPPED); CASE(CLD_CONTINUED); } break; case SIGPOLL: switch (code) { CASE(POLL_IN); CASE(POLL_OUT); CASE(POLL_MSG); CASE(POLL_ERR); CASE(POLL_PRI); CASE(POLL_HUP); } break; } char buf[100]; sprintf(buf, "sicode(%d)", code); return string(buf); } std::ostream& operator<<(std::ostream& stream, const siginfo_t& siginfo) { stream << "{signo:" << signal_name(siginfo.si_signo) << ",errno:" << errno_name(siginfo.si_errno) << ",code:" << sicode_name(siginfo.si_code, siginfo.si_signo); switch (siginfo.si_signo) { case SIGILL: case SIGFPE: case SIGSEGV: case SIGBUS: case SIGTRAP: stream << ",addr:" << siginfo.si_addr; break; } stream << "}"; return stream; } int shm_flags_to_mmap_prot(int flags) { return PROT_READ | ((flags & SHM_RDONLY) ? 0 : PROT_WRITE) | ((flags & SHM_EXEC) ? PROT_EXEC : 0); } } // namespace rr rr-4.4.0/src/kernel_metadata.h000066400000000000000000000024451277367620400162450ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_SYSCALLS_H_ #define RR_SYSCALLS_H_ #include #include #include #include "kernel_abi.h" namespace rr { /** * Return the symbolic name of |syscall|, f.e. "read", or "syscall(%d)" * if unknown. */ std::string syscall_name(int syscall, SupportedArch arch); /** * Return the symbolic name of the PTRACE_EVENT_* |event|, or * "PTRACE_EVENT(%d)" if unknown. */ std::string ptrace_event_name(int event); /** * Return the symbolic name of the PTRACE_ |request|, or "PTRACE_REQUEST(%d)" if * unknown. */ std::string ptrace_req_name(int request); /** * Return the symbolic name of |sig|, f.e. "SIGILL", or "signal(%d)" if * unknown. */ std::string signal_name(int sig); /** * Return true if this is some kind of sigreturn syscall. */ bool is_sigreturn(int syscall, SupportedArch arch); /** * Return the symbolic error name (e.g. "EINVAL") for errno. */ std::string errno_name(int err); /** * Return the symbolic name (e.g. "SI_USER") for an si_code. */ std::string sicode_name(int code, int sig); /** * Print siginfo on ostream. */ std::ostream& operator<<(std::ostream& stream, const siginfo_t& siginfo); int shm_flags_to_mmap_prot(int flags); } // namespace rr #endif rr-4.4.0/src/kernel_supplement.h000066400000000000000000000074721277367620400166660ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_KERNEL_SUPPLEMENT_H_ #define RR_KERNEL_SUPPLEMENT_H_ #include #include #include #include #include #include namespace rr { /* Definitions that should be part of system headers (and maybe are on some but * not all systems). * This should not contain anything for which rr needs all the definitions * across architectures; those definitions belong in kernel_abi.h. */ #ifndef PTRACE_EVENT_NONE #define PTRACE_EVENT_NONE 0 #endif #ifndef PTRACE_EVENT_STOP #define PTRACE_EVENT_STOP 128 #endif #ifndef PTRACE_SYSEMU #define PTRACE_SYSEMU 31 #endif #ifndef PTRACE_SYSEMU_SINGLESTEP #define PTRACE_SYSEMU_SINGLESTEP 32 #endif #ifndef PTRACE_O_TRACESECCOMP #define PTRACE_O_TRACESECCOMP 0x00000080 #define PTRACE_EVENT_SECCOMP_OBSOLETE 8 // ubuntu 12.04 #define PTRACE_EVENT_SECCOMP 7 // ubuntu 12.10 and future kernels #endif #ifndef PTRACE_O_EXITKILL #define PTRACE_O_EXITKILL (1 << 20) #endif #ifndef SECCOMP_SET_MODE_STRICT #define SECCOMP_SET_MODE_STRICT 0 #endif #ifndef SECCOMP_SET_MODE_FILTER #define SECCOMP_SET_MODE_FILTER 1 #endif #ifndef SECCOMP_FILTER_FLAG_TSYNC #define SECCOMP_FILTER_FLAG_TSYNC 1 #endif #ifndef SYS_SECCOMP #define SYS_SECCOMP 1 #endif // These are defined by the include/linux/errno.h in the kernel tree. // Since userspace doesn't see these errnos in normal operation, that // header apparently isn't distributed with libc. #define ERESTARTSYS 512 #define ERESTARTNOINTR 513 #define ERESTARTNOHAND 514 #define ERESTART_RESTARTBLOCK 516 // These definitions haven't made it out to current libc-dev packages // yet. #ifndef GRND_NONBLOCK #define GRND_NONBLOCK 0x0001 #define GRND_RANDOM 0x0002 #endif /* We need to complement sigsets in order to update the Task blocked * set, but POSIX doesn't appear to define a convenient helper. So we * define our own linux-compatible sig_set_t and use bit operators to * manipulate sigsets. */ typedef uint64_t sig_set_t; static_assert(_NSIG / 8 == sizeof(sig_set_t), "Update sig_set_t for _NSIG."); #ifndef BTRFS_IOCTL_MAGIC #define BTRFS_IOCTL_MAGIC 0x94 #endif #ifndef BTRFS_IOC_CLONE #define BTRFS_IOC_CLONE _IOW(BTRFS_IOCTL_MAGIC, 9, int) #endif #ifndef BTRFS_IOC_CLONE_RANGE struct btrfs_ioctl_clone_range_args { int64_t src_fd; uint64_t src_offset; uint64_t src_length; uint64_t dest_offset; }; #define BTRFS_IOC_CLONE_RANGE \ _IOW(BTRFS_IOCTL_MAGIC, 13, struct btrfs_ioctl_clone_range_args) #endif #ifndef USBDEVFS_GET_CAPABILITIES #define USBDEVFS_GET_CAPABILITIES _IOR('U', 26, __u32) #endif #ifndef USBDEVFS_DISCONNECT_CLAIM struct usbdevfs_disconnect_claim { unsigned int interface; unsigned int flags; char driver[USBDEVFS_MAXDRIVERNAME + 1]; }; #define USBDEVFS_DISCONNECT_CLAIM \ _IOR('U', 27, struct usbdevfs_disconnect_claim) #endif #ifndef USBDEVFS_ALLOC_STREAMS struct usbdevfs_streams { unsigned int num_streams; unsigned int num_eps; unsigned char eps[0]; }; #define USBDEVFS_ALLOC_STREAMS _IOR('U', 28, struct usbdevfs_streams) #define USBDEVFS_FREE_STREAMS _IOR('U', 29, struct usbdevfs_streams) #endif #ifndef TIOCGPKT #define TIOCGPKT _IOR('T', 0x38, int) #endif #ifndef TIOCGPTLCK #define TIOCGPTLCK _IOR('T', 0x39, int) #endif #ifndef TIOCGEXCL #define TIOCGEXCL _IOR('T', 0x40, int) #endif #ifndef MADV_FREE #define MADV_FREE 8 #endif #ifndef MADV_DONTDUMP #define MADV_DONTDUMP 16 #endif #ifndef MADV_DODUMP #define MADV_DODUMP 17 #endif #ifndef MADV_SOFT_OFFLINE #define MADV_SOFT_OFFLINE 101 #endif #ifndef BUS_MCEERR_AR #define BUS_MCEERR_AR 4 #endif #ifndef BUS_MCEERR_AO #define BUS_MCEERR_AO 5 #endif } // namespace rr #endif /* RR_KERNEL_SUPPLEMENT_H_ */ rr-4.4.0/src/log.cc000066400000000000000000000175431277367620400140510ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "log.h" #include #include #include #include #include "Flags.h" #include "GdbServer.h" #include "RecordSession.h" #include "ftrace.h" #include "kernel_metadata.h" #include "util.h" using namespace std; namespace rr { struct LogModule { string name; LogLevel level; }; static LogLevel to_log_level(const string& str) { if (str == "debug") { return LOG_debug; } if (str == "info") { return LOG_info; } if (str == "warn") { return LOG_warn; } if (str == "error") { return LOG_error; } if (str == "fatal") { return LOG_fatal; } fprintf(stderr, "Log level %s in RR_LOG is not valid, assuing 'fatal'\n", str.c_str()); return LOG_fatal; } static char simple_to_lower(char ch) { // to_lower sucks because it's locale-dependent if (ch >= 'A' && ch <= 'Z') { return ch + 'a' - 'A'; } return ch; } static string simple_to_lower(const string& s) { char* buf = new char[s.size() + 1]; for (size_t i = 0; i < s.size(); ++i) { buf[i] = simple_to_lower(s[i]); } buf[s.size()] = 0; return string(buf); } #if __has_attribute(require_constant_initialization) #define _CONSTANT_STATIC \ __attribute__((__require_constant_initialization__)) static #else #define _CONSTANT_STATIC static #endif static bool log_globals_initialized = false; static LogLevel default_level = LOG_error; // These need to be available to other static constructors, so we need to be // sure that they const constant-initialized. Unfortunately some versions of C++ // libraries have a bug that causes them not to be. _CONSTANT_STATIC should // turn this into a compile error rather than a runtime crash for compilers // that support the attribute. _CONSTANT_STATIC unique_ptr> level_map; _CONSTANT_STATIC unique_ptr> log_modules; _CONSTANT_STATIC std::unique_ptr logging_stream; static void init_log_globals() { if (log_globals_initialized) { return; } log_globals_initialized = true; level_map = unique_ptr>( new unordered_map()); log_modules = unique_ptr>( new unordered_map()); logging_stream = unique_ptr(new stringstream()); const char* log_env = "RR_LOG"; if (running_under_rr()) { log_env = "RR_UNDER_RR_LOG"; } char* env = getenv(log_env); if (env) { env = strdup(env); for (int i = 0; env[i]; ++i) { env[i] = simple_to_lower(env[i]); } char* p = env; while (*p) { char* end = strchrnul(p, ','); char* sep = strchrnul(p, ':'); string n; LogLevel level; if (sep >= end) { n = string(p, end - p); level = LOG_debug; } else { n = string(p, sep - p); if (sep + 1 == end) { level = LOG_fatal; } else { level = to_log_level(string(sep + 1, end - (sep + 1))); } } if (n == "" || n == "all") { level_map->clear(); default_level = level; } else { (*level_map)[n] = level; } if (*end) { p = end + 1; } else { p = end; } } free(env); } } static LogLevel get_log_level(const string& name) { init_log_globals(); auto it = level_map->find(simple_to_lower(name)); if (it == level_map->end()) { return default_level; } return it->second; } static string file_to_name(const char* file) { const char* base = strrchr(file, '/'); if (base) { ++base; } else { base = file; } const char* dot = strrchr(base, '.'); string r; if (dot) { r = string(base, dot - base); } else { r = string(base); } return r; } static LogModule& get_log_module(const char* file) { init_log_globals(); auto it = log_modules->find(file); if (it != log_modules->end()) { return it->second; } LogModule m; m.name = file_to_name(file); m.level = get_log_level(m.name); (*log_modules)[file] = m; return (*log_modules)[file]; } void set_all_logging(LogLevel level) { default_level = level; level_map->clear(); log_modules->clear(); } void set_logging(const char* name, LogLevel level) { (*level_map)[simple_to_lower(name)] = level; log_modules->clear(); } static const char* log_name(LogLevel level) { switch (level) { case LOG_fatal: return "FATAL"; case LOG_error: return "ERROR"; case LOG_warn: return "WARN"; case LOG_info: return "INFO"; default: return "???"; } } ostream& log_stream() { init_log_globals(); return *logging_stream; } static void flush_log_stream() { cerr << logging_stream->str(); ftrace::write(logging_stream->str()); logging_stream->str(string()); } template static void write_prefix(T& stream, LogLevel level, const char* file, int line, const char* function) { int err = errno; stream << "[" << log_name(level) << " "; if (level <= LOG_error) { stream << file << ":" << line << ":"; } stream << function << "()"; if (level <= LOG_warn) { stream << " errno: " << errno_name(err); } stream << "] "; } NewlineTerminatingOstream::NewlineTerminatingOstream(LogLevel level, const char* file, int line, const char* function) : level(level) { LogModule& m = get_log_module(file); enabled = level <= m.level; if (enabled) { if (level == LOG_debug) { *this << "[" << m.name << "] "; } else { write_prefix(*this, level, file, line, function); } } } NewlineTerminatingOstream::~NewlineTerminatingOstream() { if (enabled) { log_stream() << std::endl; flush_log_stream(); if (Flags::get().fatal_errors_and_warnings && level <= LOG_warn) { abort(); } } } FatalOstream::FatalOstream(const char* file, int line, const char* function) { write_prefix(*this, LOG_fatal, file, line, function); } FatalOstream::~FatalOstream() { log_stream() << std::endl; flush_log_stream(); abort(); } static void emergency_debug(Task* t) { ftrace::stop(); // Enable SIGINT in case it was disabled. Users want to be able to ctrl-C // out of this. struct sigaction sa; memset(&sa, 0, sizeof(sa)); sa.sa_handler = SIG_DFL; sigaction(SIGINT, &sa, nullptr); RecordSession* record_session = t->session().as_record(); if (record_session) { record_session->trace_writer().close(); } if (probably_not_interactive() && !Flags::get().force_things) { errno = 0; FATAL() << "(session doesn't look interactive, aborting emergency debugging)"; } GdbServer::emergency_debug(t); FATAL() << "Can't resume execution from invalid state"; } EmergencyDebugOstream::EmergencyDebugOstream(bool cond, const Task* t, const char* file, int line, const char* function, const char* cond_str) : t(const_cast(t)), cond(cond) { if (!cond) { write_prefix(*this, LOG_fatal, file, line, function); *this << "\n (task " << t->tid << " (rec:" << t->rec_tid << ") at time " << t->trace_time() << ")" << "\n -> Assertion `" << cond_str << "' failed to hold. "; } } EmergencyDebugOstream::~EmergencyDebugOstream() { if (!cond) { log_stream() << std::endl; flush_log_stream(); t->log_pending_events(); emergency_debug(t); } } ostream& operator<<(ostream& stream, const vector& bytes) { for (uint32_t i = 0; i < bytes.size(); ++i) { if (i > 0) { stream << ' '; } stream << HEX(bytes[i]); } return stream; } } // namespace rr rr-4.4.0/src/log.h000066400000000000000000000072511277367620400137060ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_LOG_H #define RR_LOG_H #include #include #include namespace rr { class Task; enum LogLevel { LOG_fatal, LOG_error, LOG_warn, LOG_info, LOG_debug }; /** * Return the ostream to which log data will be written. */ std::ostream& log_stream(); /** * Dynamically set all log levels to 'level' */ void set_all_logging(LogLevel level); /** * Set log level for 'name' to 'level' */ void set_logging(const char* name, LogLevel level); std::ostream& operator<<(std::ostream& stream, const std::vector& bytes); std::ostream& operator<<(std::ostream& stream, const std::vector& bytes); struct NewlineTerminatingOstream { NewlineTerminatingOstream(LogLevel level, const char* file, int line, const char* function); ~NewlineTerminatingOstream(); bool enabled; LogLevel level; }; template const NewlineTerminatingOstream& operator<<( const NewlineTerminatingOstream& stream, const T& v) { if (stream.enabled) { log_stream() << v; } return stream; } // TODO: support stream modifiers. struct FatalOstream { FatalOstream(const char* file, int line, const char* function); ~FatalOstream(); }; template const FatalOstream& operator<<(const FatalOstream& stream, const T& v) { log_stream() << v; return stream; } struct EmergencyDebugOstream { EmergencyDebugOstream(bool cond, const Task* t, const char* file, int line, const char* function, const char* cond_str); ~EmergencyDebugOstream(); Task* t; bool cond; }; template const EmergencyDebugOstream& operator<<(const EmergencyDebugOstream& stream, const T& v) { if (!stream.cond) { log_stream() << v; } return stream; } /** * Write logging output at the given level, which can be one of |{ * error, warn, info, debug }| in decreasing order of severity. */ #define LOG(_level) \ NewlineTerminatingOstream(LOG_##_level, __FILE__, __LINE__, __FUNCTION__) /** A fatal error has occurred. Log the error and exit. */ #define FATAL() FatalOstream(__FILE__, __LINE__, __FUNCTION__) #ifndef __has_builtin #define __has_builtin(x) 0 #endif #if __has_builtin(__builtin_expect) || __GNUC_PREREQ(4, 0) #define RR_UNLIKELY(EXPR) __builtin_expect((bool)(EXPR), false) #else #define RR_UNLIKELY(EXPR) (EXPR) #endif /** * Assert a condition related to a Task. If the condition fails, an * emergency debugger for the task is launched. */ #define ASSERT(_t, _cond) \ EmergencyDebugOstream(_cond, _t, __FILE__, __LINE__, __FUNCTION__, #_cond) #define ASSERT_ACTIONS(_t, _cond, _actions) \ do { \ bool _ASSERT_cond = _cond; \ if (RR_UNLIKELY(!_ASSERT_cond)) { \ EmergencyDebugOstream(_ASSERT_cond, _t, __FILE__, __LINE__, \ __FUNCTION__, #_cond) _actions; \ } \ } while (0) /** * Ensure that |_v| is streamed in hex format. * We make sure that signed types are *not* sign-extended. */ template inline void* HEX(T v) { return reinterpret_cast( static_cast::type>(v)); } } // namespace rr #endif // RR_LOG_H rr-4.4.0/src/main.cc000066400000000000000000000211411277367620400142010ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "main.h" #include #include #include #include #include #include #include "Command.h" #include "Flags.h" #include "RecordCommand.h" #include "log.h" using namespace std; namespace rr { // Show version and quit. static bool show_version = false; void assert_prerequisites(bool use_syscall_buffer) { struct utsname uname_buf; memset(&uname_buf, 0, sizeof(uname_buf)); if (!uname(&uname_buf)) { unsigned int major, minor; char dot; stringstream stream(uname_buf.release); stream >> major >> dot >> minor; if (KERNEL_VERSION(major, minor, 0) < KERNEL_VERSION(3, 4, 0)) { FATAL() << "Kernel doesn't support necessary ptrace " << "functionality; need 3.4.0 or better."; } if (use_syscall_buffer && KERNEL_VERSION(major, minor, 0) < KERNEL_VERSION(3, 5, 0)) { FATAL() << "Your kernel does not support syscall " << "filtering; please use the -n option"; } } } void check_performance_settings() { if (Flags::get().suppress_environment_warnings) { return; } // NB: we hard-code "cpu0" here because rr pins itself and all // tracees to cpu 0. We don't care about the other CPUs. ScopedFd fd("/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor", O_RDONLY); if (0 > fd) { // If the file doesn't exist, the system probably // doesn't have the ability to frequency-scale, for // example a VM. LOG(info) << "Unable to check CPU-frequency governor."; return; } char governor[PATH_MAX]; ssize_t nread = read(fd, governor, sizeof(governor) - 1); if (0 > nread) { FATAL() << "Unable to read cpu0's frequency governor."; } governor[nread] = '\0'; ssize_t len = strlen(governor); if (len > 0) { // Eat the '\n'. governor[len - 1] = '\0'; } LOG(info) << "cpu0's frequency governor is '" << governor << "'"; if (strcmp("performance", governor)) { fprintf(stderr, "\n" "rr: Warning: Your CPU frequency governor is '%s'. rr strongly\n" " recommends that you use the 'performance' governor. Not " "using the\n" " 'performance' governor can cause rr to be at least 2x slower\n" " on laptops.\n" "\n" " On Fedora-based systems, you can enable the 'performance' " "governor\n" " by running the following commands:\n" "\n" " $ sudo dnf install kernel-tools\n" " $ sudo cpupower frequency-set -g performance\n" "\n", governor); // TODO: It would be nice to bail here or do something // clever to enable the 'performance' just for rr, but // that seems too hard at the moment. } } void print_version(FILE* out) { fprintf(out, "rr version %s\n", RR_VERSION); } void print_usage(FILE* out) { print_version(out); fputs("Usage:\n", out); Command::print_help_all(out); fputs( "\n" "Common options:\n" " -A, --microarch= force rr to assume it's running on a CPU\n" " with microarch NAME even if runtime " "detection\n" " says otherwise. NAME should be a string " "like\n" " 'Ivy Bridge'. Note that rr will not work " "with\n" " Intel Merom or Penryn microarchitectures.\n" " -C, --checksum={on-syscalls,on-all-events}|FROM_TIME\n" " compute and store (during recording) or\n" " read and verify (during replay) checksums\n" " of each of a tracee's memory mappings " "either\n" " at the end of all syscalls " "(`on-syscalls'),\n" " at all events (`on-all-events'), or \n" " starting from a global timepoint " "FROM_TIME\n" " -D, --dump-on=\n" " dump memory at SYSCALL or SIGNAL to the\n" " file " "`[trace_dir]/[tid].[time]_{rec,rep}':\n" " `_rec' for dumps during recording, `_rep'\n" " for dumps during replay\n" " -F, --force-things force rr to do some things that don't " "seem\n" " like good ideas, for example launching an\n" " interactive emergency debugger if stderr\n" " isn't a tty.\n" " -K, --check-cached-mmaps verify that cached task mmaps match " "/proc/maps\n" " -E, --fatal-errors any warning or error that is printed is\n" " treated as fatal\n" " -M, --mark-stdio mark stdio writes with [rr ]\n" " where EV is the global trace time at\n" " which the write occurs and PID is the pid\n" " of the process it occurs in.\n" " -N, --version print the version number and exit\n" " -S, --suppress-environment-warnings\n" " suppress warnings about issues in the\n" " environment that rr has no control over\n" " -T, --dump-at=TIME dump memory at global timepoint TIME\n" " -V, --verbose log messages that may not be urgently \n" " critical to the user\n" "\n" "Use RR_LOG to control logging; e.g. RR_LOG=all:warn,Task:debug\n", out); } static void init_random() { // Not very good, but good enough for our non-security-sensitive needs. int key = time(nullptr) ^ getpid(); srandom(key); srand(key); } bool parse_global_option(std::vector& args) { static const OptionSpec options[] = { { 'C', "checksum", HAS_PARAMETER }, { 'K', "check-cached-mmaps", NO_PARAMETER }, { 'U', "cpu-unbound", NO_PARAMETER }, { 'T', "dump-at", HAS_PARAMETER }, { 'D', "dump-on", HAS_PARAMETER }, { 'F', "force-things", NO_PARAMETER }, { 'A', "microarch", HAS_PARAMETER }, { 'M', "mark-stdio", NO_PARAMETER }, { 'S', "suppress-environment-warnings", NO_PARAMETER }, { 'E', "fatal-errors", NO_PARAMETER }, { 'V', "verbose", NO_PARAMETER }, { 'N', "version", NO_PARAMETER } }; ParsedOption opt; if (!Command::parse_option(args, options, &opt)) { return false; } Flags& flags = Flags::get_for_init(); switch (opt.short_name) { case 'A': flags.forced_uarch = opt.value; break; case 'C': if (opt.value == "on-syscalls") { LOG(info) << "checksumming on syscall exit"; flags.checksum = Flags::CHECKSUM_SYSCALL; } else if (opt.value == "on-all-events") { LOG(info) << "checksumming on all events"; flags.checksum = Flags::CHECKSUM_ALL; } else { flags.checksum = atoi(opt.value.c_str()); LOG(info) << "checksumming on at event " << flags.checksum; } break; case 'D': if (opt.value == "RDTSC") { flags.dump_on = Flags::DUMP_ON_RDTSC; } else { flags.dump_on = atoi(opt.value.c_str()); } break; case 'E': flags.fatal_errors_and_warnings = true; break; case 'F': flags.force_things = true; break; case 'K': flags.check_cached_mmaps = true; break; case 'M': flags.mark_stdio = true; break; case 'S': flags.suppress_environment_warnings = true; break; case 'T': flags.dump_at = atoi(opt.value.c_str()); break; case 'N': show_version = true; break; default: assert(0 && "Invalid flag"); } return true; } } // namespace rr using namespace rr; int main(int argc, char* argv[]) { init_random(); vector args; for (int i = 1; i < argc; ++i) { args.push_back(argv[i]); } while (parse_global_option(args)) { } if (show_version) { print_version(stdout); return 0; } if (args.size() == 0) { print_usage(stderr); return 1; } auto command = Command::command_for_name(args[0]); if (command) { args.erase(args.begin()); } else { if (!Command::verify_not_option(args)) { print_usage(stderr); return 1; } command = RecordCommand::get(); } return command->run(args); } rr-4.4.0/src/main.h000066400000000000000000000006141277367620400140450ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_MAIN_H_ #define RR_MAIN_H_ #include #include namespace rr { void assert_prerequisites(bool use_syscall_buffer = false); void check_performance_settings(); void print_usage(FILE*); bool parse_global_option(std::vector& args); } // namespace rr #endif // RR_MAIN_H_ rr-4.4.0/src/preload/000077500000000000000000000000001277367620400143755ustar00rootroot00000000000000rr-4.4.0/src/preload/breakpoint_table.S000066400000000000000000000010221277367620400200210ustar00rootroot00000000000000#if defined(__i386__) || defined(__x86_64__) .text .global _breakpoint_table_entry_start .hidden _breakpoint_table_entry_start _breakpoint_table_entry_start: ret .global _breakpoint_table_entry_end .hidden _breakpoint_table_entry_end _breakpoint_table_entry_end: .rept 131071 /* SYSCALLBUF_BUFFER_SIZE/8 - 1 */ ret .endr #else #error unknown CPU architecture #endif /* __i386__/__x86_64__ */ .section .note.GNU-stack,"",@progbits .previous rr-4.4.0/src/preload/preload.c000066400000000000000000002555651277367620400162110ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define RR_IMPLEMENT_PRELOAD #ifndef _GNU_SOURCE #define _GNU_SOURCE 1 #endif #include "preload_interface.h" /** * Buffer syscalls, so that rr can process the entire buffer with one * trap instead of a trap per call. * * This file is compiled into a dso that's PRELOADed in recorded * applications. The dso replaces libc syscall wrappers with our own * implementation that saves nondetermistic outparams in a fixed-size * buffer. When the buffer is full or the recorded application * invokes an un-buffered syscall or receives a signal, we trap to rr * and it records the state of the buffer. * * During replay, rr simply refills the buffer with the recorded data * when it reaches the "flush-buffer" events that were recorded. Then * rr emulates each buffered syscall, and the code here restores the * client data from the refilled buffer. * * The crux of the implementation here is to selectively ptrace-trap * syscalls. The normal (un-buffered) syscalls generate a ptrace * trap, and the buffered syscalls trap directly to the kernel. This * is implemented with a seccomp-bpf which examines the syscall and * decides how to handle it (see seccomp-bpf.h and Task::spawn). * * Because this code runs in the tracee's address space and overrides * system calls, the code is rather delicate. The following rules * must be followed * * o No rr headers (other than seccomp-bpf.h and rr.h) may be included * o All syscalls invoked by this code must be called directly, not * through libc wrappers (which this file may itself indirectly override) */ /** * We also use this preload library to disable XShm by overriding * XShmQueryExtension. */ #include "rr/rr.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef BTRFS_IOCTL_MAGIC #define BTRFS_IOCTL_MAGIC 0x94 #endif #ifndef BTRFS_IOC_CLONE_RANGE struct btrfs_ioctl_clone_range_args { int64_t src_fd; uint64_t src_offset; uint64_t src_length; uint64_t dest_offset; }; #define BTRFS_IOC_CLONE_RANGE \ _IOW(BTRFS_IOCTL_MAGIC, 13, struct btrfs_ioctl_clone_range_args) #endif /* NB: don't include any other local headers here. */ #ifdef memcpy #undef memcpy #endif #define memcpy you_must_use_local_memcpy #ifdef syscall #undef syscall #endif #define syscall you_must_use_traced_syscall #define RR_HIDDEN __attribute__((visibility("hidden"))) /** * Represents syscall params. Makes it simpler to pass them around, * and avoids pushing/popping all the data for calls. */ struct syscall_info { long no; long args[6]; }; /* Nonzero when syscall buffering is enabled. */ static int buffer_enabled; /* Nonzero after process-global state has been initialized. */ static int process_inited; static struct preload_globals globals; /** * Can be architecture dependent. The rr process does not manipulate * these except to save and restore the values on task switches so that * the values are always effectively local to the current task. * We use this instead of regular libc TLS because sometimes buggy application * code breaks libc TLS for some tasks. With this approach we can be sure * thread-locals are usable for any task in any state. */ struct preload_thread_locals { /* Nonzero when thread-local state like the syscallbuf has been * initialized. */ int thread_inited; /* When buffering is enabled, points at the thread's mapped buffer * segment. At the start of the segment is an object of type |struct * syscallbuf_hdr|, so |buffer| is also a pointer to the buffer * header. */ uint8_t* buffer; size_t buffer_size; /* This is used to support the buffering of "may-block" system calls. * The problem that needs to be addressed can be introduced with a * simple example; assume that we're buffering the "read" and "write" * syscalls. * * o (Tasks W and R set up a synchronous-IO pipe open between them; W * "owns" the write end of the pipe; R owns the read end; the pipe * buffer is full) * o Task W invokes the write syscall on the pipe * o Since write is a buffered syscall, the seccomp filter traps W * directly to the kernel; there's no trace event for W delivered * to rr. * o The pipe is full, so W is descheduled by the kernel because W * can't make progress. * o rr thinks W is still running and doesn't schedule R. * * At this point, progress in the recorded application can only be * made by scheduling R, but no one tells rr to do that. Oops! * * Thus enter the "desched counter". It's a perf_event for the "sw t * switches" event (which, more precisely, is "sw deschedule"; it * counts schedule-out, not schedule-in). We program the counter to * deliver a signal to this task when there's new counter data * available. And we set up the "sample period", how many descheds * are triggered before the signal is delivered, to be "1". This * means that when the counter is armed, the next desched (i.e., the * next time the desched counter is bumped up) of this task will * deliver the signal to it. And signal delivery always generates a * ptrace trap, so rr can deduce that this task was descheduled and * schedule another. * * The description above is sort of an idealized view; there are * numerous implementation details that are documented in * handle_signal.c, where they're dealt with. */ int desched_counter_fd; int cloned_file_data_fd; off_t cloned_file_data_offset; void* scratch_buf; size_t scratch_size; struct msghdr* notify_control_msg; }; static struct preload_thread_locals* const thread_locals = (struct preload_thread_locals*)PRELOAD_THREAD_LOCALS_ADDR; /* Points at the libc/pthread pthread_create(). We wrap * pthread_create, so need to retain this pointer to call out to the * libc version. There is no __pthread_create stub to call. There are * some explicitly-versioned stubs but let's not use those. */ static int (*real_pthread_create)(pthread_t* thread, const pthread_attr_t* attr, void* (*start_routine)(void*), void* arg); static int (*real_pthread_mutex_timedlock)(pthread_mutex_t* mutex, const struct timespec* abstime); /** * Return a pointer to the buffer header, which happens to occupy the * initial bytes in the mapped region. */ static struct syscallbuf_hdr* buffer_hdr(void) { return (struct syscallbuf_hdr*)thread_locals->buffer; } /** * Return a pointer to the byte just after the last valid syscall record in * the buffer. */ static uint8_t* buffer_last(void) { return (uint8_t*)next_record(buffer_hdr()); } /** * Return a pointer to the byte just after the very end of the mapped * region. */ static uint8_t* buffer_end(void) { return thread_locals->buffer + thread_locals->buffer_size; } /** * Same as libc memcpy(), but usable within syscallbuf transaction * critical sections. */ static void local_memcpy(void* dest, const void* source, int n) { #if defined(__i386__) || defined(__x86_64__) /* On modern x86-ish CPUs rep movsb is fast, usually able to move * 64 bytes at a time. */ __asm__ __volatile__("rep movsb\n\t" : "+S"(source), "+D"(dest), "+c"(n) : : "cc", "memory"); #else #error Unknown architecture #endif } /* The following are wrappers for the syscalls invoked by this library * itself. These syscalls will generate ptrace traps. * stack_param_1 and stack_param_2 are pushed onto the stack just before * the syscall, for SYS_rrcall_notify_syscall_hook_exit which takes stack * parameters as well as register parameters. * syscall_instruction is the actual syscall invocation instruction * (a function which we call with the registers set up appropriately). */ extern RR_HIDDEN long _raw_syscall(int syscallno, long a0, long a1, long a2, long a3, long a4, long a5, void* syscall_instruction, long stack_param_1, long stack_param_2); static int update_errno_ret(long ret) { /* EHWPOISON is the last known errno as of linux 3.9.5. */ if (0 > ret && ret >= -EHWPOISON) { errno = -ret; ret = -1; } return ret; } static int privileged_traced_syscall(int syscallno, long a0, long a1, long a2, long a3, long a4, long a5) { long ret = _raw_syscall(syscallno, a0, a1, a2, a3, a4, a5, RR_PAGE_SYSCALL_PRIVILEGED_TRACED, 0, 0); return update_errno_ret(ret); } #define privileged_traced_syscall6(no, a0, a1, a2, a3, a4, a5) \ privileged_traced_syscall(no, (uintptr_t)a0, (uintptr_t)a1, (uintptr_t)a2, \ (uintptr_t)a3, (uintptr_t)a4, (uintptr_t)a5) #define privileged_traced_syscall5(no, a0, a1, a2, a3, a4) \ privileged_traced_syscall6(no, a0, a1, a2, a3, a4, 0) #define privileged_traced_syscall4(no, a0, a1, a2, a3) \ privileged_traced_syscall5(no, a0, a1, a2, a3, 0) #define privileged_traced_syscall3(no, a0, a1, a2) \ privileged_traced_syscall4(no, a0, a1, a2, 0) #define privileged_traced_syscall2(no, a0, a1) \ privileged_traced_syscall3(no, a0, a1, 0) #define privileged_traced_syscall1(no, a0) privileged_traced_syscall2(no, a0, 0) #define privileged_traced_syscall0(no) privileged_traced_syscall1(no, 0) /** * Make a raw traced syscall using the params in |call|. "Raw" traced * syscalls return the raw kernel return value, and don't transform it * to -1/errno per POSIX semantics. */ static long traced_raw_syscall(const struct syscall_info* call) { /* FIXME: pass |call| to avoid pushing these on the stack * again. */ return _raw_syscall(call->no, call->args[0], call->args[1], call->args[2], call->args[3], call->args[4], call->args[5], RR_PAGE_SYSCALL_TRACED, 0, 0); } #if defined(SYS_fcntl64) #define RR_FCNTL_SYSCALL SYS_fcntl64 #else #define RR_FCNTL_SYSCALL SYS_fcntl #endif static int privileged_traced_fcntl(int fd, int cmd, ...) { va_list ap; void* arg; va_start(ap, cmd); arg = va_arg(ap, void*); va_end(ap); return privileged_traced_syscall3(RR_FCNTL_SYSCALL, fd, cmd, arg); } static pid_t privileged_traced_getpid(void) { return privileged_traced_syscall0(SYS_getpid); } static pid_t privileged_traced_gettid(void) { return privileged_traced_syscall0(SYS_gettid); } static int privileged_traced_perf_event_open(struct perf_event_attr* attr, pid_t pid, int cpu, int group_fd, unsigned long flags) { return privileged_traced_syscall5(SYS_perf_event_open, attr, pid, cpu, group_fd, flags); } static int privileged_traced_raise(int sig) { return privileged_traced_syscall2(SYS_kill, privileged_traced_getpid(), sig); } static ssize_t privileged_traced_write(int fd, const void* buf, size_t count) { return privileged_traced_syscall3(SYS_write, fd, buf, count); } /* We can't use the rr logging helpers because they rely on libc * syscall-invoking functions, so roll our own here. * * XXX just use these for all logging? */ __attribute__((format(printf, 1, 2))) static void logmsg(const char* msg, ...) { va_list args; char buf[1024]; int len; va_start(args, msg); len = vsnprintf(buf, sizeof(buf) - 1, msg, args); va_end(args); privileged_traced_write(STDERR_FILENO, buf, len); } #ifndef NDEBUG #define assert(cond) \ do { \ if (!(cond)) { \ logmsg("%s:%d: Assertion `" #cond "' failed.\n", __FILE__, __LINE__); \ privileged_traced_raise(SIGABRT); \ } \ } while (0) #else #define assert(cond) ((void)0) #endif #define fatal(msg, ...) \ do { \ logmsg("[FATAL] (%s:%d: errno: %s: tid: %d) " msg "\n", __FILE__, \ __LINE__, strerror(errno), privileged_traced_gettid(), \ ##__VA_ARGS__); \ privileged_traced_syscall1(SYS_exit_group, EX_OSERR); \ } while (0) #ifdef DEBUGTAG #define debug(msg, ...) logmsg("[" DEBUGTAG "] " msg "\n", ##__VA_ARGS__) #else #define debug(msg, ...) ((void)0) #endif /** * Unlike |traced_syscall()|, this helper is implicitly "raw" (returns * the direct kernel return value), because the syscall hooks have to * save that raw return value. * This is only called from syscall wrappers that are doing a proper * buffered syscall. */ static long untraced_syscall_base(int syscallno, long a0, long a1, long a2, long a3, long a4, long a5, void* syscall_instruction) { struct syscallbuf_record* rec = (struct syscallbuf_record*)buffer_last(); long ret = _raw_syscall(syscallno, a0, a1, a2, a3, a4, a5, syscall_instruction, 0, 0); unsigned char tmp_in_replay = globals.in_replay; /* During replay, return the result that's already in the buffer, instead of what our "syscall" returned. */ #if defined(__i386__) || defined(__x86_64__) /* On entry, during recording %eax/%rax are whatever the kernel returned * but during replay they may be invalid (e.g. 0). During replay, reload * %eax/%rax from |rec->ret|. At the end of this sequence all registers * will match between recording and replay. We clobber the temporary * in_replay register, and the condition codes, to ensure this. * This all assumes the compiler doesn't create unnecessary temporaries * holding values like |ret|. Inspection of generated code shows it doesn't. */ __asm__("test %1,%1\n\t" "cmovne %2,%0\n\t" "xor %1,%1\n\t" : "+a"(ret), "+c"(tmp_in_replay) : "m"(rec->ret) : "cc"); #else #error Unknown architecture #endif return ret; } #define untraced_syscall6(no, a0, a1, a2, a3, a4, a5) \ untraced_syscall_base(no, (uintptr_t)a0, (uintptr_t)a1, (uintptr_t)a2, \ (uintptr_t)a3, (uintptr_t)a4, (uintptr_t)a5, \ RR_PAGE_SYSCALL_UNTRACED_RECORDING_ONLY) #define untraced_syscall5(no, a0, a1, a2, a3, a4) \ untraced_syscall6(no, a0, a1, a2, a3, a4, 0) #define untraced_syscall4(no, a0, a1, a2, a3) \ untraced_syscall5(no, a0, a1, a2, a3, 0) #define untraced_syscall3(no, a0, a1, a2) untraced_syscall4(no, a0, a1, a2, 0) #define untraced_syscall2(no, a0, a1) untraced_syscall3(no, a0, a1, 0) #define untraced_syscall1(no, a0) untraced_syscall2(no, a0, 0) #define untraced_syscall0(no) untraced_syscall1(no, 0) #define untraced_replayed_syscall6(no, a0, a1, a2, a3, a4, a5) \ untraced_syscall_base(no, (uintptr_t)a0, (uintptr_t)a1, (uintptr_t)a2, \ (uintptr_t)a3, (uintptr_t)a4, (uintptr_t)a5, \ RR_PAGE_SYSCALL_UNTRACED) #define untraced_replayed_syscall5(no, a0, a1, a2, a3, a4) \ untraced_replayed_syscall6(no, a0, a1, a2, a3, a4, 0) #define untraced_replayed_syscall4(no, a0, a1, a2, a3) \ untraced_replayed_syscall5(no, a0, a1, a2, a3, 0) #define untraced_replayed_syscall3(no, a0, a1, a2) \ untraced_replayed_syscall4(no, a0, a1, a2, 0) #define untraced_replayed_syscall2(no, a0, a1) \ untraced_replayed_syscall3(no, a0, a1, 0) #define untraced_replayed_syscall1(no, a0) untraced_replayed_syscall2(no, a0, 0) #define untraced_replayed_syscall0(no) untraced_replayed_syscall1(no, 0) #define privileged_untraced_syscall6(no, a0, a1, a2, a3, a4, a5) \ _raw_syscall(no, (uintptr_t)a0, (uintptr_t)a1, (uintptr_t)a2, (uintptr_t)a3, \ (uintptr_t)a4, (uintptr_t)a5, \ RR_PAGE_SYSCALL_PRIVILEGED_UNTRACED_RECORDING_ONLY, 0, 0) #define privileged_untraced_syscall5(no, a0, a1, a2, a3, a4) \ privileged_untraced_syscall6(no, a0, a1, a2, a3, a4, 0) #define privileged_untraced_syscall4(no, a0, a1, a2, a3) \ privileged_untraced_syscall5(no, a0, a1, a2, a3, 0) #define privileged_untraced_syscall3(no, a0, a1, a2) \ privileged_untraced_syscall4(no, a0, a1, a2, 0) #define privileged_untraced_syscall2(no, a0, a1) \ privileged_untraced_syscall3(no, a0, a1, 0) #define privileged_untraced_syscall1(no, a0) \ privileged_untraced_syscall2(no, a0, 0) #define privileged_untraced_syscall0(no) privileged_untraced_syscall1(no, 0) #define replay_only_syscall6(no, a0, a1, a2, a3, a4, a5) \ _raw_syscall(no, (uintptr_t)a0, (uintptr_t)a1, (uintptr_t)a2, (uintptr_t)a3, \ (uintptr_t)a4, (uintptr_t)a5, \ RR_PAGE_SYSCALL_PRIVILEGED_UNTRACED_REPLAY_ONLY, 0, 0) #define replay_only_syscall5(no, a0, a1, a2, a3, a4) \ replay_only_syscall6(no, a0, a1, a2, a3, a4, 0) #define replay_only_syscall4(no, a0, a1, a2, a3) \ replay_only_syscall5(no, a0, a1, a2, a3, 0) #define replay_only_syscall3(no, a0, a1, a2) \ replay_only_syscall4(no, a0, a1, a2, 0) #define replay_only_syscall2(no, a0, a1) replay_only_syscall3(no, a0, a1, 0) #define replay_only_syscall1(no, a0) replay_only_syscall2(no, a0, 0) #define replay_only_syscall0(no) replay_only_syscall1(no, 0) static int privileged_untraced_close(int fd) { return privileged_untraced_syscall1(SYS_close, fd); } static int privileged_untraced_fcntl(int fd, int cmd, ...) { va_list ap; void* arg; va_start(ap, cmd); arg = va_arg(ap, void*); va_end(ap); return privileged_untraced_syscall3(RR_FCNTL_SYSCALL, fd, cmd, arg); } /** * Do what's necessary to set up buffers for the caller. * |untraced_syscall_ip| lets rr know where our untraced syscalls will * originate from. |addr| is the address of the control socket the * child expects to connect to. |msg| is a pre-prepared IPC that can * be used to share fds; |fdptr| is a pointer to the control-message * data buffer where the fd number being shared will be stored. * |args_vec| provides the tracer with preallocated space to make * socketcall syscalls. * * Return a pointer to the syscallbuf (with an initialized header * including the available size), if syscallbuf is enabled. * * This is a "magic" syscall implemented by rr. */ static void rrcall_init_buffers(struct rrcall_init_buffers_params* args) { privileged_traced_syscall1(SYS_rrcall_init_buffers, args); } /** * Return a counter that generates a signal targeted at this task * every time the task is descheduled |nr_descheds| times. */ static int open_desched_event_counter(size_t nr_descheds, pid_t tid) { struct perf_event_attr attr; int tmp_fd, fd; struct f_owner_ex own; memset(&attr, 0, sizeof(attr)); attr.size = sizeof(attr); attr.type = PERF_TYPE_SOFTWARE; attr.config = PERF_COUNT_SW_CONTEXT_SWITCHES; attr.disabled = 1; attr.sample_period = nr_descheds; tmp_fd = privileged_traced_perf_event_open(&attr, 0 /*self*/, -1 /*any cpu*/, -1, 0); if (0 > tmp_fd) { fatal("Failed to perf_event_open(cs, period=%zu)", nr_descheds); } fd = privileged_traced_fcntl(tmp_fd, F_DUPFD_CLOEXEC, RR_DESCHED_EVENT_FLOOR_FD); if (0 > fd) { fatal("Failed to dup desched fd"); } if (privileged_untraced_close(tmp_fd)) { fatal("Failed to close tmp_fd"); } if (privileged_untraced_fcntl(fd, F_SETFL, O_ASYNC)) { fatal("Failed to fcntl(O_ASYNC) the desched counter"); } own.type = F_OWNER_TID; own.pid = tid; if (privileged_untraced_fcntl(fd, F_SETOWN_EX, &own)) { fatal("Failed to fcntl(SETOWN_EX) the desched counter to this"); } if (privileged_untraced_fcntl(fd, F_SETSIG, SYSCALLBUF_DESCHED_SIGNAL)) { fatal("Failed to fcntl(SETSIG, %d) the desched counter", SYSCALLBUF_DESCHED_SIGNAL); } return fd; } /** * Initialize thread-local buffering state, if enabled and not already * initialized. */ static void init_thread(void) { struct rrcall_init_buffers_params args; assert(process_inited); if (thread_locals->thread_inited) { return; } /* Do not do any syscall buffering in a DiversionSession! */ if (!buffer_enabled || globals.in_diversion) { thread_locals->thread_inited = 1; return; } /* NB: we want this setup emulated during replay. */ thread_locals->desched_counter_fd = open_desched_event_counter(1, privileged_traced_gettid()); args.desched_counter_fd = thread_locals->desched_counter_fd; /* Trap to rr: let the magic begin! * * If the desched signal is currently blocked, then the tracer * will clear our TCB guard and we won't be able to buffer * syscalls. But the tracee will set the guard when (or if) * the signal is unblocked. */ rrcall_init_buffers(&args); thread_locals->cloned_file_data_fd = args.cloned_file_data_fd; /* rr initializes the buffer header. */ thread_locals->buffer = args.syscallbuf_ptr; thread_locals->buffer_size = args.syscallbuf_size; thread_locals->scratch_buf = args.scratch_buf; thread_locals->scratch_size = args.scratch_size; thread_locals->thread_inited = 1; } extern char _breakpoint_table_entry_start; extern char _breakpoint_table_entry_end; /** * Initialize process-global buffering state, if enabled. */ static void __attribute__((constructor)) init_process(void) { struct rrcall_init_preload_params params; extern RR_HIDDEN void _syscall_hook_trampoline(void); extern RR_HIDDEN void _syscall_hook_end(void); #if defined(__i386__) extern RR_HIDDEN void _syscall_hook_trampoline_3d_01_f0_ff_ff(void); extern RR_HIDDEN void _syscall_hook_trampoline_90_90_90(void); struct syscall_patch_hook syscall_patch_hooks[] = { /* pthread_cond_broadcast has 'int 80' followed by * cmp $-4095,%eax (in glibc-2.18-16.fc20.i686) */ { 5, { 0x3d, 0x01, 0xf0, 0xff, 0xff }, (uintptr_t)_syscall_hook_trampoline_3d_01_f0_ff_ff }, /* Our vdso syscall patch has 'int 80' followed by onp; nop; nop */ { 3, { 0x90, 0x90, 0x90 }, (uintptr_t)_syscall_hook_trampoline_90_90_90 } }; /* Load GLIBC 2.1 version of pthread_create. Otherwise we may get the 2.0 version, which cannot handle the pthread_attr values passed by callers expecting to call the glibc 2.1 version. */ real_pthread_create = dlvsym(RTLD_NEXT, "pthread_create", "GLIBC_2.1"); #elif defined(__x86_64__) extern RR_HIDDEN void _syscall_hook_trampoline_48_3d_01_f0_ff_ff(void); extern RR_HIDDEN void _syscall_hook_trampoline_48_3d_00_f0_ff_ff(void); extern RR_HIDDEN void _syscall_hook_trampoline_48_8b_3c_24(void); extern RR_HIDDEN void _syscall_hook_trampoline_5a_5e_c3(void); extern RR_HIDDEN void _syscall_hook_trampoline_89_c2_f7_da(void); extern RR_HIDDEN void _syscall_hook_trampoline_90_90_90(void); extern RR_HIDDEN void _syscall_hook_trampoline_ba_01_00_00_00(void); extern RR_HIDDEN void _syscall_hook_trampoline_89_c1_31_d2(void); struct syscall_patch_hook syscall_patch_hooks[] = { /* Many glibc syscall wrappers (e.g. read) have 'syscall' followed * by * cmp $-4095,%rax (in glibc-2.18-16.fc20.x86_64) */ { 6, { 0x48, 0x3d, 0x01, 0xf0, 0xff, 0xff }, (uintptr_t)_syscall_hook_trampoline_48_3d_01_f0_ff_ff }, /* Many glibc syscall wrappers (e.g. __libc_recv) have 'syscall' * followed by * cmp $-4096,%rax (in glibc-2.18-16.fc20.x86_64) */ { 6, { 0x48, 0x3d, 0x00, 0xf0, 0xff, 0xff }, (uintptr_t)_syscall_hook_trampoline_48_3d_00_f0_ff_ff }, /* Many glibc syscall wrappers (e.g. read) have 'syscall' followed * by * mov (%rsp),%rdi (in glibc-2.18-16.fc20.x86_64) */ { 4, { 0x48, 0x8b, 0x3c, 0x24 }, (uintptr_t)_syscall_hook_trampoline_48_8b_3c_24 }, /* __lll_unlock_wake has 'syscall' followed by * pop %rdx; pop %rsi; ret */ { 3, { 0x5a, 0x5e, 0xc3 }, (uintptr_t)_syscall_hook_trampoline_5a_5e_c3 }, /* posix_fadvise64 has 'syscall' followed by * mov %eax,%edx; neg %edx (in glibc-2.22-11.fc23.x86_64) */ { 4, { 0x89, 0xc2, 0xf7, 0xda }, (uintptr_t)_syscall_hook_trampoline_89_c2_f7_da }, /* Our VDSO vsyscall patches have 'syscall' followed by "nop; nop; nop" */ { 3, { 0x90, 0x90, 0x90 }, (uintptr_t)_syscall_hook_trampoline_ba_01_00_00_00 }, /* glibc-2.22-17.fc23.x86_64 has 'syscall' followed by 'mov $1,%rdx' * in * pthread_barrier_wait. */ { 5, { 0xba, 0x01, 0x00, 0x00, 0x00 }, (uintptr_t)_syscall_hook_trampoline_ba_01_00_00_00 }, /* pthread_sigmask has 'syscall' followed by 'mov %eax,%ecx; xor %edx,%edx' */ { 4, { 0x89, 0xc1, 0x31, 0xd2 }, (uintptr_t)_syscall_hook_trampoline_89_c1_31_d2 } }; real_pthread_create = dlsym(RTLD_NEXT, "pthread_create"); #else #error Unknown architecture #endif assert(sizeof(struct preload_thread_locals) <= PRELOAD_THREAD_LOCALS_SIZE); if (process_inited) { return; } buffer_enabled = !!getenv(SYSCALLBUF_ENABLED_ENV_VAR); params.syscallbuf_enabled = buffer_enabled; params.syscall_hook_trampoline = (void*)_syscall_hook_trampoline; params.syscall_hook_end = (void*)_syscall_hook_end; params.syscall_patch_hook_count = sizeof(syscall_patch_hooks) / sizeof(syscall_patch_hooks[0]); params.syscall_patch_hooks = syscall_patch_hooks; params.globals = &globals; params.breakpoint_table = &_breakpoint_table_entry_start; params.breakpoint_table_entry_size = &_breakpoint_table_entry_end - &_breakpoint_table_entry_start; privileged_traced_syscall1(SYS_rrcall_init_preload, ¶ms); process_inited = 1; } /** * In a thread newly created by |pthread_create()|, first initialize * thread-local internal rr data, then trampoline into the user's * thread function. */ struct thread_func_data { void* (*start_routine)(void*); void* arg; }; static void* thread_trampoline(void* arg) { struct thread_func_data data = *(struct thread_func_data*)arg; free(arg); return data.start_routine(data.arg); } /** * Interpose |pthread_create()| so that we can use a custom trampoline * function (see above) that initializes rr thread-local data for new * threads. * * This is a wrapper of |pthread_create()|, but not like the ones * below: we don't wrap |pthread_create()| in order to buffer its * syscalls, rather in order to initialize rr thread data. */ int pthread_create(pthread_t* thread, const pthread_attr_t* attr, void* (*start_routine)(void*), void* arg) { struct thread_func_data* data = malloc(sizeof(*data)); int ret; /* Init syscallbuf now if we haven't yet (e.g. if pthread_create is called * during library initialization before our preload library). * This also fetches real_pthread_create which we'll need below. */ init_process(); data->start_routine = start_routine; data->arg = arg; ret = real_pthread_create(thread, attr, thread_trampoline, data); return ret; } #define PTHREAD_MUTEX_TYPE_MASK 3 #define PTHREAD_MUTEX_PRIO_INHERIT_NP 32 static void fix_mutex_kind(pthread_mutex_t* mutex) { /* Disable priority inheritance. */ mutex->__data.__kind &= ~PTHREAD_MUTEX_PRIO_INHERIT_NP; } /* * We bind directly to __pthread_mutex_lock and __pthread_mutex_trylock * because setting up indirect function pointers in init_process requires * calls to dlsym which itself can call pthread_mutex_lock (e.g. via * application code overriding malloc/calloc to use a pthreads-based * implementation). */ extern int __pthread_mutex_lock(pthread_mutex_t* mutex); extern int __pthread_mutex_trylock(pthread_mutex_t* mutex); /* Prevent use of lock elision; Haswell's TSX/RTM features used by lock elision increment the rbc perf counter for instructions which are later rolled back if the transaction fails. */ int pthread_mutex_lock(pthread_mutex_t* mutex) { fix_mutex_kind(mutex); return __pthread_mutex_lock(mutex); } int pthread_mutex_timedlock(pthread_mutex_t* mutex, const struct timespec* abstime) { fix_mutex_kind(mutex); /* No __pthread_mutex_timedlock stub exists, so we have to use the * indirect call. */ if (!real_pthread_mutex_timedlock) { real_pthread_mutex_timedlock = dlsym(RTLD_NEXT, "pthread_mutex_timedlock"); } return real_pthread_mutex_timedlock(mutex, abstime); } int pthread_mutex_trylock(pthread_mutex_t* mutex) { fix_mutex_kind(mutex); return __pthread_mutex_trylock(mutex); } /** * syscall hooks start here. * * !!! NBB !!!: from here on, all code that executes within the * critical sections of transactions *MUST KEEP $ip IN THE SYSCALLBUF * CODE*. That means no calls into libc, even for innocent-looking * functions like |memcpy()|. * * How syscall hooks operate: * * 1. The rr tracer monkey-patches __kernel_vsyscall() to jump to * _syscall_hook_trampoline() above. * 2. When a call is made to __kernel_vsyscall(), it jumps to * _syscall_hook_trampoline(), where the syscall params are * packaged up into a call to syscall_hook() below. * 3. syscall_hook() dispatches to a syscall processor function. * 4. The syscall processor prepares a new record in the buffer. See * struct syscallbuf_record for record fields. If the buffer runs * out of space, the processor function aborts and makes a traced * syscall, trapping to rr. rr then flushes the buffer. Records * are directly saved to trace, and a buffer-flush event is * recorded without execution info because it's a synthetic event. * 5. Then, the syscall processor redirects all potential output * for the syscall to the record (and corrects the overall size of * the record while it does so). * 6. The syscall is invoked through a asm helper that does *not* * ptrace-trap to rr. * 7. The syscall output, written on the buffer, is copied to the * original pointers provided by the user. Take notice that this * part saves us the injection of the data on replay, as we only * need to push the data to the buffer and the wrapper code will * copy it to the user address for us. * 8. The return value and overall size are saved to the record. */ /** * Call this and save the result at the start of every system call we * want to buffer. The result is a pointer into the record space. You * can add to this pointer to allocate space in the trace record. * However, do not read or write through this pointer until * start_commit_syscall() has been called. And you *must* call * start_commit_syscall() after this is called, otherwise buffering * state will be inconsistent between syscalls. * * See |sys_clock_gettime()| for a simple example of how this helper * should be used to buffer outparam data. */ static void* prep_syscall(void) { if (!thread_locals->buffer) { return NULL; } if (buffer_hdr()->locked) { /* We may be reentering via a signal handler. Return * an invalid pointer. */ return NULL; } /* We don't need to worry about a race between testing * |locked| and setting it here. rr recording is responsible * for ensuring signals are not delivered during * syscall_buffer prologue and epilogue code. * * XXX except for synchronous signals generated in the syscall * buffer code, while reading/writing user pointers */ buffer_hdr()->locked = 1; /* "Allocate" space for a new syscall record, not including * syscall outparam data. */ return buffer_last() + sizeof(struct syscallbuf_record); } static int is_bufferable_fd(int fd) { return fd < 0 || (fd < SYSCALLBUF_FDS_DISABLED_SIZE && !globals.syscallbuf_fds_disabled[fd]); } /** * Like prep_syscall, but preps a syscall to operate on a particular fd. If * syscallbuf is disabled for this fd, returns NULL (in which case * start_commit_syscall will abort cleanly and a traced syscall will be used). * Allow negative fds to pass through; they'll either trigger an error or * receive special treatment by the kernel (e.g. AT_FDCWD). */ static void* prep_syscall_for_fd(int fd) { if (!is_bufferable_fd(fd)) { return NULL; } return prep_syscall(); } static void arm_desched_event(void) { /* Don't trace the ioctl; doing so would trigger a flushing * ptrace trap, which is exactly what this code is trying to * avoid! :) Although we don't allocate extra space for these * ioctl's, we do record that we called them; the replayer * knows how to skip over them. */ if ((int)privileged_untraced_syscall3(SYS_ioctl, thread_locals->desched_counter_fd, PERF_EVENT_IOC_ENABLE, 0)) { fatal("Failed to ENABLE counter %d", thread_locals->desched_counter_fd); } } static void disarm_desched_event(void) { /* See above. */ if ((int)privileged_untraced_syscall3(SYS_ioctl, thread_locals->desched_counter_fd, PERF_EVENT_IOC_DISABLE, 0)) { fatal("Failed to DISABLE counter %d", thread_locals->desched_counter_fd); } } /** * Return 1 if it's ok to proceed with buffering this system call. * Return 0 if we should trace the system call. * This must be checked before proceeding with the buffered system call. */ /* (Negative numbers so as to not be valid syscall numbers, in case * the |int| arguments below are passed in the wrong order.) */ enum { MAY_BLOCK = -1, WONT_BLOCK = -2 }; static int start_commit_buffered_syscall(int syscallno, void* record_end, int blockness) { void* record_start; void* stored_end; struct syscallbuf_record* rec; if (!thread_locals->buffer) { return 0; } record_start = buffer_last(); stored_end = record_start + stored_record_size(record_end - record_start); rec = record_start; if (stored_end < record_start + sizeof(struct syscallbuf_record)) { /* Either a catastrophic buffer overflow or * we failed to lock the buffer. Just bail out. */ return 0; } if (stored_end > (void*)buffer_end() - sizeof(struct syscallbuf_record)) { /* Buffer overflow. * Unlock the buffer and then execute the system call * with a trap to rr. Note that we reserve enough * space in the buffer for the next prep_syscall(). */ buffer_hdr()->locked = 0; return 0; } /* Store this breadcrumb so that the tracer can find out what * syscall we're executing if our registers are in a weird * state. If we end up aborting this syscall, no worry, this * will just be overwritten later. * * NBB: this *MUST* be set before the desched event is * armed. */ rec->syscallno = syscallno; rec->desched = MAY_BLOCK == blockness; rec->size = record_end - record_start; if (rec->desched) { /* NB: the ordering of the next two statements is * important. * * We set this flag to notify rr that it should pay * attention to desched signals pending for this task. * We have to set it *before* we arm the notification * because we can't set the flag atomically with * arming the event (too bad there's no ioctl() for * querying the event enabled-ness state). That's * important because if the notification is armed, * then rr must be confident that when it disarms the * event, the tracee is at an execution point that * *must not* need the desched event. * * If we were to set the flag non-atomically after the * event was armed, then if a desched signal was * delivered right at the instruction that set the * flag, rr wouldn't know that it needed to advance * the tracee to the untraced syscall entry point. * (And if rr didn't do /that/, then the syscall might * block without rr knowing it, and the recording * session would deadlock.) */ buffer_hdr()->desched_signal_may_be_relevant = 1; arm_desched_event(); } return 1; } /** * Commit the record for a buffered system call. record_end can be * adjusted downward from what was passed to * start_commit_buffered_syscall, if not all of the initially * requested space is needed. The result of this function should be * returned directly by the kernel syscall hook. */ static long commit_raw_syscall(int syscallno, void* record_end, long ret) { void* record_start = buffer_last(); struct syscallbuf_record* rec = record_start; struct syscallbuf_hdr* hdr = buffer_hdr(); void (*breakpoint_function)(void) = 0; assert(record_end >= record_start); rec->size = record_end - record_start; assert(buffer_hdr()->locked); /* NB: the ordering of this statement with the * |disarm_desched_event()| call below is important. * * We clear this flag to notify rr that the may-block syscall * has finished, so there's no danger of blocking anymore. * (And thus the desched signal is no longer relevant.) We * have to clear this *before* disarming the event, because if * rr sees the flag set, it has to PTRACE_SYSCALL this task to * ensure it reaches an execution point where the desched * signal is no longer relevant. We have to use the ioctl() * that disarms the event as a safe "backstop" that can be hit * by the PTRACE_SYSCALL. * * If we were to clear the flag *after* disarming the event, * and the signal arrived at the instruction that cleared the * flag, and rr issued the PTRACE_SYSCALL, then this tracee * could fly off to any unknown execution point, including an * iloop. So the recording session could livelock. */ hdr->desched_signal_may_be_relevant = 0; if (rec->syscallno != syscallno) { fatal("Record is for %d but trying to commit %d", rec->syscallno, syscallno); } if (hdr->abort_commit) { /* We were descheduled in the middle of a may-block * syscall, and it was recorded as a normal entry/exit * pair. So don't record the syscall in the buffer or * replay will go haywire. */ hdr->abort_commit = 0; /* Clear the return value that rr puts there during replay */ rec->ret = 0; } else { int breakpoint_entry_size = &_breakpoint_table_entry_end - &_breakpoint_table_entry_start; rec->ret = ret; // Finish 'rec' first before updating num_rec_bytes, since // rr might read the record anytime after this update. hdr->num_rec_bytes += stored_record_size(rec->size); breakpoint_function = (void*)(&_breakpoint_table_entry_start + (hdr->num_rec_bytes / 8) * breakpoint_entry_size); } if (rec->desched) { disarm_desched_event(); } /* NBB: for may-block syscalls that are descheduled, the * tracer uses the previous ioctl() as a stable point to reset * the record counter. Therefore nothing from here on in the * current txn must touch the record counter (at least, must * not assume it's unchanged). */ buffer_hdr()->locked = 0; if (breakpoint_function) { /* Call the breakpoint function corresponding to the record we just * committed. This function just returns, but during replay it gives rr * a chance to set a breakpoint for when a specific syscallbuf record * has been processed. */ breakpoint_function(); } return ret; } /** * |ret_size| is the result of a syscall indicating how much data was returned * in scratch buffer |buf2|; this function copies that data to |buf| and returns * a pointer to the end of it. If there is no scratch buffer (|buf2| is NULL) * just returns |ptr|. */ static void* copy_output_buffer(int ret_size, void* ptr, void* buf, void* buf2) { if (!buf2) { return ptr; } if (ret_size <= 0) { return buf2; } local_memcpy(buf, buf2, ret_size); return buf2 + ret_size; } /** * Copy an input parameter to the syscallbuf where the kernel needs to * read and write it. During replay, we do a no-op self-copy in the buffer * so that the buffered data is not lost. * This code is written in assembler to ensure that the registers that receive * values differing between record and replay (%0, rsi/esi, and flags) * are reset to values that are the same between record and replay immediately * afterward. This guards against diverging register values leaking into * later code. * Use local_memcpy or plain assignment instead if the kernel is not going to * overwrite the values. */ static void memcpy_input_parameter(void* buf, void* src, int size) { #if defined(__i386__) || defined(__x86_64__) unsigned char tmp_in_replay = globals.in_replay; __asm__ __volatile__("test %0,%0\n\t" "cmovne %1,%2\n\t" "rep movsb\n\t" "xor %0,%0\n\t" "xor %2,%2\n\t" : "+a"(tmp_in_replay), "+D"(buf), "+S"(src), "+c"(size) : : "cc", "memory"); #else #error Unknown architecture #endif } /** * During recording, we copy *real to *buf. * During replay, we copy *buf to *real. * Behaves like memcpy_input_parameter in terms of hiding differences between * recording and replay. */ static void copy_futex_int(uint32_t* buf, uint32_t* real) { #if defined(__i386__) || defined(__x86_64__) uint32_t tmp_in_replay = globals.in_replay; __asm__ __volatile__("test %0,%0\n\t" "mov %2,%0\n\t" "cmovne %1,%0\n\t" "mov %0,%1\n\t" "mov %0,%2\n\t" /* This instruction is just to clear flags */ "xor %0,%0\n\t" : "+a"(tmp_in_replay) : "m"(*buf), "m"(*real) : "cc", "memory"); #else #error Unknown architecture #endif } /* Keep syscalls in alphabetical order, please. */ /** * Call this for syscalls that have no memory effects, don't block, and * aren't fd-related. */ static long sys_generic_nonblocking(const struct syscall_info* call) { void* ptr = prep_syscall(); long ret; if (!start_commit_buffered_syscall(call->no, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall6(call->no, call->args[0], call->args[1], call->args[2], call->args[3], call->args[4], call->args[5]); return commit_raw_syscall(call->no, ptr, ret); } /** * Call this for syscalls that have no memory effects, don't block, and * have an fd as their first parameter. */ static long sys_generic_nonblocking_fd(const struct syscall_info* call) { int fd = call->args[0]; void* ptr = prep_syscall_for_fd(fd); long ret; if (!start_commit_buffered_syscall(call->no, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall6(call->no, fd, call->args[1], call->args[2], call->args[3], call->args[4], call->args[5]); return commit_raw_syscall(call->no, ptr, ret); } static long sys_clock_gettime(const struct syscall_info* call) { const int syscallno = SYS_clock_gettime; clockid_t clk_id = (clockid_t)call->args[0]; struct timespec* tp = (struct timespec*)call->args[1]; void* ptr = prep_syscall(); struct timespec* tp2 = NULL; long ret; assert(syscallno == call->no); if (tp) { tp2 = ptr; ptr += sizeof(*tp2); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall2(syscallno, clk_id, tp2); if (tp) { local_memcpy(tp, tp2, sizeof(*tp)); } return commit_raw_syscall(syscallno, ptr, ret); } static long sys_open(const struct syscall_info* call); static long sys_creat(const struct syscall_info* call) { const char* pathname = (const char*)call->args[0]; mode_t mode = call->args[1]; /* Thus sayeth the man page: * * creat() is equivalent to open() with flags equal to * O_CREAT|O_WRONLY|O_TRUNC. */ struct syscall_info open_call; open_call.no = SYS_open; open_call.args[0] = (long)pathname; open_call.args[1] = O_CREAT | O_TRUNC | O_WRONLY; open_call.args[2] = mode; return sys_open(&open_call); } static int sys_fcntl64_no_outparams(const struct syscall_info* call) { const int syscallno = RR_FCNTL_SYSCALL; int fd = call->args[0]; int cmd = call->args[1]; long arg = call->args[2]; /* None of the no-outparam fcntl's are known to be * may-block. */ void* ptr = prep_syscall_for_fd(fd); long ret; assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, cmd, arg); return commit_raw_syscall(syscallno, ptr, ret); } static int sys_fcntl64_own_ex(const struct syscall_info* call) { const int syscallno = RR_FCNTL_SYSCALL; int fd = call->args[0]; int cmd = call->args[1]; struct f_owner_ex* owner = (struct f_owner_ex*)call->args[2]; /* The OWN_EX fcntl's aren't may-block. */ void* ptr = prep_syscall_for_fd(fd); struct f_owner_ex* owner2 = NULL; long ret; assert(syscallno == call->no); if (owner) { owner2 = ptr; ptr += sizeof(*owner2); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } if (owner2) { memcpy_input_parameter(owner2, owner, sizeof(*owner2)); } ret = untraced_syscall3(syscallno, fd, cmd, owner2); if (owner2) { local_memcpy(owner, owner2, sizeof(*owner)); } return commit_raw_syscall(syscallno, ptr, ret); } static int sys_fcntl64_setlk64(const struct syscall_info* call) { const int syscallno = RR_FCNTL_SYSCALL; int fd = call->args[0]; int cmd = call->args[1]; struct flock64* lock = (struct flock64*)call->args[2]; void* ptr = prep_syscall_for_fd(fd); struct flock64* lock2 = NULL; long ret; assert(syscallno == call->no); if (lock) { lock2 = ptr; ptr += sizeof(*lock2); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } if (lock2) { memcpy_input_parameter(lock2, lock, sizeof(*lock2)); } ret = untraced_syscall3(syscallno, fd, cmd, lock2); if (lock2) { local_memcpy(lock, lock2, sizeof(*lock)); } return commit_raw_syscall(syscallno, ptr, ret); } static int sys_fcntl64_setlkw64(const struct syscall_info* call) { const int syscallno = RR_FCNTL_SYSCALL; int fd = call->args[0]; int cmd = call->args[1]; struct flock64* lock = (struct flock64*)call->args[2]; void* ptr = prep_syscall_for_fd(fd); long ret; assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, cmd, lock); return commit_raw_syscall(syscallno, ptr, ret); } #if defined(SYS_fcntl64) static long sys_fcntl64(const struct syscall_info* call) #else static long sys_fcntl(const struct syscall_info* call) #endif { switch (call->args[1]) { case F_DUPFD: case F_GETFD: case F_GETFL: case F_GETOWN: case F_SETFL: case F_SETFD: case F_SETOWN: case F_SETSIG: return sys_fcntl64_no_outparams(call); case F_GETOWN_EX: case F_SETOWN_EX: return sys_fcntl64_own_ex(call); #if F_SETLK != F_SETLK64 case F_SETLK64: #else case F_SETLK: #endif return sys_fcntl64_setlk64(call); #if F_SETLKW != F_SETLKW64 case F_SETLKW64: #else case F_SETLKW: #endif return sys_fcntl64_setlkw64(call); default: return traced_raw_syscall(call); } } static long sys_flistxattr(const struct syscall_info* call) { const int syscallno = SYS_flistxattr; int fd = (int)call->args[0]; char* buf = (char*)call->args[1]; size_t size = call->args[2]; void* ptr = prep_syscall_for_fd(fd); void* buf2 = NULL; long ret; assert(syscallno == call->no); if (buf && size > 0) { buf2 = ptr; ptr += size; } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, buf2, size); ptr = copy_output_buffer(ret > (long)size ? (long)size : ret, ptr, buf, buf2); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_safe_nonblocking_ioctl(const struct syscall_info* call) { const int syscallno = SYS_ioctl; int fd = call->args[0]; void* ptr = prep_syscall_for_fd(fd); long ret; if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, call->args[1], call->args[2]); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_ioctl(const struct syscall_info* call) { switch (call->args[1]) { case BTRFS_IOC_CLONE_RANGE: case FIOCLEX: case FIONCLEX: return sys_safe_nonblocking_ioctl(call); default: return traced_raw_syscall(call); } } static long sys_futex(const struct syscall_info* call) { enum { FUTEX_USES_UADDR2 = 1 << 0, }; int op = call->args[1]; int flags = 0; switch (FUTEX_CMD_MASK & op) { case FUTEX_WAKE: break; case FUTEX_CMP_REQUEUE: case FUTEX_WAKE_OP: flags |= FUTEX_USES_UADDR2; break; /* It turns out not to be worth buffering the FUTEX_WAIT* * calls. When a WAIT call is made, we know almost for sure * that the tracee is going to be desched'd (otherwise the * userspace CAS would have succeeded). This is unlike * read/write, f.e., where the vast majority of calls aren't * desched'd and the overhead is worth it. So all that * buffering WAIT does is add the overhead of arming/disarming * desched (which is a measurable perf loss). * * NB: don't ever try to buffer FUTEX_LOCK_PI; it requires * special processing in the tracer process (in addition to * not being worth doing for perf reasons). */ default: return traced_raw_syscall(call); } const int syscallno = SYS_futex; uint32_t* uaddr = (uint32_t*)call->args[0]; uint32_t val = call->args[2]; const struct timespec* timeout = (const struct timespec*)call->args[3]; uint32_t* uaddr2 = (uint32_t*)call->args[4]; uint32_t val3 = call->args[5]; void* ptr = prep_syscall(); uint32_t* saved_uaddr; uint32_t* saved_uaddr2 = NULL; long ret; assert(syscallno == call->no); /* We have to record the value of the futex at kernel exit, * but we can't substitute a scratch pointer for the uaddrs: * the futex identity is the memory cell. There are schemes * that would allow us to use scratch futexes, but they get * complicated quickly. */ saved_uaddr = ptr; ptr += sizeof(*saved_uaddr); if (FUTEX_USES_UADDR2 & flags) { saved_uaddr2 = ptr; ptr += sizeof(*saved_uaddr2); } /* See above; it's not worth buffering may-block futex * calls. */ if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall6(syscallno, uaddr, op, val, timeout, uaddr2, val3); /* During recording, save the real outparams to the buffer. * During replay, save the values from the buffer to the real outparams. * * The *ONLY* reason it's correct for us to read the outparams * carelessly is that rr protects this syscallbuf * transaction as as a critical section. */ copy_futex_int(saved_uaddr, uaddr); if (saved_uaddr2) { copy_futex_int(saved_uaddr2, uaddr2); } return commit_raw_syscall(syscallno, ptr, ret); } static long sys_generic_getdents(const struct syscall_info* call) { int fd = (int)call->args[0]; void* buf = (void*)call->args[1]; unsigned int count = (unsigned int)call->args[2]; void* ptr = prep_syscall_for_fd(fd); void* buf2 = NULL; long ret; if (buf && count > 0) { buf2 = ptr; ptr += count; } if (!start_commit_buffered_syscall(call->no, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(call->no, fd, buf2, count); ptr = copy_output_buffer(ret, ptr, buf, buf2); return commit_raw_syscall(call->no, ptr, ret); } static long sys_getdents(const struct syscall_info* call) { return sys_generic_getdents(call); } static long sys_getdents64(const struct syscall_info* call) { return sys_generic_getdents(call); } static long sys_gettimeofday(const struct syscall_info* call) { const int syscallno = SYS_gettimeofday; struct timeval* tp = (struct timeval*)call->args[0]; struct timezone* tzp = (struct timezone*)call->args[1]; /* XXX it seems odd that clock_gettime() is spec'd to be * async-signal-safe while gettimeofday() isn't, but that's * what the docs say! */ void* ptr = prep_syscall(); struct timeval* tp2 = NULL; struct timezone* tzp2 = NULL; long ret; assert(syscallno == call->no); if (tp) { tp2 = ptr; ptr += sizeof(*tp2); } if (tzp) { tzp2 = ptr; ptr += sizeof(*tzp2); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall2(syscallno, tp2, tzp2); if (tp) { local_memcpy(tp, tp2, sizeof(*tp)); } if (tzp) { local_memcpy(tzp, tzp2, sizeof(*tzp)); } return commit_raw_syscall(syscallno, ptr, ret); } static long sys_generic_getxattr(const struct syscall_info* call) { const char* path = (const char*)call->args[0]; const char* name = (const char*)call->args[1]; void* value = (void*)call->args[2]; size_t size = call->args[3]; void* ptr = prep_syscall(); void* value2 = NULL; long ret; if (value && size > 0) { value2 = ptr; ptr += size; } if (!start_commit_buffered_syscall(call->no, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall4(call->no, path, name, value2, size); ptr = copy_output_buffer(ret > (long)size ? (long)size : ret, ptr, value, value2); return commit_raw_syscall(call->no, ptr, ret); } static long sys_getxattr(const struct syscall_info* call) { return sys_generic_getxattr(call); } static long sys_lgetxattr(const struct syscall_info* call) { return sys_generic_getxattr(call); } static long sys_fgetxattr(const struct syscall_info* call) { int fd = (int)call->args[0]; const char* name = (const char*)call->args[1]; void* value = (void*)call->args[2]; size_t size = call->args[3]; void* ptr = prep_syscall_for_fd(fd); void* value2 = NULL; long ret; if (value && size > 0) { value2 = ptr; ptr += size; } if (!start_commit_buffered_syscall(call->no, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall4(call->no, fd, name, value2, size); ptr = copy_output_buffer(ret > (long)size ? (long)size : ret, ptr, value, value2); return commit_raw_syscall(call->no, ptr, ret); } static long sys_generic_listxattr(const struct syscall_info* call) { char* path = (char*)call->args[0]; char* buf = (char*)call->args[1]; size_t size = call->args[2]; void* ptr = prep_syscall(); void* buf2 = NULL; long ret; if (buf && size > 0) { buf2 = ptr; ptr += size; } if (!start_commit_buffered_syscall(call->no, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(call->no, path, buf2, size); ptr = copy_output_buffer(ret > (long)size ? (long)size : ret, ptr, buf, buf2); return commit_raw_syscall(call->no, ptr, ret); } static long sys_listxattr(const struct syscall_info* call) { return sys_generic_listxattr(call); } static long sys_llistxattr(const struct syscall_info* call) { return sys_generic_listxattr(call); } #if defined(SYS__llseek) static long sys__llseek(const struct syscall_info* call) { const int syscallno = SYS__llseek; int fd = call->args[0]; unsigned long offset_high = call->args[1]; unsigned long offset_low = call->args[2]; loff_t* result = (loff_t*)call->args[3]; unsigned int whence = call->args[4]; void* ptr = prep_syscall_for_fd(fd); loff_t* result2 = NULL; long ret; assert(syscallno == call->no); if (result) { result2 = ptr; ptr += sizeof(*result2); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } if (result2) { memcpy_input_parameter(result2, result, sizeof(*result2)); } ret = untraced_syscall5(syscallno, fd, offset_high, offset_low, result2, whence); if (result2) { *result = *result2; } return commit_raw_syscall(syscallno, ptr, ret); } #endif static long sys_madvise(const struct syscall_info* call) { const int syscallno = SYS_madvise; void* addr = (void*)call->args[0]; size_t length = call->args[1]; int advice = call->args[2]; void* ptr; long ret; switch (advice) { // Whitelist advice values that we know are OK to pass through to the // kernel directly. case MADV_NORMAL: case MADV_RANDOM: case MADV_SEQUENTIAL: case MADV_WILLNEED: case MADV_DONTNEED: case MADV_MERGEABLE: case MADV_UNMERGEABLE: case MADV_HUGEPAGE: case MADV_NOHUGEPAGE: case MADV_DONTDUMP: case MADV_DODUMP: break; default: return traced_raw_syscall(call); } ptr = prep_syscall(); assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } /* Ensure this syscall happens during replay. In particular MADV_DONTNEED * must be executed. */ ret = untraced_replayed_syscall3(syscallno, addr, length, advice); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_mprotect(const struct syscall_info* call) { const int syscallno = SYS_mprotect; void* addr = (void*)call->args[0]; size_t length = call->args[1]; int prot = call->args[2]; struct mprotect_record* mrec; void* ptr; long ret; if ((prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC)) || !buffer_hdr() || buffer_hdr()->mprotect_record_count >= MPROTECT_RECORD_COUNT) { return traced_raw_syscall(call); } ptr = prep_syscall(); assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } mrec = &globals.mprotect_records[buffer_hdr()->mprotect_record_count++]; mrec->start = (uint64_t)(uintptr_t)addr; mrec->size = length; mrec->prot = prot; ret = untraced_replayed_syscall3(syscallno, addr, length, prot); buffer_hdr()->mprotect_record_count_completed++; return commit_raw_syscall(syscallno, ptr, ret); } static long sys_open(const struct syscall_info* call) { const int syscallno = SYS_open; const char* pathname = (const char*)call->args[0]; int flags = call->args[1]; mode_t mode = call->args[2]; /* NB: not arming the desched event is technically correct, * since open() can't deadlock if it blocks. However, not * allowing descheds here may cause performance issues if the * open does block for a while. Err on the side of simplicity * until we have perf data. */ void* ptr; long ret; assert(syscallno == call->no); /* The strcmp()s done here are OK because we're not in the * critical section yet. */ if (!allow_buffered_open(pathname)) { return traced_raw_syscall(call); } ptr = prep_syscall(); if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, pathname, flags, mode); return commit_raw_syscall(syscallno, ptr, ret); } /** * Make this function external so desched_ticks.py can set a breakpoint on it. */ void __before_poll_syscall_breakpoint(void) {} static long sys_poll(const struct syscall_info* call) { const int syscallno = SYS_poll; struct pollfd* fds = (struct pollfd*)call->args[0]; unsigned int nfds = call->args[1]; int timeout = call->args[2]; void* ptr = prep_syscall(); struct pollfd* fds2 = NULL; long ret; assert(syscallno == call->no); if (fds && nfds > 0) { fds2 = ptr; ptr += nfds * sizeof(*fds2); } if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } if (fds2) { memcpy_input_parameter(fds2, fds, nfds * sizeof(*fds2)); } __before_poll_syscall_breakpoint(); ret = untraced_syscall3(syscallno, fds2, nfds, timeout); if (fds2 && ret >= 0) { /* NB: even when poll returns 0 indicating no pending * fds, it still sets each .revent outparam to 0. * (Reasonably.) So we always need to copy on return * value >= 0. * It's important that we not copy when there's an error. * The syscallbuf commit might have been aborted, which means * during replay fds2 might be non-recorded data, so we'd be * incorrectly trashing 'fds'. */ local_memcpy(fds, fds2, nfds * sizeof(*fds)); } return commit_raw_syscall(syscallno, ptr, ret); } #define CLONE_SIZE_THRESHOLD 0x10000 static long sys_read(const struct syscall_info* call) { const int syscallno = SYS_read; int fd = call->args[0]; void* buf = (void*)call->args[1]; size_t count = call->args[2]; void* ptr; void* buf2 = NULL; long ret; /* Try cloning data using CLONE_RANGE ioctl. * XXX switch to FIOCLONERANGE when that's more widely available. It's the * same ioctl number so it won't affect rr per se but it'd be cleaner code. * 64-bit only for now, since lseek and pread64 need special handling for * 32-bit. * Basically we break down the read into three syscalls lseek, clone and * read-from-clone, each of which is individually syscall-buffered. * Crucially, the read-from-clone syscall does NOT store data in the syscall * buffer; instead, we perform the syscall during replay, assuming that * cloned_file_data_fd is open to the same file during replay. * Reads that hit EOF are rejected by the CLONE_RANGE ioctl so we take the * slow path. That's OK. * There is a possible race here: between cloning the data and reading from * |fd|, |fd|'s data may be overwritten, in which case the data read during * replay will not match the data read during recording, causing divergence. * I don't see any performant way to avoid this race; I tried reading from * the cloned data instead of |fd|, but that is very slow because readahead * doesn't work. (The cloned data file always ends at the current offset so * there is nothing to readahead.) However, if an application triggers this * race, it's almost certainly a bad bug because Linux can return any * interleaving of old+new data for the read even without rr. */ if (buf && count >= CLONE_SIZE_THRESHOLD && thread_locals->cloned_file_data_fd >= 0 && is_bufferable_fd(fd) && sizeof(void*) == 8 && !(count & 4095)) { struct syscall_info lseek_call = { SYS_lseek, { fd, 0, SEEK_CUR, 0, 0, 0 } }; off_t lseek_ret = sys_generic_nonblocking_fd(&lseek_call); if (lseek_ret > 0 && !(lseek_ret & 4095)) { struct btrfs_ioctl_clone_range_args ioctl_args; int ioctl_ret; void* ioctl_ptr = prep_syscall(); ioctl_args.src_fd = fd; ioctl_args.src_offset = lseek_ret; ioctl_args.src_length = count; ioctl_args.dest_offset = thread_locals->cloned_file_data_offset; /* Don't call sys_ioctl here; cloned_file_data_fd has syscall buffering * disabled for it so rr can reject attempts to close/dup to it. But * we want to allow syscall buffering of this ioctl on it. */ if (!start_commit_buffered_syscall(SYS_ioctl, ioctl_ptr, WONT_BLOCK)) { struct syscall_info ioctl_call = { SYS_ioctl, { thread_locals->cloned_file_data_fd, BTRFS_IOC_CLONE_RANGE, (long)&ioctl_args, 0, 0, 0 } }; ioctl_ret = traced_raw_syscall(&ioctl_call); } else { ioctl_ret = untraced_syscall3(SYS_ioctl, thread_locals->cloned_file_data_fd, BTRFS_IOC_CLONE_RANGE, &ioctl_args); ioctl_ret = commit_raw_syscall(SYS_ioctl, ioctl_ptr, ioctl_ret); } if (ioctl_ret >= 0) { struct syscall_info read_call = { SYS_read, { fd, (long)buf, count, 0, 0, 0 } }; thread_locals->cloned_file_data_offset += count; replay_only_syscall2(SYS_dup2, thread_locals->cloned_file_data_fd, fd); ptr = prep_syscall(); if (count > thread_locals->scratch_size) { if (!start_commit_buffered_syscall(SYS_read, ptr, WONT_BLOCK)) { return traced_raw_syscall(&read_call); } ret = untraced_replayed_syscall3(SYS_read, fd, buf, count); } else { if (!start_commit_buffered_syscall(SYS_read, ptr, MAY_BLOCK)) { return traced_raw_syscall(&read_call); } ret = untraced_replayed_syscall3(SYS_read, fd, thread_locals->scratch_buf, count); copy_output_buffer(ret, NULL, buf, thread_locals->scratch_buf); } // Do this now before we finish processing the syscallbuf record. // This means the syscall will be executed in // ReplaySession::flush_syscallbuf instead of // ReplaySession::enter_syscall or something similar. replay_only_syscall1(SYS_close, fd); ret = commit_raw_syscall(SYS_read, ptr, ret); return ret; } } } ptr = prep_syscall_for_fd(fd); assert(syscallno == call->no); if (buf && count > 0) { buf2 = ptr; ptr += count; } if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, buf2, count); ptr = copy_output_buffer(ret, ptr, buf, buf2); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_readlink(const struct syscall_info* call) { const int syscallno = SYS_readlink; const char* path = (const char*)call->args[0]; char* buf = (char*)call->args[1]; int bufsiz = call->args[2]; void* ptr = prep_syscall(); char* buf2 = NULL; long ret; assert(syscallno == call->no); if (buf && bufsiz > 0) { buf2 = ptr; ptr += bufsiz; } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, path, buf2, bufsiz); ptr = copy_output_buffer(ret, ptr, buf, buf2); return commit_raw_syscall(syscallno, ptr, ret); } #if defined(SYS_socketcall) static long sys_socketcall_recv(const struct syscall_info* call) { const int syscallno = SYS_socketcall; long* args = (long*)call->args[1]; int sockfd = args[0]; void* buf = (void*)args[1]; size_t len = args[2]; unsigned int flags = args[3]; unsigned long new_args[4]; void* ptr = prep_syscall_for_fd(sockfd); void* buf2 = NULL; long ret; assert(syscallno == call->no); if (buf && len > 0) { buf2 = ptr; ptr += len; } if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } new_args[0] = sockfd; new_args[1] = (unsigned long)buf2; new_args[2] = len; new_args[3] = flags; ret = untraced_syscall2(SYS_socketcall, SYS_RECV, new_args); ptr = copy_output_buffer(ret, ptr, buf, buf2); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_socketcall(const struct syscall_info* call) { switch (call->args[0]) { case SYS_RECV: return sys_socketcall_recv(call); default: return traced_raw_syscall(call); } } #endif #ifdef SYS_recvfrom static long sys_recvfrom(const struct syscall_info* call) { const int syscallno = SYS_recvfrom; int sockfd = call->args[0]; void* buf = (void*)call->args[1]; size_t len = call->args[2]; int flags = call->args[3]; /* struct sockaddr isn't useful here since some sockaddrs are bigger than * it. To avoid making false assumptions, treat the sockaddr parameter * as an untyped buffer. */ void* src_addr = (void*)call->args[4]; socklen_t* addrlen = (socklen_t*)call->args[5]; void* ptr = prep_syscall_for_fd(sockfd); void* buf2 = NULL; struct sockaddr* src_addr2 = NULL; socklen_t* addrlen2 = NULL; long ret; assert(syscallno == call->no); /* If addrlen is NULL then src_addr must also be null */ assert(addrlen || !src_addr); if (src_addr) { src_addr2 = ptr; ptr += *addrlen; } if (addrlen) { addrlen2 = ptr; ptr += sizeof(*addrlen); } if (buf && len > 0) { buf2 = ptr; ptr += len; } if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } if (addrlen) { memcpy_input_parameter(addrlen2, addrlen, sizeof(*addrlen2)); } ret = untraced_syscall6(syscallno, sockfd, buf2, len, flags, src_addr2, addrlen2); if (ret >= 0) { if (src_addr2) { socklen_t actual_size = *addrlen2; if (actual_size > *addrlen) { actual_size = *addrlen; } local_memcpy(src_addr, src_addr2, actual_size); } if (addrlen2) { *addrlen = *addrlen2; } } ptr = copy_output_buffer(ret, ptr, buf, buf2); return commit_raw_syscall(syscallno, ptr, ret); } #endif #ifdef SYS_recvmsg static long sys_recvmsg(const struct syscall_info* call) { const int syscallno = SYS_recvmsg; int sockfd = call->args[0]; struct msghdr* msg = (struct msghdr*)call->args[1]; int flags = call->args[2]; void* ptr = prep_syscall_for_fd(sockfd); long ret; struct msghdr* msg2; void* ptr_base = ptr; void* ptr_overwritten_end; void* ptr_bytes_start; void* ptr_end; size_t i; assert(syscallno == call->no); /* Compute final buffer size up front, before writing syscall inputs to the * buffer. Thus if we decide not to buffer this syscall, we bail out * before trying to write to a buffer that won't be recorded and may be * invalid (e.g. overflow). */ ptr += sizeof(struct msghdr) + sizeof(struct iovec) * msg->msg_iovlen; if (msg->msg_name) { ptr += msg->msg_namelen; } if (msg->msg_control) { ptr += msg->msg_controllen; } for (i = 0; i < msg->msg_iovlen; ++i) { ptr += msg->msg_iov[i].iov_len; } if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } /** * The kernel only writes to the struct msghdr, and the iov buffers. We must * not overwrite that data (except using memcpy_input_parameter) during * replay. For the rest of the data, the values we write here during replay * are guaranteed to match what was recorded in the buffer. * We can't rely on the values we wrote here during recording also being * here during replay since the syscall might have been aborted and our * written data not recorded. */ msg2 = ptr = ptr_base; memcpy_input_parameter(msg2, msg, sizeof(*msg)); ptr += sizeof(struct msghdr); msg2->msg_iov = ptr; ptr += sizeof(struct iovec) * msg->msg_iovlen; ptr_overwritten_end = ptr; if (msg->msg_name) { msg2->msg_name = ptr; ptr += msg->msg_namelen; } if (msg->msg_control) { msg2->msg_control = ptr; ptr += msg->msg_controllen; } ptr_bytes_start = ptr; for (i = 0; i < msg->msg_iovlen; ++i) { msg2->msg_iov[i].iov_base = ptr; ptr += msg->msg_iov[i].iov_len; msg2->msg_iov[i].iov_len = msg->msg_iov[i].iov_len; } ret = untraced_syscall3(syscallno, sockfd, msg2, flags); if (ret >= 0) { size_t bytes = ret; size_t i; if (msg->msg_name) { local_memcpy(msg->msg_name, msg2->msg_name, msg2->msg_namelen); } msg->msg_namelen = msg2->msg_namelen; if (msg->msg_control) { local_memcpy(msg->msg_control, msg2->msg_control, msg2->msg_controllen); } msg->msg_controllen = msg2->msg_controllen; ptr_end = ptr_bytes_start + bytes; for (i = 0; i < msg->msg_iovlen; ++i) { long copy_bytes = bytes < msg->msg_iov[i].iov_len ? bytes : msg->msg_iov[i].iov_len; local_memcpy(msg->msg_iov[i].iov_base, msg2->msg_iov[i].iov_base, copy_bytes); bytes -= copy_bytes; } msg->msg_flags = msg2->msg_flags; if (msg->msg_controllen) { /* When we reach a safe point, notify rr that the control message was * received. */ thread_locals->notify_control_msg = msg; } } else { /* Allocate record space as least to cover the data we overwrote above. * We don't want to start the next record overlapping that data, since then * we'll corrupt it during replay. */ ptr_end = ptr_overwritten_end; } return commit_raw_syscall(syscallno, ptr_end, ret); } #endif #ifdef SYS_sendmsg static long sys_sendmsg(const struct syscall_info* call) { const int syscallno = SYS_sendmsg; int sockfd = call->args[0]; struct msghdr* msg = (struct msghdr*)call->args[1]; int flags = call->args[2]; void* ptr = prep_syscall_for_fd(sockfd); long ret; assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, sockfd, msg, flags); return commit_raw_syscall(syscallno, ptr, ret); } #endif #ifdef SYS_socketpair typedef int two_ints[2]; static long sys_socketpair(const struct syscall_info* call) { const int syscallno = SYS_socketpair; int domain = call->args[0]; int type = call->args[1]; int protocol = call->args[2]; two_ints* sv = (two_ints*)call->args[3]; void* ptr = prep_syscall(); struct timezone* sv2 = NULL; long ret; assert(syscallno == call->no); sv2 = ptr; ptr += sizeof(*sv2); if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall4(syscallno, domain, type, protocol, sv2); local_memcpy(sv, sv2, sizeof(*sv)); return commit_raw_syscall(syscallno, ptr, ret); } #endif static long sys_time(const struct syscall_info* call) { const int syscallno = SYS_time; time_t* tp = (time_t*)call->args[0]; void* ptr = prep_syscall(); long ret; assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall1(syscallno, NULL); if (tp) { /* No error is possible here. */ *tp = ret; } return commit_raw_syscall(syscallno, ptr, ret); } static long sys_xstat64(const struct syscall_info* call) { const int syscallno = call->no; /* NB: this arg may be a string or an fd, but for the purposes * of this generic helper we don't care. */ long what = call->args[0]; struct stat64* buf = (struct stat64*)call->args[1]; /* Like open(), not arming the desched event because it's not * needed for correctness, and there are no data to suggest * whether it's a good idea perf-wise. */ void* ptr = prep_syscall(); struct stat64* buf2 = NULL; long ret; if (buf) { buf2 = ptr; ptr += sizeof(*buf2); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall2(syscallno, what, buf2); if (buf2) { local_memcpy(buf, buf2, sizeof(*buf)); } return commit_raw_syscall(syscallno, ptr, ret); } static long sys_write(const struct syscall_info* call) { const int syscallno = SYS_write; int fd = call->args[0]; const void* buf = (const void*)call->args[1]; size_t count = call->args[2]; void* ptr = prep_syscall_for_fd(fd); long ret; assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, buf, count); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_writev(const struct syscall_info* call) { int syscallno = SYS_writev; int fd = call->args[0]; const struct iovec* iov = (const struct iovec*)call->args[1]; unsigned long iovcnt = call->args[2]; void* ptr = prep_syscall_for_fd(fd); long ret; assert(syscallno == call->no); if (!start_commit_buffered_syscall(syscallno, ptr, MAY_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall3(syscallno, fd, iov, iovcnt); return commit_raw_syscall(syscallno, ptr, ret); } static long sys_getrusage(const struct syscall_info* call) { const int syscallno = SYS_getrusage; int who = (int)call->args[0]; struct rusage* buf = (struct rusage*)call->args[1]; void* ptr = prep_syscall(); long ret; struct rusage* buf2 = NULL; assert(syscallno == call->no); if (buf) { buf2 = ptr; ptr += sizeof(struct rusage); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } ret = untraced_syscall2(syscallno, who, buf2); if (buf2 && ret >= 0) { local_memcpy(buf, buf2, sizeof(*buf)); } return commit_raw_syscall(syscallno, ptr, ret); } // The alignment of this struct is incorrect, but as long as it's not // used inside other structures, defining it this way makes the code below // easier. typedef uint64_t kernel_sigset_t; static long sys_rt_sigprocmask(const struct syscall_info* call) { const int syscallno = SYS_rt_sigprocmask; long ret; kernel_sigset_t modified_set; void* oldset2 = NULL; struct syscallbuf_hdr* hdr; kernel_sigset_t previous_set; void* ptr = prep_syscall(); int how = (int)call->args[0]; const kernel_sigset_t* set = (const kernel_sigset_t*)call->args[1]; kernel_sigset_t* oldset = (kernel_sigset_t*)call->args[2]; if (oldset) { oldset2 = ptr; ptr += sizeof(kernel_sigset_t); } if (!start_commit_buffered_syscall(syscallno, ptr, WONT_BLOCK)) { return traced_raw_syscall(call); } if (set && (how == SIG_BLOCK || how == SIG_SETMASK)) { local_memcpy(&modified_set, set, sizeof(kernel_sigset_t)); // SIGSTKFLT (PerfCounters::TIME_SLICE_SIGNAL) and // SIGPWR(SYSCALLBUF_DESCHED_SIGNAL) are used by rr modified_set &= ~(((uint64_t)1) << (SIGSTKFLT - 1)) & ~(((uint64_t)1) << (SIGPWR - 1)); set = &modified_set; } hdr = buffer_hdr(); previous_set = hdr->blocked_sigs; /* Update |blocked_sigs| now so that if the syscall succeeds and a blocked * signal is raised before it returns, rr sees the updated signal mask. */ if (set) { switch (how) { case SIG_UNBLOCK: hdr->blocked_sigs &= ~*set; break; case SIG_BLOCK: hdr->blocked_sigs |= *set; break; case SIG_SETMASK: hdr->blocked_sigs = *set; break; } } ret = untraced_syscall4(syscallno, how, set, oldset2, call->args[3]); if (ret == 0) { if (oldset2) { local_memcpy(oldset, oldset2, sizeof(kernel_sigset_t)); } } else { /* Ssyscall failed; don't update |blocked_sigs|! */ hdr->blocked_sigs = previous_set; } return commit_raw_syscall(syscallno, ptr, ret); } static long syscall_hook_internal(const struct syscall_info* call) { switch (call->no) { #define CASE(syscallname) \ case SYS_##syscallname: \ return sys_##syscallname(call) #define CASE_GENERIC_NONBLOCKING(syscallname) \ case SYS_##syscallname: \ return sys_generic_nonblocking(call) #define CASE_GENERIC_NONBLOCKING_FD(syscallname) \ case SYS_##syscallname: \ return sys_generic_nonblocking_fd(call) CASE_GENERIC_NONBLOCKING(access); CASE(clock_gettime); CASE_GENERIC_NONBLOCKING_FD(close); CASE(creat); CASE_GENERIC_NONBLOCKING(fchmod); CASE_GENERIC_NONBLOCKING_FD(fadvise64); #if defined(SYS_fcntl64) CASE(fcntl64); #else CASE(fcntl); #endif CASE(rt_sigprocmask); CASE(fgetxattr); CASE(flistxattr); CASE_GENERIC_NONBLOCKING_FD(fsetxattr); CASE(futex); CASE(getdents); CASE(getdents64); CASE_GENERIC_NONBLOCKING(geteuid); CASE_GENERIC_NONBLOCKING(getpid); CASE(getrusage); CASE_GENERIC_NONBLOCKING(gettid); CASE(gettimeofday); CASE(getxattr); CASE(ioctl); CASE_GENERIC_NONBLOCKING(lchown); CASE(lgetxattr); CASE(listxattr); CASE(llistxattr); #if defined(SYS__llseek) CASE(_llseek); #endif CASE_GENERIC_NONBLOCKING_FD(lseek); CASE(madvise); CASE_GENERIC_NONBLOCKING(mkdir); CASE_GENERIC_NONBLOCKING(mknod); CASE(mprotect); CASE(open); CASE(poll); CASE(read); CASE(readlink); #if defined(SYS_recvfrom) CASE(recvfrom); #endif #if defined(SYS_recvmsg) CASE(recvmsg); #endif #if defined(SYS_sendmsg) CASE(sendmsg); #endif CASE_GENERIC_NONBLOCKING(setxattr); #if defined(SYS_socketcall) CASE(socketcall); #endif #if defined(SYS_socketpair) CASE(socketpair); #endif CASE_GENERIC_NONBLOCKING(symlink); CASE(time); CASE_GENERIC_NONBLOCKING_FD(utimensat); CASE(write); CASE(writev); #undef CASE #if defined(SYS_fstat64) case SYS_fstat64: #else case SYS_fstat: #endif #if defined(SYS_lstat64) case SYS_lstat64: #else case SYS_lstat: #endif #if defined(SYS_stat64) case SYS_stat64: #else case SYS_stat: #endif return sys_xstat64(call); default: return traced_raw_syscall(call); } } /* Explicitly declare this as hidden so we can call it from * _syscall_hook_trampoline without doing all sorts of special PIC handling. */ RR_HIDDEN long syscall_hook(const struct syscall_info* call) { // Initialize thread-local state if this is the first syscall for this // thread. init_thread(); long result = syscall_hook_internal(call); if (buffer_hdr() && buffer_hdr()->notify_on_syscall_hook_exit) { // SYS_rrcall_notify_syscall_hook_exit will clear // notify_on_syscall_hook_exit. Clearing it ourselves is tricky to get // right without races. // // During recording, this flag is set when the recorder needs to delay // delivery of a signal until we've stopped using the syscallbuf. // During replay, this flag is set when the next event is entering a // SYS_rrcall_notify_syscall_hook_exit. // // The correctness argument is as follows: // Correctness requires that a) replay's setting of the flag happens before // we read the flag in the call to syscall_hook that triggered the // SYS_rrcall_notify_syscall_hook_exit and b) replay's setting of the flag // must happen after we read the flag in the previous execution of // syscall_hook. // Condition a) holds as long as no events are recorded between the // checking of the flag above and the execution of this syscall. This // should be the case; no synchronous signals or syscalls are // triggerable, all async signals other than SYSCALLBUF_DESCHED_SIGNAL // are delayed, and SYSCALLBUF_DESCHED_SIGNAL shouldn't fire since we've // disarmed the desched fd at this point. SYSCALLBUF_FLUSH events may be // emitted when we process the SYS_rrcall_notify_syscall_hook_exit event, // but replay of those events ends at the last flushed syscall, before // we exit syscall_hook_internal. // Condition b) failing would mean no new events were generated between // testing the flag in the previous syscall_hook and the execution of this // SYS_rrcall_notify_syscall_hook_exit. However, every invocation of // syscall_hook_internal generates either a traced syscall or a syscallbuf // record that would be flushed by SYSCALLBUF_FLUSH, so that can't // happen. // // Another crazy thing is going on here: it's possible that a signal // intended to be delivered result = _raw_syscall(SYS_rrcall_notify_syscall_hook_exit, call->args[0], call->args[1], call->args[2], call->args[3], call->args[4], call->args[5], RR_PAGE_SYSCALL_PRIVILEGED_TRACED, result, call->no); } // Do work that can only be safely done after syscallbuf can be flushed if (thread_locals->notify_control_msg) { privileged_traced_syscall1(SYS_rrcall_notify_control_msg, thread_locals->notify_control_msg); thread_locals->notify_control_msg = NULL; } return result; } /** * Exported glibc synonym for |sysconf()|. We can't use |dlsym()| to * resolve the next "sysconf" symbol, because * - dlysym usually calls malloc() * - custom allocators like jemalloc may use sysconf() * - if our sysconf wrapper is re-entered during initialization, it * has nothing to fall back on to get the conf name, and chaos will * likely ensue if we return something random. */ long __sysconf(int name); /** * Pretend that only 1 processor is configured/online, because rr * binds all tracees to one logical CPU. */ long sysconf(int name) { switch (name) { case _SC_NPROCESSORS_ONLN: case _SC_NPROCESSORS_CONF: return globals.pretend_num_cores ? globals.pretend_num_cores : 1; } return __sysconf(name); } /** Disable XShm since rr doesn't work with it */ int XShmQueryExtension(__attribute__((unused)) void* dpy) { return 0; } /** Make sure XShmCreateImage returns null in case an application doesn't do extension checks first. */ void* XShmCreateImage(__attribute__((unused)) register void* dpy, __attribute__((unused)) register void* visual, __attribute__((unused)) unsigned int depth, __attribute__((unused)) int format, __attribute__((unused)) char* data, __attribute__((unused)) void* shminfo, __attribute__((unused)) unsigned int width, __attribute__((unused)) unsigned int height) { return 0; } /** * This is for testing purposes only. */ void very_slow_exit_syscall(void) { int i; int result = 0; struct syscall_info info; for (i = 0; i < 1000000; ++i) { result += i * i; } info.no = SYS_exit; info.args[0] = result; syscall_hook(&info); } /** * glibc geteuid() can be compiled to instructions ending in "syscall; ret" * which can't be hooked. So override it here and call the hook directly. */ uid_t geteuid(void) { struct syscall_info call = { SYS_geteuid, { 0, 0, 0, 0, 0, 0 } }; return syscall_hook(&call); } typedef void* (*fopen_ptr)(const char* filename, const char* mode); static void random_device_init_helper(void* this) { void** file_ptr = (void**)this; void* f_ptr = dlsym(RTLD_DEFAULT, "fopen"); fopen_ptr fopen = (fopen_ptr)f_ptr; *file_ptr = fopen("/dev/urandom", "rb"); } /** * libstdc++3 uses RDRAND. Bypass that with this incredible hack. */ void _ZNSt13random_device7_M_initERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE( void* this, __attribute__((unused)) void* token) { random_device_init_helper(this); } /** * gcc 4.8.4 in Ubuntu 14.04-32 */ void _ZNSt13random_device7_M_initERKSs(void* this, __attribute__((unused)) void* token) { random_device_init_helper(this); } rr-4.4.0/src/preload/preload_interface.h000066400000000000000000000353311277367620400202210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PRELOAD_INTERFACE_H_ #define RR_PRELOAD_INTERFACE_H_ #include #include #include #include #include #ifndef RR_IMPLEMENT_PRELOAD #include "../remote_ptr.h" #endif /* This header file is included by preload.c and various rr .cc files. It * defines the interface between the preload library and rr. preload.c * #defines RR_IMPLEMENT_PRELOAD to let us handle situations where rr and * preload.c need to see slightly different definitions of the same constructs. * * preload.c compiles this as C code. All rr modules compile this as C++ code. * We do not use 'extern "C"' because we don't actually link between C and C++ * and 'extern "C"' is not compatible with our use of templates below. */ #define SYSCALLBUF_LIB_FILENAME_BASE "librrpreload" #define SYSCALLBUF_LIB_FILENAME SYSCALLBUF_LIB_FILENAME_BASE ".so" #define SYSCALLBUF_LIB_FILENAME_PADDED SYSCALLBUF_LIB_FILENAME_BASE ".so:::" #define SYSCALLBUF_LIB_FILENAME_32 SYSCALLBUF_LIB_FILENAME_BASE "_32.so" /* This is pretty arbitrary. On Linux SIGPWR is sent to PID 1 (init) on * power failure, and it's unlikely rr will be recording that. * Note that SIGUNUSED means SIGSYS which actually *is* used (by seccomp), * so we can't use it. */ #define SYSCALLBUF_DESCHED_SIGNAL SIGPWR /* Set this env var to enable syscall buffering. */ #define SYSCALLBUF_ENABLED_ENV_VAR "_RR_USE_SYSCALLBUF" /* Size of table mapping fd numbers to syscallbuf-disabled flag. * Most Linux kernels limit fds to 1024 so it probably doesn't make sense * to raise this value... */ #define SYSCALLBUF_FDS_DISABLED_SIZE 1024 #define MPROTECT_RECORD_COUNT 1000 /* Must match generate_rr_page.py */ #define RR_PAGE_ADDR 0x70000000 #define RR_PAGE_SYSCALL_STUB_SIZE 3 #define RR_PAGE_SYSCALL_INSTRUCTION_END 2 #define RR_PAGE_SYSCALL_ADDR(index) \ ((void*)(RR_PAGE_ADDR + RR_PAGE_SYSCALL_STUB_SIZE * (index))) #define RR_PAGE_SYSCALL_TRACED RR_PAGE_SYSCALL_ADDR(0) #define RR_PAGE_SYSCALL_PRIVILEGED_TRACED RR_PAGE_SYSCALL_ADDR(1) #define RR_PAGE_SYSCALL_UNTRACED RR_PAGE_SYSCALL_ADDR(2) #define RR_PAGE_SYSCALL_UNTRACED_REPLAY_ONLY RR_PAGE_SYSCALL_ADDR(3) #define RR_PAGE_SYSCALL_UNTRACED_RECORDING_ONLY RR_PAGE_SYSCALL_ADDR(4) #define RR_PAGE_SYSCALL_PRIVILEGED_UNTRACED RR_PAGE_SYSCALL_ADDR(5) #define RR_PAGE_SYSCALL_PRIVILEGED_UNTRACED_REPLAY_ONLY RR_PAGE_SYSCALL_ADDR(6) #define RR_PAGE_SYSCALL_PRIVILEGED_UNTRACED_RECORDING_ONLY \ RR_PAGE_SYSCALL_ADDR(7) #define RR_PAGE_FF_BYTES (RR_PAGE_ADDR + RR_PAGE_SYSCALL_STUB_SIZE * 8) #define PRELOAD_THREAD_LOCALS_ADDR (RR_PAGE_ADDR + PAGE_SIZE) #define PRELOAD_THREAD_LOCALS_SIZE 64 /* "Magic" (rr-implemented) syscalls that we use to initialize the * syscallbuf. * * NB: magic syscalls must be positive, because with at least linux * 3.8.0 / eglibc 2.17, rr only gets a trap for the *entry* of invalid * syscalls, not the exit. rr can't handle that yet. */ /* TODO: static_assert(LAST_SYSCALL < SYS_rrcall_init_buffers) */ /** * The preload library calls SYS_rrcall_init_preload during its * initialization. */ #define SYS_rrcall_init_preload 442 /** * The preload library calls SYS_rrcall_init_buffers in each thread that * gets created (including the initial main thread). */ #define SYS_rrcall_init_buffers 443 /** * The preload library calls SYS_rrcall_notify_syscall_hook_exit when * unlocking the syscallbuf and notify_after_syscall_hook_exit has been set. * The word at 4/8(sp) is returned in the syscall result and the word at * 8/16(sp) is stored in original_syscallno. */ #define SYS_rrcall_notify_syscall_hook_exit 444 /** * When the preload library detects that control data has been received in a * syscallbuf'ed recvmsg, it calls this syscall with a pointer to the * 'struct msg' returned. */ #define SYS_rrcall_notify_control_msg 445 /** * When rr replay has restored the auxv vectors for a new process (completing * emulation of exec), it calls this syscall. It takes one parameter, the tid * of the task that it has restored auxv vectors for. */ #define SYS_rrcall_reload_auxv 446 /* Define macros that let us compile a struct definition either "natively" * (when included by preload.c) or as a template over Arch for use by rr. */ #ifdef RR_IMPLEMENT_PRELOAD #define TEMPLATE_ARCH #define PTR(T) T* #define VOLATILE volatile #else #define TEMPLATE_ARCH template #define PTR(T) typename Arch::template ptr #define VOLATILE #endif /** * To support syscall buffering, we replace syscall instructions with a "call" * instruction that calls a hook in the preload library to handle the syscall. * Since the call instruction takes more space than the syscall instruction, * the patch replaces one or more instructions after the syscall instruction as * well; those instructions are folded into the tail of the hook function * and we have multiple hook functions, each one corresponding to an * instruction that follows a syscall instruction. * Each instance of this struct describes an instruction that can follow a * syscall and a hook function to patch with. */ struct syscall_patch_hook { uint8_t next_instruction_length; uint8_t next_instruction_bytes[6]; uint64_t hook_address; }; /** * We buffer mprotect syscalls. Their effects need to be noted so we can * update AddressSpace's cache of memory layout, which stores prot bits. So, * the preload code builds a list of mprotect_records corresponding to the * mprotect syscalls that have been buffered. This list is read by rr whenever * we flush the syscallbuf, and its effects performed. The actual mprotect * syscalls are performed during recording and replay. * * We simplify things by making this arch-independent. */ struct mprotect_record { uint64_t start; uint64_t size; int32_t prot; int32_t padding; }; /** * Must be arch-independent. * Variables used to communicate between preload and rr. * We package these up into a single struct to simplify the preload/rr * interface. */ struct preload_globals { /* 0 during recording, 1 during replay. Set by rr. * This MUST NOT be used in conditional branches. It should only be used * as the condition for conditional moves so that control flow during replay * does not diverge from control flow during recording. * We also have to be careful that values different between record and replay * don't accidentally leak into other memory locations or registers. * USE WITH CAUTION. */ unsigned char in_replay; /* 0 during recording and replay, 1 during diversion. Set by rr. */ unsigned char in_diversion; /* Number of cores to pretend we have. 0 means 1. rr sets this when * the preload library is initialized. */ int pretend_num_cores; /** * Set by rr. * If syscallbuf_fds_disabled[fd] is nonzero, then operations on that fd * must be performed through traced syscalls, not the syscallbuf. * The rr supervisor modifies this array directly to dynamically turn * syscallbuf on and off for particular fds. fds outside the array range must * never use the syscallbuf. */ VOLATILE char syscallbuf_fds_disabled[SYSCALLBUF_FDS_DISABLED_SIZE]; /* mprotect records. Set by preload. */ struct mprotect_record mprotect_records[MPROTECT_RECORD_COUNT]; }; /** * Packs up the parameters passed to |SYS_rrcall_init_preload|. * We use this struct because it's a little cleaner. */ TEMPLATE_ARCH struct rrcall_init_preload_params { /* All "In" params. */ /* The syscallbuf lib's idea of whether buffering is enabled. * We let the syscallbuf code decide in order to more simply * replay the same decision that was recorded. */ int syscallbuf_enabled; int syscall_patch_hook_count; PTR(struct syscall_patch_hook) syscall_patch_hooks; PTR(void) syscall_hook_trampoline; PTR(void) syscall_hook_end; PTR(struct preload_globals) globals; /* Address of the first entry of the breakpoint table. * After processing a sycallbuf record (and unlocking the syscallbuf), * we call a function in this table corresponding to the record processed. * rr can set a breakpoint in this table to break on the completion of a * particular syscallbuf record. */ PTR(void) breakpoint_table; int breakpoint_table_entry_size; }; /** * Packs up the inout parameters passed to |SYS_rrcall_init_buffers|. * We use this struct because there are too many params to pass * through registers on at least x86. (It's also a little cleaner.) */ TEMPLATE_ARCH struct rrcall_init_buffers_params { /* The fd we're using to track desched events. */ int desched_counter_fd; /* "Out" params. */ int cloned_file_data_fd; /* Returned pointer to and size of the shared syscallbuf * segment. */ PTR(void) syscallbuf_ptr; /* Returned pointer to rr's syscall scratch buffer */ PTR(void) scratch_buf; uint32_t syscallbuf_size; uint32_t scratch_size; }; /** * The syscall buffer comprises an array of these variable-length * records, along with the header below. */ struct syscallbuf_record { /* Return value from the syscall. This can be a memory * address, so must be as big as a memory address can be. * We use 64 bits rather than make syscallbuf_record Arch-specific as that * gets cumbersome. */ int64_t ret; /* Syscall number. * * NB: the x86 linux ABI has 350 syscalls as of 3.9.6 and * x86-64 defines 313, so this is a pretty safe storage * allocation. It would be an earth-shattering event if the * syscall surface were doubled in a short period of time, and * even then we would have a comfortable cushion. Still, * * TODO: static_assert this can hold largest syscall num */ uint16_t syscallno; /* Did the tracee arm/disarm the desched notification for this * syscall? */ uint8_t desched; uint8_t _padding; /* Size of entire record in bytes: this struct plus extra * recorded data stored inline after the last field, not * including padding. * * TODO: static_assert this can repr >= buffer size */ uint32_t size; /* Extra recorded outparam data starts here. */ uint8_t extra_data[0]; }; /** * This struct summarizes the state of the syscall buffer. It happens * to be located at the start of the buffer. */ struct syscallbuf_hdr { /* The number of valid syscallbuf_record bytes in the buffer, * not counting this header. * Make this volatile so that memory writes aren't reordered around * updates to this field. */ volatile uint32_t num_rec_bytes; /* Number of mprotect calls since last syscallbuf flush. The last record in * the list may not have been applied yet. */ volatile uint32_t mprotect_record_count; /* Number of records whose syscalls have definitely completed. * May be one less than mprotect_record_count. */ volatile uint32_t mprotect_record_count_completed; /* True if the current syscall should not be committed to the * buffer, for whatever reason; likely interrupted by * desched. Set by rr. */ uint8_t abort_commit; /* True if, next time we exit the syscall buffer hook, libpreload should * execute SYS_rrcall_notify_syscall_hook_exit to give rr the opportunity to * deliver a signal and/or reset the syscallbuf. */ uint8_t notify_on_syscall_hook_exit; /* This tracks whether the buffer is currently in use for a * system call. This is helpful when a signal handler runs * during a wrapped system call; we don't want it to use the * buffer for its system calls. */ uint8_t locked; /* Nonzero when rr needs to worry about the desched signal. * When it's zero, the desched signal can safely be * discarded. */ uint8_t desched_signal_may_be_relevant; /* A copy of the tasks's signal mask. Updated by both preload and rr in * response to events that change the signal mask. RR stores this in * RecordTask::blocked_sigs, but since some signal mask affecting system * calls may be buffered, that value may be out of date until rr reloads it * from here. */ uint64_t blocked_sigs; struct syscallbuf_record recs[0]; } __attribute__((__packed__)); /* TODO: static_assert(sizeof(uint32_t) == * sizeof(struct syscallbuf_hdr)) */ /** * Return a pointer to what may be the next syscall record. * * THIS POINTER IS NOT GUARANTEED TO BE VALID!!! Caveat emptor. */ inline static struct syscallbuf_record* next_record( struct syscallbuf_hdr* hdr) { uintptr_t next = (uintptr_t)hdr->recs + hdr->num_rec_bytes; return (struct syscallbuf_record*)next; } /** * Return the amount of space that a record of |length| will occupy in * the buffer if committed, including padding. */ inline static long stored_record_size(size_t length) { /* Round up to a whole number of 64-bit words. */ return (length + 7) & ~7; } /** * Return nonzero if an attempted open() of |filename| should be * blocked. * * The background of this hack is that rr doesn't support DRI/DRM * currently, so we use the blunt stick of refusing to open this * interface file as a way of disabling it entirely. (In addition to * tickling xorg.conf, which doesn't entirely do the trick.) It's * known how to fix this particular, so let's not let this hack grow * too much by piling on. */ inline static int is_blacklisted_filename(const char* filename) { return !strncmp("/dev/dri/", filename, 9) || !strcmp("/dev/nvidiactl", filename) || !strcmp("/usr/share/alsa/alsa.conf", filename); } inline static int is_gcrypt_deny_file(const char* filename) { return !strcmp("/etc/gcrypt/hwf.deny", filename); } inline static int is_terminal(const char* filename) { return !strncmp("/dev/tty", filename, 8) || !strncmp("/dev/pts", filename, 8); } inline static int is_proc_mem_file(const char* filename) { if (strncmp("/proc/", filename, 6)) { return 0; } return !strcmp(filename + strlen(filename) - 4, "/mem"); } inline static int is_proc_fd_dir(const char* filename) { if (strncmp("/proc/", filename, 6)) { return 0; } int len = strlen(filename); const char* fd_bit = filename + len; if (*fd_bit == '/') { fd_bit--; } return !strncmp(fd_bit - 3, "/fd", 3); } /** * Returns nonzero if an attempted open() of |filename| can be syscall-buffered. * When this returns zero, the open must be forwarded to the rr process. * This is imperfect because it doesn't handle symbolic links, hard links, * files accessed with non-absolute paths, /proc mounted in differnet places, * etc etc etc. Handling those efficiently (no additional syscalls in * common cases) is a problem. Maybe we could afford fstat after every open... */ inline static int allow_buffered_open(const char* filename) { return !is_blacklisted_filename(filename) && !is_gcrypt_deny_file(filename) && !is_terminal(filename) && !is_proc_mem_file(filename) && !is_proc_fd_dir(filename); } #endif /* RR_PRELOAD_INTERFACE_H_ */ rr-4.4.0/src/preload/raw_syscall.S000066400000000000000000000127371277367620400170560ustar00rootroot00000000000000#if defined(__i386__) .text .globl _raw_syscall .hidden _raw_syscall .type _raw_syscall, @function _raw_syscall: /* syscallno = 4(%esp) */ .cfi_startproc pushl %ebx /* syscallno = 8(%esp) */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %ebx, 0 pushl %esi /* syscallno = 12(%esp) */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %esi, 0 pushl %edi /* syscallno = 16(%esp) */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %edi, 0 pushl %ebp /* syscallno = 20(%esp) */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %ebp, 0 movl 20(%esp), %eax /* %eax = syscallno */ movl 24(%esp), %ebx /* %ebx = a0 */ movl 28(%esp), %ecx /* %ecx = a1 */ movl 32(%esp), %edx /* %edx = a2 */ movl 36(%esp), %esi /* %esi = a3 */ movl 40(%esp), %edi /* %edi = a4 */ movl 44(%esp), %ebp /* %ebp = a5 */ pushl 56(%esp) .cfi_adjust_cfa_offset 4 pushl 56(%esp) .cfi_adjust_cfa_offset 4 call *56(%esp) addl $8,%esp .cfi_adjust_cfa_offset -8 popl %ebp .cfi_adjust_cfa_offset -4 .cfi_restore %ebp popl %edi .cfi_adjust_cfa_offset -4 .cfi_restore %edi popl %esi .cfi_adjust_cfa_offset -4 .cfi_restore %esi popl %ebx .cfi_adjust_cfa_offset -4 .cfi_restore %ebx ret .cfi_endproc .size _raw_syscall, . - _raw_syscall #elif defined(__x86_64__) .text .globl _raw_syscall .hidden _raw_syscall .type _raw_syscall, @function _raw_syscall: .cfi_startproc /* Incoming args are in %rdi, %rsi, %rdx, %rcx, %r8, %r9, and 8(%rsp). Syscall arguments are %rdi, %rsi, %rdx, %r10, %r8, %r9. */ movq %rdi, %rax /* syscall number */ movq %rsi, %rdi /* first syscall arg */ movq %rdx, %rsi /* second syscall arg */ movq %rcx, %rdx /* third syscall arg */ movq %r8, %r10 /* fourth syscall arg */ movq %r9, %r8 /* fifth syscall arg */ movq 8(%rsp), %r9 /* sixth syscall arg */ pushq 32(%rsp) .cfi_adjust_cfa_offset 8 pushq 32(%rsp) .cfi_adjust_cfa_offset 8 /* During a system call the kernel makes some user-space-visible register changes: a) on entry, %r11 is set to %rflags b) %rcx is sometimes set to -1 (perhaps because of something rr does) c) on entry or exit, some flags are sometimes changed Also, during replay we may perform single-stepping which can set TF (trace flag). We need to hide this. fixup_syscall_registers is responsible for fixing up registers to hide these effects when we get a ptrace trap from system calls in the kernel: it clears TF from %r11, forces %rcx to -1, and sets flags to fixed values (ZF+PF+IF+reserved, same as for "xor reg,reg"). Task::emulate_syscall_entry is responsible for fixing up registers when we emulate a system call that was traced during recording (by running to a breakpoint at that system call). It does the above effects after setting %r11 to %rflags. For untraced system calls there is no trap to rr during recording or replay, so we must handle these issues here. We do not need untraced system calls to behave exactly the same as traced system calls, since whether a given system call was traced or not is the same whether recording or replaying, but it's a good idea to make them as similar as possible. We do need register values to be perfectly consistent at every instruction in every replay whether or not singlestepping is used (because a ReplayTimeline::mark might be created at any point). During replay, untraced syscall instructions are replaced with "xor %eax,%eax". The following code is harmless for traced syscalls (and needs to be, because traced syscalls go through here too). */ /* Set %r11 and %rcx to the values we expect them to have after the system call. Set flags to ZF+PF+IF+reserved (0x246) first. This simplifies everything. This all has to be independent of TF being set at any point during replay! But the way we're doing it here, it's trivial. */ xor %ecx,%ecx /* At this point, flags are 0x246 + possibly TF. */ movq $0x246,%r11 movq $-1,%rcx callq *32(%rsp) /* At this point, during recording we don't trust the kernel to have restored flags correctly. It probably doesn't matter, but fix it anyway. */ xor %ecx,%ecx /* At this point, the high 32 bits of %rcx are unknown. Fix that by setting to -1 to match traced syscalls. */ movq $-1,%rcx /* At this point, %r11 is always 0x246 during replay and during recording (because TF is never set during recording). Nothing to fix in %r11. */ addq $16,%rsp .cfi_adjust_cfa_offset -16 ret .cfi_endproc .size _raw_syscall, . - _raw_syscall #else #error unknown CPU architecture #endif /* __i386__/__x86_64__ */ .section .note.GNU-stack,"",@progbits .previous rr-4.4.0/src/preload/syscall_hook.S000066400000000000000000000221161277367620400172150ustar00rootroot00000000000000 /* This must match the numbers in X86SyscallStubMonkeypatch and X64SyscallStubMonkeypatch */ .set _syscall_stack_adjust,256 /* This must exceed the maximum stack usage of the syscall hook and its callees */ .set _stack_pad_size,2048 /* _syscall_hook_trampoline must be the first instruction defined in this file, and _syscall_hook_end must be at the end of the last instruction. */ .global _syscall_hook_trampoline .hidden _syscall_hook_trampoline .type _syscall_hook_trampoline, @function .global _syscall_hook_end .hidden _syscall_hook_end #if defined(__i386__) /** * Jump to this hook from |__kernel_vsyscall()|, to buffer syscalls that * we otherwise couldn't wrap through LD_PRELOAD helpers. Return the * *RAW* kernel return value, not the -1/errno mandated by POSIX. * * Remember, this function runs *below* the level of libc. libc can't * know that its call to |__kernel_vsyscall()| has been re-routed to * us. */ .text _syscall_hook_trampoline: .cfi_startproc /* Force the stack to be extended to at least _stack_pad_size. This forces any MAP_GROWSDOWN emulation to happen before we enter the syscallbuf, which avoids having to reason about system calls being recorded while we're in the middle of syscallbuf processing. */ movb $0,-_stack_pad_size(%esp) /* Build a |struct syscall_info| by pushing all the syscall * args and the number onto the stack. */ /* struct syscall_info info; */ pushl %ebp /* info.args[5] = $ebp; */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %ebp, 0 pushl %edi /* info.args[4] = $edi; */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %edi, 0 pushl %esi /* info.args[3] = $esi; */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %esi, 0 pushl %edx /* info.args[2] = $edx; */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %edx, 0 pushl %ecx /* info.args[1] = $ecx; */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %ecx, 0 pushl %ebx /* info.args[0] = $ebx; */ .cfi_adjust_cfa_offset 4 .cfi_rel_offset %ebx, 0 pushl %eax /* info.no = $eax; */ .cfi_adjust_cfa_offset 4 /* $esp points at &info. Push that pointer on the stack as * our arg for vsyscall_hook(). */ movl %esp, %ecx pushl %ecx .cfi_adjust_cfa_offset 4 call syscall_hook /* $eax = vsyscall_hook(&info); */ /* $eax is now the syscall return value. Erase the |&info| * arg and |info.no| from the stack so that we can restore the * other registers we saved. */ addl $8, %esp .cfi_adjust_cfa_offset -8 /* Contract of __kernel_vsyscall() and real syscalls is that even * callee-save registers aren't touched, so we restore everything * here. */ popl %ebx .cfi_adjust_cfa_offset -4 .cfi_restore %ebx popl %ecx .cfi_adjust_cfa_offset -4 .cfi_restore %ecx popl %edx .cfi_adjust_cfa_offset -4 .cfi_restore %edx popl %esi .cfi_adjust_cfa_offset -4 .cfi_restore %esi popl %edi .cfi_adjust_cfa_offset -4 .cfi_restore %edi popl %ebp .cfi_adjust_cfa_offset -4 .cfi_restore %ebp ret .cfi_endproc .size _syscall_hook_trampoline, .-_syscall_hook_trampoline #define SYSCALLHOOK_START(name) \ .global name; \ .hidden name; \ .type name, @function; \ name: \ .cfi_startproc; \ .cfi_def_cfa_offset 0; \ .cfi_offset %eip, 0; \ .cfi_offset %esp, 4; #define SYSCALLHOOK_END(name) \ ret $_syscall_stack_adjust-4; \ .cfi_endproc; \ .size name, .-name SYSCALLHOOK_START(_syscall_hook_trampoline_3d_01_f0_ff_ff) call _syscall_hook_trampoline cmpl $0xfffff001,%eax SYSCALLHOOK_END(_syscall_hook_trampoline_3d_01_f0_ff_ff) SYSCALLHOOK_START(_syscall_hook_trampoline_90_90_90) call _syscall_hook_trampoline SYSCALLHOOK_END(_syscall_hook_trampoline_90_90_90) _syscall_hook_end: #elif defined(__x86_64__) .text .p2align 4 _syscall_hook_trampoline: .cfi_startproc /* Force the stack to be extended to at least _stack_pad_size. This forces any MAP_GROWSDOWN emulation to happen before we enter the syscallbuf, which avoids having to reason about system calls being recorded while we're in the middle of syscallbuf processing. */ movb $0,-_stack_pad_size(%rsp) /* Build a |struct syscall_info| on the stack by pushing the arguments and syscall number. */ pushq %r9 .cfi_adjust_cfa_offset 8 .cfi_rel_offset %r9, 0 pushq %r8 .cfi_adjust_cfa_offset 8 .cfi_rel_offset %r8, 0 pushq %r10 .cfi_adjust_cfa_offset 8 .cfi_rel_offset %r10, 0 pushq %rdx .cfi_adjust_cfa_offset 8 .cfi_rel_offset %rdx, 0 pushq %rsi .cfi_adjust_cfa_offset 8 .cfi_rel_offset %rsi, 0 pushq %rdi .cfi_adjust_cfa_offset 8 .cfi_rel_offset %rdi, 0 pushq %rax .cfi_adjust_cfa_offset 8 .cfi_rel_offset %rax, 0 /* Call our hook. */ mov %rsp, %rdi callq syscall_hook /* On entrance, we pushed the %rax, the syscall number. But we don't want to |pop %rax|, as that will overwrite our return value. Pop into %r11 instead. */ pop %r11 .cfi_adjust_cfa_offset -8 /* We don't really *need* to restore these, since the kernel could have trashed them all anyway. But it seems reasonable to do so. */ pop %rdi .cfi_adjust_cfa_offset -8 .cfi_restore %rdi pop %rsi .cfi_adjust_cfa_offset -8 .cfi_restore %rsi pop %rdx .cfi_adjust_cfa_offset -8 .cfi_restore %rdx pop %r10 .cfi_adjust_cfa_offset -8 .cfi_restore %r10 pop %r8 .cfi_adjust_cfa_offset -8 .cfi_restore %r8 pop %r9 .cfi_adjust_cfa_offset -8 .cfi_restore %r9 /* ...and we're done. */ ret .cfi_endproc .size _syscall_hook_trampoline, . - _syscall_hook_trampoline #define SYSCALLHOOK_START(name) \ .global name; \ .hidden name; \ .type name, @function; \ name: \ .cfi_startproc; \ .cfi_def_cfa_offset 0; \ .cfi_offset %rip, 0; \ .cfi_offset %rsp, 8; #define SYSCALLHOOK_END(name) \ ret $_syscall_stack_adjust-8; \ .cfi_endproc; \ .size name, .-name SYSCALLHOOK_START(_syscall_hook_trampoline_48_3d_01_f0_ff_ff) callq _syscall_hook_trampoline cmpq $0xfffffffffffff001,%rax SYSCALLHOOK_END(_syscall_hook_trampoline_48_3d_01_f0_ff_ff) SYSCALLHOOK_START(_syscall_hook_trampoline_48_3d_00_f0_ff_ff) callq _syscall_hook_trampoline cmpq $0xfffffffffffff000,%rax SYSCALLHOOK_END(_syscall_hook_trampoline_48_3d_00_f0_ff_ff) SYSCALLHOOK_START(_syscall_hook_trampoline_48_8b_3c_24) callq _syscall_hook_trampoline /* The original instruction after the syscall is movq (%rsp),%rdi. Because we pushed a return address and shifted RSP down before reaching this point, to get the equivalent behavior we need to use this offset. */ movq _syscall_stack_adjust(%rsp),%rdi SYSCALLHOOK_END(_syscall_hook_trampoline_48_8b_3c_24) SYSCALLHOOK_START(_syscall_hook_trampoline_5a_5e_c3) callq _syscall_hook_trampoline /* The original instructions after the syscall are pop %rdx; pop %rsi; retq. */ /* We're not returning to the dynamically generated stub, so we need to fix the stack pointer ourselves. */ add $_syscall_stack_adjust,%rsp pop %rdx pop %rsi ret .cfi_endproc .size _syscall_hook_trampoline_5a_5e_c3, .-_syscall_hook_trampoline_5a_5e_c3 SYSCALLHOOK_START(_syscall_hook_trampoline_89_c2_f7_da) call _syscall_hook_trampoline mov %eax,%edx neg %edx SYSCALLHOOK_END(_syscall_hook_trampoline_89_c2_f7_da) SYSCALLHOOK_START(_syscall_hook_trampoline_90_90_90) call _syscall_hook_trampoline SYSCALLHOOK_END(_syscall_hook_trampoline_90_90_90) SYSCALLHOOK_START(_syscall_hook_trampoline_ba_01_00_00_00) call _syscall_hook_trampoline mov $1,%edx SYSCALLHOOK_END(_syscall_hook_trampoline_ba_01_00_00_00) SYSCALLHOOK_START(_syscall_hook_trampoline_89_c1_31_d2) call _syscall_hook_trampoline mov %eax,%ecx xor %edx,%edx SYSCALLHOOK_END(_syscall_hook_trampoline_89_c1_31_d2) _syscall_hook_end: #endif /* __x86_64__ */ .section .note.GNU-stack,"",@progbits rr-4.4.0/src/record_signal.cc000066400000000000000000000463031277367620400160770ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "record_signal.h" #include #include #include #include #include #include #include #include #include #include #include #include #include "preload/preload_interface.h" #include "AutoRemoteSyscalls.h" #include "Flags.h" #include "PerfCounters.h" #include "RecordSession.h" #include "RecordTask.h" #include "TraceStream.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" using namespace std; namespace rr { static __inline__ unsigned long long rdtsc(void) { return __rdtsc(); } template static size_t sigaction_sigset_size_arch() { return sizeof(typename Arch::kernel_sigset_t); } static size_t sigaction_sigset_size(SupportedArch arch) { RR_ARCH_FUNCTION(sigaction_sigset_size_arch, arch); } /** * Restore the blocked-ness and sigaction for |sig| from |t|'s local * copy. */ static void restore_signal_state(RecordTask* t, int sig) { AutoRemoteSyscalls remote(t); size_t sigset_size = sigaction_sigset_size(remote.arch()); { const vector& sa = t->signal_action(sig); AutoRestoreMem child_sa(remote, sa.data(), sa.size()); remote.infallible_syscall(syscall_number_for_rt_sigaction(remote.arch()), sig, child_sa.get().as_int(), nullptr, sigset_size); } if (t->is_sig_blocked(sig)) { vector bytes; bytes.resize(sigset_size); memset(bytes.data(), 0, sigset_size); uint64_t mask = uint64_t(1) << (sig - 1); ASSERT(t, sigset_size >= sizeof(mask)); memcpy(bytes.data(), &mask, sizeof(mask)); AutoRestoreMem child_block(remote, bytes.data(), bytes.size()); remote.infallible_syscall(syscall_number_for_rt_sigprocmask(remote.arch()), SIG_BLOCK, child_block.get().as_int(), nullptr, sigset_size); } } /** Return true iff |t->ip()| points at a RDTSC instruction. */ static const uint8_t rdtsc_insn[] = { 0x0f, 0x31 }; static bool is_ip_rdtsc(RecordTask* t) { uint8_t insn[sizeof(rdtsc_insn)]; if (sizeof(insn) != t->read_bytes_fallible(t->ip().to_data_ptr(), sizeof(insn), insn)) { return false; } return !memcmp(insn, rdtsc_insn, sizeof(insn)); } /** * Return true if |t| was stopped because of a SIGSEGV resulting * from a rdtsc and |t| was updated appropriately, false otherwise. */ static bool try_handle_rdtsc(RecordTask* t, siginfo_t* si) { ASSERT(t, si->si_signo == SIGSEGV); if (!is_ip_rdtsc(t) || t->tsc_mode == PR_TSC_SIGSEGV) { return false; } unsigned long long current_time = rdtsc(); Registers r = t->regs(); r.set_rdtsc_output(current_time); r.set_ip(r.ip() + sizeof(rdtsc_insn)); t->set_regs(r); t->push_event(Event(EV_SEGV_RDTSC, HAS_EXEC_INFO, t->arch())); LOG(debug) << " trapped for rdtsc: returning " << current_time; return true; } /** * Return true if |t| was stopped because of a SIGSEGV and we want to retry * the instruction after emulating MAP_GROWSDOWN. */ static bool try_grow_map(RecordTask* t, siginfo_t* si) { ASSERT(t, si->si_signo == SIGSEGV); // Use kernel_abi to avoid odd inconsistencies between distros auto arch_si = reinterpret_cast(si); auto addr = arch_si->_sifields._sigfault.si_addr_.rptr(); if (t->vm()->has_mapping(addr)) { LOG(debug) << "try_grow_map " << addr << ": address already mapped"; return false; } auto maps = t->vm()->maps_starting_at(floor_page_size(addr)); auto it = maps.begin(); if (it == maps.end()) { LOG(debug) << "try_grow_map " << addr << ": no later map to grow downward"; return false; } if (!(it->map.flags() & MAP_GROWSDOWN)) { LOG(debug) << "try_grow_map " << addr << ": map is not MAP_GROWSDOWN (" << it->map << ")"; return false; } if (addr >= page_size() && t->vm()->has_mapping(addr - page_size())) { LOG(debug) << "try_grow_map " << addr << ": address would be in guard page"; return false; } struct rlimit stack_limit; remote_ptr limit_bottom; int ret = prlimit(t->tid, RLIMIT_STACK, NULL, &stack_limit); if (ret >= 0 && stack_limit.rlim_cur != RLIM_INFINITY) { limit_bottom = ceil_page_size(it->map.end() - stack_limit.rlim_cur); if (limit_bottom > addr) { LOG(debug) << "try_grow_map " << addr << ": RLIMIT_STACK exceeded"; return false; } } // Try to grow by 64K at a time to reduce signal frequency. auto new_start = floor_page_size(addr); static const uintptr_t grow_size = 0x10000; if (it->map.start().as_int() >= grow_size) { auto possible_new_start = std::max( limit_bottom, std::min(new_start, it->map.start() - grow_size)); // Ensure that no mapping exists between possible_new_start - page_size() // and new_start. If there is, possible_new_start is not valid, in which // case we just abandon the optimization. if (possible_new_start >= page_size() && !t->vm()->has_mapping(possible_new_start - page_size()) && t->vm()->maps_starting_at(possible_new_start - page_size()) .begin() ->map.start() == it->map.start()) { new_start = possible_new_start; } } LOG(debug) << "try_grow_map " << addr << ": trying to grow map " << it->map; { AutoRemoteSyscalls remote(t, AutoRemoteSyscalls::DISABLE_MEMORY_PARAMS); remote.infallible_mmap_syscall( new_start, it->map.start() - new_start, it->map.prot(), (it->map.flags() & ~MAP_GROWSDOWN) | MAP_ANONYMOUS | MAP_FIXED, -1, 0); } KernelMapping km = t->vm()->map(t, new_start, it->map.start() - new_start, it->map.prot(), it->map.flags() | MAP_ANONYMOUS, 0, string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE); t->trace_writer().write_mapped_region(t, km, km.fake_stat()); // No need to flush syscallbuf here. It's safe to map these pages "early" // before they're really needed. t->record_event(Event(EV_GROW_MAP, NO_EXEC_INFO, t->arch()), RecordTask::DONT_FLUSH_SYSCALLBUF); t->push_event(Event::noop(t->arch())); LOG(debug) << "try_grow_map " << addr << ": extended map " << t->vm()->mapping_of(addr).map; return true; } void disarm_desched_event(RecordTask* t) { if (ioctl(t->desched_fd, PERF_EVENT_IOC_DISABLE, 0)) { FATAL() << "Failed to disarm desched event"; } } void arm_desched_event(RecordTask* t) { if (ioctl(t->desched_fd, PERF_EVENT_IOC_ENABLE, 0)) { FATAL() << "Failed to disarm desched event"; } } /** * Return the event needing to be processed after this desched of |t|. * The tracee's execution may be advanced, and if so |regs| is updated * to the tracee's latest state. */ static void handle_desched_event(RecordTask* t, const siginfo_t* si) { ASSERT(t, (SYSCALLBUF_DESCHED_SIGNAL == si->si_signo && si->si_code == POLL_IN && si->si_fd == t->desched_fd_child)) << "Tracee is using SIGPWR??? (siginfo=" << *si << ")"; /* If the tracee isn't in the critical section where a desched * event is relevant, we can ignore it. See the long comments * in syscall_buffer.c. * * It's OK if the tracee is in the critical section for a * may-block syscall B, but this signal was delivered by an * event programmed by a previous may-block syscall A. * * If we're running in a signal handler inside an interrupted syscallbuf * system call, never do anything here. Syscall buffering is disabled and * the desched_signal_may_be_relevant was set by the outermost syscallbuf * invocation. */ if (!t->read_mem(REMOTE_PTR_FIELD(t->syscallbuf_child, desched_signal_may_be_relevant)) || t->running_inside_desched()) { LOG(debug) << " (not entering may-block syscall; resuming)"; /* We have to disarm the event just in case the tracee * has cleared the relevancy flag, but not yet * disarmed the event itself. */ disarm_desched_event(t); t->push_event(Event::noop(t->arch())); return; } /* TODO: how can signals interrupt us here? */ /* The desched event just fired. That implies that the * arm-desched ioctl went into effect, and that the * disarm-desched syscall didn't take effect. Since a signal * is pending for the tracee, then if the tracee was in a * syscall, linux has exited it with an -ERESTART* error code. * That means the tracee is about to (re-)enter either * * 1. buffered syscall * 2. disarm-desched ioctl syscall * * We can figure out which one by simply issuing a * ptrace(SYSCALL) and examining the tracee's registers. * * If the tracee enters the disarm-desched ioctl, it's going * to commit a record of the buffered syscall to the * syscallbuf, and we can safely send the tracee back on its * way, ignoring the desched completely. * * If it enters the buffered syscall, then the desched event * has served its purpose and we need to prepare the tracee to * be context-switched. * * An annoyance of the desched signal is that when the tracer * is descheduled in interval (C) above, we see normally (see * below) see *two* signals. The current theory of what's * happening is * * o child gets descheduled, bumps counter to i and schedules * signal * o signal notification "schedules" child, but it doesn't * actually run any application code * o child is being ptraced, so we "deschedule" child to * notify parent and bump counter to i+1. (The parent * hasn't had a chance to clear the counter yet.) * o another counter signal is generated, but signal is * already pending so this one is queued * o parent is notified and sees counter value i+1 * o parent stops delivery of first signal and disarms * counter * o second signal dequeued and delivered, notififying parent * (counter is disarmed now, so no pseudo-desched possible * here) * o parent notifiedand sees counter value i+1 again * o parent stops delivery of second signal and we continue on * * So we "work around" this by the tracer expecting two signal * notifications, and silently discarding both. * * One really fun edge case is that sometimes the desched * signal will interrupt the arm-desched syscall itself. * Continuing to the next syscall boundary seems to restart * the arm-desched syscall, and advancing to the boundary * again exits it and we start receiving desched signals * again. * * That may be a kernel bug, but we handle it by just * continuing until we we continue past the arm-desched * syscall *and* stop seeing signals. */ while (true) { // Prevent further desched notifications from firing // while we're advancing the tracee. We're going to // leave it in a consistent state anyway, so the event // is no longer useful. We have to do this in each // loop iteration because a restarted arm-desched // syscall may have re-armed the event. disarm_desched_event(t); t->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_UNLIMITED_TICKS); if (t->status().is_syscall()) { if (t->is_arm_desched_event_syscall()) { continue; } break; } // Completely ignore spurious desched signals and // signals that aren't going to be delivered to the // tracee. // // Also ignore time-slice signals. If the tracee ends // up at the disarm-desched ioctl, we'll reschedule it // with the ticks interrupt still programmed. At worst, // the tracee will get an extra time-slice out of // this, on average, so we don't worry too much about // it. // // TODO: it's theoretically possible for this to // happen an unbounded number of consecutive times // and the tracee never switched out. int sig = t->stop_sig(); ASSERT(t, sig) << "expected stop-signal, got " << t->status(); if (SYSCALLBUF_DESCHED_SIGNAL == sig || PerfCounters::TIME_SLICE_SIGNAL == sig || t->is_sig_ignored(sig)) { LOG(debug) << " dropping ignored " << signal_name(sig); continue; } LOG(debug) << " stashing " << signal_name(sig); t->stash_sig(); } if (t->is_disarm_desched_event_syscall()) { LOG(debug) << " (at disarm-desched, so finished buffered syscall; resuming)"; t->push_event(Event::noop(t->arch())); return; } if (t->desched_rec()) { // We're already processing a desched. We probably reexecuted the // system call (e.g. because a signal was processed) and the syscall // blocked again. Carry on with the current desched. } else { /* This prevents the syscallbuf record counter from being * reset until we've finished guiding the tracee through this * interrupted call. We use the record counter for * assertions. */ t->delay_syscallbuf_reset = true; /* The tracee is (re-)entering the buffered syscall. Stash * away this breadcrumb so that we can figure out what syscall * the tracee was in, and how much "scratch" space it carved * off the syscallbuf, if needed. */ remote_ptr desched_rec = t->next_syscallbuf_record(); t->push_event(DeschedEvent(desched_rec, t->arch())); int call = t->read_mem(REMOTE_PTR_FIELD(t->desched_rec(), syscallno)); /* The descheduled syscall was interrupted by a signal, like * all other may-restart syscalls, with the exception that * this one has already been restarted (which we'll detect * back in the main loop). */ t->push_event(Event(interrupted, SyscallEvent(call, t->arch()))); SyscallEvent& ev = t->ev().Syscall(); ev.desched_rec = desched_rec; } SyscallEvent& ev = t->ev().Syscall(); ev.regs = t->regs(); /* For some syscalls (at least poll) but not all (at least not read), * repeated cont_syscall()s above of the same interrupted syscall * can set $orig_eax to 0 ... for unclear reasons. Fix that up here * otherwise we'll get a divergence during replay, which will not * encounter this problem. */ int call = t->read_mem(REMOTE_PTR_FIELD(t->desched_rec(), syscallno)); ev.regs.set_original_syscallno(call); t->set_regs(ev.regs); // runnable_state_changed will observe us entering this syscall and change // state to ENTERING_SYSCALL LOG(debug) << " resuming (and probably switching out) blocked `" << t->syscall_name(call) << "'"; } static bool is_safe_to_deliver_signal(RecordTask* t) { if (!t->is_in_syscallbuf()) { /* The tracee is outside the syscallbuf code, * so in most cases can't possibly affect * syscallbuf critical sections. The * exception is signal handlers "re-entering" * desched'd syscalls, which are OK. */ LOG(debug) << "Safe to deliver signal at " << t->ip() << " because not in syscallbuf"; return true; } if (t->is_in_traced_syscall()) { LOG(debug) << "Safe to deliver signal at " << t->ip() << " because in traced syscall"; return true; } if (t->is_in_untraced_syscall() && t->desched_rec()) { LOG(debug) << "Safe to deliver signal at " << t->ip() << " because tracee interrupted by desched of " << t->syscall_name(t->read_mem( REMOTE_PTR_FIELD(t->desched_rec(), syscallno))); return true; } // If the syscallbuf buffer hasn't been created yet, just delay the signal // with no need to set notify_on_syscall_hook_exit; the signal will be // delivered when rrcall_init_buffers is called. if (t->syscallbuf_child) { // Our emulation of SYS_rrcall_notify_syscall_hook_exit clears this flag. t->write_mem( REMOTE_PTR_FIELD(t->syscallbuf_child, notify_on_syscall_hook_exit), (uint8_t)1); } LOG(debug) << "Not safe to deliver signal at " << t->ip(); return false; } SignalHandled handle_signal(RecordTask* t, siginfo_t* si, SignalDeterministic deterministic) { LOG(debug) << t->tid << ": handling signal " << signal_name(si->si_signo) << " (pevent: " << ptrace_event_name(t->ptrace_event()) << ", event: " << t->ev(); /* We have to check for a desched event first, because for * those we *do not* want to (and cannot, most of the time) * step the tracee out of the syscallbuf code before * attempting to deliver the signal. */ if (SYSCALLBUF_DESCHED_SIGNAL == si->si_signo) { handle_desched_event(t, si); return SIGNAL_HANDLED; } if (!is_safe_to_deliver_signal(t)) { return DEFER_SIGNAL; } if (!t->set_siginfo_for_synthetic_SIGCHLD(si)) { return DEFER_SIGNAL; } int sig = si->si_signo; // When a deterministic signal is triggered, but the signal is currently // blocked or ignored, the kernel (in |force_sig_info|) unblocks it and // sets its disposition to SIG_DFL. It never undoes this (probably // because it expects the signal to be fatal, which it always would be // unless a ptracer intercepts the signal as we do). Therefore, if the signal // was generated for rr's purposes, we need to restore the signal state // ourselves. If the signal was not generated for rr's purposes, we'll // modify our copy of the signal state to match what the kernel did. /* See if this signal occurred because of an rr implementation detail, * and fudge t appropriately. */ switch (sig) { case SIGSEGV: if (deterministic == DETERMINISTIC_SIG && (try_handle_rdtsc(t, si) || try_grow_map(t, si))) { if (t->is_sig_blocked(sig) || t->is_sig_ignored(sig)) { restore_signal_state(t, sig); } return SIGNAL_HANDLED; } break; case PerfCounters::TIME_SLICE_SIGNAL: t->push_event(Event(EV_SCHED, HAS_EXEC_INFO, t->arch())); return SIGNAL_HANDLED; } if (deterministic == DETERMINISTIC_SIG && (t->is_sig_blocked(sig) || t->is_sig_ignored(sig))) { t->set_sig_blocked(sig, false); t->set_sig_handler_default(sig); } /* This signal was generated by the program or an external * source, record it normally. */ if (t->emulate_ptrace_stop(WaitStatus::for_stop_sig(sig), si)) { // Record an event so that replay progresses the tracee to the // current point before we notify the tracer. // If the signal is deterministic, record it as an EV_SIGNAL so that // we replay it using the deterministic-signal replay path. This is // more efficient than emulate_async_signal. Also emulate_async_signal // currently assumes it won't encounter a deterministic SIGTRAP (due to // a hardcoded breakpoint in the tracee). if (deterministic == DETERMINISTIC_SIG) { t->push_event(SignalEvent(*si, deterministic, t)); t->record_current_event(); t->pop_event(EV_SIGNAL); } else { t->push_event(Event(EV_SCHED, HAS_EXEC_INFO, t->arch())); t->record_current_event(); t->pop_event(EV_SCHED); } // ptracer has been notified, so don't deliver the signal now. // The signal won't be delivered for real until the ptracer calls // PTRACE_CONT with the signal number (which we don't support yet!). return SIGNAL_PTRACE_STOP; } t->push_event(SignalEvent(*si, deterministic, t)); return SIGNAL_HANDLED; } } // namespace rr rr-4.4.0/src/record_signal.h000066400000000000000000000020011277367620400157240ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_HANDLE_SIGNAL_H__ #define RR_HANDLE_SIGNAL_H__ #include #include "Event.h" namespace rr { class RecordTask; const int SIGCHLD_SYNTHETIC = 0xbeadf00d; void disarm_desched_event(RecordTask* t); void arm_desched_event(RecordTask* t); enum SignalHandled { SIGNAL_HANDLED, SIGNAL_PTRACE_STOP, DEFER_SIGNAL }; /** * Handle the given signal for |t|. * Returns SIGNAL_HANDLED if we handled the signal, SIGNAL_PTRACE_STOP if we * didn't handle the signal due to an emulated ptrace-stop, and SIGNAL_DEFER * if we can't handle the signal right now and should try calling * handle_signal again later in task execution. * Handling the signal means we either pushed a new signal event, new * desched + syscall-interruption events, or no-op. */ SignalHandled handle_signal(RecordTask* t, siginfo_t* si, SignalDeterministic deterministic); } // namespace rr #endif /* RR_HANDLE_SIGNAL_H__ */ rr-4.4.0/src/record_syscall.cc000066400000000000000000004737511277367620400163070ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "record_syscall.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "preload/preload_interface.h" #include "AutoRemoteSyscalls.h" #include "Flags.h" #include "MmappedFileMonitor.h" #include "ProcFdDirMonitor.h" #include "ProcMemMonitor.h" #include "RecordSession.h" #include "RecordTask.h" #include "Scheduler.h" #include "StdioMonitor.h" #include "TraceStream.h" #include "VirtualPerfCounterMonitor.h" #include "drm.h" #include "ftrace.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "kernel_supplement.h" #include "log.h" #include "util.h" using namespace std; namespace rr { union _semun { int val; struct semid64_ds* buf; unsigned short int* array; struct seminfo* __buf; }; /* We can't include to get shmctl because it clashes with * linux/shm.h. */ static int _shmctl(int shmid, int cmd, shmid64_ds* buf) { if (sizeof(void*) == 4) { cmd |= IPC_64; } #ifdef SYS_shmctl return syscall(SYS_shmctl, shmid, cmd, buf); #else return syscall(SYS_ipc, SHMCTL, shmid, cmd, 0, buf); #endif } static int _semctl(int semid, int semnum, int cmd, _semun un_arg) { if (sizeof(void*) == 4) { cmd |= IPC_64; } #ifdef SYS_semctl return syscall(SYS_semctl, semid, semnum, cmd, un_arg); #else return syscall(SYS_ipc, SEMCTL, semid, semnum, cmd, &un_arg); #endif } /** * Modes used to register syscall memory parameter with TaskSyscallState. */ enum ArgMode { // Syscall memory parameter is an in-parameter only. // This is only important when we want to move the buffer to scratch memory // so we can modify it without making the modifications potentially visible // to user code. Otherwise, such parameters can be ignored. IN, // Syscall memory parameter is out-parameter only. OUT, // Syscall memory parameter is an in-out parameter. IN_OUT, // Syscall memory parameter is an in-out parameter but we must not use // scratch (e.g. for futexes, we must use the actual memory word). IN_OUT_NO_SCRATCH }; /** * Specifies how to determine the size of a syscall memory * parameter. There is usually an incoming size determined before the syscall * executes (which we need in order to allocate scratch memory), combined * with an optional final size taken from the syscall result or a specific * memory location after the syscall has executed. The minimum of the incoming * and final sizes is used, if both are present. */ struct ParamSize { ParamSize() : incoming_size(size_t(-1)), from_syscall(false) {} // Clamp incoming_size to INTPTR_MAX. No system call can read more data // than that in practice (to a single output parameter). ParamSize(size_t incoming_size) : incoming_size(min(INTPTR_MAX, incoming_size)), from_syscall(false) {} /** * p points to a tracee location that is already initialized with a * "maximum buffer size" passed in by the tracee, and which will be filled * in with the size of the data by the kernel when the syscall exits. */ template static ParamSize from_initialized_mem(RecordTask* t, remote_ptr p) { ParamSize r(p.is_null() ? size_t(0) : size_t(t->read_mem(p))); r.mem_ptr = p; r.read_size = sizeof(T); return r; } /** * p points to a tracee location which will be filled in with the size of * the data by the kernel when the syscall exits, but the location * is uninitialized before the syscall. */ template static ParamSize from_mem(remote_ptr p) { ParamSize r; r.mem_ptr = p; r.read_size = sizeof(T); return r; } /** * When the syscall exits, the syscall result will be of type T and contain * the size of the data. 'incoming_size', if present, is a bound on the size * of the data. */ template static ParamSize from_syscall_result() { ParamSize r; r.from_syscall = true; r.read_size = sizeof(T); return r; } template static ParamSize from_syscall_result(size_t incoming_size) { ParamSize r(incoming_size); r.from_syscall = true; r.read_size = sizeof(T); return r; } /** * Indicate that the size will be at most 'max'. */ ParamSize limit_size(size_t max) const { ParamSize r(*this); r.incoming_size = min(r.incoming_size, max); return r; } /** * Return true if 'other' takes its dynamic size from the same source as * this. * When multiple syscall memory parameters take their dynamic size from the * same source, the source size is distributed among them, with the first * registered parameter taking up to its max_size bytes, followed by the next, * etc. This lets us efficiently record iovec buffers. */ bool is_same_source(const ParamSize& other) const { return ((!mem_ptr.is_null() && other.mem_ptr == mem_ptr) || (from_syscall && other.from_syscall)) && (read_size == other.read_size); } /** * Compute the actual size after the syscall has executed. * 'already_consumed' bytes are subtracted from the syscall-result/ * memory-location part of the size. */ size_t eval(RecordTask* t, size_t already_consumed) const; size_t incoming_size; /** If non-null, the size is limited by the value at this location after * the syscall. */ remote_ptr mem_ptr; /** Size of the value at mem_ptr or in the syscall result register. */ size_t read_size; /** If true, the size is limited by the value of the syscall result. */ bool from_syscall; }; size_t ParamSize::eval(RecordTask* t, size_t already_consumed) const { size_t s = incoming_size; if (!mem_ptr.is_null()) { size_t mem_size; switch (read_size) { case 4: mem_size = t->read_mem(mem_ptr.cast()); break; case 8: mem_size = t->read_mem(mem_ptr.cast()); break; default: ASSERT(t, false) << "Unknown read_size"; return 0; } ASSERT(t, already_consumed <= mem_size); s = min(s, mem_size - already_consumed); } if (from_syscall) { size_t syscall_size = max(0, t->regs().syscall_result_signed()); switch (read_size) { case 4: syscall_size = uint32_t(syscall_size); break; case 8: syscall_size = uint64_t(syscall_size); break; default: ASSERT(t, false) << "Unknown read_size"; return 0; } ASSERT(t, already_consumed <= syscall_size); s = min(s, syscall_size - already_consumed); } ASSERT(t, s < size_t(-1)); return s; } typedef bool (*ArgMutator)(RecordTask*, remote_ptr, void*); /** * When tasks enter syscalls that may block and so must be * prepared for a context-switch, and the syscall params * include (in)outparams that point to buffers, we need to * redirect those arguments to scratch memory. This allows rr * to serialize execution of what may be multiple blocked * syscalls completing "simultaneously" (from rr's * perspective). After the syscall exits, we restore the data * saved in scratch memory to the original buffers. * * Then during replay, we simply restore the saved data to the * tracee's passed-in buffer args and continue on. * * This is implemented by having rec_prepare_syscall_arch set up * a record in param_list for syscall in-memory parameter (whether * "in" or "out"). Then done_preparing is called, which does the actual * scratch setup. process_syscall_results is called when the syscall is * done, to write back scratch results to the real parameters and * clean everything up. * * ... a fly in this ointment is may-block buffered syscalls. * If a task blocks in one of those, it will look like it just * entered a syscall that needs a scratch buffer. However, * it's too late at that point to fudge the syscall args, * because processing of the syscall has already begun in the * kernel. But that's OK: the syscallbuf code has already * swapped out the original buffer-pointers for pointers into * the syscallbuf (which acts as its own scratch memory). We * just have to worry about setting things up properly for * replay. * * The descheduled syscall will "abort" its commit into the * syscallbuf, so the outparam data won't actually be saved * there (and thus, won't be restored during replay). During * replay, we have to restore them like we restore the * non-buffered-syscall scratch data. This is done by recording * the relevant syscallbuf record data in rec_process_syscall_arch. */ struct TaskSyscallState { void init(RecordTask* t) { if (preparation_done) { return; } this->t = t; scratch = t->scratch_ptr; } /** * Identify a syscall memory parameter whose address is in register 'arg' * with type T. * Returns a remote_ptr to the data in the child (before scratch relocation) * or null if parameters have already been prepared (the syscall is * resuming). */ template remote_ptr reg_parameter(int arg, ArgMode mode = OUT, ArgMutator mutator = nullptr) { return reg_parameter(arg, sizeof(T), mode, mutator).cast(); } /** * Identify a syscall memory parameter whose address is in register 'arg' * with size 'size'. * Returns a remote_ptr to the data in the child (before scratch relocation) * or null if parameters have already been prepared (the syscall is * resuming). */ remote_ptr reg_parameter(int arg, const ParamSize& size, ArgMode mode = OUT, ArgMutator mutator = nullptr); /** * Identify a syscall memory parameter whose address is in memory at * location 'addr_of_buf_ptr' with type T. * Returns a remote_ptr to the data in the child (before scratch relocation) * or null if parameters have already been prepared (the syscall is * resuming). * addr_of_buf_ptr must be in a buffer identified by some init_..._parameter * call. */ template remote_ptr mem_ptr_parameter(remote_ptr addr_of_buf_ptr, ArgMode mode = OUT, ArgMutator mutator = nullptr) { return mem_ptr_parameter(addr_of_buf_ptr, sizeof(T), mode, mutator) .cast(); } /** * Identify a syscall memory parameter whose address is in memory at * location 'addr_of_buf_ptr' with type T. * Returns a remote_ptr to the data in the child (before scratch relocation) * or null if parameters have already been prepared (the syscall is * resuming). * addr_of_buf_ptr must be in a buffer identified by some init_..._parameter * call. */ template remote_ptr mem_ptr_parameter_inferred( remote_ptr addr_of_buf_ptr, ArgMode mode = OUT, ArgMutator mutator = nullptr) { remote_ptr p = mem_ptr_parameter(addr_of_buf_ptr, Ptr::referent_size(), mode, mutator); return p.cast(); } /** * Identify a syscall memory parameter whose address is in memory at * location 'addr_of_buf_ptr' with size 'size'. * Returns a remote_ptr to the data in the child (before scratch relocation) * or null if parameters have already been prepared (the syscall is * resuming). * addr_of_buf_ptr must be in a buffer identified by some init_..._parameter * call. */ remote_ptr mem_ptr_parameter(remote_ptr addr_of_buf_ptr, const ParamSize& size, ArgMode mode = OUT, ArgMutator mutator = nullptr); typedef void (*AfterSyscallAction)(RecordTask* t); void after_syscall_action(AfterSyscallAction action) { after_syscall_actions.push_back(action); } void emulate_result(uint64_t result) { ASSERT(t, !preparation_done); ASSERT(t, !should_emulate_result); should_emulate_result = true; emulated_result = result; } /** * Internal method that takes 'ptr', an address within some memory parameter, * and relocates it to the parameter's location in scratch memory. */ remote_ptr relocate_pointer_to_scratch(remote_ptr ptr); /** * Internal method that takes the index of a MemoryParam and a vector * containing the actual sizes assigned to each param < param_index, and * computes the actual size to use for parameter param_index. */ size_t eval_param_size(size_t param_index, vector& actual_sizes); /** * Called when all memory parameters have been identified. If 'sw' is * ALLOW_SWITCH, sets up scratch memory and updates registers etc as * necessary. * If scratch can't be used for some reason, returns PREVENT_SWITCH, * otherwise returns 'sw'. */ Switchable done_preparing(Switchable sw); Switchable done_preparing_internal(Switchable sw); enum WriteBack { WRITE_BACK, NO_WRITE_BACK }; /** * Called when a syscall exits to copy results from scratch memory to their * original destinations, update registers, etc. */ void process_syscall_results(); /** * Upon successful syscall completion, each RestoreAndRecordScratch record * in param_list consumes num_bytes from the t->scratch_ptr * buffer, copying the data to remote_dest and recording the data at * remote_dest. If ptr_in_reg is greater than zero, updates the task's * ptr_in_reg register with 'remote_dest'. If ptr_in_memory is non-null, * updates the ptr_in_memory location with the value 'remote_dest'. */ struct MemoryParam { MemoryParam() : ptr_in_reg(0) {} remote_ptr dest; remote_ptr scratch; ParamSize num_bytes; remote_ptr ptr_in_memory; int ptr_in_reg; ArgMode mode; ArgMutator mutator; }; RecordTask* t; vector param_list; /** Tracks the position in t's scratch_ptr buffer where we should allocate * the next scratch area. */ remote_ptr scratch; vector after_syscall_actions; std::unique_ptr exec_saved_event; RecordTask* emulate_wait_for_child; /** Saved syscall-entry registers, used by code paths that modify the * registers temporarily. */ Registers syscall_entry_registers; /** When nonzero, syscall is expected to return the given errno and we should * die if it does not. This is set when we detect an error condition during * syscall-enter preparation. */ int expect_errno; /** When should_emulate_result is true, syscall result should be adjusted to * be emulated_result. */ bool should_emulate_result; uint64_t emulated_result; /** Records whether the syscall is switchable. Only valid when * preparation_done is true. */ Switchable switchable; /** Whether we should write back the syscall results from scratch. Only * valid when preparation_done is true. */ WriteBack write_back; /** When true, this syscall has already been prepared and should not * be set up again. */ bool preparation_done; /** When true, the scratch area is enabled, otherwise we're letting * syscall outputs be written directly to their destinations. * Only valid when preparation_done is true. */ bool scratch_enabled; /** Miscellaneous saved data that can be used by particular syscalls */ vector saved_data; TaskSyscallState() : t(nullptr), emulate_wait_for_child(nullptr), expect_errno(0), should_emulate_result(false), preparation_done(false), scratch_enabled(false) {} }; static const Property syscall_state_property; template static void set_remote_ptr_arch(RecordTask* t, remote_ptr addr, remote_ptr value) { auto typed_addr = addr.cast(); t->write_mem(typed_addr, (typename Arch::unsigned_word)value.as_int()); } static void set_remote_ptr(RecordTask* t, remote_ptr addr, remote_ptr value) { RR_ARCH_FUNCTION(set_remote_ptr_arch, t->arch(), t, addr, value); } template static remote_ptr get_remote_ptr_arch(RecordTask* t, remote_ptr addr) { auto typed_addr = addr.cast(); auto old = t->read_mem(typed_addr); return remote_ptr(old); } static remote_ptr get_remote_ptr(RecordTask* t, remote_ptr addr) { RR_ARCH_FUNCTION(get_remote_ptr_arch, t->arch(), t, addr); } static void align_scratch(remote_ptr* scratch, uintptr_t amount = 8) { *scratch = (scratch->as_int() + amount - 1) & ~(amount - 1); } remote_ptr TaskSyscallState::reg_parameter(int arg, const ParamSize& size, ArgMode mode, ArgMutator mutator) { if (preparation_done) { return remote_ptr(); } MemoryParam param; param.dest = t->regs().arg(arg); if (param.dest.is_null()) { return remote_ptr(); } param.num_bytes = size; param.mode = mode; param.mutator = mutator; ASSERT(t, !mutator || mode == IN); if (mode != IN_OUT_NO_SCRATCH) { param.scratch = scratch; scratch += param.num_bytes.incoming_size; align_scratch(&scratch); param.ptr_in_reg = arg; } param_list.push_back(param); return param.dest; } remote_ptr TaskSyscallState::mem_ptr_parameter( remote_ptr addr_of_buf_ptr, const ParamSize& size, ArgMode mode, ArgMutator mutator) { if (preparation_done) { return remote_ptr(); } MemoryParam param; param.dest = get_remote_ptr(t, addr_of_buf_ptr); if (param.dest.is_null()) { return remote_ptr(); } param.num_bytes = size; param.mode = mode; param.mutator = mutator; ASSERT(t, !mutator || mode == IN); if (mode != IN_OUT_NO_SCRATCH) { param.scratch = scratch; scratch += param.num_bytes.incoming_size; align_scratch(&scratch); param.ptr_in_memory = addr_of_buf_ptr; } param_list.push_back(param); return param.dest; } remote_ptr TaskSyscallState::relocate_pointer_to_scratch( remote_ptr ptr) { int num_relocations = 0; remote_ptr result; for (auto& param : param_list) { if (param.dest <= ptr && ptr < param.dest + param.num_bytes.incoming_size) { result = param.scratch + (ptr - param.dest); ++num_relocations; } } assert(num_relocations > 0 && "Pointer in non-scratch memory being updated to point to scratch?"); assert(num_relocations <= 1 && "Overlapping buffers containing relocated pointer?"); return result; } Switchable TaskSyscallState::done_preparing_internal(Switchable sw) { ASSERT(t, !preparation_done); preparation_done = true; write_back = WRITE_BACK; switchable = sw; if (!t->scratch_ptr) { return switchable; } ASSERT(t, scratch >= t->scratch_ptr); if (sw == ALLOW_SWITCH && scratch > t->scratch_ptr + t->scratch_size) { LOG(warn) << "`" << t->syscall_name(t->ev().Syscall().number) << "' needed a scratch buffer of size " << scratch - t->scratch_ptr << ", but only " << t->scratch_size << " was available. Disabling context switching: deadlock may follow."; switchable = PREVENT_SWITCH; } if (switchable == PREVENT_SWITCH || param_list.empty()) { return switchable; } scratch_enabled = true; // Step 1: Copy all IN/IN_OUT parameters to their scratch areas for (auto& param : param_list) { ASSERT(t, param.num_bytes.incoming_size < size_t(-1)); if (param.mode == IN_OUT || param.mode == IN) { // Initialize scratch buffer with input data uint8_t buf[param.num_bytes.incoming_size]; t->read_bytes_helper(param.dest, param.num_bytes.incoming_size, buf); t->write_bytes_helper(param.scratch, param.num_bytes.incoming_size, buf); } } // Step 2: Update pointers in registers/memory to point to scratch areas { Registers r = t->regs(); for (auto& param : param_list) { if (param.ptr_in_reg) { r.set_arg(param.ptr_in_reg, param.scratch.as_int()); } if (!param.ptr_in_memory.is_null()) { // Pointers being relocated must themselves be in scratch memory. // We don't want to modify non-scratch memory. Find the pointer's // location // in scratch memory. auto p = relocate_pointer_to_scratch(param.ptr_in_memory); // Update pointer to point to scratch. // Note that this can only happen after step 1 is complete and all // parameter data has been copied to scratch memory. set_remote_ptr(t, p, param.scratch); } // If the number of bytes to record is coming from a memory location, // update that location to scratch. if (!param.num_bytes.mem_ptr.is_null()) { param.num_bytes.mem_ptr = relocate_pointer_to_scratch(param.num_bytes.mem_ptr); } } t->set_regs(r); } return switchable; } Switchable TaskSyscallState::done_preparing(Switchable sw) { if (preparation_done) { return switchable; } sw = done_preparing_internal(sw); ASSERT(t, sw == switchable); // Step 3: Execute mutators. This must run even if the scratch steps do not. for (auto& param : param_list) { if (param.mutator) { // Mutated parameters must be IN. If we have scratch space, we don't need // to save anything. void* saved_data_loc = nullptr; if (!scratch_enabled) { auto prev_size = saved_data.size(); saved_data.resize(prev_size + param.num_bytes.incoming_size); saved_data_loc = saved_data.data() + prev_size; } if (!(*param.mutator)(t, param.dest, saved_data_loc)) { // Nothing was modified, no need to clean up when we unwind. param.mutator = nullptr; if (!scratch_enabled) { saved_data.resize(saved_data.size() - param.num_bytes.incoming_size); } } } } return switchable; } size_t TaskSyscallState::eval_param_size(size_t i, vector& actual_sizes) { assert(actual_sizes.size() == i); size_t already_consumed = 0; for (size_t j = 0; j < i; ++j) { if (param_list[j].num_bytes.is_same_source(param_list[i].num_bytes)) { already_consumed += actual_sizes[j]; } } size_t size = param_list[i].num_bytes.eval(t, already_consumed); actual_sizes.push_back(size); return size; } void TaskSyscallState::process_syscall_results() { ASSERT(t, preparation_done); // XXX what's the best way to handle failed syscalls? Currently we just // record everything as if it succeeded. That handles failed syscalls that // wrote partial results, but doesn't handle syscalls that failed with // EFAULT. vector actual_sizes; if (scratch_enabled) { size_t scratch_num_bytes = scratch - t->scratch_ptr; auto data = t->read_mem(t->scratch_ptr.cast(), scratch_num_bytes); Registers r = t->regs(); // Step 1: compute actual sizes of all buffers and copy outputs // from scratch back to their origin for (size_t i = 0; i < param_list.size(); ++i) { auto& param = param_list[i]; size_t size = eval_param_size(i, actual_sizes); if (write_back == WRITE_BACK && (param.mode == IN_OUT || param.mode == OUT)) { const uint8_t* d = data.data() + (param.scratch - t->scratch_ptr); t->write_bytes_helper(param.dest, size, d); } } bool memory_cleaned_up = false; // Step 2: restore modified in-memory pointers and registers for (size_t i = 0; i < param_list.size(); ++i) { auto& param = param_list[i]; if (param.ptr_in_reg) { r.set_arg(param.ptr_in_reg, param.dest.as_int()); } if (!param.ptr_in_memory.is_null()) { memory_cleaned_up = true; set_remote_ptr(t, param.ptr_in_memory, param.dest); } } if (write_back == WRITE_BACK) { // Step 3: record all output memory areas for (size_t i = 0; i < param_list.size(); ++i) { auto& param = param_list[i]; size_t size = actual_sizes[i]; if (param.mode == IN_OUT_NO_SCRATCH) { t->record_remote(param.dest, size); } else if (param.mode == IN_OUT || param.mode == OUT) { // If pointers in memory were fixed up in step 2, then record // from tracee memory to ensure we record such fixes. Otherwise we // can record from our local data. // XXX This optimization can be improved if necessary... if (memory_cleaned_up) { t->record_remote(param.dest, size); } else { const uint8_t* d = data.data() + (param.scratch - t->scratch_ptr); t->record_local(param.dest, size, d); } } } } t->set_regs(r); } else { // Step 1: restore all mutated memory for (auto& param : param_list) { if (param.mutator) { size_t size = param.num_bytes.incoming_size; ASSERT(t, saved_data.size() >= size); t->write_bytes_helper(param.dest, size, saved_data.data()); saved_data.erase(saved_data.begin(), saved_data.begin() + size); } } ASSERT(t, saved_data.empty()); // Step 2: record all output memory areas for (size_t i = 0; i < param_list.size(); ++i) { auto& param = param_list[i]; size_t size = eval_param_size(i, actual_sizes); t->record_remote(param.dest, size); } } if (should_emulate_result) { Registers r = t->regs(); r.set_syscall_result(emulated_result); t->set_regs(r); } for (auto& action : after_syscall_actions) { action(t); } } template static void prepare_recvmsg(RecordTask* t, TaskSyscallState& syscall_state, remote_ptr msgp, const ParamSize& io_size) { auto namelen_ptr = REMOTE_PTR_FIELD(msgp, msg_namelen); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(msgp, msg_name), ParamSize::from_initialized_mem(t, namelen_ptr)); auto msg = t->read_mem(msgp); remote_ptr iovecsp_void = syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(msgp, msg_iov), sizeof(typename Arch::iovec) * msg.msg_iovlen, IN); auto iovecsp = iovecsp_void.cast(); auto iovecs = t->read_mem(iovecsp, msg.msg_iovlen); for (size_t i = 0; i < msg.msg_iovlen; ++i) { syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(iovecsp + i, iov_base), io_size.limit_size(iovecs[i].iov_len)); } auto controllen_ptr = REMOTE_PTR_FIELD(msgp, msg_controllen); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(msgp, msg_control), ParamSize::from_initialized_mem(t, controllen_ptr)); } template static void prepare_recvmmsg(RecordTask* t, TaskSyscallState& syscall_state, remote_ptr mmsgp, unsigned int vlen) { for (unsigned int i = 0; i < vlen; ++i) { auto msgp = mmsgp + i; prepare_recvmsg(t, syscall_state, REMOTE_PTR_FIELD(msgp, msg_hdr), ParamSize::from_mem(REMOTE_PTR_FIELD(msgp, msg_len))); } } static bool block_sock_opt(int level, int optname, TaskSyscallState& syscall_state) { switch (level) { case SOL_PACKET: switch (optname) { case PACKET_RX_RING: case PACKET_TX_RING: syscall_state.emulate_result(-ENOPROTOOPT); return true; default: break; } default: break; } return false; } template static Switchable prepare_socketcall(RecordTask* t, TaskSyscallState& syscall_state) { /* int socketcall(int call, unsigned long *args) { * long a[6]; * copy_from_user(a,args); * sys_recv(a0, (void __user *)a1, a[2], a[3]); * } * * (from http://lxr.linux.no/#linux+v3.6.3/net/socket.c#L2354) */ switch ((int)t->regs().arg1_signed()) { /* int socket(int domain, int type, int protocol); */ case SYS_SOCKET: /* int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen); */ case SYS_CONNECT: /* int bind(int sockfd, const struct sockaddr *addr, socklen_t addrlen); */ case SYS_BIND: /* int listen(int sockfd, int backlog) */ case SYS_LISTEN: /* ssize_t send(int sockfd, const void *buf, size_t len, int flags) */ case SYS_SEND: /* ssize_t sendto(int sockfd, const void *buf, size_t len, int flags, const * struct sockaddr *dest_addr, socklen_t addrlen); */ case SYS_SENDTO: /* int shutdown(int socket, int how) */ case SYS_SHUTDOWN: break; /* int setsockopt(int sockfd, int level, int optname, const void *optval, * socklen_t optlen); */ case SYS_SETSOCKOPT: { auto argsp = syscall_state.reg_parameter(2, IN); auto args = t->read_mem(argsp); if (block_sock_opt(args.level, args.optname, syscall_state)) { Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); } break; } /* int getsockopt(int sockfd, int level, int optname, const void *optval, * socklen_t* optlen); */ case SYS_GETSOCKOPT: { auto argsp = syscall_state.reg_parameter(2, IN); auto optlen_ptr = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, optlen), IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, optval), ParamSize::from_initialized_mem(t, optlen_ptr)); break; } /* int socketpair(int domain, int type, int protocol, int sv[2]); * * values returned in sv */ case SYS_SOCKETPAIR: { auto argsp = syscall_state.reg_parameter(2, IN); syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(argsp, sv), sizeof(int) * 2); break; } /* int getpeername(int sockfd, struct sockaddr *addr, socklen_t *addrlen); */ case SYS_GETPEERNAME: /* int getsockname(int sockfd, struct sockaddr *addr, socklen_t *addrlen); */ case SYS_GETSOCKNAME: { auto argsp = syscall_state.reg_parameter(2, IN); auto addrlen_ptr = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, addrlen), IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, addr), ParamSize::from_initialized_mem(t, addrlen_ptr)); break; } /* ssize_t recv([int sockfd, void *buf, size_t len, int flags]) */ case SYS_RECV: { auto argsp = syscall_state.reg_parameter(2, IN); auto args = t->read_mem(argsp); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, buf), ParamSize::from_syscall_result(args.len)); return ALLOW_SWITCH; } /* int accept([int sockfd, struct sockaddr *addr, socklen_t *addrlen]) */ case SYS_ACCEPT: { auto argsp = syscall_state.reg_parameter(2, IN); auto addrlen_ptr = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, addrlen), IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, addr), ParamSize::from_initialized_mem(t, addrlen_ptr)); return ALLOW_SWITCH; } /* int accept4([int sockfd, struct sockaddr *addr, socklen_t *addrlen, int * flags]) */ case SYS_ACCEPT4: { auto argsp = syscall_state.reg_parameter(2, IN); auto addrlen_ptr = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, addrlen), IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, addr), ParamSize::from_initialized_mem(t, addrlen_ptr)); return ALLOW_SWITCH; } case SYS_RECVFROM: { auto argsp = syscall_state.reg_parameter(2, IN); auto args = t->read_mem(argsp); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, buf), ParamSize::from_syscall_result(args.len)); auto addrlen_ptr = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, addrlen), IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, src_addr), ParamSize::from_initialized_mem(t, addrlen_ptr)); return ALLOW_SWITCH; } case SYS_RECVMSG: { auto argsp = syscall_state.reg_parameter(2, IN); auto msgp = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, msg), IN_OUT); prepare_recvmsg( t, syscall_state, msgp, ParamSize::from_syscall_result()); auto args = t->read_mem(argsp); if (!(args.flags & MSG_DONTWAIT)) { return ALLOW_SWITCH; } break; } case SYS_RECVMMSG: { auto argsp = syscall_state.reg_parameter(2, IN); auto args = t->read_mem(argsp); remote_ptr mmsgp_void = syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, msgvec), sizeof(typename Arch::mmsghdr) * args.vlen, IN_OUT); auto mmsgp = mmsgp_void.cast(); prepare_recvmmsg(t, syscall_state, mmsgp, args.vlen); if (!(args.flags & MSG_DONTWAIT)) { return ALLOW_SWITCH; } break; } /* ssize_t sendmsg(int sockfd, const struct msghdr *msg, int flags) */ case SYS_SENDMSG: { auto argsp = remote_ptr(t->regs().arg2()); auto args = t->read_mem(argsp); if (!(args.flags & MSG_DONTWAIT)) { return ALLOW_SWITCH; } break; } case SYS_SENDMMSG: { auto argsp = syscall_state.reg_parameter(2, IN); auto args = t->read_mem(argsp); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, msgvec), sizeof(typename Arch::mmsghdr) * args.vlen, IN_OUT); if (!(args.flags & MSG_DONTWAIT)) { return ALLOW_SWITCH; } break; } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; } template static Switchable prepare_msgctl(TaskSyscallState& syscall_state, int cmd, int ptr_reg) { switch (cmd) { case IPC_STAT: case MSG_STAT: syscall_state.reg_parameter(ptr_reg); break; case IPC_INFO: case MSG_INFO: syscall_state.reg_parameter(ptr_reg); break; case IPC_SET: case IPC_RMID: break; default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; } template static Switchable prepare_shmctl(TaskSyscallState& syscall_state, int cmd, int ptr_reg) { switch (cmd) { case IPC_SET: case IPC_RMID: case SHM_LOCK: case SHM_UNLOCK: break; case IPC_STAT: case SHM_STAT: syscall_state.reg_parameter(ptr_reg); break; case IPC_INFO: syscall_state.reg_parameter(ptr_reg); break; case SHM_INFO: syscall_state.reg_parameter(ptr_reg); break; default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; } enum SemctlDereference { DEREFERENCE, USE_DIRECTLY }; template static Switchable prepare_semctl(RecordTask* t, TaskSyscallState& syscall_state, int semid, int cmd, int ptr_reg, SemctlDereference deref) { switch (cmd) { case IPC_SET: case IPC_RMID: case GETNCNT: case GETPID: case GETVAL: case GETZCNT: case SETALL: case SETVAL: break; case IPC_STAT: case SEM_STAT: if (deref == DEREFERENCE) { syscall_state.mem_ptr_parameter( syscall_state.reg_parameter(ptr_reg)); } else { syscall_state.reg_parameter(ptr_reg); } break; case IPC_INFO: case SEM_INFO: if (deref == DEREFERENCE) { syscall_state.mem_ptr_parameter( syscall_state.reg_parameter(ptr_reg)); } else { syscall_state.reg_parameter(ptr_reg); } break; case GETALL: { semid64_ds ds; _semun un_arg; un_arg.buf = &ds; int ret = _semctl(semid, 0, IPC_STAT, un_arg); msan_unpoison(&ds, sizeof(semid64_ds)); ASSERT(t, ret == 0); ParamSize size = sizeof(unsigned short) * ds.sem_nsems; if (deref == DEREFERENCE) { syscall_state.mem_ptr_parameter( syscall_state.reg_parameter(ptr_reg), size); } else { syscall_state.reg_parameter(ptr_reg, size); } break; } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; } /** * A change has been made to file 'fd' in task t. If the file has been mmapped * somewhere in t's address space, record the changes. * We check for matching files by comparing file names. This may not be * reliable but hopefully it's good enough for the cases where we need this. * This doesn't currently handle shared mappings very well. A file mapped * shared in multiple locations will be recorded once per location. * This doesn't handle mappings of the file into other address spaces. */ static void record_file_change(RecordTask* t, int fd, uint64_t offset, uint64_t length) { string file_name = t->file_name_of_fd(fd); for (auto m : t->vm()->maps()) { if (m.map.fsname() == file_name) { uint64_t start = max(offset, uint64_t(m.map.file_offset_bytes())); uint64_t end = min(offset + length, uint64_t(m.map.file_offset_bytes()) + m.map.size()); if (start < end) { t->record_remote(m.map.start() + (start - m.map.file_offset_bytes()), end - start); } } }; } template static void record_v4l2_buffer_contents(RecordTask* t) { remote_ptr bufp = t->regs().arg3(); auto buf = t->read_mem(bufp); switch (buf.memory) { case V4L2_MEMORY_MMAP: record_file_change(t, (int)t->regs().arg1_signed(), buf.m.offset, buf.length); return; default: ASSERT(t, false) << "Unhandled V4L2 memory type " << buf.memory; return; } } template static void record_usbdevfs_reaped_urb(RecordTask* t) { if (t->regs().syscall_failed()) { return; } remote_ptr pp = t->regs().arg3(); remote_ptr p = t->read_mem(pp); t->record_remote(p); auto urb = t->read_mem(p); size_t length; if (urb.type == USBDEVFS_URB_TYPE_ISO) { auto iso_frame_descs_ptr = REMOTE_PTR_FIELD(p, iso_frame_desc[0]); auto iso_frame_descs = t->read_mem(iso_frame_descs_ptr, urb.number_of_packets); length = 0; for (auto& f : iso_frame_descs) { length += f.length; } t->record_local(iso_frame_descs_ptr, iso_frame_descs.data(), iso_frame_descs.size()); } else { length = urb.buffer_length; } // It's tempting to use actual_length here but in some cases the kernel // writes back more data than that. t->record_remote(urb.buffer, length); } static void record_page_below_stack_ptr(RecordTask* t) { /* Record.the page above the top of |t|'s stack. The SIOC* ioctls * have been observed to write beyond the end of tracees' stacks, as * if they had allocated scratch space for themselves. All we can do * for now is try to record the scratch data. */ t->record_remote(t->regs().sp() - page_size(), page_size()); } #define IOCTL_MASK_SIZE(v) ((v) & ~(_IOC_SIZEMASK << _IOC_SIZESHIFT)) template static Switchable prepare_ioctl(RecordTask* t, TaskSyscallState& syscall_state) { int fd = t->regs().arg1(); uint64_t result; if (t->fd_table()->emulate_ioctl(fd, t, &result)) { // Don't perform this syscall. Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); syscall_state.emulate_result(result); return PREVENT_SWITCH; } unsigned long request = t->regs().arg2(); int type = _IOC_TYPE(request); int nr = _IOC_NR(request); int dir = _IOC_DIR(request); int size = _IOC_SIZE(request); LOG(debug) << "handling ioctl(" << HEX(request) << "): type:" << HEX(type) << " nr:" << HEX(nr) << " dir:" << HEX(dir) << " size:" << size; ASSERT(t, !t->is_desched_event_syscall()) << "Failed to skip past desched ioctl()"; /* Some ioctl()s are irregular and don't follow the _IOC() * conventions. Special case them here. */ switch (request) { case SIOCETHTOOL: { auto ifrp = syscall_state.reg_parameter(3, IN); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(ifrp, ifr_ifru.ifru_data)); syscall_state.after_syscall_action(record_page_below_stack_ptr); return PREVENT_SWITCH; } case SIOCGIFCONF: { auto ifconfp = syscall_state.reg_parameter(3, IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(ifconfp, ifc_ifcu.ifcu_buf), ParamSize::from_initialized_mem(t, REMOTE_PTR_FIELD(ifconfp, ifc_len))); syscall_state.after_syscall_action(record_page_below_stack_ptr); return PREVENT_SWITCH; } case SIOCGIFADDR: case SIOCGIFDSTADDR: case SIOCGIFBRDADDR: case SIOCGIFHWADDR: case SIOCGIFFLAGS: case SIOCGIFPFLAGS: case SIOCGIFTXQLEN: case SIOCGIFINDEX: case SIOCGIFMTU: case SIOCGIFNAME: case SIOCGIFNETMASK: case SIOCGIFMETRIC: syscall_state.reg_parameter(3); syscall_state.after_syscall_action(record_page_below_stack_ptr); return PREVENT_SWITCH; // These haven't been observed to write beyond // tracees' stacks, but we record a stack page here // just in case the behavior is driver-dependent. case SIOCGIWFREQ: case SIOCGIWMODE: case SIOCGIWNAME: case SIOCGIWRATE: case SIOCGIWSENS: syscall_state.reg_parameter(3); syscall_state.after_syscall_action(record_page_below_stack_ptr); return PREVENT_SWITCH; case SIOCGIWESSID: { auto argsp = syscall_state.reg_parameter(3, IN_OUT); auto args = t->read_mem(argsp); syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(argsp, u.essid.pointer), args.u.essid.length); syscall_state.after_syscall_action(record_page_below_stack_ptr); return PREVENT_SWITCH; } case TCGETS: case TIOCGLCKTRMIOS: syscall_state.reg_parameter(3); return PREVENT_SWITCH; case TCGETA: syscall_state.reg_parameter(3); return PREVENT_SWITCH; case TIOCINQ: case TIOCOUTQ: case TIOCGETD: syscall_state.reg_parameter(3); return PREVENT_SWITCH; case TIOCGWINSZ: syscall_state.reg_parameter(3); return PREVENT_SWITCH; case TIOCGPGRP: case TIOCGSID: syscall_state.reg_parameter(3); return PREVENT_SWITCH; case SNDRV_CTL_IOCTL_PVERSION: syscall_state.reg_parameter(3); return PREVENT_SWITCH; case SNDRV_CTL_IOCTL_CARD_INFO: syscall_state.reg_parameter(3); return PREVENT_SWITCH; } /* In ioctl language, "_IOC_READ" means "outparam". Both * READ and WRITE can be set for inout params. * USBDEVFS ioctls seem to be mostly backwards in their interpretation of the * read/write bits :-(. */ if (!(_IOC_READ & dir)) { switch (IOCTL_MASK_SIZE(request)) { // Order by value // Older ioctls don't use IOC macros at all, so don't mask size for them case TCSETS: case TCSETSW: case TCSETSF: case TCSETA: case TCSETAW: case TCSETAF: case TIOCSLCKTRMIOS: case TCSBRK: case TCSBRKP: case TIOCSBRK: case TIOCCBRK: case TCXONC: case TCFLSH: case TIOCEXCL: case TIOCNXCL: case TIOCSCTTY: case TIOCNOTTY: case TIOCSPGRP: case TIOCSTI: case TIOCSWINSZ: // No test for TIOCCONS because if run as root it would do bad things case TIOCCONS: case TIOCPKT: case FIONBIO: case TIOCSETD: case IOCTL_MASK_SIZE(TIOCSPTLCK): case FIOCLEX: case FIONCLEX: case IOCTL_MASK_SIZE(BTRFS_IOC_CLONE): case IOCTL_MASK_SIZE(BTRFS_IOC_CLONE_RANGE): case IOCTL_MASK_SIZE(USBDEVFS_DISCARDURB): case IOCTL_MASK_SIZE(USBDEVFS_RESET): return PREVENT_SWITCH; case IOCTL_MASK_SIZE(USBDEVFS_GETDRIVER): // Reads and writes its parameter despite not having the _IOC_READ bit. syscall_state.reg_parameter(3, size); return PREVENT_SWITCH; case IOCTL_MASK_SIZE(USBDEVFS_REAPURB): case IOCTL_MASK_SIZE(USBDEVFS_REAPURBNDELAY): syscall_state.reg_parameter(3, size); syscall_state.after_syscall_action(record_usbdevfs_reaped_urb); return ALLOW_SWITCH; } switch (type) { case 0x54: // TIO* case 0x89: // SIO* case 0x8B: // SIO* wireless interface ioctls // These ioctls are known to be irregular and don't usually have the // correct |dir| bits. They must be handled above syscall_state.expect_errno = EINVAL; return PREVENT_SWITCH; } /* If the kernel isn't going to write any data back to * us, we hope and pray that the result of the ioctl * (observable to the tracee) is deterministic. * We're also assuming it doesn't block. * This is risky! Many ioctls use irregular ioctl codes * that do not have the _IOC_READ bit set but actually do write to * user-space! */ LOG(debug) << " (presumed ignorable ioctl, nothing to do)"; return PREVENT_SWITCH; } /* The following are thought to be "regular" ioctls, the * processing of which is only known to (observably) write to * the bytes in the structure passed to the kernel. So all we * need is to record |size| bytes. * Since the size may vary across architectures we mask it out here to check * only the type + number. */ switch (IOCTL_MASK_SIZE(request)) { case IOCTL_MASK_SIZE(VIDIOC_QUERYCAP): case IOCTL_MASK_SIZE(VIDIOC_ENUM_FMT): case IOCTL_MASK_SIZE(VIDIOC_ENUM_FRAMESIZES): case IOCTL_MASK_SIZE(VIDIOC_ENUM_FRAMEINTERVALS): case IOCTL_MASK_SIZE(VIDIOC_G_FMT): case IOCTL_MASK_SIZE(VIDIOC_S_FMT): case IOCTL_MASK_SIZE(VIDIOC_TRY_FMT): case IOCTL_MASK_SIZE(VIDIOC_G_PARM): case IOCTL_MASK_SIZE(VIDIOC_S_PARM): case IOCTL_MASK_SIZE(VIDIOC_REQBUFS): case IOCTL_MASK_SIZE(VIDIOC_QUERYBUF): case IOCTL_MASK_SIZE(VIDIOC_QBUF): case IOCTL_MASK_SIZE(VIDIOC_G_CTRL): case IOCTL_MASK_SIZE(VIDIOC_S_CTRL): case IOCTL_MASK_SIZE(VFAT_IOCTL_READDIR_BOTH): syscall_state.reg_parameter(3, size, IN_OUT); return PREVENT_SWITCH; case IOCTL_MASK_SIZE(TIOCGPTN): case IOCTL_MASK_SIZE(TIOCGPKT): case IOCTL_MASK_SIZE(TIOCGPTLCK): case IOCTL_MASK_SIZE(TIOCGEXCL): case IOCTL_MASK_SIZE(USBDEVFS_GET_CAPABILITIES): syscall_state.reg_parameter(3, size); return PREVENT_SWITCH; case IOCTL_MASK_SIZE(USBDEVFS_ALLOC_STREAMS): case IOCTL_MASK_SIZE(USBDEVFS_CLAIMINTERFACE): case IOCTL_MASK_SIZE(USBDEVFS_CLEAR_HALT): case IOCTL_MASK_SIZE(USBDEVFS_DISCONNECT_CLAIM): case IOCTL_MASK_SIZE(USBDEVFS_FREE_STREAMS): case IOCTL_MASK_SIZE(USBDEVFS_RELEASEINTERFACE): case IOCTL_MASK_SIZE(USBDEVFS_SETCONFIGURATION): case IOCTL_MASK_SIZE(USBDEVFS_SETINTERFACE): case IOCTL_MASK_SIZE(USBDEVFS_SUBMITURB): // Doesn't actually seem to write to userspace return PREVENT_SWITCH; case IOCTL_MASK_SIZE(USBDEVFS_IOCTL): { auto argsp = syscall_state.reg_parameter(3, IN); auto args = t->read_mem(argsp); syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(argsp, data), _IOC_SIZE(args.ioctl_code)); return PREVENT_SWITCH; } case IOCTL_MASK_SIZE(USBDEVFS_CONTROL): { auto argsp = syscall_state.reg_parameter(3, IN); auto args = t->read_mem(argsp); syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(argsp, data), args.wLength); return PREVENT_SWITCH; } } /* These ioctls are mostly regular but require additional recording. */ switch (IOCTL_MASK_SIZE(request)) { case IOCTL_MASK_SIZE(VIDIOC_DQBUF): { if (size == sizeof(typename Arch::v4l2_buffer)) { syscall_state.reg_parameter(3, size, IN_OUT); syscall_state.after_syscall_action(record_v4l2_buffer_contents); // VIDIOC_DQBUF can block. It can't if the fd was opened O_NONBLOCK, // but we don't try to determine that. // Note that we're exposed to potential race conditions here because // VIDIOC_DQBUF (blocking or not) assumes the driver has filled // the mmapped data region at some point since the buffer was queued // with VIDIOC_QBUF, and we don't/can't know exactly when that // happened. Replay could fail if this thread or another thread reads // the contents of mmapped contents queued with the driver. return ALLOW_SWITCH; } } } syscall_state.expect_errno = EINVAL; return PREVENT_SWITCH; } static bool maybe_emulate_wait(RecordTask* t, TaskSyscallState& syscall_state, int options) { for (RecordTask* child : t->emulated_ptrace_tracees) { if (t->is_waiting_for_ptrace(child) && child->emulated_stop_pending) { syscall_state.emulate_wait_for_child = child; return true; } } if (options & WUNTRACED) { for (TaskGroup* child_process : t->task_group()->children()) { for (Task* child : child_process->task_set()) { auto rchild = static_cast(child); if (rchild->emulated_stop_type == GROUP_STOP && rchild->emulated_stop_pending && t->is_waiting_for(rchild)) { syscall_state.emulate_wait_for_child = rchild; return true; } } } } return false; } static void maybe_pause_instead_of_waiting(RecordTask* t, int options) { if (t->in_wait_type != WAIT_TYPE_PID || (options & WNOHANG)) { return; } RecordTask* child = t->session().find_task(t->in_wait_pid); if (!child || !t->is_waiting_for_ptrace(child) || t->is_waiting_for(child)) { return; } // OK, t is waiting for a ptrace child by tid, but since t is not really // ptracing child, entering a real wait syscall will not actually wait for // the child, so the kernel may error out with ECHILD (non-ptracers can't // wait on specific threads of another process, or for non-child processes). // To avoid this problem, we'll replace the wait syscall with a pause() // syscall. // It would be nice if we didn't have to do this, but I can't see a better // way. Registers r = t->regs(); r.set_original_syscallno(syscall_number_for_pause(t->arch())); t->set_regs(r); } static RecordTask* verify_ptrace_target(RecordTask* tracer, TaskSyscallState& syscall_state, pid_t pid) { RecordTask* tracee = tracer->session().find_task(pid); if (!tracee || tracee->emulated_ptracer != tracer || tracee->emulated_stop_type == NOT_STOPPED) { syscall_state.emulate_result(-ESRCH); return nullptr; } return tracee; } static void do_ptrace_exit_stop(RecordTask* t) { // Notify ptracer of the exit if it's not going to receive it from the // kernel because it's not the parent. (The kernel has similar logic to // deliver two stops in this case.) t->emulated_ptrace_queued_exit_stop = false; if (t->emulated_ptracer && (t->is_clone_child() || t->get_parent_pid() != t->emulated_ptracer->real_tgid())) { // This is a bit wrong; this is an exit stop, not a signal/ptrace stop. t->emulate_ptrace_stop(WaitStatus::for_exit_code(t->exit_code)); } } static void prepare_ptrace_cont(RecordTask* tracee, int sig, int command) { if (sig) { siginfo_t si = tracee->take_ptrace_signal_siginfo(sig); // Treat signal as nondeterministic; it won't happen just by // replaying the tracee. tracee->push_event(SignalEvent(si, NONDETERMINISTIC_SIG, tracee)); } tracee->emulated_stop_type = NOT_STOPPED; tracee->emulated_stop_pending = false; tracee->emulated_stop_code = WaitStatus(); tracee->emulated_ptrace_cont_command = command; if (tracee->ev().is_syscall_event() && PROCESSING_SYSCALL == tracee->ev().Syscall().state) { // Continue the task since we didn't in enter_syscall tracee->resume_execution(RESUME_SYSCALL, RESUME_NONBLOCKING, RESUME_NO_TICKS); } if (tracee->emulated_ptrace_queued_exit_stop) { do_ptrace_exit_stop(tracee); } } static uint64_t widen_buffer_unsigned(const void* buf, size_t size) { switch (size) { case 1: return *reinterpret_cast(buf); case 2: return *reinterpret_cast(buf); case 4: return *reinterpret_cast(buf); case 8: return *reinterpret_cast(buf); default: assert(0 && "Unsupported size"); return 0; } } static int64_t widen_buffer_signed(const void* buf, size_t size) { switch (size) { case 1: return *reinterpret_cast(buf); case 2: return *reinterpret_cast(buf); case 4: return *reinterpret_cast(buf); case 8: return *reinterpret_cast(buf); default: assert(0 && "Unsupported size"); return 0; } } static uint64_t path_inode_number(const char* path) { struct stat st; int ret = stat(path, &st); assert(ret == 0); return st.st_ino; } static bool is_same_namespace(const char* name, pid_t tid1, pid_t tid2) { char path1[PATH_MAX]; char path2[PATH_MAX]; sprintf(path1, "/proc/%d/ns/%s", tid1, name); sprintf(path2, "/proc/%d/ns/%s", tid2, name); return path_inode_number(path1) == path_inode_number(path2); } template static void ptrace_get_reg_set(RecordTask* t, TaskSyscallState& syscall_state, const vector& regs) { auto piov = syscall_state.reg_parameter(4, IN_OUT); auto iov = t->read_mem(piov); iov.iov_len = min(iov.iov_len, regs.size()); t->write_mem(piov, iov); auto data = syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(piov, iov_base), iov.iov_len); t->write_bytes_helper(data, iov.iov_len, regs.data()); syscall_state.emulate_result(0); } template static void ptrace_verify_set_reg_set(RecordTask* t, size_t min_size, TaskSyscallState& syscall_state) { auto iov = t->read_mem(remote_ptr(t->regs().arg4())); if (iov.iov_len < min_size) { syscall_state.emulate_result(-EIO); } syscall_state.emulate_result(0); } static bool verify_ptrace_options(RecordTask* t, TaskSyscallState& syscall_state) { // We "support" PTRACE_O_SYSGOOD because we don't support PTRACE_SYSCALL yet static const int supported_ptrace_options = PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEEXIT | PTRACE_O_TRACEFORK | PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXEC; if ((int)t->regs().arg4() & ~supported_ptrace_options) { LOG(debug) << "Unsupported ptrace options " << HEX(t->regs().arg4()); syscall_state.emulate_result(-EINVAL); return false; } return true; } static RecordTask* prepare_ptrace_attach(RecordTask* t, pid_t pid, TaskSyscallState& syscall_state) { // To simplify things, require that a ptracer be in the same pid // namespace as rr itself. I.e., tracee tasks sandboxed in a pid // namespace can't use ptrace. This is normally a requirement of // sandboxes anyway. // This could be supported, but would require some work to translate // rr's pids to/from the ptracer's pid namespace. ASSERT(t, is_same_namespace("pid", t->tid, getpid())); RecordTask* tracee = t->session().find_task(pid); if (!tracee) { // XXX This prevents a tracee from attaching to a process which isn't // under rr's control. We could support this but it would complicate // things. syscall_state.emulate_result(-ESRCH); return nullptr; } // Don't allow a 32-bit process to trace a 64-bit process. That doesn't // make much sense (manipulating registers gets crazy), and would be hard to // support. if (tracee->emulated_ptracer || tracee->tgid() == t->tgid() || (t->arch() == x86 && tracee->arch() == x86_64)) { syscall_state.emulate_result(-EPERM); return nullptr; } return tracee; } static void ptrace_attach_to_already_stopped_task(RecordTask* t) { ASSERT(t, t->emulated_stop_type == GROUP_STOP); // tracee is already stopped because of a group-stop signal. // Sending a SIGSTOP won't work, but we don't need to. t->force_emulate_ptrace_stop(WaitStatus::for_stop_sig(SIGSTOP)); siginfo_t si; memset(&si, 0, sizeof(si)); si.si_signo = SIGSTOP; si.si_code = SI_USER; t->save_ptrace_signal_siginfo(si); } template static Switchable prepare_ptrace(RecordTask* t, TaskSyscallState& syscall_state) { pid_t pid = (pid_t)t->regs().arg2_signed(); bool emulate = true; int command = (int)t->regs().arg1_signed(); switch (command) { case PTRACE_ATTACH: { RecordTask* tracee = prepare_ptrace_attach(t, pid, syscall_state); if (!tracee) { break; } tracee->set_emulated_ptracer(t); tracee->emulated_ptrace_seized = false; tracee->emulated_ptrace_options = 0; syscall_state.emulate_result(0); if (tracee->emulated_stop_type == NOT_STOPPED) { // Send SIGSTOP to this specific thread. Otherwise the kernel might // deliver SIGSTOP to some other thread of the process, and we won't // generate any ptrace event if that thread isn't being ptraced. tracee->tgkill(SIGSTOP); } else { ptrace_attach_to_already_stopped_task(tracee); } break; } case PTRACE_SEIZE: { RecordTask* tracee = prepare_ptrace_attach(t, pid, syscall_state); if (!tracee) { break; } if (t->regs().arg3()) { syscall_state.emulate_result(-EIO); break; } if (!verify_ptrace_options(t, syscall_state)) { break; } tracee->set_emulated_ptracer(t); tracee->emulated_ptrace_seized = true; tracee->emulated_ptrace_options = (int)t->regs().arg4(); if (tracee->emulated_stop_type == GROUP_STOP) { ptrace_attach_to_already_stopped_task(tracee); } syscall_state.emulate_result(0); break; } case PTRACE_SETOPTIONS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { if (!verify_ptrace_options(t, syscall_state)) { break; } tracee->emulated_ptrace_options = (int)t->regs().arg4(); syscall_state.emulate_result(0); } break; } case PTRACE_GETEVENTMSG: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto datap = syscall_state.reg_parameter(4); t->write_mem( datap, (typename Arch::unsigned_long)tracee->emulated_ptrace_event_msg); syscall_state.emulate_result(0); } break; } case PTRACE_GETSIGINFO: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto datap = syscall_state.reg_parameter(4); typename Arch::siginfo_t dest; memset(&dest, 0, sizeof(dest)); set_arch_siginfo(tracee->get_saved_ptrace_siginfo(), Arch::arch(), &dest, sizeof(dest)); t->write_mem(datap, dest); syscall_state.emulate_result(0); } break; } case PTRACE_GETREGS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto data = syscall_state.reg_parameter(4); auto regs = tracee->regs().get_ptrace_for_arch(Arch::arch()); ASSERT(t, regs.size() == data.referent_size()); t->write_bytes_helper(data, regs.size(), regs.data()); syscall_state.emulate_result(0); } break; } case PTRACE_GETFPREGS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto data = syscall_state.reg_parameter(4); auto regs = tracee->extra_regs().get_user_fpregs_struct(Arch::arch()); ASSERT(t, regs.size() == data.referent_size()); t->write_bytes_helper(data, regs.size(), regs.data()); syscall_state.emulate_result(0); } break; } case PTRACE_GETFPXREGS: { if (Arch::arch() != x86) { // GETFPXREGS is x86-32 only syscall_state.expect_errno = EIO; break; } RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto data = syscall_state.reg_parameter(4); auto regs = tracee->extra_regs().get_user_fpxregs_struct(); t->write_mem(data, regs); syscall_state.emulate_result(0); } break; } case PTRACE_GETREGSET: { switch ((int)t->regs().arg3()) { case NT_PRSTATUS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto regs = tracee->regs().get_ptrace_for_arch(Arch::arch()); ptrace_get_reg_set(t, syscall_state, regs); } break; } case NT_FPREGSET: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { auto regs = tracee->extra_regs().get_user_fpregs_struct(Arch::arch()); ptrace_get_reg_set(t, syscall_state, regs); } break; } case NT_X86_XSTATE: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { switch (tracee->extra_regs().format()) { case ExtraRegisters::XSAVE: ptrace_get_reg_set(t, syscall_state, tracee->extra_regs().data()); break; default: syscall_state.emulate_result(EINVAL); break; } } break; } default: syscall_state.expect_errno = EINVAL; emulate = false; break; } break; } case PTRACE_SETREGS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { // The actual register effects are performed by // Task::on_syscall_exit_arch syscall_state.emulate_result(0); } break; } case PTRACE_SETFPREGS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { // The actual register effects are performed by // Task::on_syscall_exit_arch syscall_state.emulate_result(0); } break; } case PTRACE_SETFPXREGS: { if (Arch::arch() != x86) { // SETFPXREGS is x86-32 only syscall_state.expect_errno = EIO; break; } RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { // The actual register effects are performed by // Task::on_syscall_exit_arch syscall_state.emulate_result(0); } break; } case PTRACE_SETREGSET: { // The actual register effects are performed by // Task::on_syscall_exit_arch switch ((int)t->regs().arg3()) { case NT_PRSTATUS: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { ptrace_verify_set_reg_set( t, sizeof(typename Arch::user_regs_struct), syscall_state); } break; } case NT_FPREGSET: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { ptrace_verify_set_reg_set( t, sizeof(typename Arch::user_fpregs_struct), syscall_state); } break; } case NT_X86_XSTATE: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { switch (tracee->extra_regs().format()) { case ExtraRegisters::XSAVE: ptrace_verify_set_reg_set( t, tracee->extra_regs().data_size(), syscall_state); break; default: syscall_state.emulate_result(EINVAL); break; } } break; } default: syscall_state.expect_errno = EINVAL; emulate = false; break; } break; } case PTRACE_PEEKTEXT: case PTRACE_PEEKDATA: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { // The actual syscall returns the data via the 'data' out-parameter. // The behavior of returning the data as the system call result is // provided by the glibc wrapper. auto datap = syscall_state.reg_parameter(4); remote_ptr addr = t->regs().arg3(); bool ok = true; auto v = tracee->read_mem(addr, &ok); if (ok) { t->write_mem(datap, v); syscall_state.emulate_result(0); } else { syscall_state.emulate_result(-EIO); } } break; } case PTRACE_POKETEXT: case PTRACE_POKEDATA: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { remote_ptr addr = t->regs().arg3(); typename Arch::unsigned_word data = t->regs().arg4(); bool ok = true; tracee->write_mem(addr, data, &ok); if (ok) { // Since we're recording data that might not be for |t|, we have to // handle this specially during replay. tracee->record_local(addr, &data); syscall_state.emulate_result(0); } else { syscall_state.emulate_result(-EIO); } } break; } case PTRACE_PEEKUSER: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { // The actual syscall returns the data via the 'data' out-parameter. // The behavior of returning the data as the system call result is // provided by the glibc wrapper. size_t addr = t->regs().arg3(); typename Arch::unsigned_word data; if ((addr & (sizeof(data) - 1)) || addr >= sizeof(typename Arch::user)) { syscall_state.emulate_result(-EIO); break; } auto datap = syscall_state.reg_parameter(4); if (addr < sizeof(typename Arch::user_regs_struct)) { uint8_t buf[Registers::MAX_SIZE]; bool defined; size_t size = tracee->regs().read_register_by_user_offset(buf, addr, &defined); if (defined) { // For unclear reasons, all 32-bit user_regs_struct members are // signed while all 64-bit user_regs_struct members are unsigned. if (Arch::arch() == x86) { data = widen_buffer_signed(buf, size); } else { data = widen_buffer_unsigned(buf, size); } } else { data = 0; } } else if (addr >= offsetof(typename Arch::user, u_debugreg[0]) && addr < offsetof(typename Arch::user, u_debugreg[8])) { size_t regno = (addr - offsetof(typename Arch::user, u_debugreg[0])) / sizeof(data); data = tracee->get_debug_reg(regno); } else { data = 0; } t->write_mem(datap, data); syscall_state.emulate_result(0); } break; } case PTRACE_POKEUSER: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { // The actual syscall returns the data via the 'data' out-parameter. // The behavior of returning the data as the system call result is // provided by the glibc wrapper. size_t addr = t->regs().arg3(); if ((addr & (sizeof(typename Arch::unsigned_word) - 1)) || addr >= sizeof(typename Arch::user)) { syscall_state.emulate_result(-EIO); break; } syscall_state.emulate_result(0); } break; } case PTRACE_SYSCALL: case PTRACE_SINGLESTEP: case PTRACE_SYSEMU: case PTRACE_SYSEMU_SINGLESTEP: case PTRACE_CONT: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { prepare_ptrace_cont(tracee, t->regs().arg4(), command); syscall_state.emulate_result(0); } break; } case PTRACE_DETACH: { RecordTask* tracee = verify_ptrace_target(t, syscall_state, pid); if (tracee) { tracee->emulated_ptrace_options = 0; tracee->emulated_ptrace_cont_command = 0; tracee->emulated_stop_pending = false; tracee->emulated_ptrace_queued_exit_stop = false; prepare_ptrace_cont(tracee, t->regs().arg4(), 0); tracee->set_emulated_ptracer(nullptr); syscall_state.emulate_result(0); } break; } default: syscall_state.expect_errno = EIO; emulate = false; break; } if (emulate) { Registers r = t->regs(); r.set_arg1((intptr_t)-1); t->set_regs(r); } return PREVENT_SWITCH; } static void check_signals_while_exiting(RecordTask* t) { if (t->has_stashed_sig()) { // An unblockable signal (SIGKILL, SIGSTOP) might be received // and stashed. Since these signals are unblockable they take // effect no matter what and we don't need to deliver them to an exiting // thread. int sig = t->peek_stash_sig().siginfo.si_signo; ASSERT(t, sig == SIGKILL || sig == SIGSTOP) << "Got unexpected signal " << t->peek_stash_sig().siginfo << " (should have been blocked)"; } } /** * At thread exit time, undo the work that init_buffers() did. * * Call this when the tracee has already entered SYS_exit/SYS_exit_group. The * tracee will be returned at a state in which it has entered (or * re-entered) SYS_exit/SYS_exit_group. */ static void prepare_exit(RecordTask* t, int exit_code) { // RecordSession is responsible for ensuring we don't get here with // pending signals. See interrupt_syscall_to_handle_signals. ASSERT(t, !t->has_stashed_sig()); t->stable_exit = true; t->exit_code = exit_code; t->session().scheduler().in_stable_exit(t); Registers r = t->regs(); Registers exit_regs = r; ASSERT(t, is_exit_syscall(exit_regs.original_syscallno(), t->arch()) || is_exit_group_syscall(exit_regs.original_syscallno(), t->arch())) << "Tracee should have been at exit/exit_group, but instead at " << t->syscall_name(exit_regs.original_syscallno()); // The first thing we need to do is to block all signals to prevent // a signal being delivered to the thread (since it's going to exit and // won't be able to handle any more signals). // // The tracee is at the entry to SYS_exit/SYS_exit_group, but hasn't started // the call yet. We can't directly start injecting syscalls // because the tracee is still in the kernel. And obviously, // if we finish the SYS_exit/SYS_exit_group syscall, the tracee isn't around // anymore. // // So hijack this SYS_exit call and rewrite it into a SYS_rt_sigprocmask. r.set_original_syscallno(syscall_number_for_rt_sigprocmask(t->arch())); r.set_arg1(SIG_BLOCK); r.set_arg2(AddressSpace::rr_page_ff_bytes()); r.set_arg3(0); r.set_arg4(sizeof(sig_set_t)); t->set_regs(r); // This exits the SYS_rt_sigprocmask. Now the tracee is ready to do our // bidding. t->exit_syscall(); check_signals_while_exiting(t); // Do the actual buffer and fd cleanup. t->destroy_buffers(); check_signals_while_exiting(t); // Restore these regs to what they would have been just before // the tracee trapped at SYS_exit/SYS_exit_group. When we've finished // cleanup, we'll restart the call. exit_regs.set_syscallno(exit_regs.original_syscallno()); exit_regs.set_original_syscallno(-1); exit_regs.set_ip(exit_regs.ip() - syscall_instruction_length(t->arch())); ASSERT(t, is_at_syscall_instruction(t, exit_regs.ip())) << "Tracee should have entered through int $0x80."; // Restart the SYS_exit call. t->set_regs(exit_regs); t->enter_syscall(); check_signals_while_exiting(t); if (t->emulated_ptrace_options & PTRACE_O_TRACEEXIT) { // Ensure that do_ptrace_exit_stop can run later. t->emulated_ptrace_queued_exit_stop = true; t->emulate_ptrace_stop(WaitStatus::for_ptrace_event(PTRACE_EVENT_EXIT)); } else { // Only allow one stop at a time. After the PTRACE_EVENT_EXIT has been // processed, PTRACE_CONT will call do_ptrace_exit_stop for us. do_ptrace_exit_stop(t); } } static void prepare_mmap_register_params(RecordTask* t) { Registers r = t->regs(); if (t->session().enable_chaos() && !(r.arg4_signed() & (MAP_FIXED | MAP_32BIT)) && r.arg1() == 0) { // No address hint was provided. Randomize the allocation address. size_t len = r.arg2(); if (r.arg4_signed() & MAP_GROWSDOWN) { // Ensure stacks can grow to the minimum size we choose len = max(AddressSpace::chaos_mode_min_stack_size(), len); } remote_ptr addr = t->vm()->chaos_mode_find_free_memory(t, len); if (!addr.is_null()) { r.set_arg1(addr + len - r.arg2()); // Note that we don't set MAP_FIXED here. If anything goes wrong (e.g. // we pick a hint address that actually can't be used on this system), the // kernel will pick a valid address instead. } } r.set_arg4(r.arg4_signed() & ~MAP_GROWSDOWN); t->set_regs(r); } static void set_own_namespace_tid(RecordTask* t) { AutoRemoteSyscalls remote(t); t->own_namespace_rec_tid = remote.infallible_syscall(syscall_number_for_gettid(t->arch())); } enum ScratchAddrType { FIXED_ADDRESS, DYNAMIC_ADDRESS }; /* Pointer used when running RR in WINE. Memory below this address is unmapped by WINE immediately after exec, so start the scratch buffer here. */ static const uintptr_t FIXED_SCRATCH_PTR = 0x68000000; static void init_scratch_memory(RecordTask* t, ScratchAddrType addr_type = DYNAMIC_ADDRESS) { const int scratch_size = 512 * page_size(); size_t sz = scratch_size; // The PROT_EXEC looks scary, and it is, but it's to prevent // this region from being coalesced with another anonymous // segment mapped just after this one. If we named this // segment, we could remove this hack. int prot = PROT_READ | PROT_WRITE | PROT_EXEC; int flags = MAP_PRIVATE | MAP_ANONYMOUS; { /* initialize the scratchpad for blocking system calls */ AutoRemoteSyscalls remote(t); if (addr_type == DYNAMIC_ADDRESS) { t->scratch_ptr = remote.infallible_mmap_syscall(remote_ptr(), sz, prot, flags, -1, 0); } else { t->scratch_ptr = remote.infallible_mmap_syscall(remote_ptr(FIXED_SCRATCH_PTR), sz, prot, flags | MAP_FIXED, -1, 0); } t->scratch_size = scratch_size; } // record this mmap for the replay Registers r = t->regs(); uintptr_t saved_result = r.syscall_result(); r.set_syscall_result(t->scratch_ptr); t->set_regs(r); KernelMapping km = t->vm()->map(t, t->scratch_ptr, sz, prot, flags, 0, string()); struct stat stat; memset(&stat, 0, sizeof(stat)); auto record_in_trace = t->trace_writer().write_mapped_region(t, km, stat); ASSERT(t, record_in_trace == TraceWriter::DONT_RECORD_IN_TRACE); r.set_syscall_result(saved_result); t->set_regs(r); } static int ptrace_option_for_event(int ptrace_event) { switch (ptrace_event) { case PTRACE_EVENT_FORK: return PTRACE_O_TRACEFORK; case PTRACE_EVENT_CLONE: return PTRACE_O_TRACECLONE; case PTRACE_EVENT_VFORK: return PTRACE_O_TRACEVFORK; default: FATAL() << "Unsupported ptrace event"; return 0; } } template static Switchable process_sigreturn(RecordTask* t); template static void prepare_clone(RecordTask* t, TaskSyscallState& syscall_state) { uintptr_t flags; CloneParameters params; Registers r = t->regs(); int original_syscall = r.original_syscallno(); int ptrace_event; int termination_signal = SIGCHLD; if (is_clone_syscall(original_syscall, r.arch())) { params = extract_clone_parameters(t); flags = r.arg1(); r.set_arg1(flags & ~uintptr_t(CLONE_UNTRACED)); t->set_regs(r); termination_signal = flags & 0xff; if (flags & CLONE_VFORK) { ptrace_event = PTRACE_EVENT_VFORK; } else if (termination_signal == SIGCHLD) { ptrace_event = PTRACE_EVENT_FORK; } else { ptrace_event = PTRACE_EVENT_CLONE; } } else if (is_vfork_syscall(original_syscall, r.arch())) { ptrace_event = PTRACE_EVENT_VFORK; flags = CLONE_VM | CLONE_VFORK | SIGCHLD; } else { ptrace_event = PTRACE_EVENT_FORK; flags = SIGCHLD; } while (true) { t->resume_execution(RESUME_SYSCALL, RESUME_WAIT, RESUME_NO_TICKS); // XXX handle stray signals? if (t->ptrace_event()) { break; } ASSERT(t, !t->stop_sig()); ASSERT(t, t->regs().syscall_result_signed() < 0); if (!t->regs().syscall_may_restart()) { LOG(debug) << "clone failed, returning " << errno_name(-t->regs().syscall_result_signed()); syscall_state.emulate_result(t->regs().syscall_result()); // clone failed and we're existing the syscall with an error. Reenter // the syscall so that we're in the same state as the normal execution // path. t->ev().Syscall().failed_during_preparation = true; r.set_syscallno(Arch::gettid); r.set_ip(r.ip().decrement_by_syscall_insn_length(r.arch())); t->set_regs(r); t->enter_syscall(); r.set_ip(t->regs().ip()); r.set_original_syscallno(original_syscall); t->set_regs(r); return; } // Reenter the syscall. If we try to return an ERESTART* error using the // code path above, our set_syscallno(SYS_gettid) fails to take effect and // we actually do the clone, and things get horribly confused. r.set_syscallno(r.original_syscallno()); r.set_ip(r.ip().decrement_by_syscall_insn_length(r.arch())); t->set_regs(r); t->enter_syscall(); } ASSERT(t, t->ptrace_event() == ptrace_event); // Ideally we'd just use t->get_ptrace_eventmsg_pid() here, but // kernels failed to translate that value from other pid namespaces to // our pid namespace until June 2014: // https://github.com/torvalds/linux/commit/4e52365f279564cef0ddd41db5237f0471381093 pid_t new_tid; if (flags & CLONE_THREAD) { new_tid = t->find_newborn_thread(); } else { new_tid = t->find_newborn_child_process(); } RecordTask* new_task = static_cast( t->session().clone(t, clone_flags_to_task_flags(flags), params.stack, params.tls, params.ctid, new_tid)); set_own_namespace_tid(new_task); // Restore modified registers in cloned task Registers new_r = new_task->regs(); new_r.set_original_syscallno( syscall_state.syscall_entry_registers.original_syscallno()); new_r.set_arg1(syscall_state.syscall_entry_registers.arg1()); new_task->emulate_syscall_entry(new_r); new_task->set_termination_signal(termination_signal); /* record child id here */ if (is_clone_syscall(original_syscall, r.arch())) { CloneParameters child_params = extract_clone_parameters(new_task); t->record_remote_even_if_null(params.ptid); if (Arch::clone_tls_type == Arch::UserDescPointer) { t->record_remote_even_if_null( params.tls.cast()); new_task->record_remote_even_if_null( child_params.tls.cast()); } else { assert(Arch::clone_tls_type == Arch::PthreadStructurePointer); } new_task->record_remote_even_if_null(child_params.ptid); new_task->record_remote_even_if_null(child_params.ctid); } t->session().trace_writer().write_task_event( TraceTaskEvent::for_clone(new_task->tid, t->tid, flags)); init_scratch_memory(new_task); if ((t->emulated_ptrace_options & ptrace_option_for_event(ptrace_event)) && !(flags & CLONE_UNTRACED)) { new_task->set_emulated_ptracer(t->emulated_ptracer); new_task->emulated_ptrace_seized = t->emulated_ptrace_seized; new_task->emulated_ptrace_options = t->emulated_ptrace_options; t->emulated_ptrace_event_msg = new_task->rec_tid; t->emulate_ptrace_stop(WaitStatus::for_ptrace_event(ptrace_event)); // ptrace(2) man page says that SIGSTOP is used here, but it's really // SIGTRAP (in 4.4.4-301.fc23.x86_64 anyway). new_task->apply_group_stop(SIGTRAP); } // Restore our register modifications now, so that the emulated ptracer will // see the original registers without our modifications if it inspects them // in the ptrace event. r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); r.set_original_syscallno( syscall_state.syscall_entry_registers.original_syscallno()); t->set_regs(r); // We're in a PTRACE_EVENT_FORK/VFORK/CLONE so the next PTRACE_SYSCALL for // |t| will go to the exit of the syscall, as expected. } static bool protect_rr_sigs(RecordTask* t, remote_ptr p, void* save) { remote_ptr setp = p.cast(); if (setp.is_null()) { return false; } auto sig_set = t->read_mem(setp); auto new_sig_set = sig_set; // Don't let the tracee block TIME_SLICE_SIGNAL or // SYSCALLBUF_DESCHED_SIGNAL. new_sig_set &= ~(uint64_t(1) << (PerfCounters::TIME_SLICE_SIGNAL - 1)) & ~(uint64_t(1) << (SYSCALLBUF_DESCHED_SIGNAL - 1)); auto syscallno = t->ev().Syscall().number; if (syscallno == syscall_number_for_ppoll(t->arch()) || syscallno == syscall_number_for_pselect6(t->arch())) { t->save_sigmask(); t->set_new_sigmask(new_sig_set); } if (sig_set == new_sig_set) { return false; } t->write_mem(setp, new_sig_set); if (save) { memcpy(save, &sig_set, sizeof(sig_set)); } return true; } static void record_ranges(RecordTask* t, const vector& ranges, size_t size) { size_t s = size; for (auto& r : ranges) { size_t bytes = min(s, r.length); if (bytes > 0) { t->record_remote(r.data, bytes); s -= bytes; } } } template static Switchable rec_prepare_syscall_arch(RecordTask* t, TaskSyscallState& syscall_state) { int syscallno = t->ev().Syscall().number; syscall_state.syscall_entry_registers = t->regs(); if (t->desched_rec()) { /* |t| was descheduled while in a buffered syscall. We normally don't * use scratch memory for the call, because the syscallbuf itself * is serving that purpose. More importantly, we *can't* set up * scratch for |t|, because it's already in the syscall. Instead, we will * record the syscallbuf memory in rec_process_syscall_arch. * * However there is one case where we use scratch memory: when * sys_read's block-cloning path is interrupted. In that case, record * the scratch memory. */ if (syscallno == Arch::read && remote_ptr(t->regs().arg2()) == t->scratch_ptr) { syscall_state.reg_parameter( 2, ParamSize::from_syscall_result( (size_t)t->regs().arg3()), IN_OUT_NO_SCRATCH); } return ALLOW_SWITCH; } if (syscallno < 0) { // Invalid syscall. Don't let it accidentally match a // syscall number below that's for an undefined syscall. syscall_state.expect_errno = ENOSYS; return PREVENT_SWITCH; } switch (syscallno) { // All the regular syscalls are handled here. #include "SyscallRecordCase.generated" case Arch::splice: { syscall_state.reg_parameter(2, IN_OUT); syscall_state.reg_parameter(4, IN_OUT); return ALLOW_SWITCH; } case Arch::sendfile: { syscall_state.reg_parameter(3, IN_OUT); return ALLOW_SWITCH; } case Arch::sendfile64: { syscall_state.reg_parameter(3, IN_OUT); return ALLOW_SWITCH; } case Arch::capget: { auto hdr = t->read_mem( syscall_state.reg_parameter( 1, IN_OUT)); int struct_count; switch (hdr.version) { case _LINUX_CAPABILITY_VERSION_1: struct_count = _LINUX_CAPABILITY_U32S_1; break; case _LINUX_CAPABILITY_VERSION_2: struct_count = _LINUX_CAPABILITY_U32S_2; break; case _LINUX_CAPABILITY_VERSION_3: struct_count = _LINUX_CAPABILITY_U32S_3; break; default: struct_count = 0; break; } if (struct_count > 0) { syscall_state.reg_parameter( 2, sizeof(typename Arch::__user_cap_data_struct) * struct_count, OUT); } return PREVENT_SWITCH; } case Arch::fork: case Arch::vfork: case Arch::clone: prepare_clone(t, syscall_state); return ALLOW_SWITCH; case Arch::exit: prepare_exit(t, (int)t->regs().arg1()); return ALLOW_SWITCH; case Arch::exit_group: if (t->task_group()->task_set().size() == 1) { prepare_exit(t, (int)t->regs().arg1()); return ALLOW_SWITCH; } return PREVENT_SWITCH; case Arch::execve: { vector cmd_line; remote_ptr argv = t->regs().arg2(); while (true) { auto p = t->read_mem(argv); if (!p) { break; } cmd_line.push_back(t->read_c_str(p)); argv++; } // Save the event. We can't record it here because the exec might fail. string raw_filename = t->read_c_str(t->regs().arg1()); syscall_state.exec_saved_event = unique_ptr(new TraceTaskEvent( TraceTaskEvent::for_exec(t->tid, raw_filename, cmd_line))); // This can trigger unstable exits of non-main threads, so we have to // allow them to be handled. return ALLOW_SWITCH; } case Arch::fcntl: case Arch::fcntl64: { int fd = t->regs().arg1(); uint64_t result; if (t->fd_table()->emulate_fcntl(fd, t, &result)) { // Don't perform this syscall. Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); syscall_state.emulate_result(result); return PREVENT_SWITCH; } switch ((int)t->regs().arg2_signed()) { case Arch::DUPFD: case Arch::DUPFD_CLOEXEC: case Arch::GETFD: case Arch::GETFL: case Arch::SETFL: case Arch::SETLK: case Arch::SETLK64: case Arch::SETOWN: case Arch::SETOWN_EX: case Arch::GETSIG: case Arch::SETSIG: case Arch::ADD_SEALS: break; case Arch::SETFD: if (t->fd_table()->is_rr_fd(fd)) { // Don't let tracee set FD_CLOEXEC on this fd. Disable the syscall, // but emulate a successful return. Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); syscall_state.emulate_result(0); } break; case Arch::GETLK: syscall_state.reg_parameter(3, IN_OUT); break; case Arch::GETLK64: // flock and flock64 better be different on 32-bit architectures, // but on 64-bit architectures, it's OK if they're the same. static_assert( sizeof(typename Arch::_flock) < sizeof(typename Arch::flock64) || Arch::elfclass == ELFCLASS64, "struct flock64 not declared differently from struct flock"); syscall_state.reg_parameter(3, IN_OUT); break; case Arch::GETOWN_EX: syscall_state.reg_parameter(3); break; case Arch::SETLKW: case Arch::SETLKW64: // SETLKW blocks, but doesn't write any // outparam data to the |struct flock| // argument, so no need for scratch. return ALLOW_SWITCH; default: // Unknown command should trigger EINVAL. syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; } /* int futex(int *uaddr, int op, int val, const struct timespec *timeout, * int *uaddr2, int val3); * futex parameters are in-out but they can't be moved to scratch * addresses. */ case Arch::futex: { int op = t->regs().arg2_signed(); switch (op & FUTEX_CMD_MASK) { case FUTEX_WAIT: case FUTEX_WAIT_BITSET: return ALLOW_SWITCH; case FUTEX_CMP_REQUEUE: case FUTEX_WAKE_OP: syscall_state.reg_parameter(5, IN_OUT_NO_SCRATCH); break; case FUTEX_WAKE: break; case FUTEX_LOCK_PI: case FUTEX_UNLOCK_PI: case FUTEX_TRYLOCK_PI: case FUTEX_CMP_REQUEUE_PI: case FUTEX_WAIT_REQUEUE_PI: { Registers r = t->regs(); r.set_arg2(-1); t->set_regs(r); syscall_state.emulate_result(-ENOSYS); break; } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; } case Arch::getrandom: syscall_state.reg_parameter( 1, ParamSize::from_syscall_result((size_t)t->regs().arg2())); return (GRND_NONBLOCK & t->regs().arg3()) ? PREVENT_SWITCH : ALLOW_SWITCH; case Arch::set_thread_area: syscall_state.reg_parameter(1, IN_OUT); return PREVENT_SWITCH; case Arch::ipc: switch ((int)t->regs().arg1_signed()) { case MSGGET: case SHMDT: case SHMGET: case SEMGET: break; case MSGCTL: { int cmd = (int)t->regs().arg3_signed() & ~IPC_64; return prepare_msgctl(syscall_state, cmd, 5); } case MSGSND: case SEMOP: case SEMTIMEDOP: return ALLOW_SWITCH; case MSGRCV: { size_t msgsize = t->regs().arg3(); auto kluge_args = syscall_state.reg_parameter(5, IN); syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(kluge_args, msgbuf), sizeof(typename Arch::signed_long) + msgsize); return ALLOW_SWITCH; } case SHMAT: { // Insane legacy feature: ipc SHMAT returns its pointer via an // in-memory out parameter. syscall_state.reg_parameter(4); return PREVENT_SWITCH; } case SHMCTL: { int cmd = (int)t->regs().arg3_signed() & ~IPC_64; return prepare_shmctl(syscall_state, cmd, 5); } case SEMCTL: { int cmd = (int)t->regs().arg4_signed() & ~IPC_64; return prepare_semctl(t, syscall_state, (int)t->regs().arg2_signed(), cmd, 5, DEREFERENCE); } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; case Arch::msgctl: return prepare_msgctl(syscall_state, (int)t->regs().arg2_signed(), 3); case Arch::msgrcv: { size_t msgsize = t->regs().arg3(); syscall_state.reg_parameter(2, sizeof(typename Arch::signed_long) + msgsize); return ALLOW_SWITCH; } case Arch::msgsnd: case Arch::semop: case Arch::semtimedop: return ALLOW_SWITCH; case Arch::socketcall: return prepare_socketcall(t, syscall_state); case Arch::select: case Arch::_newselect: if (syscallno == Arch::select && Arch::select_semantics == Arch::SelectStructArguments) { auto argsp = syscall_state.reg_parameter(1, IN); syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, read_fds), IN_OUT); syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, write_fds), IN_OUT); syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, except_fds), IN_OUT); syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, timeout), IN_OUT); } else { syscall_state.reg_parameter(2, IN_OUT); syscall_state.reg_parameter(3, IN_OUT); syscall_state.reg_parameter(4, IN_OUT); syscall_state.reg_parameter(5, IN_OUT); } return ALLOW_SWITCH; /* int pselect6(int nfds, fd_set *readfds, fd_set *writefds, * fd_set *exceptfds, const struct timespec *timeout, * const pselect6_arg6 *sigmask); */ case Arch::pselect6: { syscall_state.reg_parameter(2, IN_OUT); syscall_state.reg_parameter(3, IN_OUT); syscall_state.reg_parameter(4, IN_OUT); syscall_state.reg_parameter(5, IN_OUT); auto arg6p = syscall_state.reg_parameter(6, IN); syscall_state.mem_ptr_parameter_inferred(REMOTE_PTR_FIELD(arg6p, ss), IN, protect_rr_sigs); return ALLOW_SWITCH; } case Arch::recvfrom: { syscall_state.reg_parameter( 2, ParamSize::from_syscall_result( t->regs().arg3())); auto addrlen_ptr = syscall_state.reg_parameter(6, IN_OUT); syscall_state.reg_parameter( 5, ParamSize::from_initialized_mem(t, addrlen_ptr)); return ALLOW_SWITCH; } case Arch::recvmsg: { auto msgp = syscall_state.reg_parameter(2, IN_OUT); prepare_recvmsg( t, syscall_state, msgp, ParamSize::from_syscall_result()); if (!((int)t->regs().arg3() & MSG_DONTWAIT)) { return ALLOW_SWITCH; } return PREVENT_SWITCH; } case Arch::recvmmsg: { auto vlen = (unsigned int)t->regs().arg3(); auto mmsgp = syscall_state .reg_parameter(2, sizeof(typename Arch::mmsghdr) * vlen, IN_OUT) .cast(); prepare_recvmmsg(t, syscall_state, mmsgp, vlen); if (!((unsigned int)t->regs().arg4() & MSG_DONTWAIT)) { return ALLOW_SWITCH; } return PREVENT_SWITCH; } case Arch::sendmsg: if (!((unsigned int)t->regs().arg3() & MSG_DONTWAIT)) { return ALLOW_SWITCH; } return PREVENT_SWITCH; case Arch::sendmmsg: { auto vlen = (unsigned int)t->regs().arg3(); syscall_state.reg_parameter(2, sizeof(typename Arch::mmsghdr) * vlen, IN_OUT); if (!((unsigned int)t->regs().arg4() & MSG_DONTWAIT)) { return ALLOW_SWITCH; } return PREVENT_SWITCH; } case Arch::getsockname: case Arch::getpeername: { auto addrlen_ptr = syscall_state.reg_parameter(3, IN_OUT); syscall_state.reg_parameter( 2, ParamSize::from_initialized_mem(t, addrlen_ptr)); return PREVENT_SWITCH; } case Arch::setsockopt: if (block_sock_opt(t->regs().arg2_signed(), t->regs().arg3_signed(), syscall_state)) { Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); } return PREVENT_SWITCH; case Arch::getsockopt: { auto optlen_ptr = syscall_state.reg_parameter(5, IN_OUT); syscall_state.reg_parameter( 4, ParamSize::from_initialized_mem(t, optlen_ptr)); return PREVENT_SWITCH; } case Arch::pread64: /* ssize_t read(int fd, void *buf, size_t count); */ case Arch::read: { int fd = t->regs().arg1(); uint64_t result; vector ranges; ranges.push_back(FileMonitor::Range(t->regs().arg2(), t->regs().arg3())); if (t->fd_table()->emulate_read( fd, t, ranges, t->get_io_offset(syscallno, t->regs()), &result)) { // Don't perform this syscall. Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); record_ranges(t, ranges, result); syscall_state.emulate_result(result); return PREVENT_SWITCH; } syscall_state.reg_parameter( 2, ParamSize::from_syscall_result( (size_t)t->regs().arg3())); return ALLOW_SWITCH; } case Arch::accept: case Arch::accept4: { auto addrlen_ptr = syscall_state.reg_parameter(3, IN_OUT); syscall_state.reg_parameter( 2, ParamSize::from_initialized_mem(t, addrlen_ptr)); return ALLOW_SWITCH; } case Arch::getcwd: { syscall_state.reg_parameter( 1, ParamSize::from_syscall_result( (size_t)t->regs().arg2())); return PREVENT_SWITCH; } case Arch::getdents: case Arch::getdents64: { syscall_state.reg_parameter(2, ParamSize::from_syscall_result( (unsigned int)t->regs().arg3())); return PREVENT_SWITCH; } case Arch::readlink: { syscall_state.reg_parameter( 2, ParamSize::from_syscall_result( (size_t)t->regs().arg3())); return PREVENT_SWITCH; } case Arch::readlinkat: { syscall_state.reg_parameter( 3, ParamSize::from_syscall_result( (size_t)t->regs().arg4())); return PREVENT_SWITCH; } case Arch::getgroups: { // We could record a little less data by restricting the recorded data // to the syscall result * sizeof(Arch::legacy_gid_t), but that would // require more infrastructure and it's not worth worrying about. syscall_state.reg_parameter(2, (int)t->regs().arg1_signed() * sizeof(typename Arch::legacy_gid_t)); return PREVENT_SWITCH; } case Arch::getgroups32: { // We could record a little less data by restricting the recorded data // to the syscall result * sizeof(Arch::gid_t), but that would // require more infrastructure and it's not worth worrying about. syscall_state.reg_parameter(2, (int)t->regs().arg1_signed() * sizeof(typename Arch::gid_t)); return PREVENT_SWITCH; } case Arch::write: case Arch::writev: { int fd = (int)t->regs().arg1_signed(); return t->fd_table()->will_write(t, fd); } /* ssize_t readv(int fd, const struct iovec *iov, int iovcnt); */ case Arch::readv: /* ssize_t preadv(int fd, const struct iovec *iov, int iovcnt, off_t offset); */ case Arch::preadv: { int fd = (int)t->regs().arg1_signed(); int iovcnt = (int)t->regs().arg3_signed(); remote_ptr iovecsp_void = syscall_state.reg_parameter( 2, sizeof(typename Arch::iovec) * iovcnt, IN); auto iovecsp = iovecsp_void.cast(); auto iovecs = t->read_mem(iovecsp, iovcnt); uint64_t result; vector ranges; for (int i = 0; i < iovcnt; ++i) { ranges.push_back( FileMonitor::Range(iovecs[i].iov_base, iovecs[i].iov_len)); } if (t->fd_table()->emulate_read( fd, t, ranges, t->get_io_offset(syscallno, t->regs()), &result)) { // Don't perform this syscall. Registers r = t->regs(); r.set_arg1(-1); t->set_regs(r); record_ranges(t, ranges, result); syscall_state.emulate_result(result); return PREVENT_SWITCH; } ParamSize io_size = ParamSize::from_syscall_result(); for (int i = 0; i < iovcnt; ++i) { syscall_state.mem_ptr_parameter(REMOTE_PTR_FIELD(iovecsp + i, iov_base), io_size.limit_size(iovecs[i].iov_len)); } return ALLOW_SWITCH; } /* pid_t waitpid(pid_t pid, int *status, int options); */ /* pid_t wait4(pid_t pid, int *status, int options, struct rusage * *rusage); */ case Arch::waitpid: case Arch::wait4: { syscall_state.reg_parameter(2, IN_OUT); if (syscallno == Arch::wait4) { syscall_state.reg_parameter(4); } pid_t pid = (pid_t)t->regs().arg1_signed(); if (pid < -1) { t->in_wait_type = WAIT_TYPE_PGID; t->in_wait_pid = -pid; } else if (pid == -1) { t->in_wait_type = WAIT_TYPE_ANY; } else if (pid == 0) { t->in_wait_type = WAIT_TYPE_SAME_PGID; } else { t->in_wait_type = WAIT_TYPE_PID; t->in_wait_pid = pid; } int options = (int)t->regs().arg3(); if (maybe_emulate_wait(t, syscall_state, options)) { Registers r = t->regs(); // Set options to an invalid value to force syscall to fail r.set_arg3(0xffffffff); t->set_regs(r); return PREVENT_SWITCH; } maybe_pause_instead_of_waiting(t, options); return ALLOW_SWITCH; } case Arch::waitid: { syscall_state.reg_parameter(3, IN_OUT); t->in_wait_pid = (id_t)t->regs().arg2(); switch ((idtype_t)t->regs().arg1()) { case P_ALL: t->in_wait_type = WAIT_TYPE_ANY; break; case P_PID: t->in_wait_type = WAIT_TYPE_PID; break; case P_PGID: t->in_wait_type = WAIT_TYPE_PGID; break; default: syscall_state.expect_errno = EINVAL; break; } int options = (int)t->regs().arg4(); if (maybe_emulate_wait(t, syscall_state, options)) { Registers r = t->regs(); // Set options to an invalid value to force syscall to fail r.set_arg4(0xffffffff); t->set_regs(r); return PREVENT_SWITCH; } maybe_pause_instead_of_waiting(t, options); return ALLOW_SWITCH; } case Arch::setpriority: // The syscall might fail due to insufficient // permissions (e.g. while trying to decrease the nice value // while not root). // We'll choose to honor the new value anyway since we'd like // to be able to test configurations where a child thread // has a lower nice value than its parent, which requires // lowering the child's nice value. if ((int)t->regs().arg1_signed() == PRIO_PROCESS) { RecordTask* target = (int)t->regs().arg2_signed() ? t->session().find_task((int)t->regs().arg2_signed()) : t; if (target) { LOG(debug) << "Setting nice value for tid " << t->tid << " to " << t->regs().arg3(); target->session().scheduler().update_task_priority( target, (int)t->regs().arg3_signed()); } } return PREVENT_SWITCH; case Arch::pause: return ALLOW_SWITCH; /* int poll(struct pollfd *fds, nfds_t nfds, int timeout) */ /* int ppoll(struct pollfd *fds, nfds_t nfds, * const struct timespec *timeout_ts, * const sigset_t *sigmask); */ case Arch::ppoll: syscall_state.reg_parameter(4, IN, protect_rr_sigs); /* fall through */ case Arch::poll: { auto nfds = (nfds_t)t->regs().arg2(); syscall_state.reg_parameter(1, sizeof(typename Arch::pollfd) * nfds, IN_OUT); return ALLOW_SWITCH; } case Arch::perf_event_open: { RecordTask* target = t->session().find_task((pid_t)t->regs().arg2_signed()); int cpu = t->regs().arg3_signed(); int group_fd = t->regs().arg4_signed(); unsigned long flags = t->regs().arg5(); if (target && cpu == -1 && group_fd == -1 && !flags) { auto attr = t->read_mem(remote_ptr(t->regs().arg1())); if (VirtualPerfCounterMonitor::should_virtualize(attr)) { Registers r = t->regs(); // Turn this into an inotify_init() syscall. This just gives us an // allocated fd. Syscalls using this fd will be emulated (except for // close()). r.set_original_syscallno(Arch::inotify_init); t->set_regs(r); } } return PREVENT_SWITCH; } case Arch::open: { string pathname = t->read_c_str(remote_ptr(t->regs().arg1())); if (is_blacklisted_filename(pathname.c_str())) { LOG(warn) << "Cowardly refusing to open " << pathname; Registers r = t->regs(); // Set path to terminating null byte. This forces ENOENT. r.set_arg1(remote_ptr(r.arg1()) + pathname.size()); t->set_regs(r); } else if (is_gcrypt_deny_file(pathname.c_str())) { // Hijack the syscall. Registers r = t->regs(); r.set_original_syscallno(Arch::gettid); t->set_regs(r); return PREVENT_SWITCH; } return ALLOW_SWITCH; } case Arch::openat: { // XXX we really should support blacklisting here return ALLOW_SWITCH; } case Arch::close: if (t->fd_table()->is_rr_fd((int)t->regs().arg1())) { // Don't let processes close this fd. Abort with EBADF by setting // oldfd to -1, as if the fd is already closed. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); } return PREVENT_SWITCH; case Arch::dup2: case Arch::dup3: if (t->fd_table()->is_rr_fd((int)t->regs().arg2())) { // Don't let processes dup over this fd. Abort with EBADF by setting // oldfd to -1. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); } return PREVENT_SWITCH; /* int prctl(int option, unsigned long arg2, unsigned long arg3, unsigned * long arg4, unsigned long arg5); */ case Arch::prctl: switch ((int)t->regs().arg1_signed()) { case PR_GET_ENDIAN: case PR_GET_FPEMU: case PR_GET_FPEXC: case PR_GET_PDEATHSIG: case PR_GET_UNALIGN: syscall_state.reg_parameter(2); break; case PR_GET_KEEPCAPS: case PR_GET_NO_NEW_PRIVS: case PR_GET_TIMERSLACK: case PR_MCE_KILL: case PR_MCE_KILL_GET: case PR_SET_KEEPCAPS: case PR_SET_NAME: case PR_SET_PDEATHSIG: case PR_SET_TIMERSLACK: break; case PR_SET_DUMPABLE: if (t->regs().arg2() == 0) { // Don't let processes make themselves undumpable. If a process // becomes undumpable, calling perf_event_open on it fails. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); syscall_state.emulate_result(0); t->task_group()->dumpable = false; } else if (t->regs().arg2() == 1) { t->task_group()->dumpable = true; } break; case PR_GET_DUMPABLE: syscall_state.emulate_result(t->task_group()->dumpable); break; case PR_GET_SECCOMP: syscall_state.emulate_result(t->prctl_seccomp_status); break; case PR_GET_TSC: { // Prevent the actual GET_TSC call and return our emulated state. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); syscall_state.emulate_result(0); t->write_mem(syscall_state.reg_parameter(2, IN_OUT_NO_SCRATCH), t->tsc_mode); break; } case PR_SET_TSC: { // Prevent the actual SET_TSC call. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); int val = (int)t->regs().arg2(); if (val != PR_TSC_ENABLE && val != PR_TSC_SIGSEGV) { syscall_state.emulate_result(-EINVAL); } else { syscall_state.emulate_result(0); t->tsc_mode = val; } break; } case PR_GET_NAME: syscall_state.reg_parameter(2, 16); break; case PR_SET_NO_NEW_PRIVS: if ((unsigned long)t->regs().arg2() != 1) { syscall_state.expect_errno = EINVAL; } break; case PR_SET_SECCOMP: // Allow all known seccomp calls. We must allow the seccomp call // that rr triggers when spawning the initial tracee. switch ((unsigned long)t->regs().arg2()) { case SECCOMP_MODE_STRICT: break; case SECCOMP_MODE_FILTER: { // If we're bootstrapping then this must be rr's own syscall // filter, so just install it normally now. if (t->session().done_initial_exec()) { // Prevent the actual prctl call. We'll fix this up afterwards. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); } break; } default: syscall_state.expect_errno = EINVAL; break; } break; case PR_SET_PTRACER: { // Prevent any PR_SET_PTRACER call, but pretend it succeeded, since // we don't want any interference with our ptracing. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); syscall_state.emulate_result(0); break; } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; case Arch::arch_prctl: switch ((int)t->regs().arg1_signed()) { case ARCH_SET_FS: case ARCH_SET_GS: break; case ARCH_GET_FS: case ARCH_GET_GS: syscall_state.reg_parameter(2); break; default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; case Arch::ioctl: return prepare_ioctl(t, syscall_state); case Arch::_sysctl: { auto argsp = syscall_state.reg_parameter(1, IN); auto oldlenp = syscall_state.mem_ptr_parameter_inferred( REMOTE_PTR_FIELD(argsp, oldlenp), IN_OUT); syscall_state.mem_ptr_parameter( REMOTE_PTR_FIELD(argsp, oldval), ParamSize::from_initialized_mem(t, oldlenp)); return PREVENT_SWITCH; } case Arch::quotactl: switch (t->regs().arg1() >> SUBCMDSHIFT) { case Q_GETQUOTA: syscall_state.reg_parameter(4); break; case Q_GETINFO: syscall_state.reg_parameter(4); break; case Q_GETFMT: syscall_state.reg_parameter(4); break; case Q_SETQUOTA: FATAL() << "Trying to set disk quota usage, this may interfere with " "rr recording"; // not reached case Q_QUOTAON: case Q_QUOTAOFF: case Q_SETINFO: case Q_SYNC: break; default: // Don't set expect_errno here because quotactl can fail with // various error codes before checking the command break; } return PREVENT_SWITCH; /* int epoll_wait(int epfd, struct epoll_event *events, int maxevents, int * timeout); */ case Arch::epoll_wait: syscall_state.reg_parameter(2, sizeof(typename Arch::epoll_event) * t->regs().arg3_signed()); return ALLOW_SWITCH; /* The following two syscalls enable context switching not for * liveness/correctness reasons, but rather because if we * didn't context-switch away, rr might end up busy-waiting * needlessly. In addition, albeit far less likely, the * client program may have carefully optimized its own context * switching and we should take the hint. */ case Arch::nanosleep: syscall_state.reg_parameter(2); return ALLOW_SWITCH; case Arch::clock_nanosleep: syscall_state.reg_parameter(4); return ALLOW_SWITCH; case Arch::sched_yield: t->session().scheduler().schedule_one_round_robin(t); return ALLOW_SWITCH; case Arch::rt_sigpending: syscall_state.reg_parameter(1, (size_t)t->regs().arg2()); return PREVENT_SWITCH; case Arch::rt_sigtimedwait: syscall_state.reg_parameter(2); return ALLOW_SWITCH; case Arch::rt_sigsuspend: case Arch::sigsuspend: t->sigsuspend_blocked_sigs = unique_ptr( new sig_set_t(t->read_mem(remote_ptr(t->regs().arg1())))); return ALLOW_SWITCH; case Arch::rt_sigprocmask: case Arch::sigprocmask: { syscall_state.reg_parameter(3); syscall_state.reg_parameter(2, IN, protect_rr_sigs); return PREVENT_SWITCH; } case Arch::getxattr: case Arch::lgetxattr: case Arch::fgetxattr: syscall_state.reg_parameter( 3, ParamSize::from_syscall_result(t->regs().arg4())); return PREVENT_SWITCH; case Arch::listxattr: case Arch::llistxattr: case Arch::flistxattr: syscall_state.reg_parameter( 2, ParamSize::from_syscall_result(t->regs().arg3())); return PREVENT_SWITCH; case Arch::sched_setaffinity: { // Ignore all sched_setaffinity syscalls. They might interfere // with our own affinity settings. Registers r = t->regs(); // Set arg1 to an invalid PID to ensure this syscall is ignored. r.set_arg1(-1); t->set_regs(r); syscall_state.emulate_result(0); return PREVENT_SWITCH; } case Arch::sched_getaffinity: syscall_state.reg_parameter(3, ParamSize::from_syscall_result( (unsigned int)t->regs().arg2())); return PREVENT_SWITCH; case Arch::ptrace: return prepare_ptrace(t, syscall_state); case Arch::mincore: syscall_state.reg_parameter(3, (t->regs().arg2() + page_size() - 1) / page_size()); return PREVENT_SWITCH; case Arch::shmctl: return prepare_shmctl(syscall_state, (int)t->regs().arg2_signed(), 3); case Arch::semctl: return prepare_semctl( t, syscall_state, (int)t->regs().arg1_signed(), (int)t->regs().arg3_signed(), 4, USE_DIRECTLY); case Arch::seccomp: switch ((unsigned int)t->regs().arg1()) { case SECCOMP_SET_MODE_STRICT: break; case SECCOMP_SET_MODE_FILTER: { // Prevent the actual seccomp call. We'll fix this up afterwards. Registers r = t->regs(); r.set_arg1(intptr_t(-1)); t->set_regs(r); break; } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; case Arch::madvise: switch ((int)t->regs().arg3()) { case MADV_NORMAL: case MADV_RANDOM: case MADV_SEQUENTIAL: case MADV_WILLNEED: case MADV_DONTNEED: case MADV_REMOVE: case MADV_DONTFORK: case MADV_DOFORK: case MADV_SOFT_OFFLINE: case MADV_HWPOISON: case MADV_MERGEABLE: case MADV_UNMERGEABLE: case MADV_HUGEPAGE: case MADV_NOHUGEPAGE: case MADV_DONTDUMP: case MADV_DODUMP: break; case MADV_FREE: { // MADV_FREE introduces nondeterminism --- the kernel zeroes the // pages when under memory pressure. So we don't allow it. Registers r = t->regs(); r.set_arg3(-1); t->set_regs(r); break; } default: syscall_state.expect_errno = EINVAL; break; } return PREVENT_SWITCH; case Arch::personality: switch ((int)t->regs().arg1()) { case PER_LINUX: // The default personality requires no handling. break; case -1: // A special argument that only returns the existing personality. break; default: syscall_state.expect_errno = EINVAL; } return PREVENT_SWITCH; case Arch::mmap: switch (Arch::mmap_semantics) { case Arch::StructArguments: { auto args = t->read_mem( remote_ptr(t->regs().arg1())); // XXX fix this ASSERT(t, !(args.flags & MAP_GROWSDOWN)); break; } case Arch::RegisterArguments: { prepare_mmap_register_params(t); break; } } return PREVENT_SWITCH; case Arch::mmap2: prepare_mmap_register_params(t); return PREVENT_SWITCH; case Arch::mprotect: // Since we're stripping MAP_GROWSDOWN from kernel mmap calls, we need // to implement PROT_GROWSDOWN ourselves. t->vm()->fixup_mprotect_growsdown_parameters(t); return PREVENT_SWITCH; case SYS_rrcall_notify_control_msg: case SYS_rrcall_init_preload: syscall_state.emulate_result(0); return PREVENT_SWITCH; case SYS_rrcall_init_buffers: syscall_state.reg_parameter>(1, IN_OUT); return PREVENT_SWITCH; case Arch::brk: case Arch::munmap: case Arch::process_vm_readv: case Arch::process_vm_writev: case SYS_rrcall_notify_syscall_hook_exit: case Arch::mremap: case Arch::shmat: case Arch::shmdt: return PREVENT_SWITCH; case Arch::sigreturn: return process_sigreturn(t); case Arch::rt_sigreturn: { auto frameptr = (t->regs().sp() - sizeof(typename Arch::unsigned_word)) .cast(); auto oldmaskptr = REMOTE_PTR_FIELD(REMOTE_PTR_FIELD(frameptr, uc), uc_sigmask); // User space sigset_t is larger than the kernel one, but since we only // care about what the kernel sees, load that one. static_assert(sizeof(typename Arch::kernel_sigset_t) == sizeof(uint64_t), "Kernel mask size grew?"); uint64_t oldmask = t->read_mem(oldmaskptr.template cast()); t->set_new_sigmask(oldmask); t->clear_saved_sigmask(); return PREVENT_SWITCH; } case Arch::mq_timedreceive: { syscall_state.reg_parameter( 2, ParamSize::from_syscall_result( (size_t)t->regs().arg3())); syscall_state.reg_parameter(4); return ALLOW_SWITCH; } default: // Invalid syscalls return -ENOSYS. Assume any such // result means the syscall was completely ignored by the // kernel so it's OK for us to not do anything special. // Other results mean we probably need to understand this // syscall, but we don't. syscall_state.expect_errno = ENOSYS; return PREVENT_SWITCH; } } template <> Switchable process_sigreturn(RecordTask* t) { ASSERT(t, "sigreturn should not be callable on x86_64"); t->clear_saved_sigmask(); return PREVENT_SWITCH; } template <> Switchable process_sigreturn(RecordTask* t) { auto frameptr = (t->regs().sp() - 8).cast(); auto oldmaskptrlow = REMOTE_PTR_FIELD(REMOTE_PTR_FIELD(frameptr, sc), oldmask); auto oldmaskptrhigh = REMOTE_PTR_FIELD(frameptr, extramask); uint64_t oldmask = t->read_mem(oldmaskptrlow) | (((uint64_t)t->read_mem(oldmaskptrhigh)) << 32); t->set_new_sigmask(oldmask); t->clear_saved_sigmask(); return PREVENT_SWITCH; } static Switchable rec_prepare_syscall_internal( RecordTask* t, TaskSyscallState& syscall_state) { RR_ARCH_FUNCTION(rec_prepare_syscall_arch, t->arch(), t, syscall_state) } Switchable rec_prepare_syscall(RecordTask* t) { auto& syscall_state = syscall_state_property.get_or_create(*t); syscall_state.init(t); Switchable s = rec_prepare_syscall_internal(t, syscall_state); int syscallno = t->ev().Syscall().number; if (is_sigreturn(syscallno, t->arch())) { // There isn't going to be an exit event for this syscall, so remove // syscall_state now. syscall_state_property.remove(*t); return s; } return syscall_state.done_preparing(s); } template static void rec_prepare_restart_syscall_arch(RecordTask* t, TaskSyscallState& syscall_state) { int syscallno = t->ev().Syscall().number; switch (syscallno) { case Arch::nanosleep: case Arch::clock_nanosleep: /* Hopefully uniquely among syscalls, nanosleep()/clock_nanosleep() * requires writing to its remaining-time outparam * *only if* the syscall fails with -EINTR. When a * nanosleep() is interrupted by a signal, we don't * know a priori whether it's going to be eventually * restarted or not. (Not easily, anyway.) So we * don't know whether it will eventually return -EINTR * and would need the outparam written. To resolve * that, we do what the kernel does, and update the * outparam at the -ERESTART_RESTART interruption * regardless. */ syscall_state.process_syscall_results(); break; case Arch::wait4: case Arch::waitid: case Arch::waitpid: { Registers r = t->regs(); r.set_original_syscallno( syscall_state.syscall_entry_registers.original_syscallno()); t->set_regs(r); t->in_wait_type = WAIT_TYPE_NONE; break; } } } static void rec_prepare_restart_syscall_internal( RecordTask* t, TaskSyscallState& syscall_state) { RR_ARCH_FUNCTION(rec_prepare_restart_syscall_arch, t->arch(), t, syscall_state); } void rec_prepare_restart_syscall(RecordTask* t) { auto& syscall_state = *syscall_state_property.get(*t); rec_prepare_restart_syscall_internal(t, syscall_state); syscall_state_property.remove(*t); } static void process_execve(RecordTask* t, TaskSyscallState& syscall_state) { Registers r = t->regs(); if (r.syscall_failed()) { return; } t->post_exec_syscall(*syscall_state.exec_saved_event); KernelMapping rr_page_mapping = t->vm()->mapping_of(AddressSpace::rr_page_start()).map; auto mode = t->trace_writer().write_mapped_region( t, rr_page_mapping, rr_page_mapping.fake_stat(), TraceWriter::RR_BUFFER_MAPPING); ASSERT(t, mode == TraceWriter::DONT_RECORD_IN_TRACE); KernelMapping preload_thread_locals_mapping = t->vm()->mapping_of(AddressSpace::preload_thread_locals_start()).map; mode = t->trace_writer().write_mapped_region( t, preload_thread_locals_mapping, preload_thread_locals_mapping.fake_stat(), TraceWriter::RR_BUFFER_MAPPING); ASSERT(t, mode == TraceWriter::DONT_RECORD_IN_TRACE); t->session().trace_writer().write_task_event(*syscall_state.exec_saved_event); KernelMapping vvar; // Write out stack mappings first since during replay we need to set up the // stack before any files get mapped. vector stacks; for (auto m : t->vm()->maps()) { auto& km = m.map; if (km.is_stack()) { stacks.push_back(km); } else if (km.is_vvar()) { vvar = km; } } { AutoRemoteSyscalls remote(t, AutoRemoteSyscalls::DISABLE_MEMORY_PARAMS); if (vvar.size()) { // We're not going to map [vvar] during replay --- that wouldn't // make sense, since it contains data from the kernel that isn't correct // for replay, and we patch out the vdso syscalls that would use it. // Unmapping it now makes recording look more like replay. // Also note that under 4.0.7-300.fc22.x86_64 (at least) /proc//mem // can't read the contents of [vvar]. remote.infallible_syscall(syscall_number_for_munmap(remote.arch()), vvar.start(), vvar.size()); t->vm()->unmap(t, vvar.start(), vvar.size()); } for (auto& km : stacks) { mode = t->trace_writer().write_mapped_region(t, km, km.fake_stat(), TraceWriter::EXEC_MAPPING); ASSERT(t, mode == TraceWriter::RECORD_IN_TRACE); auto buf = t->read_mem(km.start().cast(), km.size()); t->trace_writer().write_raw(t->rec_tid, buf.data(), km.size(), km.start()); // Remove MAP_GROWSDOWN from stacks by remapping the memory and // writing the contents back. int flags = (km.flags() & ~MAP_GROWSDOWN) | MAP_ANONYMOUS; remote.infallible_syscall(syscall_number_for_munmap(remote.arch()), km.start(), km.size()); if (!t->vm()->has_mapping(km.start() - page_size())) { // Unmap an extra page at the start; this seems to be necessary // to properly wipe out the growsdown mapping. Doing it as a separate // munmap call also seems to be necessary. remote.infallible_syscall(syscall_number_for_munmap(remote.arch()), km.start() - page_size(), page_size()); } remote.infallible_mmap_syscall(km.start(), km.size(), km.prot(), flags, -1, 0); t->write_mem(km.start().cast(), buf.data(), buf.size()); } } // The kernel may zero part of the last page in each data mapping according // to ELF BSS metadata. So we record the last page of each data mapping in // the trace. vector> pages_to_record; for (auto m : t->vm()->maps()) { auto& km = m.map; if (km.start() == AddressSpace::rr_page_start()) { continue; } if (km.is_stack() || km.is_vsyscall()) { // [stack] has already been handled. // [vsyscall] can't be read via /proc//mem, *should* // be the same across all execs, and can't be munmapped so we can't fix // it even if it does vary. Plus no-one should be using it anymore. continue; } struct stat st; if (stat(km.fsname().c_str(), &st) != 0) { st = km.fake_stat(); } if (t->trace_writer().write_mapped_region(t, km, st, TraceWriter::EXEC_MAPPING) == TraceWriter::RECORD_IN_TRACE) { if (st.st_size > 0) { off64_t end = (off64_t)st.st_size - km.file_offset_bytes(); t->record_remote(km.start(), min(end, (off64_t)km.size())); } else { // st_size is not valid. Some device files are mmappable but have zero // size. We also take this path if there's no file at all (vdso etc). t->record_remote(km.start(), km.size()); } } else { // See https://github.com/mozilla/rr/issues/1568; in some cases // after exec we have memory areas that are rwx. These areas have // a trailing page that may be partially zeroed by the kernel. Record the // trailing page of every mapping just to be simple and safe. pages_to_record.push_back(km.end() - page_size()); } } init_scratch_memory(t, FIXED_ADDRESS); for (auto& p : pages_to_record) { t->record_remote(p, page_size()); } // Patch LD_PRELOAD and VDSO after saving the mappings. Replay will apply // patches to the saved mappings. t->vm()->monkeypatcher().patch_after_exec(t); } static void process_mmap(RecordTask* t, size_t length, int prot, int flags, int fd, off_t offset_pages) { if (t->regs().syscall_failed()) { // We purely emulate failed mmaps. return; } size_t size = ceil_page_size(length); off64_t offset = offset_pages * 4096; remote_ptr addr = t->regs().syscall_result(); if (flags & MAP_ANONYMOUS) { KernelMapping km; if (flags & MAP_PRIVATE) { // Anonymous mappings are by definition not backed by any file-like // object, and are initialized to zero, so there's no nondeterminism to // record. km = t->vm()->map(t, addr, size, prot, flags, 0, string()); } else { ASSERT(t, !(flags & MAP_GROWSDOWN)); // Read the kernel's mapping. There doesn't seem to be any other way to // get the correct device/inode numbers. Fortunately anonymous shared // mappings are rare. KernelMapping kernel_info = t->vm()->read_kernel_mapping(t, addr); km = t->vm()->map(t, addr, size, prot, flags, 0, kernel_info.fsname(), kernel_info.device(), kernel_info.inode()); } auto d = t->trace_writer().write_mapped_region(t, km, km.fake_stat()); ASSERT(t, d == TraceWriter::DONT_RECORD_IN_TRACE); return; } ASSERT(t, fd >= 0) << "Valid fd required for file mapping"; ASSERT(t, !(flags & MAP_GROWSDOWN)); auto st = t->stat_fd(fd); string file_name = t->file_name_of_fd(fd); KernelMapping km = t->vm()->map(t, addr, size, prot, flags, offset, file_name, st.st_dev, st.st_ino, unique_ptr(new struct stat(st))); if (!st.st_size) { // Some device files are mmappable but have zero size. Increasing the // size here is safe even if the mapped size is greater than the real size. st.st_size = offset + size; } if (t->trace_writer().write_mapped_region(t, km, st) == TraceWriter::RECORD_IN_TRACE) { off64_t end = (off64_t)st.st_size - km.file_offset_bytes(); t->record_remote(addr, min(end, (off64_t)km.size())); if ((flags & MAP_SHARED)) { if (t->fd_table()->is_monitoring(fd)) { ASSERT(t, t->fd_table()->get_monitor(fd)->type() == FileMonitor::Type::Mmapped); } else { t->fd_table()->add_monitor(fd, new MmappedFileMonitor(t, fd)); } } } if ((prot & PROT_WRITE) && (flags & MAP_SHARED)) { LOG(debug) << file_name << " is SHARED|WRITEABLE; that's not handled " "correctly yet. Optimistically hoping it's not " "written by programs outside the rr tracee " "tree."; } // We don't want to patch MAP_SHARED files. In the best case we'd end crashing // at an assertion, in the worst case, we'd end up modifying the underlying // file. if (!(flags & MAP_SHARED)) t->vm()->monkeypatcher().patch_after_mmap(t, addr, size, offset_pages, fd); if ((prot & (PROT_WRITE | PROT_READ)) == PROT_READ && (flags & MAP_SHARED) && !(flags & MAP_ANONYMOUS)) { MonitoredSharedMemory::maybe_monitor(t, file_name, t->vm()->mapping_of(addr), fd, offset); } } static void process_mremap(RecordTask* t, remote_ptr old_addr, size_t old_length, size_t new_length) { if (t->regs().syscall_failed()) { // We purely emulate failed mremaps. return; } size_t old_size = ceil_page_size(old_length); size_t new_size = ceil_page_size(new_length); remote_ptr new_addr = t->regs().syscall_result(); t->vm()->remap(t, old_addr, old_size, new_addr, new_size); AddressSpace::Mapping m = t->vm()->mapping_of(new_addr); KernelMapping km = m.map.subrange(new_addr, new_addr + min(new_size, old_size)); struct stat st = m.mapped_file_stat ? *m.mapped_file_stat : km.fake_stat(); // Make sure that the trace records the mapping at the new location, even // if the mapping didn't grow. auto r = t->trace_writer().write_mapped_region(t, km, st, TraceWriter::REMAP_MAPPING); ASSERT(t, r == TraceWriter::DONT_RECORD_IN_TRACE); if (old_size >= new_size) { return; } // Now record the new part of the mapping. km = m.map.subrange(new_addr + old_size, new_addr + new_size); if (!st.st_size) { // Some device files are mmappable but have zero size. Increasing the // size here is safe even if the mapped size is greater than the real size. st.st_size = m.map.file_offset_bytes() + new_size; } if (t->trace_writer().write_mapped_region(t, km, st) == TraceWriter::RECORD_IN_TRACE) { off64_t end = max(st.st_size - km.file_offset_bytes(), 0); t->record_remote(km.start(), min(end, (off64_t)km.size())); } // If the original mapping was monitored, we'll continue monitoring it // automatically. } static void process_shmat(RecordTask* t, int shmid, int shm_flags, remote_ptr addr) { if (t->regs().syscall_failed()) { // We purely emulate failed shmats. return; } struct shmid64_ds ds; int ret = _shmctl(shmid, IPC_STAT, &ds); msan_unpoison(&ds, sizeof(semid64_ds)); ASSERT(t, !ret) << "shmid should be readable by rr since rr has the same " "UID as tracees"; size_t size = ceil_page_size(ds.shm_segsz); int prot = shm_flags_to_mmap_prot(shm_flags); int flags = MAP_SHARED; // Read the kernel's mapping for the shm segment. There doesn't seem to be // any other way to get the correct device number. (The inode number seems to // be the shm key.) This should be OK since SysV shmem is not used very much // and reading /proc//maps should be reasonably cheap. KernelMapping kernel_info = t->vm()->read_kernel_mapping(t, addr); KernelMapping km = t->vm()->map(t, addr, size, prot, flags, 0, kernel_info.fsname(), kernel_info.device(), kernel_info.inode()); if (t->trace_writer().write_mapped_region(t, km, km.fake_stat()) == TraceWriter::RECORD_IN_TRACE) { t->record_remote(addr, size); } LOG(debug) << "Optimistically hoping that SysV segment is not used outside " "of tracees"; } template static string extra_expected_errno_info(RecordTask* t, TaskSyscallState& syscall_state) { stringstream ss; switch (syscall_state.expect_errno) { case ENOSYS: ss << "; execution of syscall unsupported by rr"; break; case EINVAL: switch (t->regs().original_syscallno()) { case Arch::ioctl: { int request = (int)t->regs().arg2_signed(); int type = _IOC_TYPE(request); int nr = _IOC_NR(request); int dir = _IOC_DIR(request); int size = _IOC_SIZE(request); ss << "; Unknown ioctl(" << HEX(request) << "): type:" << HEX(type) << " nr:" << HEX(nr) << " dir:" << HEX(dir) << " size:" << size << " addr:" << HEX(t->regs().arg3()); break; } case Arch::fcntl: case Arch::fcntl64: ss << "; unknown fcntl(" << HEX((int)t->regs().arg2_signed()) << ")"; break; case Arch::prctl: ss << "; unknown prctl(" << HEX((int)t->regs().arg1_signed()) << ")"; break; case Arch::arch_prctl: ss << "; unknown arch_prctl(" << HEX((int)t->regs().arg1_signed()) << ")"; break; case Arch::socketcall: ss << "; unknown socketcall(" << HEX((int)t->regs().arg1_signed()) << ")"; break; case Arch::ipc: ss << "; unknown ipc(" << HEX((int)t->regs().arg1_signed()) << ")"; break; case Arch::futex: ss << "; unknown futex(" << HEX((int)t->regs().arg2_signed() & FUTEX_CMD_MASK) << ")"; break; case Arch::waitid: ss << "; unknown waitid(" << HEX((idtype_t)t->regs().arg1()) << ")"; break; case Arch::seccomp: ss << "; unknown seccomp(" << HEX((unsigned int)t->regs().arg1()) << ")"; break; case Arch::madvise: ss << "; unknown madvise(" << (int)t->regs().arg3() << ")"; break; } break; case EIO: switch (t->regs().original_syscallno()) { case Arch::ptrace: ss << "; unsupported ptrace(" << HEX((int)t->regs().arg1()) << " [" << ptrace_req_name((int)t->regs().arg1_signed()) << "])"; break; } break; } return ss.str(); } static bool is_rr_fd_terminal(int fd, const string& pathname) { char buf[PATH_MAX]; if (ttyname_r(fd, buf, sizeof(buf))) { return false; } buf[sizeof(buf) - 1] = 0; return pathname == buf; } static bool is_rr_terminal(const string& pathname) { if (pathname == "/dev/tty") { // XXX the tracee's /dev/tty could refer to a tty other than // the recording tty, in which case output should not be // redirected. That's not too bad, replay will still work, just // with some spurious echoes. return true; } return is_rr_fd_terminal(STDIN_FILENO, pathname) || is_rr_fd_terminal(STDOUT_FILENO, pathname) || is_rr_fd_terminal(STDERR_FILENO, pathname); } static int dev_tty_fd() { static int fd = -1; if (fd < 0) { fd = open("/dev/tty", O_WRONLY); } return fd; } template static void record_iovec_output(RecordTask* t, RecordTask* dest, remote_ptr piov, uint32_t iov_cnt) { // Ignore the syscall result, the kernel may have written more data than that. // See https://bugzilla.kernel.org/show_bug.cgi?id=113541 auto iovs = t->read_mem(piov, iov_cnt); for (auto& iov : iovs) { dest->record_remote_fallible(iov.iov_base, iov.iov_len); } } static void handle_opened_file(RecordTask* t, int fd) { string pathname = t->file_name_of_fd(fd); bool do_write = false; // This must be kept in sync with replay_syscall's handle_opened_files. if (is_rr_terminal(pathname)) { // This will let rr event annotations echo to the terminal. It will also // ensure writes to this fd are not syscall-buffered. t->fd_table()->add_monitor(fd, new StdioMonitor(dev_tty_fd())); pathname = "terminal"; do_write = true; } else if (is_proc_mem_file(pathname.c_str())) { t->fd_table()->add_monitor(fd, new ProcMemMonitor(t, pathname)); do_write = true; } else if (is_proc_fd_dir(pathname.c_str())) { LOG(info) << "Installing proc_fd monitor"; t->fd_table()->add_monitor(fd, new ProcFdDirMonitor(t, pathname)); do_write = true; } if (do_write) { // Write absolute file name t->trace_writer().write_generic(&fd, sizeof(fd)); t->trace_writer().write_generic(pathname.c_str(), pathname.size()); } } template static void check_scm_rights_fd(RecordTask* t, typename Arch::msghdr& msg) { if (msg.msg_controllen < sizeof(typename Arch::cmsghdr)) { return; } auto data = t->read_mem(msg.msg_control.rptr().template cast(), msg.msg_controllen); size_t index = 0; while (true) { auto cmsg = reinterpret_cast(data.data() + index); if (cmsg->cmsg_len < sizeof(*cmsg) || index + Arch::cmsg_align(cmsg->cmsg_len) > data.size()) { break; } if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SCM_RIGHTS) { int* fds = static_cast(Arch::cmsg_data(cmsg)); int fd_count = (cmsg->cmsg_len - sizeof(*cmsg)) / sizeof(int); for (int i = 0; i < fd_count; ++i) { handle_opened_file(t, fds[i]); } } index += Arch::cmsg_align(cmsg->cmsg_len); if (index + sizeof(*cmsg) > data.size()) { break; } } } template static void rec_process_syscall_arch(RecordTask* t, TaskSyscallState& syscall_state) { int syscallno = t->ev().Syscall().number; LOG(debug) << t->tid << ": processing: " << t->ev() << " -- time: " << t->trace_time(); if (remote_ptr rec = t->desched_rec()) { // If the syscallbuf has already been unmapped, there's no need to record // the entry. if (t->syscallbuf_child) { t->record_remote(REMOTE_PTR_FIELD(rec, extra_data), t->read_mem(REMOTE_PTR_FIELD(rec, size)) - sizeof(struct syscallbuf_record)); } return; } if (syscall_state.expect_errno) { if (syscall_state.expect_errno == EINVAL && syscallno == Arch::ioctl && t->regs().syscall_result_signed() == -ENOTTY) { // Unsupported ioctl was called, but is not supported for this device, // so we can safely ignore it. return; } ASSERT(t, t->regs().syscall_result_signed() == -syscall_state.expect_errno) << "Expected " << errno_name(syscall_state.expect_errno) << " for '" << t->syscall_name(syscallno) << "' but got result " << t->regs().syscall_result_signed() << " (errno " << errno_name(-t->regs().syscall_result_signed()) << ")" << extra_expected_errno_info(t, syscall_state); return; } // Here we handle syscalls that need work that can only happen after the // syscall completes --- and that our TaskSyscallState infrastructure can't // handle. switch (syscallno) { case Arch::fork: case Arch::vfork: case Arch::clone: { // On a 3.19.0-39-generic #44-Ubuntu kernel we have observed clone() // clearing the parity flag internally. Registers r = t->regs(); r.set_flags(syscall_state.syscall_entry_registers.flags()); t->set_regs(r); break; } case Arch::execve: process_execve(t, syscall_state); if (t->emulated_ptracer) { if (t->emulated_ptrace_options & PTRACE_O_TRACEEXEC) { t->emulate_ptrace_stop( WaitStatus::for_ptrace_event(PTRACE_EVENT_EXEC)); } else if (!t->emulated_ptrace_seized) { // Inject legacy SIGTRAP-after-exec t->tgkill(SIGTRAP); } } break; case Arch::brk: { remote_ptr old_brk = ceil_page_size(t->vm()->current_brk()); remote_ptr new_brk = ceil_page_size(t->regs().syscall_result()); KernelMapping km; if (old_brk < new_brk) { // Read the kernel's mapping. There doesn't seem to be any other way to // get the correct prot bits for heaps. Usually it's READ|WRITE but // there seem to be exceptions depending on system settings. KernelMapping kernel_info = t->vm()->read_kernel_mapping(t, old_brk); ASSERT(t, km.device() == KernelMapping::NO_DEVICE); ASSERT(t, km.inode() == KernelMapping::NO_INODE); km = kernel_info.subrange(old_brk, new_brk); } else { // Write a dummy KernelMapping that indicates an unmap km = KernelMapping(new_brk, old_brk, string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, 0, 0, 0); } auto d = t->trace_writer().write_mapped_region(t, km, km.fake_stat()); ASSERT(t, d == TraceWriter::DONT_RECORD_IN_TRACE); t->vm()->brk(t, t->regs().syscall_result(), km.prot()); break; } case Arch::mmap: switch (Arch::mmap_semantics) { case Arch::StructArguments: { auto args = t->read_mem( remote_ptr(t->regs().arg1())); process_mmap(t, args.len, args.prot, args.flags, args.fd, args.offset / 4096); break; } case Arch::RegisterArguments: { Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); r.set_arg4(syscall_state.syscall_entry_registers.arg4_signed()); t->set_regs(r); process_mmap(t, (size_t)r.arg2(), (int)r.arg3_signed(), (int)r.arg4_signed(), (int)r.arg5_signed(), ((off_t)r.arg6_signed()) / 4096); break; } } break; case Arch::mmap2: { Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); r.set_arg4(syscall_state.syscall_entry_registers.arg4_signed()); t->set_regs(r); process_mmap(t, (size_t)r.arg2(), (int)r.arg3_signed(), (int)r.arg4_signed(), (int)r.arg5_signed(), (off_t)r.arg6_signed()); break; } case Arch::mremap: process_mremap(t, t->regs().arg1(), t->regs().arg2(), t->regs().arg3()); break; case Arch::shmat: process_shmat(t, (int)t->regs().arg1_signed(), (int)t->regs().arg3_signed(), t->regs().syscall_result()); break; case Arch::ipc: switch ((int)t->regs().arg1_signed()) { case SHMAT: { auto out_ptr = t->read_mem( remote_ptr(t->regs().arg4())); process_shmat(t, (int)t->regs().arg2_signed(), (int)t->regs().arg3_signed(), out_ptr); break; } default: break; } break; case Arch::clock_nanosleep: case Arch::nanosleep: { /* If the sleep completes, the kernel doesn't * write back to the remaining-time * argument. */ if (!(int)t->regs().syscall_result_signed()) { syscall_state.write_back = TaskSyscallState::NO_WRITE_BACK; } break; } case Arch::rt_sigsuspend: case Arch::sigsuspend: t->sigsuspend_blocked_sigs = nullptr; break; case Arch::perf_event_open: if (t->regs().original_syscallno() == Arch::inotify_init) { ASSERT(t, !t->regs().syscall_failed()); int fd = t->regs().syscall_result_signed(); Registers r = t->regs(); r.set_original_syscallno( syscall_state.syscall_entry_registers.original_syscallno()); t->set_regs(r); auto attr = t->read_mem(remote_ptr(t->regs().arg1())); t->fd_table()->add_monitor( fd, new VirtualPerfCounterMonitor( t, t->session().find_task((pid_t)t->regs().arg2_signed()), attr)); } break; case Arch::open: { // Restore the registers that we may have altered. Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); if (r.original_syscallno() == Arch::gettid) { // We hijacked this call to deal with /etc/gcrypt/hwf.deny. char filename[] = "/tmp/rr-gcrypt-hwf-deny-XXXXXX"; { ScopedFd fd(mkstemp(filename)); struct stat dummy; if (!stat("/etc/gcrypt/hwf.deny", &dummy)) { // Copy the contents into our temporary file ScopedFd existing(open("/etc/gcrypt/hwf.deny", O_RDONLY)); copy_file(t, fd, existing); } const char disable_rdrand[] = "\nintel-rdrand\n"; write(fd, disable_rdrand, sizeof(disable_rdrand)); } // Now open the file in the child. int child_fd; { AutoRemoteSyscalls remote(t); AutoRestoreMem child_str(remote, filename); child_fd = remote.infallible_syscall(syscall_number_for_open(remote.arch()), child_str.get(), O_RDONLY); } // Unlink it now that the child has opened it. unlink(filename); // And hand out our fake file. r.set_original_syscallno(Arch::open); r.set_syscall_result(child_fd); } t->set_regs(r); if (!t->regs().syscall_failed()) { handle_opened_file(t, (int)t->regs().syscall_result_signed()); } break; } case Arch::openat: if (!t->regs().syscall_failed()) { handle_opened_file(t, (int)t->regs().syscall_result_signed()); } break; case SYS_rrcall_notify_control_msg: { auto msg = t->read_mem(remote_ptr(t->regs().arg1())); check_scm_rights_fd(t, msg); break; } case Arch::recvmsg: if (!t->regs().syscall_failed()) { auto msg = t->read_mem(remote_ptr(t->regs().arg2())); check_scm_rights_fd(t, msg); } break; case Arch::recvmmsg: if (!t->regs().syscall_failed()) { int msg_count = (int)t->regs().syscall_result_signed(); auto msgs = t->read_mem( remote_ptr(t->regs().arg2()), msg_count); for (auto& m : msgs) { check_scm_rights_fd(t, m.msg_hdr); } } break; case Arch::setsockopt: { // restore possibly-modified regs Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); t->set_regs(r); break; } case Arch::socketcall: { // restore possibly-modified regs Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); t->set_regs(r); if (!t->regs().syscall_failed()) { switch ((int)t->regs().arg1_signed()) { case SYS_RECVMSG: { auto args = t->read_mem( remote_ptr(t->regs().arg2())); auto msg = t->read_mem(args.msg.rptr()); check_scm_rights_fd(t, msg); break; } case SYS_RECVMMSG: { auto args = t->read_mem( remote_ptr(t->regs().arg2())); int msg_count = (int)t->regs().syscall_result_signed(); auto msgs = t->read_mem(args.msgvec.rptr(), msg_count); for (auto& m : msgs) { check_scm_rights_fd(t, m.msg_hdr); } break; } } } break; } case Arch::process_vm_readv: record_iovec_output(t, t, t->regs().arg2(), t->regs().arg3()); break; case Arch::process_vm_writev: { RecordTask* dest = t->session().find_task(t->regs().arg1()); if (dest) { record_iovec_output(t, dest, t->regs().arg4(), t->regs().arg5()); } break; } case Arch::close: case Arch::dup2: case Arch::dup3: case Arch::fcntl: case Arch::fcntl64: case Arch::futex: case Arch::ioctl: case Arch::madvise: case Arch::pread64: case Arch::preadv: case Arch::ptrace: case Arch::read: case Arch::readv: case Arch::sched_setaffinity: case Arch::mprotect: { // Restore the registers that we may have altered. Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); r.set_arg2(syscall_state.syscall_entry_registers.arg2()); r.set_arg3(syscall_state.syscall_entry_registers.arg3()); t->set_regs(r); break; } case Arch::getdents: case Arch::getdents64: { Registers r = t->regs(); int fd = r.arg1(); t->fd_table()->filter_getdents(fd, t); break; } case Arch::waitpid: case Arch::wait4: case Arch::waitid: { t->in_wait_type = WAIT_TYPE_NONE; // Restore possibly-modified registers Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); r.set_arg2(syscall_state.syscall_entry_registers.arg2()); r.set_arg3(syscall_state.syscall_entry_registers.arg3()); r.set_arg4(syscall_state.syscall_entry_registers.arg4()); r.set_original_syscallno( syscall_state.syscall_entry_registers.original_syscallno()); t->set_regs(r); RecordTask* tracee = syscall_state.emulate_wait_for_child; if (tracee) { // Finish emulation of ptrace result or stop-signal Registers r = t->regs(); r.set_syscall_result(tracee->tid); t->set_regs(r); if (syscallno == Arch::waitid) { remote_ptr sip = r.arg3(); if (!sip.is_null()) { typename Arch::siginfo_t si; memset(&si, 0, sizeof(si)); si.si_signo = SIGCHLD; tracee->set_siginfo_for_waited_task(&si); t->write_mem(sip, si); } } else { remote_ptr statusp = r.arg2(); if (!statusp.is_null()) { t->write_mem(statusp, tracee->emulated_stop_code.get()); } } if (syscallno == Arch::waitid && (r.arg4() & WNOWAIT)) { // Leave the child in a waitable state } else { if (tracee->emulated_stop_code.exit_code() >= 0) { // If we stopped the tracee to deliver this notification, // now allow it to continue to exit properly and notify its // real parent. ASSERT(t, tracee->ev().is_syscall_event() && PROCESSING_SYSCALL == tracee->ev().Syscall().state && tracee->stable_exit); // Continue the task since we didn't in enter_syscall tracee->resume_execution(RESUME_SYSCALL, RESUME_NONBLOCKING, RESUME_NO_TICKS); } if (tracee->emulated_ptracer == t) { tracee->emulated_stop_pending = false; } else { for (Task* thread : tracee->task_group()->task_set()) { auto rt = static_cast(thread); rt->emulated_stop_pending = false; } } } } break; } case Arch::prctl: { // Restore arg1 in case we modified it to disable the syscall Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); t->set_regs(r); switch ((int)t->regs().arg1()) { case PR_SET_SECCOMP: if (t->session().done_initial_exec()) { t->session() .as_record() ->seccomp_filter_rewriter() .install_patched_seccomp_filter(t); } break; } break; } case Arch::quotactl: switch (t->regs().arg1() >> SUBCMDSHIFT) { case Q_GETQUOTA: case Q_GETINFO: case Q_GETFMT: case Q_SETQUOTA: case Q_QUOTAON: case Q_QUOTAOFF: case Q_SETINFO: case Q_SYNC: break; default: { auto ret = t->regs().syscall_result_signed(); ASSERT(t, ret == -ENOENT || ret == -ENODEV || ret == -ENOTBLK || ret == -EINVAL) << " unknown quotactl(" << HEX(t->regs().arg1() >> SUBCMDSHIFT) << ")"; break; } } break; case Arch::seccomp: { // Restore arg1 in case we modified it to disable the syscall Registers r = t->regs(); r.set_arg1(syscall_state.syscall_entry_registers.arg1()); t->set_regs(r); if (t->regs().arg1() == SECCOMP_SET_MODE_FILTER) { ASSERT(t, t->session().done_initial_exec()) << "no seccomp calls during spawn"; t->session() .as_record() ->seccomp_filter_rewriter() .install_patched_seccomp_filter(t); } break; } case SYS_rrcall_init_buffers: t->init_buffers(); break; case SYS_rrcall_init_preload: { t->at_preload_init(); break; } case SYS_rrcall_notify_syscall_hook_exit: { remote_ptr child_addr = REMOTE_PTR_FIELD(t->syscallbuf_child, notify_on_syscall_hook_exit); t->write_mem(child_addr, (uint8_t)0); t->record_remote(child_addr); struct rrcall_params { typename Arch::unsigned_word result; typename Arch::unsigned_word original_syscallno; }; Registers r = t->regs(); auto params_ptr = r.sp() + sizeof(typename Arch::unsigned_word); auto params = t->read_mem(params_ptr.cast()); r.set_syscall_result((uintptr_t)params.result); r.set_original_syscallno((intptr_t)params.original_syscallno); t->set_regs(r); break; } } } static void rec_process_syscall_internal(RecordTask* t, TaskSyscallState& syscall_state) { RR_ARCH_FUNCTION(rec_process_syscall_arch, t->arch(), t, syscall_state) } void rec_process_syscall(RecordTask* t) { auto& syscall_state = *syscall_state_property.get(*t); rec_process_syscall_internal(t, syscall_state); syscall_state.process_syscall_results(); t->on_syscall_exit(t->ev().Syscall().number, t->regs()); syscall_state_property.remove(*t); MonitoredSharedMemory::check_all(t); } } // namespace rr rr-4.4.0/src/record_syscall.h000066400000000000000000000013671277367620400161370ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_PROCESS_SYSCALL_H_ #define RR_PROCESS_SYSCALL_H_ #include "util.h" namespace rr { class RecordTask; /** * Prepare |t| to enter its current syscall event. Return ALLOW_SWITCH if * a context-switch is allowed for |t|, PREVENT_SWITCH if not. */ Switchable rec_prepare_syscall(RecordTask* t); /** * Prepare |t| for its current syscall event to be interrupted and * possibly restarted. */ void rec_prepare_restart_syscall(RecordTask* t); /** * Restore any argument registers fudged for |t|'s current syscall and * store any nondeterministic outparam data. */ void rec_process_syscall(RecordTask* t); } // namespace rr #endif /* RR_PROCESS_SYSCALL_H_ */ rr-4.4.0/src/remote_code_ptr.cc000066400000000000000000000004351277367620400164320ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "remote_code_ptr.h" using namespace std; namespace rr { ostream& operator<<(ostream& stream, remote_code_ptr p) { stream << (void*)p.register_value(); return stream; } } // namespace rr rr-4.4.0/src/remote_code_ptr.h000066400000000000000000000047171277367620400163030ustar00rootroot00000000000000#ifndef RR_REMOTE_CODE_PTR_H_ #define RR_REMOTE_CODE_PTR_H_ #include #include #include "kernel_abi.h" namespace rr { /* * A pointer to code in the tracee address space. Convertible to a * remote_ptr. */ class remote_code_ptr { public: remote_code_ptr() : ptr(0) {} remote_code_ptr(uintptr_t ptr) : ptr(ptr) {} remote_code_ptr(std::nullptr_t) : ptr(0) {} bool operator==(const remote_code_ptr& other) const { return ptr == other.ptr; } bool operator!=(const remote_code_ptr& other) const { return ptr != other.ptr; } // XXXkhuey this will have to get smarter once we have ARM. remote_code_ptr operator+(intptr_t delta) const { return remote_code_ptr(ptr + delta); } remote_code_ptr operator-(intptr_t delta) const { return remote_code_ptr(ptr - delta); } intptr_t operator-(remote_code_ptr other) const { return ptr - other.ptr; } // XXXkhuey this is somewhat arbitrary bool operator<(const remote_code_ptr& other) const { return ptr < other.ptr; } remote_code_ptr decrement_by_syscall_insn_length(SupportedArch arch) const { return remote_code_ptr(ptr - rr::syscall_instruction_length(arch)); } remote_code_ptr increment_by_syscall_insn_length(SupportedArch arch) const { return remote_code_ptr(ptr + rr::syscall_instruction_length(arch)); } remote_code_ptr decrement_by_bkpt_insn_length(SupportedArch) const { return remote_code_ptr(ptr - 1); } remote_code_ptr increment_by_bkpt_insn_length(SupportedArch) const { return remote_code_ptr(ptr + 1); } template remote_ptr to_data_ptr() const { return remote_ptr(to_data_ptr_value()); } // Return the pointer in a form suitable for storing in a register. Only // intended for use by Registers and the operator << uintptr_t register_value() const { return ptr; } bool is_null() const { return !ptr; } explicit operator bool() const { return ptr != 0; } private: // Return the integer value for this pointer viewed as a data pointer. // A no-op on Intel architectures, will mask off the thumb bit on ARM. uintptr_t to_data_ptr_value() const { return ptr; } uintptr_t ptr; }; std::ostream& operator<<(std::ostream& stream, remote_code_ptr p); } // namespace rr namespace std { template <> struct hash { size_t operator()(const rr::remote_code_ptr& ptr) const { return hash()(ptr.register_value()); } }; } // namespace std #endif // RR_REMOTE_CODE_PTR_H_ rr-4.4.0/src/remote_ptr.h000066400000000000000000000074401277367620400153050ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REMOTE_PTR_H_ #define RR_REMOTE_PTR_H_ #include #include namespace rr { /** * Number of bytes to use as the element size when doing pointer arithmetic * on this type. We specialize 'void' to use 1 byte to make a lot of our * calculations easier. */ template size_t pointer_arithmetic_size() { return sizeof(T); } template <> inline size_t pointer_arithmetic_size() { return 1; } /** * A pointer to data in some tracee address space. * This lets us distinguish between real, usable pointers in rr's address space * and pointers that only make sense in a tracee address space. */ template class remote_ptr { public: remote_ptr() : ptr(0) {} remote_ptr(uintptr_t ptr) : ptr(ptr) {} remote_ptr(std::nullptr_t) : ptr(0) {} template remote_ptr(remote_ptr p) : ptr(p.as_int()) { consume_dummy(static_cast::type*>(nullptr)); } uintptr_t as_int() const { return ptr; } remote_ptr operator+(intptr_t delta) const { return remote_ptr(ptr + delta * arith_size()); } remote_ptr operator-(intptr_t delta) const { return remote_ptr(ptr - delta * arith_size()); } remote_ptr& operator+=(intptr_t delta) { ptr += delta * arith_size(); return *this; } remote_ptr& operator-=(intptr_t delta) { ptr -= delta * arith_size(); return *this; } intptr_t operator-(remote_ptr other) const { return (ptr - other.ptr) / arith_size(); } remote_ptr& operator++() { ptr += arith_size(); return *this; } remote_ptr operator++(int) { uintptr_t p = ptr; ptr += arith_size(); return p; } remote_ptr& operator--() { ptr -= arith_size(); return *this; } remote_ptr operator--(int) { uintptr_t p = ptr; ptr -= arith_size(); return p; } template remote_ptr cast() const { return remote_ptr(ptr); } explicit operator bool() const { return ptr != 0; } bool operator!() const { return !ptr; } bool operator<(const remote_ptr& other) const { return ptr < other.ptr; } bool operator<=(const remote_ptr& other) const { return ptr <= other.ptr; } bool operator==(const remote_ptr& other) const { return ptr == other.ptr; } bool operator!=(const remote_ptr& other) const { return ptr != other.ptr; } bool operator>(const remote_ptr& other) const { return ptr > other.ptr; } bool operator>=(const remote_ptr& other) const { return ptr >= other.ptr; } bool is_null() const { return !ptr; } template remote_ptr::type> field(U*, uintptr_t offset) const { return remote_ptr::type>(ptr + offset); } T* dummy() { return nullptr; } const T* dummy() const { return nullptr; } size_t referent_size() { return sizeof(T); } private: static void consume_dummy(T*) {} static size_t arith_size() { return pointer_arithmetic_size(); } uintptr_t ptr; }; /** * returns a remote_ptr pointing to field f of the struct pointed to by * remote_ptr p */ #define REMOTE_PTR_FIELD(p, f) \ ((p).field( \ ((typename std::remove_referencef)>::type*)nullptr), \ offsetof(typename std::remove_reference::type, \ f))) template std::ostream& operator<<(std::ostream& stream, remote_ptr p) { stream << (void*)p.as_int(); return stream; } } // namespace rr #endif /* RR_REMOTE_PTR_H_ */ rr-4.4.0/src/replay_syscall.cc000066400000000000000000001352331277367620400163130ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "replay_syscall.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "preload/preload_interface.h" #include "AutoRemoteSyscalls.h" #include "EmuFs.h" #include "MmappedFileMonitor.h" #include "ProcFdDirMonitor.h" #include "ProcMemMonitor.h" #include "ReplaySession.h" #include "ReplayTask.h" #include "StdioMonitor.h" #include "TaskGroup.h" #include "TraceStream.h" #include "VirtualPerfCounterMonitor.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" #include "util.h" /* Uncomment this to check syscall names and numbers defined in syscalls.py against the definitions in unistd.h. This may cause the build to fail if unistd.h is slightly out of date, so it's not turned on by default. */ //#define CHECK_SYSCALL_NUMBERS using namespace std; namespace rr { // XXX: x86-only currently. #ifdef CHECK_SYSCALL_NUMBERS // Hack because our 'break' syscall is called '_break' #define SYS__break SYS_break #include "CheckSyscallNumbers.generated" #endif // CHECK_SYSCALL_NUMBERS static string maybe_dump_written_string(ReplayTask* t) { if (!is_write_syscall(t->regs().original_syscallno(), t->arch())) { return ""; } size_t len = min(1000, t->regs().arg3()); vector buf; buf.resize(len + 1); buf.resize(t->read_bytes_fallible(t->regs().arg2(), len, buf.data()) + 1); buf[buf.size() - 1] = 0; return " \"" + string(buf.data()) + "\""; } /** * Proceeds until the next system call, which is being executed. */ static void __ptrace_cont(ReplayTask* t, ResumeRequest resume_how, int expect_syscallno, int expect_syscallno2 = -1, pid_t new_tid = -1) { do { t->resume_execution(resume_how, RESUME_NONBLOCKING, RESUME_NO_TICKS); if (new_tid > 0) { // Set new tid before we wait, so we wait for the right task. // XXX maybe a signal could arrive and be delivered to the task before // its tid changes, so we hang? Hope not! // Update the serial as if this task was really created by cloning the old // task. t->set_real_tid_and_update_serial(new_tid); } t->wait(); } while (ReplaySession::is_ignored_signal(t->status().stop_sig())); ASSERT(t, !t->stop_sig()) << "Expected no pending signal, but got " << t->stop_sig(); /* check if we are synchronized with the trace -- should never fail */ int current_syscall = t->regs().original_syscallno(); ASSERT(t, current_syscall == expect_syscallno || current_syscall == expect_syscallno2) << "Should be at " << t->syscall_name(expect_syscallno) << ", but instead at " << t->syscall_name(current_syscall) << maybe_dump_written_string(t); } static void init_scratch_memory(ReplayTask* t, const KernelMapping& km, const TraceReader::MappedData& data) { ASSERT(t, data.source == TraceReader::SOURCE_ZERO); t->scratch_ptr = km.start(); t->scratch_size = km.size(); size_t sz = t->scratch_size; // Make the scratch buffer read/write during replay so that // preload's sys_read can use it to buffer cloned data. ASSERT(t, (km.prot() & (PROT_READ | PROT_WRITE)) == (PROT_READ | PROT_WRITE)); ASSERT(t, (km.flags() & (MAP_PRIVATE | MAP_ANONYMOUS)) == (MAP_PRIVATE | MAP_ANONYMOUS)); AutoRemoteSyscalls remote(t); remote.infallible_mmap_syscall(t->scratch_ptr, sz, km.prot(), km.flags() | MAP_FIXED, -1, 0); t->vm()->map(t, t->scratch_ptr, sz, km.prot(), km.flags(), 0, string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, nullptr, &km); } /** * If scratch data was incidentally recorded for the current desched'd * but write-only syscall, then do a no-op restore of that saved data * to keep the trace in sync. * * Syscalls like |write()| that may-block and are wrapped in the * preload library can be desched'd. When this happens, we save the * syscall record's "extra data" as if it were normal scratch space, * since it's used that way in effect. But syscalls like |write()| * that don't actually use scratch space don't ever try to restore * saved scratch memory during replay. So, this helper can be used * for that class of syscalls. */ static void maybe_noop_restore_syscallbuf_scratch(ReplayTask* t) { if (t->is_in_untraced_syscall()) { LOG(debug) << " noop-restoring scratch for write-only desched'd " << t->syscall_name(t->regs().original_syscallno()); t->set_data_from_trace(); } } static TraceTaskEvent read_task_trace_event(ReplayTask* t, TraceTaskEvent::Type type) { TraceTaskEvent tte; while (true) { ASSERT(t, t->trace_reader().good()) << "Unable to find TraceTaskEvent; " "trace is corrupt (did you kill -9 " "rr?)"; tte = t->trace_reader().read_task_event(); if (tte.type() == type) { break; } } return tte; } template static void prepare_clone(ReplayTask* t) { const TraceFrame& trace_frame = t->current_trace_frame(); if (trace_frame.event().Syscall().failed_during_preparation) { /* creation failed, nothing special to do */ return; } Registers r = t->regs(); int sys = r.original_syscallno(); int flags = 0; if (Arch::clone == sys) { // If we allow CLONE_UNTRACED then the child would escape from rr control // and we can't allow that. // Block CLONE_CHILD_CLEARTID because we'll emulate that ourselves. // Block CLONE_VFORK for the reasons below. // Block CLONE_NEW* from replay, any effects it had were dealt with during // recording. uintptr_t disallowed_clone_flags = CLONE_UNTRACED | CLONE_CHILD_CLEARTID | CLONE_VFORK | CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWUSER | CLONE_NEWUTS | CLONE_NEWCGROUP; flags = r.arg1() & ~disallowed_clone_flags; r.set_arg1(flags); } else if (Arch::vfork == sys) { // We can't perform a real vfork, because the kernel won't let the vfork // parent return from the syscall until the vfork child has execed or // exited, and it is an invariant of replay that tasks are not in the kernel // except when we need them to execute a specific syscall on rr's behalf. // So instead we do a regular fork but use the CLONE_VM flag to share // address spaces between the parent and child. That's just like a vfork // except the parent is immediately runnable. This is no problem for replay // since we follow the recorded schedule in which the vfork parent did not // run until the vfork child exited. sys = Arch::clone; flags = CLONE_VM; r.set_arg1(flags); r.set_arg2(0); } r.set_syscallno(sys); r.set_ip(r.ip().decrement_by_syscall_insn_length(r.arch())); t->set_regs(r); Registers entry_regs = r; // Run; we will be interrupted by PTRACE_EVENT_CLONE/FORK/VFORK. __ptrace_cont(t, RESUME_CONT, sys); while (!t->clone_syscall_is_complete()) { // clone() calls sometimes fail with -EAGAIN due to load issues or // whatever. We need to retry the system call until it succeeds. Reset // state to try the syscall again. ASSERT(t, t->regs().syscall_result_signed() == -EAGAIN); t->set_regs(entry_regs); __ptrace_cont(t, RESUME_CONT, sys); } // Get out of the syscall __ptrace_cont(t, RESUME_SYSCALL, sys); ASSERT(t, !t->ptrace_event()) << "Unexpected ptrace event while waiting for syscall exit; got " << ptrace_event_name(t->ptrace_event()); r = t->regs(); // Restore the saved flags, to hide the fact that we may have // masked out CLONE_UNTRACED/CLONE_CHILD_CLEARTID or changed from vfork to // clone. r.set_arg1(trace_frame.regs().arg1()); r.set_arg2(trace_frame.regs().arg2()); // Pretend we're still in the system call r.set_syscall_result(-ENOSYS); r.set_original_syscallno(trace_frame.regs().original_syscallno()); t->set_regs(r); // Get out of the kernel t->finish_emulated_syscall(); // Dig the recorded tid out out of the trace. The tid value returned in // the recorded registers could be in a different pid namespace from rr's, // so we can't use it directly. TraceTaskEvent tte = read_task_trace_event(t, TraceTaskEvent::CLONE); ASSERT(t, tte.parent_tid() == t->rec_tid); long rec_tid = tte.tid(); pid_t new_tid = t->get_ptrace_eventmsg(); CloneParameters params; if (Arch::clone == t->regs().original_syscallno()) { params = extract_clone_parameters(t); } ReplayTask* new_task = static_cast( t->session().clone(t, clone_flags_to_task_flags(flags), params.stack, params.tls, params.ctid, new_tid, rec_tid)); if (Arch::clone == t->regs().original_syscallno()) { /* FIXME: what if registers are non-null and contain an * invalid address? */ t->set_data_from_trace(); if (Arch::clone_tls_type == Arch::UserDescPointer) { t->set_data_from_trace(); new_task->set_data_from_trace(); } else { assert(Arch::clone_tls_type == Arch::PthreadStructurePointer); } new_task->set_data_from_trace(); new_task->set_data_from_trace(); } // Fix registers in new task Registers new_r = new_task->regs(); new_r.set_original_syscallno(trace_frame.regs().original_syscallno()); new_r.set_arg1(trace_frame.regs().arg1()); new_r.set_arg2(trace_frame.regs().arg2()); new_task->emulate_syscall_entry(new_r); if (Arch::clone != t->regs().original_syscallno() || !(CLONE_VM & r.arg1())) { // It's hard to imagine a scenario in which it would // be useful to inherit breakpoints (along with their // refcounts) across a non-VM-sharing clone, but for // now we never want to do this. new_task->vm()->remove_all_breakpoints(); new_task->vm()->remove_all_watchpoints(); AutoRemoteSyscalls remote(new_task); for (auto m : t->vm()->maps()) { // Recreate any tracee-shared mappings if (m.local_addr && !(m.flags & AddressSpace::Mapping::IS_SYSCALLBUF)) { memcpy(Session::recreate_shared_mmap(remote, m).local_addr, m.local_addr, m.map.size()); } } } TraceReader::MappedData data; KernelMapping km = t->trace_reader().read_mapped_region(&data); init_scratch_memory(new_task, km, data); new_task->vm()->after_clone(); } static string find_exec_stub(SupportedArch arch) { string exe_path = exe_directory() + "../bin/"; if (arch == x86 && NativeArch::arch() == x86_64) { exe_path += "rr_exec_stub_32"; } else { exe_path += "rr_exec_stub"; } return exe_path; } static void finish_direct_mmap(ReplayTask* t, AutoRemoteSyscalls& remote, remote_ptr rec_addr, size_t length, int prot, int flags, const string& backing_file_name, int backing_file_open_flags, off64_t backing_offset_pages, struct stat& real_file, string& real_file_name) { int fd; LOG(debug) << "directly mmap'ing " << length << " bytes of " << backing_file_name << " at page offset " << HEX(backing_offset_pages); ASSERT(t, !(flags & MAP_GROWSDOWN)); /* Open in the tracee the file that was mapped during * recording. */ { AutoRestoreMem child_str(remote, backing_file_name.c_str()); fd = remote.infallible_syscall(syscall_number_for_open(remote.arch()), child_str.get().as_int(), backing_file_open_flags); } /* And mmap that file. */ remote.infallible_mmap_syscall(rec_addr, length, /* (We let SHARED|WRITEABLE * mappings go through while * they're not handled properly, * but we shouldn't do that.) */ prot, flags | MAP_FIXED, fd, backing_offset_pages); // While it's open, grab the link reference. real_file = t->stat_fd(fd); real_file_name = t->file_name_of_fd(fd); /* Don't leak the tmp fd. The mmap doesn't need the fd to * stay open. */ remote.infallible_syscall(syscall_number_for_close(remote.arch()), fd); } static void restore_mapped_region(ReplayTask* t, AutoRemoteSyscalls& remote, const KernelMapping& km, const TraceReader::MappedData& data) { ASSERT(t, km.flags() & MAP_PRIVATE) << "Shared mappings after exec not supported"; string real_file_name; dev_t device = KernelMapping::NO_DEVICE; ino_t inode = KernelMapping::NO_INODE; int flags = km.flags(); uint64_t offset_bytes = 0; switch (data.source) { case TraceReader::SOURCE_FILE: { struct stat real_file; offset_bytes = km.file_offset_bytes(); // Private mapping, so O_RDONLY is always OK. finish_direct_mmap(t, remote, km.start(), km.size(), km.prot(), km.flags(), data.file_name, O_RDONLY, data.data_offset_bytes / page_size(), real_file, real_file_name); device = real_file.st_dev; inode = real_file.st_ino; break; } case TraceReader::SOURCE_TRACE: case TraceReader::SOURCE_ZERO: flags |= MAP_ANONYMOUS; remote.infallible_mmap_syscall(km.start(), km.size(), km.prot(), (flags & ~MAP_GROWSDOWN) | MAP_FIXED, -1, 0); // The data, if any, will be written back by // ReplayTask::apply_all_data_records_from_trace break; default: ASSERT(t, false) << "Unknown data source"; break; } t->vm()->map(t, km.start(), km.size(), km.prot(), flags, offset_bytes, real_file_name, device, inode, nullptr, &km); } static void process_execve(ReplayTask* t, const TraceFrame& trace_frame, ReplayTraceStep* step) { step->action = TSTEP_RETIRE; /* First, exec a stub program */ string stub_filename = find_exec_stub(trace_frame.regs().arch()); // Setup memory and registers for the execve call. We may not have to save // the old values since they're going to be wiped out by execve. We can // determine this by checking if this address space has any tasks with a // different tgid. Task* memory_task = t; for (auto task : t->vm()->task_set()) { if (task->tgid() != t->tgid()) { memory_task = task; break; } } // Old data if required std::vector saved_data; // Set up everything Registers regs = t->regs(); regs.set_ip(t->vm()->traced_syscall_ip()); remote_ptr remote_mem = floor_page_size(regs.sp()); // Determine how much memory we'll need size_t filename_size = stub_filename.size() + 1; size_t total_size = filename_size + sizeof(size_t); if (memory_task != t) { saved_data = t->read_mem(remote_mem.cast(), total_size); } // We write a zero word in the host size, not t's size, but that's OK, // since the host size must be bigger than t's size. // We pass no argv or envp, so exec params 2 and 3 just point to the NULL // word. t->write_mem(remote_mem.cast(), size_t(0)); regs.set_arg2(remote_mem); regs.set_arg3(remote_mem); remote_ptr filename_addr = remote_mem + sizeof(size_t); t->write_bytes_helper(filename_addr, filename_size, stub_filename.c_str()); regs.set_arg1(filename_addr); /* The original_syscallno is execve in the old architecture. The kernel does * not update the original_syscallno when the architecture changes across * an exec. */ int expect_syscallno = syscall_number_for_execve(t->arch()); regs.set_syscallno(expect_syscallno); t->set_regs(regs); LOG(debug) << "Beginning execve"; /* Enter our execve syscall. */ __ptrace_cont(t, RESUME_SYSCALL, expect_syscallno); ASSERT(t, !t->stop_sig()) << "Stub exec failed on entry"; /* Complete the syscall. The tid of the task will be the thread-group-leader * tid, no matter what tid it was before. */ pid_t tgid = t->task_group()->real_tgid; __ptrace_cont(t, RESUME_SYSCALL, expect_syscallno, syscall_number_for_execve(trace_frame.regs().arch()), tgid == t->tid ? -1 : tgid); if (t->regs().syscall_result()) { errno = -t->regs().syscall_result(); if (access(stub_filename.c_str(), 0) == -1 && errno == ENOENT && trace_frame.regs().arch() == x86) { FATAL() << "Cannot find exec stub " << stub_filename << " to replay this 32-bit process; you probably built rr with " "disable32bit"; } ASSERT(t, false) << "Exec of stub " << stub_filename << " failed"; } vector kms; vector datas; ssize_t exe_km = -1; while (true) { TraceReader::MappedData data; bool found; KernelMapping km = t->trace_reader().read_mapped_region(&data, &found); if (!found) { break; } if (km.start() == AddressSpace::rr_page_start() || km.start() == AddressSpace::preload_thread_locals_start()) { // Skip rr-page mapping record, that gets mapped automatically continue; } const string& file_name = km.fsname(); if ((km.prot() & PROT_EXEC) && file_name.size() > 0 && file_name[0] == '/' && file_name.rfind(".so") != file_name.size() - 3) { exe_km = kms.size(); } kms.push_back(km); datas.push_back(data); } ASSERT(t, exe_km >= 0) << "Can't find exe mapping"; ASSERT(t, kms[0].is_stack()) << "Can't find stack"; TraceTaskEvent tte = read_task_trace_event(t, TraceTaskEvent::EXEC); // The exe name we pass in here will be passed to gdb. Pass the backing file // name if there is one, otherwise pass the original file name (which means // we declined to copy it to the trace file during recording for whatever // reason). const string& exe_name = datas[exe_km].file_name.empty() ? kms[exe_km].fsname() : datas[exe_km].file_name; t->post_exec_syscall(exe_name, tte); { // Tell AutoRemoteSyscalls that we don't need memory parameters. This will // stop it from having trouble if our current stack pointer (the value // from the replay) isn't in the [stack] mapping created for our stub. AutoRemoteSyscalls remote(t, AutoRemoteSyscalls::DISABLE_MEMORY_PARAMS); // Now fix up the address space. First unmap all the mappings other than // our rr page. vector unmaps; for (auto m : t->vm()->maps()) { // Do not attempt to unmap [vsyscall] --- it doesn't work. if (m.map.start() != AddressSpace::rr_page_start() && m.map.start() != AddressSpace::preload_thread_locals_start() && !m.map.is_vsyscall()) { unmaps.push_back(m.map); } } for (auto& m : unmaps) { remote.infallible_syscall(syscall_number_for_munmap(t->arch()), m.start(), m.size()); t->vm()->unmap(t, m.start(), m.size()); } // We will have unmapped the stack memory that |remote| would have used for // memory parameters. Fortunately process_mapped_region below doesn't // need any memory parameters for its remote syscalls. // Process the [stack] mapping. restore_mapped_region(t, remote, kms[0], datas[0]); } const string& recorded_exe_name = kms[exe_km].fsname(); { // Now that [stack] is mapped, reinitialize AutoRemoteSyscalls with // memory parameters enabled. AutoRemoteSyscalls remote(t); // Now map in all the mappings that we recorded from the real exec. for (ssize_t i = 1; i < ssize_t(kms.size()) - 1; ++i) { restore_mapped_region(t, remote, kms[i], datas[i]); } size_t index = recorded_exe_name.rfind('/'); string name = string("rr:") + recorded_exe_name.substr(index == string::npos ? 0 : index + 1); AutoRestoreMem mem(remote, name.c_str()); remote.infallible_syscall(syscall_number_for_prctl(t->arch()), PR_SET_NAME, mem.get()); } init_scratch_memory(t, kms.back(), datas.back()); // Apply final data records --- fixing up the last page in each data segment // for zeroing applied by the kernel, and applying monkeypatches. t->apply_all_data_records_from_trace(); // Now it's safe to save the auxv data t->vm()->save_auxv(t); // Restore any memory if required. We need to do this through memory_task, // since the new task is now on the new address space. if (memory_task != t) { memory_task->write_mem(remote_mem.cast(), saved_data.data(), saved_data.size()); } // Notify outer rr if there is one syscall(SYS_rrcall_reload_auxv, t->tid); } static void process_brk(ReplayTask* t) { TraceReader::MappedData data; KernelMapping km = t->trace_reader().read_mapped_region(&data); // Zero flags means it's an an unmap, or no change. if (km.flags()) { AutoRemoteSyscalls remote(t); ASSERT(t, data.source == TraceReader::SOURCE_ZERO); remote.infallible_mmap_syscall(km.start(), km.size(), km.prot(), MAP_ANONYMOUS | MAP_FIXED | km.flags(), -1, 0); t->vm()->map(t, km.start(), km.size(), km.prot(), MAP_ANONYMOUS | km.flags(), 0, "[heap]", KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, nullptr, &km); } else if (km.size() > 0) { AutoRemoteSyscalls remote(t); remote.infallible_syscall(syscall_number_for_munmap(t->arch()), km.start(), km.size()); t->vm()->unmap(t, km.start(), km.size()); } } /** * Pass NOTE_TASK_MAP to update cached mmap data. If the data * need to be manually updated, pass |DONT_NOTE_TASK_MAP| and update * it manually. */ enum NoteTaskMap { DONT_NOTE_TASK_MAP = 0, NOTE_TASK_MAP }; static void finish_anonymous_mmap(ReplayTask* t, AutoRemoteSyscalls& remote, remote_ptr rec_addr, size_t length, int prot, int flags, NoteTaskMap note_task_map) { string file_name; dev_t device = KernelMapping::NO_DEVICE; ino_t inode = KernelMapping::NO_INODE; TraceReader::MappedData data; KernelMapping recorded_km = t->trace_reader().read_mapped_region(&data); EmuFile::shr_ptr emu_file; if (flags & MAP_PRIVATE) { remote.infallible_mmap_syscall(rec_addr, length, prot, // Tell the kernel to take |rec_addr| // seriously. (flags & ~MAP_GROWSDOWN) | MAP_FIXED, -1, 0); } else { ASSERT(remote.task(), data.source == TraceReader::SOURCE_ZERO); emu_file = t->session().emufs().get_or_create(recorded_km, length); struct stat real_file; // Emufs file, so open it read-write in case we need to write to it // through the task's memfd. finish_direct_mmap(t, remote, rec_addr, length, prot, flags & ~MAP_ANONYMOUS, emu_file->proc_path(), O_RDWR, 0, real_file, file_name); device = real_file.st_dev; inode = real_file.st_ino; } if (note_task_map) { remote.task()->vm()->map(t, rec_addr, length, prot, flags, 0, file_name, device, inode, nullptr, &recorded_km, emu_file); } } /* Ensure that accesses to the memory region given by start/length cause a SIGBUS, as for accesses beyond the end of an mmaped file. */ static void create_sigbus_region(AutoRemoteSyscalls& remote, int prot, remote_ptr start, size_t length, const KernelMapping& km) { if (length == 0) { return; } /* Open an empty file in the tracee */ char filename[] = PREFIX_FOR_EMPTY_MMAPED_REGIONS "XXXXXX"; { /* Close our side immediately */ ScopedFd fd(mkstemp(filename)); } int child_fd; { AutoRestoreMem child_str(remote, filename); child_fd = remote.infallible_syscall(syscall_number_for_open(remote.arch()), child_str.get(), O_RDONLY); } /* Unlink it now that the child has opened it */ unlink(filename); struct stat fstat = remote.task()->stat_fd(child_fd); string file_name = remote.task()->file_name_of_fd(child_fd); /* mmap it in the tracee. We need to set the correct 'prot' flags so that the correct signal is generated on a memory access (SEGV if 'prot' doesn't allow the access, BUS if 'prot' does allow the access). */ remote.infallible_mmap_syscall(start, length, prot, MAP_FIXED | MAP_PRIVATE, child_fd, 0); /* Don't leak the tmp fd. The mmap doesn't need the fd to * stay open. */ remote.infallible_syscall(syscall_number_for_close(remote.arch()), child_fd); KernelMapping km_slice = km.subrange(start, start + length); remote.task()->vm()->map(remote.task(), start, length, prot, MAP_FIXED | MAP_PRIVATE, 0, file_name, fstat.st_dev, fstat.st_ino, nullptr, &km_slice); } static void finish_private_mmap(ReplayTask* t, AutoRemoteSyscalls& remote, remote_ptr rec_addr, size_t length, int prot, int flags, off64_t offset_pages, const KernelMapping& km) { LOG(debug) << " finishing private mmap of " << km.fsname(); remote.infallible_mmap_syscall( rec_addr, length, prot, // Tell the kernel to take |rec_addr| seriously. (flags & ~MAP_GROWSDOWN) | MAP_FIXED | MAP_ANONYMOUS, -1, 0); /* Restore the map region we copied. */ ssize_t data_size = t->set_data_from_trace(); /* Ensure pages past the end of the file fault on access */ size_t data_pages = ceil_page_size(data_size); size_t mapped_pages = ceil_page_size(length); t->vm()->map(t, rec_addr, length, prot, flags | MAP_ANONYMOUS, page_size() * offset_pages, string(), KernelMapping::NO_DEVICE, KernelMapping::NO_INODE, nullptr, &km); create_sigbus_region(remote, prot, rec_addr + data_pages, mapped_pages - data_pages, km); } static void finish_shared_mmap(ReplayTask* t, AutoRemoteSyscalls& remote, int prot, int flags, int fd, off64_t offset_pages, uint64_t file_size, const KernelMapping& km) { auto buf = t->trace_reader().read_raw_data(); size_t rec_num_bytes = ceil_page_size(buf.data.size()); // Ensure there's a virtual file for the file that was mapped // during recording. auto emufile = t->session().emufs().get_or_create(km, file_size); // Re-use the direct_map() machinery to map the virtual file. // // NB: the tracee will map the procfs link to our fd; there's // no "real" name for the file anywhere, to ensure that when // we exit/crash the kernel will clean up for us. struct stat real_file; string real_file_name; // Emufs file, so open it read-write in case we want to write to it through // the task's mem fd. finish_direct_mmap(t, remote, buf.addr, rec_num_bytes, prot, flags, emufile->proc_path(), O_RDWR, offset_pages, real_file, real_file_name); // Write back the snapshot of the segment that we recorded. // // TODO: this is a poor man's shared segment synchronization. // For full generality, we also need to emulate direct file // modifications through write/splice/etc. uint64_t offset_bytes = page_size() * offset_pages; t->vm()->map(t, buf.addr, buf.data.size(), prot, flags, offset_bytes, real_file_name, real_file.st_dev, real_file.st_ino, nullptr, &km, emufile); t->write_bytes_helper(buf.addr, buf.data.size(), buf.data.data()); LOG(debug) << " restored " << buf.data.size() << " bytes at " << HEX(offset_bytes) << " to " << emufile->real_path() << " for " << emufile->emu_path(); if (fd >= 0) { if (t->fd_table()->is_monitoring(fd)) { ASSERT(t, t->fd_table()->get_monitor(fd)->type() == FileMonitor::Type::Mmapped); } else { t->fd_table()->add_monitor(fd, new MmappedFileMonitor(t, emufile)); } } } static void process_mmap(ReplayTask* t, const TraceFrame& trace_frame, size_t length, int prot, int flags, int fd, off64_t offset_pages, ReplayTraceStep* step) { step->action = TSTEP_RETIRE; /* Successful mmap calls are much more interesting to process. */ { // Next we hand off actual execution of the mapping to the // appropriate helper. AutoRemoteSyscalls remote(t, (flags & MAP_PRIVATE) && (flags & MAP_ANONYMOUS) ? AutoRemoteSyscalls::DISABLE_MEMORY_PARAMS : AutoRemoteSyscalls::ENABLE_MEMORY_PARAMS); if (flags & MAP_ANONYMOUS) { finish_anonymous_mmap(t, remote, trace_frame.regs().syscall_result(), length, prot, flags, NOTE_TASK_MAP); } else { TraceReader::MappedData data; KernelMapping km = t->trace_reader().read_mapped_region(&data); if (data.source == TraceReader::SOURCE_FILE) { struct stat real_file; string real_file_name; finish_direct_mmap(t, remote, trace_frame.regs().syscall_result(), length, prot, flags, data.file_name, O_RDONLY, data.data_offset_bytes / page_size(), real_file, real_file_name); t->vm()->map(t, km.start(), length, prot, flags, page_size() * offset_pages, real_file_name, real_file.st_dev, real_file.st_ino, nullptr, &km); } else { ASSERT(t, data.source == TraceReader::SOURCE_TRACE); if (MAP_PRIVATE & flags) { finish_private_mmap(t, remote, trace_frame.regs().syscall_result(), length, prot, flags, offset_pages, km); } else { finish_shared_mmap(t, remote, prot, flags, fd, offset_pages, data.file_size_bytes, km); } } } // This code is used to test the sharing functionality. It is in // general a bad idea to indiscriminately share mappings between the // tracer and the tracee. Instead, only mappings that have // sufficiently many memory access from the tracer to require // acceleration should be shared. if ((MAP_PRIVATE & flags) && t->session().share_private_mappings()) { Session::make_private_shared( remote, t->vm()->mapping_of(trace_frame.regs().syscall_result())); } // Finally, we finish by emulating the return value. remote.regs().set_syscall_result(trace_frame.regs().syscall_result()); } // Monkeypatcher can emit data records that need to be applied now t->apply_all_data_records_from_trace(); t->validate_regs(); } static void process_mremap(ReplayTask* t, const TraceFrame& trace_frame, ReplayTraceStep* step) { step->action = TSTEP_RETIRE; auto& trace_regs = trace_frame.regs(); remote_ptr old_addr = trace_frame.regs().arg1(); size_t old_size = ceil_page_size(trace_regs.arg2()); remote_ptr new_addr = trace_frame.regs().syscall_result(); size_t new_size = ceil_page_size(trace_regs.arg3()); { // We must emulate mremap because the kernel's choice for the remap // destination can vary (in particular, when we emulate exec it makes // different decisions). AutoRemoteSyscalls remote(t); if (new_addr == old_addr) { // Non-moving mremap. Don't pass MREMAP_FIXED or MREMAP_MAYMOVE // since that triggers EINVAL when the new map overlaps the old map. remote.infallible_syscall_ptr(trace_regs.original_syscallno(), new_addr, old_size, new_size, 0); } else { // Force the mremap to use the destination address from recording. // XXX could the new mapping overlap the old, with different start // addresses? Hopefully the kernel doesn't do that to us!!! remote.infallible_syscall_ptr(trace_regs.original_syscallno(), old_addr, old_size, new_size, MREMAP_MAYMOVE | MREMAP_FIXED, new_addr); } remote.regs().set_syscall_result(new_addr); } t->vm()->remap(t, old_addr, old_size, new_addr, new_size); TraceReader::MappedData data; t->trace_reader().read_mapped_region(&data); ASSERT(t, data.source == TraceReader::SOURCE_ZERO); // We don't need to do anything; this is the mapping record for the moved // data. // Try reading a mapping record for new data. bool found; t->trace_reader().read_mapped_region(&data, &found); // SOURCE_FILE should be handled automatically by the mremap above. // (If we started storing partial files, we'd have to careful to ensure this // is still the case.) if (found && data.source == TraceReader::SOURCE_TRACE) { TraceReader::RawData buf; if (t->trace_reader().read_raw_data_for_frame(trace_frame, buf)) { auto& mapping = t->vm()->mapping_of(new_addr); auto f = mapping.emu_file; if (f) { f->ensure_size(mapping.map.file_offset_bytes() + old_size + buf.data.size()); } t->write_bytes_helper(buf.addr, buf.data.size(), buf.data.data()); } } t->validate_regs(); } void process_grow_map(ReplayTask* t) { AutoRemoteSyscalls remote(t); TraceReader::MappedData data; KernelMapping km = t->trace_reader().read_mapped_region(&data); ASSERT(t, km.size()); restore_mapped_region(t, remote, km, data); } static void process_shmat(ReplayTask* t, const TraceFrame& trace_frame, int shm_flags, ReplayTraceStep* step) { step->action = TSTEP_RETIRE; { AutoRemoteSyscalls remote(t); TraceReader::MappedData data; KernelMapping km = t->trace_reader().read_mapped_region(&data); int prot = shm_flags_to_mmap_prot(shm_flags); int flags = MAP_SHARED; finish_shared_mmap(t, remote, prot, flags, -1, 0, data.file_size_bytes, km); // Finally, we finish by emulating the return value. remote.regs().set_syscall_result(trace_frame.regs().syscall_result()); } // on x86-32 we have an extra data record that we need to apply --- // the ipc syscall's klugy out-parameter. t->apply_all_data_records_from_trace(); t->validate_regs(); } static void process_shmdt(ReplayTask* t, const TraceFrame& trace_frame, remote_ptr addr, ReplayTraceStep* step) { step->action = TSTEP_RETIRE; { AutoRemoteSyscalls remote(t); auto mapping = t->vm()->mapping_of(addr); ASSERT(t, mapping.map.start() == addr); remote.infallible_syscall(syscall_number_for_munmap(t->arch()), addr, mapping.map.end() - addr); remote.regs().set_syscall_result(trace_frame.regs().syscall_result()); } t->validate_regs(); } static void process_init_buffers(ReplayTask* t, ReplayTraceStep* step) { step->action = TSTEP_RETIRE; /* Proceed to syscall exit so we can run our own syscalls. */ remote_ptr rec_child_map_addr = t->current_trace_frame().regs().syscall_result(); /* We don't want the desched event fd during replay, because * we already know where they were. (The perf_event fd is * emulated anyway.) */ t->init_buffers(rec_child_map_addr); ASSERT(t, t->syscallbuf_child.cast() == rec_child_map_addr) << "Should have mapped syscallbuf at " << rec_child_map_addr << ", but it's at " << t->syscallbuf_child; t->validate_regs(); } static int non_negative_syscall(int sys) { return sys < 0 ? INT32_MAX : sys; } template static void rep_after_enter_syscall_arch(ReplayTask* t) { switch (non_negative_syscall(t->regs().original_syscallno())) { case Arch::exit: case Arch::exit_group: // We don't really need to destroy buffers in exit_group since they'll // go away anyway. Also, we have a fallback destroy_buffers in // prepare_exit. However, doing it here makes memory consistent with // recording for checksumming. t->destroy_buffers(); break; case Arch::write: case Arch::writev: { int fd = (int)t->regs().arg1_signed(); t->fd_table()->will_write(t, fd); break; } case Arch::clone: case Arch::vfork: case Arch::fork: // Create the new task now. It needs to exist before clone/fork/vfork // returns so that a ptracer can touch it during PTRACE_EVENT handling. prepare_clone(t); break; case Arch::ptrace: switch ((int)t->regs().arg1_signed()) { case PTRACE_POKETEXT: case PTRACE_POKEDATA: ReplayTask* target = t->session().find_task((pid_t)t->regs().arg2_signed()); if (target) { target->apply_all_data_records_from_trace(); } break; } break; } t->apply_all_data_records_from_trace(); } void rep_after_enter_syscall(ReplayTask* t) { RR_ARCH_FUNCTION(rep_after_enter_syscall_arch, t->arch(), t) } void rep_prepare_run_to_syscall(ReplayTask* t, ReplayTraceStep* step) { int sys = t->current_trace_frame().event().Syscall().number; LOG(debug) << "processing " << t->syscall_name(sys) << " (entry)"; if (is_restart_syscall_syscall(sys, t->arch())) { ASSERT(t, t->tick_count() == t->current_trace_frame().ticks()); t->set_regs(t->current_trace_frame().regs()); step->action = TSTEP_RETIRE; return; } step->syscall.number = sys; step->action = TSTEP_ENTER_SYSCALL; /* Don't let a negative incoming syscall number be treated as a real * system call that we assigned a negative number because it doesn't * exist in this architecture. */ if (is_rrcall_notify_syscall_hook_exit_syscall(sys, t->arch())) { ASSERT(t, t->syscallbuf_child != nullptr); t->write_mem( REMOTE_PTR_FIELD(t->syscallbuf_child, notify_on_syscall_hook_exit), (uint8_t)1); } } static void handle_opened_files(ReplayTask* t) { vector buf; while ( t->trace_reader().read_generic_for_frame(t->current_trace_frame(), buf)) { int fd = *reinterpret_cast(buf.data()); t->trace_reader().read_generic(buf); string pathname(reinterpret_cast(buf.data()), buf.size()); // This must be kept in sync with replay_syscall's handle_opened_file. if (pathname == "terminal") { t->fd_table()->add_monitor(fd, new StdioMonitor(STDERR_FILENO)); } else if (is_proc_mem_file(pathname.c_str())) { t->fd_table()->add_monitor(fd, new ProcMemMonitor(t, pathname)); } else if (is_proc_fd_dir(pathname.c_str())) { t->fd_table()->add_monitor(fd, new ProcFdDirMonitor(t, pathname)); } else { ASSERT(t, false) << "Why did we write filename " << pathname; } } } template static void rep_process_syscall_arch(ReplayTask* t, ReplayTraceStep* step) { int sys = t->current_trace_frame().event().Syscall().number; const TraceFrame& trace_frame = t->session().current_trace_frame(); const Registers& trace_regs = trace_frame.regs(); LOG(debug) << "processing " << t->syscall_name(sys) << " (exit)"; // sigreturns are never restartable, and the value of the // syscall-result register after a sigreturn is not actually the // syscall result. if (trace_regs.syscall_may_restart() && !is_sigreturn(sys, t->arch())) { // During recording, when a sys exits with a // restart "error", the kernel sometimes restarts the // tracee by resetting its $ip to the syscall entry // point, but other times restarts the syscall without // changing the $ip. t->apply_all_data_records_from_trace(); t->set_return_value_from_trace(); step->action = TSTEP_RETIRE; LOG(debug) << " " << t->syscall_name(sys) << " interrupted by " << trace_regs.syscall_result() << " at " << trace_regs.ip() << ", may restart"; return; } if (sys == Arch::restart_syscall) { sys = t->regs().original_syscallno(); } step->syscall.number = sys; step->action = TSTEP_EXIT_SYSCALL; if (trace_regs.syscall_failed()) { switch (non_negative_syscall(sys)) { case Arch::madvise: case Arch::mprotect: case Arch::sigreturn: case Arch::rt_sigreturn: break; default: return; } } /* Manual implementations of irregular syscalls that need to do more during * replay than just modify register and memory state. * Don't let a negative incoming syscall number be treated as a real * system call that we assigned a negative number because it doesn't * exist in this architecture. * All invalid/unsupported syscalls get the default emulation treatment. */ switch (non_negative_syscall(sys)) { case Arch::execve: return process_execve(t, trace_frame, step); case Arch::brk: return process_brk(t); case Arch::mmap: { switch (Arch::mmap_semantics) { case Arch::StructArguments: { auto args = t->read_mem( remote_ptr(trace_regs.arg1())); return process_mmap(t, trace_frame, args.len, args.prot, args.flags, args.fd, args.offset / page_size(), step); } case Arch::RegisterArguments: return process_mmap(t, trace_frame, trace_regs.arg2(), trace_regs.arg3(), trace_regs.arg4(), trace_regs.arg5(), trace_regs.arg6() / page_size(), step); } break; } case Arch::mmap2: return process_mmap(t, trace_frame, trace_regs.arg2(), trace_regs.arg3(), trace_regs.arg4(), trace_regs.arg5(), trace_regs.arg6(), step); case Arch::shmat: return process_shmat(t, trace_frame, trace_regs.arg3(), step); case Arch::shmdt: return process_shmdt(t, trace_frame, trace_regs.arg1(), step); case Arch::mremap: return process_mremap(t, trace_frame, step); case Arch::madvise: switch ((int)t->regs().arg3()) { case MADV_DONTNEED: case MADV_REMOVE: break; default: return; } /* fall through */ case Arch::munmap: case Arch::mprotect: case Arch::arch_prctl: case Arch::set_thread_area: { // Using AutoRemoteSyscalls here fails for arch_prctl, not sure why. Registers r = t->regs(); r.set_syscallno(t->regs().original_syscallno()); r.set_ip(r.ip().decrement_by_syscall_insn_length(r.arch())); t->set_regs(r); if (sys == Arch::mprotect) { t->vm()->fixup_mprotect_growsdown_parameters(t); } __ptrace_cont(t, RESUME_SYSCALL, sys); __ptrace_cont(t, RESUME_SYSCALL, sys); ASSERT(t, t->regs().syscall_result() == trace_regs.syscall_result()); if (sys == Arch::mprotect) { Registers r2 = t->regs(); r2.set_arg1(r.arg1()); r2.set_arg2(r.arg2()); r2.set_arg3(r.arg3()); t->set_regs(r2); } return; } case Arch::ipc: switch ((int)trace_regs.arg1_signed()) { case SHMAT: return process_shmat(t, trace_frame, trace_regs.arg3(), step); case SHMDT: return process_shmdt(t, trace_frame, trace_regs.arg5(), step); default: break; } break; case Arch::sigreturn: case Arch::rt_sigreturn: t->set_regs(trace_regs); t->set_extra_regs(trace_frame.extra_regs()); step->action = TSTEP_RETIRE; return; case Arch::perf_event_open: { Task* target = t->session().find_task((pid_t)trace_regs.arg2_signed()); int cpu = trace_regs.arg3_signed(); int group_fd = trace_regs.arg4_signed(); unsigned long flags = trace_regs.arg5(); int fd = trace_regs.syscall_result_signed(); if (target && cpu == -1 && group_fd == -1 && !flags) { auto attr = t->read_mem(remote_ptr(trace_regs.arg1())); if (VirtualPerfCounterMonitor::should_virtualize(attr)) { t->fd_table()->add_monitor( fd, new VirtualPerfCounterMonitor(t, target, attr)); } } } case Arch::recvmsg: case Arch::recvmmsg: case Arch::openat: case Arch::open: case Arch::socketcall: case Arch::rrcall_notify_control_msg: handle_opened_files(t); break; case Arch::write: case Arch::writev: /* write*() can be desched'd, but don't use scratch, * so we might have saved 0 bytes of scratch after a * desched. */ maybe_noop_restore_syscallbuf_scratch(t); return; case Arch::process_vm_writev: { // Recorded data records may be for another process. ReplayTask* dest = t->session().find_task(t->regs().arg1()); if (dest) { uint32_t iov_cnt = t->regs().arg5(); for (uint32_t i = 0; i < iov_cnt; ++i) { dest->set_data_from_trace(); } } return; } case Arch::read: { if (t->cloned_file_data_fd_child >= 0) { int fd = (int)t->regs().arg1(); string file_name = t->file_name_of_fd(fd); if (!file_name.empty() && file_name == t->file_name_of_fd(t->cloned_file_data_fd_child)) { // This is a read of the cloned-data file. Replay logic depends on // this file's offset actually advancing. AutoRemoteSyscalls remote(t); remote.infallible_lseek_syscall(fd, trace_regs.syscall_result(), SEEK_CUR); } } return; } case SYS_rrcall_init_buffers: return process_init_buffers(t, step); case SYS_rrcall_init_preload: t->at_preload_init(); return; case SYS_rrcall_reload_auxv: { // Inner rr has finished emulating execve for a tracee. Reload auxv // vectors now so that if gdb gets attached to the inner tracee, it will // get useful symbols. Task* target = t->session().find_task((pid_t)t->regs().arg1()); ASSERT(t, target) << "SYS_rrcall_reload_auxv misused"; target->vm()->save_auxv(target); return; } default: return; } } void rep_process_syscall(ReplayTask* t, ReplayTraceStep* step) { // Use the event's arch, not the task's, because the task's arch may // be out of date immediately after an exec. RR_ARCH_FUNCTION(rep_process_syscall_arch, t->current_trace_frame().event().arch(), t, step) } } // namespace rr rr-4.4.0/src/replay_syscall.h000066400000000000000000000015261277367620400161520ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_REP_PROCESS_EVENT_H_ #define RR_REP_PROCESS_EVENT_H_ #include "TraceStream.h" namespace rr { class ReplayTask; struct ReplayTraceStep; /** * Prepare for a pending syscall. Call this when |t| is going to run towards * a syscall. */ void rep_prepare_run_to_syscall(ReplayTask* t, ReplayTraceStep* step); /** * Call this when |t| has just entered a syscall. */ void rep_after_enter_syscall(ReplayTask* t); /** * Process pending syscall. Call this when |t| is about to exit a syscall. */ void rep_process_syscall(ReplayTask* t, ReplayTraceStep* step); /** * Process an EV_GROW_MAP event. These are like mmap syscalls, so handled * in replay_syscall. */ void process_grow_map(ReplayTask* t); } // namespace rr #endif /* RR_REP_PROCESS_EVENT_H_ */ rr-4.4.0/src/script/000077500000000000000000000000001277367620400142535ustar00rootroot00000000000000rr-4.4.0/src/script/checkpoint-visualizer.html000066400000000000000000000053271277367620400214720ustar00rootroot00000000000000
CheckpointTimeTime to next
rr-4.4.0/src/script/setup_travis.sh000077500000000000000000000005401277367620400173410ustar00rootroot00000000000000#!/bin/bash # Install the prerequisites needed to build and run tests on travis-ci. echo Configuring travis-ci build slave ... echo The slave is `uname -a` packages=(rpm ccache cmake make g++-multilib pkg-config realpath zlib1g-dev) sudo apt-get update && \ sudo apt-get install -y "${packages[@]}" && \ echo ... finished configuring slave rr-4.4.0/src/script/tag-release.sh000077500000000000000000000017721277367620400170120ustar00rootroot00000000000000#!/bin/bash function fatal { why=$1; echo "[FATAL]" $why >&2 exit 1 } major=$1 minor=$2 patch=$3 ver="$major.$minor.$patch" echo "Preparing for release '$ver' ..." if [[ $major == "" || $minor == "" || $patch == "" ]]; then fatal "Usage: ./tag-release.sh MAJOR MINOR PATCH" fi verfile=CMakeLists.txt echo "Patching $verfile with new version string ..." sed -i "s/rr_VERSION_MAJOR [0-9][0-9]*/rr_VERSION_MAJOR $major/g" $verfile sed -i "s/rr_VERSION_MINOR [0-9][0-9]*/rr_VERSION_MINOR $minor/g" $verfile sed -i "s/rr_VERSION_PATCH [0-9][0-9]*/rr_VERSION_PATCH $patch/g" $verfile echo "Showing diff for $verfile ..." git diff -p -U8 echo -n "Is this what you expected to see? [Y/n] " read ok if [[ $ok != "Y" ]]; then fatal "Oops. Aborting version update by user request." fi echo "Generating git commit ..." git commit $verfile -m "Bump version to $ver." echo "Generating git tag $ver ..." git tag $ver echo "Done! Publish the new version using 'git push --all' or 'git push; git push --tags'." rr-4.4.0/src/script/update-gh-pages.sh000077500000000000000000000013361277367620400175700ustar00rootroot00000000000000#!/bin/bash function fatal { why=$1; echo "[FATAL]" $why >&2 exit 1 } rev=HEAD if [[ $1 != "" ]]; then rev=$1 fi ver=`git name-rev --name-only --tags $rev` if [[ $ver == undefined ]]; then fatal "No tag found" fi echo "Updating repo ..." git checkout gh-pages || fatal "Failed to checkout gh-pages branch." verfile=index.html echo "Patching $verfile with new version $ver ..." sed -i "s/[^<]*$ver * Authors: * Will Drewry * Kees Cook * * The code may be used by anyone for any purpose, and can serve as a * starting point for developing applications using mode 2 seccomp. */ #ifndef RR_SECCOMP_BPF_H_ #define RR_SECCOMP_BPF_H_ #define _GNU_SOURCE 1 #include #include #include #include #include #include #include #include #include #include "remote_code_ptr.h" #include #include #ifndef PR_SET_NO_NEW_PRIVS #define PR_SET_NO_NEW_PRIVS 38 #endif #include #include #include #ifdef HAVE_LINUX_SECCOMP_H #include #endif #ifndef SECCOMP_MODE_FILTER #define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ #define SECCOMP_RET_KILL 0x00000000U #define SECCOMP_RET_TRAP 0x00030000U #define SECCOMP_RET_ERRNO 0x00050000U #define SECCOMP_RET_TRACE 0x7ff00000U #define SECCOMP_RET_ALLOW 0x7fff0000U #define SECCOMP_RET_ACTION 0x7fff0000U #define SECCOMP_RET_DATA 0x0000ffffU struct seccomp_data { int nr; __u32 arch; __u64 instruction_pointer; __u64 args[6]; }; #endif namespace rr { #define inst_ptr (offsetof(struct seccomp_data, instruction_pointer)) template class SeccompFilter { public: void allow() { filters.push_back(BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW)); } void trace() { filters.push_back( BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_TRACE | SECCOMP_RET_DATA)); } void allow_syscalls_from_callsite(remote_code_ptr ip) { uint32_t v(ip.register_value()); assert(ip.register_value() == v); filters.push_back(BPF_STMT(BPF_LD + BPF_W + BPF_ABS, inst_ptr)); filters.push_back(BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, v, 0, 1)); allow(); } std::vector filters; }; } #endif /* RR_SECCOMP_BPF_H_ */ rr-4.4.0/src/syscalls.py000066400000000000000000002072171277367620400151670ustar00rootroot00000000000000class BaseSyscall(object): """A base class for syscalls. The constructor accepts specifications for the x86 and x86-64 syscall numbers; if one of them does not exist, then the associated syscall is assumed to not exist on the corresponding architecture. """ # Take **kwargs and ignore to make life easier on RegularSyscall. def __init__(self, x86=None, x64=None, **kwargs): assert x86 or x64 # Must exist on one architecture. self.x86 = x86 self.x64 = x64 assert len(kwargs) is 0 class RestartSyscall(BaseSyscall): """A special class for the restart_syscall syscall.""" def __init__(self, x86=None, x64=None): BaseSyscall.__init__(self, x86=x86, x64=x64) class UnsupportedSyscall(BaseSyscall): """A syscall that is unsupported by rr. It is useful to expose these syscalls to the system, so that proper names can be displayed in error messages, if nothing else. They also serve as useful documentation. """ def __init__(self, x86=None, x64=None): BaseSyscall.__init__(self, x86=x86, x64=x64) class InvalidSyscall(UnsupportedSyscall): """A syscall that is unsupported by rr and unimplemented by Linux. We distinguish syscalls unimplemented by any version of Linux supported by rr from other UnsupportedSyscalls, to help us track the completeness of rr's syscall support. """ def __init__(self, x86=None, x64=None): UnsupportedSyscall.__init__(self, x86=x86, x64=x64) class RegularSyscall(BaseSyscall): """A syscall for which replay information may be recorded automatically. The arguments required for rr to record may be specified directly through the arg1...arg6 keyword arguments. The values for these arguments determine the size of the associated arguments to the syscall. The only allowed type for a given argument is a Python string, in which case the size of the argument is sizeof(arg). To ensure correct handling for mixed-arch process groups (e.g. a mix of 32 and 64-bit processes), types should be specified using Arch instead of referring directly to the host system types. """ def __init__(self, **kwargs): for a in range(1,6): arg = 'arg' + str(a) if arg in kwargs: self.__setattr__(arg, kwargs[arg]) kwargs.pop(arg) BaseSyscall.__init__(self, **kwargs) class EmulatedSyscall(RegularSyscall): """A wrapper for regular syscalls. """ def __init__(self, **kwargs): RegularSyscall.__init__(self, **kwargs) class IrregularEmulatedSyscall(BaseSyscall): """A wrapper for irregular syscalls. """ def __init__(self, **kwargs): BaseSyscall.__init__(self, **kwargs) # void exit(int status) # # The exit() function causes normal process termination and the value # of status & 0377 is returned to the parent (see wait(2)). exit = IrregularEmulatedSyscall(x86=1, x64=60) # Obsolete, glibc calls clone() instead. # But Google Breakpad uses it! fork = IrregularEmulatedSyscall(x86=2, x64=57) # ssize_t read(int fd, void *buf, size_t count); # # read() attempts to read up to count bytes from file descriptor fd # into the buffer starting at buf. # # CHECKED: (trace->recorded_regs.eax > 0) read = IrregularEmulatedSyscall(x86=3, x64=0) # ssize_t write(int fd, const void *buf, size_t count); # # write() writes up to count bytes to the file referenced by the file # descriptor fd from the buffer starting at buf. POSIX requires that # a read() which can be proved to occur after a write() has returned # returns the new data. Note that not all file systems are POSIX # conforming. # # Note: write isn't irregular per se; we hook it to redirect output # to stdout/stderr during replay. write = IrregularEmulatedSyscall(x86=4, x64=1) # int open(const char *pathname, int flags) # int open(const char *pathname, int flags, mode_t mode) # # Given a pathname for a file, open() returns a file descriptor, a # small, nonnegative integer for use in subsequent system calls # (read(2), write(2), lseek(2), fcntl(2), etc.). The file descriptor # returned by a successful call will be the lowest-numbered file # descriptor not currently open for the process. open = IrregularEmulatedSyscall(x86=5, x64=2) # int close(int fd) # # close() closes a file descriptor, so that it no longer refers to # any file and may be reused. Any record locks (see fcntl(2)) held # on the file it was associated with, and owned by the process, are # removed (regardless of the file descriptor that was used to obtain # the lock). close = IrregularEmulatedSyscall(x86=6, x64=3) # pid_t waitpid(pid_t pid, int *status, int options); # # The waitpid() system call suspends execution of the calling process # until a child specified by pid argument has changed state. By # default, waitpid() waits only for terminated children, but this # behavior is modifiable via the options argument, as described # below.... waitpid = IrregularEmulatedSyscall(x86=7) # int creat(const char *pathname, mode_t mode); # # creat() is equivalent to open() with flags equal to # O_CREAT|O_WRONLY|O_TRUNC. creat = EmulatedSyscall(x86=8, x64=85) # int link(const char *oldpath, const char *newpath); # # link() creates a new link (also known as a hard link) to an # existing file. link = EmulatedSyscall(x86=9, x64=86) # int unlink(const char *path); # # The unlink() function shall remove a link to a file. If path names # a symbolic link, unlink() shall remove the symbolic link named by # path and shall not affect any file or directory named by the # contents of the symbolic link. Otherwise, unlink() shall remove the # link named by the pathname pointed to by path and shall decrement # the link count of the file referenced by the link. unlink = EmulatedSyscall(x86=10, x64=87) # int execve(const char *filename, char *const argv[], char *const envp[]); # # execve() executes the program pointed to by filename. execve = IrregularEmulatedSyscall(x86=11, x64=59) # int chdir(const char *path); # # chdir() changes the current working directory of the calling # process to the directory specified in path. chdir = EmulatedSyscall(x86=12, x64=80) # time_t time(time_t *t); # # time() returns the time since the Epoch (00:00:00 UTC, January 1, # 1970), measured in seconds. If t is non-NULL, the return value is # also stored in the memory pointed to by t. time = EmulatedSyscall(x86=13, x64=201, arg1="typename Arch::time_t") mknod = EmulatedSyscall(x86=14, x64=133) # int chmod(const char *path, mode_t mode) # # The mode of the file given by path or referenced by fildes is # changed. chmod = EmulatedSyscall(x86=15, x64=90) lchown = EmulatedSyscall(x86=16, x64=94) _break = InvalidSyscall(x86=17) oldstat = UnsupportedSyscall(x86=18) # off_t lseek(int fd, off_t offset, int whence) # # The lseek() function repositions the offset of the open file # associated with the file descriptor fd to the argument offset # according to the directive whence as follows: lseek = EmulatedSyscall(x86=19, x64=8) # pid_t getpid(void); # # getpid() returns the process ID of the calling process. (This is # often used by routines that generate unique temporary # filenames.) getpid = EmulatedSyscall(x86=20, x64=39) mount = EmulatedSyscall(x86=21, x64=165) umount = EmulatedSyscall(x86=22) setuid = EmulatedSyscall(x86=23, x64=105) getuid = EmulatedSyscall(x86=24, x64=102) stime = UnsupportedSyscall(x86=25) # long ptrace(enum __ptrace_request request, pid_t pid, # void *addr, void *data); # # The ptrace() system call provides a means by which one process (the # "tracer") may observe and control the execution of another process # (the "tracee"), and examine and change the tracee's memory and # registers. It is primarily used to implement breakpoint debugging # and system call tracing. ptrace = IrregularEmulatedSyscall(x86=26, x64=101) # unsigned int alarm(unsigned int seconds) # # The alarm() system call schedules an alarm. The process will get a # SIGALRM after the requested amount of seconds. alarm = EmulatedSyscall(x86=27, x64=37) oldfstat = UnsupportedSyscall(x86=28) # int pause(void); # # pause() causes the calling process (or thread) to sleep until a # signal is delivered that either terminates the process or causes # the invocation of a signal-catching function. pause = IrregularEmulatedSyscall(x86=29, x64=34) # int utime(const char *filename, const struct utimbuf *times) # # The utime() system call changes the access and modification times # of the inode specified by filename to the actime and modtime fields # of times respectively. # # If times is NULL, then the access and modification times of the # file are set to the current time. # # Changing timestamps is permitted when: either the process has # appropriate privileges, or the effective user ID equals the user ID # of the file, or times is NULL and the process has write permission # for the file. # # FIXME: is mod_time set by the kernel? utime = EmulatedSyscall(x86=30, x64=132) stty = InvalidSyscall(x86=31) gtty = InvalidSyscall(x86=32) # int access(const char *pathname, int mode); # # access() checks whether the calling process can access the file # pathname. If pathname is a symbolic link, it is dereferenced. access = EmulatedSyscall(x86=33, x64=21) nice = UnsupportedSyscall(x86=34) ftime = InvalidSyscall(x86=35) sync = EmulatedSyscall(x86=36, x64=162) # int kill(pid_t pid, int sig) # # The kill() system call can be used to send any signal to any # process group or process. kill = EmulatedSyscall(x86=37, x64=62) # int rename(const char *oldpath, const char *newpath) # # rename() renames a file, moving it between directories if required. rename = EmulatedSyscall(x86=38, x64=82) # int mkdir(const char *pathname, mode_t mode); # # mkdir() attempts to create a directory named pathname. mkdir = EmulatedSyscall(x86=39, x64=83) # int rmdir(const char *pathname) # # rmdir() deletes a directory, which must be empty. rmdir = EmulatedSyscall(x86=40, x64=84) # int dup(int oldfd) # # dup() uses the lowest-numbered unused descriptor for the new # descriptor. dup = EmulatedSyscall(x86=41, x64=32) # int pipe(int pipefd[2]); # # pipe() creates a pipe, a unidirectional data channel that can be # used for interprocess communication. The array pipefd is used to # return two file descriptors referring to the ends of the pipe. # pipefd[0] refers to the read end of the pipe. pipefd[1] refers to # the write end of the pipe. Data written to the write end of the # pipe is buffered by the kernel until it is read from the read end # of the pipe. For further details, see pipe(7). pipe = EmulatedSyscall(x86=42, x64=22, arg1="int[2]") # clock_t times(struct tms *buf) # # times() stores the current process times in the struct tms that buf # points to. The struct tms is as defined in : times = EmulatedSyscall(x86=43, x64=100, arg1="typename Arch::tms") prof = InvalidSyscall(x86=44) # int brk(void *addr) # # brk() and sbrk() change the location of the program break, which # defines the end of the process's data segment (i.e., theprogram # break is the first location after the end of the uninitialized data # segment). Increasing the program break has the effect of # allocating memory to the process; decreasing the break deallocates # memory. # # brk() sets the end of the data segment to the value specified by # addr, when that value is reasonable, the system has enough memory, # and the process does not exceed its maximum data size (see # setrlimit(2)). brk = IrregularEmulatedSyscall(x86=45, x64=12) # int setgid(gid_t gid) # # setgid() sets the effective group ID of the calling process. # If the caller is the superuser, the real GID and saved set-group-ID # are also set. # # Under Linux, setgid() is implemented like the POSIX version with the # _POSIX_SAVED_IDS feature. This allows a set-group-ID program that # is not set-user-ID-root to drop all of its group privileges, do some # un-privileged work, and then reengage the original effective group # ID in a secure manner. # # setgid will return 0 on success, or if the process already runs # under the given gid. setgid = EmulatedSyscall(x86=46, x64=106) getgid = EmulatedSyscall(x86=47, x64=104) signal = UnsupportedSyscall(x86=48) geteuid = EmulatedSyscall(x86=49, x64=107) getegid = EmulatedSyscall(x86=50, x64=108) acct = UnsupportedSyscall(x86=51, x64=163) umount2 = EmulatedSyscall(x86=52, x64=166) lock = InvalidSyscall(x86=53) # int ioctl(int d, int request, ...) # # The ioctl() function manipulates the underlying device parameters # of special files. In particular, many operating characteristics of # character special files (e.g., terminals) may be controlled with # ioctl() requests. The argument d must be an open file descriptor. # ioctl = IrregularEmulatedSyscall(x86=54, x64=16) fcntl = IrregularEmulatedSyscall(x86=55, x64=72) mpx = InvalidSyscall(x86=56) # int setpgid(pid_t pid, pid_t pgid); # # setpgid() sets the PGID of the process specified by pid to pgid. # If pid is zero, then the process ID of the calling process is used. # If pgid is zero, then the PGID of the process specified by pid is # made the same as its process ID. If setpgid() is used to move a # process from one process group to another (as is done by some # shells when creating pipelines), both process groups must be part # of the same session (see setsid(2) and credentials(7)). In this # case, the pgid specifies an existing process group to be joined and # the session ID of that group must match the session ID of the # joining process. setpgid = EmulatedSyscall(x86=57, x64=109) ulimit = InvalidSyscall(x86=58) oldolduname = UnsupportedSyscall(x86=59) # mode_t umask(mode_t mask); # # umask() sets the calling process's file mode creation mask (umask) # to mask & 0777 (i.e., only the file permission bits of mask are # used), and returns the previous value of the mask. umask = EmulatedSyscall(x86=60, x64=95) chroot = EmulatedSyscall(x86=61, x64=161) ustat = UnsupportedSyscall(x86=62, x64=136) # int dup2(int oldfd, int newfd) # # dup2() makes newfd be the copy of oldfd, closing newfd first if # necessary, but note the following.. dup2 = IrregularEmulatedSyscall(x86=63, x64=33) # pid_t getppid(void); # # getppid() returns the process ID of the parent of the calling # process. getppid = EmulatedSyscall(x86=64, x64=110) # pid_t getpgrp(void) # # The POSIX.1 getpgrp() always returns the PGID of the caller. getpgrp = EmulatedSyscall(x86=65, x64=111) # pid_t setsid(void) # # setsid() is used to start a new session and set the new process # group ID. setsid = EmulatedSyscall(x86=66, x64=112) # int sigaction(int signum, const struct sigaction *act, struct sigaction #*oldact); # # The sigaction() system call is used to change the action taken by a # process on receipt of a specific signal. (See signal(7) for an # overview of signals.) # # signum specifies the signal and can be any valid signal except # SIGKILL and SIGSTOP. # # If act is non-NULL, the new action for signal signum is installed # from act. If oldact is non-NULL, the previous action is saved in # oldact. sigaction = EmulatedSyscall(x86=67, arg3="typename Arch::kernel_sigaction") sgetmask = UnsupportedSyscall(x86=68) ssetmask = UnsupportedSyscall(x86=69) setreuid = EmulatedSyscall(x86=70, x64=113) setregid = EmulatedSyscall(x86=71, x64=114) sigsuspend = IrregularEmulatedSyscall(x86=72) sigpending = UnsupportedSyscall(x86=73) sethostname = EmulatedSyscall(x86=74, x64=170) # int setrlimit(int resource, const struct rlimit *rlim) # # getrlimit() and setrlimit() get and set resource limits # respectively. Each resource has an associated soft and hard limit, # as defined by the rlimit structure (the rlim argument to both # getrlimit() and setrlimit()): # # NOTE: This syscall is emulated so the limit does not apply during # replay. Any signals triggered due to exceeded limits are emulated # by other means. setrlimit = EmulatedSyscall(x86=75, x64=160) getrlimit = EmulatedSyscall(x64=97, arg2="typename Arch::rlimit") # int getrusage(int who, struct rusage *usage) # # getrusage() returns resource usage measures for who, which can be # one of the following.. getrusage = EmulatedSyscall(x86=77, x64=98, arg2="typename Arch::rusage") # int gettimeofday(struct timeval *tv, struct timezone *tz); # # The functions gettimeofday() and settimeofday() can get and set the # time as well as a timezone. The tv argument is a struct timeval # (as specified in ): gettimeofday = EmulatedSyscall(x86=78, x64=96, arg1="typename Arch::timeval", arg2="typename Arch::timezone") settimeofday = UnsupportedSyscall(x86=79, x64=164) getgroups = IrregularEmulatedSyscall(x86=80, x64=115) setgroups = EmulatedSyscall(x86=81, x64=116) select = IrregularEmulatedSyscall(x86=82, x64=23) # int symlink(const char *oldpath, const char *newpath) # # symlink() creates a symbolic link named newpath which contains the # string oldpath. symlink = EmulatedSyscall(x86=83, x64=88) oldlstat = UnsupportedSyscall(x86=84) # ssize_t readlink(const char *path, char *buf, size_t bufsiz); # # readlink() places the contents of the symbolic link path in the # buffer buf, which has size bufsiz. readlink() does not append a # null byte to buf. It will truncate the contents (to a length of # bufsiz characters), in case the buffer is too small to hold all of # the contents. readlink = IrregularEmulatedSyscall(x86=85, x64=89) uselib = UnsupportedSyscall(x86=86, x64=134) swapon = UnsupportedSyscall(x86=87, x64=167) reboot = UnsupportedSyscall(x86=88, x64=169) readdir = UnsupportedSyscall(x86=89) # void *mmap2(void *addr, size_t length, int prot,int flags, int fd, off_t #pgoffset); # # The mmap2() system call operates in exactly the same way as # mmap(2), except that the final argument specifies the offset into # the file in 4096-byte units (instead of bytes, as is done by # mmap(2)). This enables applications that use a 32-bit off_t to map # large files (up to 2^44 bytes). mmap = IrregularEmulatedSyscall(x86=90, x64=9) # int munmap(void *addr, size_t length) # # The munmap() system call deletes the mappings for the specified # address range, and causes further references to addresses within # the range to generate invalid memory references. The region is # also automatically unmapped when the process is terminated. On the # other hand, closing the file descriptor does not unmap the region. munmap = IrregularEmulatedSyscall(x86=91, x64=11) # int truncate(const char *path, off_t length); # int ftruncate(int fd, off_t length) # # The truncate() and ftruncate() functions cause the regular file # named by path or referenced by fd to be truncated to a size of # precisely length bytes. truncate = EmulatedSyscall(x86=92, x64=76) ftruncate = EmulatedSyscall(x86=93, x64=77) # int fchmod(int fd, mode_t mode); # # fchmod() changes the permissions of the file referred to by the # open file descriptor fd fchmod = EmulatedSyscall(x86=94, x64=91) fchown = EmulatedSyscall(x86=95, x64=93) # int getpriority(int which, int who); # # The scheduling priority of the process, process group, or user, as # indicated by which and who is obtained with the getpriority() call. getpriority = EmulatedSyscall(x86=96, x64=140) # int setpriority(int which, int who, int prio); # # The scheduling priority of the process, process group, or user, as # indicated by which and who is obtained with the getpriority() call # and set with the setpriority() call. setpriority = IrregularEmulatedSyscall(x86=97, x64=141) profil = InvalidSyscall(x86=98) # int statfs(const char *path, struct statfs *buf) # # The function statfs() returns information about a mounted file # system. path is the pathname of any file within the mounted file # system. buf is a pointer to a statfs structure defined # approximately as follows: statfs = EmulatedSyscall(x86=99, x64=137, arg2="struct Arch::statfs") # int fstatfs(int fd, struct statfs *buf) # # The function statfs() returns information about a mounted file # system. path is the pathname of any file within the # get_time(GET_TID(thread_id));mounted file system. buf is a pointer # to a statfs structure defined approximately as follows: fstatfs = EmulatedSyscall(x86=100, x64=138, arg2="struct Arch::statfs") ioperm = UnsupportedSyscall(x86=101, x64=173) # int socketcall(int call, unsigned long *args) # # socketcall() is a common kernel entry point for the socket system # calls. call determines which socket function to invoke. args # points to a block containing the actual arguments, which are passed # through to the appropriate call. socketcall = IrregularEmulatedSyscall(x86=102) syslog = UnsupportedSyscall(x86=103, x64=103) # int setitimer(int which, const struct itimerval *new_value, struct itimerval #*old_value); # # The function setitimer() sets the specified timer to the value in # new_value. If old_value is non-NULL, the old value of the timer is # stored there. setitimer = EmulatedSyscall(x86=104, x64=38, arg3="typename Arch::itimerval") getitimer = EmulatedSyscall(x86=105, x64=36, arg2="typename Arch::itimerval") stat = EmulatedSyscall(x86=106, x64=4, arg2="struct Arch::stat") lstat = EmulatedSyscall(x86=107, x64=6, arg2="struct Arch::stat") fstat = EmulatedSyscall(x86=108, x64=5, arg2="struct Arch::stat") olduname = UnsupportedSyscall(x86=109) iopl = UnsupportedSyscall(x86=110, x64=172) vhangup = UnsupportedSyscall(x86=111, x64=153) idle = UnsupportedSyscall(x86=112) vm86old = UnsupportedSyscall(x86=113) # pid_t wait4(pid_t pid, int *status, int options, struct rusage *rusage); # # The wait3() and wait4() system calls are similar to waitpid(2), but # additionally return resource usage information about the child in # the structure pointed to by rusage. wait4 = IrregularEmulatedSyscall(x86=114, x64=61) swapoff = UnsupportedSyscall(x86=115, x64=168) # int sysinfo(struct sysinfo *info) # # sysinfo() provides a simple way of getting overall system # statistics. sysinfo = EmulatedSyscall(x86=116, x64=99, arg1="struct Arch::sysinfo") # int ipc(unsigned int call, int first, int second, int third, void *ptr, long #fifth); # # ipc() is a common kernel entry point for the System V IPC calls for # messages, semaphores, and shared memory. call determines which IPC # function to invoke; the other arguments are passed through to the # appropriate call. ipc = IrregularEmulatedSyscall(x86=117) # int fsync(int fd) # # fsync() transfers ("flushes") all modified in-core data of (i.e., # modified buffer cache pages for) the file referred to by the file # descriptor fd to the disk device (or other permanent storage # device) where that file resides. The call blocks until the device # reports that the transfer has completed. It also flushes metadata # information associated with the file (see stat(2)) fsync = EmulatedSyscall(x86=118, x64=74) # int sigreturn(unsigned long __unused) # # When the Linux kernel creates the stack frame for a signal handler, # a call to sigreturn() is inserted into the stack frame so that upon # return from the signal handler, sigreturn() will be called. sigreturn = IrregularEmulatedSyscall(x86=119) # int clone(int (*fn)(void *), void *child_stack, int flags, void *arg, (pid_t #*ptid, struct user_desc *tls, pid_t *ctid)); # # clone() creates a new process, in a manner similar to fork(2). It # is actually a library function layered ontrace top of the # underlying clone() system call, hereinafter referred to tidas # sys_clone. A description of sys_clone is given towards the end of # this page. # # NOTE: clone is actually implemented by sys_clone which has the # following signature: # # long sys_clone(unsigned long clone_flags, unsigned long newsp, void __user #*parent_tid, void __user *child_tid, struct pt_regs *regs) clone = IrregularEmulatedSyscall(x86=120, x64=56) setdomainname = EmulatedSyscall(x86=121, x64=171) # int uname(struct utsname *buf) # # uname() returns system information in the structure pointed to by # buf. The utsname struct is defined in : uname = EmulatedSyscall(x86=122, x64=63, arg1="typename Arch::utsname") modify_ldt = UnsupportedSyscall(x86=123, x64=154) adjtimex = UnsupportedSyscall(x86=124, x64=159) # int mprotect(const void *addr, size_t len, int prot) # # mprotect() changes protection for the calling process's memory # page(s) containing any part of the address range in the interval # [addr, addr+len-1]. addr must be aligned to a page boundary. # # If the calling process tries to access memory in a manner that # violates the protection, then the kernel generates a SIGSEGV signal # for the process. mprotect = IrregularEmulatedSyscall(x86=125, x64=10) # int sigprocmask(int how, const sigset_t *set, sigset_t *oldset); # # sigprocmask() is used to fetch and/or change the signal mask of the # calling thread. The signal mask is the set of signals whose # delivery is currently blocked for the caller (see also signal(7) # for more details). sigprocmask = IrregularEmulatedSyscall(x86=126) create_module = UnsupportedSyscall(x86=127, x64=174) init_module = UnsupportedSyscall(x86=128, x64=175) delete_module = UnsupportedSyscall(x86=129, x64=176) get_kernel_syms = InvalidSyscall(x86=130, x64=177) # int quotactl(int cmd, const char *special, int id, caddr_t addr); # # The quotactl() call manipulates disk quotas. The cmd argument # indicates a command to be applied to the user or group ID # specified in id. To initialize the cmd argument, use the # QCMD(subcmd, type) macro. The type value is either USRQUOTA, for # user quotas, or GRPQUOTA, for group quotas. The subcmd value is # described below. quotactl = IrregularEmulatedSyscall(x86=131, x64=179) # pid_t getpgid(pid_t pid); # # getpgid() returns the PGID of the process specified by pid. If pid # is zero, getpgid() the process ID of the calling process is # used.int getrusage(int who, struct rusage *usage); getpgid = EmulatedSyscall(x86=132, x64=121) # int fchdir(int fd); # # fchdir() is identical to chdir(); the only difference is that the # directory is given as an open file descriptor. fchdir = EmulatedSyscall(x86=133, x64=81) bdflush = UnsupportedSyscall(x86=134) sysfs = UnsupportedSyscall(x86=135, x64=139) personality = IrregularEmulatedSyscall(x86=136, x64=135) afs_syscall = InvalidSyscall(x86=137, x64=183) setfsuid = EmulatedSyscall(x86=138, x64=122) setfsgid = EmulatedSyscall(x86=139, x64=123) # int _llseek(unsigned int fd, unsigned long offset_high, unsigned long #offset_low, loff_t *result, unsigned int whence); # # The _llseek() function repositions the offset of the open file # associated with the file descriptor fd to (offset_high<<32) | # offset_low bytes relative to the beginning of the file, the current # position in the file, or the end of the file, depending on whether # whence is SEEK_SET, SEEK_CUR, or SEEK_END, respectively. It # returns the resulting file position in the argument result. _llseek = EmulatedSyscall(x86=140, arg4="typename Arch::__kernel_loff_t") # int getdents(unsigned int fd, struct linux_dirent *dirp, unsigned int #count); # # The system call getdents() reads several linux_dirent structures # from the directory referred to by the open file descriptor fd into # the buffer pointed to by dirp. The argument count specifies the # size of that buffer. getdents = IrregularEmulatedSyscall(x86=141, x64=78) # int select(int nfds, fd_set *readfds, fd_set *writefds, fd_set *exceptfds, #struct timeval *timeout); # # select() and pselect() allow a program to monitor multiple file # descriptors, waiting until one or more of the file descriptors # become "ready" for some class of I/O operation (e.g., input # possible). A file descriptor is considered ready if it is possible # to perform the corresponding I/O operation (e.g., read(2)) without # blocking. _newselect = IrregularEmulatedSyscall(x86=142) flock = EmulatedSyscall(x86=143, x64=73) # int msync(void *addr, size_t length, int flags); # # msync() flushes changes made to the in-core copy of a file that was # mapped into memory using mmap(2) back to disk. Without use of this # call there is no guarantee that changes are written back before # munmap(2) is called. To be more precise, the part of the file that # corresponds to the memory area starting at addr and having length # length is updated. msync = EmulatedSyscall(x86=144, x64=26) # ssize_t readv(int fd, const struct iovec *iov, int iovcnt); # # The readv() system call reads iovcnt buffers from the file associated # with the file descriptor fd into the buffers described by iov ("scatter # input"). readv = IrregularEmulatedSyscall(x86=145, x64=19) # ssize_t writev(int fd, const struct iovec *iov, int iovcnt) # # The writev() function writes iovcnt buffers of data described by # iov to the file associated with the file descriptor fd ("gather # output"). writev = IrregularEmulatedSyscall(x86=146, x64=20) # pid_t getsid(pid_t pid); # # getsid(0) returns the session ID of the calling process. getsid(p) # returns the session ID of the process with process ID p. (The session # ID of a process is the process group ID of the session leader.) getsid = EmulatedSyscall(x86=147, x64=124) # int fdatasync(int fd) # # fdatasync() is similar to fsync(), but does not flush modified # metadata unless that metadata is needed in order to allow a # subsequent data retrieval to be correctly handled. For example, # changes to st_atime or st_mtime (respectively, time of last access # and time of last modification; see stat(2)) do not require flushing # because they are not necessary for a subsequent data read to be # handled correctly. On the other hand, a change to the file size # (st_size, as made by say ftruncate(2)), would require a metadata # flush fdatasync = EmulatedSyscall(x86=148, x64=75) # int _sysctl(struct __syscall_args* args); # # The _sysctl() call reads and/or writes kernel parameters. For example, # the hostname, or the maximum number of open files. # # Often not supported in modern kernels, so can return ENOSYS. _sysctl = IrregularEmulatedSyscall(x86=149, x64=156) mlock = EmulatedSyscall(x86=150, x64=149) munlock = EmulatedSyscall(x86=151, x64=150) mlockall = EmulatedSyscall(x86=152, x64=151) munlockall = EmulatedSyscall(x86=153, x64=152) sched_setparam = EmulatedSyscall(x86=154, x64=142) # int sched_getparam(pid_t pid, struct sched_param *param) # # sched_getparam() retrieves the scheduling parameters for the # process i dentified by pid. If pid is zero, then the parameters of # the calling process are retrieved. sched_getparam = EmulatedSyscall(x86=155, x64=143, arg2="typename Arch::sched_param") # int sched_setscheduler(pid_t pid, int policy, const struct sched_param #*param); # # sched_setscheduler() sets both the scheduling policy and the # associated parameters for the process whose ID is specified in pid. # If pid equals zero, the scheduling policy and parameters of the # calling process will be set. The interpretation of the argument # param depends on the selected policy. sched_setscheduler = EmulatedSyscall(x86=156, x64=144) # int sched_getscheduler(pid_t pid); # # sched_getscheduler() queries the scheduling policy currently # applied to the process identified by pid. If pid equals zero, the # policy of the calling process will be retrieved. sched_getscheduler = EmulatedSyscall(x86=157, x64=145) # int sched_yield(void) # # sched_yield() causes the calling thread to relinquish the CPU. The # thread is moved to the end of the queue for its static priority and # a new thread gets to run. sched_yield = IrregularEmulatedSyscall(x86=158, x64=24) # int sched_get_priority_max(int policy) # # sched_get_priority_max() returns the maximum priority value that # can be used with the scheduling algorithm identified by policy. sched_get_priority_max = EmulatedSyscall(x86=159, x64=146) # int sched_get_priority_min(int policy) # # sched_get_priority_min() returns the minimum priority value that # can be used with the scheduling algorithm identified by policy. sched_get_priority_min = EmulatedSyscall(x86=160, x64=147) sched_rr_get_interval = UnsupportedSyscall(x86=161, x64=148) # int nanosleep(const struct timespec *req, struct timespec *rem) # # nanosleep() suspends the execution of the calling thread until # either at least the time specified in *req has elapsed, or the # delivery of a signal that triggers the invocation of a handler in # the calling thread or that ter- minates the process. # # CHECKED: trace->recorded_regs.ecx != NULL nanosleep = IrregularEmulatedSyscall(x86=162, x64=35) # void *mremap(void *old_address, size_t old_size, size_t new_size, int flags, #... ( void *new_address )); # # mremap() expands (or shrinks) an existing memory mapping, # potentially moving it at the same time (controlled by the flags # argument and the available virtual address space). mremap = IrregularEmulatedSyscall(x86=163, x64=25) # int setresuid(uid_t ruid, uid_t euid, uid_t suid); # # setresuid() sets the real user ID, the effective user ID, and the # saved set-user-ID of the calling process. setresuid = EmulatedSyscall(x86=164, x64=117) getresuid = EmulatedSyscall(x86=165, x64=118, arg1="typename Arch::legacy_uid_t", arg2="typename Arch::legacy_uid_t", arg3="typename Arch::legacy_uid_t") vm86 = UnsupportedSyscall(x86=166) query_module = UnsupportedSyscall(x86=167, x64=178) # int poll(struct pollfd *fds, nfds_t nfds, int timeout) # int ppoll(struct pollfd *fds, nfds_t nfds, # const struct timespec *timeout_ts, # const sigset_t *sigmask); # # poll() performs a similar task to select(2): it waits for one of a # set of file descriptors to become ready to perform I/O. # # The relationship between poll() and ppoll() is analogous to the # relationship between select(2) and pselect(2): like pselect(2), # ppoll() allows an application to safely wait until either a file # descriptor becomes ready or until a signal is caught. # # XXX is this irregular? CHECKED: (trace->recorded_regs.eax > 0) poll = IrregularEmulatedSyscall(x86=168, x64=7) nfsservctl = UnsupportedSyscall(x86=169, x64=180) # int setresgid(gid_t rgid, gid_t egid, gid_t sgid); # # setresgid() sets the real GID, effective GID, and saved # set-group-ID of the calling process. setresgid = EmulatedSyscall(x86=170, x64=119) getresgid = EmulatedSyscall(x86=171, x64=120, arg1="typename Arch::legacy_gid_t", arg2="typename Arch::legacy_gid_t", arg3="typename Arch::legacy_gid_t") # int prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long #arg4, unsigned long arg5); # # prctl() is called with a first argument describing what to do (with # values defined in ), and further arguments with a # significance depending on the first one. # prctl = IrregularEmulatedSyscall(x86=172, x64=157) rt_sigreturn = IrregularEmulatedSyscall(x86=173, x64=15) rt_sigaction = EmulatedSyscall(x86=174, x64=13, arg3="typename Arch::kernel_sigaction") rt_sigprocmask = IrregularEmulatedSyscall(x86=175, x64=14) # int sigpending(sigset_t *set); # # sigpending() returns the set of signals that are pending for # delivery to the calling thread (i.e., the signals which have been # raised while blocked). The mask of pending signals is returned in # set. rt_sigpending = IrregularEmulatedSyscall(x86=176, x64=127) # int sigtimedwait(const sigset_t *set, siginfo_t *info, # const struct timespec *timeout); # # sigwaitinfo() suspends execution of the calling thread until one of # the signals in set is pending (If one of the signals in set is # already pending for the calling thread, sigwaitinfo() will return # immedi ately.) # # sigtimedwait() operates in exactly the same way as sigwaitinfo() # except that it has an additional argument, timeout, which specifies # a minimum interval for which the thread is suspended waiting for a # signal. rt_sigtimedwait = IrregularEmulatedSyscall(x86=177, x64=128) # int sigsuspend(const sigset_t *mask); # # sigsuspend() temporarily replaces the signal mask of the calling # process with the mask given by mask and then suspends the process # until delivery of a signal whose action is to invoke a signal # handler or to terminate a process. rt_sigsuspend = IrregularEmulatedSyscall(x86=179, x64=130) # ssize_t pread(int fd, void *buf, size_t count, off_t offset); # # pread, pwrite - read from or write to a file descriptor at a given # offset pread64 = IrregularEmulatedSyscall(x86=180, x64=17) pwrite64 = EmulatedSyscall(x86=181, x64=18) chown = EmulatedSyscall(x86=182, x64=92) # char *getwd(char *buf); # # These functions return a null-terminated string containing an # absolute pathname that is the current working directory of the # calling process. The pathname is returned as the function result # and via the argument buf, if present. getcwd = IrregularEmulatedSyscall(x86=183, x64=79) capget = IrregularEmulatedSyscall(x86=184, x64=125) capset = EmulatedSyscall(x86=185, x64=126) # int sigaltstack(const stack_t *ss, stack_t *oss) # # sigaltstack() allows a process to define a new alternate signal # stack and/or retrieve the state of an existing alternate signal # stack. An alternate signal stack is used during the execution of a # signal handler if the establishment of that handler (see # sigaction(2)) requested it. sigaltstack = EmulatedSyscall(x86=186, x64=131, arg2="typename Arch::stack_t") sendfile = IrregularEmulatedSyscall(x86=187, x64=40) getpmsg = InvalidSyscall(x86=188, x64=181) putpmsg = InvalidSyscall(x86=189, x64=182) vfork = IrregularEmulatedSyscall(x86=190, x64=58) # int getrlimit(int resource, struct rlimit *rlim) # # getrlimit() and setrlimit() get and set resource limits # respectively. Each resource has an associated soft and hard limit, # as defined by the rlimit structure (the rlim argument to both # getrlimit() and setrlimit()): ugetrlimit = EmulatedSyscall(x86=191, arg2="typename Arch::rlimit") mmap2 = IrregularEmulatedSyscall(x86=192) truncate64 = EmulatedSyscall(x86=193) ftruncate64 = EmulatedSyscall(x86=194) # int stat(const char *path, struct stat *buf); # # stat() stats the file pointed to by path and fills in buf. stat64 = EmulatedSyscall(x86=195, arg2="struct Arch::stat64") # int lstat(const char *path, struct stat *buf); # # lstat() is identical to stat(), except that if path is a symbolic # link, then the link itself is stat-ed, not the file that it refers # to. lstat64 = EmulatedSyscall(x86=196, arg2="struct Arch::stat64") # int fstat(int fd, struct stat *buf) # # fstat() is identical to stat(), except that the file to be stat-ed # is specified by the file descriptor fd. fstat64 = EmulatedSyscall(x86=197, arg2="struct Arch::stat64") lchown32 = EmulatedSyscall(x86=198) # uid_t getuid(void); # # getuid() returns the real user ID of the calling process getuid32 = EmulatedSyscall(x86=199) # gid_t getgid(void); # # getgid() returns the real group ID of the calling process. getgid32 = EmulatedSyscall(x86=200) # uid_t geteuid(void); # # geteuid() returns the effective user ID of the calling process. geteuid32 = EmulatedSyscall(x86=201) # gid_t getegid(void); # # getegid() returns the effective group ID of the calling process. getegid32 = EmulatedSyscall(x86=202) setreuid32 = EmulatedSyscall(x86=203) # int setregid(gid_t rgid, gid_t egid) # # setreuid() sets real and effective user IDs of the calling process setregid32 = EmulatedSyscall(x86=204) # int getgroups(int size, gid_t list[]); # # getgroups() returns the supplementary group IDs of the calling # process in list. The argument size should be set to the maximum # number of items that can be stored in the buffer pointed to by # list. If the calling process is a member of more than size # supplementary groups, then an error results. It is unspecified # whether the effective group ID of the calling process is included # in the returned list. (Thus, an application should also call # getegid(2) and add or remove the resulting value.) # # If size is zero, list is not modified, but the total number of # supplementary group IDs for the process is returned. This allows # the caller to determine the size of a dynamically allocated list to # be used in a further call to getgroups(). getgroups32 = IrregularEmulatedSyscall(x86=205) setgroups32 = EmulatedSyscall(x86=206) fchown32 = EmulatedSyscall(x86=207) # int setresuid32(uid_t ruid, uid_t euid, uid_t suid); # # setresuid() sets the real user ID, the effective user ID, and the # saved set-user-ID of the calling process. setresuid32 = EmulatedSyscall(x86=208) # int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) # # getresuid() returns the real UID, the effective UID, and the saved # set- user-ID of the calling process, in the arguments ruid, euid, # and suid, respectively. getresgid() performs the analogous task # for the process's group IDs. getresuid32 = EmulatedSyscall(x86=209, arg1="typename Arch::uid_t", arg2="typename Arch::uid_t", arg3="typename Arch::uid_t") # int setresgid32(gid_t rgid, gid_t egid, gid_t sgid); # # setresgid() sets the real GID, effective GID, and saved # set-group-ID of the calling process. setresgid32 = EmulatedSyscall(x86=210) # int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid); # # getresuid() returns the real UID, the effective UID, and the saved # set-user-ID of the calling process, in the arguments ruid, euid, # and suid, respectively. getresgid() performs the analogous task # for the process's group IDs. @return: On success, zero is # returned. On error, -1 is returned, and errno is set # appropriately. getresgid32 = EmulatedSyscall(x86=211, arg1="typename Arch::gid_t", arg2="typename Arch::gid_t", arg3="typename Arch::gid_t") chown32 = EmulatedSyscall(x86=212) setuid32 = EmulatedSyscall(x86=213) setgid32 = EmulatedSyscall(x86=214) setfsuid32 = EmulatedSyscall(x86=215) setfsgid32 = EmulatedSyscall(x86=216) pivot_root = UnsupportedSyscall(x86=217, x64=155) mincore = IrregularEmulatedSyscall(x86=218, x64=27) # int madvise(void *addr, size_t length, int advice); # # The madvise() system call advises the kernel about how to handle # paging input/output in the address range beginning at address addr # and with size length bytes. It allows an application to tell the # kernel how it expects to use some mapped or shared memory areas, so # that the kernel can choose appropriate read-ahead and caching # techniques. # The man page says "This call does not influence the semantics of the # application (except in the case of MADV_DONTNEED)", but that is a lie. madvise = IrregularEmulatedSyscall(x86=219, x64=28) getdents64 = IrregularEmulatedSyscall(x86=220, x64=217) # int fcntl(int fd, int cmd, ... ( arg )); # # fcntl() performs one of the operations described below on the open # file descriptor fd. The operation is determined by cmd. fcntl() # can take an optional third argument. Whether or not this argument # is required is determined by cmd. The required argument type is # indicated in parentheses after each cmd name (in most cases, the # required type is long, and we identify the argument using the name # arg), or void is specified if the argument is not required. fcntl64 = IrregularEmulatedSyscall(x86=221) # pid_t gettid(void); # # gettid() returns the caller's thread ID (TID). gettid = EmulatedSyscall(x86=224, x64=186) # ssize_t readahead(int fd, off64_t offset, size_t count); # # readahead() populates the page cache with data from a file so that # subsequent reads from that file will not block on disk I/O. The fd # argument is a file descriptor identifying the file which is to be # read. The offset argu- ment specifies the starting point from # which data is to be read and count specifies the number of bytes to # be read. I/O is performed in whole pages, so that offset is # effectively rounded down to a page boundary and bytes are read up # to the next page boundary greater than or equal to (offset+count). # readahead() does not read beyond the end of the file. readahead() # blocks until the specified data has been read. The current file # offset of the open file referred to by fd is left unchanged. readahead = EmulatedSyscall(x86=225, x64=187) setxattr = EmulatedSyscall(x86=226, x64=188) lsetxattr = EmulatedSyscall(x86=227, x64=189) fsetxattr = EmulatedSyscall(x86=228, x64=190) # ssize_t getxattr(const char *path, const char *name, # void *value, size_t size); # ssize_t lgetxattr(const char *path, const char *name, # void *value, size_t size); # ssize_t fgetxattr(int fd, const char *name, # void *value, size_t size); # # getxattr() retrieves the value of the extended attribute identified # by name and associated with the given path in the file system. The # length of the attribute value is returned. getxattr = IrregularEmulatedSyscall(x86=229, x64=191) lgetxattr = IrregularEmulatedSyscall(x86=230, x64=192) fgetxattr = IrregularEmulatedSyscall(x86=231, x64=193) listxattr = IrregularEmulatedSyscall(x86=232, x64=194) llistxattr = IrregularEmulatedSyscall(x86=233, x64=195) flistxattr = IrregularEmulatedSyscall(x86=234, x64=196) removexattr = EmulatedSyscall(x86=235, x64=197) lremovexattr = EmulatedSyscall(x86=236, x64=198) fremovexattr = EmulatedSyscall(x86=237, x64=199) tkill = UnsupportedSyscall(x86=238, x64=200) # ssize_t sendfile64 (int __out_fd, int __in_fd, __off64_t *__offset, size_t #__count); # # Send up to COUNT bytes from file associated with IN_FD starting at # *OFFSET to descriptor OUT_FD. Set *OFFSET to the IN_FD's file position # following the read bytes. If OFFSET is a null pointer, use the normal # file position instead. Return the number of written bytes, or -1 in # case of error. sendfile64 = IrregularEmulatedSyscall(x86=239) # int futex(int *uaddr, int op, int val, const struct timespec *timeout, int #*uaddr2, int val3); # # The futex() system call provides a method for a program to wait for # a value at a given address to change, and a method to wake up # anyone waiting on a particular address (while the addresses for the # same memory in separate processes may not be equal, the kernel # maps them internally so the same memory mapped in different # locations will correspond for futex() calls). This system call is # typically used to implement the contended case of a lock in shared # memory, as described in futex(7). futex = IrregularEmulatedSyscall(x86=240, x64=202) # int sched_getaffinity(pid_t pid, size_t cpusetsize, cpu_set_t *mask); # # sched_setaffinity() sets the CPU affinity mask of the process whose # ID is pid to the value specified by mask. If pid is zero, then the # calling process is used. The argument cpusetsize is the length # (in bytes) of the data pointed to by mask. Normally this argument # would be specified as sizeof(cpu_set_t). sched_setaffinity = IrregularEmulatedSyscall(x86=241, x64=203) # int sched_getaffinity(pid_t pid, size_t cpusetsize, cpu_set_t *mask); # # sched_getaffinity() writes the affinity mask of the process whose # ID is pid into the cpu_set_t structure pointed to by mask. The # cpusetsize argument specifies the size (in bytes) of mask. If pid # is zero, then the mask of the calling process is returned. sched_getaffinity = IrregularEmulatedSyscall(x86=242, x64=204) # int set_thread_area(struct user_desc *u_info) # # set_thread_area() sets an entry in the current thread's Thread Local # Storage (TLS) array. The TLS array entry set by set_thread_area() # corresponds to the value of u_info->entry_number passed in by the # user. If this value is in bounds, set_thread_area() copies the TLS # descriptor pointed to by u_info into the thread's TLS array. # # When set_thread_area() is passed an entry_number of -1, it uses a free # TLS entry. If set_thread_area() finds a free TLS entry, the value of # u_info->entry_number is set upon return to show which entry was # changed. set_thread_area = IrregularEmulatedSyscall(x86=243, x64=205) get_thread_area = UnsupportedSyscall(x86=244, x64=211) io_setup = UnsupportedSyscall(x86=245, x64=206) io_destroy = UnsupportedSyscall(x86=246, x64=207) io_getevents = UnsupportedSyscall(x86=247, x64=208) io_submit = UnsupportedSyscall(x86=248, x64=209) io_cancel = UnsupportedSyscall(x86=249, x64=210) # int posix_fadvise(int fd, off_t offset, off_t len, int advice); # # Programs can use posix_fadvise() to announce an intention to access # file data in a specific pattern in the future, thus allowing the # kernel to perform appropriate optimizations. fadvise64 = EmulatedSyscall(x86=250, x64=221) # void exit_group(int status) # # This system call is equivalent to exit(2) except that it terminates # not only the calling thread, but all threads in the calling # process's thread group. exit_group = IrregularEmulatedSyscall(x86=252, x64=231) lookup_dcookie = UnsupportedSyscall(x86=253, x64=212) # int epoll_create(int size); # # epoll_create() creates an epoll "instance", requesting the kernel # to allocate an event backing store dimensioned for size # descriptors. The size is not the maximum size of the backing store # but just a hint to the kernel about how to dimension internal # structures. When no longer required, the file descriptor returned # by epoll_create() should be closed by using close(2). epoll_create = EmulatedSyscall(x86=254, x64=213) # int epoll_ctl(int epfd, int op, int fd, struct epoll_event *event) # # This system call performs control operations on the epoll instance # referred to by the file descriptor epfd. It requests that the # operation op be performed for the target file descriptor, fd. epoll_ctl = EmulatedSyscall(x86=255, x64=233) # int epoll_wait(int epfd, struct epoll_event *events, int maxevents, int #timeout); # # The epoll_wait() system call waits for events on the epoll instance # referred to by the file descriptor epfd. The memory area pointed # to by events will contain the events that will be available for the # caller. Up to maxevents are returned by epoll_wait(). The # maxevents argument must be greater than zero. # # XXX is this irregular? CHECKED: (trace->recorded_regs.eax >= 0) epoll_wait = IrregularEmulatedSyscall(x86=256, x64=232) remap_file_pages = UnsupportedSyscall(x86=257, x64=216) # long set_tid_address(int *tidptr); # # The kernel keeps for each process two values called set_child_tid # and clear_child_tid that are NULL by default. # # If a process is started using clone(2) with the CLONE_CHILD_SETTID # flag, set_child_tid is set to child_tidptr, the fifth argument of # that system call. # # When set_child_tid is set, the very first thing the new process # does is writing its PID at this address. set_tid_address = EmulatedSyscall(x86=258, x64=218) timer_create = EmulatedSyscall(x86=259, x64=222, arg3="typename Arch::__kernel_timer_t") timer_settime = EmulatedSyscall(x86=260, x64=223, arg4="typename Arch::itimerspec") timer_gettime = EmulatedSyscall(x86=261, x64=224, arg2="typename Arch::itimerspec") timer_getoverrun = EmulatedSyscall(x86=262, x64=225) timer_delete = EmulatedSyscall(x86=263, x64=226) clock_settime = UnsupportedSyscall(x86=264, x64=227) # int clock_gettime(clockid_t clk_id, struct timespec *tp); # # The functions clock_gettime() and clock_settime() retrieve and set # the time of the specified clock clk_id. clock_gettime = EmulatedSyscall(x86=265, x64=228, arg2="typename Arch::timespec") # int clock_getres(clockid_t clk_id, struct timespec *res) # # The function clock_getres() finds the resolution (precision) of the # specified clock clk_id, and, if res is non-NULL, stores it in the # struct timespec pointed to by res. The resolution of clocks # depends on the implementation and cannot be configured by a # particular process. If the time value pointed to by the argument # tp of clock_settime() is not a multiple of res, then it is # truncated to a multiple of res. clock_getres = EmulatedSyscall(x86=266, x64=229, arg2="typename Arch::timespec") clock_nanosleep = IrregularEmulatedSyscall(x86=267, x64=230) # int statfs(const char *path, struct statfs *buf) # # The function statfs() returns information about a mounted file # system. path is the pathname of any file within the mounted file # system. buf is a pointer to a statfs structure defined # approximately as follows... # # FIXME: we use arg3() here, although according to man pages this system # call has only 2 paramaters. However, strace tells another story... statfs64 = EmulatedSyscall(x86=268, arg3="struct Arch::statfs64") fstatfs64 = EmulatedSyscall(x86=269, arg3="struct Arch::statfs64") # int tgkill(int tgid, int tid, int sig) # # tgkill() sends the signal sig to the thread with the thread ID tid # in the thread group tgid. (By contrast, kill(2) can only be used # to send a signal to a process (i.e., thread group) as a whole, and # the signal will be delivered to an arbitrary thread within that # process.) tgkill = EmulatedSyscall(x86=270, x64=234) # int utimes(const char *filename, const struct timeval times[2]) # # The utime() system call changes the access and modification times # of the inode specified by filename to the actime and modtime fields # of times respectively. # utimes = EmulatedSyscall(x86=271, x64=235) fadvise64_64 = EmulatedSyscall(x86=272) vserver = InvalidSyscall(x86=273, x64=236) mbind = EmulatedSyscall(x86=274, x64=237) get_mempolicy = UnsupportedSyscall(x86=275, x64=239) set_mempolicy = UnsupportedSyscall(x86=276, x64=238) mq_open = EmulatedSyscall(x86=277, x64=240) mq_unlink = EmulatedSyscall(x86=278, x64=241) mq_timedsend = EmulatedSyscall(x86=279, x64=242) mq_timedreceive = IrregularEmulatedSyscall(x86=280, x64=243) mq_notify = EmulatedSyscall(x86=281, x64=244) mq_getsetattr = EmulatedSyscall(x86=282, x64=245, arg3="struct Arch::mq_attr") kexec_load = UnsupportedSyscall(x86=283, x64=246) # int waitid(idtype_t idtype, id_t id, siginfo_t *infop, int options); # # If WNOHANG was specified in options and there were no children in a # waitable state, then waitid() returns 0 immediately and the state # of the siginfo_t structure pointed to by infop is unspecified. To # distinguish this case from that where a child was in a waitable # state, zero out the si_pid field before the call and check for a # nonzero value in this field after the call returns. waitid = IrregularEmulatedSyscall(x86=284, x64=247) add_key = UnsupportedSyscall(x86=286, x64=248) request_key = UnsupportedSyscall(x86=287, x64=249) keyctl = UnsupportedSyscall(x86=288, x64=250) ioprio_set = UnsupportedSyscall(x86=289, x64=251) ioprio_get = UnsupportedSyscall(x86=290, x64=252) # int inotify_init(void) # # inotify_init() initializes a new inotify instance and returns a # file descriptor associated with a new inotify event queue. inotify_init = EmulatedSyscall(x86=291, x64=253) # int inotify_add_watch(int fd, const char *pathname, uint32_t mask) # # inotify_add_watch() adds a new watch, or modifies an existing # watch, for the file whose location is specified in pathname; the # caller must have read permission for this file. The fd argument is # a file descrip tor referring to the inotify instance whose watch # list is to be modified. The events to be monitored for pathname # are specified in the mask bit-mask argument. See inotify(7) for a # description of the bits that can be set in mask. inotify_add_watch = EmulatedSyscall(x86=292, x64=254) # int inotify_rm_watch(int fd, uint32_t wd) # # inotify_rm_watch() removes the watch associated with the watch # descriptor wd from the inotify instance associated with the file # descriptor fd. inotify_rm_watch = EmulatedSyscall(x86=293, x64=255) migrate_pages = UnsupportedSyscall(x86=294, x64=256) # int openat(int dirfd, const char *pathname, int flags); # int openat(int dirfd, const char *pathname, int flags, mode_t mode); # # The openat() system call operates in exactly the same way as # open(2), except for the differences described in this manual page. openat = IrregularEmulatedSyscall(x86=295, x64=257) # int mkdirat(int dirfd, const char *pathname, mode_t mode); # # The mkdirat() system call operates in exactly the same way as # mkdir(2), except for the differences described in this manual # page.... mkdirat = EmulatedSyscall(x86=296, x64=258) mknodat = EmulatedSyscall(x86=297, x64=259) fchownat = EmulatedSyscall(x86=298, x64=260) futimesat = UnsupportedSyscall(x86=299, x64=261) # int fstatat(int dirfd, const char *pathname, struct stat *buf, int flags); # # The fstatat() system call operates in exactly the same way as # stat(2), except for the differences described in this manual # page.... fstatat64 = EmulatedSyscall(x86=300, x64=262, arg3="struct Arch::stat64") # int unlinkat(int dirfd, const char *pathname, int flags) # # The unlinkat() system call operates in exactly the same way as # either unlink(2) or rmdir(2) (depending on whether or not flags # includes the AT_REMOVEDIR flag) except for the differences # described in this manual page. unlinkat = EmulatedSyscall(x86=301, x64=263) renameat = EmulatedSyscall(x86=302, x64=264) linkat = EmulatedSyscall(x86=303, x64=265) symlinkat = EmulatedSyscall(x86=304, x64=266) readlinkat = IrregularEmulatedSyscall(x86=305, x64=267) fchmodat = EmulatedSyscall(x86=306, x64=268) # int faccessat(int dirfd, const char *pathname, int mode, int flags) # # The faccessat() system call operates in exactly the same way as # access(2), except for the differences described in this manual # page.... faccessat = EmulatedSyscall(x86=307, x64=269) pselect6 = IrregularEmulatedSyscall(x86=308, x64=270) ppoll = IrregularEmulatedSyscall(x86=309, x64=271) unshare = EmulatedSyscall(x86=310, x64=272) # long set_robust_list(struct robust_list_head *head, size_t len) # # The robust futex implementation needs to maintain per-thread lists # of robust futexes which are unlocked when the thread exits. These # lists are managed in user space, the kernel is only notified about # the location of the head of the list. # # set_robust_list sets the head of the list of robust futexes owned # by the current thread to head. len is the size of *head. set_robust_list = EmulatedSyscall(x86=311, x64=273) get_robust_list = EmulatedSyscall(x86=312, x64=274, arg2="typename Arch::unsigned_word", arg3="typename Arch::size_t") # ssize_t splice(int fd_in, loff_t *off_in, int fd_out, loff_t *off_out, #size_t len, unsigned int flags); # # splice() moves data between two file descriptors without copying # between kernel address space and user address space. It transfers # up to len bytes of data from the file descriptor fd_in to the file # descriptor fd_out, where one of the descriptors must refer to a # pipe. # # NB: the documentation doesn't mention it explicitly, but the |off| # params are actually inout params, and are updated with the new file # offset on return. # # NOTE: Technically, the following implementation is unsound for # programs that splice with stdin/stdout/stderr and have output # redirected during replay. But, *crickets*. splice = IrregularEmulatedSyscall(x86=313, x64=275) sync_file_range = UnsupportedSyscall(x86=314, x64=277) tee = UnsupportedSyscall(x86=315, x64=276) vmsplice = UnsupportedSyscall(x86=316, x64=278) move_pages = UnsupportedSyscall(x86=317, x64=279) getcpu = EmulatedSyscall(x86=318, x64=309, arg1="unsigned int", arg2="unsigned int") epoll_pwait = UnsupportedSyscall(x86=319, x64=281) # int utimensat(int dirfd, const char *pathname, const struct timespec #times[2], int flags); # # utimensat() and futimens() update the timestamps of a file with # nanosecond precision. This contrasts with the historical utime(2) # and utimes(2), which permit only second and microsecond precision, # respectively, when setting file timestamps. utimensat = EmulatedSyscall(x86=320, x64=280) # int signalfd(int fd, const sigset_t *mask, int flags); # There are two underlying Linux system calls: signalfd() and the more # recent signalfd4(). The former system call does not implement a flags # argument. The latter system call implements the flags values described # above. Starting with glibc 2.9, the signalfd() wrapper function will # use signalfd4() where it is available. signalfd = EmulatedSyscall(x86=321, x64=282) # int timerfd_create(int clockid, int flags); # # timerfd_create() creates a new timer object, and returns a file # descriptor that refers to that timer. timerfd_create = EmulatedSyscall(x86=322, x64=283) eventfd = EmulatedSyscall(x86=323, x64=284) # int fallocate(int fd, int mode, off_t offset, off_t len); # # fallocate() allows the caller to directly manipulate the allocated # disk space for the file referred to by fd for the byte range # starting at offset and continuing for len bytes fallocate = EmulatedSyscall(x86=324, x64=285) # int timerfd_settime(int fd, int flags, # const struct itimerspec *new_value, # struct itimerspec *old_value); # # timerfd_settime() arms (starts) or disarms (stops) the timer # referred to by the file descriptor fd. timerfd_settime = EmulatedSyscall(x86=325, x64=286, arg4="typename Arch::itimerspec") # int timerfd_gettime(int fd, struct itimerspec *curr_value); # # timerfd_gettime() returns, in curr_value, an itimerspec structure # that contains the current setting of the timer referred to by the # file descriptor fd. timerfd_gettime = EmulatedSyscall(x86=326, x64=287, arg2="typename Arch::itimerspec") # int signalfd(int fd, const sigset_t *mask, int flags); # There are two underlying Linux system calls: signalfd() and the more # recent signalfd4(). The former system call does not implement a flags # argument. The latter system call implements the flags values described # above. Starting with glibc 2.9, the signalfd() wrapper function will # use signalfd4() where it is available. signalfd4 = EmulatedSyscall(x86=327, x64=289) # int eventfd(unsigned int initval, int flags); # # eventfd() creates an "eventfd object" that can be used as an event # wait/notify mechanism by userspace applications, and by the kernel # to notify userspace applications of events. The object contains an # unsigned 64-bit integer (uint64_t) counter that is maintained by # the kernel. This counter is initialized with the value specified # in the argument initval. eventfd2 = EmulatedSyscall(x86=328, x64=290) # int epoll_create1(int flags); # # epoll_create1() is very similar to epoll_create. They are identical # if the passed flag value is 0, they are completely identical. The # flag argument can be used to set the close-on-exec flag on the new # file descriptor. epoll_create1 = EmulatedSyscall(x86=329, x64=291) dup3 = IrregularEmulatedSyscall(x86=330, x64=292) # int pipe2(int pipefd[2], int flags) # # If flags is 0, then pipe2() is the same as pipe(). The following # values can be bitwise ORed in flags to obtain different behavior... pipe2 = EmulatedSyscall(x86=331, x64=293, arg1="int[2]") inotify_init1 = EmulatedSyscall(x86=332, x64=294) preadv = IrregularEmulatedSyscall(x86=333, x64=295) pwritev = EmulatedSyscall(x86=334, x64=296) # int rt_sigqueueinfo(pid_t tgid, int sig, siginfo_t *uinfo); # int rt_tgsigqueueinfo(pid_t tgid, pid_t tid, int sig, # siginfo_t *uinfo); # # The rt_sigqueueinfo() and rt_tgsigqueueinfo() system calls are the # low-level interfaces used to send a signal plus data to a process # or thread. The receiver of the signal can obtain the accompanying # data by establishing a signal handler with the sigaction(2) # SA_SIGINFO flag. rt_sigqueueinfo = EmulatedSyscall(x86=178, x64=129) rt_tgsigqueueinfo = EmulatedSyscall(x86=335, x64=297) # int perf_event_open(struct perf_event_attr *attr, # pid_t pid, int cpu, int group_fd, # unsigned long flags); # # Given a list of parameters, perf_event_open() returns a file # descriptor, for use in subsequent system calls (read(2), mmap(2), # prctl(2), fcntl(2), etc.). perf_event_open = IrregularEmulatedSyscall(x86=336, x64=298) # int recvmmsg(int sockfd, struct mmsghdr *msgvec, # unsigned int vlen, unsigned int flags, # struct timespec *timeout); # # The recvmmsg() system call is an extension of recvmsg(2) that # allows the caller to receive multiple messages from a socket using # a single system call. (This has performance benefits for some # applications.) A further extension over recvmsg(2) is support for # a timeout on the receive operation. recvmmsg = IrregularEmulatedSyscall(x86=337, x64=299) fanotify_init = EmulatedSyscall(x86=338, x64=300) fanotify_mark = EmulatedSyscall(x86=339, x64=301) # int prlimit(pid_t pid, int resource, const struct rlimit *new_limit, struct #rlimit *old_limit); # # The Linux-specific prlimit() system call combines and extends the # functionality of setrlimit() and getrlimit(). It can be used to # both set and get the resource limits of an arbitrary process. # # NOTE: We should execute this system call, since this system call # can set a limit on the stack size that will trigger a synchronous SIGSEGV, # and we expect synchronous SIGSEGVs to be triggered by the kernel # during replay. prlimit64 = EmulatedSyscall(x86=340, x64=302, arg4="typename Arch::rlimit64") name_to_handle_at = UnsupportedSyscall(x86=341, x64=303) open_by_handle_at = UnsupportedSyscall(x86=342, x64=304) clock_adjtime = UnsupportedSyscall(x86=343, x64=305) syncfs = EmulatedSyscall(x86=344, x64=306) # int sendmmsg(int sockfd, struct mmsghdr *msgvec, unsigned int vlen, # unsigned int flags); # # The sendmmsg() system call is an extension of sendmsg(2) that # allows the caller to transmit multiple messages on a socket using a # single system call. (This has performance benefits for some # applications.) sendmmsg = IrregularEmulatedSyscall(x86=345, x64=307) setns = EmulatedSyscall(x86=346, x64=308) process_vm_readv = IrregularEmulatedSyscall(x86=347, x64=310) process_vm_writev = IrregularEmulatedSyscall(x86=348, x64=311) kcmp = EmulatedSyscall(x86=349, x64=312) finit_module = UnsupportedSyscall(x86=350, x64=313) sched_setattr = UnsupportedSyscall(x86=351, x64=314) sched_getattr = UnsupportedSyscall(x86=352, x64=315) renameat2 = EmulatedSyscall(x86=353, x64=316) seccomp = IrregularEmulatedSyscall(x86=354, x64=317) getrandom = IrregularEmulatedSyscall(x86=355, x64=318) memfd_create = EmulatedSyscall(x86=356, x64=319) bpf = UnsupportedSyscall(x86=357, x64=321) execveat = UnsupportedSyscall(x86=358, x64=322) userfaultfd = UnsupportedSyscall(x86=374, x64=323) membarrier = EmulatedSyscall(x86=375, x64=324) mlock2 = UnsupportedSyscall(x86=376, x64=325) copy_file_range = UnsupportedSyscall(x86=377, x64=326) preadv2 = UnsupportedSyscall(x86=378, x64=327) pwritev2 = UnsupportedSyscall(x86=379, x64=328) # restart_syscall is a little special. restart_syscall = RestartSyscall(x86=0, x64=219) rrcall_init_preload = IrregularEmulatedSyscall(x86=442, x64=442) rrcall_init_buffers = IrregularEmulatedSyscall(x86=443, x64=443) rrcall_notify_syscall_hook_exit = IrregularEmulatedSyscall(x86=444, x64=444) rrcall_notify_control_msg = IrregularEmulatedSyscall(x86=445, x64=445) # These syscalls are also subsumed under socketcall on x86. socket = EmulatedSyscall(x86=359, x64=41) connect = EmulatedSyscall(x86=362, x64=42) accept = IrregularEmulatedSyscall(x64=43) sendto = EmulatedSyscall(x86=369, x64=44) recvfrom = IrregularEmulatedSyscall(x86=371, x64=45) sendmsg = IrregularEmulatedSyscall(x86=370, x64=46) recvmsg = IrregularEmulatedSyscall(x86=372, x64=47) shutdown = EmulatedSyscall(x86=373, x64=48) bind = EmulatedSyscall(x86=361, x64=49) listen = EmulatedSyscall(x86=363, x64=50) getsockname = IrregularEmulatedSyscall(x86=367, x64=51) getpeername = IrregularEmulatedSyscall(x86=368, x64=52) socketpair = EmulatedSyscall(x86=360, x64=53, arg4="int[2]") setsockopt = IrregularEmulatedSyscall(x86=366, x64=54) getsockopt = IrregularEmulatedSyscall(x86=365, x64=55) accept4 = IrregularEmulatedSyscall(x86=364, x64=288) # These syscalls are subsumed under ipc on x86. shmget = EmulatedSyscall(x64=29) shmat = IrregularEmulatedSyscall(x64=30) shmctl = IrregularEmulatedSyscall(x64=31) semget = EmulatedSyscall(x64=64) semop = IrregularEmulatedSyscall(x64=65) semctl = IrregularEmulatedSyscall(x64=66) shmdt = IrregularEmulatedSyscall(x64=67) msgget = EmulatedSyscall(x64=68) msgsnd = IrregularEmulatedSyscall(x64=69) msgrcv = IrregularEmulatedSyscall(x64=70) msgctl = IrregularEmulatedSyscall(x64=71) semtimedop = IrregularEmulatedSyscall(x64=220) # These syscalls simply don't exist on x86. arch_prctl = IrregularEmulatedSyscall(x64=158) tuxcall = InvalidSyscall(x64=184) security = InvalidSyscall(x64=185) epoll_ctl_old = UnsupportedSyscall(x64=214) epoll_wait_old = UnsupportedSyscall(x64=215) def _syscalls(): for name, obj in globals().iteritems(): if isinstance(obj, BaseSyscall): yield name, obj def all(): return list(_syscalls()) def for_arch(arch): for name, obj in all(): if getattr(obj, arch) is not None: yield name, obj rr-4.4.0/src/test/000077500000000000000000000000001277367620400137265ustar00rootroot00000000000000rr-4.4.0/src/test/64bit_child.c000066400000000000000000000007621277367620400161720ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { /* Fork-and-exec 'echo'. The exec may fail if 'bash' is 64-bit and rr doesn't support 64-bit processes. That's fine; the test should still pass. We're testing that rr doesn't abort. */ FILE* f = popen("echo -n", "r"); while (1) { int ch = fgetc(f); if (ch < 0) { break; } putchar(ch); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/_llseek.c000066400000000000000000000006721277367620400155150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(__attribute__((unused)) int argc, char* argv[]) { int fd = open(argv[0], O_RDONLY); #ifdef SYS__llseek loff_t result = -1234; #endif test_assert(fd >= 0); #ifdef SYS__llseek test_assert(syscall(SYS__llseek, fd, 0, 0, &result, SEEK_SET) == 0); test_assert(result == 0); #endif atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/abort_nonmain.c000066400000000000000000000007301277367620400167200ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* kill_thread(__attribute__((unused)) void* dontcare) { atomic_puts("killing ..."); abort(); atomic_puts("FAILED: abort() didn't work"); return NULL; /* not reached */ } int main(void) { pthread_t t; pthread_create(&t, NULL, kill_thread, NULL); pthread_join(t, NULL); atomic_puts("FAILED: joined thread that should have died"); return 0; } rr-4.4.0/src/test/abort_nonmain.run000066400000000000000000000000661277367620400173040ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test 'killing...' rr-4.4.0/src/test/accept.c000066400000000000000000000043151277367620400153340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void client(const struct sockaddr_un* addr) { int clientfd; struct sockaddr_un a; socklen_t len = sizeof(a); char c; clientfd = socket(AF_UNIX, SOCK_STREAM, 0); test_assert(clientfd >= 0); test_assert(0 == connect(clientfd, (struct sockaddr*)addr, sizeof(*addr))); memset(&a, 0, sizeof(a)); test_assert(1 == recvfrom(clientfd, &c, 1, 0, &a, &len)); atomic_printf("recvfrom() -> %c from (%d,%s) len %d\n", c, a.sun_family, a.sun_path, len); test_assert(c == '!'); test_assert(len > 0); test_assert(addr->sun_family == a.sun_family); test_assert(!strcmp(addr->sun_path, a.sun_path)); exit(0); } static void server(int use_accept4, int pass_addr) { struct sockaddr_un addr; int listenfd; pid_t child; int servefd; struct sockaddr_un peer_addr; socklen_t len = sizeof(peer_addr); int status; struct sockaddr* peer_addr_ptr = pass_addr ? (struct sockaddr*)&peer_addr : NULL; socklen_t* len_ptr = pass_addr ? &len : NULL; memset(&addr, 0, sizeof(addr)); addr.sun_family = AF_UNIX; strncpy(addr.sun_path, "socket.unix", sizeof(addr.sun_path) - 1); test_assert(0 <= (listenfd = socket(AF_UNIX, SOCK_STREAM, 0))); test_assert(0 == bind(listenfd, (struct sockaddr*)&addr, sizeof(addr))); test_assert(0 == listen(listenfd, 1)); if (0 == (child = fork())) { client(&addr); test_assert("Not reached" && 0); } if (use_accept4) { test_assert(0 <= (servefd = accept4(listenfd, peer_addr_ptr, len_ptr, 0))); } else { test_assert(0 <= (servefd = accept(listenfd, peer_addr_ptr, len_ptr))); } if (pass_addr) { test_assert(AF_UNIX == peer_addr.sun_family); } test_assert(1 == send(servefd, "!", 1, 0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); unlink(addr.sun_path); close(servefd); close(listenfd); } int main(void) { int use_accept4, pass_addr; for (use_accept4 = 0; use_accept4 <= 1; ++use_accept4) { for (pass_addr = 0; pass_addr <= 1; ++pass_addr) { server(use_accept4, pass_addr); } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/alarm.c000066400000000000000000000016261277367620400151730ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} static volatile int caught_sig = 0; void catcher(__attribute__((unused)) int signum, __attribute__((unused)) siginfo_t* siginfo_ptr, __attribute__((unused)) void* ucontext_ptr) { caught_sig = signum; } int main(void) { struct sigaction sact; int counter; sigemptyset(&sact.sa_mask); sact.sa_flags = SA_SIGINFO; sact.sa_sigaction = catcher; sigaction(SIGALRM, &sact, NULL); alarm(1); /* timer will pop in 1 second */ for (counter = 0; counter >= 0 && !caught_sig; counter++) { if (counter % 100000 == 0) { write(STDOUT_FILENO, ".", 1); } } atomic_printf("\nSignal %d caught, Counter is %d\n", caught_sig, counter); test_assert(SIGALRM == caught_sig); breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/alarm2.c000066400000000000000000000010741277367620400152520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" void catcher(__attribute__((unused)) int signum, __attribute__((unused)) siginfo_t* siginfo_ptr, __attribute__((unused)) void* ucontext_ptr) { atomic_puts("EXIT-SUCCESS"); exit(0); } int main(void) { struct sigaction sact; int r = 0; sigemptyset(&sact.sa_mask); sact.sa_flags = SA_SIGINFO; sact.sa_sigaction = catcher; sigaction(SIGALRM, &sact, NULL); alarm(1); /* timer will pop in 1 second */ sleep(10); return r; } rr-4.4.0/src/test/alsa_ioctl.c000066400000000000000000000015031277367620400162030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #ifndef ALSA_DEVICE_DIRECTORY #define ALSA_DEVICE_DIRECTORY "/dev/snd/" #endif int main(void) { int fd = open(ALSA_DEVICE_DIRECTORY "control0", O_NONBLOCK | O_RDONLY); if (fd < 0) { test_assert(errno == EACCES || errno == ENOENT); } else { int* pversion; struct snd_ctl_card_info* info; ALLOCATE_GUARD(pversion, 'x'); *pversion = -1; test_assert(0 == ioctl(fd, SNDRV_CTL_IOCTL_PVERSION, pversion)); VERIFY_GUARD(pversion); test_assert(*pversion >= 0); ALLOCATE_GUARD(info, 1); test_assert(0 == ioctl(fd, SNDRV_CTL_IOCTL_CARD_INFO, info)); VERIFY_GUARD(info); test_assert(info->id[0] > 1); test_assert(info->driver[0] > 1); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/arch_prctl.c000066400000000000000000000004241277367620400162130ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { #ifdef __x86_64__ unsigned long addr; test_assert(0 == syscall(SYS_arch_prctl, ARCH_GET_FS, &addr)); #endif atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/args.c000066400000000000000000000006611277367620400150310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { test_assert(6 == argc); test_assert(!strcmp("-no", argv[1])); test_assert(!strcmp("--force-syscall-buffer=foo", argv[2])); test_assert(!strcmp("-c", argv[3])); test_assert(!strcmp("1000", argv[4])); test_assert(!strcmp("hello", argv[5])); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/args.run000066400000000000000000000001731277367620400154110ustar00rootroot00000000000000source `dirname $0`/util.sh record args$bitness "-no --force-syscall-buffer=foo -c 1000 hello" replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/async_kill_with_threads.c000066400000000000000000000005321277367620400207670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { sleep(1000); return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, start_thread, NULL); atomic_puts("EXIT-SUCCESS"); sleep(1000); return 0; } rr-4.4.0/src/test/async_kill_with_threads.run000066400000000000000000000001611277367620400213470ustar00rootroot00000000000000source `dirname $0`/util.sh # SIGKILL, wait 2.0s record_async_signal 9 2.0 $TESTNAME replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/async_kill_with_threads_main_running.c000066400000000000000000000005351277367620400235360ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { sleep(1000); return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, start_thread, NULL); atomic_puts("EXIT-SUCCESS"); while (1) { } return 0; } rr-4.4.0/src/test/async_kill_with_threads_main_running.run000066400000000000000000000001611277367620400241130ustar00rootroot00000000000000source `dirname $0`/util.sh # SIGKILL, wait 2.0s record_async_signal 9 2.0 $TESTNAME replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/async_kill_with_threads_thread_running.c000066400000000000000000000005351277367620400240610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { while (1) { } return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, start_thread, NULL); atomic_puts("EXIT-SUCCESS"); sleep(1000); return 0; } rr-4.4.0/src/test/async_kill_with_threads_thread_running.run000066400000000000000000000005441277367620400244430ustar00rootroot00000000000000source `dirname $0`/util.sh # SIGKILL, wait 6.0s # The timeout must be greater than rr's alarm threshold of 3s, because # the spinning-thread may not do any conditional branches so we rely # on the alarm fallback to ensure there's a context switch to the main # thread to print EXIT-SUCCESS. record_async_signal 9 6.0 $TESTNAME replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/async_segv.c000066400000000000000000000010221277367620400162260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handle_segv(int sig) { test_assert(SIGSEGV == sig); atomic_puts("EXIT-SUCCESS"); exit(0); } int main(void) { int dummy = 0, i; signal(SIGSEGV, handle_segv); /* No syscalls after here! (Up to the assert.) */ for (i = 1; i < (1 << 30); ++i) { dummy += (dummy + i) % 9735; } /* It's possible for SEGV to be delivered too late, so succeed anyway */ atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/async_segv.run000066400000000000000000000001601277367620400166120ustar00rootroot00000000000000source `dirname $0`/util.sh # SIGSEGV, wait 2.0s record_async_signal 11 2.0 $TESTNAME replay check EXIT-SUCCESS rr-4.4.0/src/test/async_segv_ignored.c000066400000000000000000000003351277367620400177430ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { signal(SIGSEGV, SIG_IGN); kill(getpid(), SIGSEGV); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/async_signal_syscalls.c000066400000000000000000000027101277367620400204610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static sig_atomic_t caught_usr1; static void handle_usr1(int sig) { test_assert(SIGUSR1 == sig); atomic_puts("caught usr1"); caught_usr1 = 1; } static void* do_thread(__attribute__((unused)) void* p) { while (1) { sched_yield(); } return NULL; } int main(int argc, char* argv[]) { struct timespec ts; struct timeval tv; int num_its; int i; pthread_t thread; /* Create an extra thread so context switches can happen and SCHED events will be recorded. */ pthread_create(&thread, NULL, do_thread, NULL); test_assert(argc == 2); num_its = atoi(argv[1]); test_assert(num_its > 0); atomic_printf("Running 2^%d iterations\n", num_its); signal(SIGUSR1, handle_usr1); /* Driver scripts choose the number of iterations based on * their needs. */ for (i = 0; i < 1 << num_its; ++i) { /* The odds of the signal being caught in the library * implementing these syscalls is very high. But even * if it's not caught there, this test will pass. */ clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); if (caught_usr1) { break; } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/async_signal_syscalls.run000066400000000000000000000006621277367620400210470ustar00rootroot00000000000000source `dirname $0`/util.sh # Without the syscallbuf, trying to record the large number of # syscalls in this test is impractical. skip_if_no_syscall_buf # 2^17 iterations is arbitrarily chosen to take ~3s on a fast machine record $TESTNAME 17 # Because of issue #184, replay takes longer than practical. So for # now we'll skip it and hope other tests exercise the relevant code # well enough. replay check 'EXIT-SUCCESS' passed rr-4.4.0/src/test/async_signal_syscalls2.c000066400000000000000000000034721277367620400205510ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define ITERATION_COUNT 10 static int usr1_count = 0; static int usr2_count = 0; static int alrm_count = 0; static volatile int done; static int ready_fds[2]; static void handle_signal(int sig) { switch (sig) { case SIGUSR1: usr1_count++; break; case SIGUSR2: usr2_count++; break; case SIGALRM: alrm_count++; break; default: test_assert(0); break; } test_assert(1 == write(ready_fds[1], "K", 1)); } static void* thread_start(__attribute__((unused)) void* p) { struct timespec ts = { 0, 1000 }; sigset_t mask; int i; sigemptyset(&mask); sigaddset(&mask, SIGUSR1); sigaddset(&mask, SIGUSR2); sigaddset(&mask, SIGALRM); test_assert(0 == pthread_sigmask(SIG_BLOCK, &mask, NULL)); for (i = 0; i < ITERATION_COUNT; ++i) { char buf[3]; int count = 3; nanosleep(&ts, NULL); if (i > 0) { while (count > 0) { int n = read(ready_fds[0], buf, count); test_assert(n > 0); count -= n; } } kill(getpid(), SIGUSR1); kill(getpid(), SIGUSR2); kill(getpid(), SIGALRM); } done = 1; return NULL; } int main(void) { struct timespec ts; pthread_t thread; int fd; char buf[10]; test_assert(0 == pipe(ready_fds)); fd = open("/dev/zero", O_RDONLY); signal(SIGUSR1, handle_signal); signal(SIGUSR2, handle_signal); signal(SIGALRM, handle_signal); pthread_create(&thread, NULL, thread_start, NULL); while (!done) { clock_gettime(CLOCK_MONOTONIC, &ts); read(fd, buf, sizeof(buf)); } test_assert(usr1_count == ITERATION_COUNT); test_assert(usr2_count == ITERATION_COUNT); test_assert(alrm_count == ITERATION_COUNT); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/async_signal_syscalls2.run000066400000000000000000000002661277367620400211310ustar00rootroot00000000000000source `dirname $0`/util.sh # Without the syscallbuf, trying to record the large number of # syscalls in this test is impractical. skip_if_no_syscall_buf compare_test EXIT-SUCCESS rr-4.4.0/src/test/async_signal_syscalls_100.run000066400000000000000000000007071277367620400214270ustar00rootroot00000000000000source `dirname $0`/util.sh # It's relatively easy to reproduce a CPUID divergence caused by lack # of CPU binding. GLOBAL_OPTIONS="$GLOBAL_OPTIONS_BIND_CPU" # Ensure that the test records some SCHED interrupt events. timeslice=100 RECORD_ARGS="-c$timeslice" # 2^9 iterations is arbitrarily chosen to record and replay < 15s, # both with and without the syscallbuf, on a fast machine. record async_signal_syscalls$bitness 9 replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/async_signal_syscalls_1000.run000066400000000000000000000005111277367620400215000ustar00rootroot00000000000000source `dirname $0`/util.sh # Ensure that the test records some USR_SCHED interrupt events. timeslice=1000 RECORD_ARGS="-c$timeslice" # 2^9 iterations is arbitrarily chosen to record and replay < 15s, # both with and without the syscallbuf, on a fast machine. record async_signal_syscalls$bitness 9 replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/async_signal_syscalls_siginfo.c000066400000000000000000000040151277367620400221770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static sig_atomic_t caught_usr1; static siginfo_t siginfo; #define MAGIC_NUMBER 0x7654321 /* positive */ static void handle_usr1(int sig, siginfo_t* si, __attribute__((unused)) void* context) { test_assert(SIGUSR1 == sig); test_assert(si->si_code == siginfo.si_code); test_assert(si->si_pid == siginfo.si_pid); test_assert(si->si_uid == siginfo.si_uid); test_assert(si->si_value.sival_int == siginfo.si_value.sival_int); caught_usr1 = 1; atomic_puts("caught usr1"); } static void* thread_start(__attribute__((unused)) void* p) { usleep(1000); siginfo.si_code = SI_QUEUE; siginfo.si_pid = getpid(); siginfo.si_uid = geteuid(); siginfo.si_value.sival_int = MAGIC_NUMBER; syscall(SYS_rt_tgsigqueueinfo, getpid(), getpid(), SIGUSR1, &siginfo); return NULL; } int main(int argc, char* argv[]) { struct timespec ts; struct timeval tv; int num_its; int i; struct sigaction sa; pthread_t thread; test_assert(argc == 2); num_its = atoi(argv[1]); test_assert(num_its > 0); atomic_printf("Running 2^%d iterations\n", num_its); sa.sa_flags = SA_SIGINFO; sigemptyset(&sa.sa_mask); sa.sa_sigaction = handle_usr1; sigaction(SIGUSR1, &sa, NULL); pthread_create(&thread, NULL, thread_start, NULL); /* Driver scripts choose the number of iterations based on * their needs. */ for (i = 0; i < 1 << num_its; ++i) { /* The odds of the signal being caught in the library * implementing these syscalls is very high. But even * if it's not caught there, this test will pass. */ clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); } pthread_join(thread, NULL); test_assert(caught_usr1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/async_signal_syscalls_siginfo.run000066400000000000000000000004321277367620400225600ustar00rootroot00000000000000source `dirname $0`/util.sh # Without the syscallbuf, trying to record the large number of # syscalls in this test is impractical. skip_if_no_syscall_buf # 2^17 iterations is arbitrarily chosen to take ~3s on a fast machine record $TESTNAME 17 replay check 'EXIT-SUCCESS' passed rr-4.4.0/src/test/async_usr1.c000066400000000000000000000011341277367620400161600ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static sig_atomic_t caught_usr1; static void handle_usr1(int sig) { test_assert(SIGUSR1 == sig); caught_usr1 = 1; atomic_puts("caught usr1"); } static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(void) { int dummy = 0, i; signal(SIGUSR1, handle_usr1); breakpoint(); /* NO SYSCALLS AFTER HERE! (Up to the assert.) */ for (i = 1; !caught_usr1 && i < (1 << 30); ++i) { dummy += (dummy + i) % 9735; } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/async_usr1.run000066400000000000000000000001621277367620400165420ustar00rootroot00000000000000source `dirname $0`/util.sh # SIGUSR1, wait 2.0s record_async_signal 10 2.0 $TESTNAME replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/at_threadexit.c000066400000000000000000000010461277367620400167200ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static pthread_key_t exit_key; static void thread_exit(__attribute__((unused)) void* data) { atomic_puts("thread exit"); } static void* thread(__attribute__((unused)) void* unused) { pthread_key_create(&exit_key, thread_exit); pthread_setspecific(exit_key, (void*)0x1); pthread_exit(NULL); } int main(void) { pthread_t t; pthread_create(&t, NULL, thread, NULL); pthread_join(t, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/backtrace_syscall.py000066400000000000000000000002771277367620400177570ustar00rootroot00000000000000from rrutil import * send_gdb('b __kernel_vsyscall') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('bt') expect_gdb(r'#0 [^_]*__kernel_vsyscall \(\)') ok() rr-4.4.0/src/test/backtrace_syscall.run000066400000000000000000000001121277367620400201170ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug backtrace_syscall rr-4.4.0/src/test/bad_breakpoint.run000066400000000000000000000003221277367620400174150ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness for i in $(seq 15 25); do echo Replaying to event $i ... debug restart_finish "-g $i" if [[ "$leave_data" == "y" ]]; then break fi done rr-4.4.0/src/test/bad_good_break.py000066400000000000000000000004371277367620400172060ustar00rootroot00000000000000from rrutil import * send_gdb('b bad_breakpoint') expect_gdb('Breakpoint 1') send_gdb('b good_breakpoint') expect_gdb('Breakpoint 2') send_gdb('c') # If we hit bad_breakpoint, then we never continue and never reach # good_breakpoint. expect_gdb('Breakpoint 2, good_breakpoint') ok() rr-4.4.0/src/test/bad_ip.c000066400000000000000000000010271277367620400153100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(int sig, siginfo_t* si, __attribute__((unused)) void* utp) { test_assert(SIGSEGV == sig && si->si_addr == (void*)0x42); atomic_puts("EXIT-SUCCESS"); _exit(0); } int main(void) { struct sigaction act; act.sa_sigaction = sighandler; sigemptyset(&act.sa_mask); act.sa_flags = SA_SIGINFO; sigaction(SIGSEGV, &act, NULL); __asm__ __volatile__("call 0x42"); return 0; } rr-4.4.0/src/test/bad_syscall.c000066400000000000000000000004601277367620400163520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int ret = syscall(-10); test_assert(-1 == ret && ENOSYS == errno); ret = syscall(9999); test_assert(-1 == ret && ENOSYS == errno); atomic_puts("EXIT-SUCCESS"); return ret; } rr-4.4.0/src/test/barrier.c000066400000000000000000000031531277367620400155220ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } static void hit_barrier(void) { int break_here = 1; (void)break_here; } static void joined_threads(void) { int break_here = 1; (void)break_here; } static void set_thread_name(int id) { char name_buf[16]; snprintf(name_buf, sizeof(name_buf), "BP-THREAD-%d", id); prctl(PR_SET_NAME, name_buf); } struct thread_data { int threadno; pthread_barrier_t* bar; }; static void* thread(void* datap) { struct thread_data* data = datap; pthread_barrier_t* bar = data->bar; set_thread_name(data->threadno); atomic_printf("thread %d launched with data %p\n", data->threadno, data); breakpoint(); pthread_barrier_wait(bar); pthread_barrier_wait(bar); atomic_printf("thread %d done\n", data->threadno); free(data); return NULL; } int main(void) { struct timeval tv; pthread_barrier_t bar; pthread_t threads[10]; size_t i; /* (Kick on the syscallbuf lib.) */ gettimeofday(&tv, NULL); pthread_barrier_init(&bar, NULL, 1 + ALEN(threads)); set_thread_name(1); for (i = 0; i < ALEN(threads); ++i) { struct thread_data* data = calloc(1, sizeof(*data)); data->threadno = i + 2; data->bar = &bar; pthread_create(&threads[i], NULL, thread, data); } pthread_barrier_wait(&bar); hit_barrier(); pthread_barrier_wait(&bar); atomic_puts("main done"); for (i = 0; i < ALEN(threads); ++i) { pthread_join(threads[i], NULL); } joined_threads(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/basic_test.run000066400000000000000000000000661277367620400165760ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test EXIT-SUCCESS rr-4.4.0/src/test/big_buffers.c000066400000000000000000000043161277367620400163530ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DUMMY_FILE "dummy.txt" #define BUF_SIZE (1 << 24) int main(void) { struct timeval ts; char* buf; int fd; int sockfds[2]; ssize_t nread; gettimeofday(&ts, NULL); buf = malloc(BUF_SIZE); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); /* Big read() buffer. */ fd = creat(DUMMY_FILE, 0600); write(fd, "foo", 3); close(fd); fd = open(DUMMY_FILE, O_RDONLY); unlink(DUMMY_FILE); nread = read(fd, buf, BUF_SIZE); atomic_printf("read %zu bytes: %s\n", nread, buf); test_assert(3 == nread && !strcmp(buf, "foo")); /* Big recv() buffer. */ write(sockfds[0], "bar", 3); nread = recv(sockfds[1], buf, BUF_SIZE, 0); atomic_printf("recv'd %zu bytes: %s\n", nread, buf); test_assert(3 == nread && !strcmp(buf, "bar")); /* Big recvfrom() buffer. */ write(sockfds[0], "baz", 3); nread = recvfrom(sockfds[1], buf, BUF_SIZE, 0, NULL, NULL); atomic_printf("recvfrom'd %zu bytes: %s\n", nread, buf); test_assert(3 == nread && !strcmp(buf, "baz")); { struct mmsghdr mmsg; struct iovec data; memset(&mmsg, 0, sizeof(mmsg)); memset(&data, 0, sizeof(data)); mmsg.msg_hdr.msg_iov = &data; mmsg.msg_hdr.msg_iovlen = 1; /* Big recvmsg() buffer. */ data.iov_base = "foo"; data.iov_len = 3; test_assert(3 <= sendmsg(sockfds[0], &mmsg.msg_hdr, 0)); data.iov_base = buf; data.iov_len = BUF_SIZE; nread = recvmsg(sockfds[1], &mmsg.msg_hdr, 0); atomic_printf("recvmsg'd %zu bytes: %s\n", nread, buf); test_assert(3 <= nread && !strcmp(buf, "foo")); /* Big recvmmsg() buffer. */ data.iov_base = "bar"; data.iov_len = 3; test_assert(1 == sendmmsg(sockfds[0], &mmsg, 1, 0)); data.iov_base = buf; data.iov_len = BUF_SIZE; test_assert(1 == recvmmsg(sockfds[1], &mmsg, 1, 0, NULL)); nread = mmsg.msg_len; atomic_printf("recvmmsg'd %zu bytes: %s\n", nread, buf); test_assert(3 <= nread && !strcmp(buf, "bar")); } /* TODO: tests for epoll_wait() / poll() / select() (/ * prctl()?), which are much less likely to have buffers big * enough to overflow scratch. */ atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/block.c000066400000000000000000000404711277367620400151720ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #define CTRLMSG_LEN CMSG_LEN(sizeof(int)) struct sendmmsg_arg { int sockfd; struct mmsghdr* msgvec; unsigned int vlen; unsigned int flags; }; struct recvmmsg_arg { int sockfd; struct mmsghdr* msgvec; unsigned int vlen; unsigned int flags; struct timespec* timeout; }; struct select_arg { int n_fds; fd_set* read; fd_set* write; fd_set* except; struct timeval* timeout; }; static void breakpoint(void) { int break_here = 1; (void)break_here; } static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; static int sockfds[2]; static const int msg_magic = 0x1337beef; const ssize_t num_sockbuf_bytes = 1 << 20; static void* reader_thread(__attribute__((unused)) void* dontcare) { char token = '!'; int sock = sockfds[1]; struct timeval ts; char c = '\0'; int i; gettimeofday(&ts, NULL); atomic_puts("r: acquiring mutex ..."); pthread_mutex_lock(&lock); atomic_puts("r: ... releasing mutex"); pthread_mutex_unlock(&lock); for (i = 0; i < 2; ++i) { atomic_puts("r: reading socket ..."); gettimeofday(&ts, NULL); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); ++token; } /* TODO: readv() support */ atomic_puts("r: recv'ing socket ..."); gettimeofday(&ts, NULL); test_assert(1 == recv(sock, &c, sizeof(c), 0)); atomic_printf("r: ... recv'd '%c'\n", c); test_assert(c == token); ++token; atomic_puts("r: recvfrom'ing socket ..."); test_assert(1 == recvfrom(sock, &c, sizeof(c), 0, NULL, NULL)); atomic_printf("r: ... recvfrom'd '%c'\n", c); test_assert(c == token); ++token; { struct sockaddr_un addr; socklen_t addrlen = sizeof(addr); atomic_puts("r: recvfrom(&sock)'ing socket ..."); test_assert(1 == recvfrom(sock, &c, sizeof(c), 0, &addr, &addrlen)); atomic_printf("r: ... recvfrom'd '%c' from sock len:%d\n", c, addrlen); test_assert(c == token); /* socketpair() AF_LOCAL sockets don't identify * themselves. */ test_assert(addrlen == 0); ++token; } { struct mmsghdr mmsg; struct iovec data; int magic = ~msg_magic; int err, ret; #if defined(SYS_socketcall) struct recvmmsg_arg arg; #endif memset(&mmsg, 0, sizeof(mmsg)); memset(&data, 0, sizeof(data)); data.iov_base = &magic; data.iov_len = sizeof(magic); mmsg.msg_hdr.msg_iov = &data; mmsg.msg_hdr.msg_iovlen = 1; struct cmsghdr* cmptr = (struct cmsghdr*)malloc(CTRLMSG_LEN); mmsg.msg_hdr.msg_control = cmptr; mmsg.msg_hdr.msg_controllen = CTRLMSG_LEN; atomic_puts("r: recvmsg with DONTWAIT ..."); ret = recvmsg(sock, &mmsg.msg_hdr, MSG_DONTWAIT); err = errno; atomic_printf("r: ... returned %d (%s/%d)\n", ret, strerror(err), err); test_assert(-1 == ret); test_assert(EWOULDBLOCK == err); test_assert(mmsg.msg_hdr.msg_iov == &data); atomic_puts("r: recmsg'ing socket ..."); test_assert(0 < recvmsg(sock, &mmsg.msg_hdr, 0)); atomic_printf("r: ... recvmsg'd 0x%x\n", magic); test_assert(msg_magic == magic); test_assert(mmsg.msg_hdr.msg_iov == &data); int fd; memcpy(&fd, CMSG_DATA(cmptr), sizeof(fd)); struct stat fs_new, fs_old; fstat(fd, &fs_new); fstat(STDERR_FILENO, &fs_old); // check if control msg was send successfully test_assert( fs_old.st_dev == fs_new.st_dev && fs_old.st_ino == fs_new.st_ino && fs_old.st_uid == fs_new.st_uid && fs_old.st_gid == fs_new.st_gid && fs_old.st_rdev == fs_new.st_rdev && fs_old.st_size == fs_new.st_size); magic = ~msg_magic; atomic_puts("r: recmmsg'ing socket ..."); breakpoint(); test_assert(1 == recvmmsg(sock, &mmsg, 1, 0, NULL)); atomic_printf("r: ... recvmmsg'd 0x%x (%u bytes)\n", magic, mmsg.msg_len); test_assert(msg_magic == magic); test_assert(mmsg.msg_hdr.msg_iov == &data); magic = ~msg_magic; #if defined(SYS_socketcall) memset(&arg, 0, sizeof(arg)); arg.sockfd = sock; arg.msgvec = &mmsg; arg.vlen = 1; test_assert(1 == syscall(SYS_socketcall, SYS_RECVMMSG, (void*)&arg)); #elif defined(SYS_recvmmsg) test_assert(1 == syscall(SYS_recvmmsg, sock, &mmsg, 1, 0, NULL)); #else #error unable to call recvmmsg #endif atomic_printf("r: ... recvmmsg'd(by socketcall) 0x%x (%u bytes)\n", magic, mmsg.msg_len); test_assert(msg_magic == magic); free(cmptr); } { struct msghdr msg; struct iovec iovs[2]; char c1 = '\0', c2 = '\0'; memset(&msg, 0, sizeof(msg)); iovs[0].iov_base = &c1; iovs[0].iov_len = sizeof(c1); iovs[1].iov_base = &c2; iovs[1].iov_len = sizeof(c2); msg.msg_iov = iovs; msg.msg_iovlen = sizeof(iovs) / sizeof(iovs[0]); atomic_puts("r: recmsg'ing socket with two iovs ..."); test_assert(2 == recvmsg(sock, &msg, 0)); atomic_printf("r: ... recvmsg'd '%c' and '%c'\n", c1, c2); test_assert(c1 == token); token++; test_assert(c2 == token); token++; } { struct pollfd pfd; atomic_puts("r: polling socket ..."); pfd.fd = sock; pfd.events = POLLIN; gettimeofday(&ts, NULL); poll(&pfd, 1, -1); atomic_puts("r: ... done, doing nonblocking read ..."); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); ++token; } { struct pollfd pfd; atomic_puts("r: polling socket ..."); pfd.fd = sock; pfd.events = POLLIN; gettimeofday(&ts, NULL); ppoll(&pfd, 1, NULL, NULL); atomic_puts("r: ... done, doing nonblocking read ..."); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); ++token; } { fd_set fds; const struct timeval infinity = { 1 << 30, 0 }; struct timeval tv = infinity; int ret; #if defined(__i386__) struct select_arg arg; #endif atomic_puts("r: select()ing socket ..."); FD_ZERO(&fds); FD_SET(sock, &fds); #if defined(__i386__) memset(&arg, 0, sizeof(arg)); arg.n_fds = sock + 1; arg.read = &fds; arg.write = NULL; arg.except = NULL; arg.timeout = &tv; ret = syscall(SYS_select, &arg); #else ret = syscall(SYS_select, sock + 1, &fds, NULL, NULL, &tv); #endif atomic_printf("r: ... returned %d; tv { %ld, %ld }\n", ret, tv.tv_sec, tv.tv_usec); test_assert(1 == ret); test_assert(FD_ISSET(sock, &fds)); test_assert(0 < tv.tv_sec && tv.tv_sec < infinity.tv_sec); atomic_puts("r: ... done, doing nonblocking read ..."); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); ++token; } { fd_set fds; const struct timeval infinity = { 1 << 30, 0 }; struct timeval tv = infinity; int ret; atomic_puts("r: select()ing socket ..."); FD_ZERO(&fds); FD_SET(sock, &fds); ret = select(sock + 1, &fds, NULL, NULL, &tv); atomic_printf("r: ... returned %d; tv { %ld, %ld }\n", ret, tv.tv_sec, tv.tv_usec); test_assert(1 == ret); test_assert(FD_ISSET(sock, &fds)); test_assert(0 < tv.tv_sec && tv.tv_sec < infinity.tv_sec); atomic_puts("r: ... done, doing nonblocking read ..."); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); ++token; } { int epfd; struct epoll_event ev; atomic_puts("r: epolling socket ..."); test_assert(0 <= (epfd = epoll_create(1 /*num events*/))); ev.events = EPOLLIN; ev.data.fd = sock; gettimeofday(&ts, NULL); test_assert(0 == epoll_ctl(epfd, EPOLL_CTL_ADD, ev.data.fd, &ev)); test_assert(1 == epoll_wait(epfd, &ev, 1, -1)); atomic_puts("r: ... done, doing nonblocking read ..."); test_assert(sock == ev.data.fd); test_assert(1 == epoll_wait(epfd, &ev, 1, -1)); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); ++token; close(epfd); } { char* buf = (char*)malloc(num_sockbuf_bytes); ssize_t nwritten = 0; struct iovec iov; ++token; memset(buf, token, num_sockbuf_bytes); atomic_printf("r: writing outbuf of size %zd ...\n", num_sockbuf_bytes); while (nwritten < num_sockbuf_bytes) { ssize_t this_write = write(sock, buf, num_sockbuf_bytes - nwritten); atomic_printf("r: wrote %zd bytes this time\n", this_write); nwritten += this_write; } ++token; memset(buf, token, num_sockbuf_bytes); iov.iov_base = buf; iov.iov_len = num_sockbuf_bytes; atomic_printf("r: writev()ing outbuf of size %zd ...\n", num_sockbuf_bytes); while (iov.iov_len > 0) { ssize_t this_write = writev(sock, &iov, 1); atomic_printf("r: wrote %zd bytes this time\n", this_write); iov.iov_len -= this_write; } free(buf); } atomic_puts("r: reading socket with masked signals ..."); { sigset_t old_mask, mask; sigfillset(&mask); test_assert(0 == pthread_sigmask(SIG_BLOCK, &mask, &old_mask)); test_assert(1 == read(sock, &c, sizeof(c))); test_assert(0 == pthread_sigmask(SIG_SETMASK, &old_mask, NULL)); } ++token; atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); /* Make the main thread wait on our join() */ atomic_puts("r: sleeping ..."); usleep(500000); return NULL; } static void read_all_chunks(int sock, char* buf, ssize_t num_sockbuf_bytes, char token) { ssize_t nread = 0; while (nread < num_sockbuf_bytes) { char* this_buf = buf + nread; ssize_t this_read = read(sock, this_buf, num_sockbuf_bytes - nread); int i; atomic_printf("M: read %zd bytes this time,\n", this_read); test_assert(this_read > 0); /* XXX: we would like to assert that the written data * was read in more than one chunk, which should imply * that at least one write() from the other thread * blocked, but it's possible for multiple write()s to * complete and fill the read buffer here before the * reader returns. */ /*test_assert(this_read < num_sockbuf_bytes);*/ for (i = nread; i < nread + this_read; ++i) { if (token != buf[i]) { atomic_printf("M: byte %d should be '%c', but is '%c'\n", i, token, buf[i]); } } nread += this_read; atomic_printf("M: %zd total so far\n", nread); } } int main(void) { char token = '!'; struct timeval ts; pthread_t reader; int sock; gettimeofday(&ts, NULL); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); sock = sockfds[0]; pthread_mutex_lock(&lock); pthread_create(&reader, NULL, reader_thread, NULL); /* Make the reader thread wait on its pthread_mutex_lock() */ atomic_puts("M: sleeping ..."); usleep(500000); atomic_puts("M: unlocking mutex ..."); pthread_mutex_unlock(&lock); atomic_puts("M: ... done"); /* Force a wait on read() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); test_assert(1 == write(sock, &token, sizeof(token))); ++token; atomic_puts("M: ... done"); /* Force a wait on readv() */ { struct iovec v = {.iov_base = &token, .iov_len = sizeof(token) }; atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("r: writev('%c')'ing socket ...\n", token); test_assert(1 == writev(sock, &v, 1)); ++token; atomic_puts("M: ... done"); } /* Force a wait on recv() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: sending '%c' to socket ...\n", token); send(sock, &token, sizeof(token), 0); ++token; atomic_puts("M: ... done"); /* Force a wait on recvfrom() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: sending '%c' to socket ...\n", token); send(sock, &token, sizeof(token), 0); ++token; atomic_puts("M: ... done"); /* Force a wait on recvfrom(&sock) */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: sending '%c' to socket ...\n", token); send(sock, &token, sizeof(token), 0); ++token; atomic_puts("M: ... done"); { struct mmsghdr mmsg; struct iovec data; int magic = msg_magic; #if defined(SYS_socketcall) struct sendmmsg_arg arg; #endif memset(&mmsg, 0, sizeof(mmsg)); memset(&data, 0, sizeof(data)); data.iov_base = &magic; data.iov_len = sizeof(magic); mmsg.msg_hdr.msg_iov = &data; mmsg.msg_hdr.msg_iovlen = 1; struct cmsghdr* cmptr = (struct cmsghdr*)malloc(CTRLMSG_LEN); // send a fd cmptr->cmsg_level = SOL_SOCKET; cmptr->cmsg_type = SCM_RIGHTS; cmptr->cmsg_len = CTRLMSG_LEN; mmsg.msg_hdr.msg_control = cmptr; mmsg.msg_hdr.msg_controllen = CTRLMSG_LEN; { const int fd = STDERR_FILENO; memcpy(CMSG_DATA(cmptr), &fd, sizeof(fd)); // send stderr as fd } /* Force a wait on recvmsg() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: sendmsg'ing 0x%x to socket ...\n", msg_magic); sendmsg(sock, &mmsg.msg_hdr, 0); atomic_puts("M: ... done"); /* Force a wait on recvmmsg() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: sendmmsg'ing 0x%x to socket ...\n", msg_magic); breakpoint(); sendmmsg(sock, &mmsg, 1, 0); atomic_printf("M: ... sent %u bytes\n", mmsg.msg_len); /* Force a wait on recvmmsg() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: sendmmsg'ing(by socketcall) 0x%x to socket ...\n", msg_magic); #if defined(SYS_socketcall) memset(&arg, 0, sizeof(arg)); arg.sockfd = sock; arg.msgvec = &mmsg; arg.vlen = 1; syscall(SYS_socketcall, SYS_SENDMMSG, (void*)&arg); #elif defined(SYS_sendmmsg) syscall(SYS_sendmmsg, sock, &mmsg, 1, 0); #else #error unable to call sendmmsg #endif free(cmptr); } { struct msghdr msg; struct iovec iovs[2]; char c1 = token++; char c2 = token++; memset(&msg, 0, sizeof(msg)); iovs[0].iov_base = &c1; iovs[0].iov_len = sizeof(c1); iovs[1].iov_base = &c2; iovs[1].iov_len = sizeof(c2); msg.msg_iov = iovs; msg.msg_iovlen = sizeof(iovs) / sizeof(iovs[0]); /* Force a wait on recvmsg(). */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing { '%c', '%c' } to socket ...\n", c1, c2); test_assert(2 == sendmsg(sock, &msg, 0)); atomic_puts("M: ... done"); } /* Force a wait on poll() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); ++token; atomic_puts("M: ... done"); /* Force a wait on ppoll() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); ++token; atomic_puts("M: ... done"); /* Force a wait on select(), raw syscall */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); ++token; atomic_puts("M: ... done"); /* Force a wait on select(), library call */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); ++token; atomic_puts("M: ... done"); /* Force a wait on epoll_wait() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); ++token; atomic_puts("M: ... done"); /* Force a wait on write() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: reading socket ...\n"); ++token; { char* buf = (char*)malloc(num_sockbuf_bytes); int i; for (i = 0; i < 2; ++i) { read_all_chunks(sock, buf, num_sockbuf_bytes, token); ++token; } free(buf); } atomic_puts("M: ... done"); /* Force a wait on read() */ atomic_puts("M: sleeping again ..."); usleep(500000); atomic_printf("M: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/block_clone_checkpoint.c000066400000000000000000000014141277367620400205530ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_SIZE 0x20000 static void breakpoint(void) { event_syscall(); } int main(void) { int i; int fd = open("tmp.txt", O_RDWR | O_CREAT | O_EXCL); char buf[BUF_SIZE]; test_assert(fd >= 0); test_assert(0 == unlink("tmp.txt")); for (i = 1; i <= 10; ++i) { memset(buf, i, sizeof(buf)); test_assert(sizeof(buf) == write(fd, buf, sizeof(buf))); } test_assert(0 == lseek(fd, 0, SEEK_SET)); memset(buf, 0, sizeof(buf)); for (i = 1; i <= 10; ++i) { test_assert(sizeof(buf) == read(fd, buf, sizeof(buf))); test_assert(buf[0] == i); test_assert(buf[sizeof(buf) - 1] == i); breakpoint(); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/block_clone_checkpoint.py000066400000000000000000000005551277367620400207660ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') expect_gdb('Checkpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('restart 1') expect_gdb('breakpoint') send_gdb('disable') send_gdb('c') expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/block_clone_checkpoint.run000066400000000000000000000000501277367620400211300ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/block_clone_interrupted.c000066400000000000000000000017071277367620400207760ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_COUNT (int)(0x20000 / sizeof(int)) #define FILE_BUFS 10 #define ITERATIONS 100 int main(void) { int i, j, count; int fd = open("tmp.txt", O_RDWR | O_CREAT | O_EXCL); int buf[BUF_COUNT]; test_assert(fd >= 0); test_assert(0 == unlink("tmp.txt")); count = 0; for (i = 0; i < FILE_BUFS; ++i) { for (j = 0; j < BUF_COUNT; ++j) { buf[j] = count++; } test_assert(sizeof(buf) == write(fd, buf, sizeof(buf))); } for (i = 0; i < ITERATIONS; ++i) { count = 0; test_assert(0 == lseek(fd, 0, SEEK_SET)); for (j = 0; j < FILE_BUFS; ++j) { memset(buf, 0, sizeof(buf)); test_assert(sizeof(buf) == read(fd, buf, sizeof(buf))); test_assert(buf[0] == count); test_assert(buf[BUF_COUNT - 1] == count + BUF_COUNT - 1); count += BUF_COUNT; } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/block_clone_interrupted.run000066400000000000000000000001141277367620400213470ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS="-c100" compare_test EXIT-SUCCESS rr-4.4.0/src/test/block_clone_syscallbuf_overflow.c000066400000000000000000000017431277367620400225230ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_COUNT (int)(0x20000 / sizeof(int)) #define FILE_BUFS 10 #define ITERATIONS 100 int main(void) { int i, j, count; int fd = open("tmp.txt", O_RDWR | O_CREAT | O_EXCL); int buf[BUF_COUNT]; test_assert(fd >= 0); test_assert(0 == unlink("tmp.txt")); count = 0; for (i = 0; i < FILE_BUFS; ++i) { for (j = 0; j < BUF_COUNT; ++j) { buf[j] = count++; } test_assert(sizeof(buf) == write(fd, buf, sizeof(buf))); } for (i = 0; i < ITERATIONS; ++i) { count = BUF_COUNT; test_assert(sizeof(buf) == lseek(fd, sizeof(buf), SEEK_SET)); for (j = 1; j < FILE_BUFS; ++j) { memset(buf, 0, sizeof(buf)); test_assert(sizeof(buf) == read(fd, buf, sizeof(buf))); test_assert(buf[0] == count); test_assert(buf[BUF_COUNT - 1] == count + BUF_COUNT - 1); count += BUF_COUNT; } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/block_clone_syscallbuf_overflow.run000066400000000000000000000002211277367620400230730ustar00rootroot00000000000000source `dirname $0`/util.sh # Use 4K syscallbuf size to force frequent overflows RECORD_ARGS=--syscall-buffer-size=4 compare_test EXIT-SUCCESS rr-4.4.0/src/test/block_intr_sigchld.c000066400000000000000000000041061277367620400177160ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS 10 #define NUM_PROCS_PER_ITERATION 10 #define MAGIC_EXIT_CODE 42 static int sockfds[2]; const ssize_t num_sockbuf_bytes = 1 << 20; static void child_proc(void) { exit(MAGIC_EXIT_CODE); } static void* writer_thread(__attribute__((unused)) void* dontcare) { char token = '!'; int sock = sockfds[1]; int i; for (i = 0; i < NUM_ITERATIONS; ++i) { /* Force a wait on read() */ atomic_printf("w: iteration %d: sleeping ...\n", i); usleep(500000); atomic_printf("w: writing '%c' to socket ...\n", token); write(sock, &token, sizeof(token)); ++token; atomic_puts("w: ... done"); } atomic_puts("w: ... done"); return NULL; } int main(void) { char token = '!'; char c = '\0'; pthread_t t; int sock; int i; socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); sock = sockfds[0]; pthread_create(&t, NULL, writer_thread, NULL); for (i = 0; i < NUM_ITERATIONS; ++i) { pid_t procs[NUM_PROCS_PER_ITERATION]; int j; atomic_printf("M: iteration %d: forking processes before read ...\n", i); for (j = 0; j < NUM_PROCS_PER_ITERATION; ++j) { if (0 == (procs[j] = fork())) { child_proc(); test_assert("Not reached" && 0); } } atomic_printf("M: sleeping for a bit ..."); usleep(10000); atomic_printf("M: reading socket ...\n"); test_assert(1 == read(sock, &c, sizeof(c))); atomic_printf("M: ... read '%c'\n", c); test_assert(c == token); ++token; for (j = 0; j < NUM_PROCS_PER_ITERATION; ++j) { int status; int child = procs[j]; int pid = waitpid(child, &status, 0); int err = errno; atomic_printf("M: waitpid(%d) returns %d(%s) and status %#x\n", child, pid, strerror(err), status); test_assert(child == pid); test_assert(WIFEXITED(status) && MAGIC_EXIT_CODE == WEXITSTATUS(status)); } } atomic_printf("M: ... done\n"); pthread_join(t, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/block_intr_sigchld.run000066400000000000000000000002501277367620400202740ustar00rootroot00000000000000source `dirname $0`/util.sh # The underlying failure here is difficult to reproduce without a lot # of tracee concurrency. RECORD_ARGS="-s" compare_test EXIT-SUCCESS rr-4.4.0/src/test/block_open.c000066400000000000000000000015111277367620400162030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int try_open(int flags) { return open("fifo", flags); } static int try_openat(int flags) { return openat(AT_FDCWD, "fifo", flags); } static void do_test(int (*func)(int)) { pid_t child; int fd; int status; int ret = mkfifo("fifo", 0600); test_assert(ret == 0); child = fork(); if (!child) { fd = func(O_WRONLY); test_assert(fd >= 0); test_assert(0 == close(fd)); exit(77); } fd = func(O_RDONLY); test_assert(fd >= 0); test_assert(0 == close(fd)); unlink("fifo"); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); } int main(void) { do_test(try_open); do_test(try_openat); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/blocked_bad_ip.c000066400000000000000000000017561277367620400170040ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void fault_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { atomic_puts("FAILED: handler should not have been called for blocked signal"); } static void* start_thread(__attribute__((unused)) void* p) { sigset_t s; syscall(SYS_write, STDOUT_FILENO, "EXIT-", 5); sigemptyset(&s); sigaddset(&s, SIGSEGV); sigprocmask(SIG_BLOCK, &s, NULL); syscall(SYS_write, STDOUT_FILENO, "SUCCESS\n", 8, 9, 10, 11); __asm__ __volatile__("jmp 0x42"); return NULL; } int main(void) { struct sigaction act; pthread_t thread; act.sa_sigaction = fault_handler; act.sa_flags = SA_SIGINFO | SA_NODEFER; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); pthread_create(&thread, NULL, start_thread, NULL); pthread_join(thread, NULL); return 0; } rr-4.4.0/src/test/blocked_bad_ip.py000066400000000000000000000003011277367620400171730ustar00rootroot00000000000000from rrutil import * send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('SIGSEGV') send_gdb('reverse-stepi') expect_gdb('SIGSEGV') send_gdb('reverse-stepi') expect_gdb('start_thread') ok() rr-4.4.0/src/test/blocked_bad_ip.run000066400000000000000000000000471277367620400173560ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/blocked_sigill.c000066400000000000000000000016031277367620400170400ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void fault_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { atomic_puts("FAILED: handler should not have been called for blocked signal"); } static void* start_thread(__attribute__((unused)) void* p) { sigset_t s; sigemptyset(&s); sigaddset(&s, SIGILL); sigprocmask(SIG_BLOCK, &s, NULL); atomic_puts("EXIT-SUCCESS"); asm("ud2"); return NULL; } int main(void) { struct sigaction act; pthread_t thread; act.sa_sigaction = fault_handler; act.sa_flags = SA_SIGINFO | SA_NODEFER; sigemptyset(&act.sa_mask); sigaction(SIGILL, &act, NULL); pthread_create(&thread, NULL, start_thread, NULL); pthread_join(thread, NULL); return 0; } rr-4.4.0/src/test/blocked_sigill.run000066400000000000000000000001301277367620400174140ustar00rootroot00000000000000source `dirname $0`/util.sh ( record $TESTNAME ) >& /dev/null replay check EXIT-SUCCESS rr-4.4.0/src/test/blocked_sigsegv.c000066400000000000000000000016311277367620400172250ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void fault_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { atomic_puts("FAILED: handler should not have been called for blocked signal"); } static void* start_thread(__attribute__((unused)) void* p) { sigset_t s; sigemptyset(&s); sigaddset(&s, SIGSEGV); sigprocmask(SIG_BLOCK, &s, NULL); rdtsc(); atomic_puts("EXIT-SUCCESS"); crash_null_deref(); return NULL; } int main(void) { struct sigaction act; pthread_t thread; act.sa_sigaction = fault_handler; act.sa_flags = SA_SIGINFO | SA_NODEFER; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); pthread_create(&thread, NULL, start_thread, NULL); pthread_join(thread, NULL); return 0; } rr-4.4.0/src/test/blocked_sigsegv.run000066400000000000000000000001301277367620400176000ustar00rootroot00000000000000source `dirname $0`/util.sh ( record $TESTNAME ) >& /dev/null replay check EXIT-SUCCESS rr-4.4.0/src/test/break_block.py000066400000000000000000000002421277367620400165340ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') for i in xrange(2): send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') ok() rr-4.4.0/src/test/break_block.run000066400000000000000000000001031277367620400167040ustar00rootroot00000000000000source `dirname $0`/util.sh record block$bitness debug break_block rr-4.4.0/src/test/break_clock.py000066400000000000000000000002421277367620400165350ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') for i in xrange(3): send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') ok() rr-4.4.0/src/test/break_clock.run000066400000000000000000000001031277367620400167050ustar00rootroot00000000000000source `dirname $0`/util.sh record clock$bitness debug break_clock rr-4.4.0/src/test/break_clone.py000066400000000000000000000002421277367620400165420ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') for i in xrange(3): send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') ok() rr-4.4.0/src/test/break_clone.run000066400000000000000000000001031277367620400167120ustar00rootroot00000000000000source `dirname $0`/util.sh record clone$bitness debug break_clone rr-4.4.0/src/test/break_exec.run000066400000000000000000000001111277367620400165350ustar00rootroot00000000000000source `dirname $0`/util.sh record exec_self$bitness debug generic_break rr-4.4.0/src/test/break_int3.py000066400000000000000000000002041277367620400163150ustar00rootroot00000000000000from rrutil import * send_gdb('b int3.c:3') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') ok() rr-4.4.0/src/test/break_int3.run000066400000000000000000000002561277367620400165000ustar00rootroot00000000000000source `dirname $0`/util.sh fails "gdb and rr don't yet agree what should happen when a breakpoint is set on a breakpoint instruction" record int3$bitness debug break_int3 rr-4.4.0/src/test/break_mmap_private.py000066400000000000000000000002421277367620400201260ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') for i in xrange(3): send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') ok() rr-4.4.0/src/test/break_mmap_private.run000066400000000000000000000002031277367620400202770ustar00rootroot00000000000000source `dirname $0`/util.sh record mmap_private$bitness debug break_mmap_private debug break_mmap_private --share-private-mappings rr-4.4.0/src/test/break_msg.run000066400000000000000000000001031277367620400164000ustar00rootroot00000000000000source `dirname $0`/util.sh record msg$bitness debug generic_break rr-4.4.0/src/test/break_rdtsc.run000066400000000000000000000001051277367620400167330ustar00rootroot00000000000000source `dirname $0`/util.sh record rdtsc$bitness debug generic_break rr-4.4.0/src/test/break_sigreturn.run000066400000000000000000000001121277367620400176340ustar00rootroot00000000000000source `dirname $0`/util.sh record intr_sleep$bitness debug generic_break rr-4.4.0/src/test/break_sync_signal.run000066400000000000000000000001101277367620400201210ustar00rootroot00000000000000source `dirname $0`/util.sh record segfault$bitness debug generic_break rr-4.4.0/src/test/break_thread.run000066400000000000000000000001071277367620400170650ustar00rootroot00000000000000source `dirname $0`/util.sh record barrier$bitness debug generic_break rr-4.4.0/src/test/break_time_slice.py000066400000000000000000000002631277367620400175620ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') send_gdb('c') expect_gdb('exited normally') ok() rr-4.4.0/src/test/break_time_slice.run000066400000000000000000000001131277367620400177300ustar00rootroot00000000000000source `dirname $0`/util.sh record chew_cpu$bitness debug break_time_slice rr-4.4.0/src/test/breakpoint.c000066400000000000000000000006441277367620400162340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void C(void) { atomic_puts("in C"); } static void B(void) { atomic_puts("calling C"); C(); atomic_puts("finished C"); } static void A(void) { atomic_puts("calling B"); B(); atomic_puts("finished B"); } int main(void) { atomic_puts("calling A"); A(); atomic_puts("finished A"); return 0; } rr-4.4.0/src/test/breakpoint.py000066400000000000000000000003361277367620400164400ustar00rootroot00000000000000from rrutil import * send_gdb('b C') expect_gdb('Breakpoint 1') send_gdb('c') expect_rr('calling C') expect_gdb('Breakpoint 1, C') send_gdb('bt') expect_gdb('#0[^C]+C[^#]+#1[^B]+B[^#]+#2[^A]+A[^#]+#3[^m]+main') ok() rr-4.4.0/src/test/breakpoint.run000066400000000000000000000000471277367620400166130ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/breakpoint_conditions.c000066400000000000000000000011241277367620400204570ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpointA(__attribute__((unused)) int v4) { int break_here = 1; (void)break_here; } static void breakpointB(__attribute__((unused)) int v4) { int break_here = 1; (void)break_here; } int v0 = 0; int v1 = 1; int v2 = 2; int v3 = 3; int vm1 = -1; int vm2 = -2; uint64_t u64max = (uint64_t)(int64_t)-1; int* p = (int*)&u64max; int main(void) { int i; for (i = 0; i < 10000; ++i) { breakpointA(4); breakpointB(4); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/breakpoint_conditions.py000066400000000000000000000017441277367620400206750ustar00rootroot00000000000000from rrutil import * def test_cond(c): send_gdb('cond 1 %s'%c) # check that the condition is evaluated correctly by checking that # we don't break on the negation of the condition send_gdb('cond 2 !(%s)'%c) send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('b breakpointA') expect_gdb('Breakpoint 1') send_gdb('b breakpointB') expect_gdb('Breakpoint 2') test_cond('v1==1') test_cond('v1!=2') test_cond('v4==4') test_cond('v1+v2==3') test_cond('v2-1==v1') test_cond('v3-v2==1') test_cond('v4>>2==v1') test_cond('v1<<2==v4') test_cond('(unsigned char)u64max==255') test_cond('v2*v2==4') test_cond('v4/v2==2') test_cond('v4/vm2==-2') test_cond('v3%v2==1') test_cond('v3%vm2==1') test_cond('!v1==v0') test_cond('v1|v2==3') test_cond('v3&v2==2') test_cond('v3^v2==1') test_cond('~v0==(int)u64max') test_cond('v0?v1:v2==2') test_cond('*p==(int)u64max') test_cond('*(unsigned char*)p==255') test_cond('*(short int*)p==-1') test_cond('*(long long*)p==(long long)u64max') ok() rr-4.4.0/src/test/breakpoint_conditions.run000066400000000000000000000000471277367620400210440ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/breakpoint_consistent.py000066400000000000000000000005061277367620400207100ustar00rootroot00000000000000from rrutil import * send_gdb('b C') expect_gdb('Breakpoint 1') send_gdb('b main') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 2, main') send_gdb('cond 1 rand()&1 < 10') send_gdb('c') expect_rr('calling C') expect_gdb('Breakpoint 1, C') send_gdb('check') send_gdb('c') expect_rr('finished C') ok() rr-4.4.0/src/test/breakpoint_consistent.run000066400000000000000000000001221277367620400210560ustar00rootroot00000000000000source `dirname $0`/util.sh record breakpoint$bitness debug breakpoint_consistent rr-4.4.0/src/test/breakpoint_overlap.c000066400000000000000000000041721277367620400177640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* This is a difficult bug to trigger because we need to set a breakpoint where a SCHED event will stop, and the breakpoint has to fire exactly at the moment the SCHED event fires. So we need a SCHED event to fire at a location when it's the first time we've executed that location. Setting the context switch time to something small-ish like -c100 should help. Then we generate a lot of conditional branches. */ #define STATEMENT(i) \ if (a * (i) < b) { \ ++a; \ } else { \ ++b; \ } #define STATEMENT2(i) STATEMENT(i) STATEMENT(i + 1) #define STATEMENT4(i) STATEMENT2(i) STATEMENT2(i + 2) #define STATEMENT8(i) STATEMENT4(i) STATEMENT4(i + 4) #define STATEMENT16(i) STATEMENT8(i) STATEMENT8(i + 8) #define STATEMENT32(i) STATEMENT16(i) STATEMENT16(i + 16) #define STATEMENT64(i) STATEMENT32(i) STATEMENT32(i + 32) #define STATEMENT128(i) STATEMENT64(i) STATEMENT64(i + 64) #define STATEMENT256(i) STATEMENT128(i) STATEMENT128(i + 128) #define STATEMENT512(i) STATEMENT256(i) STATEMENT256(i + 256) #define STATEMENT1024(i) STATEMENT512(i) STATEMENT512(i + 512) #define STATEMENT2048(i) STATEMENT1024(i) STATEMENT1024(i + 1024) #define STATEMENT4096(i) STATEMENT2048(i) STATEMENT2048(i + 2048) static void* do_thread(__attribute__((unused)) void* p) { while (1) { sched_yield(); } return NULL; } int main(__attribute__((unused)) int argc, char* argv[]) { int a = atoi(argv[1]); int b = atoi(argv[2]); pthread_t thread; /* Create an extra thread so context switches can happen and SCHED events will be recorded. */ pthread_create(&thread, NULL, do_thread, NULL); /* This syscall signals the test that we're in the test body proper */ getgid(); STATEMENT4096(0) return a + b; } rr-4.4.0/src/test/breakpoint_overlap.py000066400000000000000000000022161277367620400201670ustar00rootroot00000000000000import collections import sys import re from rrutil import * arch = get_exe_arch() ArchInfo = collections.namedtuple('ArchInfo', ['syscall', 'ip_name']) regex_info = { 'i386': ArchInfo('getgid32', 'eip'), 'i386:x86-64': ArchInfo('getgid', 'rip'), } syscall_re = re.compile("`SYSCALL: %s' \\(state:EXITING_SYSCALL\\)" % regex_info[arch].syscall) sched_re = re.compile("`SCHED'") eip_re = re.compile("%s:(0x[a-f0-9]+)" % regex_info[arch].ip_name) sched_enabled = False eip_enabled = False eip = None while True: line = sys.stdin.readline() if not line: break if syscall_re.search(line): sched_enabled = True if sched_enabled and sched_re.search(line): eip_enabled = True if eip_enabled: m = eip_re.search(line) if m: eip = m.group(1) break if eip is None: failed('%s not found' % regex_info[arch].ip_name) send_gdb('b *%s'%eip) expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') expect_gdb('(rr)') send_gdb('p/x *(char*)$pc') expect_gdb('0x([a-f0-9]+)') if last_match().group(1) is 'cc': failed('saw breakpoint at current instruction') ok() rr-4.4.0/src/test/breakpoint_overlap.run000066400000000000000000000006641277367620400203500ustar00rootroot00000000000000source `dirname $0`/util.sh # It's relatively easy to reproduce a CPUID divergence caused by lack # of CPU binding. GLOBAL_OPTIONS="$GLOBAL_OPTIONS_BIND_CPU" RECORD_ARGS="-c100" record breakpoint_overlap$bitness 3 4 # Don't use pipes here since we need 'debug' to run in the same bash process rr --suppress-environment-warnings dump $workdir/latest-trace > $workdir/plaintext-trace debug breakpoint_overlap < $workdir/plaintext-trace rr-4.4.0/src/test/brk.c000066400000000000000000000006131277367620400146500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { void* prev; void* start = sbrk(0); test_assert((intptr_t)start != -1); test_assert(start == sbrk(111)); memset(start, 0xaa, 111); prev = sbrk(1000000); test_assert(prev != (void*)-1); test_assert(0 == brk(prev)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/brk2.c000066400000000000000000000012261277367620400147330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { void* start = (void*)syscall(SYS_brk, 0); void* p = (void*)syscall(SYS_brk, start + 5000); int res; void* pp; void* q; void* r; res = mprotect((void*)(((long)start + 4095) & ~(long)4095), 4096, PROT_READ); test_assert(res == 0); pp = (void*)syscall(SYS_brk, 0); test_assert(pp == p); *(char*)p = 77; q = (void*)syscall(SYS_brk, p + 5000); test_assert(p + 5000 == q); test_assert(*(char*)p == 77); r = (void*)syscall(SYS_brk, start + 1); test_assert(start < r); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/call_exit.py000066400000000000000000000003711277367620400162450ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, main') send_gdb('call exit(0)') expect_gdb('while in a function called from GDB') restart_replay() expect_gdb('Breakpoint 1, main') ok() rr-4.4.0/src/test/call_exit.run000066400000000000000000000001021277367620400164110ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug call_exit rr-4.4.0/src/test/call_function.c000066400000000000000000000034011277367620400167100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int var; static void breakpoint(void) { int break_here = 1; (void)break_here; } void mutate_var(void) { var = 22; atomic_printf("var is %d\n", var); } void print_nums(void) { int i; for (i = 1; i <= 5; ++i) { atomic_printf("%d ", i); } atomic_puts(""); } void alloc_and_print(void) { static const int num_bytes = 4096; char* str = mmap(NULL, num_bytes, PROT_WRITE | PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); snprintf(str, num_bytes, "Hello %d", var); atomic_puts(str); munmap(str, num_bytes); } void make_unhandled_syscall(void) { ssize_t ret = kill(getpid(), SIGKILL); /* XXX the error return is somewhat arbitrary here, but as * long as |splice()| remains unimplemented in experiment * mode, it's reasonable to assume that the libc wrapper will * return -1 back to us. */ atomic_printf("return from kill: %zd\n", ret); } void print_time(void) { struct timespec ts = { -1, -1 }; double now_sec; clock_gettime(CLOCK_MONOTONIC, &ts); now_sec = (double)ts.tv_sec + (double)ts.tv_nsec / 1e9; atomic_printf("now is %g sec\n", now_sec); } static void make_stack_executable(void) { int v = 0; void* p = (void*)((uintptr_t)&v & ~((uintptr_t)PAGE_SIZE - 1)); int ret = mprotect(p, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC); test_assert(ret == 0 || errno == EACCES); } int main(void) { var = -42; breakpoint(); atomic_printf("var is %d\n", var); test_assert(var == -42); make_stack_executable(); breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; /* not reached */ mutate_var(); print_nums(); alloc_and_print(); make_unhandled_syscall(); print_time(); } rr-4.4.0/src/test/call_function.py000066400000000000000000000013661277367620400171260ustar00rootroot00000000000000from rrutil import * def do_tests(): expect_gdb('Breakpoint 1, breakpoint') send_gdb('call mutate_var()') expect_gdb('var is 22') send_gdb('call print_nums()') expect_gdb('1 2 3 4 5') send_gdb('call alloc_and_print()') expect_gdb('Hello 22') send_gdb('call make_unhandled_syscall()') expect_gdb('return from kill: -1') send_gdb('call print_time()') expect_gdb(r'now is \d+(\.\d+(e\+\d\d)?)? sec') send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') # first set of tests use regular (hopefully not-executable) stack do_tests() send_gdb('c') expect_rr('var is -42') # repeat the tests with executable stack do_tests() # make sure we didn't crash send_gdb('c') expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/call_function.run000066400000000000000000000000471277367620400172750ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/capget.c000066400000000000000000000016201277367620400153340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" extern int capget(cap_user_header_t header, cap_user_data_t data); int main(void) { struct __user_cap_header_struct* hdr; struct __user_cap_data_struct* data; ALLOCATE_GUARD(hdr, 'a'); hdr->version = 0; hdr->pid = 0; test_assert(0 == capget(hdr, NULL)); test_assert(hdr->version > 0); VERIFY_GUARD(hdr); ALLOCATE_GUARD(hdr, 'a'); hdr->version = _LINUX_CAPABILITY_VERSION_1; hdr->pid = 0; ALLOCATE_GUARD(data, 'b'); test_assert(0 == capget(hdr, data)); VERIFY_GUARD(hdr); VERIFY_GUARD(data); ALLOCATE_GUARD(hdr, 'c'); hdr->version = _LINUX_CAPABILITY_VERSION_3; hdr->pid = 0; data = allocate_guard(sizeof(*data) * 2, 'd'); test_assert(0 == capget(hdr, data)); VERIFY_GUARD(hdr); verify_guard(sizeof(*data) * 2, data); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/check_patched_pthread.py000066400000000000000000000004421277367620400205540ustar00rootroot00000000000000from rrutil import * import re send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('p ((int*)&__elision_aconf)[2]') expect_gdb(re.compile(r'= 0|No symbol')) send_gdb('p/x *(char*)elision_init') expect_gdb(re.compile(r'= 0xc3|No symbol')) ok() rr-4.4.0/src/test/check_patched_pthread.run000066400000000000000000000001171277367620400207270ustar00rootroot00000000000000source `dirname $0`/util.sh record threads$bitness debug check_patched_pthread rr-4.4.0/src/test/check_session_leaks.c000066400000000000000000000014741277367620400200770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_THREADS 100 static int pipe_fds[2]; static void read_all(int fd, char* buf, size_t size) { while (size > 0) { ssize_t ret = read(fd, buf, size); test_assert(ret > 0); size -= ret; buf += ret; } } static void* thread(__attribute__((unused)) void* p) { int fd = open("/dev/zero", O_RDONLY); char buf[1000000]; test_assert(fd >= 0); read_all(fd, buf, sizeof(buf)); read(pipe_fds[0], buf, 1); test_assert(0); return NULL; } int main(void) { pthread_t threads[NUM_THREADS]; int i; test_assert(0 == pipe(pipe_fds)); for (i = 0; i < NUM_THREADS; ++i) { test_assert(0 == pthread_create(&threads[i], NULL, thread, NULL)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/check_session_leaks.py000066400000000000000000000005721277367620400203030ustar00rootroot00000000000000from rrutil import * import re send_gdb('b atomic_puts') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') for i in range(1,100): send_gdb('checkpoint') expect_gdb('Checkpoint %d '%i) send_gdb('stepi') send_gdb('restart %d'%i) expect_gdb('stopped') send_gdb('delete checkpoint %d'%i) send_gdb('stepi') send_gdb('stepi') ok() rr-4.4.0/src/test/check_session_leaks.run000066400000000000000000000000471277367620400204540ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/check_syscall_perf_interval.py000066400000000000000000000027651277367620400220410ustar00rootroot00000000000000import sys import re if len(sys.argv) < 4: print '''Usage: %s Exits with status 0 if exactly the expected number of perf events occur between every pair of consecutive system calls of the given type.''' % sys.argv[0] sys.exit(2) syscall = sys.argv[1] counter = sys.argv[2] expected_count = int(sys.argv[3]) last_perfctr_value = -1 syscall_re = re.compile("`SYSCALL: (\\w+)' \\(state:0\\)") perfctr_re = re.compile(counter + ":(\\d+)") while True: line = sys.stdin.readline() if not line: sys.exit(0) m = syscall_re.search(line) if m: if m.group(1) == syscall: line = sys.stdin.readline() m = perfctr_re.search(line) if m: v = int(m.group(1)) if last_perfctr_value >= 0 and v - last_perfctr_value != expected_count: print "Mismatch: saw %d %ss between %ss (from %d to %d), expected %d" % \ (v - last_perfctr_value, counter, syscall, last_perfctr_value, v, expected_count) sys.exit(1) last_perfctr_value = v else: # Ignore nonconsecutive syscalls. In the cpuid test, we have # two batches of geteuid32s; one injected by rr itself to detect # a buggy system, and a separate one for the test. We need to # ignore the geteuid32 pair that spans the gap between the batches. last_perfctr_value = -1 rr-4.4.0/src/test/checkpoint_async_signal_syscalls_1000.run000066400000000000000000000011731277367620400237140ustar00rootroot00000000000000source `dirname $0`/util.sh timeslice=1000 RECORD_ARGS="-c$timeslice" record async_signal_syscalls$bitness 9 num_events=$(count_events) # This recording has a large number of events, and it's impractical to # run the debugger for each one. The original bug reproduces when the # debugger attaches to pretty much any event past event 350, so we # somewhat arbitrarily choose a stride that reduces the number of # debug sessions by about 10x. stride=80 for i in $(seq 1 $stride $num_events); do echo Checkpointing at event $i ... debug restart_finish "-g $i" if [[ "$leave_data" == "y" ]]; then break fi done rr-4.4.0/src/test/checkpoint_dying_threads.c000066400000000000000000000025521277367620400211310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} static int thread_to_main_fds[2]; static int main_to_child_fds[2]; static int wait_forever_fds[2]; static char ch = 'X'; static void* run_thread(__attribute__((unused)) void* p) { test_assert(1 == write(thread_to_main_fds[1], &ch, 1)); read(wait_forever_fds[0], &ch, 1); test_assert(0); return NULL; } static int run_child(void) { test_assert(1 == read(main_to_child_fds[0], &ch, 1)); /* At this point, the parent's main thread should have exit_group()ed and its extra thread should have died but not been scheduled yet. Try to take a checkpoint in this state. */ breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } int main(void) { pthread_t thread; pid_t child; test_assert(0 == pipe(thread_to_main_fds)); test_assert(0 == pipe(main_to_child_fds)); test_assert(0 == pipe(wait_forever_fds)); child = fork(); if (!child) { return run_child(); } atomic_printf("child %d\n", child); test_assert(0 == pthread_create(&thread, NULL, run_thread, NULL)); test_assert(1 == read(thread_to_main_fds[0], &ch, 1)); /* thread should have blocked on its wait-forever read. Tell the child to proceed after we exit_group. */ test_assert(1 == write(main_to_child_fds[1], &ch, 1)); return 0; } rr-4.4.0/src/test/checkpoint_dying_threads.py000066400000000000000000000003331277367620400213320ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited normally') ok() rr-4.4.0/src/test/checkpoint_dying_threads.run000066400000000000000000000003051277367620400215050ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug checkpoint_dying_threads "-f $TARGET_PID" rr-4.4.0/src/test/checkpoint_mixed_mode.c000066400000000000000000000013531277367620400204150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int create_segment(size_t num_bytes) { char filename[] = "/dev/shm/rr-test-XXXXXX"; int fd = mkstemp(filename); unlink(filename); test_assert(fd >= 0); ftruncate(fd, num_bytes); return fd; } static void breakpoint(void) {} int main(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); int fd = create_segment(num_bytes); char* p = mmap(NULL, num_bytes, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); char* shared_p; p[0] = 77; shared_p = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); breakpoint(); test_assert(p[0] == 77); test_assert(shared_p[0] == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/checkpoint_mixed_mode.py000066400000000000000000000004551277367620400206250ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('n') send_gdb('restart 1') expect_gdb('breakpoint') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('xited normally') rr-4.4.0/src/test/checkpoint_mixed_mode.run000066400000000000000000000000471277367620400207760ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/checkpoint_mmap_shared.run000066400000000000000000000001041277367620400211360ustar00rootroot00000000000000source `dirname $0`/util.sh checkpoint_test mmap_shared$bitness 7 9 rr-4.4.0/src/test/checkpoint_prctl_name.run000066400000000000000000000001051277367620400210030ustar00rootroot00000000000000source `dirname $0`/util.sh checkpoint_test prctl_name$bitness 11 13 rr-4.4.0/src/test/checkpoint_simple.run000066400000000000000000000000771277367620400201600ustar00rootroot00000000000000source `dirname $0`/util.sh checkpoint_test simple$bitness 3 5 rr-4.4.0/src/test/checksum_sanity.c000066400000000000000000000012541277367620400172650ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* do_thread(__attribute__((unused)) void* p) { return NULL; } int main(int argc, char** argv) { pthread_t thread; pid_t child; int status; if (argc > 1) { return 77; } pthread_create(&thread, NULL, do_thread, NULL); pthread_join(thread, NULL); child = fork(); if (!child) { char* args[] = { argv[0], "dummy", NULL }; execve(argv[0], args, environ); test_assert(0 && "exec failed"); } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/checksum_sanity.run000066400000000000000000000002011277367620400176360ustar00rootroot00000000000000source `dirname $0`/util.sh GLOBAL_OPTIONS="$GLOBAL_OPTIONS --checksum=on-all-events" record $TESTNAME replay check EXIT-SUCCESS rr-4.4.0/src/test/chew_cpu.c000066400000000000000000000012571277367620400156740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS (1 << 30) static void breakpoint(void) { int break_here = 1; (void)break_here; } int spin(void) { int i, dummy = 0; atomic_puts("spinning"); /* NO SYSCALLS AFTER HERE: the point of this test is to hit * hpc interrupts to exercise the nonvoluntary interrupt * scheduler. */ for (i = 1; i < NUM_ITERATIONS; ++i) { dummy += i % (1 << 20); dummy += i % (79 * (1 << 20)); if (i == NUM_ITERATIONS / 2) { breakpoint(); } } return dummy; } int main(void) { atomic_printf("EXIT-SUCCESS dummy=%d\n", spin()); return 0; } rr-4.4.0/src/test/chmod.c000066400000000000000000000010671277367620400151700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { static const char file_path[] = "rr-test-file"; int fd = open(file_path, O_WRONLY | O_CREAT, 0); test_assert(fd >= 0); test_assert(0 == chmod(file_path, 0400)); test_assert(0 == access(file_path, R_OK)); test_assert(0 == fchmod(fd, 0200)); test_assert(0 == access(file_path, W_OK)); test_assert(0 == fchmodat(AT_FDCWD, file_path, 0400, 0)); test_assert(0 == access(file_path, R_OK)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/chown.c000066400000000000000000000034611277367620400152140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DUMMY_FILENAME "foo.txt" static gid_t get_gid(int fd) { struct stat* st; gid_t result; ALLOCATE_GUARD(st, 'x'); test_assert(0 == fstat(fd, st)); result = st->st_gid; FREE_GUARD(st); return result; } static void change_group(const char* path, gid_t new_gid) { test_assert(0 == chown(path, geteuid(), new_gid)); } static void change_group_fd(int fd, gid_t new_gid) { test_assert(0 == fchown(fd, geteuid(), new_gid)); } static void change_group_at(const char* path, gid_t new_gid) { test_assert(0 == fchownat(AT_FDCWD, path, geteuid(), new_gid, 0)); } int main(void) { gid_t groups[32]; int ngroups; gid_t this_group, other_group; int fd; this_group = getegid(); atomic_printf("Current group is %d\n", this_group); ngroups = getgroups(ALEN(groups), groups); test_assert(ngroups > 0); other_group = groups[0]; if (this_group == other_group && ngroups > 1) { other_group = groups[1]; } if (this_group == other_group) { atomic_puts("WARNING: unable to properly test chown()"); } fd = creat(DUMMY_FILENAME, 0600); test_assert(fd >= 0); atomic_printf("Group owner of %s is %d\n", DUMMY_FILENAME, get_gid(fd)); test_assert(this_group == get_gid(fd)); change_group(DUMMY_FILENAME, other_group); atomic_printf(" ... now owner is %d\n", get_gid(fd)); test_assert(other_group == get_gid(fd)); change_group_fd(fd, this_group); atomic_printf(" ... now back to original owner %d\n", get_gid(fd)); test_assert(this_group == get_gid(fd)); change_group_at(DUMMY_FILENAME, other_group); atomic_printf(" ... now owner is %d\n", get_gid(fd)); test_assert(other_group == get_gid(fd)); unlink(DUMMY_FILENAME); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clock.c000066400000000000000000000024731277367620400151730ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(void) { struct timespec ts; struct timeval tv; int i; clock_getres(CLOCK_MONOTONIC, &ts); atomic_printf("Clock resolution is >= %g us\n", ((double)ts.tv_nsec) / 1.0e3); memset(&ts, 0, sizeof(ts)); memset(&tv, 0, sizeof(tv)); breakpoint(); for (i = 0; i < 100; ++i) { struct timespec ts_now; struct timeval tv_now; clock_gettime(CLOCK_MONOTONIC, &ts_now); test_assert(ts.tv_sec < ts_now.tv_sec || (ts.tv_sec == ts_now.tv_sec && ts.tv_nsec <= ts_now.tv_nsec)); ts = ts_now; if (i == 50) { breakpoint(); } /* technically gettimeofday() isn't monotonic, but the * value of this check is higher than the remote * possibility of a spurious failure */ gettimeofday(&tv_now, NULL); test_assert(tv.tv_sec < tv_now.tv_sec || (tv.tv_sec == tv_now.tv_sec && tv.tv_usec <= tv_now.tv_usec)); tv = tv_now; atomic_printf("cg: %g %llu, gtod: %g %llu\n", (double)ts.tv_sec, (long long int)ts.tv_nsec, (double)tv.tv_sec, (long long int)tv.tv_usec); } breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clock_nanosleep.c000066400000000000000000000022761277367620400172400ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Keep this roughly in sync with 'nanosleep' */ static void* do_thread(__attribute__((unused)) void* p) { sigset_t sigs; sigemptyset(&sigs); sigaddset(&sigs, SIGINT); pthread_sigmask(SIG_BLOCK, &sigs, NULL); while (1) { sleep(1); test_assert(0 == kill(getpid(), SIGINT)); } return NULL; } static void handler(__attribute__((unused)) int sig) {} int main(void) { struct timespec sleep = { 0, 1000000 }; struct timespec* remain; pthread_t thread; test_assert(0 == clock_nanosleep(CLOCK_MONOTONIC, 0, &sleep, NULL)); ALLOCATE_GUARD(remain, 'x'); remain->tv_sec = 9999; remain->tv_nsec = 9998; test_assert(0 == clock_nanosleep(CLOCK_MONOTONIC, 0, &sleep, remain)); VERIFY_GUARD(remain); test_assert(remain->tv_sec == 9999 && remain->tv_nsec == 9998); test_assert(0 == signal(SIGINT, handler)); pthread_create(&thread, NULL, do_thread, NULL); sleep.tv_sec = 1000000; test_assert(EINTR == clock_nanosleep(CLOCK_MONOTONIC, 0, &sleep, remain)); VERIFY_GUARD(remain); test_assert(remain->tv_sec <= sleep.tv_sec); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone.c000066400000000000000000000057011277367620400151750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int futex(int* uaddr, int op, int val, const struct timespec* timeout, int* uaddr2, int val2) { return syscall(SYS_futex, uaddr, op, val, timeout, uaddr2, val2); } static pid_t child_tid; static pid_t child_tid_copy; static void breakpoint(void) { int break_here = 1; (void)break_here; } static int child(__attribute__((unused)) void* arg) { sigset_t set; int fd; char byte = 'x'; /* Be careful in here. This thread was set up by a raw clone() call * without TLS support so many things won't work, e.g. atomic_printf. */ /* Do some syscall-bufferable syscalls to make sure that works. * The syscallbuf will not have been set up, but the syscalls should * still work by not buffering them. */ fd = open("/dev/zero", O_RDONLY); test_assert(fd >= 0); test_assert(1 == read(fd, &byte, 1)); test_assert(0 == byte); test_assert(0 == close(fd)); sigfillset(&set); /* NB: we have to naughtily make the linux assumption that * sigprocmask is per-task, because we're not a real * pthread. */ test_assert(0 == syscall(SYS_rt_sigprocmask, SIG_UNBLOCK, &set, NULL, _NSIG / 8)); /* clone() should have set child_tid to our tid */ child_tid_copy = child_tid; breakpoint(); /* We cannot return normally here. Some clone() implementations call |_exit| after the clone function returns; some call SYS_exit. For consistency and correctness's sake, we need to call SYS_exit here. */ syscall(SYS_exit, 0); /* NOT REACHED */ return 0; } int main(void) { const size_t stack_size = 1 << 20; void* stack = mmap(NULL, stack_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); int tid; sigset_t set; test_assert(stack != MAP_FAILED); sys_gettid(); /* NB: no syscalls in between the sys_gettid() above and this * clone(). */ breakpoint(); /* Warning: strace gets the parameter order wrong and will print child_tidptr as 0 here. */ tid = clone(child, stack + stack_size, CLONE_VM | CLONE_FS | CLONE_FILES | CLONE_THREAD | CLONE_SIGHAND | CLONE_PARENT_SETTID | CLONE_CHILD_CLEARTID, NULL, &child_tid, NULL, &child_tid); atomic_printf("clone()d pid: %d\n", tid); test_assert(tid > 0); futex(&child_tid, FUTEX_WAIT, tid, NULL, NULL, 0); test_assert(child_tid_copy == tid); /* clone() should have cleared child_tid now */ test_assert(child_tid == 0); sys_gettid(); sigfillset(&set); test_assert(0 == sigprocmask(SIG_BLOCK, &set, NULL)); /* NB: no syscalls in between the sys_gettid() above and this * clone(). */ breakpoint(); tid = clone(child, stack + stack_size, CLONE_SIGHAND /*must also have CLONE_VM*/, NULL, NULL, NULL); atomic_printf("clone(CLONE_SIGHAND)'d tid: %d\n", tid); test_assert(-1 == tid); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone_bad_stack.c000066400000000000000000000005361277367620400171710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int status = -1; if (syscall(SYS_clone, SIGCHLD, (intptr_t)-1, (intptr_t)-1, (intptr_t)-1, (intptr_t)-1) == 0) { _exit(0); } test_assert(wait(&status) >= 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone_bad_tls.c000066400000000000000000000013161277367620400166630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int ret; int status; child = syscall(SYS_clone, CLONE_SETTLS | SIGCHLD, 0, 0, 0, 0); if (child < 0) { /* On x86-32 null TLS produces EFAULT */ test_assert(EFAULT == errno); atomic_puts("EXIT-SUCCESS"); return 0; } if (!child) { /* Use `syscall` here so we don't do any dl_runtime_resolve stuff that * might use TLS. */ syscall(SYS_write, STDOUT_FILENO, "EXIT-SUCCESS\n", 13); syscall(SYS_exit_group, 77); } ret = wait(&status); test_assert(child == ret); test_assert(WIFEXITED(status) && 77 == WEXITSTATUS(status)); return 0; } rr-4.4.0/src/test/clone_file_range.c000066400000000000000000000031051277367620400173440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #ifndef BTRFS_IOCTL_MAGIC #define BTRFS_IOCTL_MAGIC 0x94 #endif #ifndef BTRFS_IOC_CLONE_RANGE struct btrfs_ioctl_clone_range_args { int64_t src_fd; uint64_t src_offset; uint64_t src_length; uint64_t dest_offset; }; #define BTRFS_IOC_CLONE_RANGE \ _IOW(BTRFS_IOCTL_MAGIC, 13, struct btrfs_ioctl_clone_range_args) #endif #define BUF_SIZE 65536 #define FILE_SIZE 10 static const char file_name[] = "tmp.bin"; static const char file_name2[] = "tmp2.bin"; int main(void) { char buf[BUF_SIZE]; int fd2; int fd = open(file_name, O_RDWR | O_CREAT | O_EXCL, 0600); struct btrfs_ioctl_clone_range_args args; int ret; test_assert(fd >= 0); test_assert(0 == unlink(file_name)); memset(buf, 1, sizeof(buf)); test_assert(write(fd, buf, FILE_SIZE) == FILE_SIZE); fd2 = open(file_name2, O_RDWR | O_CREAT | O_EXCL, 0600); test_assert(fd2 >= 0); test_assert(0 == unlink(file_name2)); args.src_fd = fd; args.src_offset = 0; args.src_length = FILE_SIZE; args.dest_offset = 0; ret = ioctl(fd2, BTRFS_IOC_CLONE_RANGE, &args); if (ret < 0 && (errno == EOPNOTSUPP || errno == ENOTTY)) { atomic_puts("range cloning not supported"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(ret == 0); memset(buf, 0, sizeof(buf)); test_assert(FILE_SIZE == read(fd2, buf, BUF_SIZE)); test_assert(buf[0] == 1); test_assert(buf[9] == 1); test_assert(buf[10] == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone_immediate_exit.c000066400000000000000000000007311277367620400202420ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* run_thread(__attribute__((unused)) void* p) { atomic_puts("EXIT-SUCCESS"); exit(0); return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, run_thread, NULL); /* The signal will be delivered to the thread before any code runs in the thread. */ pthread_kill(thread, SIGCHLD); syscall(SYS_exit, 0); return 0; } rr-4.4.0/src/test/clone_interruption.c000066400000000000000000000031421277367620400200140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void futex(int* uaddr, int op, int val) { /* Avoid using the rr-page syscall entrypoints, so we don't trigger any special treatment that might hide bugs. */ #ifdef __x86_64__ __asm__("mov $0,%%r10\n\t" "syscall\n\t" ::"a"(SYS_futex), "D"(uaddr), "S"(op), "d"(val)); #elif defined(__i386__) __asm__("xchg %%ebx,%%edi\n\t" "int $0x80\n\t" "xchg %%ebx,%%edi\n\t" ::"a"(SYS_futex), "c"(op), "d"(val), "S"(NULL), "D"(uaddr)); #else syscall(SYS_futex, uaddr, op, val, NULL, NULL, 0); #endif } static int thread_to_main_fds[2]; static void signal_handler(int sig) { char ch = 'X'; test_assert(sig == SIGCHLD); test_assert(1 == write(thread_to_main_fds[1], &ch, 1)); } static void* run_thread(__attribute__((unused)) void* p) { char ch = 'X'; int futex_val = 0; test_assert(SIG_ERR != signal(SIGCHLD, signal_handler)); test_assert(1 == write(thread_to_main_fds[1], &ch, 1)); futex(&futex_val, FUTEX_WAIT, 0); test_assert(0); return NULL; } int main(void) { pthread_t thread; char ch; int i; sigset_t mask; test_assert(0 == pipe(thread_to_main_fds)); pthread_create(&thread, NULL, run_thread, NULL); sigemptyset(&mask); sigaddset(&mask, SIGCHLD); pthread_sigmask(SIG_SETMASK, &mask, NULL); test_assert(1 == read(thread_to_main_fds[0], &ch, 1)); for (i = 0; i < 1000; ++i) { geteuid(); } kill(getpid(), SIGCHLD); test_assert(1 == read(thread_to_main_fds[0], &ch, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone_interruption.py000066400000000000000000000003071277367620400202220ustar00rootroot00000000000000import collections import sys import re from rrutil import * send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('n') send_gdb('restart 1') send_gdb('c') expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/clone_interruption.run000066400000000000000000000005151277367620400203770ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS="-c100" record $TESTNAME # Don't use pipes here since we need 'debug' to run in the same bash process declare -i stop_at_event=`rr --suppress-environment-warnings dump $workdir/latest-trace | \ python2 $TESTDIR/clone_interruption_finder.py`+1 debug clone_interruption "-g $stop_at_event" rr-4.4.0/src/test/clone_interruption_finder.py000066400000000000000000000005601277367620400215520ustar00rootroot00000000000000import sys import re syscall_re = re.compile("`SYSCALL: futex' \\(state:EXITING_SYSCALL\\)") time_re = re.compile("global_time:(\d+)") futex_time = 999999999 while True: line = sys.stdin.readline() if not line: break if syscall_re.search(line): m = time_re.search(line) if m: futex_time = m.group(1) print futex_time rr-4.4.0/src/test/clone_newflags.c000066400000000000000000000020741277367620400170630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void overwrite_file(const char* path, ssize_t num_bytes) { const int magic = 0x5a5a5a5a; int fd = open(path, O_TRUNC | O_RDWR, 0600); size_t i; for (i = 0; i < num_bytes / sizeof(magic); ++i) { write(fd, &magic, sizeof(magic)); } close(fd); } int main(void) { pid_t child; int ret; int status; char name[] = "/tmp/rr-clone-newflags-XXXXXX"; int fd = mkstemp(name); overwrite_file(name, 0x1000); child = syscall(SYS_clone, CLONE_NEWUSER | SIGCHLD, 0, 0, 0, 0); if (child == -1 && (errno == EINVAL || errno == EPERM)) { atomic_puts("CLONE_NEWUSER not supported at this privilege level"); atomic_puts("EXIT-SUCCESS"); return 0; } if (!child) { mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); atomic_puts("EXIT-SUCCESS"); return 77; } ret = wait(&status); test_assert(0 == unlink(name)); test_assert(child == ret); test_assert(WIFEXITED(status) && 77 == WEXITSTATUS(status)); return 0; } rr-4.4.0/src/test/clone_untraced.c000066400000000000000000000010361277367620400170570ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static int run_thread(__attribute__((unused)) void* p) { test_assert(1 == write(pipe_fds[1], ".", 1)); return 0; } int main(void) { char* stack = (char*)malloc(65536) + 65536; int ret; char ch; test_assert(0 == pipe(pipe_fds)); ret = clone(run_thread, stack, CLONE_UNTRACED, NULL); test_assert(ret >= 0); test_assert(1 == read(pipe_fds[0], &ch, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone_vfork.c000066400000000000000000000020431277367620400164000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int not_shared; static int* shared; int clonefunc(void* exe) { not_shared = 1; sched_yield(); *shared = 1; execl(exe, exe, NULL); test_assert("Not reached" && 0); return 0; } int main(int argc, char* argv[]) { char child_stack[16384]; const char* exe; pid_t child; int status; test_assert(2 == argc); exe = argv[1]; shared = (int*)mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0); child = clone(clonefunc, child_stack + sizeof(child_stack), CLONE_VFORK | SIGCHLD, (void*)exe); /* This should not execute until after the vfork child has execed */ test_assert(*shared = 1); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); /* We didn't pass CLONE_VM so this should not have changed */ test_assert(not_shared == 0); atomic_puts("clone-vfork-EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/clone_vfork.run000066400000000000000000000002021277367620400167550ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe simple$bitness record $TESTNAME simple$bitness-$nonce replay check clone-vfork-EXIT-SUCCESS rr-4.4.0/src/test/cloned_sigmask.c000066400000000000000000000011721277367620400170550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handler(__attribute__((unused)) int sig) { write(STDOUT_FILENO, "FAILED!\n", 9); exit(0); } int main(void) { sigset_t sigs; pid_t child; int status; signal(SIGSEGV, handler); sigemptyset(&sigs); sigaddset(&sigs, SIGSEGV); sigprocmask(SIG_BLOCK, &sigs, NULL); child = fork(); if (!child) { *(int*)NULL = 0; return 77; } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/conditional_breakpoint_calls.c000066400000000000000000000005711277367620400217740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int counter; int dot_counter; int checker(void) { ++counter; return 0; } static void print_dot(void) { atomic_printf("."); ++dot_counter; } int main(void) { int i; for (i = 0; i < 10; ++i) { print_dot(); } atomic_puts("\nEXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/conditional_breakpoint_calls.py000066400000000000000000000003351277367620400222000ustar00rootroot00000000000000import re from rrutil import * send_gdb('b print_dot if checker()') expect_gdb('Breakpoint 1') send_gdb('watch dot_counter if checker()') expect_gdb('Hardware watchpoint 2') send_gdb('c') expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/conditional_breakpoint_calls.run000066400000000000000000000000471277367620400223540ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/conditional_breakpoint_offload.c000066400000000000000000000005131277367620400223040ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } static int var; int main(void) { int i; for (i = 0; i < 5000; ++i) { ++var; breakpoint(); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/conditional_breakpoint_offload.py000066400000000000000000000006171277367620400225170ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('cond 1 var==-1') send_gdb('b main') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 2') send_gdb('c') # This should complete in a reasonable amount of time! expect_gdb('SIGKILL') send_gdb('reverse-continue') # And so should this! expect_gdb('Breakpoint 2') ok() rr-4.4.0/src/test/conditional_breakpoint_offload.run000066400000000000000000000000471277367620400226700ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/condvar_stress.c000066400000000000000000000046051277367620400171360ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_THREADS 10 #define NUM_TRIALS 1000 static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; static pthread_cond_t cond = PTHREAD_COND_INITIALIZER; static int last_written; static int trial; static int write_locked; static int done; static void* thread(void* idp) { int id = (intptr_t)idp; int num_loops = 0; int num_written = 0; while (1) { int this_write; ++num_loops; { pthread_mutex_lock(&lock); while (!done && (last_written == trial || write_locked)) { pthread_cond_wait(&cond, &lock); } if (done) { pthread_mutex_unlock(&lock); break; } write_locked = 1; this_write = trial; pthread_mutex_unlock(&lock); } atomic_printf("%d:%d(%d)\n", id, this_write, num_loops); ++num_written; { pthread_mutex_lock(&lock); last_written = this_write; write_locked = 0; pthread_cond_broadcast(&cond); pthread_mutex_unlock(&lock); } } atomic_printf(" (%d wrote %d)\n", id, num_written); pthread_exit((void*)(intptr_t)num_written); } int main(void) { pthread_t threads[NUM_THREADS]; int i; int threads_num_written = 0; for (i = 0; i < NUM_THREADS; ++i) { test_assert(0 == pthread_create(&threads[i], NULL, thread, (void*)(intptr_t)i)); } for (i = 0; i < NUM_TRIALS; ++i) { { pthread_mutex_lock(&lock); assert(i == trial); test_assert(last_written == trial); ++trial; if (i % 2) { pthread_cond_signal(&cond); } else { pthread_cond_broadcast(&cond); } pthread_mutex_unlock(&lock); } { pthread_mutex_lock(&lock); while (last_written < trial) { pthread_cond_wait(&cond, &lock); } pthread_mutex_unlock(&lock); } } { pthread_mutex_lock(&lock); done = 1; pthread_cond_broadcast(&cond); pthread_mutex_unlock(&lock); } for (i = 0; i < NUM_THREADS; ++i) { void* ret = NULL; test_assert(0 == pthread_join(threads[i], &ret)); threads_num_written += (intptr_t)ret; } atomic_printf(" ... %d threads completed %d out of %d trials\n", NUM_THREADS, threads_num_written, NUM_TRIALS); test_assert(threads_num_written == NUM_TRIALS); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/condvar_stress.run000066400000000000000000000001731277367620400175140ustar00rootroot00000000000000source `dirname $0`/util.sh # Switch threads very eagerly on recorded events. RECORD_ARGS="-s" compare_test EXIT-SUCCESS rr-4.4.0/src/test/constructor.c000066400000000000000000000002701277367620400164560ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" void lib_exit_success(void); int main(void) { lib_exit_success(); return 0; } rr-4.4.0/src/test/cont_signal.py000066400000000000000000000003361277367620400166020ustar00rootroot00000000000000from rrutil import * import re send_gdb('c') index = expect_list([re.compile(r'exited normally'), re.compile(r'Program received signal SIGUSR1')]) if index == 1: send_gdb('c') expect_gdb('exited normally') ok() rr-4.4.0/src/test/cont_signal.run000066400000000000000000000002271277367620400167550ustar00rootroot00000000000000source `dirname $0`/util.sh recorded_exe=async_usr1$bitness # SIGUSR1, wait 2.0s record_async_signal 10 2.0 $recorded_exe debug $TESTNAME_NO_BITNESS rr-4.4.0/src/test/cpuid.c000066400000000000000000000004161277367620400151770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" extern int cpuid_loop(int iterations); int main(void) { int sum; getegid(); sum = cpuid_loop(1000); atomic_printf("EXIT-SUCCESS; sum=%d\n", sum); return 0; } rr-4.4.0/src/test/cpuid.run000066400000000000000000000010031277367620400155520ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test EXIT-SUCCESS if [[ $@ == -n ]]; then bin=$(which $TESTNAME) case $(file bin) in *x86-64*) syscall=geteuid ;; *i386*) syscall=geteuid32 ;; *) failed "can't determine architecture" ;; esac rr --suppress-environment-warnings dump $workdir/latest-trace | \ python2 $TESTDIR/check_syscall_perf_interval.py $syscall rbc 2 if [[ $? != 0 ]]; then failed "expected 2 rbcs between each geteuid32 syscall" fi fi rr-4.4.0/src/test/cpuid_loop.S000066400000000000000000000065641277367620400162220ustar00rootroot00000000000000#if defined(__i386__) .text .p2align 4,,15 .globl cpuid_call .type cpuid_call, @function cpuid_call: _cpuid_call: .cfi_startproc pushl %edi .cfi_def_cfa_offset 8 .cfi_offset 7, -8 pushl %esi .cfi_def_cfa_offset 12 .cfi_offset 6, -12 pushl %ebx .cfi_def_cfa_offset 16 .cfi_offset 3, -16 xorl %ebx, %ebx movl 20(%esp), %esi movl %ebx, %eax xchgl %ebx, %edi cpuid xchgl %ebx, %edi movl %eax, %ebx xorl %eax, %eax cmpl $4, %ebx jbe .L4 movl 16(%esp), %eax andl $4, %eax cpuid movl %eax, (%esi) movl 24(%esp), %eax movl %ebx, (%eax) movl (%esi), %eax .L4: popl %ebx .cfi_restore 3 .cfi_def_cfa_offset 12 popl %esi .cfi_restore 6 .cfi_def_cfa_offset 8 popl %edi .cfi_restore 7 .cfi_def_cfa_offset 4 ret .cfi_endproc .LFE89: .size cpuid_call, .-cpuid_call .p2align 4,,15 .globl cpuid_loop .type cpuid_loop, @function cpuid_loop: .cfi_startproc pushl %ebp .cfi_def_cfa_offset 8 .cfi_offset 5, -8 pushl %edi .cfi_def_cfa_offset 12 .cfi_offset 7, -12 pushl %esi .cfi_def_cfa_offset 16 .cfi_offset 6, -16 movl 16(%esp), %esi pushl %ebx .cfi_def_cfa_offset 20 .cfi_offset 3, -20 xorl %ebx, %ebx subl $44, %esp .cfi_def_cfa_offset 64 leal 28(%esp), %ebp leal 24(%esp), %edi .p2align 4,,7 .p2align 3 .L10: movl %ebx, (%esp) movl %ebp, 8(%esp) movl %edi, 4(%esp) call _cpuid_call addl %eax, %ebx mov $201, %eax int $0x80 subl $1, %esi jne .L10 addl $44, %esp .cfi_def_cfa_offset 20 movl %ebx, %eax popl %ebx .cfi_restore 3 .cfi_def_cfa_offset 16 popl %esi .cfi_restore 6 .cfi_def_cfa_offset 12 popl %edi .cfi_restore 7 .cfi_def_cfa_offset 8 popl %ebp .cfi_restore 5 .cfi_def_cfa_offset 4 ret .cfi_endproc .size cpuid_loop, .-cpuid_loop #elif defined(__x86_64__) .text .p2align 4,,15 .globl cpuid_call .type cpuid_call, @function cpuid_call: _cpuid_call: pushq %rbx /* Call CPUID twice, once under a conditional. */ xorl %eax, %eax cpuid cmpl $4, %eax jbe 1f movl $1, %eax cpuid 1: popq %rbx ret .size cpuid_call, .-cpuid_call .p2align 4,,15 .globl cpuid_loop .type cpuid_loop, @function cpuid_loop: pushq %rbx mov %rdi, %rbx xor %r11d, %r11d 1: call _cpuid_call addq %rax, %r11 mov $107, %rax syscall subq $1, %rbx jne 1b movq %r11, %rax popq %rbx ret .size cpuid_loop, .-cpuid_loop #else #error unknown CPU architecture #endif /* __i386__/__x86_64__ */ .section .note.GNU-stack,"",@progbits rr-4.4.0/src/test/crash.c000066400000000000000000000003141277367620400151700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { volatile int* p = NULL; *p = 42; test_assert("Not reached" && 0); return 0; } rr-4.4.0/src/test/crash.run000066400000000000000000000001021277367620400155450ustar00rootroot00000000000000source `dirname $0`/util.sh record crash$bitness replay check '' rr-4.4.0/src/test/crash_in_function.c000066400000000000000000000003151277367620400175640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" void crash(void) { crash_null_deref(); } int main(void) { atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/crash_in_function.py000066400000000000000000000011551277367620400177750ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('set unwindonsignal off') send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('call crash()') expect_gdb('SIGSEGV') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('next') send_gdb('call crash()') expect_gdb('SIGSEGV') send_gdb('c') expect_gdb('SIGKILL') restart_replay() expect_gdb('Breakpoint 1') send_gdb('delete 1') send_gdb('set unwindonsignal on') send_gdb('call crash()') expect_gdb('SIGSEGV') send_gdb('next') send_gdb('call crash()') expect_gdb('SIGSEGV') send_gdb('c') expect_gdb('SIGKILL') ok() rr-4.4.0/src/test/crash_in_function.run000066400000000000000000000000471277367620400201500ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/creat_address_not_truncated.c000066400000000000000000000015101277367620400216230ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include static const char dummy_filename[] = "dummy.txt"; int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); // Request an address where casting to int could corrupt the address on 64-bit // (i.e. not near the top or bottom of memory). uint8_t* map = mmap((void*)(LONG_MAX / 2), page_size, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); // Copy the filename there, and try to use creat. If the address gets // truncated, this can cause a segmentation fault. memcpy(map, dummy_filename, sizeof(dummy_filename)); int fd = creat((const char*)map, 0600); close(fd); test_assert(access(dummy_filename, F_OK) == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/cwd_inaccessible.c000066400000000000000000000022071277367620400173540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #include int main(void) { struct passwd* p = getpwnam("nobody"); pid_t child; int ret; int status; if (!p) { atomic_puts("User 'nobody' does not exist, can't run test"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(0 == mkdir("private", 0700)); child = fork(); if (!child) { pid_t grandchild; test_assert(0 == chdir("private")); ret = setuid(p->pw_uid); if (ret == -1 && errno == EPERM) { atomic_puts("Don't have CAP_SETUID, can't run test"); exit(78); } grandchild = fork(); if (!grandchild) { ret = open(".", O_PATH); test_assert(ret == -1 && errno == EACCES); exit(77); } test_assert(grandchild = waitpid(grandchild, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); exit(78); } test_assert(child = waitpid(child, &status, 0)); test_assert(0 == rmdir("private")); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 78); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/daemon.c000066400000000000000000000010061277367620400153320ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static int do_child(void) { /* Daemonize */ if (fork()) { return 0; } setsid(); write(pipe_fds[1], "x", 1); sleep(1000000); return 0; } int main(void) { pid_t child; char ch; test_assert(0 == pipe(pipe_fds)); child = fork(); if (!child) { return do_child(); } test_assert(1 == read(pipe_fds[0], &ch, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/daemon_read.c000066400000000000000000000016721277367620400163360ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static int do_child(void) { char buf[100]; int fd = open("/dev/zero", O_RDONLY); test_assert(fd >= 0); /* Daemonize */ if (fork()) { return 0; } setsid(); test_assert(1 == write(pipe_fds[1], "x", 1)); sched_yield(); while (1) { test_assert(sizeof(buf) == read(fd, buf, sizeof(buf))); } return 0; } static void* do_thread(__attribute__((unused)) void* p) { sleep(100000); return NULL; } #define NUM_THREADS 5 int main(void) { pid_t child; char ch; pthread_t threads[NUM_THREADS]; int i; test_assert(0 == pipe(pipe_fds)); for (i = 0; i < NUM_THREADS; ++i) { pthread_create(&threads[i], NULL, do_thread, NULL); } child = fork(); if (!child) { return do_child(); } test_assert(1 == read(pipe_fds[0], &ch, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/dconf_mock.c000066400000000000000000000015021277367620400161720ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, __attribute__((unused)) char* argv[]) { int fd; volatile char* p; int count = 0; if (argc == 1) { test_assert(0 == mkdir("dconf", 0700)); } fd = open("dconf/user", O_CREAT | O_RDWR, 0600); test_assert(fd >= 0); test_assert(0 == ftruncate(fd, 2)); p = (char*)mmap(NULL, PAGE_SIZE, PROT_READ | (argc == 2 ? PROT_WRITE : 0), MAP_SHARED, fd, 0); test_assert(MAP_FAILED != p); if (argc == 2) { *p = 1; test_assert(0 == unlink("dconf/user")); test_assert(0 == rmdir("dconf")); return 0; } atomic_puts("ready"); while (*p == 0) { ++count; sched_yield(); } atomic_printf("Count = %d\n", count); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/dconf_mock.run000066400000000000000000000005151277367620400165570ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME & until grep -q ready record.out; do sleep 0 done ${OBJDIR}/bin/$TESTNAME mock_dconf_update # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written. wait %1 echo "Replaying ..." replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/dead_thread_target.py000066400000000000000000000017761277367620400201050ustar00rootroot00000000000000from rrutil import * import re send_gdb('b hit_barrier') expect_gdb('Breakpoint 1') send_gdb('b joined_threads') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 1, hit_barrier') send_gdb('info thr') expect_gdb('2 Thread') send_gdb('thr 2') expect_gdb('Switching to thread 2') send_gdb('c') # TODO: with the gdb in fedora 19, if a thread dies while it's the # resume target, then rr notifies gdb, but gdb doesn't ask for a new # thread list. This seems like a gdb bug, because we don't have any # other way to notify gdb of thread death, and the same code works # just fine in concurrent ubuntu and older versions. # # So we work around that problem by returning this special error code # to the user. Once gdb has made this mistake, the debugging session # is "stuck" because won't let any other threads continue. But at # least this error code tells the user that they need to restart the # session. expect_gdb(re.compile( r'Breakpoint 2, joined_threads|Remote failure reply: E10')) ok() rr-4.4.0/src/test/dead_thread_target.run000066400000000000000000000001141277367620400202420ustar00rootroot00000000000000source `dirname $0`/util.sh record barrier$bitness debug dead_thread_target rr-4.4.0/src/test/deliver_async_signal_during_syscalls.run000066400000000000000000000007421277367620400241300ustar00rootroot00000000000000source `dirname $0`/util.sh # See async_signal_syscalls.run for an explanation. skip_if_no_syscall_buf # SIGUSR1, wait 0.5s; do 2^30 iterations to give us effectively unlimited time # (the test exits when SIGUSR1 has been handled) record_async_signal 10 0.5 async_signal_syscalls$bitness 30 # Because of issue #184, replay takes longer than practical. So for # now we'll skip it and hope other tests exercise the relevant code # well enough. #replay #check 'EXIT-SUCCESS' passed rr-4.4.0/src/test/desched_blocking_poll.c000066400000000000000000000011521277367620400203660ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_PFDS 200 int main(void) { int fds[2]; struct pollfd pfds[NUM_PFDS]; char ch = 'x'; int i; pipe(fds); for (i = 0; i < NUM_PFDS; ++i) { pfds[i].fd = fds[0]; pfds[i].events = POLLIN; } if (fork() == 0) { usleep(1000); write(fds[1], &ch, 1); return 0; } /* This should block */ test_assert(NUM_PFDS == poll(pfds, NUM_PFDS, -1)); test_assert(POLLIN & pfds[0].revents); test_assert(1 == read(pfds[0].fd, &ch, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/desched_ticks.py000066400000000000000000000007331277367620400170770ustar00rootroot00000000000000from rrutil import * import re send_gdb('handle SIGKILL stop') send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('b __before_poll_syscall_breakpoint') expect_gdb('Breakpoint 2') send_gdb('c') index = expect_list([re.compile(r'Breakpoint 2'), re.compile(r'SIGKILL')]) if index == 0: # This is testing that we can reverse-step without crashing rr. send_gdb('reverse-stepi') send_gdb('c') expect_gdb('Breakpoint 2') ok() rr-4.4.0/src/test/desched_ticks.run000066400000000000000000000003411277367620400172460ustar00rootroot00000000000000source `dirname $0`/util.sh # Without the syscallbuf, this test makes no sense # and will fail since it sets a breakpoint in the preload code. skip_if_no_syscall_buf record desched_blocking_poll$bitness debug desched_ticks rr-4.4.0/src/test/dev_tty.c000066400000000000000000000005771277367620400155610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = open("/dev/tty", O_RDWR); if (fd == -1 && errno == ENXIO) { atomic_puts("/dev/tty does not exist, skipping test"); fd = STDERR_FILENO; } else { test_assert(fd >= 0); } test_assert(13 == write(fd, "EXIT-SUCCESS\n", 13)); return 0; } rr-4.4.0/src/test/dev_tty.run000066400000000000000000000005261277367620400161350ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME replay token=EXIT-SUCCESS if [[ "replay.err" != $(grep -l $token replay.err) ]]; then failed ": token '$token' not in replay.err:" echo "--------------------------------------------------" cat replay.err echo "--------------------------------------------------" else passed fi rr-4.4.0/src/test/dlopen.c000066400000000000000000000003561277367620400153570ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { void* h = dlopen("libX11.so", RTLD_LAZY); if (h) { dlclose(h); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/dlopen.py000066400000000000000000000002561277367620400155640ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('c') expect_gdb('EXIT-SUCCESS') expect_gdb('SIGKILL') send_gdb('reverse-continue') expect_gdb('stopped') ok() rr-4.4.0/src/test/dlopen.run000066400000000000000000000000501277367620400157300ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/doublesegv.c000066400000000000000000000025761277367620400162430ustar00rootroot00000000000000#include "rrutil.h" int handler_pipe_fd; static void fault_handler(int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { sigset_t oldset; sigprocmask(0, NULL, &oldset); test_assert(sigismember(&oldset, SIGSEGV) && "SIGSEGV should be blocked here"); write(handler_pipe_fd, &sig, sizeof(int)); *((int*)1) = 0; // raise(SIGSEGV); test_assert(0 && "Should not reach here"); } static void* do_thread(__attribute__((unused)) void* p) { raise(SIGSEGV); test_assert(0 && "Should not reach here!"); return NULL; } int main(void) { pid_t child; int status; pthread_t thread; int pipe_fds[2]; pipe(pipe_fds); handler_pipe_fd = pipe_fds[1]; if ((child = fork()) == 0) { struct sigaction act; act.sa_sigaction = fault_handler; act.sa_flags = SA_ONSTACK | SA_SIGINFO; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); pthread_create(&thread, NULL, do_thread, NULL); test_assert(0 == sched_yield()); sleep(1000); test_assert(0 && "Should not reach here"); return 0; } int handler_sig; test_assert(read(pipe_fds[0], &handler_sig, sizeof(int)) == sizeof(int)); test_assert(handler_sig == SIGSEGV); test_assert(child == wait(&status)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/dup.c000066400000000000000000000023111277367620400146570ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char buf[] = "0123456789"; int main(void) { int pipe_fds[2]; int fd; char ch; test_assert(0 == pipe(pipe_fds)); test_assert(10 == write(pipe_fds[1], buf, 10)); fd = dup(pipe_fds[0]); test_assert(fd >= 0); test_assert(fd != pipe_fds[0] && fd != pipe_fds[1]); test_assert(1 == read(fd, &ch, 1)); test_assert(ch == '0'); fd = dup2(pipe_fds[0], 0); test_assert(fd == 0); test_assert(1 == read(fd, &ch, 1)); test_assert(ch == '1'); fd = dup3(pipe_fds[0], 49, O_CLOEXEC); test_assert(fd == 49); test_assert(1 == read(fd, &ch, 1)); test_assert(ch == '2'); test_assert(FD_CLOEXEC == fcntl(fd, F_GETFD)); test_assert(fd == dup2(0, fd)); test_assert(0 == fcntl(fd, F_GETFD)); fd = fcntl(pipe_fds[0], F_DUPFD, 49); test_assert(fd == 50); test_assert(1 == read(fd, &ch, 1)); test_assert(ch == '3'); test_assert(0 == fcntl(fd, F_GETFD)); fd = fcntl(pipe_fds[0], F_DUPFD_CLOEXEC, 49); test_assert(fd == 51); test_assert(1 == read(fd, &ch, 1)); test_assert(ch == '4'); test_assert(FD_CLOEXEC == fcntl(fd, F_GETFD)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/env_newline.run000066400000000000000000000001441277367620400167640ustar00rootroot00000000000000export BADENV='hello kitty' source `dirname $0`/util.sh compare_test EXIT-SUCCESS "" simple$bitness rr-4.4.0/src/test/epoll_create.c000066400000000000000000000004451277367620400165330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; fd = epoll_create(1); atomic_printf("New epoll file descriptor: %d\n", fd); if (fd >= 0) { atomic_puts("EXIT-SUCCESS"); } close(fd); return 0; } rr-4.4.0/src/test/epoll_create1.c000066400000000000000000000004461277367620400166150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; fd = epoll_create1(0); atomic_printf("New epoll file descriptor: %d\n", fd); if (fd >= 0) { atomic_puts("EXIT-SUCCESS"); } close(fd); return 0; } rr-4.4.0/src/test/eventfd.c000066400000000000000000000007221277367620400155260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void do_test(int fd) { uint64_t val = 7; uint64_t out; test_assert(fd >= 0); test_assert(sizeof(val) == write(fd, &val, sizeof(val))); test_assert(sizeof(out) == read(fd, &out, sizeof(out))); test_assert(out == val); } int main(void) { do_test(syscall(SYS_eventfd, 0)); do_test(eventfd(0, 0)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/exec_deleted.run000066400000000000000000000002341277367620400170650ustar00rootroot00000000000000source `dirname $0`/util.sh file=simple$bitness cp ${OBJDIR}/bin/$file $file-$nonce just_record ./$file-$nonce rm $file-$nonce replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/exec_flags.c000066400000000000000000000022721277367620400161750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void my_exec(const char* filename, const char** argv, const char** envp) { #ifdef __i386__ /* Use a special instruction after the syscall to make sure we don't patch it */ int out_bx; __asm__ __volatile__("xor %%ebx,%%ebx\n\t" "xchg %%ebx,%%edi\n\t" "int $0x80\n\t" "xchg %%ebx,%%edi\n\t" : "=b"(out_bx) : "a"(SYS_execve), "c"(argv), "d"(envp), "D"(filename)); #elif defined(__x86_64__) int out_bx; /* Use a special instruction after the syscall to make sure we don't patch it */ __asm__ __volatile__("xor %%ebx,%%ebx\n\t" "syscall\n\t" "xchg %%rdx,%%rdx\n\t" : "=b"(out_bx) : "a"(SYS_execve), "D"(filename), "S"(argv), "d"(envp)); #else #error Unknown architecture #endif } int main(__attribute__((unused)) int argc, const char* argv[], const char* envp[]) { my_exec("/no-exist!", argv, envp); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/exec_from_main_thread.c000066400000000000000000000012101277367620400203660ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* do_thread(__attribute__((unused)) void* p) { sleep(1000); test_assert(0 && "Failed something!"); return NULL; } int main(int argc, __attribute__((unused)) char** argv) { pthread_t thread; char* args[] = { "/proc/self/exe", "dummy", NULL }; if (argc > 1) { atomic_puts("EXIT-SUCCESS"); return 0; } pthread_create(&thread, NULL, do_thread, NULL); test_assert(0 == sched_yield()); atomic_puts("About to exec"); execve("/proc/self/exe", args, environ); test_assert(0 && "Failed exec!"); return 1; } rr-4.4.0/src/test/exec_from_other_thread.c000066400000000000000000000011441277367620400205710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* do_thread(__attribute__((unused)) void* p) { char* argv[] = { "/proc/self/exe", "dummy", NULL }; atomic_puts("About to exec"); execve("/proc/self/exe", argv, environ); test_assert(0 && "Failed exec!"); return NULL; } int main(int argc, __attribute__((unused)) char** argv) { pthread_t thread; if (argc > 1) { atomic_puts("EXIT-SUCCESS"); return 0; } pthread_create(&thread, NULL, do_thread, NULL); sleep(1000); test_assert(0 && "Failed something!"); return 1; } rr-4.4.0/src/test/exec_no_env.c000066400000000000000000000005331277367620400163630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char** argv) { if (argc == 1) { char* args[] = { argv[0], "hello", NULL }; char* envp[] = { NULL }; execve(argv[0], args, envp); test_assert(0); return 0; } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/exec_self.c000066400000000000000000000010401277367620400160220ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(int argc, char* argv[]) { test_assert(argc == 1 || (argc == 2 && !strcmp("self", argv[1]))); if (argc != 2) { atomic_printf("exec(%s, 'self') ...\n", argv[0]); breakpoint(); /* No syscalls in between here. */ execlp(argv[0], argv[0], "self", NULL); test_assert("Not reached" && 0); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/exec_stop.py000066400000000000000000000004301277367620400162660ustar00rootroot00000000000000from rrutil import * import re send_gdb('c') expect_gdb('stopped') send_gdb('stepi') expect_gdb('stopped') send_gdb('stepi') expect_gdb('stopped') send_gdb('c') expect_gdb('stopped') send_gdb('b execve') expect_gdb('Breakpoint 1') send_gdb('rc') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/exec_stop.run000066400000000000000000000001051277367620400164410ustar00rootroot00000000000000source `dirname $0`/util.sh record exec_self$bitness debug exec_stop rr-4.4.0/src/test/execp.run000066400000000000000000000002271277367620400155610ustar00rootroot00000000000000source `dirname $0`/util.sh exe=simple$bitness cp ${OBJDIR}/bin/$exe $exe-$nonce PATH="${PATH}:." just_record $exe-$nonce replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/execve_loop.c000066400000000000000000000010631277367620400164020ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* The runner script bombards us with SIGCHLDs. It's quite likely that one of these will be received during an AutoRemoteSyscalls sycall, which is what we want to test here. */ int main(__attribute__((unused)) int argc, char* argv[], char* envp[]) { int count = atoi(argv[1]); if (count > 0) { char buf[10]; sprintf(buf, "%d", count - 1); argv[1] = buf; execve(argv[0], argv, envp); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/execve_loop.run000066400000000000000000000005261277367620400167670ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME 100 & for i in $(seq 1 30); do sleep 0.01 kill -CHLD $rrpid $(pidof $TESTNAME-$nonce) >& /dev/null done # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written. wait echo "Replaying ..." replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/exit_codes.c000066400000000000000000000004231277367620400162170ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { int cmd; test_assert(argc == 2); cmd = atoi(argv[1]); if (cmd < 0) { kill(getpid(), -cmd); return 0; } return cmd; } rr-4.4.0/src/test/exit_codes.run000066400000000000000000000003061277367620400166010ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME 3 if [[ $? != 3 ]]; then failed "Expected exit code 3" fi ( record $TESTNAME -5 ) if [[ $? != 133 ]]; then failed "Expected exit signal 5" fi rr-4.4.0/src/test/exit_group.c000066400000000000000000000007241277367620400162620ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" pthread_barrier_t bar; static void* thread(__attribute__((unused)) void* unused) { pthread_barrier_wait(&bar); sleep(-1); return NULL; } int main(void) { pthread_t t; pthread_barrier_init(&bar, NULL, 2); pthread_create(&t, NULL, thread, NULL); pthread_barrier_wait(&bar); atomic_puts("_exit()ing"); _exit(0); return 0; /* not reached */ } rr-4.4.0/src/test/exit_group.run000066400000000000000000000000661277367620400166430ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test '_exit()ing' rr-4.4.0/src/test/exit_status.c000066400000000000000000000002021277367620400164400ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { return 7; } rr-4.4.0/src/test/exit_status.run000066400000000000000000000002151277367620400170260ustar00rootroot00000000000000source `dirname $0`/util.sh record exit_status$bitness if [[ $? != 7 ]]; then failed "got exit status $?, expected 7" else passed fi rr-4.4.0/src/test/exit_with_syscallbuf_signal.c000066400000000000000000000016461277367620400216710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" typedef void (*NullCall)(void); static NullCall very_slow_exit_syscall; static void* run_child(__attribute__((unused)) void* arg) { /* context-switch events will happen during our long delay in the syscallbuf. These will be queued and must be processed during exit. In general these could be other signals that must not be dropped so we want to handle them. */ very_slow_exit_syscall(); test_assert(0 && "Should not reach here!"); return 0; } int main(void) { pthread_t thread; very_slow_exit_syscall = dlsym(RTLD_DEFAULT, "very_slow_exit_syscall"); if (!very_slow_exit_syscall) { atomic_puts("syscallbuf not loaded"); atomic_puts("EXIT-SUCCESS"); return 0; } pthread_create(&thread, NULL, run_child, NULL); pthread_join(thread, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/expect_in_atomic_printf.py000066400000000000000000000001211277367620400211660ustar00rootroot00000000000000from rrutil import * import re send_gdb('bt') expect_gdb('atomic_printf') ok() rr-4.4.0/src/test/explicit_checkpoint_clone.py000066400000000000000000000006701277367620400215130ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') # Now we should be in the clone() thread. checkpoint here. send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('restart 1') expect_gdb('stopped') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') send_gdb('c') expect_gdb('EXIT-SUCCESS') ok() rr-4.4.0/src/test/explicit_checkpoint_clone.run000066400000000000000000000001211277367620400216560ustar00rootroot00000000000000source `dirname $0`/util.sh record clone$bitness debug explicit_checkpoint_clone rr-4.4.0/src/test/explicit_checkpoints.c000066400000000000000000000007471277367620400203150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint2(void) { int break_here = 1; (void)break_here; } static void breakpoint3(void) { int break_here = 1; (void)break_here; } int main(void) { /* NO SYSCALLS BETWEEN HERE AND RDTSC: next event for * replay must be rdtsc */ rdtsc(); breakpoint2(); atomic_printf("Write syscall...\n"); breakpoint3(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/explicit_checkpoints.py000066400000000000000000000027041277367620400205160ustar00rootroot00000000000000from rrutil import * import re # Setup breakpoints send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('b breakpoint2') expect_gdb('Breakpoint 2') send_gdb('b breakpoint3') expect_gdb('Breakpoint 3') # Empty checkpoint list send_gdb('info checkpoint') expect_gdb('No checkpoints.') # Create checkpoint at each breakpoint send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') index = expect_list([re.compile(r'Checkpoint 1 at .*'), re.compile(r'ERROR')]) if index > 0: failed('ERROR detected in rr output') send_gdb('c') expect_gdb('Breakpoint 2, breakpoint2') send_gdb('checkpoint') expect_gdb('Checkpoint 2 at') send_gdb('c') expect_gdb('Breakpoint 3, breakpoint3') send_gdb('checkpoint') expect_gdb('Checkpoint 3 at') # Checkpoint list send_gdb('info checkpoint') expect_gdb('ID\tWhen\tWhere') expect_gdb('1\t') expect_gdb('2\t') expect_gdb('3\t') # Resume checkpoints: each one stops at its breakpoint send_gdb("restart 1"); expect_gdb('stopped') send_gdb('c') expect_gdb('Breakpoint 2, breakpoint2') send_gdb("restart 3"); expect_gdb('stopped') send_gdb('c') expect_rr('exited normally') send_gdb("restart 2"); expect_gdb('stopped') send_gdb('c') expect_gdb('Breakpoint 3, breakpoint3') # Bare 'run' defaults to last resumed checkpoint restart_replay() expect_gdb('Breakpoint 3, breakpoint3') # Remove checkpoint 2 and try resuming it; it should fail send_gdb('delete checkpoint 2') send_gdb("restart 2"); send_gdb('c') expect_gdb('failed') ok() rr-4.4.0/src/test/explicit_checkpoints.run000066400000000000000000000000471277367620400206700ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/fadvise.c000066400000000000000000000010341277367620400155110ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { /* There's not a (simple) way to meaningfully test fadvise, * since it only provides optimization hints, so this just * checks that rr doesn't blow up when it sees one. */ posix_fadvise(-1, 0, 0, POSIX_FADV_NORMAL); syscall(SYS_fadvise64, -1, 0, 0, POSIX_FADV_NORMAL); #if defined(SYS_fadvise64_64) syscall(SYS_fadvise64_64, -1, POSIX_FADV_NORMAL, 0, 0); #endif atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fanotify.c000066400000000000000000000025351277367620400157160ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct fanotify_event_metadata* event; int file_fd; int fd = fanotify_init(0, O_RDONLY); if (fd == -1 && errno == EPERM) { atomic_puts("fanotify requires CAP_SYS_ADMIN (in the root namespace) but " "we don't have those privileges; skipping tests"); atomic_puts("EXIT-SUCCESS"); return 0; } if (fd == -1 && errno == ENOSYS) { atomic_puts("fanotify is not available in this kernel; skipping tests"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(fd >= 0); file_fd = open("foo", O_WRONLY | O_CREAT, 0777); test_assert(file_fd >= 0); test_assert(0 == close(file_fd)); test_assert(0 == fanotify_mark(fd, FAN_MARK_ADD, FAN_OPEN, AT_FDCWD, "foo")); file_fd = open("foo", O_WRONLY | O_CREAT, 0777); test_assert(file_fd >= 0); test_assert(0 == close(file_fd)); ALLOCATE_GUARD(event, 'x'); test_assert(sizeof(*event) == read(fd, event, sizeof(*event))); VERIFY_GUARD(event); test_assert(event->event_len == sizeof(*event)); test_assert(event->vers == FANOTIFY_METADATA_VERSION); test_assert(event->mask == FAN_OPEN); test_assert(event->fd >= 0); test_assert(event->pid == getpid()); test_assert(0 == unlink("foo")); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fault_in_code_page.c000066400000000000000000000041041277367620400176600ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" typedef int (*fn_type)(void); static fn_type fn = NULL; static const uint8_t fn_insns[] = { 0xb8, 0x2a, 0x00, 0x00, 0x00, /* movl $42, %eax */ 0xc3, /* ret */ }; static uint8_t* code_page; static size_t page_size; static int fault_count; static void fault_in_code_page(int sig, siginfo_t* si, __attribute__((unused)) void* context) { atomic_printf("FAULT: signal %d: code %d for addr %p\n", sig, si->si_code, si->si_addr); test_assert(SIGSEGV == sig); test_assert(SEGV_ACCERR == si->si_code); test_assert(code_page == si->si_addr); test_assert(1 == ++fault_count); atomic_puts(" populating page..."); test_assert(0 == mprotect(code_page, page_size, PROT_READ | PROT_WRITE)); test_assert(sizeof(fn_insns) < page_size); memcpy(code_page, fn_insns, sizeof(fn_insns)); test_assert(0 == mprotect(code_page, page_size, PROT_READ | PROT_EXEC)); atomic_puts(" ... and protected it. sigreturn'ing"); } static uint64_t sigsegv_blocked_rdtsc(void) { sigset_t s, old; sigemptyset(&s); sigaddset(&s, SIGSEGV); sigprocmask(SIG_BLOCK, &s, &old); uint64_t tsc = rdtsc(); sys_gettid(); sigprocmask(SIG_SETMASK, &old, NULL); return tsc; } int main(void) { struct sigaction act; page_size = sysconf(_SC_PAGESIZE); act.sa_sigaction = fault_in_code_page; act.sa_flags = SA_SIGINFO; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); atomic_printf("current tsc: %" PRIu64 "\n", sigsegv_blocked_rdtsc()); atomic_printf(" and now: %" PRIu64 "\n", sigsegv_blocked_rdtsc()); code_page = mmap(NULL, page_size, PROT_NONE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); atomic_printf("(%d) mapped code page to %p\n", errno, code_page); test_assert(code_page != (void*)-1); fn = (fn_type)code_page; atomic_printf("calling fn(), faulting ...\n"); int ret = fn(); atomic_printf("fn() returned %d\n", ret); test_assert(42 == ret); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fcntl_dupfd.c000066400000000000000000000004351277367620400163640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; fd = fcntl(1, F_DUPFD, 3); test_assert(fd >= 3); close(1); fd = dup2(fd, 1); test_assert(fd == 1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fcntl_owner_ex.c000066400000000000000000000014241277367620400171070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void dump_owner(const char* tag, int fd) { struct f_owner_ex own; memset(&own, 0, sizeof(own)); test_assert(0 == fcntl(fd, F_GETOWN_EX, &own)); atomic_printf("%s: { type: %d, pid: %d }\n", tag, own.type, own.pid); } int main(void) { int sockfds[2]; int fd; struct f_owner_ex own; test_assert(0 == socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds)); fd = sockfds[0]; /* doesn't matter */ test_assert(0 == fcntl(fd, F_SETFL, O_ASYNC)); dump_owner("initially", fd); own.type = F_OWNER_TID; own.pid = getpid(); test_assert(0 == fcntl(fd, F_SETOWN_EX, &own)); dump_owner("after SETOWN_EX(TID, self)", fd); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fcntl_seals.c000066400000000000000000000021211277367620400163630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TEST_MEMFD "foo" #ifndef MFD_CLOEXEC #define MFD_CLOEXEC 0x0001 #define MFD_ALLOW_SEALING 0x0002 #endif #ifndef F_ADD_SEALS #define F_ADD_SEALS 0x409 #endif #ifndef F_SEAL_SEAL #define F_SEAL_SEAL 0x0001 #define F_SEAL_SHRINK 0x0002 #define F_SEAL_GROW 0x0004 #define F_SEAL_WRITE 0x0008 #endif int main(void) { int fd; /* There's no libc helper for this syscall. */ fd = syscall(RR_memfd_create, TEST_MEMFD, MFD_ALLOW_SEALING); if (-1 == fd && ENOSYS == errno) { atomic_puts("SYS_memfd_create not supported on this kernel"); } else if (-1 == fd && EINVAL == errno) { atomic_puts("MFD_ALLOW_SEALING not supported on this kernel"); } else { test_assert(fd >= 0); test_assert( fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW) == 0); /* Seal after F_SEAL_SEAL should fail */ test_assert(fcntl(fd, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW) == -1); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fcntl_sig.c000066400000000000000000000004061277367620400160420ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { test_assert(0 == fcntl(1, F_SETSIG, SIGCHLD)); test_assert(SIGCHLD == fcntl(1, F_GETSIG, 0)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fd_tracking_across_threads.c000066400000000000000000000006311277367620400214310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { test_assert(11 == dup2(STDOUT_FILENO, 11)); test_assert(14 == write(11, "EXIT-SUCCESS\n", 14)); return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, start_thread, NULL); pthread_exit(NULL); return 0; } rr-4.4.0/src/test/fds_clean.c000066400000000000000000000004461277367620400160140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; for (fd = 3; fd < 100; ++fd) { /* Check that |fd| is available to us. */ test_assert(dup2(2, fd) == fd); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/final_sigkill.py000066400000000000000000000003371277367620400171120ustar00rootroot00000000000000from rrutil import * import re send_gdb('handle SIGKILL stop') send_gdb('c') expect_gdb('received signal SIGKILL') restart_replay() expect_gdb('received signal SIGKILL') send_gdb('c') expect_gdb('exited normally') ok() rr-4.4.0/src/test/final_sigkill.run000066400000000000000000000001061277367620400172600ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug final_sigkill rr-4.4.0/src/test/first_instruction.py000066400000000000000000000001151277367620400200650ustar00rootroot00000000000000from rrutil import * send_gdb('disass') expect_gdb('function _start') ok() rr-4.4.0/src/test/first_instruction.run000066400000000000000000000001201277367620400202350ustar00rootroot00000000000000source `dirname $0`/util.sh record rr_exec_stub$bitness debug first_instruction rr-4.4.0/src/test/flock.c000066400000000000000000000070021277367620400151670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define FILENAME "foo.txt" int main(void) { ssize_t pagesize = sysconf(_SC_PAGESIZE); int fd; size_t i; int err; pid_t parent_pid = getpid(); pid_t pid; int status; fd = open(FILENAME, O_CREAT | O_EXCL | O_RDWR, 0600); test_assert(fd >= 0); unlink(FILENAME); atomic_printf("parent pid is %d\n", parent_pid); /* Write a page's worth of data. */ for (i = 0; i < pagesize / sizeof(i); ++i) { ssize_t nwritten = write(fd, &i, sizeof(i)); test_assert(nwritten == sizeof(i)); } { struct flock lock = {.l_type = F_RDLCK, .l_whence = SEEK_SET, .l_start = pagesize, .l_len = -pagesize / 2 }; atomic_printf("sizeof(flock) = %zu\n", sizeof(lock)); /* It should currently be unlocked. */ err = fcntl(fd, F_GETLK, &lock); test_assert(0 == err); atomic_printf("before lock: type: %d, pid: %d\n", lock.l_type, lock.l_pid); test_assert(F_UNLCK == lock.l_type); lock.l_type = F_RDLCK; fcntl(fd, F_SETLK, &lock); test_assert(0 == err); /* Make sure our lock "took". */ if (0 == (pid = fork())) { lock.l_type = F_WRLCK; err = fcntl(fd, F_GETLK, &lock); test_assert(0 == err); atomic_printf(" after lock: type: %d, pid: %d\n", lock.l_type, lock.l_pid); test_assert(F_RDLCK == lock.l_type && pagesize / 2 == lock.l_start && pagesize / 2 == lock.l_len && parent_pid == lock.l_pid); exit(0); } waitpid(pid, &status, 0); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); } { struct flock64 lock = { .l_type = F_WRLCK, .l_whence = SEEK_SET, .l_start = 0, .l_len = pagesize }; atomic_printf("sizeof(flock64) = %zu\n", sizeof(lock)); /* We should be able to take a write lock on the whole * file. The kernel will upgrade the readlock. */ err = fcntl(fd, F_GETLK64, &lock); test_assert(0 == err); atomic_printf("before lock: type: %d, pid: %d\n", lock.l_type, lock.l_pid); test_assert(F_UNLCK == lock.l_type); lock.l_type = F_WRLCK; fcntl(fd, F_SETLK64, &lock); test_assert(0 == err); /* Make sure our lock "took". */ if (0 == (pid = fork())) { lock.l_type = F_RDLCK; err = fcntl(fd, F_GETLK64, &lock); test_assert(0 == err); atomic_printf(" after GETLK: type: %d, pid: %d\n", lock.l_type, lock.l_pid); test_assert(F_WRLCK == lock.l_type && 0 == lock.l_start && pagesize == lock.l_len && parent_pid == lock.l_pid); lock.l_type = F_RDLCK; lock.l_pid = 0; err = fcntl(fd, F_SETLKW64, &lock); test_assert(0 == err); atomic_printf(" after SETLKW: type: %d, pid: %d\n", lock.l_type, lock.l_pid); test_assert(F_RDLCK == lock.l_type && 0 == lock.l_start && pagesize == lock.l_len && 0 == lock.l_pid); atomic_puts(" releasing lock ..."); lock.l_type = F_UNLCK; fcntl(fd, F_SETLK64, &lock); test_assert(0 == err); return 0; } atomic_puts("P: forcing child to block on LK, sleeping ..."); usleep(500000); atomic_puts("P: ... awake, releasing lock"); lock.l_type = F_UNLCK; fcntl(fd, F_SETLK64, &lock); test_assert(0 == err); waitpid(pid, &status, 0); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/flock2.c000066400000000000000000000012471277367620400152560ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ /* Test for the 'flock' system call. */ #include "rrutil.h" #define FILENAME "foo.txt" int main(void) { int fd; int result; fd = open(FILENAME, O_CREAT | O_EXCL | O_RDWR, 0600); test_assert(fd >= 0); result = flock(fd, LOCK_SH); test_assert(result == 0); result = flock(fd, LOCK_EX); test_assert(result == 0); result = flock(fd, LOCK_UN); test_assert(result == 0); result = close(fd); test_assert(result == 0); result = flock(fd, LOCK_EX); test_assert(result < 0); test_assert(errno == EBADF); unlink(FILENAME); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fork_brk.c000066400000000000000000000005451277367620400156750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child = fork(); int status; if (!child) { sbrk(100000); return 77; } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fork_child_crash.c000066400000000000000000000012331277367620400173550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(void) { pid_t child = fork(); int status; if (0 == child) { atomic_printf("child %d\n", getpid()); breakpoint(); atomic_puts("subprocess: crashing ..."); *(volatile int*)NULL = 0; exit(0); /* not reached */ } test_assert(child == waitpid(child, &status, 0)); atomic_printf("parent: subprocess %d exited with %#x\n", child, status); test_assert(WIFSIGNALED(status) && SIGSEGV == WTERMSIG(status)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fork_exec_info_thr.run000066400000000000000000000007571277367620400203220ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe barrier$bitness saved_barrier="barrier$bitness-$nonce" GLOBAL_OPTIONS="$GLOBAL_OPTIONS -M" record target_process$bitness "$saved_barrier" TARGET_PID=$(grep 'child ' record.out | awk '{print $4}') TARGET_EVENT=$(grep 'thread 2 launched ' record.out | awk '{print substr($3,1,3)}') echo Targeting recorded pid $TARGET_PID at event $TARGET_EVENT ... debug get_thread_list "-p $TARGET_PID -g 1" debug expect_in_atomic_printf "-p $TARGET_PID -g $TARGET_EVENT" rr-4.4.0/src/test/fork_stress.c000066400000000000000000000006231277367620400164370ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS 250 int main(void) { int i; for (i = 0; i < NUM_ITERATIONS; ++i) { pid_t child = fork(); if (0 == child) { return 0; } if (0 > child) { atomic_printf("Fork failed with errno %d\n", errno); } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fork_syscalls.c000066400000000000000000000010231277367620400167440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void syscalls(int num) { struct timespec ts; struct timeval tv; int i; for (i = 0; i < num; ++i) { clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); } } int main(void) { int child; syscalls(10); if (0 == (child = fork())) { syscalls(10); atomic_printf("CHILD-EXIT "); exit(0); } syscalls(10); waitpid(child, NULL, 0); atomic_puts("PARENT-EXIT"); return 0; } rr-4.4.0/src/test/fork_syscalls.run000066400000000000000000000001021277367620400173230ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test "CHILD-EXIT PARENT-EXIT" rr-4.4.0/src/test/function_calls.c000066400000000000000000000010621277367620400170740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int result = 0; static void funcallD(int n) { result = n; } static void funcallC(int n) { funcallD(n); funcallD(n); } static void funcallB(int n) { funcallC(n); funcallC(n); } static void funcallA(int n) { funcallB(n); funcallB(n); } static void funcall(int n) { funcallA(n); funcallA(n); } int main(void) { funcall(1); funcall(1); atomic_printf("result=%d\n", result); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/function_calls.py000066400000000000000000000003361277367620400173050ustar00rootroot00000000000000from rrutil import * send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('n'); send_gdb('n'); send_gdb('reverse-next'); send_gdb('c'); expect_gdb('exited normally') ok() rr-4.4.0/src/test/function_calls.run000066400000000000000000000000471277367620400174600ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/futex_pi.c000066400000000000000000000013641277367620400157210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fut = 0; int ret; ret = syscall(SYS_futex, &fut, FUTEX_LOCK_PI, NULL, NULL, 0); test_assert(ret == -1 && errno == ENOSYS); ret = syscall(SYS_futex, &fut, FUTEX_TRYLOCK_PI, NULL, NULL, 0); test_assert(ret == -1 && errno == ENOSYS); ret = syscall(SYS_futex, &fut, FUTEX_UNLOCK_PI, NULL, NULL, 0); test_assert(ret == -1 && errno == ENOSYS); ret = syscall(SYS_futex, &fut, FUTEX_CMP_REQUEUE_PI, NULL, NULL, 0); test_assert(ret == -1 && errno == ENOSYS); ret = syscall(SYS_futex, &fut, FUTEX_WAIT_REQUEUE_PI, NULL, NULL, 0); test_assert(ret == -1 && errno == ENOSYS); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/futex_priorities.c000066400000000000000000000013501277367620400174750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int v; static int v2; static void* run_thread(__attribute__((unused)) void* p) { setpriority(PRIO_PROCESS, 0, 4); syscall(SYS_futex, &v, FUTEX_WAKE_OP, 1, NULL, &v2, FUTEX_OP(FUTEX_OP_SET, 1, FUTEX_OP_CMP_EQ, 0)); /* We test that the side effects of this syscall on v2 (setting it to 1) are performed before we context-switch to the main thread and run it. */ return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, run_thread, NULL); test_assert(0 == syscall(SYS_futex, &v, FUTEX_WAIT, 0, NULL, NULL, 0)); test_assert(1 == v2); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fxregs.c000066400000000000000000000106711277367620400153750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } enum cpuid_requests { CPUID_GETFEATURES = 0x01, }; static void cpuid(int code, int subrequest, unsigned int* a, unsigned int* c, unsigned int* d) { asm volatile("cpuid" : "=a"(*a), "=c"(*c), "=d"(*d) : "a"(code), "c"(subrequest) : "ebx"); } static __attribute__((used)) const double st0 = 1; static __attribute__((used)) const double st1 = 2; static __attribute__((used)) const double st2 = 3; static __attribute__((used)) const double st3 = 4; static __attribute__((used)) const double st4 = 5; static __attribute__((used)) const double st5 = 6; static __attribute__((used)) const double st6 = 7; static __attribute__((used)) const double st7 = 8; static __attribute__((used)) const float xmm0 = 10; static __attribute__((used)) const float xmm1 = 11; static __attribute__((used)) const float xmm2 = 12; static __attribute__((used)) const float xmm3 = 13; static __attribute__((used)) const float xmm4 = 14; static __attribute__((used)) const float xmm5 = 15; static __attribute__((used)) const float xmm6 = 16; static __attribute__((used)) const float xmm7 = 17; static __attribute__((used)) const float xmm8 = 18; static __attribute__((used)) const float xmm9 = 19; static __attribute__((used)) const float xmm10 = 20; static __attribute__((used)) const float xmm11 = 21; static __attribute__((used)) const float xmm12 = 22; static __attribute__((used)) const float xmm13 = 23; static __attribute__((used)) const float xmm14 = 24; static __attribute__((used)) const float xmm15 = 25; #define AVX_FEATURE_FLAG (1 << 28) #define OSXSAVE_FEATURE_FLAG (1 << 27) static int AVX_enabled; int main(void) { unsigned int eax, ebx, ecx; unsigned int required_cpuid_flags = AVX_FEATURE_FLAG | OSXSAVE_FEATURE_FLAG; cpuid(CPUID_GETFEATURES, 0, &eax, &ebx, &ecx); AVX_enabled = (ecx & required_cpuid_flags) == required_cpuid_flags; if (!AVX_enabled) { atomic_puts("AVX YMM registers disabled, not tested"); } __asm__ __volatile__( /* Push the constants in stack order so they look as * we expect in gdb. */ #if __i386__ "fldl st7\n\t" "fldl st6\n\t" "fldl st5\n\t" "fldl st4\n\t" "fldl st3\n\t" "fldl st2\n\t" "fldl st1\n\t" "fldl st0\n\t" "movss xmm0, %xmm0\n\t" "movss xmm1, %xmm1\n\t" "movss xmm2, %xmm2\n\t" "movss xmm3, %xmm3\n\t" "movss xmm4, %xmm4\n\t" "movss xmm5, %xmm5\n\t" "movss xmm6, %xmm6\n\t" "movss xmm7, %xmm7\n\t" #elif __x86_64__ "fldl st7(%rip)\n\t" "fldl st6(%rip)\n\t" "fldl st5(%rip)\n\t" "fldl st4(%rip)\n\t" "fldl st3(%rip)\n\t" "fldl st2(%rip)\n\t" "fldl st1(%rip)\n\t" "fldl st0(%rip)\n\t" "movss xmm0(%rip), %xmm0\n\t" "movss xmm1(%rip), %xmm1\n\t" "movss xmm2(%rip), %xmm2\n\t" "movss xmm3(%rip), %xmm3\n\t" "movss xmm4(%rip), %xmm4\n\t" "movss xmm5(%rip), %xmm5\n\t" "movss xmm6(%rip), %xmm6\n\t" "movss xmm7(%rip), %xmm7\n\t" "movss xmm8(%rip), %xmm8\n\t" "movss xmm9(%rip), %xmm9\n\t" "movss xmm10(%rip), %xmm10\n\t" "movss xmm11(%rip), %xmm11\n\t" "movss xmm12(%rip), %xmm12\n\t" "movss xmm13(%rip), %xmm13\n\t" "movss xmm14(%rip), %xmm14\n\t" "movss xmm15(%rip), %xmm15\n\t" #else #error unexpected architecture #endif ); if (AVX_enabled) { __asm__ __volatile__( #if defined(__i386__) || defined(__x86_64__) "vinsertf128 $1,%xmm1,%ymm0,%ymm0\n\t" "vinsertf128 $1,%xmm2,%ymm1,%ymm1\n\t" "vinsertf128 $1,%xmm3,%ymm2,%ymm2\n\t" "vinsertf128 $1,%xmm4,%ymm3,%ymm3\n\t" "vinsertf128 $1,%xmm5,%ymm4,%ymm4\n\t" "vinsertf128 $1,%xmm6,%ymm5,%ymm5\n\t" "vinsertf128 $1,%xmm7,%ymm6,%ymm6\n\t" "vinsertf128 $1,%xmm0,%ymm7,%ymm7\n\t" #endif #ifdef __x86_64__ "vinsertf128 $1,%xmm9,%ymm8,%ymm8\n\t" "vinsertf128 $1,%xmm10,%ymm9,%ymm9\n\t" "vinsertf128 $1,%xmm11,%ymm10,%ymm10\n\t" "vinsertf128 $1,%xmm12,%ymm11,%ymm11\n\t" "vinsertf128 $1,%xmm13,%ymm12,%ymm12\n\t" "vinsertf128 $1,%xmm14,%ymm13,%ymm13\n\t" "vinsertf128 $1,%xmm15,%ymm14,%ymm14\n\t" "vinsertf128 $1,%xmm8,%ymm15,%ymm15\n\t" #endif ); } breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/fxregs.py000066400000000000000000000022601277367620400155760ustar00rootroot00000000000000from rrutil import * import re send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') # See fxregs.c for the list of constants that are loaded into the # $st*, $xmm* and $ymm* registers. for i in xrange(8): send_gdb('p $st%d'%(i)) expect_gdb(' = %d'%(i + 1)) for i in xrange(8): send_gdb('p $xmm%d.v4_float[0]'%(i)) expect_gdb(' = %d'%(i + 10)) send_gdb('show architecture') have_64 = 0 == expect_list([re.compile('i386:x86-64\)'), re.compile('i386\)')]) if have_64: for i in xrange(8,16): send_gdb('p $xmm%d.v4_float[0]'%(i)) expect_gdb(' = %d'%(i + 10)) send_gdb('p AVX_enabled') have_AVX = 0 == expect_list([re.compile(' = 1'), re.compile(' = 0')]) if have_AVX: for i in xrange(8): send_gdb('p $ymm%d.v8_float[0]'%(i)) expect_gdb(' = %d'%(i + 10)) send_gdb('p $ymm%d.v8_float[4]'%(i)) expect_gdb(' = %d'%((i + 1)%8 + 10)) if have_64: for i in xrange(8,16): send_gdb('p $ymm%d.v8_float[0]'%(i)) expect_gdb(' = %d'%(i + 10)) send_gdb('p $ymm%d.v8_float[4]'%(i)) expect_gdb(' = %d'%((i - 8 + 1)%8 + 18)) ok() rr-4.4.0/src/test/fxregs.run000066400000000000000000000000471277367620400157530ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/gcrypt_rdrand.run000066400000000000000000000003071277367620400173160ustar00rootroot00000000000000source `dirname $0`/util.sh # Override record since there's no program here. function record { exe=$1; just_record $exe "$2 $3 $4 $5" } compare_test intel-rdrand "" "cat /etc/gcrypt/hwf.deny" rr-4.4.0/src/test/generic_break.py000066400000000000000000000002061277367620400170560ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') ok() rr-4.4.0/src/test/get_thread_list.py000066400000000000000000000026541277367620400174500ustar00rootroot00000000000000from rrutil import * import re NUM_THREADS = 10 send_gdb('b hit_barrier') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, hit_barrier') arch = get_exe_arch() # The locations the threads are stopped at depends on the architecture. stopped_locations = { # on i386, we sometimes stop in the middle of nowhere 'i386': ['(0x[0-9a-f]+ in )?__kernel_vsyscall', '(0x[0-9a-f]+ in )?_traced_raw_syscall', '0x[0-9a-f]+ in \?\?', '(0x[0-9a-f]+ in )?__lll_lock_wait', '(0x[0-9a-f]+ in )?pthread_barrier_wait', '(0x[0-9a-f]+ in )?futex_wait'], 'i386:x86-64': ['(0x[0-9a-f]+ in )?__lll_lock_wait', '(0x[0-9a-f]+ in )?pthread_barrier_wait', '(0x[0-9a-f]+ in )?futex_wait', '0x0*70000002 in \?\?'], } for i in xrange(NUM_THREADS + 1, 1, -1): # The threads are at the kernel syscall entry, or either the # traced/untraced entry reached through the rr monkeypatched one. # Rarely, non-main threads have been observed to be reordered (i.e. gdb # did not number them in order of creation). This does not seem to be a bug # so tolerate it. send_gdb('info threads') expect_gdb(r'%d\s+Thread[^(]+\(BP-THREAD-[0-9]+\) (?:%s)'% (i, '|'.join(stopped_locations[arch]))) expect_gdb(r'\(rr\)') send_gdb('info threads') expect_gdb(r'1\s+Thread[^h]+hit_barrier \(\)') ok() rr-4.4.0/src/test/get_thread_list.run000066400000000000000000000001111277367620400176060ustar00rootroot00000000000000source `dirname $0`/util.sh record barrier$bitness debug get_thread_list rr-4.4.0/src/test/getcpu.c000066400000000000000000000007531277367620400153660ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { unsigned* cpu; unsigned* node; ALLOCATE_GUARD(cpu, -1); ALLOCATE_GUARD(node, -1); /* The 'tcache' parameter is unused in all kernels rr works on */ test_assert(0 == syscall(SYS_getcpu, cpu, node, NULL)); test_assert(*cpu <= 0xffffff); test_assert(*node <= 0xffffff); VERIFY_GUARD(cpu); VERIFY_GUARD(node); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/getcwd.c000066400000000000000000000021761277367620400153550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { ssize_t pagesize = sysconf(_SC_PAGESIZE); ssize_t two_pages_size = 2 * pagesize; void* two_pages = mmap(NULL, two_pages_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); void* two_pages_end = two_pages + two_pages_size; char* cwd; char* expected_cwd; test_assert(argc == 2); expected_cwd = argv[1]; test_assert(two_pages != (void*)-1); /* Make the value returned into |path| overlap two physical * pages. */ cwd = two_pages + pagesize - 3; /* Fill pages with non-zeroes to ensure the returned string is * properly null-terminated */ memset(two_pages, 0xFF, two_pages_size); test_assert(cwd == getcwd(cwd, two_pages_end - (void*)cwd)); atomic_printf("current working directory is %s; should be %s\n", cwd, expected_cwd); test_assert(!strcmp(cwd, expected_cwd)); /* Make sure we didn't write too many bytes */ test_assert((unsigned char)cwd[strlen(cwd) + 1] == 0xFF); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/getcwd.run000066400000000000000000000001171277367620400157300ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME "$PWD" replay check EXIT-SUCCESS rr-4.4.0/src/test/getgroups.c000066400000000000000000000006461277367620400161170ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { gid_t groups[1024]; int num_groups = getgroups(ALEN(groups), groups); int i; atomic_printf("User %d belongs to %d groups:\n ", geteuid(), num_groups); for (i = 0; i < num_groups; ++i) { atomic_printf("%d,", groups[i]); } atomic_puts(""); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/getpwnam.c000066400000000000000000000003661277367620400157210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct passwd* p = getpwnam("root"); atomic_printf("%d\n", p ? p->pw_uid : 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/getrandom.c000066400000000000000000000014201277367620400160470ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #ifndef GRND_NONBLOCK #define GRND_NONBLOCK 0x0001 #define GRND_RANDOM 0x0002 #endif int main(void) { char buf[128]; int ret; memset(buf, 0, sizeof(buf)); /* There's no libc helper for this syscall. */ ret = syscall(RR_getrandom, buf, sizeof(buf), GRND_NONBLOCK); if (-1 == ret && ENOSYS == errno) { atomic_puts("SYS_getrandom not supported on this kernel"); } else { uint i; test_assert(sizeof(buf) == ret); atomic_printf( "fetched %d random bytes (non-blockingly); first few bytes:\n ", ret); for (i = 0; i < 10; ++i) { atomic_printf("%02x", buf[i]); } atomic_puts(""); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/getsid.c000066400000000000000000000004121277367620400153460ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t sid = getsid(0); atomic_printf("getsid(0) session ID: %d\n", sid); test_assert(sid > 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/gettimeofday.c000066400000000000000000000006661277367620400165630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct timeval* tv; struct timezone* tz; ALLOCATE_GUARD(tv, 0); ALLOCATE_GUARD(tz, 'x'); test_assert(0 == gettimeofday(tv, tz)); test_assert(tv->tv_sec > 0); test_assert(tz->tz_dsttime == 0); /* always zero on Linux */ VERIFY_GUARD(tv); VERIFY_GUARD(tz); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/goto_event.c000066400000000000000000000023261277367620400162460ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void first_breakpoint(void) { int break_here = 1; (void)break_here; } static void second_breakpoint(void) { int break_here = 1; (void)break_here; } static void* child_thread(void* num_syscallsp) { int num_syscalls = (uintptr_t)num_syscallsp; int i; first_breakpoint(); atomic_printf("%d: running %d syscalls ...\n", getpid(), num_syscalls); for (i = 0; i < num_syscalls; ++i) { event_syscall(); } second_breakpoint(); return NULL; } static void child(int num_syscalls) { pthread_t t; test_assert(0 == pthread_create(&t, NULL, child_thread, (void*)(uintptr_t)num_syscalls)); pthread_join(t, NULL); exit(0); } int main(int argc, char** argv) { int num_syscalls; pid_t c; int status; test_assert(argc == 2); num_syscalls = atoi(argv[1]); if (0 == (c = fork())) { child(num_syscalls); test_assert("Not reached" && 0); } atomic_printf("%d: waiting on %d ...\n", getpid(), c); test_assert(c == waitpid(c, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/goto_event.py000066400000000000000000000005511277367620400164520ustar00rootroot00000000000000from rrutil import * send_gdb('b first_breakpoint') expect_gdb('Breakpoint 1') send_gdb('b second_breakpoint') expect_gdb('Breakpoint 2') send_gdb('c') # If we hit first_breakpoint, then we never continue and never reach # second_breakpoint. expect_gdb('Breakpoint 2, second_breakpoint') restart_replay(1) expect_gdb('Breakpoint 1, first_breakpoint') ok() rr-4.4.0/src/test/goto_event.run000066400000000000000000000001411277367620400166210ustar00rootroot00000000000000source `dirname $0`/util.sh EVENTS=1000 record $TESTNAME $EVENTS debug goto_event "-g $EVENTS" rr-4.4.0/src/test/grandchild_threads.c000066400000000000000000000011201277367620400176750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { sleep(1000); return NULL; } int main(void) { pid_t child; pthread_t thread; int pipe_fds[2]; char ch; pipe(pipe_fds); child = fork(); if (child > 0) { read(pipe_fds[0], &ch, 1); kill(child, 9); /* try to exit before the child's exit */ return 0; } pthread_create(&thread, NULL, start_thread, NULL); atomic_puts("EXIT-SUCCESS"); write(pipe_fds[1], &ch, 1); sleep(1000); return 0; } rr-4.4.0/src/test/grandchild_threads_main_running.c000066400000000000000000000011611277367620400224460ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static void* start_thread(__attribute__((unused)) void* p) { char ch; sleep(1); atomic_puts("EXIT-SUCCESS"); write(pipe_fds[1], &ch, 1); sleep(1000); return NULL; } int main(void) { pid_t child; pthread_t thread; char ch; pipe(pipe_fds); child = fork(); if (child > 0) { read(pipe_fds[0], &ch, 1); kill(child, 9); /* try to exit before the child's exit */ return 0; } pthread_create(&thread, NULL, start_thread, NULL); while (1) { } return 0; } rr-4.4.0/src/test/grandchild_threads_parent_alive.c000066400000000000000000000011631277367620400224350ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { sleep(1000); return NULL; } int main(void) { pid_t child; pthread_t thread; int pipe_fds[2]; char ch; pipe(pipe_fds); child = fork(); if (child > 0) { read(pipe_fds[0], &ch, 1); kill(child, 9); /* wait for the child to exit before we exit */ waitpid(child, NULL, 0); return 0; } pthread_create(&thread, NULL, start_thread, NULL); atomic_puts("EXIT-SUCCESS"); write(pipe_fds[1], &ch, 1); sleep(1000); return 0; } rr-4.4.0/src/test/grandchild_threads_thread_running.c000066400000000000000000000011371277367620400227740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { while (1) { } return NULL; } int main(void) { pid_t child; pthread_t thread; int pipe_fds[2]; char ch; pipe(pipe_fds); child = fork(); if (child > 0) { read(pipe_fds[0], &ch, 1); kill(child, 9); /* try to exit before the child's exit */ return 0; } pthread_create(&thread, NULL, start_thread, NULL); sleep(1); atomic_puts("EXIT-SUCCESS"); write(pipe_fds[1], &ch, 1); sleep(1000); return 0; } rr-4.4.0/src/test/hardlink_mmapped_files.run000066400000000000000000000003131277367620400211320ustar00rootroot00000000000000source `dirname $0`/util.sh cp $OBJDIR/lib/libtest_lib$bitness.so . RECORD_ARGS="--env=LD_PRELOAD=libtest_lib$bitness.so" record constructor$bitness rm libtest_lib$bitness.so replay check EXIT-SUCCESS rr-4.4.0/src/test/hello.c000066400000000000000000000002311277367620400151710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { atomic_puts("Hi"); return 0; } rr-4.4.0/src/test/hello.run000066400000000000000000000000561277367620400155600ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test 'Hi' rr-4.4.0/src/test/history.c000066400000000000000000000005061277367620400155740ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpointA(__attribute__((unused)) int i) { int break_here = 1; (void)break_here; } int main(void) { int i; for (i = 0; i < 5; ++i) { breakpointA(i); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/history.py000066400000000000000000000014071277367620400160030ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpointA') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('i=0') send_gdb('c') expect_gdb('i=1') send_gdb('c') expect_gdb('i=2') send_gdb('c') expect_gdb('i=3') send_gdb('c') expect_gdb('i=4') send_gdb('forward') expect_gdb("Can't go forward. No more history entries.") send_gdb('back') expect_gdb('i=3') send_gdb('back') expect_gdb('i=2') send_gdb('back') expect_gdb('i=1') # A diversion should not interfere with the history send_gdb('call strlen("abcd")') send_gdb('back') expect_gdb('i=0') # Clear the forward stack by pushing a new entry send_gdb('c') expect_gdb('i=1') send_gdb('forward') expect_gdb("Can't go forward. No more history entries.") send_gdb('back') expect_gdb('i=0') send_gdb('d 1') expect_gdb('c') ok() rr-4.4.0/src/test/history.run000066400000000000000000000000471277367620400161560ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/ignored_async_usr1.c000066400000000000000000000010011277367620400176600ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int dummy = 0, i; /* NB: since we're masking out the signal, there's no way for * us to tell whether or not it was actually delivered. This * test can spuriously pass if it's never sent SIGUSR1. */ signal(SIGUSR1, SIG_IGN); atomic_puts("SIGUSR1 disabled"); for (i = 1; i < (1 << 27); ++i) { dummy += (dummy + i) % 9735; } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ignored_async_usr1.run000066400000000000000000000007121277367620400202520ustar00rootroot00000000000000source `dirname $0`/util.sh SYNC_TOKEN=disabled record $TESTNAME & echo "Waiting for token '$SYNC_TOKEN' from tracee ..." until grep -q $SYNC_TOKEN record.out; do sleep 0 done echo " done. Delivering SIGUSR1 ..." kill -USR1 $rrpid $(pidof $TESTNAME-$nonce) # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written. wait echo "Replaying ..." replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/ignored_sigsegv.c000066400000000000000000000010041277367620400172430ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* p) { atomic_puts("EXIT-SUCCESS"); crash_null_deref(); return NULL; } int main(void) { struct sigaction act; pthread_t thread; act.sa_handler = SIG_IGN; act.sa_flags = SA_NODEFER; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); pthread_create(&thread, NULL, start_thread, NULL); pthread_join(thread, NULL); return 0; } rr-4.4.0/src/test/ignored_sigsegv.run000066400000000000000000000001301277367620400176240ustar00rootroot00000000000000source `dirname $0`/util.sh ( record $TESTNAME ) >& /dev/null replay check EXIT-SUCCESS rr-4.4.0/src/test/immediate_restart.c000066400000000000000000000005661277367620400176030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int child; atomic_printf("%d: forking...\n", getpid()); if (0 == (child = fork())) { atomic_puts("EXIT-SUCCESS"); return 0; } atomic_printf("child %d\n", child); waitpid(child, NULL, 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/immediate_restart.py000066400000000000000000000003521277367620400200020ustar00rootroot00000000000000from rrutil import * restart_replay() # A single EXIT-SUCCESS is expected since the child process to which we have # attached only prints one, and it exits before the parent prints its # EXIT-SUCCESS. expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/immediate_restart.run000066400000000000000000000002761277367620400201630ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug immediate_restart "-f $TARGET_PID" rr-4.4.0/src/test/inotify.c000066400000000000000000000020101277367620400155440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct inotify_event* event; int desc; int file_fd; int fd = inotify_init(); test_assert(fd >= 0); test_assert(0 == close(fd)); fd = inotify_init1(IN_CLOEXEC); test_assert(fd >= 0); file_fd = open("foo", O_WRONLY | O_CREAT, 0777); test_assert(file_fd >= 0); test_assert(0 == close(file_fd)); desc = inotify_add_watch(fd, "foo", IN_ALL_EVENTS); if (desc == -1 && errno == ENOSPC) { atomic_puts("Hit inotify watch limit"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(desc >= 0); test_assert(0 <= open("foo", O_WRONLY | O_CREAT, 0777)); ALLOCATE_GUARD(event, 'x'); test_assert(sizeof(*event) == read(fd, event, sizeof(*event))); VERIFY_GUARD(event); test_assert(event->wd == desc); test_assert(event->mask == IN_OPEN); test_assert(0 == inotify_rm_watch(fd, desc)); test_assert(0 == unlink("foo")); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/int3.c000066400000000000000000000010121277367620400147410ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ static void breakpoint(void) { __asm__("int $3"); /* NB: the above instruction *must* be at line 3 in this file. * Tests rely on that. */ } #include "rrutil.h" static void handle_sigtrap(__attribute__((unused)) int sig) { atomic_puts("EXIT-SUCCESS"); _exit(0); } int main(void) { signal(SIGTRAP, handle_sigtrap); atomic_puts("raising SIGTRAP ..."); breakpoint(); test_assert("didn't catch trap!" && 0); return 0; } rr-4.4.0/src/test/int3_ok.c000066400000000000000000000005521277367620400154420ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ static void breakpoint(void) { __asm__("int $3"); /* NB: the above instruction *must* be at line 3 in this file. * Tests rely on that. */ } #include "rrutil.h" int main(void) { atomic_puts("doing int3 ..."); breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/int3_ok.run000066400000000000000000000001071277367620400160200ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS=-t5 compare_test EXIT-SUCCESS rr-4.4.0/src/test/interrupt.c000066400000000000000000000006371277367620400161340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" void spin(void) { int i; atomic_puts("spinning"); for (i = 1; i < (1 << 30); ++i) { if (0 == i % (1 << 20)) { write(STDOUT_FILENO, ".", 1); } if (0 == i % (79 * (1 << 20))) { write(STDOUT_FILENO, "\n", 1); } } } int main(void) { spin(); atomic_puts("done"); return 0; } rr-4.4.0/src/test/interrupt.py000066400000000000000000000003241277367620400163330ustar00rootroot00000000000000from rrutil import * # XXX this test is racy, because we don't have a way to halt replay # until some condition is satisfied. Maybe we should add that. send_gdb('c') expect_rr('spinning') interrupt_gdb() ok() rr-4.4.0/src/test/interrupt.run000066400000000000000000000000471277367620400165110ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/intr_futex_wait_restart.c000066400000000000000000000051061277367620400210530ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char start_token = '!'; static const char sentinel_token = ' '; static pthread_t reader; static pthread_barrier_t barrier; static pid_t reader_tid; static int reader_caught_signal; static int sockfds[2]; pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; pthread_cond_t cond = PTHREAD_COND_INITIALIZER; static void cond_wait(int secs) { struct timespec ts; clock_gettime(CLOCK_REALTIME, &ts); ts.tv_sec += secs; test_assert(ETIMEDOUT == pthread_cond_timedwait(&cond, &lock, &ts)); } static void sighandler(__attribute__((unused)) int sig) { test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 1 ..."); cond_wait(1); atomic_puts("r: ... wait done"); } static void* reader_thread(__attribute__((unused)) void* dontcare) { char token = start_token; struct sigaction act; int readsock = sockfds[1]; char c = sentinel_token; int flags = 0; pthread_mutex_lock(&lock); reader_tid = sys_gettid(); flags = SA_RESTART; act.sa_handler = sighandler; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR1, &act, NULL); act.sa_handler = SIG_IGN; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR2, &act, NULL); pthread_barrier_wait(&barrier); atomic_puts("r: blocking on read, awaiting signal ..."); test_assert(1 == read(readsock, &c, sizeof(c))); test_assert(1 == reader_caught_signal); atomic_printf("r: ... read level 0 '%c'\n", c); test_assert(c == token); return NULL; } int main(void) { char token = start_token; struct timeval ts; /* (Kick on the syscallbuf if it's enabled.) */ gettimeofday(&ts, NULL); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); pthread_barrier_init(&barrier, NULL, 2); pthread_create(&reader, NULL, reader_thread, NULL); pthread_barrier_wait(&barrier); /* Force a blocked read() that's interrupted by a SIGUSR1, * which then itself blocks on read() and succeeds. */ atomic_puts("M: sleeping ..."); usleep(500000); atomic_puts("M: killing reader ..."); pthread_kill(reader, SIGUSR1); atomic_puts("M: (quick nap)"); usleep(100000); atomic_puts("M: killing reader again ..."); pthread_kill(reader, SIGUSR2); usleep(500000); atomic_printf("M: finishing level 0 reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/intr_poll.c000066400000000000000000000020301277367620400160670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipefds[2]; static int poll_pipe(int timeout_ms) { struct pollfd pfd; int ret; pfd.fd = pipefds[0]; pfd.events = POLLIN; errno = 0; ret = poll(&pfd, 1, timeout_ms); /* Verify that our input fields were not trashed */ test_assert(pfd.fd == pipefds[0]); test_assert(pfd.events == POLLIN); return ret; } static int caught_signal; static void handle_signal(__attribute__((unused)) int sig) { ++caught_signal; } int main(void) { struct timespec dummy; test_assert(0 == pipe(pipefds)); signal(SIGALRM, SIG_IGN); alarm(1); atomic_puts("ignoring SIGALRM, going into poll ..."); test_assert(0 == poll_pipe(1500) && 0 == errno); signal(SIGALRM, handle_signal); alarm(1); atomic_puts("handling SIGALRM, going into poll ..."); clock_gettime(CLOCK_MONOTONIC, &dummy); test_assert(-1 == poll_pipe(-1) && EINTR == errno); test_assert(1 == caught_signal); atomic_puts("EXIT-SUCCESS"); return 1; } rr-4.4.0/src/test/intr_ppoll.c000066400000000000000000000022611277367620400162550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #define NUM_ITERATIONS 10 int main(void) { int fds[2]; struct pollfd pfd; int i; struct timespec t; t.tv_sec = 2; t.tv_nsec = 0; sigset_t sigset; test_assert(0 == sigemptyset(&sigset)); test_assert(0 == sigaddset(&sigset, SIGCHLD)); signal(SIGALRM, SIG_IGN); pid_t pid = getpid(); pipe2(fds, O_NONBLOCK); pfd.fd = fds[0]; pfd.events = POLLIN; for (i = 0; i < NUM_ITERATIONS; ++i) { int ret; atomic_printf("iteration %d\n", i); if (fork() == 0) { usleep(100000); // SIGCHLD will be unblocked once these signals are delivered. // Half the time we send SIGALRM too, to verify that SIGCHLD only becomes // unblocked after *all* of these are delivered. kill(pid, SIGWINCH); if (i % 2) { kill(pid, SIGALRM); } return 0; } ret = ppoll(&pfd, 1, &t, &sigset); sigset_t after_sigset; ret = sigprocmask(SIG_BLOCK, NULL, &after_sigset); test_assert(ret == 0); test_assert(!sigismember(&after_sigset, SIGCHLD)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/intr_pselect.c000066400000000000000000000024221277367620400165650ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipefds[2]; static int pselect_pipe(int timeout, sigset_t* sigmask) { fd_set set; FD_ZERO(&set); FD_SET(pipefds[0], &set); struct timespec t; t.tv_sec = timeout; t.tv_nsec = 0; errno = 0; return pselect(pipefds[0] + 1, &set, NULL, NULL, timeout ? &t : NULL, sigmask); } static int caught_signal; static void handle_signal(__attribute__((unused)) int sig) { ++caught_signal; } int main(void) { sigset_t sigmask; sigemptyset(&sigmask); pipe(pipefds); signal(SIGALRM, SIG_IGN); alarm(1); atomic_puts("ignoring SIGALRM, going into pselect ..."); test_assert(0 == pselect_pipe(2, &sigmask) && 0 == errno); /* Test that the signal mask is correct in rr when the SIGALRM is delivered */ sigaddset(&sigmask, SIGCHLD); signal(SIGALRM, handle_signal); alarm(1); atomic_puts("handling SIGALRM, going into pselect ..."); test_assert(-1 == pselect_pipe(0, &sigmask) && EINTR == errno); test_assert(1 == caught_signal); sigaddset(&sigmask, SIGALRM); alarm(1); atomic_puts("blocking SIGALRM, going into pselect ..."); test_assert(0 == pselect_pipe(2, &sigmask) && 0 == errno); atomic_puts("EXIT-SUCCESS"); return 1; } rr-4.4.0/src/test/intr_ptrace_decline.c000066400000000000000000000056001277367620400200700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char start_token = '!'; static const char sentinel_token = ' '; static pthread_t reader; static pthread_barrier_t barrier; static int sockfds[2]; pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER; pthread_cond_t cond = PTHREAD_COND_INITIALIZER; static void fin_intr_sleep(int secs) { struct timespec req = {.tv_sec = secs }; struct timespec rem = {.tv_sec = -1, .tv_nsec = -1 }; test_assert(0 == nanosleep(&req, &rem)); /* We would normally assert that the outparam wasn't touched * for this successful sleep, but ptrace-declined signals are * an odd case, the only way a nanosleep can restart. The * kernel has been observed to write back the outparam at * interrupt time, so we track that semantics here. * * test_assert(-1 == rem.tv_sec && -1 == rem.tv_nsec); */ } static void fin_poll(int secs) { static int pipefds[2]; struct pollfd pfd; int ret; pipe(pipefds); pfd.fd = pipefds[0]; pfd.events = POLLIN; pfd.revents = -1; errno = 0; ret = poll(&pfd, 1, 1000 * secs); atomic_printf("r: poll() returns %d; pfd.revents = 0x%x\n", ret, pfd.revents); test_assert(0 == ret); test_assert(0 == pfd.revents); } static void cond_wait(int secs) { struct timespec ts; clock_gettime(CLOCK_REALTIME, &ts); ts.tv_sec += secs; test_assert(ETIMEDOUT == pthread_cond_timedwait(&cond, &lock, &ts)); } static void* reader_thread(__attribute__((unused)) void* dontcare) { char token = start_token; int readsock = sockfds[1]; char c = sentinel_token; pthread_mutex_lock(&lock); pthread_barrier_wait(&barrier); atomic_puts("r: blocking on sleep, awaiting signal ..."); fin_intr_sleep(1); atomic_puts("r: blocking on poll, awaiting signal ..."); fin_poll(1); atomic_puts("r: blocking on futex, awaiting signal ..."); cond_wait(1); atomic_puts("r: blocking on read, awaiting signal ..."); test_assert(1 == read(readsock, &c, sizeof(c))); atomic_printf("r: ... read '%c'\n", c); test_assert(c == token); return NULL; } int main(void) { char token = start_token; struct timeval ts; int i; /* (Kick on the syscallbuf if it's enabled.) */ gettimeofday(&ts, NULL); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); pthread_barrier_init(&barrier, NULL, 2); pthread_create(&reader, NULL, reader_thread, NULL); pthread_barrier_wait(&barrier); atomic_puts("M: sleeping ..."); usleep(500000); for (i = 0; i < 4; ++i) { atomic_puts("M: killing reader ..."); pthread_kill(reader, SIGUSR1); atomic_puts("M: sleeping ..."); sleep(1); } atomic_printf("M: finishing original reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/intr_ptrace_decline.run000066400000000000000000000001741277367620400204530ustar00rootroot00000000000000source `dirname $0`/util.sh # Ignore SIGUSR1; block its delivery to tracees. RECORD_ARGS="-i10" compare_test EXIT-SUCCESS rr-4.4.0/src/test/intr_read_no_restart.c000066400000000000000000000055301277367620400203040ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char start_token = '!'; static const char sentinel_token = ' '; static pthread_t reader; static pthread_barrier_t barrier; static pid_t reader_tid; static int reader_caught_signal; static int sockfds[2]; static void sighandler(__attribute__((unused)) int sig) { char c = sentinel_token; test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 1 ..."); test_assert(-1 == read(sockfds[1], &c, sizeof(c)) && EINTR == errno); atomic_printf("r: ... read level 1 '%c'\n", c); test_assert(c == sentinel_token); } static void sighandler2(__attribute__((unused)) int sig) { char c = sentinel_token; test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 2 ..."); test_assert(1 == read(sockfds[1], &c, sizeof(c))); atomic_printf("r: ... read level 2 '%c'\n", c); test_assert(c == start_token); } static void* reader_thread(__attribute__((unused)) void* dontcare) { struct sigaction act; struct timeval ts; int readsock = sockfds[1]; char c = sentinel_token; int flags = 0; reader_tid = sys_gettid(); act.sa_handler = sighandler; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR1, &act, NULL); act.sa_handler = sighandler2; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR2, &act, NULL); pthread_barrier_wait(&barrier); /* (Put another record in the syscallbuf.) */ gettimeofday(&ts, NULL); atomic_puts("r: blocking on read, awaiting signal ..."); test_assert(-1 == read(readsock, &c, sizeof(c)) && EINTR == errno); test_assert(2 == reader_caught_signal); atomic_printf("r: ... read level 0 '%c'\n", c); test_assert(c == sentinel_token); return NULL; } int main(void) { char token = start_token; struct timeval ts; /* (Kick on the syscallbuf if it's enabled.) */ gettimeofday(&ts, NULL); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); pthread_barrier_init(&barrier, NULL, 2); pthread_create(&reader, NULL, reader_thread, NULL); pthread_barrier_wait(&barrier); /* Force a blocked read() that's interrupted by a SIGUSR1, * which then itself blocks on read() and succeeds. */ atomic_puts("M: sleeping ..."); usleep(500000); atomic_puts("M: killing reader ..."); pthread_kill(reader, SIGUSR1); atomic_puts("M: (quick nap)"); usleep(100000); atomic_puts("M: killing reader again ..."); pthread_kill(reader, SIGUSR2); atomic_puts("M: (longer nap)"); usleep(500000); atomic_printf("M: finishing level 2 reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/intr_read_restart.c000066400000000000000000000062011277367620400176040ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char start_token = '!'; static const char sentinel_token = ' '; static pthread_t reader; static pthread_barrier_t barrier; static pid_t reader_tid; static int reader_caught_signal; static int sockfds[2]; static void sighandler(__attribute__((unused)) int sig) { char c = sentinel_token; test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 1 ..."); test_assert(1 == read(sockfds[1], &c, sizeof(c))); atomic_printf("r: ... read level 1 '%c'\n", c); test_assert(c == start_token + 1); } static void sighandler2(__attribute__((unused)) int sig) { char c = sentinel_token; test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 2 ..."); test_assert(1 == read(sockfds[1], &c, sizeof(c))); atomic_printf("r: ... read level 2 '%c'\n", c); test_assert(c == start_token); } static void* reader_thread(__attribute__((unused)) void* dontcare) { char token = start_token; struct sigaction act; int readsock = sockfds[1]; char c = sentinel_token; int flags = 0; reader_tid = sys_gettid(); flags = SA_RESTART; act.sa_handler = sighandler; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR1, &act, NULL); act.sa_handler = sighandler2; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR2, &act, NULL); pthread_barrier_wait(&barrier); atomic_puts("r: blocking on read, awaiting signal ..."); test_assert(1 == read(readsock, &c, sizeof(c))); test_assert(2 == reader_caught_signal); token += reader_caught_signal; atomic_printf("r: ... read level 0 '%c'\n", c); test_assert(c == token); return NULL; } int main(void) { char token = start_token; struct timeval ts; /* (Kick on the syscallbuf if it's enabled.) */ gettimeofday(&ts, NULL); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); pthread_barrier_init(&barrier, NULL, 2); pthread_create(&reader, NULL, reader_thread, NULL); pthread_barrier_wait(&barrier); /* Force a blocked read() that's interrupted by a SIGUSR1, * which then itself blocks on read() and succeeds. */ atomic_puts("M: sleeping ..."); usleep(500000); atomic_puts("M: killing reader ..."); pthread_kill(reader, SIGUSR1); atomic_puts("M: (quick nap)"); usleep(100000); atomic_puts("M: killing reader again ..."); pthread_kill(reader, SIGUSR2); atomic_puts("M: (longer nap)"); usleep(500000); atomic_printf("M: finishing level 2 reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; usleep(500000); atomic_printf("M: finishing level 1 reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; usleep(500000); atomic_printf("M: finishing original reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/intr_sleep.c000066400000000000000000000020121277367620400162310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } static int interrupted_sleep(void) { struct timespec ts = {.tv_sec = 2 }; alarm(1); errno = 0; /* The implementation of sleep() is technically allowed to use * SIGALRM, so we have to use nanosleep() for pedantry. */ nanosleep(&ts, NULL); return errno; } static int caught_signal; static void handle_signal(__attribute__((unused)) int sig) { ++caught_signal; breakpoint(); /* No more syscalls after here. */ } int main(void) { int err; signal(SIGALRM, SIG_IGN); err = interrupted_sleep(); atomic_printf("No sighandler; sleep exits with errno %d\n", err); test_assert(0 == err); signal(SIGALRM, handle_signal); err = interrupted_sleep(); atomic_printf("With sighandler; sleep exits with errno %d\n", err); test_assert(1 == caught_signal); test_assert(EINTR == err); atomic_puts("EXIT-SUCCESS"); return 1; } rr-4.4.0/src/test/intr_sleep_no_restart.c000066400000000000000000000043571277367620400205070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static pthread_t reader; static pthread_barrier_t barrier; static pid_t reader_tid; static int reader_caught_signal; static void intr_sleep(int secs) { struct timespec req = { secs, 0 }; struct timespec rem = { 0, 0 }; test_assert(-1 == nanosleep(&req, &rem) && EINTR == errno); test_assert(rem.tv_sec > 0 || rem.tv_nsec > 0); } static void fin_sleep(int secs) { struct timespec req = { secs, 0 }; struct timespec rem = { -1, -1 }; test_assert(0 == nanosleep(&req, &rem)); test_assert(-1 == rem.tv_sec && -1 == rem.tv_nsec); } static void sighandler(__attribute__((unused)) int sig) { test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 1 ..."); intr_sleep(2); } static void sighandler2(__attribute__((unused)) int sig) { test_assert(sys_gettid() == reader_tid); ++reader_caught_signal; atomic_puts("r: in sighandler level 2 ..."); fin_sleep(1); } static void* reader_thread(__attribute__((unused)) void* dontcare) { struct sigaction act; int flags = 0; reader_tid = sys_gettid(); act.sa_handler = sighandler; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR1, &act, NULL); act.sa_handler = sighandler2; sigemptyset(&act.sa_mask); act.sa_flags = flags; sigaction(SIGUSR2, &act, NULL); pthread_barrier_wait(&barrier); atomic_puts("r: blocking on sleep, awaiting signal ..."); intr_sleep(3); return NULL; } int main(void) { struct timeval ts; /* (Kick on the syscallbuf if it's enabled.) */ gettimeofday(&ts, NULL); pthread_barrier_init(&barrier, NULL, 2); pthread_create(&reader, NULL, reader_thread, NULL); pthread_barrier_wait(&barrier); /* Force a blocked read() that's interrupted by a SIGUSR1, * which then itself blocks on read() and succeeds. */ atomic_puts("M: sleeping ..."); usleep(500000); atomic_puts("M: killing reader ..."); pthread_kill(reader, SIGUSR1); atomic_puts("M: (quick nap)"); usleep(100000); atomic_puts("M: killing reader again ..."); pthread_kill(reader, SIGUSR2); atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/invalid_fcntl.c000066400000000000000000000004321277367620400167050ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { /* Do an invalid fcntl command on valid fd 0 */ test_assert(-1 == fcntl(0, 9999)); test_assert(errno == EINVAL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/invalid_ioctl.c000066400000000000000000000006031277367620400167110ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { // Test invalid fd -1, to make sure that rr doesn't accidentally think // this is it's desched fd (esp. when syscallbuf is disabled). test_assert(-1 == ioctl(-1, PERF_EVENT_IOC_ENABLE)); test_assert(errno == EBADF); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/invalid_jump.c000066400000000000000000000007161277367620400165570ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(int sig) { atomic_printf("caught signal %d, exiting\n", sig); _exit(0); } char invalid_jump_here[] = { 0x00, 0x00, 0x00, 0x00, 0x00 }; int main(void) { // Just for clean exit to not worry people running the test manually ;). signal(SIGSEGV, sighandler); goto*(void*)invalid_jump_here; assert(0 && "Shouldn't reach here"); } rr-4.4.0/src/test/invalid_jump.py000066400000000000000000000002201277367620400167530ustar00rootroot00000000000000from rrutil import * send_gdb('c') expect_gdb('Program received signal SIGSEGV') send_gdb('rsi') send_gdb('rsi') expect_gdb('in main') ok() rr-4.4.0/src/test/invalid_jump.run000066400000000000000000000001131277367620400171300ustar00rootroot00000000000000source `dirname $0`/util.sh record invalid_jump$bitness debug invalid_jump rr-4.4.0/src/test/io.c000066400000000000000000000003671277367620400145070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { char buf[32]; int garbage_fd = 1 << 30; read(garbage_fd, buf, sizeof(buf)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ioctl.c000066400000000000000000000007601277367620400152070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int pipe_fds[2]; int opt = 1; test_assert(0 == pipe(pipe_fds)); test_assert(0 == ioctl(pipe_fds[0], FIOCLEX)); test_assert(FD_CLOEXEC == fcntl(pipe_fds[0], F_GETFD)); test_assert(0 == ioctl(pipe_fds[0], FIONCLEX)); test_assert(0 == fcntl(pipe_fds[0], F_GETFD)); test_assert(0 == ioctl(pipe_fds[0], FIONBIO, &opt)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ioctl_pty.c000066400000000000000000000033161277367620400161030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = open("/dev/ptmx", O_RDONLY); pid_t child; int ret; int status; int* arg; test_assert(fd >= 0); atomic_printf("pty ptsname = %s\n", ptsname(fd)); ALLOCATE_GUARD(arg, 'a'); test_assert(0 == ioctl(fd, TIOCGPKT, arg)); VERIFY_GUARD(arg); test_assert(*arg == 0); test_assert(0 == ioctl(fd, TIOCPKT, arg)); ALLOCATE_GUARD(arg, 'b'); test_assert(0 == ioctl(fd, TIOCGPTN, arg)); VERIFY_GUARD(arg); atomic_printf("pty number = %d\n", *arg); ALLOCATE_GUARD(arg, 'c'); test_assert(0 == ioctl(fd, TIOCGPTLCK, arg)); VERIFY_GUARD(arg); test_assert(*arg == 1); test_assert(0 == ioctl(fd, TIOCSPTLCK, arg)); test_assert(0 == ioctl(fd, TCXONC, TCOOFF)); test_assert(0 == ioctl(fd, TCFLSH, TCIFLUSH)); child = fork(); if (!child) { test_assert(getpid() == setsid()); test_assert(0 == ioctl(fd, TIOCSCTTY, 0)); ioctl(fd, TIOCNOTTY); // The above ioctl can legitimately fail. If so, fake it. kill(getpid(), SIGHUP); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGHUP); ret = ioctl(fd, TIOCSTI, "x"); test_assert(ret >= 0 || errno == EPERM); test_assert(0 == ioctl(fd, TIOCEXCL)); ALLOCATE_GUARD(arg, 'd'); test_assert(0 == ioctl(fd, TIOCGEXCL, arg)); VERIFY_GUARD(arg); test_assert(*arg == 1); test_assert(0 == ioctl(fd, TIOCNXCL)); ALLOCATE_GUARD(arg, 'e'); test_assert(0 == ioctl(fd, TIOCGETD, arg)); VERIFY_GUARD(arg); atomic_printf("pty TIOCGETD = %d\n", *arg); test_assert(0 == ioctl(fd, TIOCSETD, arg)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ioctl_tty.c000066400000000000000000000051521277367620400161070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; int ret; struct termios* tc; struct termio* tio; pid_t* pgrp; int* navail; int* outq; struct winsize* w; pid_t* sid; fd = open("/dev/tty", O_RDWR); if (fd < 0) { atomic_puts("Can't open tty, aborting test"); atomic_puts("EXIT-SUCCESS"); return 0; } ALLOCATE_GUARD(tc, 'a'); test_assert(0 == ioctl(fd, TCGETS, tc)); VERIFY_GUARD(tc); atomic_printf("TCGETS returned { iflag=0x%x, oflag=0x%x, cflag=0x%x, " "lflag=0x%x }\n", tc->c_iflag, tc->c_oflag, tc->c_cflag, tc->c_lflag); test_assert(0 == ioctl(fd, TCSETS, tc)); test_assert(0 == ioctl(fd, TCSETSW, tc)); test_assert(0 == ioctl(fd, TCSETSF, tc)); ALLOCATE_GUARD(tio, 'b'); test_assert(0 == ioctl(fd, TCGETA, tio)); VERIFY_GUARD(tio); atomic_printf("TCGETA returned { iflag=0x%x, oflag=0x%x, cflag=0x%x, " "lflag=0x%x }\n", tio->c_iflag, tio->c_oflag, tio->c_cflag, tio->c_lflag); test_assert(0 == ioctl(fd, TCSETA, tio)); test_assert(0 == ioctl(fd, TCSETAW, tio)); test_assert(0 == ioctl(fd, TCSETAF, tio)); test_assert(0 == ioctl(fd, TIOCGLCKTRMIOS, tc)); VERIFY_GUARD(tc); atomic_printf("TIOCGLCKTRMIOS returned { iflag=0x%x, oflag=0x%x, cflag=0x%x, " "lflag=0x%x }\n", tio->c_iflag, tio->c_oflag, tio->c_cflag, tio->c_lflag); ret = ioctl(fd, TIOCSLCKTRMIOS, tc); test_assert(ret >= 0 || errno == EPERM); test_assert(0 == ioctl(fd, TCSBRK, 0)); test_assert(0 == ioctl(fd, TCSBRKP, 0)); test_assert(0 == ioctl(fd, TIOCSBRK)); test_assert(0 == ioctl(fd, TIOCCBRK)); ALLOCATE_GUARD(pgrp, 'c'); test_assert(0 == ioctl(fd, TIOCGPGRP, pgrp)); VERIFY_GUARD(pgrp); atomic_printf("TIOCGPGRP returned process group %d\n", *pgrp); test_assert(0 == ioctl(fd, TIOCSPGRP, pgrp)); ALLOCATE_GUARD(navail, 'd'); test_assert(0 == ioctl(fd, TIOCINQ, navail)); VERIFY_GUARD(navail); atomic_printf("TIOCINQ returned navail=%d\n", *navail); ALLOCATE_GUARD(outq, 'e'); test_assert(0 == ioctl(fd, TIOCOUTQ, outq)); VERIFY_GUARD(outq); atomic_printf("TIOCOUTQ returned outq=%d\n", *outq); ALLOCATE_GUARD(w, 'f'); test_assert(0 == ioctl(fd, TIOCGWINSZ, w)); VERIFY_GUARD(w); atomic_printf("TIOCGWINSZ returned {row:%d col:%d}\n", w->ws_row, w->ws_col); test_assert(0 == ioctl(fd, TIOCSWINSZ, w)); ALLOCATE_GUARD(sid, 'g'); test_assert(0 == ioctl(fd, TIOCGSID, sid)); VERIFY_GUARD(sid); atomic_printf("TIOCGSID returned %d\n", *sid); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/kcmp.c000066400000000000000000000010571277367620400150270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t pid = getpid(); int ret; ret = syscall(RR_kcmp, pid, pid, RR_KCMP_FILES, 0, 0); if (ret < 0 && errno == ENOSYS) { atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(ret == 0); test_assert(0 < syscall(RR_kcmp, pid, getppid(), RR_KCMP_FILES, 0, 0)); test_assert(0 == syscall(RR_kcmp, pid, pid, RR_KCMP_FILE, STDIN_FILENO, STDIN_FILENO)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/kill_newborn.c000066400000000000000000000016471277367620400165670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status; int i; /* These setpriority calls may appear to fail but rr will honor them */ setpriority(PRIO_PROCESS, 0, 1); child = fork(); if (!child) { /* Doesn't matter what we do here; we intend for the child to never run */ return 0; } setpriority(PRIO_PROCESS, 0, 0); /* Hopefully we've raised our priority so the child doesn't run at all. * However, it is possible for the scheduler to pick the child to run. */ kill(child, SIGKILL); for (i = 0; i < 200; ++i) { test_assert(1 == write(STDOUT_FILENO, ".", 1)); } test_assert(child == wait(&status)); /* See above ... we can't guarantee these assertions will succeed */ /* test_assert(WIFSIGNALED(status)); test_assert(WTERMSIG(status) == SIGKILL); */ atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/legacy_ugid.c000066400000000000000000000032461277367620400163530ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* We use this structure to verify that, on architectures supporting UID16 * syscalls, rr properly records and replays only 16-bit values. */ union legacy_id { uint16_t u16[2]; uint32_t u32; }; #define UID_COOKIE 0xd05e static void initialize_legacy_ids(size_t n, union legacy_id* ids) { size_t i; for (i = 0; i < n; ++i) { ids[i].u16[0] = 0; ids[i].u16[1] = UID_COOKIE; } }; static void verify_results(size_t n, union legacy_id* ids) { size_t i; for (i = 0; i < n; ++i) { #if defined(__i386__) // For UID16 syscall-supporting archs, the cookie should be intact. test_assert(ids[i].u16[1] == UID_COOKIE); #elif defined(__x86_64__) // For UID32 archs, assume that the user doesn't have a UID with the // upper bits equivalent to our cookie. This is not a great assumption, // but we don't really have anything better. test_assert(ids[i].u16[1] != UID_COOKIE); #else #error unknown architecture #endif } } int main(void) { union legacy_id resuid_results[3]; union legacy_id resgid_results[3]; initialize_legacy_ids(ALEN(resuid_results), resuid_results); test_assert(0 == syscall(SYS_getresuid, &resuid_results[0], &resuid_results[1], &resuid_results[2])); verify_results(ALEN(resuid_results), resuid_results); initialize_legacy_ids(ALEN(resgid_results), resgid_results); test_assert(0 == syscall(SYS_getresgid, &resgid_results[0], &resgid_results[1], &resgid_results[2])); verify_results(ALEN(resgid_results), resgid_results); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/link.c000066400000000000000000000011731277367620400150310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { static const char token_file[] = "rr-link-file.txt"; static const char link_name[] = "rr-link-file.link"; int fd = open(token_file, O_RDWR | O_CREAT | O_TRUNC, 0600); test_assert(fd >= 0); test_assert(0 == close(fd)); test_assert(0 == link(token_file, link_name)); test_assert(0 == unlink(token_file)); test_assert(0 == linkat(AT_FDCWD, link_name, AT_FDCWD, token_file, 0)); test_assert(0 == unlink(token_file)); test_assert(0 == unlink(link_name)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/link.run000066400000000000000000000002401277367620400154050ustar00rootroot00000000000000source `dirname $0`/util.sh # NB: this test creates garbage, but it will be cleaned up along with # the other files in the tmp dir. compare_test 'EXIT-SUCCESS' rr-4.4.0/src/test/madvise.c000066400000000000000000000032631277367620400155260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define PAGE_ZEROES (PAGE_SIZE / sizeof(int)) static size_t count_page_zeroes(int* p) { size_t zeroes = 0; size_t i; for (i = 0; i < PAGE_SIZE / sizeof(*p); ++i) { if (!p[i]) { ++zeroes; } } return zeroes; } static void set_page_values_nonzero(int* p) { size_t i; for (i = 0; i < PAGE_SIZE / sizeof(*p); ++i) { p[i] = i + 1; } } int main(void) { int* page; void* fixed_area; fixed_area = mmap(NULL, PAGE_SIZE * 5, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(fixed_area != MAP_FAILED); test_assert(0 == munmap(fixed_area, PAGE_SIZE * 5)); page = mmap(fixed_area + PAGE_SIZE, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(page != MAP_FAILED); test_assert(count_page_zeroes(page) == PAGE_ZEROES); set_page_values_nonzero(page); test_assert(0 == madvise(page, PAGE_SIZE, MADV_DONTNEED)); test_assert(count_page_zeroes(page) == PAGE_ZEROES); set_page_values_nonzero(page); test_assert(0 == madvise(page, 1, MADV_DONTNEED)); test_assert(count_page_zeroes(page) == PAGE_ZEROES); set_page_values_nonzero(page); test_assert(-1 == madvise(fixed_area - 1, PAGE_SIZE * 5, MADV_DONTNEED)); test_assert(EINVAL == errno); /* check this madvise had no effect */ test_assert(count_page_zeroes(page) < PAGE_ZEROES); test_assert(-1 == madvise(fixed_area, PAGE_SIZE * 5, MADV_DONTNEED)); test_assert(ENOMEM == errno); /* check this madvise did take effect */ test_assert(count_page_zeroes(page) == PAGE_ZEROES); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/madvise_dontfork.c000066400000000000000000000013631277367620400174330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} int main(void) { char* page; pid_t pid; int status; page = mmap(NULL, PAGE_SIZE * 2, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(page != MAP_FAILED); test_assert(0 == madvise(page, PAGE_SIZE, MADV_DONTFORK)); breakpoint(); page[0] = 1; pid = fork(); if (!pid) { test_assert(-1 == madvise(page, PAGE_SIZE, MADV_NORMAL)); test_assert(ENOMEM == errno); page[PAGE_SIZE] = 2; atomic_puts("EXIT-SUCCESS"); return 77; } test_assert(pid == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); return 0; } rr-4.4.0/src/test/madvise_dontfork.py000066400000000000000000000004311277367620400176340ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('next') send_gdb('restart 1') expect_gdb('stopped') send_gdb('c') expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/madvise_dontfork.run000066400000000000000000000000471277367620400200130ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/madvise_free.c000066400000000000000000000005251277367620400165250ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { void* p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); test_assert(-1 == madvise(p, PAGE_SIZE, MADV_FREE)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/main_thread_exit.c000066400000000000000000000010331277367620400173730ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static pthread_t main_thread; static void breakpoint(void) {} static void* start_thread(__attribute__((unused)) void* p) { test_assert(0 == pthread_join(main_thread, NULL)); breakpoint(); atomic_puts("EXIT-SUCCESS"); return NULL; } int main(void) { pthread_t thread; main_thread = pthread_self(); test_assert(0 == pthread_create(&thread, NULL, start_thread, NULL)); pthread_exit(NULL); test_assert(0); return 0; } rr-4.4.0/src/test/main_thread_exit.py000066400000000000000000000003771277367620400176130ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') send_gdb('n') send_gdb('restart 1') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited normally') ok() rr-4.4.0/src/test/main_thread_exit.run000066400000000000000000000000471277367620400177610ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/map_fixed.c000066400000000000000000000011531277367620400160260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); uint8_t* map1 = mmap(NULL, page_size * 2, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); uint8_t* map1_end = map1 + page_size; uint8_t* map2; test_assert(map1 != (void*)-1); map2 = mmap(map1_end, page_size, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(map2 != (void*)-1); test_assert(map2 == map1_end); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/membarrier.c000066400000000000000000000010611277367620400162150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define RR_MEMBARRIER_CMD_QUERY 0 #define RR_MEMBARRIER_CMD_SHARED 1 int main(void) { int ret = syscall(RR_membarrier, RR_MEMBARRIER_CMD_QUERY, 0); if (ret < 0 && errno == ENOSYS) { atomic_puts("membarrier not supported, skipping test"); } else { test_assert(ret >= 0); if (ret & RR_MEMBARRIER_CMD_SHARED) { test_assert(0 == syscall(RR_membarrier, RR_MEMBARRIER_CMD_SHARED, 0)); } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/memfd_create.c000066400000000000000000000007331277367620400165100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TEST_MEMFD "foo" int main(void) { int fd; /* There's no libc helper for this syscall. */ fd = syscall(RR_memfd_create, TEST_MEMFD, 0); if (-1 == fd && ENOSYS == errno) { atomic_puts("SYS_memfd_create not supported on this kernel"); } else { test_assert(fd >= 0); test_assert(0 == close(fd)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mincore.c000066400000000000000000000010061277367620400155230ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_SIZE 10 int main(int argc, __attribute__((unused)) char* argv[]) { unsigned char* buf; void* p = (void*)((long)&argc & ~(long)(PAGE_SIZE - 1)); ALLOCATE_GUARD(buf, 'q'); test_assert(0 == mincore(p, PAGE_SIZE, buf)); /* I guess we can't actually check mincore's results in any way */ VERIFY_GUARD(buf); atomic_printf("In-core=%d\n", *buf & 1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mknod.c000066400000000000000000000013071277367620400152030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define FILENAME "foo" #define MODE S_IFIFO int main(void) { struct stat* st; test_assert(mknod(FILENAME, MODE, 0) == 0); ALLOCATE_GUARD(st, 'x'); test_assert(stat(FILENAME, st) == 0); test_assert(st->st_mode == MODE); VERIFY_GUARD(st); test_assert(mknod(FILENAME, MODE, 0) < 0); test_assert(errno == EEXIST); test_assert(0 == unlink(FILENAME)); test_assert(mknodat(AT_FDCWD, FILENAME, MODE, 0) == 0); test_assert(stat(FILENAME, st) == 0); test_assert(st->st_mode == MODE); VERIFY_GUARD(st); test_assert(0 == unlink(FILENAME)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mlock.c000066400000000000000000000010401277367620400151720ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { void* p = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); test_assert(0 == mlock(p, PAGE_SIZE) || errno == ENOMEM || errno == EPERM); test_assert(0 == munlock(p, PAGE_SIZE)); test_assert(0 == mlockall(MCL_CURRENT) || errno == ENOMEM || errno == EPERM); test_assert(0 == munlockall()); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_discontinuous.c000066400000000000000000000022211277367620400200070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int create_segment(size_t num_bytes) { char filename[] = "/dev/shm/rr-test-XXXXXX"; int fd = mkstemp(filename); unlink(filename); test_assert(fd >= 0); ftruncate(fd, num_bytes); return fd; } int main(void) { ssize_t page_size = sysconf(_SC_PAGESIZE); int fd = create_segment(3 * page_size); uint8_t* wpage1 = mmap(NULL, page_size, PROT_WRITE, MAP_SHARED, fd, 0); uint8_t* wpage2 = mmap(NULL, page_size, PROT_WRITE, MAP_SHARED, fd, 2 * page_size); test_assert(wpage1 != (void*)-1 && wpage2 != (void*)-1); test_assert(wpage1 != wpage2); test_assert(wpage2 - wpage1 == page_size || wpage1 - wpage2 == page_size); wpage1 = mmap(NULL, page_size, PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); wpage2 = mmap(NULL, page_size, PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 2 * page_size); test_assert(wpage1 != (void*)-1 && wpage2 != (void*)-1); test_assert(wpage1 != wpage2); test_assert(wpage2 - wpage1 == page_size || wpage1 - wpage2 == page_size); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_private.c000066400000000000000000000017061277367620400165620ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(__attribute__((unused)) int argc, char* argv[]) { size_t num_bytes = sysconf(_SC_PAGESIZE); int fd = open(argv[0], O_RDONLY); int* wpage; int* rpage; size_t i; test_assert(fd >= 0); breakpoint(); wpage = mmap(NULL, num_bytes, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); breakpoint(); rpage = mmap(NULL, num_bytes, PROT_READ, MAP_PRIVATE, fd, 0); test_assert(wpage != (void*)-1 && rpage != (void*)-1 && rpage != wpage); breakpoint(); for (i = 0; i < num_bytes / sizeof(int); ++i) { int magic; test_assert(wpage[i] == rpage[i]); magic = rpage[i] * 31 + 3; wpage[i] = magic; test_assert(rpage[i] != magic && wpage[i] == magic); atomic_printf("%d:%d,", rpage[i], wpage[i]); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_ro.c000066400000000000000000000011021277367620400155160ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DUMMY_FILE "dummy.txt" int main(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); int fd = open(DUMMY_FILE, O_CREAT | O_EXCL | O_RDWR, 0600); int one = 1; int* rpage; test_assert(fd >= 0); test_assert(sizeof(one) == write(fd, &one, sizeof(one))); test_assert(0 == fchmod(fd, 0400)); rpage = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); test_assert(rpage != (void*)-1); unlink(DUMMY_FILE); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_self_maps_shared.c000066400000000000000000000025471277367620400204130ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include static char* trim_leading_blanks(char* str) { char* trimmed = str; while (isblank(*trimmed)) { ++trimmed; } return trimmed; } int main(void) { FILE* maps_file = fopen("/proc/self/maps", "r"); while (!feof(maps_file)) { char line[PATH_MAX * 2]; if (!fgets(line, sizeof(line), maps_file)) { break; } uint64_t start, end, offset, inode; int dev_major, dev_minor; char flags[32]; int chars_scanned; int nparsed = sscanf(line, "%" SCNx64 "-%" SCNx64 " %31s %" SCNx64 " %x:%x %" SCNu64 " %n", &start, &end, flags, &offset, &dev_major, &dev_minor, &inode, &chars_scanned); assert(8 /*number of info fields*/ == nparsed || 7 /*num fields if name is blank*/ == nparsed); // trim trailing newline, if any int last_char = strlen(line) - 1; if (line[last_char] == '\n') { line[last_char] = 0; } char* name = trim_leading_blanks(line + chars_scanned); if (name[0] != '/') continue; int fd = open(name, O_RDONLY); void* addr = mmap(NULL, end - start, PROT_READ, MAP_SHARED, fd, 0); munmap(addr, end - start); close(fd); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_shared.c000066400000000000000000000033111277367620400163500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int create_segment(size_t num_bytes) { char filename[] = "/dev/shm/rr-test-XXXXXX"; int fd = mkstemp(filename); unlink(filename); test_assert(fd >= 0); ftruncate(fd, num_bytes); return fd; } struct mmap_arg_struct { unsigned long addr; unsigned long len; unsigned long prot; unsigned long flags; unsigned long fd; unsigned long offset; }; static void run_test(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); int fd = create_segment(num_bytes); int* wpage = mmap(NULL, num_bytes, PROT_WRITE, MAP_SHARED, fd, 0); size_t i; int* rpage; close(128); munmap(NULL, 0); #if defined(__i386__) struct mmap_arg_struct args; args.addr = 0; args.len = num_bytes; args.prot = PROT_READ; args.flags = MAP_SHARED; args.fd = fd; args.offset = 0; rpage = (int*)syscall(SYS_mmap, &args, -1, -1, -1, -1, -1); #elif defined(__x86_64__) rpage = (int*)syscall(SYS_mmap, 0, num_bytes, PROT_READ, MAP_SHARED, fd, (off_t)0); #else #error unknown architecture #endif test_assert(wpage != (void*)-1 && rpage != (void*)-1 && rpage != wpage); close(128); for (i = 0; i < num_bytes / sizeof(int); ++i) { wpage[i] = i; test_assert(rpage[i] == (ssize_t)i); } } int main(void) { pid_t c; int status; atomic_printf("%d: checking shared maps ...\n", getpid()); run_test(); if (0 == (c = fork())) { atomic_printf("%d: and in fork child ...\n", getpid()); run_test(); exit(0); } test_assert(c == waitpid(c, &status, 0) && WIFEXITED(status) && 0 == WEXITSTATUS(status)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_shared_multiple.c000066400000000000000000000007471277367620400202750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { char* p; char* q; p = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); test_assert(p != MAP_FAILED); q = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); test_assert(q != MAP_FAILED); *p = 'a'; test_assert(*q == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_shared_prot.c000066400000000000000000000015511277367620400174200ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} int main(void) { pid_t child; int status; char* p; /* Do a dummy waitpid so the real one doesn't go through the linker, patching etc */ waitpid(-2, NULL, 0); p = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); test_assert(p != MAP_FAILED); *p = 'a'; if ((child = fork()) == 0) { while (*(char*)p == 'a') { sched_yield(); } return 0; } test_assert(0 == mprotect(p, PAGE_SIZE, PROT_READ)); breakpoint(); test_assert(0 == mprotect(p, PAGE_SIZE, PROT_READ | PROT_WRITE)); *p = *p + 1; test_assert(*p == 'b'); test_assert(child == waitpid(child, &status, 0)); test_assert(0 == status); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_shared_prot.py000066400000000000000000000004641277367620400176300ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('check') expect_gdb('Checkpoint 1 at') send_gdb('c') expect_gdb('exited normally') send_gdb('restart 1') expect_gdb('stopped') send_gdb('c') expect_gdb('exited normally') ok() rr-4.4.0/src/test/mmap_shared_prot.run000066400000000000000000000000471277367620400200010ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/mmap_shared_subpage.c000066400000000000000000000015441277367620400200640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int create_segment(size_t num_bytes) { char filename[] = "/dev/shm/rr-test-XXXXXX"; int fd = mkstemp(filename); unlink(filename); test_assert(fd >= 0); ftruncate(fd, num_bytes); return fd; } int main(void) { size_t num_bytes = 120; /* Not a multiple of the page size */ int fd = create_segment(num_bytes); int* wpage = mmap(NULL, num_bytes, PROT_WRITE, MAP_SHARED, fd, 0); int* rpage = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); size_t i; test_assert(wpage != (void*)-1 && rpage != (void*)-1 && rpage != wpage); close(128); for (i = 0; i < num_bytes / sizeof(int); ++i) { wpage[i] = i; test_assert(rpage[i] == (ssize_t)i); atomic_printf("%d,", rpage[i]); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_shared_write.c000066400000000000000000000037001277367620400175640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void check_mapping(int* page, int magic, ssize_t nr_ints) { int i; for (i = 0; i < nr_ints; ++i) { test_assert(page[i] == magic); } atomic_printf(" %p has the correct values\n", page); } int main(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); char file_name[] = "/tmp/rr-test-mremap-XXXXXX"; int fd = mkstemp(file_name); int* rpage; test_assert(fd >= 0); int magic = 0x5a5a5a5a; size_t i; for (i = 0; i < 3 * num_bytes / sizeof(magic); ++i) { pwrite64(fd, &magic, sizeof(magic), i * sizeof(magic)); } rpage = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); atomic_printf("rpage:%p\n", rpage); test_assert(rpage != (void*)-1); magic = 0xa5a5a5a5; for (i = 0; i < num_bytes / sizeof(magic); ++i) { pwrite64(fd, &magic, sizeof(magic), i * sizeof(magic)); } check_mapping(rpage, 0xa5a5a5a5, num_bytes / sizeof(*rpage)); magic = 0x5a5a5a5a; for (i = 0; i < num_bytes / sizeof(magic); ++i) { pwrite64(fd, &magic, sizeof(magic), i * sizeof(magic)); } check_mapping(rpage, 0x5a5a5a5a, num_bytes / sizeof(*rpage)); magic = 0xa5a5a5a5; for (i = 0; i < num_bytes / sizeof(magic); ++i) { pwrite64(fd, &magic, sizeof(magic), num_bytes + i * sizeof(magic)); } check_mapping(rpage, 0x5a5a5a5a, num_bytes / sizeof(*rpage)); magic = 0xdeadbeef; pwrite64(fd, &magic, sizeof(magic), num_bytes / 2); test_assert(rpage[num_bytes / (sizeof(magic) * 2)] == magic); test_assert(rpage[0] != magic); pwrite64(fd, &magic, sizeof(magic), num_bytes - 2); test_assert(rpage[num_bytes / sizeof(magic) - 1] == (int)0xbeef5a5a); rpage = mremap(rpage, num_bytes, 5 * num_bytes, MREMAP_MAYMOVE); for (i = 3 * num_bytes / sizeof(magic); i < 5 * num_bytes / sizeof(magic); ++i) { pwrite64(fd, &magic, sizeof(magic), i * sizeof(magic)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_short_file.c000066400000000000000000000020101277367620400172330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DUMMY_FILE "dummy.txt" static void sighandler(int sig) { atomic_printf("caught signal %d, exiting\n", sig); atomic_puts("EXIT-SUCCESS"); _exit(0); } int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); int fd = open(DUMMY_FILE, O_CREAT | O_EXCL | O_RDWR, 0600); int one = 1; int* rpage; unlink(DUMMY_FILE); test_assert(fd >= 0); test_assert(sizeof(one) == write(fd, &one, sizeof(one))); rpage = mmap(NULL, page_size * 2, PROT_READ, MAP_PRIVATE, fd, 0); test_assert(rpage != (void*)-1); test_assert(*rpage == 1); signal(SIGSEGV, sighandler); signal(SIGBUS, sighandler); /* This should generate a SIGBUS, but the test will pass whether the kernel generates SIGBUS or SIGSEGV. rr checks that the same signal is produced during replay as during recording. */ char ch = *((char*)rpage + page_size); atomic_printf("FAILED: no segfault, read %d", ch); return 0; } rr-4.4.0/src/test/mmap_tmpfs.c000066400000000000000000000011361277367620400162360ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TEST_FILENAME "foo.so" #define TOKEN "hello kitty" int main(void) { int fd = open(TEST_FILENAME, O_CREAT | O_EXCL | O_RDWR, 0700); char* bytes; write(fd, TOKEN, sizeof(TOKEN)); close(fd); fd = open(TEST_FILENAME, O_RDONLY); bytes = (char*)mmap(NULL, 4096, PROT_READ | PROT_EXEC, MAP_PRIVATE, fd, 0); test_assert(bytes != MAP_FAILED); test_assert(!strcmp(bytes, TOKEN)); munmap(bytes, 4096); close(fd); unlink(TEST_FILENAME); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mmap_write.c000066400000000000000000000022161277367620400162370ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DUMMY_FILE "dummy.txt" static const int magic = 0x5a5a5a5a; static void overwrite_file(const char* path, size_t num_bytes) { int fd = open(path, O_TRUNC | O_RDWR, 0600); size_t i; test_assert(fd >= 0); for (i = 0; i < num_bytes / sizeof(magic); ++i) { write(fd, &magic, sizeof(magic)); } close(fd); } int main(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); int fd = open(DUMMY_FILE, O_CREAT | O_EXCL | O_RDWR, 0600); int* rpage; size_t i; test_assert(fd >= 0); overwrite_file(DUMMY_FILE, num_bytes); rpage = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); atomic_printf("rpage:%p\n", rpage); test_assert(rpage != (void*)-1); for (i = 0; i < num_bytes / sizeof(magic); ++i) { test_assert(rpage[i] == magic); } lseek(fd, 0, SEEK_SET); for (i = 0; i < num_bytes / sizeof(i); ++i) { int written; write(fd, &i, sizeof(i)); written = rpage[i]; atomic_printf("(wrote %d, read %d)", (int)i, written); test_assert(written == (ssize_t)i); } atomic_puts(" done"); return 0; } rr-4.4.0/src/test/mmap_write.run000066400000000000000000000002061277367620400166160ustar00rootroot00000000000000source `dirname $0`/util.sh fails "write()s to SHARED mapped files aren't propagated to mapping during replay." compare_test 'done' rr-4.4.0/src/test/mprotect.c000066400000000000000000000015631277367620400157340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); uint8_t* map1 = mmap(NULL, 4 * page_size, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); uint8_t* map1_end = map1 + 2 * page_size; uint8_t* map2; uint8_t* map2_end; test_assert(map1 != (void*)-1); atomic_printf("map1 = [%p, %p)\n", map1, map1_end); mprotect(map1 + page_size, page_size, PROT_NONE); map2 = mmap(map1_end, 2 * page_size, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); map2_end = map2 + page_size; test_assert(map2 != (void*)-1); test_assert(map2 == map1_end); atomic_printf("map2 = [%p, %p)\n", map2, map2_end); mprotect(map2, page_size, PROT_NONE); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mprotect_growsdown.c000066400000000000000000000014661277367620400200470ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { char* p; /* map 3 pages since the first page will be made into a guard page by the kernel */ p = mmap(NULL, PAGE_SIZE * 3, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_GROWSDOWN, -1, 0); test_assert(p != MAP_FAILED); test_assert( 0 == mprotect(p + PAGE_SIZE * 2, PAGE_SIZE, PROT_NONE | PROT_GROWSDOWN)); test_assert(-1 == mprotect(p + 1, PAGE_SIZE, PROT_NONE | PROT_GROWSDOWN)); test_assert(EINVAL == errno); p = (char*)(((uintptr_t)main) & ~((uintptr_t)PAGE_SIZE - 1)); test_assert(-1 == mprotect(p, PAGE_SIZE, PROT_READ | PROT_EXEC | PROT_GROWSDOWN)); test_assert(EINVAL == errno); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mprotect_growsdown.run000066400000000000000000000001511277367620400204170ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test EXIT-SUCCESS compare_test EXIT-SUCCESS --share-private-mappings rr-4.4.0/src/test/mprotect_heterogenous.c000066400000000000000000000021551277367620400205210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TEST_FILE "foo.txt" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); int fd = open(TEST_FILE, O_CREAT | O_EXCL | O_RDWR, 0600); uint8_t* pages; int ret, err; test_assert(fd >= 0); test_assert(0 == ftruncate(fd, 8 * page_size)); unlink(TEST_FILE); pages = mmap(NULL, 5 * page_size, PROT_WRITE, MAP_PRIVATE, fd, 0); test_assert(pages != (void*)-1); /* Protect second page. */ test_assert(0 == mprotect(pages + page_size, page_size, PROT_NONE)); /* Protect fourth page. */ test_assert(0 == mprotect(pages + 3 * page_size, page_size, PROT_NONE)); /* Protect all five pages. */ test_assert(0 == mprotect(pages, 5 * page_size, PROT_NONE)); /* Unmap second page. */ test_assert(0 == munmap(pages + page_size, page_size)); /* Fail to protect the entire region, because one page is * unmapped. */ errno = 0; ret = mprotect(pages, 5 * page_size, PROT_READ | PROT_WRITE); err = errno; test_assert(-1 == ret && ENOMEM == err); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mprotect_none.c000066400000000000000000000031501277367620400167450ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); uint8_t* map_base; uint8_t* map; map_base = mmap(NULL, 5 * page_size, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(map_base != MAP_FAILED); test_assert(0 == munmap(map_base, 4 * page_size)); map = mmap(map_base + page_size, page_size, PROT_READ, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, -1, 0); test_assert(map == map_base + page_size); test_assert(-1 == mprotect(map_base, 4 * page_size, PROT_READ | PROT_WRITE)); test_assert(ENOMEM == errno); test_assert(0 == munmap(map_base, 4 * page_size)); map = mmap(map_base + page_size, 2 * page_size, PROT_READ, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, -1, 0); test_assert(map == map_base + page_size); test_assert(-1 == mprotect(map_base, 2 * page_size, PROT_READ | PROT_WRITE)); test_assert(ENOMEM == errno); map = mmap(map_base + 4 * page_size, page_size, PROT_READ, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, -1, 0); /* The first mapped page will be mprotect'ed PROT_READ | PROT_WRITE and then it will return ENOMEM. */ test_assert(-1 == mprotect(map_base + 2 * page_size, 3 * page_size, PROT_READ | PROT_WRITE)); test_assert(ENOMEM == errno); map_base[2 * page_size] = 1; test_assert(0 == munmap(map_base + page_size, 2 * page_size)); test_assert(-1 == mprotect(map_base, 4 * page_size, PROT_READ | PROT_WRITE)); test_assert(ENOMEM == errno); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mprotect_stack.c000066400000000000000000000015771277367620400171260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); uint8_t* map1 = mmap(NULL, 4 * page_size, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); uint8_t* map1_end = map1 + 2 * page_size; uint8_t* map2; uint8_t* map2_end; test_assert(map1 != (void*)-1); atomic_printf("map1 = [%p, %p)\n", map1, map1_end); mprotect(map1 + page_size, page_size, PROT_NONE); map2 = mmap(map1_end, 2 * page_size, PROT_READ | PROT_WRITE, MAP_STACK | MAP_FIXED | MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); map2_end = map2 + page_size; test_assert(map2 != (void*)-1); test_assert(map2 == map1_end); atomic_printf("map2 = [%p, %p)\n", map2, map2_end); mprotect(map2, page_size, PROT_NONE); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mprotect_step.py000066400000000000000000000005621277367620400171730ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('b mprotect') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 2') # step through mprotect() until we reach the system call that # gets performed during replay for i in xrange(0,200): send_gdb('stepi') expect_gdb('(rr)') ok() rr-4.4.0/src/test/mprotect_step.run000066400000000000000000000001111277367620400173350ustar00rootroot00000000000000source `dirname $0`/util.sh record mprotect$bitness debug mprotect_step rr-4.4.0/src/test/mprotect_syscallbuf_overflow.c000066400000000000000000000006161277367620400221040ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int i; void* p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); for (i = 0; i < 10000; ++i) { test_assert(0 == mprotect(p, PAGE_SIZE, PROT_READ | PROT_WRITE)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mprotect_syscallbuf_overflow.run000066400000000000000000000002201277367620400224550ustar00rootroot00000000000000source `dirname $0`/util.sh # Use 4K syscallbuf size to force frequent overflows RECORD_ARGS=--syscall-buffer-size=4 compare_test EXIT-SUCCESS rr-4.4.0/src/test/mq.c000066400000000000000000000034671277367620400145210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { mqd_t mq_a; mqd_t mq_b; struct mq_attr mq_attr; struct mq_attr mq_attr_test; char msg[] = "Hello"; char buffer[1024] = { 0 }; /* 'C' fills in the rest of the array with 0s. */ unsigned prio; struct timespec expiry; mq_attr.mq_flags = 0; mq_attr.mq_maxmsg = 10; mq_attr.mq_msgsize = 1024; mq_attr.mq_curmsgs = 0; char mq_name[100]; snprintf(mq_name, 100, "/rr-test-queue%d", sys_gettid()); mq_a = mq_open(mq_name, O_WRONLY | O_CREAT, 0777, &mq_attr); test_assert(mq_a != -1); mq_b = mq_open(mq_name, O_RDONLY); test_assert(mq_b != -1); test_assert(mq_getattr(mq_a, &mq_attr_test) == 0); test_assert(mq_attr_test.mq_flags == mq_attr.mq_flags); test_assert(mq_attr_test.mq_maxmsg == mq_attr.mq_maxmsg); test_assert(mq_attr_test.mq_msgsize == mq_attr.mq_msgsize); test_assert(mq_attr_test.mq_curmsgs == 0); test_assert(mq_getattr(mq_b, &mq_attr_test) == 0); test_assert(mq_attr_test.mq_flags == mq_attr.mq_flags); test_assert(mq_attr_test.mq_maxmsg == mq_attr.mq_maxmsg); test_assert(mq_attr_test.mq_msgsize == mq_attr.mq_msgsize); test_assert(mq_attr_test.mq_curmsgs == 0); test_assert(sizeof(msg) == 6); test_assert(mq_send(mq_a, msg, sizeof(msg), 100) == 0); test_assert(mq_getattr(mq_b, &mq_attr_test) == 0); test_assert(mq_attr_test.mq_curmsgs == 1); prio = ~0; test_assert(mq_receive(mq_b, buffer, sizeof(buffer), &prio) == sizeof(msg)); test_assert(memcmp(msg, buffer, sizeof(msg)) == 0); test_assert(prio == 100); clock_gettime(CLOCK_REALTIME, &expiry); expiry.tv_sec += 2; test_assert(mq_timedreceive(mq_b, buffer, sizeof(buffer), &prio, &expiry) == -1); mq_unlink(mq_name); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mremap.c000066400000000000000000000034461277367620400153620ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void check_mapping(int* rpage, int* wpage, ssize_t nr_ints) { int i; for (i = 0; i < nr_ints; ++i) { test_assert(wpage[i] == rpage[i]); wpage[i] = i; test_assert(rpage[i] == i && wpage[i] == rpage[i]); } atomic_printf(" %p and %p point at the same resource\n", rpage, wpage); } static void overwrite_file(const char* path, ssize_t num_bytes) { const int magic = 0x5a5a5a5a; int fd = open(path, O_TRUNC | O_RDWR, 0600); size_t i; for (i = 0; i < num_bytes / sizeof(magic); ++i) { write(fd, &magic, sizeof(magic)); } close(fd); } int main(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); char file_name[] = "/tmp/rr-test-mremap-XXXXXX"; int fd = mkstemp(file_name); int* wpage; int* rpage; int* old_wpage; test_assert(fd >= 0); overwrite_file(file_name, 2 * num_bytes); wpage = mmap(NULL, num_bytes, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); rpage = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); atomic_printf("wpage:%p rpage:%p\n", wpage, rpage); test_assert(wpage != (void*)-1 && rpage != (void*)-1 && rpage != wpage); check_mapping(rpage, wpage, num_bytes / sizeof(*wpage)); overwrite_file(file_name, 2 * num_bytes); old_wpage = wpage; /* Test invalid mremap */ test_assert(MAP_FAILED == mremap(old_wpage, num_bytes, 2 * num_bytes - 1, 0xFFFFFFFF)); test_assert(EINVAL == errno); /* Test remapping a non-page-sized range */ wpage = mremap(old_wpage, num_bytes, 2 * num_bytes - 1, MREMAP_MAYMOVE); atomic_printf("remapped wpage:%p\n", wpage); test_assert(wpage != (void*)-1 && wpage != old_wpage); check_mapping(rpage, wpage, num_bytes / sizeof(*wpage)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mremap_grow.c000066400000000000000000000012711277367620400164120ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = open("temp", O_RDWR | O_CREAT, 0700); char buf[PAGE_SIZE * 2]; char* p; test_assert(fd >= 0); test_assert(0 == unlink("temp")); memset(buf, 1, sizeof(buf)); test_assert((ssize_t)sizeof(buf) == write(fd, buf, sizeof(buf))); p = (char*)mmap(NULL, PAGE_SIZE, PROT_READ, MAP_PRIVATE, fd, 0); test_assert(p != MAP_FAILED); test_assert(p[0] == 1); p = (char*)mremap(p, PAGE_SIZE, PAGE_SIZE * 2, MREMAP_MAYMOVE); test_assert(p != MAP_FAILED); test_assert(p[0] == 1); test_assert(p[PAGE_SIZE] == 1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mremap_grow_shared.c000066400000000000000000000012451277367620400177410ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(__attribute((unused)) int argc, char* argv[]) { int fd = open(argv[0], O_RDONLY); char buf[PAGE_SIZE * 2]; char* p; test_assert(fd >= 0); test_assert((ssize_t)sizeof(buf) == read(fd, buf, sizeof(buf))); p = (char*)mmap(NULL, PAGE_SIZE, PROT_READ, MAP_SHARED, fd, 0); test_assert(p != MAP_FAILED); test_assert(p[0] == buf[0]); p = (char*)mremap(p, PAGE_SIZE, PAGE_SIZE * 2, MREMAP_MAYMOVE); test_assert(p != MAP_FAILED); test_assert(p[0] == buf[0]); test_assert(p[PAGE_SIZE] == buf[PAGE_SIZE]); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mremap_non_page_size.c000066400000000000000000000030361277367620400202550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void check_mapping(int* rpage, int* wpage, ssize_t nr_ints) { int i; for (i = 0; i < nr_ints; ++i) { test_assert(wpage[i] == rpage[i]); wpage[i] = i; test_assert(rpage[i] == i && wpage[i] == rpage[i]); } atomic_printf(" %p and %p point at the same resource\n", rpage, wpage); } static void overwrite_file(const char* path, ssize_t num_bytes) { const int magic = 0x5a5a5a5a; int fd = open(path, O_TRUNC | O_RDWR, 0600); size_t i; for (i = 0; i < num_bytes / sizeof(magic); ++i) { write(fd, &magic, sizeof(magic)); } close(fd); } int main(void) { size_t num_bytes = sysconf(_SC_PAGESIZE); char file_name[] = "/tmp/rr-test-mremap-XXXXXX"; int fd = mkstemp(file_name); int* wpage; int* rpage; int* old_wpage; test_assert(fd >= 0); overwrite_file(file_name, num_bytes - 4); wpage = mmap(NULL, num_bytes - 8, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); rpage = mmap(NULL, num_bytes, PROT_READ, MAP_SHARED, fd, 0); atomic_printf("wpage:%p\n", wpage); test_assert(wpage != (void*)-1 && rpage != (void*)-1 && rpage != wpage); old_wpage = wpage; /* Test a remapping that changes the number of pages */ wpage = mremap(old_wpage, num_bytes - 8, num_bytes + 8, MREMAP_MAYMOVE); atomic_printf("remapped wpage:%p\n", wpage); test_assert(wpage != (void*)-1 && wpage != old_wpage); check_mapping(rpage, wpage, (num_bytes - 4) / sizeof(*wpage)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mremap_shrink.c000066400000000000000000000006751277367620400167410ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { void* p = mmap(NULL, 3 * PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); void* p2 = mremap(p, 3 * PAGE_SIZE, 2 * PAGE_SIZE, 0); void* p3 = mremap(p, 2 * PAGE_SIZE, PAGE_SIZE, MREMAP_MAYMOVE); atomic_printf("%p %p %p\n", p, p2, p3); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/msg.c000066400000000000000000000077321277367620400146710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_MSGS 3 struct msg { long mtype; long msg; }; static void breakpoint(void) { int break_here = 1; (void)break_here; } static int msqid; static void child(void) { const char* id = "c"; int i; int ret; int err; struct msg msg; memset(&msg, 0, sizeof(msg)); atomic_printf("%s: inherited msg id %d\n", id, msqid); test_assert(msqid >= 0); for (i = 1; i < NUM_MSGS; ++i) { atomic_printf("%s: msgrcv() ...\n", id); ret = msgrcv(msqid, &msg, sizeof(msg.msg), i, 0); err = errno; atomic_printf("%s: ... returned %d (%s/%d): (%ld, %ld)\n", id, ret, strerror(err), err, msg.mtype, msg.msg); test_assert(sizeof(msg.msg) == ret); test_assert(msg.mtype + 1 == msg.msg); } atomic_printf("%s: awaiting Q destruction ...\n", id); ret = msgrcv(msqid, &msg, sizeof(msg.msg), i, 0); err = errno; atomic_printf("%s: ... returned %d (%s/%d)\n", id, ret, strerror(err), err); test_assert(-1 == ret && EIDRM == err); atomic_printf("%s: ... done\n", id); exit(0); } int main(void) { const char* id = "P"; int ret; int err; pid_t c; struct msqid_ds buf; struct msginfo info; int i; int status; struct msg msg; memset(&msg, 0, sizeof(msg)); breakpoint(); /* NB: no syscalls between here and |msgget()| below. */ /* NB: surprisingly, this test will leak Q's on failure, even * though we're using IPC_PRIVATE. There doesn't appear to be * a way to avoid that. */ msqid = msgget(IPC_PRIVATE, 0600); atomic_printf("%s: got id %d for key %d\n", id, msqid, IPC_PRIVATE); test_assert(msqid >= 0); memset(&buf, 0x5a, sizeof(buf)); test_assert(0 == msgctl(msqid, IPC_STAT, &buf)); atomic_printf("%s: Q stats in %p:\n" " { perm:%#o qnum:%ld lspid:%d lrpid:%d }\n", id, &buf, buf.msg_perm.mode, buf.msg_qnum, buf.msg_lspid, buf.msg_lrpid); memset(&info, 0x5a, sizeof(info)); ret = msgctl(msqid, IPC_INFO, (struct msqid_ds*)&info); err = errno; atomic_printf("%s: IPC_INFO returned %d (%s/%d):\n" " { max:%d mnb:%d mni:%d }\n", id, ret, strerror(err), err, info.msgmax, info.msgmnb, info.msgmni); test_assert(ret >= 0); memset(&info, 0x5a, sizeof(info)); ret = msgctl(msqid, MSG_INFO, (struct msqid_ds*)&info); err = errno; atomic_printf("%s: MSG_INFO returned %d (%s/%d):\n" " { pool:%d map:%d tql:%d }\n", id, ret, strerror(err), err, info.msgpool, info.msgmap, info.msgtql); test_assert(ret >= 0); if ((0 == (c = fork()))) { child(); test_assert("Not reached" && 0); } /* Make the child wait on msgrcv() a few times. */ for (i = 1; i < NUM_MSGS; ++i) { atomic_printf("%s: sleeping ...\n", id); usleep(500000); msg.mtype = i; msg.msg = msg.mtype + 1; atomic_printf("%s: sending msg (%ld, %ld) ...\n", id, msg.mtype, msg.msg); ret = msgsnd(msqid, &msg, sizeof(msg.msg), 0); err = errno; atomic_printf("%s: ... returned %d (%s/%d)\n", id, ret, strerror(err), err); test_assert(0 == ret); atomic_printf("%s: ... done\n", id); } memset(&buf, 0x5a, sizeof(buf)); test_assert(0 == msgctl(msqid, IPC_STAT, &buf)); atomic_printf("%s: Q stats: { perm:%#o qnum:%ld lspid:%d lrpid:%d }\n", id, buf.msg_perm.mode, buf.msg_qnum, buf.msg_lspid, buf.msg_lrpid); /* Make the child wait on msgrcv() returning EIDRM. */ atomic_printf("%s: sleeping ...\n", id); usleep(500000); atomic_printf("%s: destroying msg Q ...\n", id); test_assert(0 == msgctl(msqid, IPC_RMID, NULL)); atomic_printf("%s: ... done", id); atomic_printf("%s: joining %d ...\n", id, c); ret = waitpid(c, &status, 0); atomic_printf("%s: ... joined %d with status %#x\n", id, ret, status); test_assert(c == ret && WIFEXITED(status) && 0 == WEXITSTATUS(status)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/msync.c000066400000000000000000000015531277367620400152270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define FILENAME "foo.txt" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); int fd = open(FILENAME, O_CREAT | O_EXCL | O_RDWR, 0600); int* wpage; size_t i; int* rpage; unlink(FILENAME); test_assert(fd >= 0); ftruncate(fd, page_size); wpage = mmap(NULL, page_size, PROT_WRITE, MAP_SHARED, fd, 0); test_assert(wpage != (void*)-1); for (i = 0; i < page_size / sizeof(int); ++i) { wpage[i] = i; } rpage = mmap(NULL, page_size, PROT_READ, MAP_SHARED, fd, 0); test_assert(rpage != (void*)-1 && wpage != rpage); msync(wpage, page_size, MS_INVALIDATE); for (i = 0; i < page_size / sizeof(int); ++i) { test_assert(rpage[i] == (ssize_t)i); atomic_printf("%d,", rpage[i]); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mtio.c000066400000000000000000000004261277367620400150440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct mtget out; int ret = ioctl(STDOUT_FILENO, MTIOCGET, &out); test_assert(ret == -1 && ENOTTY == errno); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/multiple_pending_signals.c000066400000000000000000000033321277367620400211520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* In this test, usually SIGUSR1 will be delivered, and then as soon as we enter the SIGUSR1 handler, SIGUSR2 will be delivered and run nested inside the SIGUSR1 handler. This doesn't usually exercise multiple pending signals within rr itself, because the kernel doesn't notify rr of the second signal until rr has injected the first signal. */ static int to_child[2]; static int from_child[2]; static void* run_thread(__attribute__((unused)) void* p) { char ch; sigset_t s; sigemptyset(&s); sigaddset(&s, SIGUSR1); sigaddset(&s, SIGUSR2); sigprocmask(SIG_SETMASK, &s, NULL); /* yield to the main thread to minimize the chance of a context switch during the following two syscalls */ test_assert(1 == read(to_child[0], &ch, 1)); test_assert('J' == ch); kill(getpid(), SIGUSR1); kill(getpid(), SIGUSR2); test_assert(1 == write(from_child[1], "K", 1)); return NULL; } static void handler(int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* p) { atomic_printf("Handling signal %s\n", sig == SIGUSR1 ? "SIGUSR1" : "SIGUSR2"); } int main(void) { pthread_t t; char ch; struct sigaction sa; test_assert(0 == pipe(to_child)); test_assert(0 == pipe(from_child)); sa.sa_sigaction = handler; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_SIGINFO | SA_RESTART; sigaction(SIGUSR1, &sa, NULL); sigaction(SIGUSR2, &sa, NULL); pthread_create(&t, NULL, run_thread, NULL); test_assert(1 == write(to_child[1], "J", 1)); test_assert(1 == read(from_child[0], &ch, 1)); test_assert('K' == ch); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/multiple_pending_signals_sequential.c000066400000000000000000000036031277367620400234050ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* In this test, usually SIGUSR1 will be delivered, the SIGUSR1 handler will run, and when the handler returns, SIGUSR2 will be delivered and its handler will run. This doesn't usually exercise multiple pending signals within rr itself, because the kernel doesn't notify rr of the second signal until rr has injected the first signal. */ static int to_child[2]; static int from_child[2]; static void* run_thread(__attribute__((unused)) void* p) { char ch; sigset_t s; sigemptyset(&s); sigaddset(&s, SIGUSR1); sigaddset(&s, SIGUSR2); sigprocmask(SIG_SETMASK, &s, NULL); /* yield to the main thread to minimize the chance of a context switch during the following two syscalls */ test_assert(1 == read(to_child[0], &ch, 1)); test_assert('J' == ch); kill(getpid(), SIGUSR1); kill(getpid(), SIGUSR2); return NULL; } static int handler_count; static void handler(int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* p) { atomic_printf("Handling signal %s\n", sig == SIGUSR1 ? "SIGUSR1" : "SIGUSR2"); ++handler_count; if (handler_count == 2) { test_assert(1 == write(from_child[1], "K", 1)); } } int main(void) { pthread_t t; char ch; struct sigaction sa; test_assert(0 == pipe(to_child)); test_assert(0 == pipe(from_child)); sa.sa_sigaction = handler; sigemptyset(&sa.sa_mask); sigaddset(&sa.sa_mask, SIGUSR2); sa.sa_flags = SA_SIGINFO | SA_RESTART; sigaction(SIGUSR1, &sa, NULL); sigemptyset(&sa.sa_mask); sigaddset(&sa.sa_mask, SIGUSR1); sigaction(SIGUSR2, &sa, NULL); pthread_create(&t, NULL, run_thread, NULL); test_assert(1 == write(to_child[1], "J", 1)); test_assert(1 == read(from_child[0], &ch, 1)); test_assert('K' == ch); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/munmap_discontinuous.c000066400000000000000000000014361277367620400203610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TEST_FILE "foo.txt" int main(void) { size_t page_size = sysconf(_SC_PAGESIZE); int fd = open(TEST_FILE, O_CREAT | O_EXCL | O_RDWR, 0600); uint8_t* pages; test_assert(fd >= 0); test_assert(0 == ftruncate(fd, 8 * page_size)); unlink(TEST_FILE); pages = mmap(NULL, 8 * page_size, PROT_WRITE, MAP_PRIVATE, fd, 0); test_assert(pages != (void*)-1); /* Unmap first page. */ munmap(pages, page_size); /* Unmap third page. */ munmap(pages + 2 * page_size, page_size); /* Unmap fifth page. */ munmap(pages + 4 * page_size, page_size); /* Unmap first 6 page locations, leave last 2. */ munmap(pages, 6 * page_size); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/munmap_segv.c000066400000000000000000000007571277367620400164240ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(__attribute__((unused)) int sig) { atomic_puts("EXIT-SUCCESS"); _exit(0); } int main(void) { char* p = (char*)mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); test_assert(p != MAP_FAILED); signal(SIGSEGV, sighandler); *p = 'a'; test_assert(0 == munmap(p, PAGE_SIZE)); *p = 'b'; return 0; } rr-4.4.0/src/test/mutex_pi_stress.c000066400000000000000000000021321277367620400173250ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_THREADS 10 #define NUM_TRIALS 1000 static pthread_mutex_t lock; static void* thread(void* idp) { int tid = (intptr_t)idp; int i; atomic_printf("thread %d starting ...\n", tid); for (i = 0; i < NUM_TRIALS; ++i) { pthread_mutex_lock(&lock); sched_yield(); pthread_mutex_unlock(&lock); } atomic_printf(" ... thread %d done.\n", tid); return NULL; } int main(void) { pthread_mutexattr_t attr; pthread_t threads[NUM_THREADS]; int i; pthread_mutexattr_init(&attr); test_assert(0 == pthread_mutexattr_setprotocol(&attr, PTHREAD_PRIO_INHERIT)); if (pthread_mutex_init(&lock, &attr)) { test_assert(ENOTSUP == errno); test_assert(0 == pthread_mutex_init(&lock, NULL)); } for (i = 0; i < NUM_THREADS; ++i) { test_assert(0 == pthread_create(&threads[i], NULL, thread, (void*)(intptr_t)i)); } for (i = 0; i < NUM_THREADS; ++i) { test_assert(0 == pthread_join(threads[i], NULL)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/mutex_pi_stress.run000066400000000000000000000001731277367620400177120ustar00rootroot00000000000000source `dirname $0`/util.sh # Switch threads very eagerly on recorded events. RECORD_ARGS="-s" compare_test EXIT-SUCCESS rr-4.4.0/src/test/nanosleep.c000066400000000000000000000022221277367620400160540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Keep this roughly in sync with 'clock_nanosleep' */ static void* do_thread(__attribute__((unused)) void* p) { sigset_t sigs; sigemptyset(&sigs); sigaddset(&sigs, SIGINT); pthread_sigmask(SIG_BLOCK, &sigs, NULL); while (1) { sleep(1); test_assert(0 == kill(getpid(), SIGINT)); } return NULL; } static void handler(__attribute__((unused)) int sig) {} int main(void) { struct timespec sleep = { 0, 1000000 }; struct timespec* remain; pthread_t thread; test_assert(0 == nanosleep(&sleep, NULL)); ALLOCATE_GUARD(remain, 'x'); remain->tv_sec = 9999; remain->tv_nsec = 9998; test_assert(0 == nanosleep(&sleep, remain)); VERIFY_GUARD(remain); test_assert(remain->tv_sec == 9999 && remain->tv_nsec == 9998); test_assert(0 == signal(SIGINT, handler)); pthread_create(&thread, NULL, do_thread, NULL); sleep.tv_sec = 1000000; test_assert(-1 == nanosleep(&sleep, remain)); test_assert(errno == EINTR); VERIFY_GUARD(remain); test_assert(remain->tv_sec <= sleep.tv_sec); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/no_mask_timeslice.c000066400000000000000000000013041277367620400175550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pseudospinlock; static pthread_barrier_t bar; static void* thread(__attribute__((unused)) void* unused) { pthread_barrier_wait(&bar); sched_yield(); pseudospinlock = 1; return NULL; } int main(void) { sigset_t old, mask; pthread_t t; pthread_barrier_init(&bar, NULL, 2); test_assert(0 == pthread_create(&t, NULL, thread, NULL)); sigfillset(&mask); pthread_sigmask(SIG_BLOCK, &mask, &old); pthread_barrier_wait(&bar); while (!pseudospinlock) ; pthread_sigmask(SIG_SETMASK, &old, NULL); pthread_join(t, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/numa.c000066400000000000000000000016671277367620400150440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define MPOL_DEFAULT 0 #define MPOL_PREFERRED 1 #define MPOL_BIND 2 #define MPOL_INTERLEAVE 3 #define MPOL_MF_STRICT 0x1 #define MPOL_MF_MOVE 0x2 #define MPOL_MF_MOVE_ALL 0x4 #define MPOL_F_STATIC_NODES (1 << 15) #define MPOL_F_RELATIVE_NODES (1 << 14) static long mbind(void* start, unsigned long len, int mode, const unsigned long* nmask, unsigned long maxnode, unsigned flags) { return syscall(SYS_mbind, start, len, mode, nmask, maxnode, flags); } int main(void) { void* p = mmap(NULL, 16 * PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); int ret; test_assert(p != MAP_FAILED); ret = mbind(p, 16 * PAGE_SIZE, MPOL_PREFERRED, NULL, 0, MPOL_MF_MOVE); test_assert(ret == 0 || (ret == -1 && errno == ENOSYS)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/old_fork.c000066400000000000000000000005631277367620400156750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status; if (0 == (child = syscall(SYS_fork))) { return 11; } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 11); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/orphan_process.c000066400000000000000000000017771277367620400171330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { /* Descendant process will write one byte to the pipe to signal that it's * complete */ int pipe_fds[2]; int err = pipe(pipe_fds); pid_t child_pid, grandchild_pid, greatgrandchild_pid, dyingchild_pid; test_assert(err == 0); child_pid = fork(); if (child_pid) { char buf; int n = read(pipe_fds[0], &buf, 1); test_assert(n == 1); return 0; } /* In child */ dyingchild_pid = getpid(); grandchild_pid = fork(); if (grandchild_pid) { exit(0); } /* In grandchild */ /* Wait for parent to die */ while (getppid() == dyingchild_pid) { sched_yield(); } /* Now the rr supervisor process is no longer our ancestor in the process tree. Try forking again. */ greatgrandchild_pid = fork(); if (greatgrandchild_pid) { exit(0); } /* In great-grandchild */ atomic_puts("EXIT-SUCCESS"); write(pipe_fds[1], "a", 1); return 0; } rr-4.4.0/src/test/packet_mmap_disable.c000066400000000000000000000012001277367620400200270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int sock = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); int ret; char buf[1024]; if (sock < 0) { atomic_puts("Can't create raw socket"); atomic_puts("EXIT-SUCCESS"); return 0; } memset(buf, 0, sizeof(buf)); ret = setsockopt(sock, SOL_PACKET, PACKET_RX_RING, buf, sizeof(buf)); test_assert(ret < 0 && errno == ENOPROTOOPT); ret = setsockopt(sock, SOL_PACKET, PACKET_TX_RING, buf, sizeof(buf)); test_assert(ret < 0 && errno == ENOPROTOOPT); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/parent_no_break_child_bkpt.py000066400000000000000000000004521277367620400216150ustar00rootroot00000000000000from rrutil import * def observe_normal_parent_exit(): expect_rr('EXIT-SUCCESS') expect_gdb(r'Inferior 1 \(process \d+\) exited normally') send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') observe_normal_parent_exit() restart_replay() observe_normal_parent_exit() ok() rr-4.4.0/src/test/parent_no_break_child_bkpt.run000066400000000000000000000001351277367620400217670ustar00rootroot00000000000000source `dirname $0`/util.sh record fork_child_crash$bitness debug parent_no_break_child_bkpt rr-4.4.0/src/test/parent_no_stop_child_crash.py000066400000000000000000000003651277367620400216610ustar00rootroot00000000000000from rrutil import * def observe_normal_parent_exit(): expect_rr('EXIT-SUCCESS') expect_gdb(r'Inferior 1 \(process \d+\) exited normally') send_gdb('c') observe_normal_parent_exit() restart_replay() observe_normal_parent_exit() ok() rr-4.4.0/src/test/parent_no_stop_child_crash.run000066400000000000000000000001351277367620400220300ustar00rootroot00000000000000source `dirname $0`/util.sh record fork_child_crash$bitness debug parent_no_stop_child_crash rr-4.4.0/src/test/pause.c000066400000000000000000000010521277367620400152050ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int caught_signal; static void handle_signal(__attribute__((unused)) int sig) { ++caught_signal; } int main(void) { int err; signal(SIGALRM, handle_signal); alarm(1); atomic_puts("set alarm for 1 sec from now; pausing ..."); pause(); err = errno; atomic_printf(" ... woke up with errno %s(%d)\n", strerror(err), err); test_assert(1 == caught_signal); test_assert(EINTR == err); atomic_puts("EXIT-SUCCESS"); return 1; } rr-4.4.0/src/test/perf_event.c000066400000000000000000000020611277367620400162260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int counter_fd; static int sys_perf_event_open(struct perf_event_attr* attr, pid_t pid, int cpu, int group_fd, unsigned long flags) { return syscall(SYS_perf_event_open, attr, pid, cpu, group_fd, flags); } static uint64_t get_desched(void) { uint64_t nr_desched; test_assert(sizeof(nr_desched) == read(counter_fd, &nr_desched, sizeof(nr_desched))); return nr_desched; } int main(void) { struct perf_event_attr attr; int i; memset(&attr, 0, sizeof(attr)); attr.size = sizeof(attr); attr.type = PERF_TYPE_SOFTWARE; attr.config = PERF_COUNT_SW_CONTEXT_SWITCHES; counter_fd = sys_perf_event_open(&attr, 0 /*self*/, -1 /*any cpu*/, -1, 0); test_assert(0 <= counter_fd); atomic_printf("num descheds: %" PRIu64 "\n", get_desched()); for (i = 0; i < 5; ++i) { sched_yield(); atomic_printf("after yield: %" PRIu64 "\n", get_desched()); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/personality.c000066400000000000000000000004211277367620400164400ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include int main(void) { personality(PER_LINUX); test_assert(personality(0xffffffff) == PER_LINUX); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/poll_sig_race.c000066400000000000000000000016431277367620400167000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS 10 int main(void) { int fds[2]; struct pollfd pfd; int i; pipe2(fds, O_NONBLOCK); pfd.fd = fds[0]; pfd.events = POLLIN; for (i = 0; i < NUM_ITERATIONS; ++i) { char c; int ret; atomic_printf("iteration %d\n", i); if (0 == fork()) { usleep(250000); write(fds[1], "x", 1); return 0; } /* wait for 1 second, which should be long enough for the chlid to do its write. In extreme cases the child might run to completion before this poll() call is entered, in which case we will time out safely. */ ret = poll(&pfd, 1, 1000); if (ret == 0) { continue; } test_assert(1 == ret); test_assert(POLLIN & pfd.revents); test_assert(1 == read(pfd.fd, &c, 1)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/post_exec_fpu_regs.py000066400000000000000000000001371277367620400201640ustar00rootroot00000000000000from rrutil import * import re send_gdb('p $xmm0') expect_gdb('v4_float = {0, 0, 0, 0}') ok() rr-4.4.0/src/test/post_exec_fpu_regs.run000066400000000000000000000001131277367620400203320ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug post_exec_fpu_regs rr-4.4.0/src/test/ppoll.c000066400000000000000000000024061277367620400152220ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #define NUM_ITERATIONS 10 static void handle_sig(__attribute__((unused)) int sig) { sigset_t after_sigset; int ret = sigprocmask(SIG_BLOCK, NULL, &after_sigset); test_assert(ret == 0); test_assert(sigismember(&after_sigset, SIGCHLD)); } int main(void) { int fds[2]; struct pollfd pfd; int i; struct timespec t; t.tv_sec = 1; t.tv_nsec = 0; sigset_t sigset; test_assert(0 == sigemptyset(&sigset)); test_assert(0 == sigaddset(&sigset, SIGCHLD)); signal(SIGALRM, &handle_sig); pipe2(fds, O_NONBLOCK); pfd.fd = fds[0]; pfd.events = POLLIN; for (i = 0; i < NUM_ITERATIONS; ++i) { int ret; atomic_printf("iteration %d\n", i); if (i % 2 == 0) { ualarm(100000, 0); } else if (fork() == 0) { usleep(100000); return 0; } ret = ppoll(&pfd, 1, &t, &sigset); if (i % 2 == 0) { test_assert(ret == -1 && errno == EINTR); } else { test_assert(ret == 0); } sigset_t after_sigset; ret = sigprocmask(SIG_BLOCK, NULL, &after_sigset); test_assert(ret == 0); test_assert(!sigismember(&after_sigset, SIGCHLD)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/prctl.c000066400000000000000000000036601277367620400152230ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { char setname[16] = "prctl-test"; char getname[16]; unsigned long slack = sizeof(unsigned long) == 4 ? 1024 * 1024 * 1024 : (unsigned long)(1024LL * 1024 * 1024 * 8); int sig = 99; int tsc = 99; int dummy; test_assert(0 == prctl(PR_SET_KEEPCAPS, 0)); test_assert(0 == prctl(PR_GET_KEEPCAPS)); test_assert(0 == prctl(PR_SET_KEEPCAPS, 1)); test_assert(1 == prctl(PR_GET_KEEPCAPS)); test_assert(0 == prctl(PR_SET_NAME, setname)); test_assert(0 == prctl(PR_GET_NAME, getname)); atomic_printf("set name `%s'; got name `%s'\n", setname, getname); test_assert(!strcmp(getname, setname)); test_assert(0 == prctl(PR_SET_DUMPABLE, 0)); test_assert(0 == prctl(PR_GET_DUMPABLE)); test_assert(0 == prctl(PR_SET_DUMPABLE, 1)); test_assert(1 == prctl(PR_GET_DUMPABLE)); test_assert(0 == prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); test_assert(1 == prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)); test_assert(0 == prctl(PR_SET_TIMERSLACK, slack)); /* prctl coerces its result to int */ test_assert((int)slack == prctl(PR_GET_TIMERSLACK)); test_assert(0 == prctl(PR_MCE_KILL, PR_MCE_KILL_SET, PR_MCE_KILL_EARLY, 0, 0)); test_assert(PR_MCE_KILL_EARLY == prctl(PR_MCE_KILL_GET, 0, 0, 0, 0)); test_assert(-1 == prctl(PR_GET_ENDIAN, &dummy) && errno == EINVAL); test_assert(-1 == prctl(PR_GET_FPEMU, &dummy) && errno == EINVAL); test_assert(-1 == prctl(PR_GET_FPEXC, &dummy) && errno == EINVAL); test_assert(-1 == prctl(PR_GET_UNALIGN, &dummy) && errno == EINVAL); test_assert(0 == prctl(PR_GET_PDEATHSIG, (unsigned long)&sig)); test_assert(sig == 0); test_assert(0 == prctl(PR_GET_TSC, (unsigned long)&tsc)); test_assert(tsc == PR_TSC_ENABLE); test_assert(0 == prctl(PR_GET_SECCOMP)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/prctl_deathsig.c000066400000000000000000000023401277367620400170650ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int grandchild_to_child_fds[2]; static int grandchild_to_main_fds[2]; static void handle_signal(int sig) { test_assert(sig == SIGILL); atomic_puts("EXIT-SUCCESS"); /* Signal main to go ahead and exit */ test_assert(1 == write(grandchild_to_main_fds[1], "x", 1)); exit(0); } static int run_grandchild(void) { int sig = 99; signal(SIGILL, handle_signal); test_assert(0 == prctl(PR_SET_PDEATHSIG, SIGILL)); test_assert(0 == prctl(PR_GET_PDEATHSIG, (unsigned long)&sig)); test_assert(sig == SIGILL); /* Signal child to go ahead and exit. This will trigger our SIGILL handler. */ test_assert(1 == write(grandchild_to_child_fds[1], "y", 1)); sleep(1000000); test_assert(0); return 0; } static int run_child(void) { char ch; if (!fork()) { return run_grandchild(); } test_assert(1 == read(grandchild_to_child_fds[0], &ch, 1)); return 0; } int main(void) { char ch; test_assert(0 == pipe(grandchild_to_child_fds)); test_assert(0 == pipe(grandchild_to_main_fds)); if (!fork()) { return run_child(); } test_assert(1 == read(grandchild_to_main_fds[0], &ch, 1)); return 0; } rr-4.4.0/src/test/prctl_name.c000066400000000000000000000046351277367620400162260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Max name length is 16 bytes, *without* null terminator. */ #define PRNAME_NUM_BYTES 16 const char* exe_image; const char main_name[] = "main"; const char thread_name[] = "thread"; const char fork_child_name[] = "fchild"; const char exec_child_name[] = "echild"; static void assert_prname_is(const char* tag, const char* name) { char prname[PRNAME_NUM_BYTES] = ""; test_assert(0 == prctl(PR_GET_NAME, prname)); atomic_printf("%s: prname is '%s'; expecting '%s'\n", tag, prname, name); test_assert(!strcmp(prname, name)); } static void* thread(__attribute__((unused)) void* unused) { pid_t child; assert_prname_is("thread", main_name); prctl(PR_SET_NAME, thread_name); assert_prname_is("thread", thread_name); if ((child = fork())) { int status; test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); assert_prname_is("thread", thread_name); return NULL; } assert_prname_is("fork child", thread_name); prctl(PR_SET_NAME, fork_child_name); assert_prname_is("fork child", fork_child_name); execl(exe_image, exe_image, "exec child", NULL); test_assert("Not reached" && 0); return NULL; } char initial_name[PRNAME_NUM_BYTES] = ""; static void compute_initial_name(const char* exe_image) { const char* basename = strrchr(exe_image, '/'); if (basename) { /* Eat the '/' character. */ ++basename; } else { /* Image path is already a basename. */ basename = exe_image; } atomic_printf(" (basename of exe path '%s' is '%s')\n", exe_image, basename); strncpy(initial_name, basename, sizeof(initial_name) - 1); } int main(int argc, char* argv[]) { pthread_t t; exe_image = argv[0]; compute_initial_name(exe_image); if (2 == argc) { assert_prname_is("exec child", initial_name); prctl(PR_SET_NAME, exec_child_name); assert_prname_is("exec child", exec_child_name); return 0; } assert_prname_is("main", initial_name); test_assert(-1 == prctl(PR_SET_NAME, NULL)); test_assert(EFAULT == errno); assert_prname_is("main", initial_name); prctl(PR_SET_NAME, main_name); assert_prname_is("main", main_name); test_assert(0 == pthread_create(&t, NULL, thread, NULL)); pthread_join(t, NULL); assert_prname_is("main", main_name); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/prctl_tsc.c000066400000000000000000000025121277367620400160670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void skip_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, void* user) { ucontext_t* ctx = (ucontext_t*)user; #if defined(__i386__) ctx->uc_mcontext.gregs[REG_EIP] += 2; #elif defined(__x86_64__) ctx->uc_mcontext.gregs[REG_RIP] += 2; #else #error unknown architecture #endif } static void print_handler(__attribute__((unused)) int sig) { atomic_puts("EXIT-SUCCESS"); exit(0); } static void exit_handler(__attribute__((unused)) int sig) { exit(77); } int main(void) { int status; pid_t child; struct sigaction sa; test_assert(0 == prctl(PR_SET_TSC, PR_TSC_SIGSEGV)); sa.sa_sigaction = skip_handler; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_SIGINFO; test_assert(0 == sigaction(SIGSEGV, &sa, NULL)); child = fork(); if (!child) { test_assert(0 == prctl(PR_GET_TSC, &status)); test_assert(PR_TSC_SIGSEGV == status); signal(SIGSEGV, exit_handler); rdtsc(); return 77; } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); signal(SIGSEGV, print_handler); test_assert(0 == prctl(PR_GET_TSC, &status)); test_assert(PR_TSC_SIGSEGV == status); rdtsc(); return 1; } rr-4.4.0/src/test/priority.c000066400000000000000000000010451277367620400157530ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int prio1, prio2; prio1 = getpriority(PRIO_PROCESS, 0); atomic_printf("Current process priority: %d\n", prio1); if (prio1 < 19) { /* If it's less than 19, we can decrease the * priority. */ ++prio1; } setpriority(PRIO_PROCESS, 0, prio1); prio2 = getpriority(PRIO_PROCESS, 0); test_assert(prio1 == prio2); atomic_printf("Now priority is: %d\n", prio2); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/priority.run000066400000000000000000000001551277367620400163360ustar00rootroot00000000000000source `dirname $0`/util.sh renice -n 1 $$ && record $TESTNAME renice -n 2 $$ && replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/proc_fds.c000066400000000000000000000034371277367620400157000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #include static pthread_barrier_t bar; static const char proc_fd_path[] = "/proc/self/fd"; static void* thread_func(__attribute__((unused)) void* name) { pthread_barrier_wait(&bar); sleep(1); return NULL; } static void close_upper_fds(void) { DIR* dir = opendir(proc_fd_path); struct dirent* ent; int fd; test_assert(dir != NULL); while ((ent = readdir(dir)) != NULL) { fd = atoi(ent->d_name); if (fd > 2) { close(fd); } } closedir(dir); } int main(void) { // Empirically tested to be enough to make ProcFdDirMonitor // repeat the getdents call. const int NUM_THREADS = 20; int i; // Close any non-stdio fds inherited from the environment close_upper_fds(); for (i = 0; i < 15; i++) { dup(2); } close(RR_MAGIC_SAVE_DATA_FD); /* init barrier */ pthread_barrier_init(&bar, NULL, NUM_THREADS + 1); /* Create independent threads each of which will execute * function */ for (i = 0; i < NUM_THREADS; i++) { pthread_t thread; pthread_create(&thread, NULL, thread_func, NULL); } pthread_barrier_wait(&bar); const char proc_fd_path[] = "/proc/self/fd"; int fd = syscall(SYS_open, proc_fd_path, O_DIRECTORY); test_assert(fd >= 0); char buf[128]; char* current; int bytes; while ((bytes = syscall(SYS_getdents64, fd, &buf, sizeof(buf)))) { current = buf; while (current != buf + bytes) { struct dirent64* ent = (struct dirent64*)current; char* end; int fd = strtol(ent->d_name, &end, 10); if (!*end) { test_assert(fd < 20); // Other fds should be cloaked! } current += ent->d_reclen; } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/proc_mem.c000066400000000000000000000055441277367620400157030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int cookie1; static int cookie2; static int COOKIE = 0x12345678; static int do_openat(int child) { char buf[1024]; int fd; int dir_fd = open("/proc", O_PATH); test_assert(dir_fd >= 0); sprintf(buf, "%d/mem", child); fd = openat(dir_fd, buf, O_RDWR); close(dir_fd); return fd; } static int do_open(int child) { char buf[1024]; sprintf(buf, "/proc/%d/mem", child); return open(buf, O_RDWR); } static int do_cmsg_generic(int child, int use_recvmmsg) { int fd = do_open(child); /* launder it through SCM_RIGHTS */ char ch = 0; struct mmsghdr msgvec; struct msghdr* msg = &msgvec.msg_hdr; struct iovec iov; uint8_t cbuf[CMSG_SPACE(sizeof(fd))]; struct cmsghdr* cmsg; int sockfds[2]; test_assert(0 == socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds)); iov.iov_base = "x"; iov.iov_len = 1; memset(msg, 0, sizeof(*msg)); msg->msg_iov = &iov; msg->msg_iovlen = 1; msg->msg_control = cbuf; msg->msg_controllen = sizeof(cbuf); cmsg = CMSG_FIRSTHDR(msg); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); test_assert(1 == sendmsg(sockfds[1], msg, 0)); iov.iov_base = &ch; if (use_recvmmsg) { test_assert(1 == recvmmsg(sockfds[0], &msgvec, 1, 0, NULL)); test_assert(1 == msgvec.msg_len); } else { test_assert(1 == recvmsg(sockfds[0], msg, 0)); } test_assert('x' == ch); cmsg = CMSG_FIRSTHDR(msg); test_assert(SOL_SOCKET == cmsg->cmsg_level && SCM_RIGHTS == cmsg->cmsg_type); memcpy(&fd, CMSG_DATA(cmsg), sizeof(fd)); close(sockfds[0]); close(sockfds[1]); return fd; } static int do_cmsg(int child) { return do_cmsg_generic(child, 0); } static int do_cmsg_recvmmsg(int child) { return do_cmsg_generic(child, 1); } static void do_test(int (*opener)(int)) { pid_t child; int fd; int status; int pipe_fds[2]; struct iovec iov[2]; test_assert(0 == pipe(pipe_fds)); child = fork(); if (!child) { char ch; test_assert(1 == read(pipe_fds[0], &ch, 1)); test_assert(COOKIE == cookie1); test_assert(COOKIE == cookie2); exit(77); } fd = opener(child); test_assert(fd >= 0); test_assert(sizeof(COOKIE) == pwrite(fd, &COOKIE, sizeof(COOKIE), (off_t)&cookie1)); iov[0].iov_base = (char*)&COOKIE; iov[0].iov_len = 2; iov[1].iov_base = (char*)&COOKIE + 2; iov[1].iov_len = 2; test_assert(sizeof(COOKIE) == pwritev(fd, iov, 2, (off_t)&cookie2)); test_assert(1 == write(pipe_fds[1], "x", 1)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); } int main(void) { do_test(do_open); do_test(do_openat); do_test(do_cmsg); do_test(do_cmsg_recvmmsg); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/protect_rr_fds.c000066400000000000000000000030601277367620400171100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define MAX_FDS 2048 int main(int argc, char* argv[]) { pid_t child; int status; int ret; int fd; int pipe_fds[2]; struct rlimit nofile; int fd_limit; if (argc == 2) { atomic_puts("EXIT-SUCCESS"); return 77; } /* Various spawning APIs try to close all open file descriptors before exec --- via direct close(), or by setting CLOEXEC. Check that those don't interfere with rr by closing RR_RESERVED_ROOT_DIR_FD or some other essential file descriptor. */ test_assert(0 == getrlimit(RLIMIT_NOFILE, &nofile)); if (nofile.rlim_cur == RLIM_INFINITY || nofile.rlim_cur > MAX_FDS) { fd_limit = MAX_FDS; } else { fd_limit = nofile.rlim_cur; } for (fd = STDERR_FILENO + 1; fd < fd_limit; ++fd) { ret = fcntl(fd, F_SETFD, FD_CLOEXEC); test_assert(ret == 0 || (ret == -1 && errno == EBADF)); ret = dup2(STDERR_FILENO, fd); test_assert(ret == fd || (ret == -1 && errno == EBADF)); ret = dup3(STDERR_FILENO, fd, O_CLOEXEC); test_assert(ret == fd || (ret == -1 && errno == EBADF)); ret = close(fd); test_assert(ret == 0 || (ret == -1 && errno == EBADF)); } /* Check that syscall buffering still works */ test_assert(0 == pipe(pipe_fds)); test_assert(1 == write(pipe_fds[1], "c", 1)); if (0 == (child = fork())) { execl(argv[0], argv[0], "step2", NULL); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); return 0; } rr-4.4.0/src/test/prw.c000066400000000000000000000013241277367620400147020ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = open("prw.txt", O_CREAT | O_RDWR, 0600); const char content[] = "01234567890\nhello there\n"; char buf[sizeof(content)]; ssize_t nr; memset(buf, '?', sizeof(buf)); nr = write(fd, buf, sizeof(buf)); test_assert(nr == sizeof(buf)); nr = write(fd, buf, 10); test_assert(nr == 10); nr = pwrite(fd, content, sizeof(content), 10); test_assert(nr == sizeof(content)); atomic_printf("Wrote ```%s'''\n", content); nr = pread(fd, buf, sizeof(buf), 10); test_assert(nr == sizeof(content)); atomic_printf("Read ```%s'''\n", buf); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/pthread_condvar_locking.c000066400000000000000000000015151277367620400207450ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static pthread_cond_t condvar = PTHREAD_COND_INITIALIZER; static pthread_mutex_t mutex; static void* start_thread(__attribute__((unused)) void* p) { while (1) { sched_yield(); pthread_mutex_lock(&mutex); pthread_cond_signal(&condvar); pthread_mutex_unlock(&mutex); } return NULL; } int main(void) { pthread_mutexattr_t attr; pthread_t thread; pthread_mutexattr_init(&attr); pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE); pthread_mutex_init(&mutex, &attr); pthread_create(&thread, NULL, start_thread, NULL); pthread_mutex_lock(&mutex); pthread_cond_wait(&condvar, &mutex); pthread_cond_wait(&condvar, &mutex); pthread_mutex_unlock(&mutex); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/pthread_rwlocks.c000066400000000000000000000014061277367620400172660ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static pthread_rwlock_t lock = PTHREAD_RWLOCK_INITIALIZER; static int pipe_fds[2]; static void* start_thread(__attribute__((unused)) void* p) { pthread_rwlock_rdlock(&lock); pthread_rwlock_unlock(&lock); test_assert(1 == write(pipe_fds[1], "x", 1)); pthread_rwlock_wrlock(&lock); pthread_rwlock_unlock(&lock); return NULL; } int main(void) { pthread_t thread; char ch; test_assert(0 == pipe(pipe_fds)); pthread_rwlock_rdlock(&lock); pthread_create(&thread, NULL, start_thread, NULL); test_assert(1 == read(pipe_fds[0], &ch, 1)); pthread_rwlock_unlock(&lock); pthread_join(thread, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace.c000066400000000000000000000230721277367620400153540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NEW_VALUE 0xabcdef static size_t static_data = 0x12345678; enum cpuid_requests { CPUID_GETFEATURES = 0x01, CPUID_GETXSAVE = 0x0D, }; static void cpuid(int code, int subrequest, unsigned int* a, unsigned int* c, unsigned int* d) { asm volatile("cpuid" : "=a"(*a), "=c"(*c), "=d"(*d) : "a"(code), "c"(subrequest) : "ebx"); } static size_t find_xsave_size(void) { unsigned int eax, ecx, edx; cpuid(CPUID_GETFEATURES, 0, &eax, &ecx, &edx); if (!(ecx & (1 << 26))) { // XSAVE not present return 0; } // We'll use the largest possible area all the time // even when it might not be needed. Simpler that way. cpuid(CPUID_GETXSAVE, 0, &eax, &ecx, &edx); return ecx; } int dummy[4] = { 1, 2, 3, 4 }; /* * Let's talk about why this is necessary, because in theory it shouldn't be. * * Intel defines bytes 416-511 of the (FP)XSAVE area as reserved and none of the * xsave instructions touch it. However, bytes 464-511 are used by the linux * kernel to keep metadata about the memory layout of the frame. That leaves * bytes 416-463 to cause trouble. Note that while these bytes do not have any * corresponding register values, the kernel does keep a copy in the fpu * structure. The kernel zeros these bytes on allocation, but ptrace moves them * in and out of the kernel fairly non-discriminantly, so if these bytes end up * non-zero we'll notice in this test, which brings us to how they actually end * up non-zero in this test (spoiler not via ptrace): * * When rr forks a new task, it sends an artificial signal to that new task in * order to force the preload library to set up its required task-local state. * When the kernel delivers a signal, it sets up a signal frame with information * about the signal as well as the full register state of the current thread. * Now, when it comes time to save out the FPU state, the kernel uses the xsave * instruction directly to write out the registers, but as mentioned, those * instructions do not touch the reserved area. Bits 464-511 then get touched * up manually with the required information, but bits 416-463 are not touched * at all, so they end up with whatever happened to be on the stack when the * kernel sets up the signal frame. However, when the kernel restores the * register state from the signal frame, it first copies in the entire area into * its internal data structures, and then restores the actual registers from * there. This means that the bits 416-463 which had invalid stack data in them * are now saved in the kernel fpu data structure and thus observable from * ptrace. * * Lastly, note that this depends on whether or not the current CPU has support * for the XSAVES instruction (and if not whether fpregs are active for the * current thread). If that is not the case, writing out also happens from * the fpu data structure and the reserved area is thus preserved. */ static void clear_reserved_area(uint8_t* fxregs) { int i; for (i = 416; i < 464; ++i) { fxregs[i] = 0; } } int main(void) { pid_t child; int status; struct user_regs_struct* regs; struct user_regs_struct* regs2; struct user_fpregs_struct* fpregs; struct user_fpregs_struct* fpregs2; #ifdef __i386__ struct user_fpxregs_struct* fpxregs; #endif void* xsave_regs; struct iovec iov; int ret; size_t xsave_size = find_xsave_size(); uintptr_t saved_ip; siginfo_t* siginfo; if (0 == (child = fork())) { /* Ensure XMM registers are modified so that ptrace will read the real registers, not stale registers. Working around kernel bug. Also, puts them in a known state in case they were actually used. */ asm("movdqu dummy,%xmm0"); asm("movdqu dummy,%xmm1"); asm("movdqu dummy,%xmm2"); asm("movdqu dummy,%xmm3"); asm("movdqu dummy,%xmm4"); asm("movdqu dummy,%xmm5"); asm("movdqu dummy,%xmm6"); asm("movdqu dummy,%xmm7"); #ifdef __x86_64__ asm("movdqu dummy,%xmm8"); asm("movdqu dummy,%xmm9"); asm("movdqu dummy,%xmm10"); asm("movdqu dummy,%xmm11"); asm("movdqu dummy,%xmm12"); asm("movdqu dummy,%xmm13"); asm("movdqu dummy,%xmm14"); asm("movdqu dummy,%xmm15"); #endif kill(getpid(), SIGSTOP); test_assert(static_data == NEW_VALUE); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); ALLOCATE_GUARD(regs, 0xFF); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, regs)); VERIFY_GUARD(regs); #if defined(__i386__) test_assert((int32_t)regs->eip != -1); test_assert((int32_t)regs->esp != -1); saved_ip = regs->eip; regs->eip = 77; #elif defined(__x86_64__) test_assert((int64_t)regs->rip != -1); test_assert((int64_t)regs->rsp != -1); saved_ip = regs->rip; regs->rip = 77; #else #error unknown architecture #endif test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, regs)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, regs)); #if defined(__i386__) test_assert((int32_t)regs->eip == 77); regs->eip = saved_ip; #elif defined(__x86_64__) test_assert((int64_t)regs->rip == 77); regs->rip = saved_ip; #else #error unknown architecture #endif test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSEGV); test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, regs)); ALLOCATE_GUARD(siginfo, 0xFE); test_assert(0 == ptrace(PTRACE_GETSIGINFO, child, NULL, siginfo)); VERIFY_GUARD(siginfo); test_assert(siginfo->si_signo == SIGSEGV); test_assert(siginfo->si_code == SEGV_MAPERR); test_assert(siginfo->si_addr == (void*)77); ALLOCATE_GUARD(fpregs, 0xBB); test_assert(0 == ptrace(PTRACE_GETFPREGS, child, NULL, fpregs)); test_assert(NULL == memchr(fpregs, 0xBB, sizeof(*fpregs))); VERIFY_GUARD(fpregs); test_assert(0 == ptrace(PTRACE_SETFPREGS, child, NULL, fpregs)); #ifdef __i386__ ALLOCATE_GUARD(fpxregs, 0xCC); test_assert(0 == ptrace(PTRACE_GETFPXREGS, child, NULL, fpxregs)); clear_reserved_area((uint8_t*)fpxregs); test_assert(NULL == memchr(fpxregs, 0xCC, sizeof(*fpxregs))); VERIFY_GUARD(fpxregs); test_assert(0 == ptrace(PTRACE_SETFPXREGS, child, NULL, fpxregs)); #endif ALLOCATE_GUARD(regs2, 0xCD); iov.iov_base = regs2; iov.iov_len = sizeof(*regs2); test_assert(0 == ptrace(PTRACE_GETREGSET, child, (void*)NT_PRSTATUS, &iov)); test_assert(iov.iov_len == sizeof(*regs2)); test_assert(0 == memcmp(regs, regs2, sizeof(*regs))); VERIFY_GUARD(regs2); test_assert(0 == ptrace(PTRACE_SETREGSET, child, (void*)NT_PRSTATUS, &iov)); ALLOCATE_GUARD(fpregs2, 0xCE); iov.iov_base = fpregs2; iov.iov_len = sizeof(*fpregs2); test_assert(0 == ptrace(PTRACE_GETREGSET, child, (void*)NT_FPREGSET, &iov)); test_assert(iov.iov_len == sizeof(*fpregs2)); test_assert(0 == memcmp(fpregs, fpregs2, sizeof(*fpregs))); VERIFY_GUARD(fpregs2); test_assert(0 == ptrace(PTRACE_SETREGSET, child, (void*)NT_FPREGSET, &iov)); if (xsave_size > 0) { int len; xsave_regs = allocate_guard(xsave_size, 0xCF); iov.iov_base = xsave_regs; iov.iov_len = xsave_size; ret = ptrace(PTRACE_GETREGSET, child, (void*)NT_X86_XSTATE, &iov); test_assert(0 == ret); test_assert(iov.iov_len <= xsave_size); len = iov.iov_len; if (len > 832) { /* Only look at the first 832 bytes since the rest may contain unknown xsave data which may validly contain 0xCF */ len = 832; } clear_reserved_area((uint8_t*)xsave_regs); test_assert(NULL == memchr(xsave_regs, 0xCF, len)); verify_guard(xsave_size, xsave_regs); test_assert(0 == ptrace(PTRACE_SETREGSET, child, (void*)NT_X86_XSTATE, &iov)); } test_assert(static_data == (size_t)ptrace(PTRACE_PEEKDATA, child, &static_data, NULL)); test_assert(0 == ptrace(PTRACE_POKEDATA, child, &static_data, (void*)NEW_VALUE)); test_assert(NEW_VALUE == ptrace(PTRACE_PEEKDATA, child, &static_data, NULL)); /* Test invalid locations */ test_assert(-1 == ptrace(PTRACE_PEEKDATA, child, NULL, NULL)); test_assert(errno == EIO || errno == EFAULT); test_assert(-1 == ptrace(PTRACE_POKEDATA, child, NULL, (void*)NEW_VALUE)); test_assert(errno == EIO || errno == EFAULT); test_assert((long)regs->eflags == ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, regs.eflags), NULL)); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, regs.eflags), 0x246)); test_assert(0 == ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, u_debugreg[0]), NULL)); test_assert(0 == ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, u_debugreg[7]), NULL)); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[0]), (void*)55)); test_assert(55 == ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, u_debugreg[0]), NULL)); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[0]), (void*)0)); test_assert(0 == ptrace(PTRACE_DETACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status)); test_assert(WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_attach_null_status.c000066400000000000000000000007251277367620400213350ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; struct timespec ts = { 0, 50000000 }; if (0 == (child = fork())) { sleep(1000000); return 77; } nanosleep(&ts, NULL); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, NULL, 0)); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_attach_running.c000066400000000000000000000010321277367620400204300ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status; struct timespec ts = { 0, 50000000 }; if (0 == (child = fork())) { while (1) { } return 77; } nanosleep(&ts, NULL); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_attach_sleeping.c000066400000000000000000000010301277367620400205540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status; struct timespec ts = { 0, 50000000 }; if (0 == (child = fork())) { sleep(1000000); return 77; } nanosleep(&ts, NULL); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_attach_stopped.c000066400000000000000000000010411277367620400204260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status; struct timespec ts = { 0, 50000000 }; if (0 == (child = fork())) { kill(getpid(), SIGSTOP); return 77; } nanosleep(&ts, NULL); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_attach_thread_running.c000066400000000000000000000024141277367620400217640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static void* child_thread(__attribute__((unused)) void* p) { char ch; test_assert(1 == read(pipe_fds[0], &ch, 1)); test_assert(ch == 'K'); exit(77); return NULL; } static void* child_thread_running(__attribute__((unused)) void* p) { while (1) { } return NULL; } static void run_child(void) { struct timespec ts = { 0, 1000000000 }; pthread_t t; pthread_create(&t, NULL, child_thread, NULL); /* try to get the kernel to deliver signals sent to our pid to some other thread */ pthread_create(&t, NULL, child_thread_running, NULL); nanosleep(&ts, NULL); } int main(void) { pid_t child; int status; struct timespec ts = { 0, 50000000 }; test_assert(0 == pipe(pipe_fds)); if (0 == (child = fork())) { run_child(); } nanosleep(&ts, NULL); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(1 == write(pipe_fds[1], "K", 1)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_breakpoint.c000066400000000000000000000033241277367620400175700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #if defined(__i386__) #define IP eip #elif defined(__x86_64__) #define IP rip #else #error unknown architecture #endif static void breakpoint(void) {} int main(void) { pid_t child; int status; struct user_regs_struct regs; int pipe_fds[2]; int mem_fd; char buf[1024]; char breakpoint_instruction = 0xcc; char saved_byte; test_assert(0 == pipe(pipe_fds)); if (0 == (child = fork())) { char ch; read(pipe_fds[0], &ch, 1); breakpoint(); return 77; } sprintf(buf, "/proc/%d/mem", child); mem_fd = open(buf, O_RDWR); test_assert(mem_fd >= 0); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(1 == pread(mem_fd, &saved_byte, 1, (off_t)breakpoint)); test_assert(1 == pwrite(mem_fd, &breakpoint_instruction, 1, (off_t)breakpoint)); test_assert(1 == write(pipe_fds[1], "x", 1)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert((char*)regs.IP == (char*)breakpoint + 1); test_assert(1 == pwrite(mem_fd, &saved_byte, 1, (off_t)breakpoint)); --regs.IP; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status)); test_assert(WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_debug_regs.c000066400000000000000000000041771277367620400175470ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NEW_VALUE 0xabcdef static void breakpoint(void) {} static char watch_var; int main(void) { pid_t child; int status; int pipe_fds[2]; test_assert(0 == pipe(pipe_fds)); if (0 == (child = fork())) { char ch; read(pipe_fds[0], &ch, 1); breakpoint(); watch_var = 1; return 77; } test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(1 == write(pipe_fds[1], "x", 1)); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[0]), (void*)breakpoint)); /* Enable DR0 break-on-exec */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0x1)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); test_assert(0x1 == ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, u_debugreg[6]))); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[0]), &watch_var)); /* Enable DR0 break-on-write */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0x10001)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); test_assert(0x1 == ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, u_debugreg[6]))); test_assert(0 == ptrace(PTRACE_DETACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status)); test_assert(WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_exec.c000066400000000000000000000045501277367620400163600ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Test that PTRACE_ATTACH produces a raw SIGTRAP after exiting exec, when PTRACE_O_TRACEEXEC is not used. */ static int proc_num_args(pid_t pid) { char buf[4096]; int fd; int i = 0; int count = 0; sprintf(buf, "/proc/%d/cmdline", pid); fd = open(buf, O_RDONLY); test_assert(fd >= 0); test_assert(0 <= read(fd, buf, sizeof(buf))); while (1) { if (!buf[i]) { break; } ++count; i += strlen(buf + i) + 1; } test_assert(0 == close(fd)); return count; } static int original_syscallno(const struct user_regs_struct* regs) { #if defined(__i386__) return regs->orig_eax; #elif defined(__x86_64__) return regs->orig_rax; #else #error unknown architecture #endif } static int syscall_result(const struct user_regs_struct* regs) { #if defined(__i386__) return regs->eax; #elif defined(__x86_64__) return regs->rax; #else #error unknown architecture #endif } int main(int argc, __attribute__((unused)) char** argv) { pid_t child; int status; struct user_regs_struct regs; test_assert(proc_num_args(getpid()) == argc); if (argc == 2) { return 77; } if (0 == (child = fork())) { char* args[] = { argv[0], "hello", NULL }; kill(getpid(), SIGSTOP); execve(argv[0], args, environ); /* should never reach here */ test_assert(0); return 1; } test_assert(proc_num_args(child) == 1); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); while (1) { test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); if (status == ((SIGTRAP << 8) | 0x7f)) { break; } test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); } test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(SYS_execve == original_syscallno(®s)); test_assert(0 == syscall_result(®s)); /* Check that we have actually transitioned */ test_assert(proc_num_args(child) == 2); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_exec32.c000066400000000000000000000041441277367620400165240ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int original_syscallno(const struct user_regs_struct* regs) { #if defined(__i386__) return regs->orig_eax; #elif defined(__x86_64__) return regs->orig_rax; #else #error unknown architecture #endif } static int syscall_result(const struct user_regs_struct* regs) { #if defined(__i386__) return regs->eax; #elif defined(__x86_64__) return regs->rax; #else #error unknown architecture #endif } int main(int argc, char** argv) { pid_t child; int status; struct user_regs_struct regs; char* name; if (sizeof(void*) == 4) { atomic_puts("EXIT-SUCCESS"); return argc <= 1 ? 0 : atoi(argv[1]); } asprintf(&name, "%s_32", argv[0]); if (access(name, F_OK)) { atomic_printf("%s not found; skipping test\n", name); atomic_puts("EXIT-SUCCESS"); return 0; } if (0 == (child = fork())) { char* args[] = { name, "77", NULL }; kill(getpid(), SIGSTOP); execve(name, args, environ); /* should never reach here */ test_assert(0); return 1; } test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); while (1) { test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); if (status == ((SIGTRAP << 8) | 0x7f)) { break; } test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); } test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* Without rr, the old syscall number persists in orig_eax. Under rr, we update the syscall number to be correct for the new architecture to simplify rr's workings. */ test_assert(SYS_execve == original_syscallno(®s) || 11 == original_syscallno(®s)); test_assert(0 == syscall_result(®s)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); return 0; } rr-4.4.0/src/test/ptrace_remote_unmap.c000066400000000000000000000101621277367620400201230ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #define RR_PAGE_ADDR 0x70000000 static char* trim_leading_blanks(char* str) { char* trimmed = str; while (isblank(*trimmed)) { ++trimmed; } return trimmed; } long checked_ptrace(enum __ptrace_request request, pid_t pid, void* addr, void* data) { long ret = ptrace(request, pid, addr, data); assert(ret != -1); return ret; } extern char syscall_addr; static __attribute__((noinline, used)) void my_syscall(void) { #if defined(__i386) __asm__ __volatile__("syscall_addr: int $0x80\n\t"); #elif defined(__x86_64__) __asm__ __volatile__("syscall_addr: syscall\n\t"); #endif } void munmap_remote(pid_t child, uintptr_t start, size_t size) { struct user_regs_struct regs; struct iovec iov; int status; pid_t wret; iov.iov_base = ®s; iov.iov_len = sizeof(regs); checked_ptrace(PTRACE_GETREGSET, child, (void*)NT_PRSTATUS, &iov); #ifdef __i386 regs.eip = (uintptr_t)&syscall_addr; regs.eax = __NR_munmap; regs.ebx = start; regs.ecx = size; #else regs.rip = (uintptr_t)&syscall_addr; regs.rax = __NR_munmap; regs.rdi = start; regs.rsi = size; regs.rdx = 0; regs.r10 = 0; regs.r8 = 0; regs.r9 = 0; #endif checked_ptrace(PTRACE_SETREGSET, child, (void*)NT_PRSTATUS, &iov); // Execute the syscall checked_ptrace(PTRACE_SYSCALL, child, 0, 0); // Wait until entry trap wret = waitpid(child, &status, __WALL | WSTOPPED); assert(wret = child); assert(WSTOPSIG(status) == (SIGTRAP | 0x80)); checked_ptrace(PTRACE_SYSCALL, child, 0, 0); // Wait until exit trap wret = waitpid(child, &status, __WALL | WSTOPPED); assert(wret = child); assert(WSTOPSIG(status) == (SIGTRAP | 0x80)); // Verify that the syscall didn't fail checked_ptrace(PTRACE_GETREGSET, child, (void*)NT_PRSTATUS, &iov); #ifdef __i386 assert(regs.eax != -1); #else assert(regs.rax != (uintptr_t)-1); #endif } static __attribute__((noinline)) void breakpoint(void) { int break_here = 1; (void)break_here; } int main(void) { pid_t child; if (0 == (child = fork())) { raise(SIGSTOP); char* args[] = { "/proc/self/exe", NULL }; execve("/proc/self/exe", args, environ); } // Wait until stopped int status; pid_t wret = waitpid(child, &status, __WALL | WSTOPPED); assert(wret == child); assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); // Now PTRACE_SEIZE the child checked_ptrace(PTRACE_SEIZE, child, NULL, (void*)(PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEEXEC)); // That caused another stop wret = waitpid(child, &status, __WALL | WSTOPPED); assert(wret = child); // Continue until the exec checked_ptrace(PTRACE_CONT, child, 0, 0); // This should be the exec stop wret = waitpid(child, &status, __WALL | WSTOPPED); assert(wret = child); assert(status >> 8 == (SIGTRAP | (PTRACE_EVENT_EXEC << 8))); // Ok, now start unmapping the remote mappings char path[200]; snprintf(path, 200, "/proc/%d/maps", child); FILE* maps_file = fopen(path, "r"); while (!feof(maps_file)) { char line[PATH_MAX * 2]; if (!fgets(line, sizeof(line), maps_file)) { break; } uint64_t start, end, offset, inode; int dev_major, dev_minor; char flags[32]; int chars_scanned; int nparsed = sscanf(line, "%" SCNx64 "-%" SCNx64 " %31s %" SCNx64 " %x:%x %" SCNu64 " %n", &start, &end, flags, &offset, &dev_major, &dev_minor, &inode, &chars_scanned); assert(8 /*number of info fields*/ == nparsed || 7 /*num fields if name is blank*/ == nparsed); // trim trailing newline, if any int last_char = strlen(line) - 1; if (line[last_char] == '\n') { line[last_char] = 0; } char* name = trim_leading_blanks(line + chars_scanned); if ((start <= (uintptr_t)&syscall_addr && (uintptr_t)&syscall_addr < end) || start == RR_PAGE_ADDR || strcmp(name, "[vsyscall]") == 0) continue; munmap_remote(child, start, end - start); } breakpoint(); atomic_printf("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_remote_unmap.py000066400000000000000000000004031277367620400203260ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('restart 1') expect_gdb('stopped') send_gdb('rc') expect_gdb('stopped') ok() rr-4.4.0/src/test/ptrace_remote_unmap.run000066400000000000000000000001311277367620400205000ustar00rootroot00000000000000source `dirname $0`/util.sh record ptrace_remote_unmap$bitness debug ptrace_remote_unmap rr-4.4.0/src/test/ptrace_seize.c000066400000000000000000000024071277367620400165520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #ifndef PTRACE_EVENT_STOP #define PTRACE_EVENT_STOP 128 #endif static int parent_to_child_fds[2]; static int child_to_parent_fds[2]; int main(void) { pid_t child; char ch; int status; test_assert(0 == pipe(parent_to_child_fds)); test_assert(0 == pipe(child_to_parent_fds)); if (0 == (child = fork())) { test_assert(1 == read(parent_to_child_fds[0], &ch, 1)); test_assert(1 == write(child_to_parent_fds[1], "x", 1)); sleep(10000); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, (void*)PTRACE_O_TRACESYSGOOD)); /* Make sure child is still running */ test_assert(1 == write(parent_to_child_fds[1], "p", 1)); test_assert(1 == read(child_to_parent_fds[0], &ch, 1)); /* Stop it */ test_assert(0 == kill(child, SIGSTOP)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)SIGSTOP)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((PTRACE_EVENT_STOP << 16) | (SIGSTOP << 8) | 0x7f)); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_sigchld_blocked.c000066400000000000000000000015351277367620400205340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int parent_to_child_fds[2]; int main(void) { pid_t child; char ch; int status; sigset_t sigs; test_assert(0 == pipe(parent_to_child_fds)); if (0 == (child = fork())) { test_assert(1 == read(parent_to_child_fds[0], &ch, 1)); kill(getpid(), SIGSEGV); return 77; } /* Try to block all signals. See if we can still get woken up. */ sigfillset(&sigs); test_assert(0 == sigprocmask(SIG_SETMASK, &sigs, NULL)); test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, NULL)); test_assert(1 == write(parent_to_child_fds[1], "p", 1)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSEGV << 8) | 0x7f)); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_signals.c000066400000000000000000000034021277367620400170670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char* p; static void sighandler(__attribute__((unused)) int sig) { p[1] = 78; signal(SIGSEGV, SIG_DFL); } int main(void) { pid_t child; int status; int pipe_fds[2]; p = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0); test_assert(MAP_FAILED != p); p[0] = 0; p[1] = 0; test_assert(0 == pipe(pipe_fds)); if (0 == (child = fork())) { char ch; read(pipe_fds[0], &ch, 1); signal(SIGSEGV, sighandler); p[0] = 77; /* trigger SIGSEGV */ crash_null_deref(); return 77; } test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(1 == write(pipe_fds[1], "x", 1)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSEGV << 8) | 0x7f)); /* Check that the child actually executed forwards to the SIGSEGV */ test_assert(p[0] == 77); test_assert(p[1] == 0); /* Progress to second (fatal) SIGSEGV */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)SIGSEGV)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSEGV << 8) | 0x7f)); test_assert(p[0] == 77); /* Check that code actually ran */ test_assert(p[1] == 78); /* Continue with the signal again. This should be fatal. */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)SIGSEGV)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSIGNALED(status)); test_assert(WTERMSIG(status) == SIGSEGV); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_syscall.c000066400000000000000000000062151277367620400171060ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #if defined(__i386__) #define ORIG_SYSCALLNO orig_eax #elif defined(__x86_64__) #define ORIG_SYSCALLNO orig_rax #else #error unknown architecture #endif #if defined(__i386__) #define SYSCALL_RESULT eax #elif defined(__x86_64__) #define SYSCALL_RESULT rax #else #error unknown architecture #endif #if defined(__i386__) #define IP eip #elif defined(__x86_64__) #define IP rip #else #error unknown architecture #endif #ifdef SYS_geteuid32 #define SYSCALLNO SYS_geteuid32 #else #define SYSCALLNO SYS_geteuid #endif extern char syscall_addr; /* Make a syscallbuf-patchable syscall to check that syscallbuf patching doesn't happen when we are emulating a ptracer --- which can be potentially confused by it. */ static uid_t my_geteuid(void) { int r; #ifdef __i386__ __asm__ __volatile__("syscall_addr: int $0x80\n\t" "nop\n\t" "nop\n\t" "nop\n\t" : "=a"(r) : "a"(SYS_geteuid32)); #elif defined(__x86_64__) __asm__ __volatile__("syscall_addr: syscall\n\t" "nop\n\t" "nop\n\t" "nop\n\t" : "=a"(r) : "a"(SYS_geteuid)); #endif return r; } int main(void) { pid_t child; int status; struct user_regs_struct regs; uid_t uid = geteuid(); if (0 == (child = fork())) { uid_t ret; kill(getpid(), SIGSTOP); /* the ptracer changes this to a gettid, and then fakes the result */ ret = my_geteuid(); test_assert(ret == uid + 1); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, (void*)PTRACE_O_TRACESYSGOOD)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); test_assert(0 == ptrace(PTRACE_SYSCALL, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == (((0x80 | SIGTRAP) << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* This assert will fail if we patched the syscall for syscallbuf. */ test_assert(&syscall_addr + 2 == (char*)regs.IP); test_assert(SYSCALLNO == regs.ORIG_SYSCALLNO); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); regs.ORIG_SYSCALLNO = SYS_gettid; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); test_assert(0 == ptrace(PTRACE_SYSCALL, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == (((0x80 | SIGTRAP) << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(SYS_gettid == regs.ORIG_SYSCALLNO); test_assert(child == (int)regs.SYSCALL_RESULT); test_assert(&syscall_addr + 2 == (char*)regs.IP); regs.SYSCALL_RESULT = uid + 1; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_syscall_clone_untraced.c000066400000000000000000000043731277367620400221560ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #if defined(__i386__) #define ORIG_SYSCALLNO orig_eax #elif defined(__x86_64__) #define ORIG_SYSCALLNO orig_rax #else #error unknown architecture #endif #if defined(__i386__) #define SYSCALL_RESULT eax #elif defined(__x86_64__) #define SYSCALL_RESULT rax #else #error unknown architecture #endif #if defined(__i386__) #define SYSCALL_ARG1 ebx #elif defined(__x86_64__) #define SYSCALL_ARG1 rdi #else #error unknown architecture #endif #if defined(__i386__) #define IP eip #elif defined(__x86_64__) #define IP rip #else #error unknown architecture #endif static void* do_thread(__attribute__((unused)) void* p) { return NULL; } int main(void) { pid_t child; int status; struct user_regs_struct regs; struct user_regs_struct regs2; if (0 == (child = fork())) { pthread_t thread; kill(getpid(), SIGSTOP); pthread_create(&thread, NULL, do_thread, NULL); pthread_join(thread, NULL); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, (void*)(PTRACE_O_TRACECLONE | PTRACE_O_TRACESYSGOOD))); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); do { test_assert(0 == ptrace(PTRACE_SYSCALL, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == (((0x80 | SIGTRAP) << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); } while (SYS_clone != regs.ORIG_SYSCALLNO); // Make sure CLONE_UNTRACED is honored. regs.SYSCALL_ARG1 |= CLONE_UNTRACED; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); test_assert(0 == ptrace(PTRACE_SYSCALL, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == (((0x80 | SIGTRAP) << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s2)); test_assert(SYS_clone == regs2.ORIG_SYSCALLNO); test_assert(regs.IP == regs2.IP); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_sysemu.c000066400000000000000000000241111277367620400167540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* This tests PTRACE_SYSEMU, PTRACE_SINGLESTEP and PTRACE_SYSEMU_SINGLESTEP */ #ifndef PTRACE_SYSEMU #define PTRACE_SYSEMU 31 #endif #ifndef PTRACE_SYSEMU_SINGLESTEP #define PTRACE_SYSEMU_SINGLESTEP 32 #endif #define DS_SINGLESTEP (1 << 14) #if defined(__i386__) #define ORIG_SYSCALLNO orig_eax #elif defined(__x86_64__) #define ORIG_SYSCALLNO orig_rax #else #error unknown architecture #endif #if defined(__i386__) #define SYSCALL_RESULT eax #elif defined(__x86_64__) #define SYSCALL_RESULT rax #else #error unknown architecture #endif #if defined(__i386__) #define IP eip #elif defined(__x86_64__) #define IP rip #else #error unknown architecture #endif #ifdef SYS_geteuid32 #define SYSCALLNO SYS_geteuid32 #else #define SYSCALLNO SYS_geteuid #endif extern char syscall_addr; /* Make a syscallbuf-patchable syscall to check that syscallbuf patching doesn't happen when we are emulating a ptracer --- which can be potentially confused by it. */ static uid_t __attribute__((noinline)) my_geteuid(void) { int r; #ifdef __i386__ __asm__ __volatile__("syscall_addr: int $0x80\n\t" "nop\n\t" "nop\n\t" "nop\n\t" : "=a"(r) : "a"(SYS_geteuid32)); #elif defined(__x86_64__) __asm__ __volatile__("syscall_addr: syscall\n\t" "nop\n\t" "nop\n\t" "nop\n\t" : "=a"(r) : "a"(SYS_geteuid)); #endif return r; } static void wait_for_syscall_enter(pid_t child) { int status; siginfo_t si; test_assert(child == waitpid(child, &status, 0)); test_assert(status == (((0x80 | SIGTRAP) << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETSIGINFO, child, NULL, &si)); test_assert(SIGTRAP == si.si_signo); } static void wait_for_singlestep(pid_t child) { int status; siginfo_t si; test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETSIGINFO, child, NULL, &si)); test_assert(SIGTRAP == si.si_signo); } static void check_dr6(pid_t child) { uintptr_t dr6; errno = 0; dr6 = ptrace(PTRACE_PEEKUSER, child, (void*)offsetof(struct user, u_debugreg[6]), (void*)0); test_assert(!errno); test_assert(dr6 & DS_SINGLESTEP); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[6]), (void*)0)); } int main(int argc, char** argv) { pid_t child; int status; struct user_regs_struct regs; uid_t uid = geteuid(); int strict = !(argc == 2 && !strcmp(argv[1], "relaxed")); if (0 == (child = fork())) { uid_t ret; kill(getpid(), SIGSTOP); /* This will be skipped by the ptracer */ syscall(SYS_exit, 6); ret = my_geteuid(); test_assert(ret == uid); ret = my_geteuid(); test_assert(ret == uid); ret = my_geteuid(); test_assert(ret == uid); ret = my_geteuid(); test_assert(ret == uid); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, (void*)PTRACE_O_TRACESYSGOOD)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); /* Test PTRACE_SYSEMU running into syscall */ test_assert(0 == ptrace(PTRACE_SYSEMU, child, NULL, (void*)0)); wait_for_syscall_enter(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(SYS_exit == regs.ORIG_SYSCALLNO); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* Test PTRACE_SINGLESTEP stepping out of a syscall. We make sure it doesn't run. If the syscall runs then the child will exit prematurely. */ test_assert(0 == ptrace(PTRACE_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* Test PTRACE_SYSEMU running into syscall */ test_assert(0 == ptrace(PTRACE_SYSEMU, child, NULL, (void*)0)); wait_for_syscall_enter(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* This assert will fail if we patched the syscall for syscallbuf. */ test_assert(&syscall_addr + 2 == (char*)regs.IP); test_assert(SYSCALLNO == regs.ORIG_SYSCALLNO); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* Test PTRACE_SINGLESTEP stepping out of a syscall */ test_assert(0 == ptrace(PTRACE_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); test_assert(&syscall_addr + 2 == (char*)regs.IP); regs.SYSCALL_RESULT = uid; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); /* Test PTRACE_SINGLESTEP stepping normally */ test_assert(0 == ptrace(PTRACE_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); check_dr6(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(&syscall_addr + 3 == (char*)regs.IP); /* Test PTRACE_SYSEMU_SINGLESTEP stepping normally */ test_assert(0 == ptrace(PTRACE_SYSEMU_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); check_dr6(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(&syscall_addr + 4 == (char*)regs.IP); /* Set a HW breakpoint at |syscall_addr| */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[0]), &syscall_addr)); test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0x1)); /* Run to it */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); /* Disable breakpoint */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0)); /* Test PTRACE_SYSEMU_SINGLESTEP stepping into syscall */ test_assert(0 == ptrace(PTRACE_SYSEMU_SINGLESTEP, child, NULL, (void*)0)); wait_for_syscall_enter(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* This assert will fail if we patched the syscall for syscallbuf. */ test_assert(&syscall_addr + 2 == (char*)regs.IP); test_assert(SYSCALLNO == regs.ORIG_SYSCALLNO); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* Test PTRACE_SYSEMU_SINGLESTEP stepping out of a syscall */ test_assert(0 == ptrace(PTRACE_SYSEMU_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* check that syscall did not run */ test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* PTRACE_SYSEMU_SINGLESTEP does an extra instruction when stepping out of a syscall. Dunno why. */ test_assert(&syscall_addr + 2 == (char*)regs.IP || (!strict && &syscall_addr + 3 == (char*)regs.IP)); regs.SYSCALL_RESULT = uid; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); /* Reenable breakpoint */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0x1)); /* Run to it */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); /* Disable breakpoint */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0)); /* Test PTRACE_SYSCALL entering syscall */ test_assert(0 == ptrace(PTRACE_SYSCALL, child, NULL, (void*)0)); wait_for_syscall_enter(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(&syscall_addr + 2 == (char*)regs.IP); test_assert(SYSCALLNO == regs.ORIG_SYSCALLNO); test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* force syscall to be invalid/skipped */ regs.ORIG_SYSCALLNO = -1; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); /* Test PTRACE_SYSEMU_SINGLESTEP stepping out of a syscall */ test_assert(0 == ptrace(PTRACE_SYSEMU_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* check that syscall did not run */ test_assert(-ENOSYS == (int)regs.SYSCALL_RESULT); /* PTRACE_SYSEMU_SINGLESTEP does an extra instruction when stepping out of a syscall. Dunno why. */ test_assert(&syscall_addr + 2 == (char*)regs.IP || (!strict && &syscall_addr + 3 == (char*)regs.IP)); regs.SYSCALL_RESULT = uid; test_assert(0 == ptrace(PTRACE_SETREGS, child, NULL, ®s)); /* Reenable breakpoint */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0x1)); /* Run to it */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGTRAP << 8) | 0x7f)); /* Disable breakpoint */ test_assert(0 == ptrace(PTRACE_POKEUSER, child, (void*)offsetof(struct user, u_debugreg[7]), (void*)0)); /* Test PTRACE_SINGLESTEP stepping over syscall */ test_assert(0 == ptrace(PTRACE_SINGLESTEP, child, NULL, (void*)0)); wait_for_singlestep(child); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); /* This assert will fail if we patched the syscall for syscallbuf. */ test_assert(&syscall_addr + 2 == (char*)regs.IP); test_assert(SYSCALLNO == regs.ORIG_SYSCALLNO); test_assert((uid_t)regs.SYSCALL_RESULT == uid); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_trace_clone.c000066400000000000000000000071101277367620400177050ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #ifndef PTRACE_EVENT_STOP #define PTRACE_EVENT_STOP 128 #endif static int parent_to_child_fds[2]; static void* do_thread(__attribute__((unused)) void* p) { return NULL; } int main(void) { pid_t child; char ch; int status; unsigned long cloned_pid; struct user_regs_struct regs; test_assert(0 == pipe(parent_to_child_fds)); if (0 == (child = fork())) { pid_t grandchild; pthread_t thread; test_assert(1 == read(parent_to_child_fds[0], &ch, 1)); grandchild = fork(); if (!grandchild) { return 66; } test_assert(grandchild = waitpid(grandchild, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 66); pthread_create(&thread, NULL, do_thread, NULL); pthread_join(thread, NULL); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, (void*)(PTRACE_O_TRACEFORK | PTRACE_O_TRACECLONE | PTRACE_O_TRACESYSGOOD))); test_assert(1 == write(parent_to_child_fds[1], "p", 1)); test_assert(child == waitpid(child, &status, 0)); /* Test that PTRACE_EVENT_FORK is generated and that we are tracing the grandchild. */ test_assert(status == ((PTRACE_EVENT_FORK << 16) | (SIGTRAP << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETEVENTMSG, child, NULL, &cloned_pid)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert((pid_t)cloned_pid == waitpid(cloned_pid, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP); test_assert((status >> 16) == PTRACE_EVENT_STOP); test_assert(0 == ptrace(PTRACE_GETREGS, cloned_pid, NULL, ®s)); /* Test that we observe the exit of the grandchild. We need to wait() on the grandchild or our child won't ever see the exit. */ test_assert(0 == ptrace(PTRACE_CONT, cloned_pid, NULL, (void*)0)); test_assert((pid_t)cloned_pid == waitpid(cloned_pid, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 66); /* Test that the child observes a SIGCHLD from the grandchild's exit. */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGCHLD); /* Test that PTRACE_EVENT_CLONE is generated and we are tracing the grandchild. */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((PTRACE_EVENT_CLONE << 16) | (SIGTRAP << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(0 == ptrace(PTRACE_GETEVENTMSG, child, NULL, &cloned_pid)); test_assert((pid_t)cloned_pid == waitpid(cloned_pid, &status, __WCLONE)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP); test_assert((status >> 16) == PTRACE_EVENT_STOP); test_assert(0 == ptrace(PTRACE_GETREGS, cloned_pid, NULL, ®s)); /* Test that we observe the exit of the grandchild. We need to wait() on the grandchild or our child won't ever see the exit. */ test_assert(0 == ptrace(PTRACE_CONT, cloned_pid, NULL, (void*)0)); test_assert((pid_t)cloned_pid == waitpid(cloned_pid, &status, __WCLONE)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 0); /* Test that we observe the exit of the child. */ test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptrace_trace_exit.c000066400000000000000000000017511277367620400175630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int parent_to_child_fds[2]; int main(void) { pid_t child; char ch; int status; struct user_regs_struct regs; test_assert(0 == pipe(parent_to_child_fds)); if (0 == (child = fork())) { test_assert(1 == read(parent_to_child_fds[0], &ch, 1)); return 77; } test_assert(0 == ptrace(PTRACE_SEIZE, child, NULL, (void*)(PTRACE_O_TRACEEXIT | PTRACE_O_TRACESYSGOOD))); test_assert(1 == write(parent_to_child_fds[1], "p", 1)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((PTRACE_EVENT_EXIT << 16) | (SIGTRAP << 8) | 0x7f)); test_assert(0 == ptrace(PTRACE_GETREGS, child, NULL, ®s)); test_assert(0 == ptrace(PTRACE_CONT, child, NULL, (void*)0)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptracer_death.c000066400000000000000000000023511277367620400167000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int status_pipe[2]; static int ptracer(void) { pid_t child; int status; struct timespec ts = { 0, 50000000 }; int ready_pipe[2]; char ready = 'R'; test_assert(0 == pipe(ready_pipe)); if (0 == (child = fork())) { char ch = 0; char ok = 'K'; test_assert(1 == read(ready_pipe[0], &ch, 1)); test_assert(ch == 'R'); test_assert(1 == write(status_pipe[1], &ok, 1)); return 77; } nanosleep(&ts, NULL); test_assert(0 == ptrace(PTRACE_ATTACH, child, NULL, NULL)); test_assert(child == waitpid(child, &status, 0)); test_assert(status == ((SIGSTOP << 8) | 0x7f)); test_assert(1 == write(ready_pipe[1], &ready, 1)); /* Now just exit, and the child should resume */ return 44; } int main(void) { char ch = 0; pid_t ptracer_pid; int status; test_assert(0 == pipe(status_pipe)); if (0 == (ptracer_pid = fork())) { return ptracer(); } test_assert(ptracer_pid == waitpid(ptracer_pid, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 44); test_assert(1 == read(status_pipe[0], &ch, 1)); test_assert(ch == 'K'); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptracer_death_multithread.c000066400000000000000000000053101277367620400213000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* This test spawns a ptracer and a ptracee, where the ptracee has 10 sub-threads. The pracer attaches to all the ptracee's threads, then exits. We check that all ptracee threads are resumed. */ static int status_pipe[2]; static int tid_pipe[2]; static int ready_pipe[2]; static int thread_wait_pipe[2]; static void write_tid(void) { pid_t tid = sys_gettid(); test_assert(sizeof(tid) == write(tid_pipe[1], &tid, sizeof(tid))); } static pid_t read_tid(void) { pid_t tid; test_assert(sizeof(tid) == read(tid_pipe[0], &tid, sizeof(tid))); return tid; } static void* child_thread(__attribute__((unused)) void* p) { char ch = 0; write_tid(); test_assert(1 == read(thread_wait_pipe[0], &ch, 1)); test_assert('W' == ch); return NULL; } static int child_runner(void) { char ch = 0; pthread_t threads[10]; int i; write_tid(); for (i = 0; i < 10; ++i) { pthread_create(&threads[i], NULL, child_thread, NULL); } atomic_printf("Waiting on ready_pipe\n"); test_assert(1 == read(ready_pipe[0], &ch, 1)); test_assert(ch == 'R'); for (i = 0; i < 10; ++i) { char ch2 = 'W'; test_assert(1 == write(thread_wait_pipe[1], &ch2, 1)); } for (i = 0; i < 10; ++i) { atomic_printf("Joining thread %d\n", i); pthread_join(threads[i], NULL); } char ok = 'K'; test_assert(1 == write(status_pipe[1], &ok, 1)); return 77; } static int ptracer(void) { pid_t child; int status; char ready = 'R'; int i; pid_t child_tids[11]; if (0 == (child = fork())) { return child_runner(); } for (i = 0; i < 11; ++i) { child_tids[i] = read_tid(); } for (i = 0; i < 11; ++i) { int ret; test_assert(0 == ptrace(PTRACE_ATTACH, child_tids[i], NULL, NULL)); ret = waitpid(child_tids[i], &status, __WALL); atomic_printf("waitpid on %d gives %d with errno=%d\n", child_tids[i], ret, errno); test_assert(ret == child_tids[i]); test_assert(status == ((SIGSTOP << 8) | 0x7f)); } test_assert(1 == write(ready_pipe[1], &ready, 1)); /* Now just exit, and all child threads should resume */ return 44; } int main(void) { char ch = 0; pid_t ptracer_pid; int status; test_assert(0 == pipe(ready_pipe)); test_assert(0 == pipe(tid_pipe)); test_assert(0 == pipe(status_pipe)); test_assert(0 == pipe(thread_wait_pipe)); if (0 == (ptracer_pid = fork())) { return ptracer(); } test_assert(ptracer_pid == waitpid(ptracer_pid, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 44); test_assert(1 == read(status_pipe[0], &ch, 1)); test_assert(ch == 'K'); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ptracer_death_multithread_peer.c000066400000000000000000000056131277367620400223210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* This test spawns a ptracer and a ptracee, where the ptracee has 10 sub-threads. The pracer attaches to all the ptracee's threads, then exits. We check that all ptracee threads are resumed. Similar to ptracer_detah_multithread, except the ptracer is not a parent of the ptracee. */ static int status_pipe[2]; static int tid_pipe[2]; static int ready_pipe[2]; static int thread_wait_pipe[2]; static void write_tid(void) { pid_t tid = sys_gettid(); test_assert(sizeof(tid) == write(tid_pipe[1], &tid, sizeof(tid))); } static pid_t read_tid(void) { pid_t tid; test_assert(sizeof(tid) == read(tid_pipe[0], &tid, sizeof(tid))); return tid; } static void* child_thread(__attribute__((unused)) void* p) { char ch = 0; write_tid(); test_assert(1 == read(thread_wait_pipe[0], &ch, 1)); test_assert('W' == ch); return NULL; } static int child_runner(void) { char ch = 0; pthread_t threads[10]; int i; /* This fails on some kernels, so don't check its result */ prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY); write_tid(); for (i = 0; i < 10; ++i) { pthread_create(&threads[i], NULL, child_thread, NULL); } atomic_printf("Waiting on ready_pipe\n"); test_assert(1 == read(ready_pipe[0], &ch, 1)); test_assert(ch == 'R'); for (i = 0; i < 10; ++i) { char ch2 = 'W'; test_assert(1 == write(thread_wait_pipe[1], &ch2, 1)); } for (i = 0; i < 10; ++i) { atomic_printf("Joining thread %d\n", i); pthread_join(threads[i], NULL); } char ok = 'K'; test_assert(1 == write(status_pipe[1], &ok, 1)); return 77; } static int ptracer(void) { int status; char ready = 'R'; int i; pid_t child_tids[11]; for (i = 0; i < 11; ++i) { child_tids[i] = read_tid(); } for (i = 0; i < 11; ++i) { int ret; test_assert(0 == ptrace(PTRACE_ATTACH, child_tids[i], NULL, NULL)); ret = waitpid(child_tids[i], &status, __WALL); atomic_printf("waitpid on %d gives %d with errno=%d\n", child_tids[i], ret, errno); test_assert(ret == child_tids[i]); test_assert(status == ((SIGSTOP << 8) | 0x7f)); } test_assert(1 == write(ready_pipe[1], &ready, 1)); /* Now just exit, and all child threads should resume */ return 44; } int main(void) { char ch = 0; pid_t ptracer_pid, child; int status; test_assert(0 == pipe(ready_pipe)); test_assert(0 == pipe(tid_pipe)); test_assert(0 == pipe(status_pipe)); test_assert(0 == pipe(thread_wait_pipe)); if (0 == (child = fork())) { return child_runner(); } if (0 == (ptracer_pid = fork())) { return ptracer(); } test_assert(ptracer_pid == waitpid(ptracer_pid, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 44); test_assert(1 == read(status_pipe[0], &ch, 1)); test_assert(ch == 'K'); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/quotactl.c000066400000000000000000000053231277367620400157310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char home_device[1001]; static void find_home_device(void) { struct stat home_stat; const char* home = getenv("HOME"); FILE* f; char mount_line[2000]; if (!home || stat(home, &home_stat)) { atomic_printf("Can't stat %s; aborting test\n", home); atomic_puts("EXIT-SUCCESS"); exit(0); } f = fopen("/proc/self/mountinfo", "rt"); test_assert(f != NULL); while (fgets(mount_line, sizeof(mount_line), f)) { int maj, min; int ret; ret = sscanf(mount_line, "%*d %*d %d:%d %*s %*s %*s %*s - %*s %1000s %*s", &maj, &min, home_device); // optional field (7) missing? if (ret != 3) { sscanf(mount_line, "%*d %*d %d:%d %*s %*s %*s - %*s %1000s %*s", &maj, &min, home_device); } if (maj == (int)major(home_stat.st_dev) && min == (int)minor(home_stat.st_dev) && maj != 0) { atomic_printf("%s (%d:%d) is on device special file %s\n", home, maj, min, home_device); return; } } atomic_printf("Can't find filesystem containing %s (%d:%d); aborting test\n", home, major(home_stat.st_dev), minor(home_stat.st_dev)); atomic_puts("EXIT-SUCCESS"); exit(0); } int main(void) { struct dqblk dq; int ret; /* ENOTBLK returned before checking cmd */ ret = quotactl(0x12345678, "/", getuid(), (caddr_t)&dq); test_assert(ret < 0 && errno == ENOTBLK); /* ENOENT returned before checking cmd */ ret = quotactl(0x12345678, "/asdfjlafdlkk289892389pkj", getuid(), (caddr_t)&dq); test_assert(ret < 0 && errno == ENOENT); /* ENODEV returned before checking cmd when the device is a Btrfs volume */ ret = quotactl(0x12345678, "/dev/dm-0", getuid(), (caddr_t)&dq); test_assert(ret < 0 && (errno == ENOTBLK || errno == ENOENT || errno == ENODEV || errno == EINVAL)); find_home_device(); ret = quotactl(QCMD(Q_GETQUOTA, USRQUOTA), home_device, getuid(), (caddr_t)&dq); if (ret < 0 && errno == ENOSYS) { atomic_puts("Quotas not supported in this kernel; aborting test"); } else if (ret < 0 && errno == ESRCH) { atomic_puts("Quotas not enabled on this file system; aborting test"); } else if (ret < 0 && errno == ENOTBLK) { atomic_puts("Home directory device is not a block device; aborting test"); } else if (ret < 0 && errno == ENOENT) { /* On Ubuntu 16.06, at least, I'm getting a `/dev/root` which doesn't * actually exist :-( */ atomic_puts("Home directory device not found; aborting test"); } else { test_assert(0 == ret); atomic_printf("QIF bits=%x\n", dq.dqb_valid); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/rdtsc.c000066400000000000000000000010431277367620400152070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(void) { int i; uint64_t last_tsc = 0; for (i = 0; i < 100; ++i) { uint64_t tsc; breakpoint(); /* NO SYSCALLS BETWEEN HERE AND RDTSC: next event for * replay must be rdtsc */ tsc = rdtsc(); test_assert(last_tsc < tsc); atomic_printf("%" PRIu64 ",", tsc); last_tsc = tsc; } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/read_bad_mem.py000066400000000000000000000004241277367620400166570ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, main') send_gdb('p *0xf') expect_gdb('Cannot access memory at address 0xf') send_gdb('p *0xffffffff') expect_gdb('Cannot access memory at address 0xffffffff') ok() rr-4.4.0/src/test/read_bad_mem.run000066400000000000000000000001051277367620400170270ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug read_bad_mem rr-4.4.0/src/test/read_big_struct.c000066400000000000000000000007261277367620400172370ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } /* FIXME: we should be able to send arbitrarily large structs over the * debugging socket. This is a temporary hack. */ struct big { char bytes[8192]; }; int main(void) { struct big big; memset(&big, 0x5a, sizeof(big)); breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/read_big_struct.py000066400000000000000000000003271277367620400174420ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') send_gdb('f 1') expect_gdb('(rr)') send_gdb('p big') expect_gdb("bytes = 'Z'") ok() rr-4.4.0/src/test/read_big_struct.run000066400000000000000000000000471277367620400176150ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/read_large.c000066400000000000000000000027721277367620400161670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_SIZE 65536 #define EXTRA 10 static const char file_name[] = "tmp.bin"; /** * For benchmarking purposes you can run this with "write" parameter to * just generate a (much larger) file and "read" parameter to read it. The * normal test uses a much smaller file size. */ int main(int argc, char** argv) { char buf[BUF_SIZE]; char buf2[BUF_SIZE]; int i; int fd; int buf_count = argc < 2 ? 500 : 20000; memset(buf, 1, sizeof(buf)); if (argc < 2 || !strcmp(argv[1], "write")) { fd = open(file_name, O_WRONLY | O_CREAT | O_EXCL, 0600); test_assert(fd >= 0); for (i = 0; i < buf_count; ++i) { test_assert(write(fd, buf, BUF_SIZE) == BUF_SIZE); } test_assert(write(fd, buf, EXTRA) == EXTRA); } if (argc < 2 || !strcmp(argv[1], "read")) { fd = open(file_name, O_RDONLY); test_assert(fd >= 0); for (i = 0; i < buf_count; ++i) { test_assert(read(fd, buf2, sizeof(buf2)) == sizeof(buf2)); test_assert(!memcmp(buf, buf2, sizeof(buf))); } test_assert(read(fd, buf2, sizeof(buf2)) == EXTRA); test_assert(read(fd, buf2, sizeof(buf2)) == 0); } if (argc < 2) { fd = open(file_name, O_WRONLY); test_assert(fd >= 0); memset(buf, 2, sizeof(buf)); test_assert(write(fd, buf, sizeof(buf)) == sizeof(buf)); test_assert(0 == close(fd)); test_assert(0 == unlink(file_name)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/read_nothing.c000066400000000000000000000010261277367620400165320ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define SIZE 100000000 int main(void) { int pipe_fds[2]; int i; char* buf = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(buf != MAP_FAILED); test_assert(0 == pipe2(pipe_fds, O_NONBLOCK)); for (i = 0; i < 10000; ++i) { test_assert(-1 == read(pipe_fds[0], buf, SIZE)); test_assert(errno == EAGAIN); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/read_oversize.c000066400000000000000000000011231277367620400167300ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = open("tmp", O_CREAT | O_RDWR, 0700); char buf[100]; int ret; test_assert(fd >= 0); memset(buf, 1, sizeof(buf)); test_assert(sizeof(buf) == write(fd, buf, sizeof(buf))); test_assert(0 == lseek(fd, 0, SEEK_SET)); ret = read(fd, buf, UINTPTR_MAX - 0xfff); if (ret < 0) { /* x86-64 returns EFAULT here. I'm not sure why. */ test_assert(EFAULT == errno); } else { test_assert(100 == ret); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/readdir.c000066400000000000000000000007331277367620400155070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { DIR* dir = opendir("."); struct dirent* ent; test_assert(dir != NULL); while ((ent = readdir(dir)) != NULL) { test_assert(ent->d_reclen >= 8); atomic_printf("%s %lld %lld\n", ent->d_name, (long long)ent->d_ino, (long long)ent->d_off); } test_assert(0 == closedir(dir)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/readlink.c000066400000000000000000000017271277367620400156720ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_SIZE 10 #define BUF2_SIZE 1000 int main(void) { char path[] = "rr-test-file-XXXXXX"; int fd = mkstemp(path); int count; char link[PATH_MAX]; char* buf = allocate_guard(BUF_SIZE, 'q'); char* buf2 = allocate_guard(BUF2_SIZE, 'r'); test_assert(0 <= fd); for (count = 0;; ++count) { sprintf(link, "rr-test-link-%d", count); int ret = symlink(path, link); if (ret == 0) { break; } test_assert(errno == EEXIST); } test_assert(BUF_SIZE == readlink(link, buf, BUF_SIZE)); test_assert(0 == memcmp(path, buf, BUF_SIZE)); verify_guard(BUF_SIZE, buf); test_assert((ssize_t)strlen(path) == readlink(link, buf2, BUF2_SIZE)); test_assert(0 == memcmp(path, buf2, strlen(path))); verify_guard(BUF2_SIZE, buf2); test_assert(0 == unlink(path)); test_assert(0 == unlink(link)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/readlinkat.c000066400000000000000000000015451277367620400162150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define BUF_SIZE 10 #define BUF2_SIZE 1000 int main(void) { static const char file_path[] = "rr-test-file"; static const char link_path[] = "rr-test-link"; char* buf = allocate_guard(BUF_SIZE, 'q'); char* buf2 = allocate_guard(BUF2_SIZE, 'r'); test_assert(0 == symlink(file_path, link_path)); test_assert(BUF_SIZE == readlinkat(AT_FDCWD, link_path, buf, BUF_SIZE)); test_assert(0 == memcmp(file_path, buf, BUF_SIZE)); verify_guard(BUF_SIZE, buf); test_assert((ssize_t)(sizeof(file_path) - 1) == readlinkat(AT_FDCWD, link_path, buf2, BUF2_SIZE)); test_assert(0 == memcmp(file_path, buf2, sizeof(file_path) - 1)); verify_guard(BUF2_SIZE, buf2); test_assert(0 == unlink(link_path)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/readv.c000066400000000000000000000024071277367620400151760ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char data[10] = "0123456789"; static void test(int use_preadv) { char name[] = "/tmp/rr-readv-XXXXXX"; int fd = mkstemp(name); struct { char ch[7]; } * part1; struct { char ch[10]; } * part2; struct iovec iovs[2]; ssize_t nread; test_assert(fd >= 0); test_assert(0 == unlink(name)); test_assert(sizeof(data) == write(fd, data, sizeof(data))); ALLOCATE_GUARD(part1, 'x'); ALLOCATE_GUARD(part2, 'y'); iovs[0].iov_base = part1; iovs[0].iov_len = sizeof(*part1); iovs[1].iov_base = part2; iovs[1].iov_len = sizeof(*part2); if (use_preadv) { /* Work around busted preadv prototype in older libcs */ nread = syscall(SYS_preadv, fd, iovs, 2, 0, 0); } else { test_assert(0 == lseek(fd, 0, SEEK_SET)); nread = readv(fd, iovs, 2); } test_assert(sizeof(data) == nread); test_assert(0 == memcmp(part1, data, sizeof(*part1))); test_assert( 0 == memcmp(part2, data + sizeof(*part1), sizeof(data) - sizeof(*part1))); test_assert(part2->ch[sizeof(data) - sizeof(*part1)] == 'y'); VERIFY_GUARD(part1); VERIFY_GUARD(part2); } int main(void) { test(0); test(1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/record_replay.run000066400000000000000000000002241277367620400173040ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness just_record rr "--suppress-environment-warnings replay -a $workdir/*-0" replay check EXIT-SUCCESS rr-4.4.0/src/test/recvfrom.c000066400000000000000000000040231277367620400157140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char buf[] = "0123456789abcdefghijklmnopqrstuvwxyz"; /* Make it longer than sizeof(struct sockaddr) */ static const char sock_name[] = "sock_sock_sock_sock"; static const char sock_name2[] = "sock_sock_sock_sock_2"; int main(void) { struct sockaddr_un addr; struct sockaddr_un addr2; struct sockaddr_un out_addr; socklen_t out_addr_len; char out[100]; int src; int dest = socket(AF_UNIX, SOCK_DGRAM, 0); test_assert(dest >= 0); addr.sun_family = AF_UNIX; strcpy(addr.sun_path, sock_name); test_assert(0 == bind(dest, &addr, sizeof(addr))); src = socket(AF_UNIX, SOCK_DGRAM, 0); test_assert(src >= 0); test_assert(36 == sendto(src, buf, 36, 0, &addr, sizeof(addr))); out_addr_len = sizeof(out_addr); test_assert(36 == recvfrom(dest, out, sizeof(out), 0, &out_addr, &out_addr_len)); test_assert(0 == memcmp(buf, out, 36)); test_assert(0 == out_addr_len); addr2.sun_family = AF_UNIX; strcpy(addr2.sun_path, sock_name2); test_assert(0 == bind(src, &addr2, sizeof(addr2))); test_assert(36 == sendto(src, buf, 36, 0, &addr, sizeof(addr))); out_addr_len = sizeof(out_addr); test_assert(36 == recvfrom(dest, out, sizeof(out), 0, &out_addr, &out_addr_len)); test_assert(0 == memcmp(buf, out, 36)); test_assert(out_addr_len == 2 + sizeof(sock_name2)); test_assert(0 == memcmp(out_addr.sun_path, sock_name2, sizeof(sock_name2))); test_assert(36 == sendto(src, buf, 36, 0, &addr, sizeof(addr))); out_addr_len = 8; out_addr.sun_path[9] = 'x'; test_assert(36 == recvfrom(dest, out, sizeof(out), 0, &out_addr, &out_addr_len)); test_assert(0 == memcmp(buf, out, 36)); test_assert(out_addr_len == 2 + sizeof(sock_name2)); test_assert(0 == memcmp(out_addr.sun_path, sock_name2, 8)); test_assert(out_addr.sun_path[9] == 'x'); test_assert(0 == unlink(sock_name)); test_assert(0 == unlink(sock_name2)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/remove_watchpoint.py000066400000000000000000000010761277367620400200410ustar00rootroot00000000000000from rrutil import * send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l var') expect_gdb('Hardware[()/a-z ]+watchpoint 2') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 42') send_gdb('p atomic_printf("hello%s", "kitty")') expect_gdb('hellokitty') send_gdb('delete 2') send_gdb('break pthread_join') expect_gdb('Breakpoint 3') send_gdb('c') expect_gdb('Breakpoint 3') send_gdb('p atomic_printf("hello%s", "kitty")') expect_gdb('hellokitty') send_gdb('c') expect_gdb('EXIT-SUCCESS') ok() rr-4.4.0/src/test/remove_watchpoint.run000066400000000000000000000001161277367620400202070ustar00rootroot00000000000000source `dirname $0`/util.sh record watchpoint$bitness debug remove_watchpoint rr-4.4.0/src/test/rename.c000066400000000000000000000013271277367620400153440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { static const char file_path[] = "rr-test-file"; static const char file2_path[] = "rr-test-file2"; int ret; int fd = open(file_path, O_WRONLY | O_CREAT, 0700); test_assert(0 == close(fd)); test_assert(0 == rename(file_path, file2_path)); test_assert(0 == renameat(AT_FDCWD, file2_path, AT_FDCWD, file_path)); ret = syscall(RR_renameat2, AT_FDCWD, file_path, AT_FDCWD, file2_path, 0); if (-1 == ret && errno == ENOSYS) { test_assert(0 == unlink(file_path)); } else { test_assert(0 == ret); test_assert(0 == unlink(file2_path)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/restart_abnormal_exit.c000066400000000000000000000002761277367620400204670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { atomic_puts("EXIT-SUCCESS"); kill(getppid(), SIGINT); return 0; } rr-4.4.0/src/test/restart_abnormal_exit.py000066400000000000000000000007061277367620400206730ustar00rootroot00000000000000from rrutil import * send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited') send_gdb('b main') expect_gdb('Breakpoint 1') restart_replay() expect_gdb('Breakpoint 1') send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited') restart_replay() expect_gdb('Breakpoint 1') send_gdb('checkpoint') expect_gdb('Checkpoint 2 at') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited') ok() rr-4.4.0/src/test/restart_abnormal_exit.run000066400000000000000000000000471277367620400210450ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/restart_breakpoint.py000066400000000000000000000005431277367620400202040ustar00rootroot00000000000000from rrutil import * send_gdb('b C') expect_gdb('Breakpoint 1') def check_breakpoint(): expect_rr('calling C') expect_gdb('Breakpoint 1, C') send_gdb('bt') expect_gdb('#0[^C]+C[^#]+#1[^B]+B[^#]+#2[^A]+A[^#]+#3[^m]+main') send_gdb('c') check_breakpoint() restart_replay() check_breakpoint() restart_replay() check_breakpoint() ok() rr-4.4.0/src/test/restart_diversion.py000066400000000000000000000006731277367620400200540ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('check') expect_gdb('Checkpoint 1 at') send_gdb('p atomic_printf("hello%s", "kitty")') expect_gdb('hellokitty') restart_replay() expect_gdb('Breakpoint 1') send_gdb('p atomic_printf("hello%s", "kitty")') expect_gdb('hellokitty') send_gdb('restart 1') expect_gdb('stopped') send_gdb('c') expect_rr('EXIT-SUCCESS') ok() rr-4.4.0/src/test/restart_diversion.run000066400000000000000000000001121277367620400202140ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug restart_diversion rr-4.4.0/src/test/restart_finish.py000066400000000000000000000002721277367620400173250ustar00rootroot00000000000000from rrutil import * import re restart_replay() send_gdb('c') # A stop fires when we hit an exec expect_rr([ re.compile(r'exited normally'), re.compile(r'stopped') ]) ok() rr-4.4.0/src/test/restart_invalid_checkpoint.py000066400000000000000000000011011277367620400216720ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('b atomic_puts') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 2') send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('restart 8') send_gdb('restart -1') send_gdb('restart abc') send_gdb('restart 1') expect_gdb('stopped') send_gdb('c') # If rr crashes, a 'restart' will re-run the program directly under gdb from # the beginning. If that happens, we'll stop at breakpoint 1, not exit normally. expect_gdb('xited normally') ok() rr-4.4.0/src/test/restart_invalid_checkpoint.run000066400000000000000000000001241277367620400220520ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug restart_invalid_checkpoint rr-4.4.0/src/test/restart_unstable.py000066400000000000000000000001711277367620400176600ustar00rootroot00000000000000from rrutil import * send_gdb('c') expect_gdb('exited normally') restart_replay() expect_gdb('exited normally') ok() rr-4.4.0/src/test/restart_unstable.run000066400000000000000000000001151277367620400200320ustar00rootroot00000000000000source `dirname $0`/util.sh record exit_group$bitness debug restart_unstable rr-4.4.0/src/test/reverse_alarm.py000066400000000000000000000004221277367620400171250ustar00rootroot00000000000000from rrutil import * send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('break breakpoint') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 2') send_gdb('reverse-continue') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/reverse_alarm.run000066400000000000000000000001051277367620400172770ustar00rootroot00000000000000source `dirname $0`/util.sh record alarm$bitness debug reverse_alarm rr-4.4.0/src/test/reverse_continue_breakpoint.c000066400000000000000000000014361277367620400216730ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int k = 2; static void breakpoint(void) {} static void breakpoint2(void) {} int main(void) { int i; int j; int fd = open("/dev/null", O_WRONLY); test_assert(fd >= 0); /* We need to test reverse-continue through a bunch of breakpoints when the next event is a syscallbuf-flush. So we need the next event to be syscall-buffered. Do a write here so that the syscall is patched now, not later. */ test_assert(1 == write(fd, ".", 1)); for (i = 0; i < 2000000; ++i) { breakpoint2(); for (j = 0; j < 10; ++j) { k = k * 37; } } breakpoint(); test_assert(1 == write(fd, ".", 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/reverse_continue_breakpoint.py000066400000000000000000000003531277367620400220760ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('break breakpoint2') expect_gdb('Breakpoint 2') send_gdb('reverse-cont') expect_gdb('Breakpoint 2') ok() rr-4.4.0/src/test/reverse_continue_breakpoint.run000066400000000000000000000000471277367620400222520ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_continue_exec_subprocess.py000066400000000000000000000007701277367620400231370ustar00rootroot00000000000000from rrutil import * import re send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') ok() rr-4.4.0/src/test/reverse_continue_exec_subprocess.run000066400000000000000000000005121277367620400233050ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe simple$bitness saved_simple="simple$bitness-$nonce" save_exe target_process$bitness record "target_process$bitness" "$saved_simple" TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug reverse_continue_exec_subprocess "-p $TARGET_PID" rr-4.4.0/src/test/reverse_continue_fork_subprocess.py000066400000000000000000000010771277367620400231550ustar00rootroot00000000000000from rrutil import * import re send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('stepi') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('stepi') send_gdb('reverse-stepi') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') ok() rr-4.4.0/src/test/reverse_continue_fork_subprocess.run000066400000000000000000000005121277367620400233220ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe simple$bitness saved_simple="simple$bitness-$nonce" save_exe target_process$bitness record "target_process$bitness" "$saved_simple" TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug reverse_continue_fork_subprocess "-f $TARGET_PID" rr-4.4.0/src/test/reverse_continue_multiprocess.c000066400000000000000000000023751277367620400222710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} static int parent_to_child[2]; static int child_to_parent[2]; int main(void) { pid_t pid; int status; int i; char ch; test_assert(0 == pipe(parent_to_child)); test_assert(0 == pipe(child_to_parent)); /* Force ping-ponging between parent and child. At each iteration the child receives a signal. We debug the parent process; the signals being received by the child while reverse-executing the parent should be ignored at a low enough level they don't impact the performance of reverse-continue. */ breakpoint(); pid = fork(); if (0 == pid) { for (i = 0; i < 1000; ++i) { char ch; test_assert(1 == read(parent_to_child[0], &ch, 1) && ch == 'y'); kill(getpid(), SIGCHLD); test_assert(1 == write(child_to_parent[1], "x", 1)); } return 77; } for (i = 0; i < 1000; ++i) { test_assert(1 == write(parent_to_child[1], "y", 1)); test_assert(1 == read(child_to_parent[0], &ch, 1) && ch == 'x'); } test_assert(pid == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/reverse_continue_multiprocess.py000066400000000000000000000003261277367620400224710ustar00rootroot00000000000000from rrutil import * import re send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('rc') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/reverse_continue_multiprocess.run000066400000000000000000000000471277367620400226450ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_continue_process_signal.c000066400000000000000000000012011277367620400225360ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS (1 << 26) int spin(void) { int i, dummy = 0; atomic_puts("spinning"); for (i = 1; i < NUM_ITERATIONS; ++i) { dummy += i % (1 << 20); dummy += i % (79 * (1 << 20)); } return dummy; } int main(void) { pid_t pid; int status; pid = fork(); if (0 == pid) { signal(SIGINT, SIG_IGN); spin(); kill(getpid(), SIGINT); return 77; } test_assert(pid == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/reverse_continue_process_signal.py000066400000000000000000000002241277367620400227500ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('c') expect_gdb('SIGKILL') send_gdb('reverse-continue') expect_gdb('stopped') ok() rr-4.4.0/src/test/reverse_continue_process_signal.run000066400000000000000000000000471277367620400231270ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_continue_start.py000066400000000000000000000006311277367620400210740ustar00rootroot00000000000000from rrutil import * import re send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('reverse-cont') expect_gdb('stopped') send_gdb('reverse-stepi') expect_gdb('stopped') send_gdb('reverse-cont') expect_gdb('stopped') ok() rr-4.4.0/src/test/reverse_continue_start.run000066400000000000000000000001171277367620400212470ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug reverse_continue_start rr-4.4.0/src/test/reverse_finish.py000066400000000000000000000002561277367620400173160ustar00rootroot00000000000000from rrutil import * send_gdb('break atomic_puts') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('reverse-finish') expect_gdb('main') ok() rr-4.4.0/src/test/reverse_finish.run000066400000000000000000000001071277367620400174650ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug reverse_finish rr-4.4.0/src/test/reverse_many_breakpoints.c000066400000000000000000000004541277367620400211750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} int main(void) { int i; int result = 0; for (i = 0; i < 100000; ++i) { result += i * i; breakpoint(); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/reverse_many_breakpoints.py000066400000000000000000000003211277367620400213740ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('c') expect_gdb('SIGKILL') send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('reverse-continue') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/reverse_many_breakpoints.run000066400000000000000000000000471277367620400215550ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_step_breakpoint.py000066400000000000000000000004221277367620400212220ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('n') send_gdb('break') expect_gdb('Breakpoint 2') send_gdb('reverse-next') expect_gdb('Breakpoint 1') send_gdb('next') expect_gdb('Breakpoint 2') ok() rr-4.4.0/src/test/reverse_step_breakpoint.run000066400000000000000000000001201277367620400213710ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug reverse_step_breakpoint rr-4.4.0/src/test/reverse_step_long.c000066400000000000000000000016331277367620400176220ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS (1 << 27) static void breakpoint(void) { int break_here = 1; (void)break_here; } static int spin(void) { int i, dummy = 0; atomic_puts("spinning"); for (i = 1; i < 1 << 28; ++i) { dummy += i % (1 << 20); dummy += i % (79 * (1 << 20)); } return dummy; } /** * We'll break in do_thread, continue until SIGKILL, and * then try a reverse-stepi. This will have to search back through * several checkpoints to find the last completed singlestep for * the thread. */ static void* do_thread(__attribute__((unused)) void* p) { char ch; breakpoint(); /* Will never return */ read(STDIN_FILENO, &ch, 1); return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, do_thread, NULL); spin(); atomic_printf("EXIT-SUCCESS\n"); return 0; } rr-4.4.0/src/test/reverse_step_long.py000066400000000000000000000004531277367620400200270ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('SIGKILL') # This should not hang send_gdb('reverse-stepi') send_gdb('reverse-continue') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/reverse_step_long.run000066400000000000000000000000471277367620400202020ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_step_signal.py000066400000000000000000000010361277367620400203430ustar00rootroot00000000000000from rrutil import * import re send_gdb('watch num_signals_caught') expect_gdb('Hardware watchpoint 1') send_gdb('c') expect_gdb('received signal') send_gdb('c') expect_gdb('Hardware watchpoint 1') expect_gdb('Old value = 0') expect_gdb('New value = 1') send_gdb('reverse-continue') expect_gdb('Hardware watchpoint 1') expect_gdb('Old value = 1') expect_gdb('New value = 0') send_gdb('reverse-finish') expect_gdb('raise') send_gdb('reverse-stepi') expect_gdb('received signal') send_gdb('reverse-continue') expect_gdb('stopped') ok() rr-4.4.0/src/test/reverse_step_signal.run000066400000000000000000000001131277367620400205120ustar00rootroot00000000000000source `dirname $0`/util.sh record sigrt$bitness debug reverse_step_signal rr-4.4.0/src/test/reverse_step_threads.c000066400000000000000000000013331277367620400203120ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_ITERATIONS (1 << 27) static void breakpoint(void) { int break_here = 1; (void)break_here; } int spin(int iterations) { int i, dummy = 0; atomic_puts("spinning"); for (i = 1; i < iterations; ++i) { dummy += i % (1 << 20); dummy += i % (79 * (1 << 20)); } return dummy; } static void* do_thread(__attribute__((unused)) void* p) { breakpoint(); return NULL; } int main(void) { int s = spin(NUM_ITERATIONS); pthread_t thread; pthread_create(&thread, NULL, do_thread, NULL); pthread_join(thread, NULL); s = spin(1000); atomic_printf("EXIT-SUCCESS dummy=%d\n", s); return 0; } rr-4.4.0/src/test/reverse_step_threads.py000066400000000000000000000003431277367620400205200ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('set scheduler-locking off') send_gdb('reverse-step') send_gdb('c') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/reverse_step_threads.run000066400000000000000000000000471277367620400206750ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_step_threads2.py000066400000000000000000000004501277367620400206010ustar00rootroot00000000000000from rrutil import * send_gdb('b spin') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('set scheduler-locking off') send_gdb('reverse-step') send_gdb('reverse-continue') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/reverse_step_threads2.run000066400000000000000000000001341277367620400207540ustar00rootroot00000000000000source `dirname $0`/util.sh record reverse_step_threads$bitness debug reverse_step_threads2 rr-4.4.0/src/test/reverse_step_threads_break.c000066400000000000000000000024451277367620400214630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int main_to_thread_fds[2]; static int thread_to_main_fds[2]; static void breakpoint(void) {} static void breakpoint_thread(void) {} static size_t my_read(int fd, void* buf, size_t size) { size_t ret; #ifdef __x86_64__ __asm__("syscall\n\t" : "=a"(ret) : "a"(SYS_read), "D"(fd), "S"(buf), "d"(size)); #elif defined(__i386__) __asm__("xchg %%ebx,%%edi\n\t" "int $0x80\n\t" "xchg %%ebx,%%edi\n\t" : "=a"(ret) : "a"(SYS_read), "c"(buf), "d"(size), "D"(fd)); #else #error define syscall here #endif return ret; } static void* do_thread(__attribute__((unused)) void* p) { char ch; breakpoint_thread(); test_assert(1 == write(thread_to_main_fds[1], "y", 1)); test_assert(1 == read(main_to_thread_fds[0], &ch, 1)); return NULL; } int main(void) { pthread_t thread; char ch; test_assert(0 == pipe(thread_to_main_fds)); test_assert(0 == pipe(main_to_thread_fds)); pthread_create(&thread, NULL, do_thread, NULL); test_assert(1 == my_read(thread_to_main_fds[0], &ch, 1)); breakpoint(); test_assert(1 == write(main_to_thread_fds[1], "x", 1)); pthread_join(thread, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/reverse_step_threads_break.py000066400000000000000000000004501277367620400216630ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('b breakpoint_thread') expect_gdb('Breakpoint 2') send_gdb('set scheduler-locking off') for i in xrange(50): send_gdb('reverse-step') expect_gdb('Breakpoint 2') ok() rr-4.4.0/src/test/reverse_step_threads_break.run000066400000000000000000000000471277367620400220410ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/reverse_watchpoint.py000066400000000000000000000012651277367620400202170ustar00rootroot00000000000000from rrutil import * send_gdb('break atomic_puts') expect_gdb('Breakpoint 1') send_gdb('watch var') expect_gdb('Hardware watchpoint 2') send_gdb('c') expect_gdb('Hardware watchpoint 2') expect_gdb('Old value = 0') expect_gdb('New value = 42') send_gdb('c') expect_gdb('Hardware watchpoint 2') expect_gdb('Old value = 42') expect_gdb('New value = 1337') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('reverse-cont') expect_gdb('Hardware watchpoint 2') expect_gdb('Old value = 1337') expect_gdb('New value = 42') send_gdb('reverse-cont') expect_gdb('Hardware watchpoint 2') expect_gdb('Old value = 42') expect_gdb('New value = 0') send_gdb('reverse-cont') expect_gdb('stopped') ok() rr-4.4.0/src/test/reverse_watchpoint.run000066400000000000000000000001171277367620400203660ustar00rootroot00000000000000source `dirname $0`/util.sh record watchpoint$bitness debug reverse_watchpoint rr-4.4.0/src/test/reverse_watchpoint_syscall.py000066400000000000000000000012011277367620400217370ustar00rootroot00000000000000from rrutil import * send_gdb('break atomic_puts') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l *p') expect_gdb('Hardware[()/a-z ]+watchpoint 2') send_gdb('reverse-continue') expect_gdb('Old value = ') expect_gdb('New value = 0') send_gdb('reverse-continue') expect_gdb('Old value = 0') expect_gdb('New value = 98') send_gdb('reverse-continue') expect_gdb('Old value = 98') expect_gdb('New value = 0') send_gdb('reverse-continue') expect_gdb('Old value = 0') expect_gdb('New value = 97') send_gdb('reverse-continue') expect_gdb('Old value = 97') expect_gdb('New value = 0') ok() rr-4.4.0/src/test/reverse_watchpoint_syscall.run000066400000000000000000000001371277367620400221220ustar00rootroot00000000000000source `dirname $0`/util.sh record watchpoint_syscall$bitness debug reverse_watchpoint_syscall rr-4.4.0/src/test/rlimit.c000066400000000000000000000013301277367620400153670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct rlimit* r; struct rlimit* r2; ALLOCATE_GUARD(r, 0); ALLOCATE_GUARD(r2, 'x'); test_assert(0 == getrlimit(RLIMIT_FSIZE, r)); test_assert(r->rlim_cur > 0); test_assert(r->rlim_max > 0); VERIFY_GUARD(r); r->rlim_cur /= 2; test_assert(0 == setrlimit(RLIMIT_FSIZE, r)); VERIFY_GUARD(r); test_assert(0 == getrlimit(RLIMIT_FSIZE, r2)); test_assert(r2->rlim_cur == r->rlim_cur); VERIFY_GUARD(r2); test_assert(0 == prlimit(0, RLIMIT_FSIZE, r, r2)); test_assert(r2->rlim_cur == r->rlim_cur); VERIFY_GUARD(r); VERIFY_GUARD(r2); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/robust_futex.c000066400000000000000000000034631277367620400166310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static pthread_mutex_t* mutex; static void* run_thread(__attribute__((unused)) void* unused) { void* p; size_t len; syscall(SYS_get_robust_list, 0, &p, &len); atomic_printf("robust_list = %p, len = %d\n", p, (int)len); test_assert(0 == pthread_mutex_lock(mutex)); return NULL; } int main(void) { pthread_mutexattr_t attr; pthread_t thread; pid_t child; int status; char ch; test_assert(0 == pipe(pipe_fds)); mutex = (pthread_mutex_t*)mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); pthread_mutexattr_init(&attr); pthread_mutexattr_setrobust(&attr, PTHREAD_MUTEX_ROBUST); pthread_mutexattr_setpshared(&attr, PTHREAD_PROCESS_SHARED); pthread_mutex_init(mutex, &attr); pthread_create(&thread, NULL, run_thread, NULL); pthread_join(thread, NULL); test_assert(EOWNERDEAD == pthread_mutex_lock(mutex)); pthread_mutex_consistent(mutex); test_assert(0 == pthread_mutex_unlock(mutex)); test_assert(0 == pthread_mutex_lock(mutex)); test_assert(0 == pthread_mutex_unlock(mutex)); child = fork(); if (!child) { test_assert(0 == pthread_mutex_lock(mutex)); test_assert(1 == write(pipe_fds[1], "x", 1)); sleep(1000000); return 1; } test_assert(1 == read(pipe_fds[0], &ch, 1)); kill(child, SIGKILL); test_assert(child == wait(&status)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == 9); test_assert(EOWNERDEAD == pthread_mutex_lock(mutex)); pthread_mutex_consistent(mutex); test_assert(0 == pthread_mutex_unlock(mutex)); test_assert(0 == pthread_mutex_lock(mutex)); test_assert(0 == pthread_mutex_unlock(mutex)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/rr_ps.c000066400000000000000000000015421277367620400152210ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, __attribute__((unused)) char* argv[]) { pid_t child; int status; if (argc > 1) { return 88; } child = fork(); if (!child) { return 77; } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); child = fork(); if (!child) { kill(getpid(), SIGSEGV); } test_assert(child == wait(&status)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); child = fork(); if (!child) { char* args[] = { argv[0], "token", NULL }; execve(argv[0], args, environ); test_assert(0 && "execve failed"); } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 88); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/rr_ps.run000066400000000000000000000004771277367620400156110ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test EXIT-SUCCESS if !(do_ps | grep -q $'\t77'); then failed "Can't find return value 77" fi if !(do_ps | grep -q -- $'\t-11'); then failed "Can't find return value -11" fi if !(do_ps | grep $'\t88' | grep -q token); then failed "Can't find exec parameter 'token'" fi rr-4.4.0/src/test/rrutil.h000066400000000000000000000135571277367620400154330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RRUTIL_H #define RRUTIL_H #define _GNU_SOURCE 1 #define _POSIX_C_SOURCE 2 /* btrfs needs NULL but doesn't #include it */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #if defined(__i386__) #include "SyscallEnumsForTestsX86.generated" #elif defined(__x86_64__) #include "SyscallEnumsForTestsX64.generated" #else #error Unknown architecture #endif #include typedef unsigned char uint8_t; #define ALEN(_a) (sizeof(_a) / sizeof(_a[0])) /** * Print the printf-like arguments to stdout as atomic-ly as we can * manage. Async-signal-safe. Does not flush stdio buffers (doing so * isn't signal safe). */ __attribute__((format(printf, 1, 2))) inline static int atomic_printf( const char* fmt, ...) { va_list args; char buf[1024]; int len; va_start(args, fmt); len = vsnprintf(buf, sizeof(buf) - 1, fmt, args); va_end(args); return write(STDOUT_FILENO, buf, len); } /** * Write |str| on its own line to stdout as atomic-ly as we can * manage. Async-signal-safe. Does not flush stdio buffers (doing so * isn't signal safe). */ inline static int atomic_puts(const char* str) { return atomic_printf("%s\n", str); } #define fprintf(...) USE_dont_write_stderr #define printf(...) USE_atomic_printf_INSTEAD #define puts(...) USE_atomic_puts_INSTEAD inline static int check_cond(int cond) { if (!cond) { atomic_printf("FAILED: errno=%d (%s)\n", errno, strerror(errno)); } return cond; } #define test_assert(cond) assert("FAILED: !" && check_cond(cond)) /** * Return the calling task's id. */ inline static pid_t sys_gettid(void) { return syscall(SYS_gettid); } /** * Ensure that |len| bytes of |buf| are the same across recording and * replay. */ inline static void check_data(void* buf, size_t len) { syscall(SYS_write, RR_MAGIC_SAVE_DATA_FD, buf, len); atomic_printf("Wrote %zu bytes to magic fd\n", len); } /** * Return the current value of the time-stamp counter. */ inline static uint64_t rdtsc(void) { return __rdtsc(); } /** * Perform some syscall that writes an event, i.e. is not syscall-buffered. */ inline static void event_syscall(void) { syscall(-1); } static uint64_t GUARD_VALUE = 0xdeadbeeff00dbaad; /** * Allocate 'size' bytes, fill with 'value', and place canary values before * and after the allocated block. */ inline static void* allocate_guard(size_t size, char value) { char* cp = (char*)malloc(size + 2 * sizeof(GUARD_VALUE)) + sizeof(GUARD_VALUE); memcpy(cp - sizeof(GUARD_VALUE), &GUARD_VALUE, sizeof(GUARD_VALUE)); memcpy(cp + size, &GUARD_VALUE, sizeof(GUARD_VALUE)); memset(cp, value, size); return cp; } /** * Verify that canary values before and after the block allocated at 'p' * (of size 'size') are still valid. */ inline static void verify_guard(size_t size, void* p) { char* cp = (char*)p; test_assert( memcmp(cp - sizeof(GUARD_VALUE), &GUARD_VALUE, sizeof(GUARD_VALUE)) == 0); test_assert(memcmp(cp + size, &GUARD_VALUE, sizeof(GUARD_VALUE)) == 0); } /** * Verify that canary values before and after the block allocated at 'p' * (of size 'size') are still valid, and free the block. */ inline static void free_guard(size_t size, void* p) { verify_guard(size, p); free((char*)p - sizeof(GUARD_VALUE)); } inline static void crash_null_deref(void) { *(volatile int*)NULL = 0; } #define ALLOCATE_GUARD(p, v) p = allocate_guard(sizeof(*p), v) #define VERIFY_GUARD(p) verify_guard(sizeof(*p), p) #define FREE_GUARD(p) free_guard(sizeof(*p), p) #ifndef SECCOMP_SET_MODE_STRICT #define SECCOMP_SET_MODE_STRICT 0 #endif #ifndef SECCOMP_SET_MODE_FILTER #define SECCOMP_SET_MODE_FILTER 1 #endif #ifndef SECCOMP_FILTER_FLAG_TSYNC #define SECCOMP_FILTER_FLAG_TSYNC 1 #endif /* Old systems don't have linux/kcmp.h */ #define RR_KCMP_FILE 0 #define RR_KCMP_FILES 2 /* Old systems don't have these */ #ifndef TIOCGPKT #define TIOCGPKT _IOR('T', 0x38, int) #endif #ifndef TIOCGPTLCK #define TIOCGPTLCK _IOR('T', 0x39, int) #endif #ifndef TIOCGEXCL #define TIOCGEXCL _IOR('T', 0x40, int) #endif #ifndef MADV_FREE #define MADV_FREE 8 #endif #endif /* RRUTIL_H */ rr-4.4.0/src/test/rrutil.py000066400000000000000000000047041277367620400156260ustar00rootroot00000000000000import pexpect, re, signal, sys, time __all__ = [ 'expect_gdb', 'send_gdb','expect_rr', 'expect_list', 'restart_replay', 'interrupt_gdb', 'ok', 'failed', 'iterlines_both', 'last_match', 'get_exe_arch' ] # Public API def expect_gdb(what): expect(gdb_rr, what) def expect_list(pats): return gdb_rr.expect_list(pats) def expect_rr(what): expect(gdb_rr, what) def failed(why, e=None): print 'FAILED:', why if e: print 'exception:', e clean_up() sys.exit(1) def interrupt_gdb(): try: gdb_rr.kill(signal.SIGINT) except Exception, e: failed('interrupting gdb', e) expect_gdb('stopped.') def iterlines_both(): return gdb_rr def last_match(): return gdb_rr.match def restart_replay(event=0): if event: send_gdb('r %d'%(event)) else: send_gdb('r') # gdb may not prompt here. It's ok to send an unnecessary 'y' # since there is no such command. send_gdb('y') send_gdb('c') def send_gdb(what): send(gdb_rr, "%s\n"%what) def ok(): send_gdb('q') send_gdb('y') clean_up() # Internal helpers TIMEOUT_SEC = 100 # gdb and rr are part of the same process tree, so they share # stdin/stdout. gdb_rr = None def clean_up(): global gdb_rr iterations = 0 while gdb_rr: try: gdb_rr.close(force=1) gdb_rr = None except Exception, e: if iterations < 5: print "close() failed with '%s', retrying..."%e iterations = iterations + 1 else: gdb_rr = None def expect(prog, what): try: prog.expect(what) except Exception, e: failed('expecting "%s"'% (what), e) def get_exe_arch(): send_gdb('show architecture') expect_gdb('The target architecture is set automatically \\(currently ([0-9a-z:-]+)\\)') global gdb_rr return gdb_rr.match.group(1) def get_rr_cmd(): '''Return the command that should be used to invoke rr, as the tuple (executable, array-of-args)''' rrargs = sys.argv[1:] return (rrargs[0], rrargs[1:]) def send(prog, what): try: prog.send(what) except Exception, e: failed('sending "%s"'% (what), e) def set_up(): global gdb_rr try: gdb_rr = pexpect.spawn(*get_rr_cmd(), timeout=TIMEOUT_SEC, logfile=open('gdb_rr.log', 'w')) expect_gdb(r'\(rr\)') except Exception, e: failed('initializing rr and gdb', e) set_up() rr-4.4.0/src/test/run_end.py000066400000000000000000000010571277367620400157350ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') # Test that invalid syntax doesn't crash rr send_gdb('run run 100') send_gdb('y') send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') # Running with a big event number should reach the end of the recording send_gdb('run 10000') send_gdb('y') expect_gdb('SIGKILL') send_gdb('c') expect_gdb('xited normally') send_gdb('run 10000') # no need to confirm since the process already exited expect_gdb('SIGKILL') send_gdb('reverse-cont') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/run_end.run000066400000000000000000000001001277367620400160750ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug run_end rr-4.4.0/src/test/run_in_function.py000066400000000000000000000003171277367620400175000ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('call crash()') expect_gdb('SIGSEGV') restart_replay() expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/run_in_function.run000066400000000000000000000001231277367620400176470ustar00rootroot00000000000000source `dirname $0`/util.sh record crash_in_function$bitness debug run_in_function rr-4.4.0/src/test/rusage.c000066400000000000000000000004641277367620400153640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct rusage* r; ALLOCATE_GUARD(r, 0); test_assert(0 == getrusage(RUSAGE_SELF, r)); test_assert(r->ru_maxrss > 0); VERIFY_GUARD(r); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/samask.c000066400000000000000000000026241277367620400153550ustar00rootroot00000000000000#include "rrutil.h" static void segv_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { test_assert(0 && "Should not reach here"); } static void usr1_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { // Generate SIGSEGV. Can't use raise, because that will be blocked (*(int*)1) = 0; test_assert(0 && "Should not reach here"); } static void* do_thread(__attribute__((unused)) void* p) { raise(SIGUSR1); test_assert(0 && "Should not reach here!"); return NULL; } int main(void) { pid_t child; int status; pthread_t thread; if ((child = fork()) == 0) { struct sigaction act; act.sa_sigaction = segv_handler; act.sa_flags = SA_ONSTACK | SA_SIGINFO; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); act.sa_sigaction = usr1_handler; sigaddset(&act.sa_mask, SIGSEGV); sigaction(SIGUSR1, &act, NULL); pthread_create(&thread, NULL, do_thread, NULL); test_assert(0 == sched_yield()); sleep(1000); test_assert(0 && "Should not reach here"); return 0; } test_assert(child == wait(&status)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sanity.py000066400000000000000000000000721277367620400156060ustar00rootroot00000000000000from rrutil import * send_gdb('c') expect_rr('Hi') ok() rr-4.4.0/src/test/sanity.run000066400000000000000000000000761277367620400157660ustar00rootroot00000000000000source `dirname $0`/util.sh record hello$bitness debug sanity rr-4.4.0/src/test/save_data_fd.c000066400000000000000000000007451277367620400165000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DEV_RANDOM "/dev/urandom" int main(void) { int fd = open(DEV_RANDOM, O_RDONLY); char buf[128]; ssize_t nread; test_assert(0 <= fd); nread = read(fd, buf, sizeof(buf)); atomic_printf("Read %zd random bytes (expected %zu)\n", nread, sizeof(buf)); test_assert(nread == sizeof(buf)); check_data(buf, sizeof(buf)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sched_attr.c000066400000000000000000000011151277367620400162100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct sched_attr* attr; ALLOCATE_GUARD(attr, 'x'); test_assert(0 == sched_getattr(0, attr, sizeof(*attr), 0)); /* Don't check specific scheduling parameters in case someone is running the rr tests with low priority or something like that */ test_assert(attr->size == sizeof(*attr)); test_assert(attr->flags == 0); VERIFY_GUARD(attr); test_assert(0 == sched_setattr(0, attr, 0)); VERIFY_GUARD(attr); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sched_setaffinity.c000066400000000000000000000015311277367620400175650ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { cpu_set_t* cpus; cpu_set_t* cpus_out; cpu_set_t* cpus_out_2; ALLOCATE_GUARD(cpus, 'x'); CPU_ZERO(cpus); CPU_SET(0, cpus); test_assert(0 == sched_setaffinity(0, sizeof(*cpus), cpus)); VERIFY_GUARD(cpus); ALLOCATE_GUARD(cpus_out, 'x'); test_assert(0 == sched_getaffinity(0, sizeof(*cpus_out), cpus_out)); /* We can't assert this because rr assigns us random affinity itself. test_assert(0 == memcmp(cpus, cpus_out, sizeof(*cpus))); */ VERIFY_GUARD(cpus_out); ALLOCATE_GUARD(cpus_out_2, 'y'); test_assert(0 == sched_getaffinity(0, sizeof(*cpus_out_2), cpus_out_2)); test_assert(0 == memcmp(cpus_out, cpus_out_2, sizeof(*cpus_out))); VERIFY_GUARD(cpus_out_2); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sched_setparam.c000066400000000000000000000013241277367620400170540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct sched_param* param; int scheduler; int min_priority; int max_priority; scheduler = sched_getscheduler(0); test_assert(scheduler >= 0); ALLOCATE_GUARD(param, 'x'); test_assert(0 == sched_getparam(0, param)); VERIFY_GUARD(param); min_priority = sched_get_priority_min(scheduler); test_assert(min_priority >= 0); max_priority = sched_get_priority_max(scheduler); test_assert(max_priority >= 0); test_assert(min_priority <= max_priority); param->sched_priority = min_priority; test_assert(0 == sched_setparam(0, param)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sched_yield.c000066400000000000000000000040011277367620400163410ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" enum { PING, PONG } last; pthread_once_t init_once = PTHREAD_ONCE_INIT; static void init_ping(void) { last = PONG; } static void init_pong(void) { last = PING; } static pthread_barrier_t bar; static int ping_ready; static int pong_ready; static void ping_pong(int which) { volatile int* self_ready = which == PING ? &ping_ready : &pong_ready; volatile int* other_ready = which == PING ? &pong_ready : &ping_ready; int i; /* Efficiently wait for the other thread to arrive. */ pthread_barrier_wait(&bar); /* Semi-busy-wait for both threads to be runnable. (One * thread exiting a barrier doesn't guarantee that the other * thread is immediately runnable.) */ *self_ready = 1; do { sched_yield(); } while (!*other_ready); /* Whichever thread reaches this loop first initializes the * other to be "last". */ pthread_once(&init_once, which == PING ? init_ping : init_pong); for (i = 0; i < 50; ++i) { /* Ensure that the other thread was the last to run * the loop body. */ which == PING ? test_assert("ping thread: " && PONG == last) : test_assert("pong thread: " && PING == last); last = which; /* Schedule the other thread run the next loop * iteration. * * NB: because the kernel scheduler is far more * complicated than rr's, this simplistic assumption * won't hold. If rr's scheduler grows to that level * of complexity, it's probably best to remove this * test. */ sched_yield(); } } static void* pong_thread(__attribute__((unused)) void* unused) { ping_pong(PONG); return NULL; } int main(void) { cpu_set_t cpus; pthread_t t; CPU_ZERO(&cpus); CPU_SET(0, &cpus); sched_setaffinity(0, sizeof(cpus), &cpus); pthread_barrier_init(&bar, NULL, 2); test_assert(0 == pthread_create(&t, NULL, pong_thread, NULL)); ping_pong(PING); pthread_join(t, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sched_yield_to_lower_priority.c000066400000000000000000000010771277367620400222260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int low_priority_thread_scheduled; static void* low_priority_thread(__attribute__((unused)) void* p) { setpriority(PRIO_PROCESS, 0, 4); low_priority_thread_scheduled = 1; return NULL; } int main(void) { pthread_t thread; pthread_create(&thread, NULL, low_priority_thread, NULL); test_assert(!low_priority_thread_scheduled); do { sched_yield(); } while (!low_priority_thread_scheduled); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/scm_rights.c000066400000000000000000000064741277367620400162470ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define MAGIC 0x1cd00d00 static void child(int sock, int fd_minus_one) { struct sockaddr addr; int fd; struct msghdr msg; union { int ints[2]; uint8_t bytes[sizeof(int[2])]; } mbuf; struct iovec iov; /* make cbuf bigger than necessary so we can test that the correct value is written back (the amount actually written by the kernel) */ uint8_t cbuf[CMSG_SPACE(sizeof(fd)) + 77]; const struct cmsghdr* cmsg; int zero = ~0; ssize_t nread; memset(&msg, 0, sizeof(msg)); memset(&addr, 0x51, sizeof(addr)); msg.msg_name = &addr; msg.msg_namelen = sizeof(addr); mbuf.ints[0] = mbuf.ints[1] = ~MAGIC; iov.iov_base = mbuf.bytes; iov.iov_len = sizeof(mbuf); msg.msg_iov = &iov; msg.msg_iovlen = 1; msg.msg_control = cbuf; msg.msg_controllen = sizeof(cbuf); msg.msg_flags = -1; atomic_printf("c: receiving msg ...\n"); nread = recvmsg(sock, &msg, 0); atomic_printf("c: ... got %#x (%zd bytes), %zu control bytes\n", mbuf.ints[0], nread, msg.msg_controllen); test_assert(nread == sizeof(mbuf.ints[0])); test_assert(MAGIC == mbuf.ints[0]); test_assert(~MAGIC == mbuf.ints[1]); test_assert(msg.msg_controllen == CMSG_SPACE(sizeof(fd))); atomic_printf("c: ... and %d name bytes\n", msg.msg_namelen); test_assert(0 == msg.msg_namelen); atomic_printf("c: ... and flags %d\n", msg.msg_flags); test_assert(0 == msg.msg_flags); cmsg = CMSG_FIRSTHDR(&msg); test_assert(SOL_SOCKET == cmsg->cmsg_level && SCM_RIGHTS == cmsg->cmsg_type); memcpy(&fd, CMSG_DATA(cmsg), sizeof(fd)); atomic_printf("c: ... and fd %d; should have received %d\n", fd, fd_minus_one + 1); test_assert(fd - 1 == fd_minus_one || fd - 2 == fd_minus_one); atomic_printf("c: reading from /dev/zero ...\n"); nread = read(fd, &zero, sizeof(zero)); atomic_printf("c: ... got %d (%zd bytes) %s\n", zero, nread, strerror(errno)); test_assert(0 == zero); exit(0); } int main(void) { int sockfds[2]; int sock; pid_t c; int fd; struct msghdr msg; int mbuf = MAGIC; struct iovec iov; uint8_t cbuf[CMSG_SPACE(sizeof(fd))]; struct cmsghdr* cmsg; ssize_t nsent; int err; int status; memset(&msg, 0, sizeof(msg)); test_assert(0 == socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds)); sock = sockfds[0]; fd = open("/dev/null", O_WRONLY); if (0 == (c = fork())) { child(sockfds[1], fd); test_assert("Not reached" && 0); } usleep(500000); fd = open("/dev/zero", O_RDONLY); iov.iov_base = &mbuf; iov.iov_len = sizeof(mbuf); msg.msg_iov = &iov; msg.msg_iovlen = 1; msg.msg_control = cbuf; msg.msg_controllen = sizeof(cbuf); cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_SOCKET; cmsg->cmsg_type = SCM_RIGHTS; cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); atomic_printf("P: sending %#x with fd %d ...\n", mbuf, fd); nsent = sendmsg(sock, &msg, 0); err = errno; atomic_printf("P: ... sent %zd bytes (%s/%d)\n", nsent, strerror(err), err); test_assert(0 < nsent); atomic_printf("P: waiting on child %d ...\n", c); test_assert(c == waitpid(c, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/search.c000066400000000000000000000027661277367620400153520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Make buf weird so that when we search the whole address space, we don't find any accidental matches. */ char buf[1024] = { 99, 1, 2, 2, 3, 0xff, 0xfa, 0xde, 0xbc }; char* p; char* p_end; int* argc_ptr; static void breakpoint(void) {} int main(int argc, __attribute__((unused)) char* argv[]) { /* 'buf' could be mapped twice in our address space, once in our data segment and once in the text segment. Tests that search the whole address space for the contents of 'buf' don't want to find a spurious match in .text, so setup buf with its intended contents here. After this the copy in .text should continue to map the old value. */ buf[0] = 0; argc_ptr = &argc; p = (char*)mmap(NULL, PAGE_SIZE * 4, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); p_end = p + PAGE_SIZE * 4; /* Don't copy the whole buf. If we do, we may trigger memcpy routines * that copy state to registers which are later spilled to the stack, * causing false positives. These short memcpys are performed using volatile * registers. */ memcpy(p + PAGE_SIZE, buf, 12); memcpy(p + PAGE_SIZE * 2, buf, 12); test_assert(0 == munmap(p, PAGE_SIZE)); test_assert(0 == munmap(p + PAGE_SIZE * 3, PAGE_SIZE)); test_assert(0 == mprotect(p + PAGE_SIZE, PAGE_SIZE, PROT_NONE)); breakpoint(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/search.py000066400000000000000000000024651277367620400155540ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('find buf,+1,(char)0') expect_gdb('') expect_gdb('1 pattern found') send_gdb('find buf,+1000,(char)99') expect_gdb('Pattern not found') send_gdb('find buf,+1000,(char)2') expect_gdb('') expect_gdb('3 patterns found') send_gdb('up'); send_gdb('find 0,-10L,&argc') expect_gdb('') send_gdb('down'); ok() rr-4.4.0/src/test/search.run000066400000000000000000000000471277367620400157220ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/seccomp.c000066400000000000000000000115521277367620400155270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define SYS_rrcall_init_buffers 443 static int count_SIGSYS = 0; static int pipe_fds[2]; static void handler(int sig, siginfo_t* si, void* p) { ucontext_t* ctx = p; /* some versions of system headers don't define si_arch, si_call_addr or * si_syscall. Just skip tests on those systems. */ #ifdef __i386__ int syscallno = ctx->uc_mcontext.gregs[REG_EAX]; #elif defined(__x86_64__) int syscallno = ctx->uc_mcontext.gregs[REG_RAX]; #else #error define architecture here #endif #ifdef si_arch #ifdef __i386__ test_assert(si->si_arch == AUDIT_ARCH_I386); #elif defined(__x86_64__) test_assert(si->si_arch == AUDIT_ARCH_X86_64); #endif #endif test_assert(syscallno == SYS_geteuid || syscallno == SYS_open); test_assert(sig == SIGSYS); test_assert(si->si_signo == SIGSYS); test_assert(si->si_errno == 0); test_assert(si->si_code == 1 /* SYS_SECCOMP */); #ifdef si_call_addr #ifdef __i386__ test_assert((intptr_t)si->si_call_addr == ctx->uc_mcontext.gregs[REG_EIP]); #elif defined(__x86_64__) test_assert((intptr_t)si->si_call_addr == ctx->uc_mcontext.gregs[REG_RIP]); #else #error define architecture here #endif #endif #ifdef si_syscall test_assert(si->si_syscall == syscallno); #endif ++count_SIGSYS; } static void install_filter(void) { struct sock_filter filter[] = { /* Load system call number from 'seccomp_data' buffer into accumulator */ BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)), /* Jump forward 1 instruction if system call number is not SYS_pipe */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_pipe, 0, 1), /* Error out with ESRCH */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ERRNO | (ESRCH & SECCOMP_RET_DATA)), /* Jump forward 1 instruction if system call number is not SYS_geteuid */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_geteuid, 0, 1), /* Trigger SIGSYS */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP), /* Jump forward 1 instruction if system call number is not SYS_open */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_open, 0, 1), /* Trigger SIGSYS */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP), /* Jump forward 1 instruction if system call number is not SYS_rrcall_init_buffers */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_rrcall_init_buffers, 0, 1), /* Trigger SIGSYS */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP), /* Jump forward 1 instruction if system call number is not SYS_ioctl */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SYS_ioctl, 0, 1), /* Trigger SIGSYS */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_TRAP), /* Destination of system call number mismatch: allow other system calls */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW) }; struct sock_fprog prog = { .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])), .filter = filter, }; int ret; ret = syscall(RR_seccomp, SECCOMP_SET_MODE_FILTER, 0, &prog); if (ret == -1 && errno == ENOSYS) { ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog); } test_assert(ret == 0); } static void* waiting_thread(__attribute__((unused)) void* p) { char buf; test_assert(1 == read(pipe_fds[0], &buf, 1)); /* Check this thread wasn't affected by the SET_SECCOMP */ test_assert(0 == prctl(PR_GET_SECCOMP)); return NULL; } static void* run_thread(__attribute__((unused)) void* p) { atomic_printf("EXIT-"); return NULL; } int main(void) { struct sigaction sa; pthread_t thread; pthread_t w_thread; char ch; test_assert(0 == pipe(pipe_fds)); sa.sa_sigaction = handler; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_SIGINFO; sigaction(SIGSYS, &sa, NULL); pthread_create(&w_thread, NULL, waiting_thread, NULL); /* Prepare syscallbuf patch path. Need to do this after pthread_create since when we have more than one thread we take a different syscall path... */ open("/dev/null", O_RDONLY); test_assert(0 == prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); test_assert(1 == prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0)); install_filter(); test_assert(2 == prctl(PR_GET_SECCOMP)); test_assert(1 == write(pipe_fds[1], "c", 1)); pthread_join(w_thread, NULL); test_assert(-1 == syscall(SYS_pipe, pipe_fds)); test_assert(ESRCH == errno); /* Spawning a thread will execute an rrcall_init_buffers syscall, which our filter tries to block but shouldn't be able to. */ pthread_create(&thread, NULL, run_thread, NULL); pthread_join(thread, NULL); /* Check that the ioctls used by syscallbuf aren't blocked */ test_assert(1 == write(pipe_fds[1], "c", 1)); test_assert(1 == read(pipe_fds[0], &ch, 1)); test_assert(1 == write(pipe_fds[1], "c", 1)); test_assert(1 == read(pipe_fds[0], &ch, 1)); syscall(SYS_geteuid); open("/dev/null", O_RDONLY); test_assert(count_SIGSYS == 2); atomic_puts("SUCCESS"); return 0; } rr-4.4.0/src/test/seccomp_null.c000066400000000000000000000006461277367620400165630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int ret = syscall(RR_seccomp, SECCOMP_SET_MODE_FILTER, 0, NULL); if (ret == -1 && errno == ENOSYS) { ret = prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, NULL); } test_assert(ret == -1 && errno == EFAULT); test_assert(0 == prctl(PR_GET_SECCOMP)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/seccomp_tsync.c000066400000000000000000000027511277367620400167500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static void install_filter(void) { struct sock_filter filter[] = { /* Allow all system calls */ BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW) }; struct sock_fprog prog = { .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])), .filter = filter, }; int ret; ret = syscall(RR_seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, &prog); if (ret == -1 && errno == ENOSYS) { atomic_puts("seccomp syscall not supported"); atomic_puts("EXIT-SUCCESS"); exit(0); } test_assert(ret == 0); } static void* waiting_thread(__attribute__((unused)) void* p) { char buf; test_assert(1 == read(pipe_fds[0], &buf, 1)); /* Check this thread *was* affected by SECCOMP_FILTER_FLAG_TSYNC */ test_assert(2 == prctl(PR_GET_SECCOMP)); return NULL; } int main(void) { pthread_t w_thread; test_assert(0 == pipe(pipe_fds)); pthread_create(&w_thread, NULL, waiting_thread, NULL); /* Prepare syscallbuf patch path. Need to do this after pthread_create since when we have more than one thread we take a different syscall path... */ test_assert(0 == prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)); install_filter(); test_assert(2 == prctl(PR_GET_SECCOMP)); test_assert(1 == write(pipe_fds[1], "c", 1)); pthread_join(w_thread, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/segfault.c000066400000000000000000000007451277367620400157120ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(int sig) { atomic_printf("caught signal %d, exiting\n", sig); _exit(0); } static void breakpoint(void) { int break_here = 1; (void)break_here; } int main(void) { signal(SIGSEGV, sighandler); breakpoint(); /* NO SYSCALLS BETWEEN HERE AND SEGFAULT BELOW: next event to * replay must be the signal. */ *((volatile int*)0) = 0; return 0; } rr-4.4.0/src/test/segfault.run000066400000000000000000000001051277367620400162620ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test 'caught signal 11, exiting' rr-4.4.0/src/test/self_sigint.c000066400000000000000000000004441277367620400164020ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { /* rr should ignore SIGINT */ kill(getppid(), SIGINT); atomic_puts("EXIT-SUCCESS"); kill(getpid(), SIGINT); test_assert(0 && "Shouldn't reach here"); return 0; } rr-4.4.0/src/test/sem.c000066400000000000000000000072731277367620400146670ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define COUNT 4 static int semid; static char* shmem; #ifdef _SEM_SEMUN_UNDEFINED union semun { int val; struct semid_ds* buf; unsigned short int* array; struct seminfo* __buf; }; #endif static int run_child(void) { int child2; int status; struct sembuf ops[2]; struct timespec ts = { 0, 20000000 }; struct timespec ts_short = { 0, 10000000 }; struct timespec ts_long = { 10000, 0 }; union semun un_arg; struct semid_ds* ds; struct seminfo* si; unsigned short* array; ops[0].sem_num = 0; ops[0].sem_op = 1; ops[0].sem_flg = SEM_UNDO; ops[1].sem_num = 1; ops[1].sem_op = 1; ops[1].sem_flg = SEM_UNDO; test_assert(0 == semop(semid, ops, 2)); *shmem = 0; ALLOCATE_GUARD(ds, 'd'); un_arg.buf = ds; test_assert(0 == semctl(semid, 0, IPC_STAT, un_arg)); VERIFY_GUARD(ds); test_assert(ds->sem_perm.mode == 0666); test_assert(ds->sem_nsems == COUNT); ds->sem_perm.mode = 0660; test_assert(0 == semctl(semid, 0, IPC_SET, un_arg)); ALLOCATE_GUARD(si, 'i'); un_arg.__buf = si; /* The following syscall should always return >= 1, but sometimes it returns 0. I don't know why. */ test_assert(0 <= semctl(semid, 0, IPC_INFO, un_arg)); VERIFY_GUARD(si); test_assert(si->semvmx > 0); test_assert(si->semusz < 100000); /* The following syscall should always return >= 1, but sometimes it returns 0. I don't know why. */ test_assert(0 <= semctl(semid, 0, SEM_INFO, un_arg)); VERIFY_GUARD(si); test_assert(si->semusz > 0); test_assert(si->semusz < 100000); array = allocate_guard(COUNT * sizeof(*array), 'a'); un_arg.array = array; test_assert(0 == semctl(semid, 0, GETALL, un_arg)); verify_guard(COUNT * sizeof(*array), array); test_assert(array[0] == 1); test_assert(array[1] == 1); test_assert(array[2] == 0); test_assert(array[3] == 0); array[2] = 2; test_assert(0 == semctl(semid, 0, SETALL, un_arg)); test_assert(0 == semctl(semid, 1, GETNCNT, NULL)); test_assert(getpid() == semctl(semid, 1, GETPID, NULL)); test_assert(2 == semctl(semid, 2, GETVAL, NULL)); test_assert(0 == semctl(semid, 0, GETZCNT, NULL)); un_arg.val = 0; test_assert(0 == semctl(semid, 2, SETVAL, un_arg)); if ((child2 = fork()) == 0) { ops[0].sem_op = -1; ops[1].sem_op = -1; /* The semtimedop timeout is irrelevant. We're just checking that the syscall works. */ test_assert(0 == semtimedop(semid, ops, 2, &ts_long)); *shmem = 1; test_assert(0 == nanosleep(&ts, NULL)); *shmem = 0; ops[0].sem_op = 1; ops[1].sem_op = 1; test_assert(0 == semtimedop(semid, ops, 2, &ts)); return 0; } test_assert(0 == nanosleep(&ts_short, NULL)); ops[0].sem_op = -1; ops[1].sem_op = -1; test_assert(0 == semop(semid, ops, 2)); test_assert(*shmem == 0); ops[0].sem_op = 1; ops[1].sem_op = 1; test_assert(0 == semop(semid, ops, 2)); test_assert(child2 == waitpid(child2, &status, __WALL)); test_assert(0 == status); return 0; } int main(void) { pid_t child; int status; shmem = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0); test_assert(shmem != (void*)-1); semid = semget(IPC_PRIVATE, COUNT, 0666); test_assert(semid >= 0); if ((child = fork()) == 0) { return run_child(); } atomic_printf("child %d\n", child); test_assert(child == waitpid(child, &status, __WALL)); /* delete the sem before testing status, because we want to ensure the segment is deleted even if the test failed. */ test_assert(0 == semctl(semid, 0, IPC_RMID, NULL)); test_assert(status == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sendfile.c000066400000000000000000000027201277367620400156640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TOKEN "ABC" #define TOKEN_SIZE sizeof(TOKEN) static const char token_file[] = "rr-sendfile-file.txt"; static const char token_file_out[] = "rr-sendfile-file-out.txt"; void verify_token(int fd) { ssize_t len; char buf[TOKEN_SIZE]; len = read(fd, buf, sizeof(buf)); if (len != TOKEN_SIZE || strcmp(buf, TOKEN)) { atomic_puts("Internal error: FAILED: sendfile wrote the wrong data"); exit(1); } atomic_puts("Got expected token " TOKEN); } int main(void) { int filefd; int filefd_out; loff_t off = 0; filefd = open(token_file, O_RDWR | O_CREAT | O_TRUNC, 0600); filefd_out = open(token_file, O_RDWR | O_CREAT | O_TRUNC, 0600); write(filefd, TOKEN, TOKEN_SIZE); sendfile64(filefd_out, filefd, &off, TOKEN_SIZE); atomic_printf( "sendfile %zu bytes from %d to %d; off changed from 0 to %" PRId64 "\n", TOKEN_SIZE, filefd, filefd_out, off); lseek(filefd_out, 0, SEEK_SET); verify_token(filefd_out); lseek(filefd, 0, SEEK_SET); sendfile64(filefd_out, filefd, NULL, TOKEN_SIZE); atomic_printf("sendfile %zu bytes from %d to %d\n", TOKEN_SIZE, filefd, filefd_out); lseek(filefd_out, 0, SEEK_SET); verify_token(filefd_out); /* The test driver will clean up after us if the test failed * before this. */ unlink(token_file); unlink(token_file_out); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/set_ptracer.c000066400000000000000000000003431277367620400164050ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { test_assert(0 == prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/set_tid_address.c000066400000000000000000000021551277367620400172350ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int v; static int* p; static int pipe_fds[2]; static void* run_thread(__attribute__((unused)) void* p) { char ch; test_assert(1 == read(pipe_fds[0], &ch, 1)); test_assert(sys_gettid() == syscall(SYS_set_tid_address, &v)); return NULL; } static void* run_thread2(__attribute__((unused)) void* q) { test_assert(sys_gettid() == syscall(SYS_set_tid_address, p)); test_assert(1 == write(pipe_fds[1], "x", 1)); return NULL; } int main(void) { pthread_t thread; char ch; test_assert(0 == pipe(pipe_fds)); v = 1; pthread_create(&thread, NULL, run_thread, NULL); test_assert(1 == write(pipe_fds[1], "x", 1)); test_assert(0 == syscall(SYS_futex, &v, FUTEX_WAIT, 1, NULL, NULL, 0)); test_assert(0 == v); p = mmap(NULL, PAGE_SIZE, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); test_assert(0 == munmap(p, PAGE_SIZE)); pthread_create(&thread, NULL, run_thread2, NULL); test_assert(1 == read(pipe_fds[0], &ch, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/setgid.c000066400000000000000000000004351277367620400153530ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { gid_t gid = getgid(); int err = setgid(gid); atomic_printf("setgid returned: %d\n", err); test_assert(0 == err); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/setgroups.c000066400000000000000000000017111277367620400161250ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include int main(void) { gid_t old_groups[1024]; gid_t new_groups[1024]; int i; int ret; int num_groups = getgroups(ALEN(old_groups), old_groups); test_assert(num_groups >= 0); /* make sure we have some new groups for setgroups() */ for (i = 0; i < num_groups; ++i) { new_groups[i] = old_groups[i] + 1; } if (num_groups == 0) { new_groups[0] = getegid(); num_groups = 1; } ret = setgroups(num_groups, new_groups); if (ret == -1) { test_assert(errno == EPERM); atomic_puts("Test did nothing because process does not have CAP_SETGID?"); atomic_puts("EXIT-SUCCESS"); return 0; } else { test_assert(getgroups(ALEN(old_groups), old_groups) == num_groups); for (i = 0; i < num_groups; ++i) { test_assert(new_groups[i] == old_groups[i]); } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/setitimer.c000066400000000000000000000014161277367620400161010ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct itimerval* v1; struct itimerval* v2; struct itimerval* v3; ALLOCATE_GUARD(v1, 0); v1->it_interval.tv_sec = 10000; v1->it_interval.tv_usec = 0; v1->it_value.tv_sec = 10000; v1->it_value.tv_usec = 0; test_assert(0 == setitimer(ITIMER_REAL, v1, NULL)); VERIFY_GUARD(v1); ALLOCATE_GUARD(v2, 1); test_assert(0 == setitimer(ITIMER_REAL, v1, v2)); test_assert(v2->it_interval.tv_sec == v1->it_interval.tv_sec); VERIFY_GUARD(v2); ALLOCATE_GUARD(v3, 2); test_assert(0 == getitimer(ITIMER_REAL, v3)); test_assert(v3->it_interval.tv_sec == v1->it_interval.tv_sec); VERIFY_GUARD(v3); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/setsid.c000066400000000000000000000004271277367620400153700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t newsid; newsid = setsid(); atomic_printf("New session ID: %d\n", newsid); if (newsid >= 0) { atomic_puts("EXIT-SUCCESS"); } return 0; } rr-4.4.0/src/test/setuid.c000066400000000000000000000025241277367620400153720ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #include int main(int argc, char** argv) { uid_t orig; uid_t new; gid_t orig_g; gid_t new_g; int ret; struct passwd* p = getpwnam("nobody"); struct group* g = getgrnam("nobody"); pid_t child; int status; if (argc > 1) { return 77; } orig = getuid(); test_assert(0 == setuid(orig)); orig_g = getgid(); new = p && p->pw_uid != orig ? p->pw_uid : orig + 1; new_g = g && g->gr_gid != orig_g ? g->gr_gid : orig_g + 1; ret = setgid(new_g); if (ret == -1) { test_assert(errno == EPERM); atomic_puts("Test did nothing because process does not have CAP_SETUID?"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(0 == setgroups(0, NULL)); test_assert(getgid() == new_g); test_assert(0 == setuid(new)); test_assert(getuid() == new); child = fork(); if (!child) { char* args[] = { argv[0], "dummy", NULL }; execve(argv[0], args, environ); test_assert(errno == EACCES); atomic_printf( "We can't reexecute %s because it's not executable by 'nobody'\n", argv[0]); return 77; } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/shared_map.c000066400000000000000000000022531277367620400161770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = open("tmp.txt", O_RDWR | O_CREAT | O_EXCL, 0700); char buf[PAGE_SIZE]; char* p; char* q; pid_t child; int status; test_assert(fd >= 0); memset(buf, 1, sizeof(buf)); test_assert(PAGE_SIZE == write(fd, buf, PAGE_SIZE)); test_assert(0 == close(fd)); fd = open("tmp.txt", O_RDWR); p = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); test_assert(p != MAP_FAILED); test_assert(p[0] == 1); test_assert(p[9] == 1); test_assert(p[10] == 1); memset(p, 2, 10); child = fork(); if (!child) { q = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); test_assert(q != MAP_FAILED); test_assert(q[0] == 2); test_assert(q[9] == 2); test_assert(q[10] == 1); return 77; } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); memset(buf, 3, 10); test_assert(10 == pwrite(fd, buf, 10, 0)); test_assert(0 == fsync(fd)); test_assert(0 == close(fd)); test_assert(0 == unlink("tmp.txt")); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/shared_map.run000066400000000000000000000001201277367620400165500ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME replay replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/shared_persistent_file.c000066400000000000000000000010431277367620400206150ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} int main(void) { int fd = open("/bin/sh", O_RDONLY); void* p = mmap(NULL, 4096, PROT_READ, MAP_SHARED, fd, 0); pid_t pid; int status; test_assert(fd >= 0); test_assert(p != MAP_FAILED); pid = fork(); breakpoint(); if (!pid) { return 77; } test_assert(pid == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/shared_persistent_file.py000066400000000000000000000004651277367620400210320ustar00rootroot00000000000000from rrutil import * import re send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('check') expect_gdb('Checkpoint 1 at') send_gdb('c') expect_gdb('xited normally') send_gdb('restart 1') expect_gdb('stopped') send_gdb('c') expect_gdb('xited normally') ok() rr-4.4.0/src/test/shared_persistent_file.run000066400000000000000000000000471277367620400212020ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/shm.c000066400000000000000000000050071277367620400146630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Make SIZE not a multiple of the page size, to ensure we handle that case. But make sure it's even, since we divide it by two. */ #define SIZE ((int)(16 * PAGE_SIZE) - 10) static int shmid; static void before_writing(void) {} static void after_writing(void) {} static int run_child(void) { int i; char* p; char* p2; pid_t child2; int status; struct shmid_ds* ds; struct shminfo* info; struct shm_info* info2; ALLOCATE_GUARD(ds, 'd'); test_assert(0 == shmctl(shmid, IPC_STAT, ds)); VERIFY_GUARD(ds); test_assert((int)ds->shm_segsz == SIZE); test_assert(ds->shm_cpid == getppid()); test_assert(ds->shm_nattch == 0); ds->shm_perm.mode = 0660; test_assert(0 == shmctl(shmid, IPC_SET, ds)); ALLOCATE_GUARD(info, 'i'); test_assert(0 <= shmctl(shmid, IPC_INFO, (struct shmid_ds*)info)); VERIFY_GUARD(info); test_assert(info->shmmin == 1); ALLOCATE_GUARD(info2, 'j'); test_assert(0 <= shmctl(shmid, SHM_INFO, (struct shmid_ds*)info2)); VERIFY_GUARD(info2); test_assert(info2->used_ids > 0); test_assert(info2->used_ids < 1000000); p = shmat(shmid, NULL, 0); test_assert(p != (char*)-1); before_writing(); for (i = 0; i < SIZE; ++i) { test_assert(p[i] == 0); } memset(p, 'r', SIZE / 2); after_writing(); p2 = shmat(shmid, NULL, 0); test_assert(p2 != (char*)-1); memset(p + SIZE / 2, 'r', SIZE / 2); test_assert(0 == shmdt(p)); test_assert(0 == shmdt(p2)); test_assert(p == mmap(p, SIZE, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0)); test_assert(p[0] == 0); p = shmat(shmid, p, SHM_REMAP); test_assert(p != (char*)-1); for (i = 0; i < SIZE; ++i) { test_assert(p[i] == 'r'); } if ((child2 = fork()) == 0) { memset(p, 's', SIZE); return 0; } test_assert(child2 == waitpid(child2, &status, __WALL)); test_assert(0 == status); for (i = 0; i < SIZE; ++i) { test_assert(p[i] == 's'); } return 0; } int main(void) { pid_t child; int status; shmid = shmget(IPC_PRIVATE, SIZE, 0666); test_assert(shmid >= 0); if ((child = fork()) == 0) { return run_child(); } atomic_printf("child %d\n", child); test_assert(child == waitpid(child, &status, __WALL)); /* delete the shm before testing status, because we want to ensure the segment is deleted even if the test failed. */ test_assert(0 == shmctl(shmid, IPC_RMID, NULL)); test_assert(status == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/shm_checkpoint.py000066400000000000000000000006411277367620400172770ustar00rootroot00000000000000from rrutil import * send_gdb('b before_writing') expect_gdb('Breakpoint 1') send_gdb('b after_writing') expect_gdb('Breakpoint 2') send_gdb('c'); expect_gdb('Breakpoint 1, before_writing') send_gdb('checkpoint'); expect_gdb('Checkpoint 1 at'); send_gdb('c'); expect_gdb('Breakpoint 2, after_writing') send_gdb('restart 1'); expect_gdb('stopped') send_gdb('c'); expect_gdb('Breakpoint 2, after_writing') ok() rr-4.4.0/src/test/shm_checkpoint.run000066400000000000000000000002171277367620400174520ustar00rootroot00000000000000source `dirname $0`/util.sh record shm$bitness TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') debug shm_checkpoint "-f $TARGET_PID" rr-4.4.0/src/test/sigaction_old.c000066400000000000000000000020751277367620400167140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handler1(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* p) {} static void handler2(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* p) {} static void handler3(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* p) {} int main(void) { struct sigaction sa; struct sigaction old_sa; sa.sa_sigaction = handler1; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_SIGINFO; sigaction(SIGUSR1, &sa, NULL); sa.sa_sigaction = handler2; old_sa.sa_sigaction = handler3; sigaction(SIGUSR1, &sa, &old_sa); test_assert(old_sa.sa_sigaction == handler1); sigaction(SIGUSR1, NULL, &old_sa); test_assert(old_sa.sa_sigaction == handler2); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigaltstack.c000066400000000000000000000011411277367620400164000ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char buf[128 * 1024]; int main(void) { stack_t* ss; stack_t* oss; ALLOCATE_GUARD(ss, 'x'); ss->ss_sp = buf; ss->ss_flags = 0; ss->ss_size = sizeof(buf); test_assert(0 == sigaltstack(ss, NULL)); VERIFY_GUARD(ss); ALLOCATE_GUARD(oss, 'y'); test_assert(0 == sigaltstack(ss, oss)); test_assert(oss->ss_sp == buf); test_assert(oss->ss_flags == 0); test_assert(oss->ss_size == sizeof(buf)); VERIFY_GUARD(ss); VERIFY_GUARD(oss); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigchld_interrupt_signal.c000066400000000000000000000011041277367620400211540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t c; int dummy = 0, i; int status; atomic_puts("forking child"); if (0 == (c = fork())) { usleep(10000); atomic_puts("child exiting"); exit(0); } /* NO SYSCALLS AFTER HERE! (Up to the test_asserts.) */ for (i = 1; i < (1 << 28); ++i) { dummy += (dummy + i) % 9735; } test_assert(c == waitpid(c, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigcont.c000066400000000000000000000007131277367620400155410ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handle_sig(__attribute__((unused)) int sig) {} int main(void) { signal(SIGTTIN, handle_sig); kill(getpid(), SIGTTIN); signal(SIGTTOU, handle_sig); kill(getpid(), SIGTTOU); signal(SIGTSTP, handle_sig); kill(getpid(), SIGTSTP); signal(SIGCONT, handle_sig); kill(getpid(), SIGCONT); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sighandler_fork.c000066400000000000000000000011731277367620400172350ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(int sig) { atomic_printf("caught signal %d, exiting\n", sig); } int main(void) { pid_t c; signal(SIGCHLD, sighandler); atomic_puts("forking child"); if (0 == (c = fork())) { // Child usleep(10000); atomic_puts("forking grandchild"); if (0 == (c = fork())) { // Grandchild usleep(10000); exit(0); } waitpid(c, NULL, 0); return 0; } // Because why not. signal(SIGCHLD, NULL); waitpid(c, NULL, 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigill.c000066400000000000000000000006351277367620400153610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(int sig) { atomic_printf("caught signal %d, exiting\n", sig); atomic_puts("EXIT-SUCCESS"); _exit(0); } int main(void) { signal(SIGILL, sighandler); atomic_puts("running undefined instruction ..."); __asm__("ud2"); test_assert("should have terminated!" && 0); return 0; } rr-4.4.0/src/test/signal_checkpoint.py000066400000000000000000000005271277367620400177700ustar00rootroot00000000000000from rrutil import * send_gdb('b sighandler') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Program received signal SIGILL') expect_gdb('ud2') send_gdb('checkpoint') expect_gdb('Checkpoint 1 at') send_gdb('c') expect_gdb('Breakpoint 1, sighandler') send_gdb("restart 1"); send_gdb('c') expect_gdb('Breakpoint 1, sighandler') ok() rr-4.4.0/src/test/signal_checkpoint.run000066400000000000000000000001121277367620400201320ustar00rootroot00000000000000source `dirname $0`/util.sh record sigill$bitness debug signal_checkpoint rr-4.4.0/src/test/signal_deferred.c000066400000000000000000000012251277367620400172070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child = fork(); int status; if (!child) { int pipe_fds[2]; test_assert(0 == pipe(pipe_fds)); test_assert(0 == close(pipe_fds[0])); /* Trigger a SIGPIPE inside the syscallbuf. The signal will have to be deferred until the syscallbuf has returned. */ write(pipe_fds[1], "x", 1); test_assert(0 && "Should not reach here"); return 0; } test_assert(child == wait(&status)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGPIPE); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/signal_numbers.c000066400000000000000000000014201277367620400170770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int sig; for (sig = 1; sig <= 64; ++sig) { struct sigaction sa; /* Skip signals that are fatal and can't be ignored, and skip signals that rr uses for itself. */ if (sig == SIGKILL || sig == SIGSTOP || sig == SIGSTKFLT || sig == SIGPWR) { continue; } sa.sa_handler = SIG_IGN; sa.sa_flags = 0; sa.sa_restorer = NULL; sigemptyset(&sa.sa_mask); /* Avoid libc wrappers since glibc won't let us send certain signals that it reserves for itself */ test_assert(0 == syscall(SYS_rt_sigaction, sig, &sa, NULL, 8)); test_assert(0 == kill(getpid(), sig)); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/signal_numbers.py000066400000000000000000000014441277367620400173130ustar00rootroot00000000000000from rrutil import * gdb_signals = [ '', 'SIGHUP', 'SIGINT', 'SIGQUIT', 'SIGILL', 'SIGTRAP', 'SIGABRT', 'SIGBUS', 'SIGFPE', '#SIGKILL', 'SIGUSR1', 'SIGSEGV', 'SIGUSR2', 'SIGPIPE', 'SIGALRM', 'SIGTERM', '#SIGSTKFLT', 'SIGCHLD', 'SIGCONT', '#SIGSTOP', 'SIGTSTP', 'SIGTTIN', 'SIGTTOU', 'SIGURG', 'SIGXCPU', 'SIGXFSZ', 'SIGVTALRM', 'SIGPROF', 'SIGWINCH', 'SIGIO', '#SIGPWR', 'SIGSYS'] for sig in xrange(32,65): gdb_signals.append('SIG%d'%sig) for sig in xrange(1,65): gdb_sig = gdb_signals[sig] if not gdb_sig.startswith('#'): send_gdb('handle %s stop'%gdb_sig) if gdb_sig == 'SIGINT' or gdb_sig == 'SIGTRAP': send_gdb('y') send_gdb('c') expect_gdb('received signal %s'%gdb_sig) ok() rr-4.4.0/src/test/signal_numbers.run000066400000000000000000000000471277367620400174650ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/signal_stop.py000066400000000000000000000003241277367620400166210ustar00rootroot00000000000000from rrutil import * send_gdb('b sighandler') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Program received signal SIGILL') expect_gdb('ud2') send_gdb('c') expect_gdb('Breakpoint 1, sighandler') ok() rr-4.4.0/src/test/signal_stop.run000066400000000000000000000001041277367620400167710ustar00rootroot00000000000000source `dirname $0`/util.sh record sigill$bitness debug signal_stop rr-4.4.0/src/test/signal_unstoppable.c000066400000000000000000000010251277367620400177610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handler(__attribute__((unused)) int sig) {} int main(void) { sigset_t sigs; sigemptyset(&sigs); sigaddset(&sigs, SIGKILL); sigprocmask(SIG_BLOCK, &sigs, NULL); signal(SIGKILL, SIG_IGN); signal(SIGKILL, handler); sigemptyset(&sigs); sigaddset(&sigs, SIGSTOP); sigprocmask(SIG_BLOCK, &sigs, NULL); signal(SIGSTOP, SIG_IGN); signal(SIGSTOP, handler); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/signalfd.c000066400000000000000000000011371277367620400156630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { sigset_t mask; int fd; struct signalfd_siginfo si; test_assert(0 == sigemptyset(&mask)); test_assert(0 == sigaddset(&mask, SIGURG)); fd = signalfd(-1, &mask, 0); test_assert(fd >= 0); test_assert(0 == sigprocmask(SIG_BLOCK, &mask, NULL)); test_assert(0 == kill(getpid(), SIGURG)); test_assert(sizeof(si) == read(fd, &si, sizeof(si))); test_assert(si.ssi_signo == SIGURG); test_assert((pid_t)si.ssi_pid == getpid()); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigprocmask.c000066400000000000000000000015661277367620400164240ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int signals_unblocked; static void handle_usr1(__attribute__((unused)) int sig) { atomic_puts("Caught usr1"); test_assert(signals_unblocked); } int main(void) { sigset_t mask, oldmask; int i, err, dummy = 0; signal(SIGUSR1, handle_usr1); sigemptyset(&mask); sigaddset(&mask, SIGUSR1); /* The libc function invokes rt_sigprocmask. */ err = sigprocmask(SIG_BLOCK, &mask, &oldmask); test_assert(err == 0); raise(SIGUSR1); for (i = 0; i < 1 << 25; ++i) { dummy += (dummy + i) % 9735; } signals_unblocked = 1; /* Some systems only have rt_sigprocmask. */ #if defined(SYS_sigprocmask) syscall(SYS_sigprocmask, SIG_SETMASK, &oldmask, NULL); #else sigprocmask(SIG_SETMASK, &oldmask, NULL); #endif atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigprocmask_in_syscallbuf_sighandler.c000066400000000000000000000020131277367620400235250ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; static void handle_signal(__attribute__((unused)) int sig) { sigset_t mask; atomic_puts("Caught SIGALRM"); sigemptyset(&mask); sigaddset(&mask, SIGUSR1); test_assert(0 == sigprocmask(SIG_BLOCK, &mask, NULL)); /* Syscallbuf should be still locked here. If it's not this could corrupt syscallbuf state. */ test_assert(2 == write(pipe_fds[1], "xx", 2)); } int main(void) { struct sigaction sact; char buf; test_assert(0 == pipe(pipe_fds)); sigemptyset(&sact.sa_mask); sact.sa_flags = SA_RESTART; sact.sa_handler = handle_signal; test_assert(0 == sigaction(SIGALRM, &sact, NULL)); test_assert(0 == alarm(1)); /* If the syscallbuf state is corrupted by the signal handler we'll probably crash out here. */ test_assert(1 == read(pipe_fds[0], &buf, 1)); /* Or here */ test_assert(1 == read(pipe_fds[0], &buf, 1)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigprocmask_rr_sigs.c000066400000000000000000000007541277367620400201520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { sigset_t mask, oldmask; int err; sigfillset(&mask); /* SIGPWR is used internally by rr, and we won't be able to turn it off. rr shouldn't observably change `mask` when it does this though */ err = sigprocmask(SIG_BLOCK, &mask, &oldmask); test_assert(err == 0); test_assert(sigismember(&mask, SIGPWR) == 1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigprocmask_syscallbuf.c000066400000000000000000000013251277367620400206440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int pipe_fds[2]; int main(void) { char buf; pid_t pid; int status; sigset_t mask; test_assert(0 == pipe(pipe_fds)); sigemptyset(&mask); sigfillset(&mask); test_assert(0 == sigprocmask(SIG_BLOCK, &mask, NULL)); /* Check that even when all signals are supposedly blocked, syscallbuf still works */ pid = fork(); if (!pid) { test_assert(1 == write(pipe_fds[1], "y", 1)); return 77; } test_assert(1 == read(pipe_fds[0], &buf, 1)); test_assert(pid == wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigqueueinfo.c000066400000000000000000000027061277367620400166020ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void queue_siginfo(int sig, int val) { siginfo_t si; memset(&si, 0, sizeof(si)); si.si_code = SI_QUEUE; si.si_pid = getpid(); si.si_uid = geteuid(); si.si_value.sival_int = val; syscall(SYS_rt_sigqueueinfo, getpid(), sig, &si); } static void queue_siginfo_tg(int sig, int val) { siginfo_t si; memset(&si, 0, sizeof(si)); si.si_code = SI_QUEUE; si.si_pid = getpid(); si.si_uid = geteuid(); si.si_value.sival_int = val; syscall(SYS_rt_tgsigqueueinfo, getpid(), getpid(), sig, &si); } static int usr1_val; static int usr2_val; static void handle_signal(int sig, siginfo_t* si, __attribute__((unused)) void* ctx) { int val = si->si_value.sival_int; if (SIGUSR1 == sig) { usr1_val = val; } else if (SIGUSR2 == sig) { usr2_val = val; } else { assert("Unexpected signal" && 0); } } int main(void) { struct sigaction sa; sa.sa_sigaction = handle_signal; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_SIGINFO; sigaction(SIGUSR1, &sa, NULL); sigaction(SIGUSR2, &sa, NULL); queue_siginfo(SIGUSR1, -42); test_assert(-42 == usr1_val); queue_siginfo(SIGUSR2, 12345); test_assert(12345 == usr2_val); queue_siginfo_tg(SIGUSR1, -43); test_assert(-43 == usr1_val); queue_siginfo_tg(SIGUSR2, 123456); test_assert(123456 == usr2_val); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigreturn.c000066400000000000000000000132461277367620400161220ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Test to ensure that sigreturn restores all necessary registers */ struct reg_ops { void (*set)(const void* p); void (*get)(void* p); }; static struct reg_ops xmm_ops[8]; static struct reg_ops st_ops[8]; /* The assignments to uint32_t* in the inline assembly statements below are because if we used *p in the asm constraints, GCC would think we were dereferencing a void pointer (!). */ #define DEFINE_XMM_HELPERS(i) \ void set_xmm##i(const void* p) { \ const uint32_t* x = p; \ asm("movaps %[ptr], %%xmm" #i : /* no outputs */ : [ptr] "m"(*x)); \ } \ void get_xmm##i(void* p) { \ uint32_t* x = p; \ asm("movaps %%xmm" #i ", %[ptr]" : [ptr] "=m"(*x) : /* no inputs */); \ } DEFINE_XMM_HELPERS(0) DEFINE_XMM_HELPERS(1) DEFINE_XMM_HELPERS(2) DEFINE_XMM_HELPERS(3) DEFINE_XMM_HELPERS(4) DEFINE_XMM_HELPERS(5) DEFINE_XMM_HELPERS(6) DEFINE_XMM_HELPERS(7) void set_st7(const void* p) { const uint32_t* x = p; asm("\tfinit\n" "\tfldt %[ptr]\n" "\tfst %%st(7)\n" : /* no outputs */ : [ptr] "m"(*x)); } void get_st7(void* p) { uint32_t* x = p; asm("\tfdecstp\n" "\tfstpt %[ptr]\n" : [ptr] "=m"(*x) : /* no inputs */); } #define DEFINE_ST_HELPERS(i) \ void set_st##i(const void* p) { \ const uint32_t* x = p; \ asm("\tfinit\n" \ "\tfldt %[ptr]\n" \ "\tfst %%st(" #i ")\n" \ : /* no outputs */ \ : [ptr] "m"(*x)); \ } \ void get_st##i(void* p) { \ uint32_t* x = p; \ asm("\tfld %%st(" #i ")\n" \ "\tfstpt %[ptr]\n" \ : [ptr] "=m"(*x) \ : /* no inputs */); \ } DEFINE_ST_HELPERS(0) DEFINE_ST_HELPERS(1) DEFINE_ST_HELPERS(2) DEFINE_ST_HELPERS(3) DEFINE_ST_HELPERS(4) DEFINE_ST_HELPERS(5) DEFINE_ST_HELPERS(6) static void init(void) { #define INIT(i) \ xmm_ops[i].set = set_xmm##i; \ xmm_ops[i].get = get_xmm##i; \ st_ops[i].set = set_st##i; \ st_ops[i].get = get_st##i; INIT(0) INIT(1) INIT(2) INIT(3) INIT(4) INIT(5) INIT(6) INIT(7) } #define GOOD 0x12345678 #define BAD 0xFEDCBA98 #define XMM_SIZE 16 #define XMM_ALIGNMENT __attribute__((aligned(XMM_SIZE))) static const int xmm_good[XMM_SIZE / sizeof(int)] XMM_ALIGNMENT = { GOOD, GOOD + 1, GOOD + 2, GOOD + 3 }; static const int xmm_bad[XMM_SIZE / sizeof(int)] XMM_ALIGNMENT = { BAD, BAD + 1, BAD + 2, BAD + 3 }; #define ST_SIZE 10 static long double st_good = 12345678.90; static long double st_bad = -1.23456789; static int regnum; static void handle_usr1_xmm(__attribute__((unused)) int sig) { int xmm[XMM_SIZE / sizeof(int)] XMM_ALIGNMENT; xmm_ops[regnum].get(xmm); /* Print incoming xmm value to ensure any modifications made while entering the signal handler are replayed correctly */ atomic_printf("xmm %d incoming: %x %x %x %x\n", regnum, xmm[0], xmm[1], xmm[2], xmm[3]); /* Try to corrupt register, to see if it gets restored */ xmm_ops[regnum].set(xmm_bad); } static void handle_usr1_st(__attribute__((unused)) int sig) { char st[ST_SIZE]; st_ops[regnum].get(st); /* Print incoming st value to ensure any modifications made while entering the signal handler are replayed correctly */ atomic_printf("st %d incoming: %x %x %x\n", regnum, *((int*)(st)), *((int*)(st + 4)), *((short*)(st + 8)) & 0xffff); /* Try to corrupt register, to see if it gets restored */ st_ops[regnum].set(&st_bad); } int main(void) { init(); signal(SIGUSR1, handle_usr1_xmm); for (regnum = 0; regnum < 8; ++regnum) { int xmm[XMM_SIZE / sizeof(int)] XMM_ALIGNMENT; memcpy(xmm, xmm_bad, sizeof(xmm)); xmm_ops[regnum].set(xmm_good); raise(SIGUSR1); xmm_ops[regnum].get(xmm); test_assert("XMM register should have been preserved" && memcmp(xmm, xmm_good, sizeof(xmm)) == 0); } signal(SIGUSR1, handle_usr1_st); for (regnum = 0; regnum < 8; ++regnum) { char st[ST_SIZE]; memcpy(st, &st_bad, sizeof(st)); st_ops[regnum].set(&st_good); raise(SIGUSR1); st_ops[regnum].get(st); test_assert("ST register should have been preserved" && memcmp(st, &st_good, sizeof(st)) == 0); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigreturn_reg.c000066400000000000000000000020751277367620400167550ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int caught_sig = 0; long long v = 99; void catcher(__attribute__((unused)) int signum, __attribute__((unused)) siginfo_t* siginfo_ptr, __attribute__((unused)) void* ucontext_ptr) { #ifdef __x86_64__ ucontext_t* ctx = (ucontext_t*)ucontext_ptr; test_assert(ctx->uc_mcontext.gregs[REG_RCX] == 0); test_assert(ctx->uc_mcontext.gregs[REG_RDI] == 0); ctx->uc_mcontext.gregs[REG_RDI] = (long long)&v; #endif caught_sig = signum; } int main(void) { struct sigaction sact; long long ax = v; long long cx = 0; sigemptyset(&sact.sa_mask); sact.sa_flags = SA_SIGINFO; sact.sa_sigaction = catcher; sigaction(SIGSEGV, &sact, NULL); #ifdef __x86_64__ ax = 0; __asm__("\txor %%rdi,%%rdi\n" "\txor %%rcx,%%rcx\n" "\tmov (%%rdi),%%rax\n" : "=c"(cx), "=a"(ax) :); test_assert(caught_sig == SIGSEGV); #endif test_assert(cx == 0); test_assert(ax == v); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigreturnmask.c000066400000000000000000000027101277367620400167700ustar00rootroot00000000000000#include "rrutil.h" static void segv_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { test_assert(0 && "Should not reach here"); } static void usr1_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { ucontext_t* ctx = (ucontext_t*)context; sigaddset(&ctx->uc_sigmask, SIGSEGV); return; } static void* do_thread(__attribute__((unused)) void* p) { raise(SIGUSR1); // just a strange way to spell sigprocmask // Generate SIGSEGV. Can't use raise, because that will be blocked (*(int*)1) = 0; test_assert(0 && "Should not reach here!"); return NULL; } int main(void) { pid_t child; int status; pthread_t thread; if ((child = fork()) == 0) { struct sigaction act; act.sa_sigaction = segv_handler; act.sa_flags = SA_ONSTACK | SA_SIGINFO; sigemptyset(&act.sa_mask); sigaction(SIGSEGV, &act, NULL); act.sa_sigaction = usr1_handler; sigaction(SIGUSR1, &act, NULL); pthread_create(&thread, NULL, do_thread, NULL); test_assert(0 == sched_yield()); sleep(1000); test_assert(0 && "Should not reach here"); return 0; } test_assert(child == wait(&status)); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigrt.c000066400000000000000000000027211277367620400152240ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } static int num_signals_caught; static void handle_sigrt(int sig) { atomic_printf("Caught signal %d\n", sig); ++num_signals_caught; } static void my_raise(int sig) { /* Don't call raise() directly, since that can go through our syscall hooks which mess up gdb's reverse-finish slightly. */ #ifdef __i386__ int tid = getpid(); /* Use a special instruction after the syscall to make sure we don't patch it */ __asm__ __volatile__("xchg %%ebx,%%edi\n\t" "int $0x80\n\t" "xchg %%ebx,%%edi\n\t" ::"a"(SYS_tgkill), "c"(tid), "d"(sig), "D"(tid)); #elif defined(__x86_64__) int tid = getpid(); /* Use a special instruction after the syscall to make sure we don't patch it */ __asm__ __volatile__("syscall\n\t" "xchg %%rdx,%%rdx\n\t" ::"a"(SYS_tgkill), "D"(tid), "S"(tid), "d"(sig)); #else raise(sig); #endif } int main(void) { int i; for (i = SIGRTMIN; i <= SIGRTMAX; ++i) { breakpoint(); signal(i, handle_sigrt); my_raise(i); } atomic_printf("caught %d signals; expected %d\n", num_signals_caught, 1 + SIGRTMAX - SIGRTMIN); test_assert(1 + SIGRTMAX - SIGRTMIN == num_signals_caught); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigstop.c000066400000000000000000000010011277367620400155520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status = -1; struct timespec ts = { 0, 50000000 }; if (0 == (child = fork())) { kill(getpid(), SIGSTOP); assert(0 && "child should not resume"); return 77; } nanosleep(&ts, NULL); test_assert(0 == waitpid(child, &status, WNOHANG)); test_assert(-1 == status); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigstop2.c000066400000000000000000000010031277367620400156360ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status = -1; struct timespec ts = { 0, 50000000 }; if (0 == (child = fork())) { nanosleep(&ts, NULL); kill(getpid(), SIGSTOP); assert(0 && "child should not resume"); return 77; } test_assert(0 == waitpid(child, &status, WNOHANG)); test_assert(-1 == status); test_assert(0 == kill(child, SIGKILL)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigsuspend.c000066400000000000000000000033451277367620400162630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* thread(__attribute__((unused)) void* p) { sigset_t mask; sigemptyset(&mask); sigaddset(&mask, SIGUSR1); sigaddset(&mask, SIGUSR2); test_assert(0 == pthread_sigmask(SIG_BLOCK, &mask, NULL)); test_assert(0 == kill(getpid(), SIGUSR1)); test_assert(0 == kill(getpid(), SIGUSR2)); return NULL; } static int usr1_hit; static int usr2_hit; static void handle_signal(int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* ctx) { if (SIGUSR1 == sig) { ++usr1_hit; } else if (SIGUSR2 == sig) { ++usr2_hit; } else { assert("Unexpected signal" && 0); } } int main(void) { struct sigaction sa; pthread_t t; sigset_t mask; int ret; struct timespec ts; siginfo_t si; sa.sa_sigaction = handle_signal; sigemptyset(&sa.sa_mask); sa.sa_flags = SA_SIGINFO; sigaction(SIGUSR1, &sa, NULL); sigaction(SIGUSR2, &sa, NULL); sigemptyset(&mask); sigaddset(&mask, SIGUSR1); sigaddset(&mask, SIGUSR2); test_assert(0 == pthread_sigmask(SIG_BLOCK, &mask, NULL)); pthread_create(&t, NULL, thread, NULL); sigemptyset(&mask); sigaddset(&mask, SIGUSR1); sigsuspend(&mask); test_assert(usr1_hit == 0); test_assert(usr2_hit == 1); test_assert(0 == sigpending(&mask)); test_assert(1 == sigismember(&mask, SIGUSR1)); test_assert(0 == sigismember(&mask, SIGUSR2)); ts.tv_sec = 5; ts.tv_nsec = 0; ret = sigtimedwait(&mask, &si, &ts); atomic_printf("Signal %d became pending\n", ret); test_assert(SIGUSR1 == ret); test_assert(si.si_signo == SIGUSR1); test_assert(si.si_code == SI_USER); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sigtrap.c000066400000000000000000000005161277367620400155450ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handle_sigtrap(__attribute__((unused)) int sig) { atomic_puts("EXIT-SUCCESS"); _exit(0); } int main(void) { signal(SIGTRAP, handle_sigtrap); atomic_puts("raising SIGTRAP ..."); raise(SIGTRAP); return 0; } rr-4.4.0/src/test/simple.c000066400000000000000000000002431277367620400153620ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/simple_script.run000066400000000000000000000001351277367620400173300ustar00rootroot00000000000000source `dirname $0`/util.sh just_record $TESTDIR/simple_script.sh replay check EXIT-SUCCESS rr-4.4.0/src/test/simple_script.sh000077500000000000000000000000351277367620400171400ustar00rootroot00000000000000#!/bin/sh echo EXIT-SUCCESS rr-4.4.0/src/test/simple_script_debug.py000066400000000000000000000002761277367620400203300ustar00rootroot00000000000000from rrutil import * send_gdb('b write') # "Make breakpoint pending on future shared library load?" send_gdb('y') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') ok() rr-4.4.0/src/test/simple_script_debug.run000066400000000000000000000001741277367620400205010ustar00rootroot00000000000000source `dirname $0`/util.sh just_record $TESTDIR/simple_script.sh debug simple_script_debug "--onprocess simple_script.sh" rr-4.4.0/src/test/simple_winch.py000066400000000000000000000005371277367620400167660ustar00rootroot00000000000000from rrutil import * # Signal all processes in the process group send_gdb('!kill -WINCH 0') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited normally') send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('run') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('!kill -WINCH 0') send_gdb('reverse-cont') expect_gdb('stopped') ok() rr-4.4.0/src/test/simple_winch.run000066400000000000000000000001051277367620400171310ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug simple_winch rr-4.4.0/src/test/sioc.c000066400000000000000000000217761277367620400150440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" const char* sockaddr_name(const struct sockaddr* addr) { const struct sockaddr_in* sin = (const struct sockaddr_in*)addr; static char str[PATH_MAX]; /* FIXME: add INET6 support (original author didn't * have ipv6 iface available to test). */ test_assert(AF_INET == addr->sa_family); return inet_ntop(AF_INET, (void*)&sin->sin_addr, str, sizeof(str)); } const char* sockaddr_hw_name(const struct sockaddr* addr) { static char str[PATH_MAX]; const unsigned char* data = (const unsigned char*)addr->sa_data; test_assert(AF_LOCAL == addr->sa_family); sprintf(str, "%02x:%02x:%02x:%02x:%02x:%02x", data[0], data[1], data[2], data[3], data[4], data[5]); return str; } /** * Fetch and print the ifconfig for this machine. Fill in * |req.ifr_name| with the first non-loopback interface name found, preferring * a wireless interface if possible. * |eth_req| returns an ethernet interface if possible. */ static void get_ifconfig(int sockfd, struct ifreq* req, struct ifreq* eth_req) { struct { struct ifreq ifaces[100]; } * ifaces; struct ifconf* ifconf; int ret; ssize_t num_ifaces; int i; int wireless_index = -1; int eth_index = -1; int non_loop_index = -1; ALLOCATE_GUARD(ifconf, 0xff); ALLOCATE_GUARD(ifaces, 'y'); ifconf->ifc_len = sizeof(*ifaces); ifconf->ifc_req = ifaces->ifaces; ret = ioctl(sockfd, SIOCGIFCONF, ifconf); VERIFY_GUARD(ifconf); VERIFY_GUARD(ifaces); num_ifaces = ifconf->ifc_len / sizeof(ifaces->ifaces[0]); test_assert(num_ifaces < 100); atomic_printf("SIOCGIFCONF(ret %d): %zd ifaces (%d bytes of ifreq)\n", ret, num_ifaces, ifconf->ifc_len); test_assert(0 == ret); test_assert(0 == (ifconf->ifc_len % sizeof(ifaces->ifaces[0]))); if (!num_ifaces) { atomic_puts("No interfaces found\n"); atomic_puts("EXIT-SUCCESS"); exit(0); } for (i = 0; i < num_ifaces; ++i) { const struct ifreq* ifc = &ifconf->ifc_req[i]; atomic_printf(" iface %d: name:%s addr:%s\n", i, ifc->ifr_name, sockaddr_name(&ifc->ifr_addr)); switch (ifc->ifr_name[0]) { case 'w': wireless_index = i; non_loop_index = i; break; case 'e': eth_index = i; non_loop_index = i; break; case 't': case 'l': break; default: non_loop_index = i; break; } } if (wireless_index >= 0) { strcpy(req->ifr_name, ifaces->ifaces[wireless_index].ifr_name); } else if (non_loop_index >= 0) { strcpy(req->ifr_name, ifaces->ifaces[non_loop_index].ifr_name); } else { strcpy(req->ifr_name, ifaces->ifaces[0].ifr_name); } if (eth_index >= 0) { strcpy(eth_req->ifr_name, ifaces->ifaces[eth_index].ifr_name); } else if (non_loop_index >= 0) { strcpy(eth_req->ifr_name, ifaces->ifaces[non_loop_index].ifr_name); } else { strcpy(eth_req->ifr_name, ifaces->ifaces[0].ifr_name); } } #define GENERIC_REQUEST_BY_NAME(nr) \ memset(&req->ifr_ifru, 0xff, sizeof(req->ifr_ifru)); \ ret = ioctl(sockfd, nr, req); \ VERIFY_GUARD(req); \ atomic_printf(#nr "(ret:%d): %s ", ret, req->ifr_name); \ test_assert(0 == ret) #define GENERIC_WIRELESS_REQUEST_BY_NAME_INTERNAL(nr, nr_str, args) \ ALLOCATE_GUARD(wreq, 'd'); \ strcpy(wreq->ifr_ifrn.ifrn_name, name); \ ret = ioctl(sockfd, nr, wreq); \ VERIFY_GUARD(wreq); \ err = errno; \ atomic_printf(nr_str "(ret:%d): %s: ", ret, wreq->ifr_name); \ if (-1 == ret) { \ atomic_printf("WARNING: %s doesn't support ioctl\n", name); \ test_assert(EOPNOTSUPP == err || EPERM == err || EINVAL == err); \ } else { \ atomic_printf args; \ atomic_puts(""); \ } \ while (0) #define GENERIC_WIRELESS_REQUEST_BY_NAME(nr, args) \ GENERIC_WIRELESS_REQUEST_BY_NAME_INTERNAL(nr, #nr, args) #define GENERIC_WIRELESS_PARAM_REQUEST_BY_NAME(nr, name) \ GENERIC_WIRELESS_REQUEST_BY_NAME_INTERNAL( \ nr, #nr, ("wireless %s:%d (fixed? %s; disabled? %s) flags:%#x", #name, \ wreq->u.name.value, wreq->u.name.fixed ? "yes" : "no", \ wreq->u.name.disabled ? "yes" : "no", wreq->u.name.flags)); int main(void) { int sockfd = socket(AF_INET, SOCK_DGRAM, 0); struct ifreq* req; struct ifreq* eth_req; char name[PATH_MAX]; int index; struct ethtool_cmd* etc; int err, ret; struct iwreq* wreq; char buf[1024]; ALLOCATE_GUARD(req, 'a'); ALLOCATE_GUARD(eth_req, 'a'); get_ifconfig(sockfd, req, eth_req); strcpy(name, req->ifr_name); req->ifr_ifindex = -1; strcpy(req->ifr_name, name); ret = ioctl(sockfd, SIOCGIFINDEX, req); VERIFY_GUARD(req); atomic_printf("SIOCGIFINDEX(ret:%d): %s index is %d\n", ret, req->ifr_name, req->ifr_ifindex); test_assert(0 == ret); test_assert(req->ifr_ifindex != -1); index = req->ifr_ifindex; memset(&req->ifr_name, 0xff, sizeof(req->ifr_name)); req->ifr_ifindex = index; ret = ioctl(sockfd, SIOCGIFNAME, req); VERIFY_GUARD(req); atomic_printf("SIOCGIFNAME(ret:%d): index %d(%s) name is %s\n", ret, index, name, req->ifr_name); test_assert(0 == ret); test_assert(!strcmp(name, req->ifr_name)); GENERIC_REQUEST_BY_NAME(SIOCGIFFLAGS); atomic_printf("flags are %#x\n", req->ifr_flags); GENERIC_REQUEST_BY_NAME(SIOCGIFADDR); atomic_printf("addr is %s\n", sockaddr_name(&req->ifr_addr)); GENERIC_REQUEST_BY_NAME(SIOCGIFDSTADDR); atomic_printf("addr is %s\n", sockaddr_name(&req->ifr_addr)); GENERIC_REQUEST_BY_NAME(SIOCGIFBRDADDR); atomic_printf("addr is %s\n", sockaddr_name(&req->ifr_addr)); GENERIC_REQUEST_BY_NAME(SIOCGIFNETMASK); atomic_printf("netmask is %s\n", sockaddr_name(&req->ifr_addr)); GENERIC_REQUEST_BY_NAME(SIOCGIFMETRIC); atomic_printf("metric is %d\n", req->ifr_metric); memset(&req->ifr_metric, 0xff, sizeof(req->ifr_metric)); ret = ioctl(sockfd, SIOCGIFMEM, req); VERIFY_GUARD(req); test_assert(-1 == ret && errno == ENOTTY); GENERIC_REQUEST_BY_NAME(SIOCGIFMTU); atomic_printf("MTU is %d\n", req->ifr_mtu); GENERIC_REQUEST_BY_NAME(SIOCGIFHWADDR); atomic_printf("hwaddr %s\n", sockaddr_hw_name(&req->ifr_addr)); memset(&req->ifr_flags, 0xff, sizeof(req->ifr_flags)); ret = ioctl(sockfd, SIOCGIFPFLAGS, req); VERIFY_GUARD(req); if (ret != -1 || errno != EINVAL) { test_assert(0 == ret); atomic_printf("SIOCGIFPFLAGS(ret:%d): %s flags are", ret, req->ifr_name); atomic_printf(" %#x\n", req->ifr_flags); } GENERIC_REQUEST_BY_NAME(SIOCGIFTXQLEN); atomic_printf("qlen is %d\n", req->ifr_qlen); ALLOCATE_GUARD(etc, 'b'); etc->cmd = ETHTOOL_GSET; req->ifr_data = (char*)&etc; ret = ioctl(sockfd, SIOCETHTOOL, req); VERIFY_GUARD(req); VERIFY_GUARD(etc); err = errno; atomic_printf("SIOCETHTOOL(ret:%d): %s ethtool data: ", ret, req->ifr_name); if (-1 == ret) { atomic_printf("WARNING: %s doesn't appear to support SIOCETHTOOL\n", name); test_assert(EOPNOTSUPP == err || EPERM == err); } else { atomic_printf("speed:%#x duplex:%#x port:%#x physaddr:%#x, maxtxpkt:%u " "maxrxpkt:%u ...\n", ethtool_cmd_speed(etc), etc->duplex, etc->port, etc->phy_address, etc->maxtxpkt, etc->maxrxpkt); } GENERIC_WIRELESS_PARAM_REQUEST_BY_NAME(SIOCGIWRATE, bitrate); GENERIC_WIRELESS_REQUEST_BY_NAME(SIOCGIWNAME, ("wireless protocol name:%s", wreq->u.name)); GENERIC_WIRELESS_REQUEST_BY_NAME(SIOCGIWMODE, (" wireless mode:%d", wreq->u.mode)); ALLOCATE_GUARD(wreq, 'e'); strcpy(wreq->ifr_ifrn.ifrn_name, name); wreq->u.essid.length = sizeof(buf); wreq->u.essid.pointer = buf; wreq->u.essid.flags = 0; ret = ioctl(sockfd, SIOCGIWESSID, wreq); VERIFY_GUARD(wreq); err = errno; atomic_printf("SIOCGIWESSID(ret:%d): %s: ", ret, wreq->ifr_name); if (-1 == ret) { atomic_printf("WARNING: %s doesn't appear to be a wireless iface\n", name); test_assert(EOPNOTSUPP == err || EPERM == err || EINVAL == err); } else { atomic_printf("wireless ESSID:%s\n", buf); } GENERIC_WIRELESS_PARAM_REQUEST_BY_NAME(SIOCGIWSENS, sens); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sock_names_opts.c000066400000000000000000000047041277367620400172660ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void client(const struct sockaddr_un* addr) { int clientfd; char c; struct sockaddr_un got_peer_addr; socklen_t got_peer_addr_len = sizeof(got_peer_addr); clientfd = socket(AF_UNIX, SOCK_STREAM, 0); test_assert(clientfd >= 0); test_assert(0 == connect(clientfd, (struct sockaddr*)addr, sizeof(*addr))); test_assert(0 == getpeername(clientfd, &got_peer_addr, &got_peer_addr_len)); test_assert(got_peer_addr_len > 0 && got_peer_addr_len <= sizeof(got_peer_addr)); test_assert(0 == memcmp(&got_peer_addr, addr, got_peer_addr_len)); test_assert(1 == read(clientfd, &c, 1)); test_assert(c == '!'); exit(7); } int main(void) { struct sockaddr_un addr; struct sockaddr_un got_name; socklen_t got_name_len = sizeof(got_name); int listenfd; int servefd; struct sockaddr_un peer_addr; socklen_t peer_addr_len = sizeof(peer_addr); pid_t child; int on = 1; int got_opt = -1; socklen_t got_opt_len = sizeof(got_opt); int status; memset(&addr, 0, sizeof(addr)); addr.sun_family = AF_UNIX; strncpy(addr.sun_path, "socket.unix", sizeof(addr.sun_path) - 1); test_assert(0 <= (listenfd = socket(AF_UNIX, SOCK_STREAM, 0))); test_assert(0 == bind(listenfd, (struct sockaddr*)&addr, sizeof(addr))); test_assert(0 == getsockname(listenfd, &got_name, &got_name_len)); test_assert(got_name_len > 0 && got_name_len <= sizeof(got_name)); test_assert(0 == memcmp(&addr, &got_name, got_name_len)); test_assert(0 == listen(listenfd, 1)); if (0 == (child = fork())) { client(&addr); test_assert("Not reached" && 0); } test_assert(0 <= (servefd = accept(listenfd, &peer_addr, &peer_addr_len))); test_assert(0 == getsockopt(servefd, SOL_SOCKET, SO_PASSCRED, &got_opt, &got_opt_len)); test_assert(got_opt_len == sizeof(got_opt)); test_assert(got_opt == 0); test_assert(0 == setsockopt(servefd, SOL_SOCKET, SO_PASSCRED, &on, sizeof(on))); test_assert(0 == getsockopt(servefd, SOL_SOCKET, SO_PASSCRED, &got_opt, &got_opt_len)); test_assert(got_opt_len == sizeof(got_opt)); test_assert(got_opt == 1); test_assert(1 == write(servefd, "!", 1)); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 7); unlink(addr.sun_path); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/spinlock_priorities.c000066400000000000000000000017471277367620400201760ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int low_priority_thread_scheduled = 0; static int low_to_high[2]; static int high_to_low[2]; static void* low_priority_thread(__attribute__((unused)) void* p) { char ch; setpriority(PRIO_PROCESS, 0, 4); test_assert(1 == write(low_to_high[1], "x", 1)); test_assert(1 == read(high_to_low[0], &ch, 1)); __sync_val_compare_and_swap(&low_priority_thread_scheduled, 0, 1); return NULL; } int main(void) { pthread_t thread; char ch; test_assert(0 == pipe(low_to_high)); test_assert(0 == pipe(high_to_low)); pthread_create(&thread, NULL, low_priority_thread, NULL); test_assert(1 == read(low_to_high[0], &ch, 1)); test_assert(1 == write(high_to_low[1], "y", 1)); test_assert(!low_priority_thread_scheduled); while (__sync_val_compare_and_swap(&low_priority_thread_scheduled, 1, 0) == 0) { } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/splice.c000066400000000000000000000026011277367620400153500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define TOKEN "ABC" #define TOKEN_SIZE sizeof(TOKEN) static const char token_file[] = "rr-splice-file.txt"; void verify_token(int fd) { ssize_t len; char buf[TOKEN_SIZE]; len = read(fd, buf, sizeof(buf)); if (len != TOKEN_SIZE || strcmp(buf, TOKEN)) { atomic_puts("Internal error: FAILED: splice wrote the wrong data"); exit(1); } atomic_puts("Got expected token " TOKEN); } int main(void) { int pipefds[2]; int filefd; loff_t off; ssize_t nmoved; filefd = open(token_file, O_RDWR | O_CREAT | O_TRUNC, 0600); pipe2(pipefds, 0 /*no flags*/); write(pipefds[1], TOKEN, TOKEN_SIZE); off = 0; nmoved = splice(pipefds[0], NULL, filefd, &off, TOKEN_SIZE, 0 /*no flags*/); atomic_printf( "spliced %zd bytes from %d to %d; off changed from 0 to %" PRId64 "\n", nmoved, pipefds[0], filefd, off); lseek(filefd, 0, SEEK_SET); verify_token(filefd); off = 0; nmoved = splice(filefd, &off, pipefds[1], NULL, TOKEN_SIZE, 0 /*no flags*/); atomic_printf( "spliced %zd bytes from %d to %d; off changed from 0 to %" PRId64 "\n", nmoved, filefd, pipefds[1], off); verify_token(pipefds[0]); /* The test driver will clean up after us if the test failed * before this. */ unlink(token_file); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stack_growth.c000066400000000000000000000007021277367620400165700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int v = 0; static void breakpoint(void) {} static void funcall(void) { char buf[2000000]; size_t i; breakpoint(); for (i = 0; i < sizeof(buf); ++i) { buf[i] = (char)i; } for (i = 0; i < sizeof(buf); ++i) { v += buf[i % 777777]; } } int main(void) { funcall(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stack_growth.py000066400000000000000000000004451277367620400170020ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('watch -l buf[100]') expect_gdb('Hardware[()/a-z ]+watchpoint 2') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 100') ok() rr-4.4.0/src/test/stack_growth.run000066400000000000000000000000471277367620400171540ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/stack_growth_after_syscallbuf.c000066400000000000000000000013131277367620400221770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int recurse(int count) { if (count == 0) { return 77; } return recurse(count - 1) * 99; } int main(void) { struct rlimit limit; int fd = open("/dev/zero", O_RDONLY); char ch; test_assert(fd >= 0); test_assert(0 == getrlimit(RLIMIT_STACK, &limit)); limit.rlim_cur = RLIM_INFINITY; /* This could fail; that's OK. We just want to try to test an unlimited stack size. */ setrlimit(RLIMIT_STACK, &limit); test_assert(1 == read(fd, &ch, 1)); test_assert(1 == read(fd, &ch, 1)); atomic_printf("recurse=%d\n", recurse(10000)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stack_growth_syscallbuf.c000066400000000000000000000007271277367620400210260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int fd; static int recurse(int n) { char ch[8]; if (n <= 0) { return 0; } /* Use a system call that goes through SYSENTER on x86-32 */ test_assert(8 == read(fd, ch, 8)); return recurse(n - 1) + ch[0]; } int main(void) { fd = open("/dev/zero", O_RDONLY); test_assert(fd >= 0); recurse(10000); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stack_growth_with_guard.c000066400000000000000000000026611277367620400210130ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char* volatile end_of_guard_addr; static volatile char got_segv; static void handler(__attribute__((unused)) int sig) { test_assert(end_of_guard_addr == mmap(end_of_guard_addr, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, -1, 0)); got_segv = 1; } int main(void) { int local_var; char* guard_addr = (char*)(((uintptr_t)&local_var) & ~((uintptr_t)PAGE_SIZE - 1)) - 262 * PAGE_SIZE; int i; test_assert(guard_addr == mmap(guard_addr, PAGE_SIZE * 128, PROT_NONE, MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE, -1, 0)); end_of_guard_addr = guard_addr + PAGE_SIZE * 128; atomic_printf("guard_addr=%p end_of_guard_addr=%p\n", guard_addr, end_of_guard_addr); /* Extend mapping close to the actual address we want to test. */ for (i = 127; i >= 5; --i) { end_of_guard_addr[PAGE_SIZE * i] = 77; } signal(SIGSEGV, handler); /* This should cause a SEGV since we should not be able to extend the stack to make it adjacent to our guard page. The handler should fire and unmap the guard page so the write can succeed. */ end_of_guard_addr[0] = 77; test_assert(got_segv); test_assert(end_of_guard_addr[0] == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stack_overflow.c000066400000000000000000000027371277367620400171330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int* depth; static int recurse(void) { int result; ++*depth; if (*depth > 10000000) { return 3; } result = recurse() * 13 + 1; --*depth; return result; } static void SEGV_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { atomic_puts( "Should not reach SEGV handler, since there's no safe altstack to use"); exit(1); } int main(void) { pid_t child; int status; depth = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0); test_assert(depth != MAP_FAILED); child = fork(); if (!child) { /* Testing shows that the output value of |depth| is not very sensitive to small values of the limit, but it's very sensitive around the 500K mark. */ struct rlimit r = { 500000, 500000 }; struct sigaction act; act.sa_sigaction = SEGV_handler; act.sa_flags = SA_SIGINFO; sigemptyset(&act.sa_mask); test_assert(0 == sigaction(SIGSEGV, &act, NULL)); test_assert(0 == setrlimit(RLIMIT_STACK, &r)); return recurse(); } atomic_printf("child %d\n", child); test_assert(wait(&status) == child); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); atomic_printf("depth = %d\n", *depth); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stack_overflow_altstack.c000066400000000000000000000022521277367620400210110ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int depth = 0; static char buf[SIGSTKSZ]; static void SEGV_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { atomic_printf("depth = %d\n", depth); atomic_puts("EXIT-SUCCESS"); exit(0); } static int recurse(void) { int result; ++depth; if (depth > 10000000) { return 3; } result = recurse() * 13 + 1; --depth; return result; } int main(void) { /* Testing shows that the output value of |depth| is not very sensitive to small values of the limit, but it's very sensitive around the 500K mark. */ struct rlimit r = { 500000, 500000 }; struct sigaction act; stack_t stack; stack.ss_flags = 0; stack.ss_size = sizeof(buf); stack.ss_sp = buf; test_assert(0 == sigaltstack(&stack, NULL)); act.sa_sigaction = SEGV_handler; act.sa_flags = SA_SIGINFO | SA_ONSTACK; sigemptyset(&act.sa_mask); test_assert(0 == sigaction(SIGSEGV, &act, NULL)); test_assert(0 == setrlimit(RLIMIT_STACK, &r)); return recurse(); } rr-4.4.0/src/test/stack_overflow_debug.py000066400000000000000000000005051277367620400204760ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('c') expect_gdb('SIGSEGV') send_gdb('stepi') expect_gdb('SIGSEGV') send_gdb('stepi') expect_gdb('SIGKILL') send_gdb('reverse-stepi') expect_gdb('SIGSEGV') send_gdb('reverse-stepi') expect_gdb('SIGSEGV') send_gdb('reverse-continue') expect_gdb('stopped') ok() rr-4.4.0/src/test/stack_overflow_debug.run000066400000000000000000000003161277367620400206520ustar00rootroot00000000000000source `dirname $0`/util.sh record stack_overflow$bitness TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug stack_overflow_debug "-f $TARGET_PID" rr-4.4.0/src/test/stack_overflow_with_guard.c000066400000000000000000000027221277367620400213420ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int* depth; static int recurse(void) { int result; ++*depth; if (*depth > 10000000) { return 3; } result = recurse() * 13 + 1; --*depth; return result; } static void SEGV_handler(__attribute__((unused)) int sig, __attribute__((unused)) siginfo_t* si, __attribute__((unused)) void* context) { atomic_puts( "Should not reach SEGV handler, since there's no safe altstack to use"); exit(1); } int main(int argc, __attribute__((unused)) char* argv[]) { pid_t child; int status; depth = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0); test_assert(depth != MAP_FAILED); child = fork(); if (!child) { struct sigaction act; int* fake_sp = &argc; act.sa_sigaction = SEGV_handler; act.sa_flags = SA_SIGINFO; sigemptyset(&act.sa_mask); test_assert(0 == sigaction(SIGSEGV, &act, NULL)); void* p = (void*)((size_t)(fake_sp - 8 * PAGE_SIZE) & ~(size_t)(PAGE_SIZE - 1)); test_assert(mmap(p, PAGE_SIZE, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0) == p); return recurse(); } test_assert(wait(&status) == child); test_assert(WIFSIGNALED(status) && WTERMSIG(status) == SIGSEGV); atomic_printf("depth = %d\n", *depth); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/statfs.c000066400000000000000000000034751277367620400154070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define DUMMY_FILENAME "foo.txt" static void dump_statfs(const char* label, const struct statfs* s) { atomic_printf("%s: {\n" " type:0x%lx, bsize:%ld, \n" " blocks:%ld, bfree:%ld, bavail:%ld,\n" " files:%lu, ffree:%lu,\n" " fsid: { %d, %d },\n" " namelen:%ld, frsize:%ld,\n" " flags:0x%lx\n" "}\n", label, (long)s->f_type, (long)s->f_bsize, s->f_blocks, s->f_bfree, s->f_bavail, s->f_files, s->f_ffree, s->f_fsid.__val[0], s->f_fsid.__val[1], (long)s->f_namelen, (long)s->f_frsize, (long)s->f_flags); } static int same_statfs_det(const struct statfs* s1, const struct statfs* s2) { /* Only compare the ~deterministic members; the free/avail * resource members can change in between calls. */ return (s1->f_type == s2->f_type && s1->f_bsize == s2->f_bsize && s1->f_blocks == s2->f_blocks && s1->f_fsid.__val[0] == s2->f_fsid.__val[0] && s1->f_fsid.__val[1] == s2->f_fsid.__val[1] && s1->f_namelen == s2->f_namelen && s1->f_frsize == s2->f_frsize && s1->f_flags == s2->f_flags); } int main(void) { int fd; struct statfs* sfs1; struct statfs* sfs2; ALLOCATE_GUARD(sfs1, 0); ALLOCATE_GUARD(sfs2, 1); fd = creat(DUMMY_FILENAME, 0600); test_assert(fd >= 0); test_assert(0 == statfs(DUMMY_FILENAME, sfs1)); test_assert(0 == fstatfs(fd, sfs2)); VERIFY_GUARD(sfs1); VERIFY_GUARD(sfs2); dump_statfs("statfs buffer", sfs1); dump_statfs("fstatfs buffer", sfs2); test_assert(same_statfs_det(sfs1, sfs2)); unlink(DUMMY_FILENAME); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/std_random.cc000066400000000000000000000004051277367620400163660ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include int main(void) { std::random_device device; atomic_printf("Random value = %d\n", device()); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stdout_child.c000066400000000000000000000006761277367620400165700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { pid_t child; int status; if (argc == 2) { atomic_puts("EXIT-SUCCESS"); return 77; } if (0 == (child = fork())) { execl(argv[0], argv[0], "step2", NULL); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); return 0; } rr-4.4.0/src/test/stdout_cloexec.c000066400000000000000000000014561277367620400171240ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { pid_t child; int status; if (argc == 2) { /* With syscallbuf disabled, this should open on fd 1. Then, the following puts will succeed, but rr should not echo to the terminal during replay, as long as our CLOEXEC handling works. */ open("/dev/null", O_WRONLY); atomic_puts("FAILED: this output should be hidden"); return 77; } if (0 == (child = fork())) { test_assert(0 == fcntl(STDOUT_FILENO, F_SETFD, FD_CLOEXEC)); execl(argv[0], argv[0], "step2", NULL); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stdout_dup.c000066400000000000000000000003651277367620400162700ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = dup(STDOUT_FILENO); static const char msg[] = "EXIT-SUCCESS\n"; write(fd, msg, sizeof(msg) - 1); return 0; } rr-4.4.0/src/test/stdout_redirect.c000066400000000000000000000011641277367620400172770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { pid_t child; int status; if (argc == 2) { atomic_puts("FAILED: this output should be hidden"); return 77; } if (0 == (child = fork())) { int fd = open("/dev/null", O_WRONLY); test_assert(fd >= 0); test_assert(STDOUT_FILENO == dup2(fd, STDOUT_FILENO)); execl(argv[0], argv[0], "step2", NULL); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/step1.py000066400000000000000000000005541277367620400153400ustar00rootroot00000000000000from rrutil import * send_gdb('b A') expect_gdb('Breakpoint 1') send_gdb('c') expect_rr('calling A') expect_gdb('Breakpoint 1, A') send_gdb('n') expect_rr('calling B') send_gdb('s') expect_gdb('B ()') send_gdb('n') expect_rr('calling C') send_gdb('s') expect_gdb('C ()') send_gdb('bt') expect_gdb('#0[^C]+C[^#]+#1[^B]+B[^#]+#2[^A]+A[^#]+#3[^m]+main') ok() rr-4.4.0/src/test/step1.run000066400000000000000000000001021277367620400155010ustar00rootroot00000000000000source `dirname $0`/util.sh record breakpoint$bitness debug step1 rr-4.4.0/src/test/step_rdtsc.py000066400000000000000000000007241277367620400164550ustar00rootroot00000000000000import re from rrutil import * send_gdb('b rdtsc') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, rdtsc') send_gdb('disass') expect_gdb(re.compile(r'=> ([0-9a-fx]+) <\+[0-9]+>:\trdtsc')) addr = last_match().group(1) send_gdb('stepi') send_gdb('disass') expect_gdb(re.compile(r'=> ([0-9a-fx]+) ')) addr2 = last_match().group(1) if eval(addr) + 2 != eval(addr2): failed("stepi from rdtsc at %s ended at incorrect %s" % (addr, addr2)); ok() rr-4.4.0/src/test/step_rdtsc.run000066400000000000000000000001021277367620400166170ustar00rootroot00000000000000source `dirname $0`/util.sh record rdtsc$bitness debug step_rdtsc rr-4.4.0/src/test/step_signal.py000066400000000000000000000007731277367620400166170ustar00rootroot00000000000000from rrutil import * import re send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1, breakpoint') send_gdb('fin') index = expect_list([re.compile(r'signal\(i, handle_sigrt\)'), re.compile('breakpoint')]) if index == 1: send_gdb('n') expect_gdb(r'signal\(i, handle_sigrt\)') send_gdb('n') expect_gdb(r'raise\(i\)') send_gdb('n') expect_gdb('Program received signal SIG34') send_gdb('stepi') send_gdb('n') expect_gdb(r'atomic_printf\("Caught signal') ok() rr-4.4.0/src/test/step_signal.run000066400000000000000000000001031277367620400167560ustar00rootroot00000000000000source `dirname $0`/util.sh record sigrt$bitness debug step_signal rr-4.4.0/src/test/step_thread.c000066400000000000000000000022451277367620400163770ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" pthread_barrier_t bar; /* NB: these must *not* be macros so that debugger step-next works as * expected per the program source. */ static void A(void) { pthread_barrier_wait(&bar); pthread_barrier_wait(&bar); } static void B(void) { pthread_barrier_wait(&bar); pthread_barrier_wait(&bar); } static void* threadA(__attribute__((unused)) void* unused) { A(); return NULL; } static void* threadB(__attribute__((unused)) void* unused) { B(); return NULL; } static void C(void) { pthread_barrier_wait(&bar); } static void hit_barrier(void) { int break_here = 1; (void)break_here; atomic_puts("hit barrier"); } static void ready(void) { int break_here = 1; (void)break_here; } int main(void) { void* dummy; pthread_t a, b; pthread_barrier_init(&bar, NULL, 3); dummy = pthread_create; dummy = pthread_barrier_wait; (void)dummy; ready(); pthread_create(&a, NULL, threadA, NULL); pthread_create(&b, NULL, threadB, NULL); C(); hit_barrier(); pthread_barrier_wait(&bar); pthread_join(a, NULL); pthread_join(b, NULL); return 0; } rr-4.4.0/src/test/step_thread.py000066400000000000000000000042511277367620400166040ustar00rootroot00000000000000import re from rrutil import * send_gdb('set scheduler-locking off') send_gdb('b hit_barrier') expect_gdb('Breakpoint 1') send_gdb('b ready') expect_gdb('Breakpoint 2') send_gdb('c') expect_gdb('Breakpoint 2, ready') bps = set(('A', 'B', 'C')) for bp in bps: send_gdb('b '+ bp +'') expect_gdb('Breakpoint \d') expect_gdb(r'\(rr\)') hit_bps = { 'A': 0, 'B': 0, 'C': 0 } events = [ re.compile(r'Breakpoint 1, hit_barrier'), re.compile(r'Breakpoint \d, ([ABC])'), re.compile(r'Remote connection closed'), re.compile(r'internal-error:'), re.compile(r'Cannot find bounds of current function'), re.compile(r'\(rr\)') ] next_cmd = 's' while 1: send_gdb(next_cmd) next_cmd = 's' i = expect_list(events) if 0 == i: break if 2 == i or 3 == i: assert False, 'Program stopped unexpectedly, review gdb_rr.log' if 4 == i: expect_gdb(r'\(rr\)') next_cmd = 'stepi' continue if 5 == i: continue bp = last_match().group(1) assert not hit_bps[bp] hit_bps[bp] = 1 expect_gdb(r'\(rr\)') for bp in hit_bps.iterkeys(): assert hit_bps[bp] arch = get_exe_arch() # The locations the threads are stopped at depends on the architecture. stopped_locations = { # on i386, we sometimes stop in the middle of nowhere 'i386': ['(0x[0-9a-f]+ in )?__kernel_vsyscall', '(0x[0-9a-f]+ in )?_traced_raw_syscall', '0x[0-9a-f]+ in \?\?', '(0x[0-9a-f]+ in )?__lll_lock_wait', '(0x[0-9a-f]+ in )?pthread_barrier_wait', '(0x[0-9a-f]+ in )?futex_wait'], 'i386:x86-64': ['(0x[0-9a-f]+ in )?__lll_lock_wait', '(0x[0-9a-f]+ in )?pthread_barrier_wait', '(0x[0-9a-f]+ in )?futex_wait', '0x0*70000002 in \?\?'], } location_regex = '|'.join(stopped_locations[arch]) send_gdb('info threads') expect_gdb(r'1\s+Thread.+hit_barrier') expect_gdb(r'\(rr\)') send_gdb('info threads') expect_gdb(r'2\s+Thread.+?(?:%s)' % location_regex) expect_gdb(r'\(rr\)') send_gdb('info threads') expect_gdb(r'3\s+Thread.+?(?:%s)' % location_regex) expect_gdb(r'\(rr\)') ok() rr-4.4.0/src/test/step_thread.run000066400000000000000000000000471277367620400167570ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/stray_time_slice_signal.c000066400000000000000000000011341277367620400207650ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int i; int fd = open("/dev/zero", O_RDONLY); int sum = 0; pid_t pid; int status; test_assert(fd >= 0); pid = fork(); if (!pid) { pid_t pp = getppid(); for (i = 0; i < 1000; ++i) { kill(pp, SIGCHLD); } return 77; } for (i = 0; i < 1000; ++i) { int j; for (j = 0; j < i % 50; ++j) { sum += j * i; } } test_assert(pid == wait(&status)); atomic_printf("token = %d\n", sum); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/stray_time_slice_signal.run000066400000000000000000000001121277367620400213420ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS = "-c3" compare_test EXIT-SUCCESS rr-4.4.0/src/test/strict_priorities.c000066400000000000000000000017611277367620400176600ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include #include #include #define NUM_ITERATIONS (1 << 30) static volatile int main_thread_done = 0; static void* low_priority_func(__attribute__((unused)) void* unused) { setpriority(PRIO_PROCESS, 0, 4); /* This thread should never be scheduled again unless/until the main thread exits. */ test_assert(main_thread_done); return NULL; } int main(void) { int i, j; int dummy = 0; pthread_t low_priority_thread; pthread_create(&low_priority_thread, NULL, low_priority_func, NULL); /* Eat some CPU and do some (nonblocking) system calls */ for (i = 0; i < 64; ++i) { getpid(); for (j = 0; j < NUM_ITERATIONS / 64; ++j) { dummy += j % (1 << 20); dummy += j % (79 * (1 << 20)); } } /* Set this before the puts below since the puts could block */ main_thread_done = 1; atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/string_instructions.c000066400000000000000000000164261277367620400202350ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define SIZE 10 * 1024 * 1024 #define FORWARD 1 #define BACKWARD -1 static char* p; static char* q; static char* r; static uintptr_t to_uintptr(char* val) { union { char buf[9]; uintptr_t p; } u; memset(u.buf, 0, sizeof(u.buf)); strcpy(u.buf, val); return u.p; } static inline void set_dir(int dir) { #if defined(__i386__) || defined(__x86_64__) if (dir < 0) { __asm__("std\n\t"); } else { __asm__("cld\n\t"); } #endif } static void string_store(char* dest, uintptr_t a, uintptr_t size, int unit, int dir) { set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("rep stosb\n\t" ::"a"(a), "c"(size), "D"(dest)); break; case 2: __asm__("rep stosw\n\t" ::"a"(a), "c"(size), "D"(dest)); break; case 4: __asm__("rep stosl\n\t" ::"a"(a), "c"(size), "D"(dest)); break; #ifdef __x86_64__ case 8: __asm__("rep stosq\n\t" ::"a"(a), "c"(size), "D"(dest)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { memcpy(dest, &a, unit); dest += dir; } #endif set_dir(1); } static void string_copy(char* dest, char* src, uintptr_t size, int unit, int dir) { set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("rep movsb\n\t" ::"S"(src), "c"(size), "D"(dest)); break; case 2: __asm__("rep movsw\n\t" ::"S"(src), "c"(size), "D"(dest)); break; case 4: __asm__("rep movsl\n\t" ::"S"(src), "c"(size), "D"(dest)); break; #ifdef __x86_64__ case 8: __asm__("rep movsq\n\t" ::"S"(src), "c"(size), "D"(dest)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { memcpy(dest, src, unit); dest += dir; src += dir; } #endif set_dir(1); } static int string_scan_equal(char* s, uintptr_t a, uintptr_t size, int unit, int dir) { char* end = s; set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("repe scasb\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; case 2: __asm__("repe scasw\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; case 4: __asm__("repe scasl\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; #ifdef __x86_64__ case 8: __asm__("repe scasq\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { end += dir; if (memcmp(end - dir, &a, unit) != 0) { break; } } #endif set_dir(1); return (end - s - dir) / dir; } static int string_scan_not_equal(char* s, uintptr_t a, uintptr_t size, int unit, int dir) { char* end = s; set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("repne scasb\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; case 2: __asm__("repne scasw\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; case 4: __asm__("repne scasl\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; #ifdef __x86_64__ case 8: __asm__("repne scasq\n\t" : "=D"(end) : "a"(a), "D"(s), "c"(size)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { end += dir; if (memcmp(end - dir, &a, unit) == 0) { break; } } #endif set_dir(1); return (end - s - dir) / dir; } static int string_cmp_equal(char* s, char* t, uintptr_t size, int unit, int dir) { char* sp = s; char* tp = t; set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("repe cmpsb\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; case 2: __asm__("repe cmpsw\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; case 4: __asm__("repe cmpsl\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; #ifdef __x86_64__ case 8: __asm__("repe cmpsq\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { sp += dir; tp += dir; if (memcmp(sp - dir, tp - dir, unit) != 0) { break; } } #endif set_dir(1); return (sp - s - dir) / dir; } static int string_cmp_not_equal(char* s, char* t, uintptr_t size, int unit, int dir) { char* sp = s; char* tp = t; set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("repne cmpsb\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; case 2: __asm__("repne cmpsw\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; case 4: __asm__("repne cmpsl\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; #ifdef __x86_64__ case 8: __asm__("repne cmpsq\n\t" : "=D"(sp) : "S"(tp), "D"(s), "c"(size)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { sp += dir; tp += dir; if (memcmp(sp - dir, tp - dir, unit) == 0) { break; } } #endif set_dir(1); return (sp - s - dir) / dir; } int main(void) { int u; uintptr_t pattern = to_uintptr("aaaaaaaa"); uintptr_t pattern2 = to_uintptr("bbbbbbbb"); p = malloc(SIZE); q = malloc(SIZE); r = malloc(SIZE); for (u = 0; u < (sizeof(void*) == 8 ? 4 : 3); ++u) { int unit = 1 << u; int dir = FORWARD * unit; int size_units = SIZE / unit; int ret; memset(p, 0, SIZE); memset(q, 0, SIZE); memset(r, 0, SIZE); string_store(p, pattern, size_units, unit, dir); test_assert(memcmp(&p[SIZE - unit], &pattern, unit) == 0); string_copy(q, p, size_units, unit, dir); test_assert(memcmp(&q[SIZE - unit], &pattern, unit) == 0); memcpy(&p[SIZE - unit], &pattern2, unit); ret = string_scan_equal(p, pattern, size_units, unit, dir); test_assert(ret == size_units - 1); ret = string_scan_not_equal(p, pattern2, size_units, unit, dir); test_assert(ret == size_units - 1); ret = string_cmp_equal(p, q, size_units, unit, dir); test_assert(ret == size_units - 1); memset(&p[SIZE - unit], 0, unit); ret = string_cmp_not_equal(p, r, size_units, unit, dir); test_assert(ret == size_units - 1); dir = BACKWARD * unit; string_store(p + SIZE - unit, pattern2, size_units, unit, dir); test_assert(memcmp(&p[0], &pattern2, unit) == 0); string_copy(q + SIZE - unit, p + SIZE - unit, size_units, unit, dir); test_assert(memcmp(&q[0], &pattern2, unit) == 0); memcpy(&p[0], &pattern, unit); ret = string_scan_equal(p + SIZE - unit, pattern2, size_units, unit, dir); test_assert(ret == size_units - 1); ret = string_scan_not_equal(p + SIZE - unit, pattern, size_units, unit, dir); test_assert(ret == size_units - 1); ret = string_cmp_equal(p + SIZE - unit, q + SIZE - unit, size_units, unit, dir); test_assert(ret == size_units - 1); memset(&p[0], 0, unit); ret = string_cmp_not_equal(p + SIZE - unit, r + SIZE - unit, size_units, unit, dir); test_assert(ret == size_units - 1); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/string_instructions.py000066400000000000000000000037421277367620400204400ustar00rootroot00000000000000from rrutil import * send_gdb('break string_store') expect_gdb('Breakpoint 1') # string_store 1-byte forwards send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('watch -l p[1000000]') expect_gdb('watchpoint') send_gdb('reverse-continue') expect_gdb('Old value = 97') expect_gdb('New value = 0') send_gdb('p p[999999]') expect_gdb('= 97') send_gdb('p p[1000000]') expect_gdb('= 0') send_gdb('p p[1000001]') expect_gdb('= 0') send_gdb('disable') send_gdb('enable 1') # string_store 1-byte backwards send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('watch -l p[1000000]') expect_gdb('watchpoint') send_gdb('reverse-continue') expect_gdb('Old value = 98') expect_gdb('New value = 97') send_gdb('p p[1000001]') expect_gdb('= 98') send_gdb('p p[1000000]') expect_gdb('= 97') send_gdb('p p[999999]') expect_gdb('= 97') send_gdb('disable') send_gdb('enable 1') # string_store 2-bytes forwards send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('watch -l p[1000001]') expect_gdb('watchpoint') send_gdb('reverse-continue') expect_gdb('Old value = 97') expect_gdb('New value = 0') send_gdb('p p[999999]') expect_gdb('= 97') send_gdb('p p[1000000]') expect_gdb('= 0') send_gdb('p p[1000001]') expect_gdb('= 0') send_gdb('disable') send_gdb('enable 1') # string_store 2-bytes backwards # Check that a watch at the end of the loop is OK send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('watch -l p[0]') expect_gdb('watchpoint') send_gdb('reverse-continue') expect_gdb('Old value = 98') expect_gdb('New value = 97') send_gdb('p p[0]') expect_gdb('= 97') send_gdb('disable') send_gdb('enable 1') # string_store 4-bytes forwards # Just check that the late-watchpoint quirk is suppressed send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l p[800000]') expect_gdb('watchpoint') send_gdb('continue') expect_gdb('Old value = 0') expect_gdb('New value = 97') send_gdb('p p[800003]') expect_gdb('= 97') send_gdb('p p[800004]') expect_gdb('= 0') ok() rr-4.4.0/src/test/string_instructions.run000066400000000000000000000000471277367620400206070ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/string_instructions_async_signals.c000066400000000000000000000035271277367620400231500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* This test is designed to trigger the following: -- SCHED event targets the start of a string instruction -- ReplaySession::advance_to sets an internal breakpoint at that string instruction and runs to it, stopping at an execution of that instruction before the SCHED point -- advance_to does a fast_forward over the string instruction -- fast_forward singlesteps, then sets a breakpoint after the string instruction and continues -- the byte at offset 1 triggers the string instruction to stop immediately, so we hit the fast_forward breakpoint without changing any other state -- fast_forward resets the register state and prepares to retry the instruction, but doesn't execute anything because it observes we're already in the state to stop at. -- Back in ReplaySession, compute_trap_type goes wrong because we see the task stopped at an internal breakpoint (but there is no internal breakpoint there) */ #define SIZE 256 #define COUNT 8 * 256 * 256 static char* p; static int ctr; static void* do_thread(__attribute__((unused)) void* p) { while (1) { sched_yield(); } return NULL; } int main(void) { int v; pthread_t thread; p = malloc(SIZE); pthread_create(&thread, NULL, do_thread, NULL); memset(p, 0, SIZE); p[1] = 'a'; for (v = 0; v < COUNT; ++v) { int ret; #if defined(__i386__) || defined(__x86_64__) char* end; __asm__("cld\n\t" "repne scasb\n\t" : "=D"(end) : "a"('a'), "D"(p), "c"(SIZE), "b"(ctr)); ret = end - p - 1; #else int i; for (i = 0; i < SIZE; ++i) { if (p[i] == 'a') { ret = i; break; } } #endif ++ctr; test_assert(ret == 1); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/string_instructions_async_signals.run000066400000000000000000000001361277367620400235230ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS="-c1000" record $TESTNAME replay check EXIT-SUCCESS rr-4.4.0/src/test/string_instructions_break.py000066400000000000000000000006261277367620400216020ustar00rootroot00000000000000from rrutil import * send_gdb('break string_store') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l p[0]') expect_gdb('watchpoint 2') send_gdb('c') expect_gdb('watchpoint 2') send_gdb('break') expect_gdb('Breakpoint 3') send_gdb('disable 3') send_gdb('finish') expect_gdb('main') send_gdb('enable 3') send_gdb('reverse-continue') expect_gdb('Breakpoint 3') ok() rr-4.4.0/src/test/string_instructions_break.run000066400000000000000000000001471277367620400217540ustar00rootroot00000000000000source `dirname $0`/util.sh record string_instructions_replay$bitness debug string_instructions_break rr-4.4.0/src/test/string_instructions_replay.c000066400000000000000000000025611277367620400216040ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define SIZE 10 * 1024 * 1024 #define DIFF 2 * 1024 * 1024 #define CMP_LEN 3 * 1024 * 1024 static char* p; static char* q; static void string_store(char* dest, int a, uintptr_t size) { #if defined(__i386__) || defined(__x86_64__) __asm__("rep stosb\n\t" ::"a"(a), "c"(size), "D"(dest)); #else memset(dest, a, size); #endif } static int string_compare(char* s1, char* s2, uintptr_t size) { #if defined(__i386__) || defined(__x86_64__) char* result; __asm__("repe cmpsb\n\t" : "=D"(result) : "c"(size), "S"(s1), "D"(s2)); uintptr_t i = result - s2; if (i == size) { return s1[size - 1] == s2[size - 1] ? size : size - 1; } return i - 1; #else for (uintptr_t i = 0; i < size; ++i) { if (s1[i] != s2[i]) { return i; } } return size; #endif } int main(void) { int i; p = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(p != MAP_FAILED); q = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); test_assert(q != MAP_FAILED); for (i = 1; i < 1000; ++i) { string_store(p, i, SIZE); string_store(q, i, SIZE); q[DIFF] = i ^ 0xff; test_assert(string_compare(p, q, (uintptr_t)-1) == DIFF); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/string_instructions_replay.run000066400000000000000000000005221277367620400221610ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME & for i in $(seq 1 30); do sleep 0.05 kill -CHLD $rrpid $(pidof $TESTNAME-$nonce) >& /dev/null done # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written. wait echo "Replaying ..." replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/string_instructions_replay_quirk.py000066400000000000000000000005271277367620400232250ustar00rootroot00000000000000from rrutil import * send_gdb('break string_store') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('disable') send_gdb('watch -l p[0]') expect_gdb('watchpoint') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 1') send_gdb('p p[0]') expect_gdb('= 1') send_gdb('p p[1]') expect_gdb('= 0') ok() rr-4.4.0/src/test/string_instructions_replay_quirk.run000066400000000000000000000001551277367620400233760ustar00rootroot00000000000000source `dirname $0`/util.sh record string_instructions_replay$bitness debug string_instructions_replay_quirk rr-4.4.0/src/test/string_instructions_watch.c000066400000000000000000000025611277367620400214160ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char* buf; static uintptr_t to_uintptr(char* val) { union { char buf[9]; uintptr_t p; } u; memset(u.buf, 0, sizeof(u.buf)); strcpy(u.buf, val); return u.p; } static inline void set_dir(int dir) { #if defined(__i386__) || defined(__x86_64__) if (dir < 0) { __asm__("std\n\t"); } else { __asm__("cld\n\t"); } #endif } static void string_store(char* dest, uintptr_t a, uintptr_t size, int unit, int dir) { set_dir(dir); #if defined(__i386__) || defined(__x86_64__) switch (unit) { case 1: __asm__("rep stosb\n\t" ::"a"(a), "c"(size), "D"(dest)); break; case 2: __asm__("rep stosw\n\t" ::"a"(a), "c"(size), "D"(dest)); break; case 4: __asm__("rep stosl\n\t" ::"a"(a), "c"(size), "D"(dest)); break; #ifdef __x86_64__ case 8: __asm__("rep stosq\n\t" ::"a"(a), "c"(size), "D"(dest)); break; #endif } #else int i; for (i = 0; i < size; i += unit) { memcpy(dest, &a, unit); dest += dir; } #endif set_dir(1); } int main(void) { buf = (char*)mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); string_store(buf, to_uintptr("aaaaaaaa"), 16, 1, 1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/string_instructions_watch.py000066400000000000000000000006451277367620400216250ustar00rootroot00000000000000from rrutil import * import re send_gdb('b string_store') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('p buf') expect_gdb(re.compile(r'= ([^ ]+)')) buf = eval(last_match().group(1)); send_gdb('watch -l *(uint16_t*)%d'%(buf + 13)) expect_gdb('atchpoint 2') send_gdb('c') expect_gdb('atchpoint 2') send_gdb('p buf[13]') expect_gdb('= 97') send_gdb('p buf[14]') expect_gdb('= 0') ok() rr-4.4.0/src/test/string_instructions_watch.run000066400000000000000000000000471277367620400217750ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/subprocess_exit_ends_session.py000066400000000000000000000010411277367620400222710ustar00rootroot00000000000000import re from rrutil import * BAD_TOKEN = r'EXIT-SUCCESS' GOOD_TOKEN = r'Inferior 1 \(process \d+\) exited normally' def observe_child_crash_and_exit(): expect_gdb('Program received signal SIGSEGV') send_gdb('c') for line in iterlines_both(): m = re.search(BAD_TOKEN, line) if m: failed('Saw illegal token "'+ BAD_TOKEN +'"') m = re.search(GOOD_TOKEN, line) if m: return send_gdb('c') observe_child_crash_and_exit() restart_replay() observe_child_crash_and_exit() ok() rr-4.4.0/src/test/subprocess_exit_ends_session.run000066400000000000000000000002541277367620400224520ustar00rootroot00000000000000source `dirname $0`/util.sh record fork_child_crash$bitness TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') debug subprocess_exit_ends_session "-f $TARGET_PID" rr-4.4.0/src/test/switch_processes.py000066400000000000000000000004401277367620400176650ustar00rootroot00000000000000from rrutil import * import re # Restart at the first debuggable event, which will be in a different # process! We should stay focused on the child process, instead of # trying to switch to that process. At least we shouldn't crash. restart_replay(1) expect_gdb('exited normally') ok() rr-4.4.0/src/test/switch_processes.run000066400000000000000000000002521277367620400200420ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe write_race$bitness saved_exe="write_race$bitness-$nonce" record target_process$bitness $saved_exe debug switch_processes "-g 1000" rr-4.4.0/src/test/switch_read.c000066400000000000000000000025741277367620400163760ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char start_token = '!'; static const char sentinel_token = ' '; static pthread_t reader; static pthread_barrier_t barrier; static int sockfds[2]; static void* reader_thread(__attribute__((unused)) void* dontcare) { int readsock = sockfds[1]; char c = sentinel_token; struct timeval tv; pthread_barrier_wait(&barrier); atomic_puts("r: blocking on read ..."); test_assert(1 == read(readsock, &c, sizeof(c))); gettimeofday(&tv, NULL); atomic_printf("r: ... read '%c'\n", c); test_assert(c == start_token); return NULL; } int main(void) { char token = start_token; struct timeval ts; /* (Kick on the syscallbuf if it's enabled.) */ gettimeofday(&ts, NULL); socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds); pthread_barrier_init(&barrier, NULL, 2); pthread_create(&reader, NULL, reader_thread, NULL); pthread_barrier_wait(&barrier); /* Force a blocked read() that's interrupted by a SIGUSR1, * which then itself blocks on read() and succeeds. */ atomic_puts("M: sleeping ..."); usleep(500000); atomic_printf("M: finishing reader by writing '%c' to socket ...\n", token); write(sockfds[0], &token, sizeof(token)); ++token; atomic_puts("M: ... done"); pthread_join(reader, NULL); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/symlink.c000066400000000000000000000007251277367620400155640ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { static const char token_file[] = "rr-link-file.txt"; static const char link_name[] = "rr-link-file.link"; test_assert(0 == symlink(token_file, link_name)); test_assert(0 == unlink(link_name)); test_assert(0 == symlinkat(token_file, AT_FDCWD, link_name)); test_assert(0 == unlink(link_name)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sync.c000066400000000000000000000005431277367620400150500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define FILENAME "foo.txt" int main(void) { int fd; sync(); fd = open(FILENAME, O_CREAT | O_RDWR, 0600); test_assert(0 == unlink(FILENAME)); test_assert(fd >= 0); test_assert(0 == syncfs(fd)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/syscall_bp.c000066400000000000000000000032171277367620400162300ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define RR_PAGE_ADDR 0x70000000 static uintptr_t my_syscall(uintptr_t syscall, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3) { uintptr_t ret; #ifdef __x86_64__ __asm__ volatile("syscall\n\t" : "=a"(ret) : "a"(syscall), "D"(arg1), "S"(arg2), "d"(arg3)); #elif defined(__i386__) __asm__ volatile("xchg %%esi,%%edi\n\t" "int $0x80\n\t" "xchg %%esi,%%edi\n\t" : "=a"(ret) : "a"(syscall), "b"(arg1), "c"(arg2), "d"(arg3)); #else #error define syscall here #endif return ret; } int main(void) { uint8_t* syscall_addr = (uint8_t*)RR_PAGE_ADDR; uintptr_t current_brk = (uintptr_t)sbrk(0); // Write a breakpoint instruction to the vdso syscall address. // We don't do this by mprotecting, since we'd have to use RWX, // which may be disallowed by some kernels. int memfd = open("/proc/self/mem", O_RDWR); uint8_t bp = 0xcc; int nwritten = pwrite(memfd, &bp, 1, (uintptr_t)syscall_addr); if (nwritten == -1 && errno == EIO) { atomic_puts("Not running under rr"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(nwritten == 1); // Now make a syscall that we know rr will want to use a remote syscall // for. Don't use the glibc wrapper to make absolutely sure we don't hit // our own breakpoint. my_syscall(SYS_brk, current_brk + 0x100000, 0, 0); my_syscall(SYS_write, STDOUT_FILENO, (uintptr_t) "EXIT-SUCCESS", 14); // Exit directly. my_syscall(SYS_exit, 0x0, 0, 0); return 1; } rr-4.4.0/src/test/syscallbuf_fd_disabling.c000066400000000000000000000003561277367620400207320ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { atomic_puts("Line 1"); atomic_puts("Line 2"); atomic_puts("Line 3"); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/syscallbuf_fd_disabling.run000066400000000000000000000003361277367620400213120ustar00rootroot00000000000000source `dirname $0`/util.sh GLOBAL_OPTIONS="$GLOBAL_OPTIONS -M" record $TESTNAME if [[ "record.out" != $(grep -l '^\[.*\]Line 2$' record.out) ]]; then failed "Missing line annotation" exit fi compare_test EXIT-SUCCESS rr-4.4.0/src/test/syscallbuf_signal_reset.c000066400000000000000000000007461277367620400210070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void sighandler(__attribute__((unused)) int sig) { /* Must be a syscall we've already executed, otherwise patching gets in the * way */ open("/dev/zero", O_RDONLY); atomic_puts("EXIT-SUCCESS"); exit(0); } int main(void) { char ch; int fd = open("/dev/zero", O_RDONLY); signal(SIGSEGV, sighandler); read(fd, &ch, 1); crash_null_deref(); return 0; } rr-4.4.0/src/test/syscallbuf_sigstop.c000066400000000000000000000013311277367620400200070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int do_child(void) { int fd = open("/dev/zero", O_RDONLY); int i; char ch; test_assert(fd >= 0); for (i = 0; i < 10000; ++i) { test_assert(1 == read(fd, &ch, 1)); sched_yield(); } return 77; } int main(void) { pid_t child; int status; int i; child = fork(); if (!child) { return do_child(); } for (i = 0; i < 100; ++i) { kill(child, SIGSTOP); sched_yield(); kill(child, SIGCONT); sched_yield(); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/syscallbuf_timeslice.c000066400000000000000000000005651277367620400203050ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; char buf[10]; int i; fd = open("/dev/zero", O_RDONLY); for (i = 0; i < 1 << 12; ++i) { read(fd, buf, sizeof(buf)); if (!(i & ((1 << 8) - 1))) { atomic_printf("."); } } atomic_puts("\nEXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/syscallbuf_timeslice2.c000066400000000000000000000006061277367620400203630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd; char buf[10]; int i; for (i = 0; i < 1 << 12; ++i) { fd = open("/dev/zero", O_RDONLY); read(fd, buf, sizeof(buf)); close(fd); if (!(i & ((1 << 8) - 1))) { atomic_printf("."); } } atomic_puts("\nEXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/syscallbuf_timeslice2_250.run000066400000000000000000000003661277367620400213360ustar00rootroot00000000000000source `dirname $0`/util.sh # It's relatively easy to reproduce a CPUID divergence caused by lack # of CPU binding. GLOBAL_OPTIONS="$GLOBAL_OPTIONS_BIND_CPU" RECORD_ARGS="-c250" record syscallbuf_timeslice2$bitness replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/syscallbuf_timeslice_250.run000066400000000000000000000003651277367620400212530ustar00rootroot00000000000000source `dirname $0`/util.sh # It's relatively easy to reproduce a CPUID divergence caused by lack # of CPU binding. GLOBAL_OPTIONS="$GLOBAL_OPTIONS_BIND_CPU" RECORD_ARGS="-c250" record syscallbuf_timeslice$bitness replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/sysconf.c000066400000000000000000000010001277367620400155450ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { long pagesize = sysconf(_SC_PAGESIZE); long ncpus = sysconf(_SC_NPROCESSORS_ONLN); atomic_printf("sysconf says page size is %ld bytes\n", pagesize); test_assert(4096 == pagesize); atomic_printf("sysconf says %ld processors are online\n", ncpus); /* TODO: change this when rr supports parallel recording. */ test_assert(1 == ncpus); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sysctl.c000066400000000000000000000012471277367620400154170ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #include int main(void) { int name[2] = { CTL_KERN, KERN_RTSIGMAX }; int sig_max = -1; size_t len = sizeof(sig_max); name[0] = CTL_KERN; name[1] = KERN_RTSIGMAX; if (sysctl(name, 2, &sig_max, &len, NULL, 0) == -1) { /* many kernels don't support this */ atomic_printf("sysctl KERN_RTSIGMAX returned errno %d\n", errno); atomic_puts("EXIT-SUCCESS"); } else { assert(len == sizeof(sig_max)); atomic_printf("sysctl KERN_RTSIGMAX returned %d\n", sig_max); assert(sig_max > 0); atomic_puts("EXIT-SUCCESS"); } return 0; } rr-4.4.0/src/test/sysemu_singlestep.c000066400000000000000000000010631277367620400176540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int var = 41; #ifdef __i386__ __asm__ __volatile__("int $0x80\n\t" "incl %0\n\t" : "=m"(var) : "a"(SYS_gettid)); #elif defined(__x86_64__) __asm__ __volatile__("syscall\n\t" "incl %0\n\t" : "=m"(var) : "a"(SYS_gettid)); #endif test_assert(var == 42); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/sysinfo.c000066400000000000000000000005241277367620400155650ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct sysinfo* info; ALLOCATE_GUARD(info, 0); test_assert(0 == sysinfo(info)); test_assert(info->mem_unit > 0); test_assert(info->procs > 0); VERIFY_GUARD(info); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/target_fork.c000066400000000000000000000013471277367620400164060ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void bad_breakpoint(void) { int break_here = 1; (void)break_here; } static void good_breakpoint(void) { int break_here = 1; (void)break_here; } int main(int argc, char* argv[]) { int num_syscalls; int child; int i; bad_breakpoint(); test_assert(argc == 2); num_syscalls = atoi(argv[1]); atomic_printf("%d: running %d syscalls ...\n", getpid(), num_syscalls); for (i = 0; i < num_syscalls; ++i) { event_syscall(); } if (0 == (child = fork())) { good_breakpoint(); exit(0); } atomic_printf("child %d\n", child); waitpid(child, NULL, 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/target_fork.run000066400000000000000000000003321277367620400167610ustar00rootroot00000000000000source `dirname $0`/util.sh EVENTS=1000 record $TESTNAME $EVENTS TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug bad_good_break "-f $TARGET_PID -g $EVENTS" rr-4.4.0/src/test/target_process.c000066400000000000000000000010341277367620400171140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { const char* exe_image; int child; test_assert(argc == 2); exe_image = argv[1]; atomic_printf("%d: forking and exec'ing %s...\n", getpid(), exe_image); if (0 == (child = fork())) { execl(exe_image, exe_image, NULL); test_assert("Not reached; execl() failed." && 0); } atomic_printf("child %d\n", child); waitpid(child, NULL, 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/target_process.run000066400000000000000000000004421277367620400175000ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe breakpoint$bitness saved_breakpoint="breakpoint$bitness-$nonce" record $TESTNAME "$saved_breakpoint" TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug restart_breakpoint "-p $TARGET_PID -g 1" rr-4.4.0/src/test/term_nonmain.c000066400000000000000000000015521277367620400165630ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void waittermsig(int sig, const char* waiter) { struct timespec ts = {.tv_sec = 1 }; sigset_t set; siginfo_t si; sigemptyset(&set); sigaddset(&set, sig); sigtimedwait(&set, &si, &ts); atomic_printf("FAILED: %s: signal %d either not caught or didn't terminate " "process within 1 second\n", waiter, sig); } static void* kill_thread(__attribute__((unused)) void* dontcare) { const int termsig = SIGTERM; atomic_puts("killing..."); kill(getpid(), termsig); waittermsig(termsig, "kill_thread"); return NULL; /* not reached */ } int main(void) { pthread_t t; pthread_create(&t, NULL, kill_thread, NULL); pthread_join(t, NULL); atomic_puts("FAILED: joined thread that should have died"); return 0; } rr-4.4.0/src/test/term_nonmain.run000066400000000000000000000000671277367620400171450ustar00rootroot00000000000000source `dirname $0`/util.sh compare_test 'killing ...' rr-4.4.0/src/test/term_rr.c000066400000000000000000000002771277367620400155520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { atomic_puts("EXIT-SUCCESS"); kill(getppid(), SIGTERM); return 0; } rr-4.4.0/src/test/term_rr.py000066400000000000000000000002731277367620400157540ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('SIGKILL') ok() rr-4.4.0/src/test/term_rr.run000066400000000000000000000000471277367620400161270ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/term_trace_cpu.run000066400000000000000000000030761277367620400174560ustar00rootroot00000000000000source `dirname $0`/util.sh # We want to test two things here: # 1) Terminating rr when the next tracee event is a reschedule # 2) Terminating rr when the syscallbuf contains events that need to be flushed # To test both of these, we need to set the reschedule threshold high enough # that our signal is delivered before the first reschedule after sending # the SYNC_TOKEN. We also need to set the reschedule threshold low enough # that a reschedule occurs before chew_cpu's spin() loop finishes. Currently # that loop has 2^30 iterations, so 100M events per reschedule sounds good. RECORD_ARGS="-c100000000" EXE=chew_cpu$bitness SYNC_TOKEN=spinning WAIT_SECS=1 record $EXE & echo "Waiting for token '$SYNC_TOKEN' from tracee ..." until grep -q $SYNC_TOKEN record.out; do sleep 0 done rrpid=$(parent_pid_of $(pidof $EXE-$nonce)) # It's possible for this signal to be acted on before chew_cpu actually # reaches the spin() loop, e.g. with syscallbuf disabled it might be delivered # before rr has finished handling the syscalls of atomic_puts. But scheduling # variations should ensure that sometimes we reach spin() first. echo " done. Delivering SIGTERM to $rrpid ..." kill -TERM $rrpid echo " done." # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written, and we might # fail to see the tracee write EXIT-SUCCESS. wait if [[ "record.out" == $(grep -l "EXIT-SUCCESS" record.out) ]]; then failed "error during recording: tracer not interrupted in time." fi echo "Replaying ..." replay check "" rr-4.4.0/src/test/term_trace_syscall.c000066400000000000000000000004001277367620400177430ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct timespec ts = { 1000000, 0 }; atomic_puts("sleeping"); nanosleep(&ts, NULL); atomic_puts("EXIT-SUCCESS"); return 1; } rr-4.4.0/src/test/term_trace_syscall.run000066400000000000000000000013501277367620400203320ustar00rootroot00000000000000source `dirname $0`/util.sh SYNC_TOKEN=sleeping record $TESTNAME & # sleep "forever" echo "Waiting for token '$SYNC_TOKEN' from tracee ..." until grep -q $SYNC_TOKEN record.out; do sleep 0 done rrpid=$(parent_pid_of $(pidof $TESTNAME-$nonce)) echo " done. Delivering SIGTERM to $rrpid ..." kill -TERM $rrpid echo " done." # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written, and we might # fail to see the tracee write EXIT-SUCCESS. wait if [[ "record.out" == $(grep -l "EXIT-SUCCESS" record.out) ]]; then echo "Test '$TESTNAME' FAILED: error during recording: tracer not interrupted in time." fi echo "Replaying ..." replay check "" rr-4.4.0/src/test/test_lib.c000066400000000000000000000007411277367620400157010ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* start_thread(__attribute__((unused)) void* dontcare) { return NULL; } static void constructor(void) __attribute__((constructor)); static void constructor(void) { struct timeval tv; pthread_t t; gettimeofday(&tv, NULL); pthread_create(&t, NULL, start_thread, NULL); pthread_join(t, NULL); } void lib_exit_success(void) { atomic_puts("EXIT-SUCCESS"); } rr-4.4.0/src/test/test_setup.gdb000066400000000000000000000000751277367620400166050ustar00rootroot00000000000000set pagination off handle SIGSEGV stop handle SIGKILL nostop rr-4.4.0/src/test/tgkill.c000066400000000000000000000011361277367620400153610ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int num_signals_caught; static int tgkill(int tgid, int tid, int sig) { return syscall(SYS_tgkill, tgid, tid, sig); } static void sighandler(int sig) { atomic_printf("Task %d got signal %d\n", sys_gettid(), sig); ++num_signals_caught; } int main(void) { signal(SIGUSR1, sighandler); signal(SIGUSR2, sighandler); tgkill(getpid(), sys_gettid(), SIGUSR1); tgkill(getpid(), sys_gettid(), SIGUSR2); test_assert(2 == num_signals_caught); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/thread_exit_signal.c000066400000000000000000000012431277367620400177270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int count; static volatile int stop; static void handler(__attribute__((unused)) int sig) { ++count; } static void handler2(__attribute__((unused)) int sig) { stop = 1; } static void* do_thread(__attribute__((unused)) void* p) { return NULL; } int main(void) { test_assert(0 == signal(SIGCHLD, handler)); test_assert(0 == signal(SIGUSR2, handler2)); atomic_puts("ready"); while (!stop) { pthread_t thread; pthread_create(&thread, NULL, do_thread, NULL); pthread_join(thread, NULL); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/thread_exit_signal.run000066400000000000000000000007351277367620400203160ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME & until grep -q ready record.out; do sleep 0 done for i in $(seq 1 100); do sleep 0.001 kill -CHLD $(pidof $TESTNAME-$nonce) >& /dev/null done kill -USR2 $(pidof $TESTNAME-$nonce) >& /dev/null # Wait for 'record' to actually terminate. Otherwise we might start # replaying before the trace file has been completely written. wait %1 || failed "Abnormal record termination" echo "Replaying ..." replay check 'EXIT-SUCCESS' rr-4.4.0/src/test/thread_stress.c000066400000000000000000000014211277367620400167420ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" /* Chosen so that |3MB * THREAD_GROUPS * THREADS_PER_GROUP| exhausts a * 32-bit address space. */ #define THREAD_GROUPS 150 #define THREADS_PER_GROUP 10 static void* thread(__attribute__((unused)) void* unused) { struct timeval tv; gettimeofday(&tv, NULL); return NULL; } int main(void) { int i; for (i = 0; i < THREAD_GROUPS; ++i) { pthread_t threads[THREADS_PER_GROUP]; int j; for (j = 0; j < THREADS_PER_GROUP; ++j) { test_assert(0 == pthread_create(&threads[j], NULL, thread, NULL)); } for (j = 0; j < THREADS_PER_GROUP; ++j) { test_assert(0 == pthread_join(threads[j], NULL)); } } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/thread_yield.c000066400000000000000000000011171277367620400165270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int spin(int iterations) { int i, dummy = 0; atomic_puts("spinning"); for (i = 1; i < iterations; ++i) { dummy += i % (1 << 20); dummy += i % (79 * (1 << 20)); } return dummy; } static int ran_thread = 0; static void* do_thread(__attribute__((unused)) void* p) { ran_thread = 1; return NULL; } int main(void) { pthread_t t; pthread_create(&t, NULL, do_thread, NULL); spin(1 << 28); test_assert(ran_thread); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/threaded_syscall_spam.c000066400000000000000000000027531277367620400204330ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int num_its; static void syscall_spam(void) { int i; struct timespec ts; struct timeval tv; for (i = 0; i < 1 << num_its; ++i) { /* The odds of the signal being caught in the library * implementing these syscalls is very high. But even * if it's not caught there, this test will pass. */ clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); clock_gettime(CLOCK_MONOTONIC, &ts); gettimeofday(&tv, NULL); } } static void unblock_signals(void) { sigset_t set; sigfillset(&set); test_assert(0 == pthread_sigmask(SIG_UNBLOCK, &set, NULL)); atomic_printf(" %d: unblocked all sigs\n", sys_gettid()); } static void* thread(__attribute__((unused)) void* unused) { unblock_signals(); syscall_spam(); return NULL; } int main(int argc, char** argv) { sigset_t set; pthread_t t; test_assert(argc == 2); num_its = atoi(argv[1]); test_assert(num_its > 0); atomic_printf("Running 2^%d iterations in two threads\n", num_its); atomic_printf("parent %d: blocking all sigs ...\n", getpid()); sigfillset(&set); test_assert(0 == pthread_sigmask(SIG_BLOCK, &set, NULL)); pthread_create(&t, NULL, thread, NULL); unblock_signals(); syscall_spam(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/threaded_syscall_spam.run000066400000000000000000000006641277367620400210140ustar00rootroot00000000000000source `dirname $0`/util.sh # Without the syscallbuf, trying to record the large number of # syscalls in this test is impractical. skip_if_no_syscall_buf # 2^17 iterations is arbitrarily chosen to take ~3s on a fast machine record $TESTNAME 17 # Because of issue #184, replay takes longer than practical. So for # now we'll skip it and hope other tests exercise the relevant code # well enough. #replay #check 'EXIT-SUCCESS' passed rr-4.4.0/src/test/threads.c000066400000000000000000000026311277367620400155260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" long int counter = 0; pthread_barrier_t bar; void catcher(__attribute__((unused)) int sig) { atomic_printf("Signal caught, Counter is %ld\n", counter); atomic_puts("EXIT-SUCCESS"); _exit(0); } void* receiver(__attribute__((unused)) void* name) { struct sigaction sact; sigemptyset(&sact.sa_mask); sact.sa_flags = 0; sact.sa_handler = catcher; sigaction(SIGALRM, &sact, NULL); pthread_barrier_wait(&bar); while (1) { counter++; if (counter % 100000 == 0) { write(1, ".", 1); } } return NULL; } void* sender(void* id) { sleep(1); pthread_barrier_wait(&bar); pthread_kill(*((pthread_t*)id), SIGALRM); return NULL; } int main(void) { struct timeval tv; pthread_t thread1, thread2; /* (Kick on the syscallbuf lib.) */ gettimeofday(&tv, NULL); /* init barrier */ pthread_barrier_init(&bar, NULL, 2); /* Create independent threads each of which will execute * function */ pthread_create(&thread1, NULL, receiver, NULL); pthread_create(&thread2, NULL, sender, &thread1); /* Wait till threads are complete before main * continues. Unless we wait we run the risk of executing an * exit which will terminate the process and all threads * before the threads have completed. */ pthread_join(thread1, NULL); pthread_join(thread2, NULL); return 0; } rr-4.4.0/src/test/threads.run000066400000000000000000000005651277367620400161140ustar00rootroot00000000000000source `dirname $0`/util.sh # When the syscallbuf is enabled, this test looks to rr like a long # series of CPU chewing, with buffer flushes at each time-slice # interrupt. This makes replay take a pathologically long time # because of all the async-signal replaying. So speed things up by # bumping up the timeslice. RECORD_ARGS="-c20000000" compare_test EXIT-SUCCESS rr-4.4.0/src/test/timer.c000066400000000000000000000040221277367620400152100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int caught_sig = 0; void catcher(int signum, __attribute__((unused)) siginfo_t* siginfo_ptr, __attribute__((unused)) void* ucontext_ptr) { caught_sig = signum; } int main(void) { timer_t* id; struct itimerspec its = { { 100000, 0 }, { 0, 100000000 } }; struct itimerspec its2 = { { 100000, 0 }, { 100000, 0 } }; struct itimerspec* old; struct itimerspec* old2; struct sigaction sact; int counter; sigemptyset(&sact.sa_mask); sact.sa_flags = SA_SIGINFO; sact.sa_sigaction = catcher; sigaction(SIGALRM, &sact, NULL); ALLOCATE_GUARD(id, 'a'); test_assert(0 == timer_create(CLOCK_REALTIME, NULL, id)); VERIFY_GUARD(id); test_assert(0 == timer_settime(*id, 0, &its, NULL)); for (counter = 0; counter >= 0 && !caught_sig; counter++) { if (counter % 100000 == 0) { write(STDOUT_FILENO, ".", 1); } } atomic_printf("\nSignal %d caught, Counter is %d\n", caught_sig, counter); test_assert(SIGALRM == caught_sig); test_assert(0 == timer_getoverrun(*id)); ALLOCATE_GUARD(old, 'b'); test_assert(0 == timer_settime(*id, 0, &its2, old)); VERIFY_GUARD(old); test_assert(old->it_interval.tv_sec == its.it_interval.tv_sec); test_assert(old->it_interval.tv_nsec == its.it_interval.tv_nsec); test_assert(old->it_value.tv_sec <= its.it_interval.tv_sec); test_assert(old->it_value.tv_sec >= its.it_interval.tv_sec / 2); test_assert(old->it_value.tv_nsec < 1000000000); ALLOCATE_GUARD(old2, 'c'); test_assert(0 == timer_gettime(*id, old2)); VERIFY_GUARD(old2); test_assert(old2->it_interval.tv_sec == its2.it_interval.tv_sec); test_assert(old2->it_interval.tv_nsec == its2.it_interval.tv_nsec); test_assert(old2->it_value.tv_sec <= its2.it_interval.tv_sec); test_assert(old2->it_value.tv_sec >= its2.it_interval.tv_sec / 2); test_assert(old2->it_value.tv_nsec < 1000000000); test_assert(0 == timer_delete(*id)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/timerfd.c000066400000000000000000000023711277367620400155270ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int fd = timerfd_create(CLOCK_MONOTONIC, 0); struct itimerspec spec, old; uint64_t num_expirations; atomic_printf("created timerfd %d\n", fd); test_assert(fd >= 0); memset(&spec, 0, sizeof(spec)); spec.it_value.tv_nsec = 100000000; atomic_printf("setting timer to expire in {sec:%ld,nsec:%ld}\n", spec.it_value.tv_sec, spec.it_value.tv_nsec); timerfd_settime(fd, 0, &spec, &old); atomic_printf(" (old expiration was {sec:%ld,nsec:%ld})\n", old.it_value.tv_sec, old.it_value.tv_nsec); test_assert(0 == old.it_value.tv_sec && 0 == old.it_value.tv_nsec); atomic_puts("sleeping 50ms ..."); usleep(50000); timerfd_gettime(fd, &old); atomic_printf(" expiration now in {sec:%ld,nsec:%ld})\n", old.it_value.tv_sec, old.it_value.tv_nsec); test_assert(0 == old.it_value.tv_sec && old.it_value.tv_nsec <= 50000000); atomic_puts("waiting for timer to expire ..."); read(fd, &num_expirations, sizeof(num_expirations)); atomic_printf(" timer expired %" PRIu64 " times\n", num_expirations); test_assert(1 == num_expirations); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/times.c000066400000000000000000000007431277367620400152170ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct tms* buf; clock_t t; ALLOCATE_GUARD(buf, -1); test_assert((t = times(buf)) != (clock_t)-1); test_assert(buf->tms_cutime == 0); test_assert(buf->tms_utime >= 0); VERIFY_GUARD(buf); atomic_printf("tms_utime = %lld\n", (long long)buf->tms_utime); atomic_printf("result = %lld\n", (long long)t); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/tls.c000066400000000000000000000006121277367620400146730ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" __thread int tlsvar; void breakpoint_fn(void) {} void* thread_fn(void* arg) { tlsvar = *(int*)arg; breakpoint_fn(); return NULL; } int main(void) { pthread_t thread; int value = 97; pthread_create(&thread, NULL, thread_fn, &value); pthread_join(thread, NULL); return 0; } rr-4.4.0/src/test/tls.py000066400000000000000000000002571277367620400151060ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint_fn') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('print tlsvar') expect_gdb(' = 97') ok() rr-4.4.0/src/test/tls.run000066400000000000000000000000611277367620400152530ustar00rootroot00000000000000source `dirname $0`/util.sh record tls debug tls rr-4.4.0/src/test/trace_version.run000066400000000000000000000015671277367620400173300ustar00rootroot00000000000000source `dirname $0`/util.sh TRACE_DIR=trace_0 function expect_replay_fail { replay if [[ $(cat replay.err) == "" ]]; then echo "Test '$TESTNAME' FAILED: replay should have failed, but it succeeded." exit 1 fi echo " (replay failed as expected)" } record simple$bitness trace_dir="simple$bitness-$nonce-0" if [ ! -f "$trace_dir/version" ]; then echo "Test '$TESTNAME' FAILED: version file not found in trace directory." exit 1 fi; echo "Moving version file away ..." mv "$trace_dir/version" ./version.tmp expect_replay_fail echo "Trying to replay with empty version file ..." echo "" > "$trace_dir/version" expect_replay_fail echo "Trying to replay with dummy version number ..." echo "-42\n" > "$trace_dir/version" expect_replay_fail echo "Restoring trace version file ..." mv ./version.tmp "$trace_dir/version" replay check EXIT-SUCCESS rr-4.4.0/src/test/truncate.c000066400000000000000000000017111277367620400157170ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #define _FILE_OFFSET_BITS 64 #include "rrutil.h" #define TEST_FILE "foo.txt" ssize_t get_file_size(const char* filename) { struct stat* st; ssize_t result; ALLOCATE_GUARD(st, 'x'); test_assert(0 == stat(filename, st)); result = st->st_size; FREE_GUARD(st); return result; } int main(void) { int fd; ssize_t size; fd = open(TEST_FILE, O_CREAT | O_EXCL | O_RDWR, 0600); test_assert(0 <= fd); size = get_file_size(TEST_FILE); atomic_printf("initial file size: %zd\n", size); test_assert(0 == size); truncate(TEST_FILE, 4096); size = get_file_size(TEST_FILE); atomic_printf("after truncate(4096): %zd\n", size); test_assert(4096 == size); ftruncate(fd, 8192); size = get_file_size(TEST_FILE); atomic_printf("after truncate(8192): %zd\n", size); test_assert(8192 == size); unlink(TEST_FILE); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/ttyname.c000066400000000000000000000006251277367620400155560ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { char* tty = ttyname(STDIN_FILENO); atomic_printf("ttyname = %s\n", tty); if (!tty) { atomic_puts("No tty attached to stdin"); fputs("EXIT-SUCCESS", stderr); return 0; } int fd = open(tty, O_RDWR); test_assert(13 == write(fd, "EXIT-SUCCESS\n", 13)); return 0; } rr-4.4.0/src/test/ttyname.run000066400000000000000000000005261277367620400161400ustar00rootroot00000000000000source `dirname $0`/util.sh record $TESTNAME replay token=EXIT-SUCCESS if [[ "replay.err" != $(grep -l $token replay.err) ]]; then failed ": token '$token' not in replay.err:" echo "--------------------------------------------------" cat replay.err echo "--------------------------------------------------" else passed fi rr-4.4.0/src/test/uname.c000066400000000000000000000013131277367620400151750ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { struct utsname* buf; ALLOCATE_GUARD(buf, 0); test_assert(0 == uname(buf)); test_assert(buf->sysname[0] != 0); test_assert(buf->nodename[0] != 0); test_assert(buf->release[0] != 0); test_assert(buf->version[0] != 0); test_assert(buf->machine[0] != 0); VERIFY_GUARD(buf); atomic_printf("{ sysname: '%s', nodename: '%s', release: '%s',\n" " version: '%s', machine: '%s', domainname: '%s' }\n", buf->sysname, buf->nodename, buf->release, buf->version, buf->machine, buf->domainname); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/unexpected_stack_growth.c000066400000000000000000000012711277367620400210160ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static volatile int vv = 0; static void breakpoint(void) {} static void funcall(void) { char buf[2000000]; size_t i; for (i = 0; i < sizeof(buf); ++i) { buf[i] = (char)i; } for (i = 0; i < sizeof(buf); ++i) { vv += buf[i % 777777]; } } int main(void) { char v; char* fix_addr; void* p; breakpoint(); fix_addr = (char*)(((uintptr_t)&v - 256 * 1024) & ~(uintptr_t)(PAGE_SIZE - 1)); p = mmap(fix_addr, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); test_assert(p == fix_addr); funcall(); return 0; } rr-4.4.0/src/test/unexpected_stack_growth.py000066400000000000000000000004741277367620400212300ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('finish') send_gdb('watch -l *(&v - 1000000)') expect_gdb('Hardware[()/a-z ]+watchpoint 2') send_gdb('c') expect_gdb('signal SIGSEGV') send_gdb('c') expect_gdb('exited normally') ok() rr-4.4.0/src/test/unexpected_stack_growth.run000066400000000000000000000000471277367620400214000ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/unjoined_thread.c000066400000000000000000000005211277367620400172320ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void* thread(__attribute__((unused)) void* unused) { sleep(-1); return NULL; } int main(void) { pthread_t t; pthread_create(&t, NULL, thread, NULL); /* Don't join |t|. */ atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/unshare.c000066400000000000000000000157601277367620400155500ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define MAX_FDS 2048 extern int capset(cap_user_header_t header, const cap_user_data_t data); static char tmp_name[] = "/tmp/rr-unshare-tmp-XXXXXX"; static uid_t uid; static uid_t gid; static void* start_thread(__attribute__((unused)) void* p) { test_assert(0 == unshare(CLONE_FILES)); test_assert(0 == close(STDOUT_FILENO)); return NULL; } static void test_mount(void) { test_assert(0 == mkdir("/aaa", 0777)); /* Most filesystems can't be mounted in a non-root namespace, but proc can. */ test_assert(0 == mount("dummy", "/aaa", "proc", 0, NULL)); test_assert(0 == access("/aaa/cpuinfo", F_OK)); test_assert(0 == umount("/aaa")); test_assert(0 == mount("dummy", "/aaa", "proc", 0, NULL)); test_assert(0 == umount2("/aaa", 0)); test_assert(0 == rmdir("/aaa")); } static void test_uids(void) { test_assert(0 == syscall(SYS_setreuid, 7, 7)); #ifdef SYS_setreuid32 test_assert(0 == syscall(SYS_setreuid32, 7, 7)); #endif test_assert(0 == syscall(SYS_setregid, 8, 8)); #ifdef SYS_setreuid32 test_assert(0 == syscall(SYS_setregid32, 8, 8)); #endif test_assert(0 == syscall(SYS_setresuid, 7, 7, 7)); #ifdef SYS_setresuid32 test_assert(0 == syscall(SYS_setresuid32, 7, 7, 7)); #endif test_assert(0 == syscall(SYS_setresgid, 8, 8, 8)); #ifdef SYS_setresuid32 test_assert(0 == syscall(SYS_setresgid32, 8, 8, 8)); #endif test_assert(0 == syscall(SYS_setuid, 7)); #ifdef SYS_setuid32 test_assert(0 == syscall(SYS_setuid32, 7)); #endif test_assert(0 == syscall(SYS_setgid, 8)); #ifdef SYS_setgid32 test_assert(0 == syscall(SYS_setgid32, 8)); #endif test_assert(7 == syscall(SYS_setfsuid, 7)); #ifdef SYS_setfsuid32 test_assert(7 == syscall(SYS_setfsuid32, 7)); #endif test_assert(8 == syscall(SYS_setfsgid, 8)); #ifdef SYS_setfsgid32 test_assert(8 == syscall(SYS_setfsgid32, 8)); #endif test_assert(7 == syscall(SYS_getuid)); #ifdef SYS_getuid32 test_assert(7 == syscall(SYS_getuid32)); #endif test_assert(8 == syscall(SYS_getgid)); #ifdef SYS_getgid32 test_assert(8 == syscall(SYS_getgid32)); #endif test_assert(7 == syscall(SYS_geteuid)); #ifdef SYS_geteuid32 test_assert(7 == syscall(SYS_geteuid32)); #endif test_assert(8 == syscall(SYS_getegid)); #ifdef SYS_getegid32 test_assert(8 == syscall(SYS_getegid32)); #endif } static void test_setns(void) { int uts_ns = open("/proc/self/ns/uts", O_RDONLY); pid_t child; int status; test_assert(uts_ns >= 0); child = fork(); if (!child) { test_assert(0 == unshare(CLONE_NEWUTS)); /* setns requires that this process be privileged in both the old and new * uts namespaces. We are. */ test_assert(0 == setns(uts_ns, CLONE_NEWUTS)); exit(76); } test_assert(child = wait(&status)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 76); test_assert(0 == close(uts_ns)); } static void test_sethostname(void) { char name[] = "hello"; char buf[1000]; test_assert(0 == sethostname(name, strlen(name))); test_assert(0 == gethostname(buf, sizeof(buf))); test_assert(0 == strcmp(buf, name)); } static void test_setdomainname(void) { char name[] = "kitty"; char buf[1000]; test_assert(0 == setdomainname(name, strlen(name))); test_assert(0 == getdomainname(buf, sizeof(buf))); test_assert(0 == strcmp(buf, name)); } static void test_capset_and_drop_privileges(void) { struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_1, 0 }; struct __user_cap_data_struct data = { 0x1, 0x1, 0x1 }; /* Test using capset. capset is privileged, but we are privileged in our user namespace. After this we are no longer privileged. */ test_assert(0 == capset(&hdr, &data)); } static void write_user_namespace_mappings(void) { char buf[100]; int fd; fd = open("/proc/self/uid_map", O_WRONLY | O_CREAT); test_assert(fd >= 0); sprintf(buf, "7 %d 1\n", uid); test_assert((ssize_t)strlen(buf) == write(fd, buf, strlen(buf))); test_assert(0 == close(fd)); /* Per user_namespaces(7), we need to write 'deny' to /proc/self/setgroups * before we set up gid_map. This means we can't test setgroups here. Oh well. */ fd = open("/proc/self/setgroups", O_WRONLY | O_CREAT); /* This file does not exist in some old kernel */ if (fd >= 0) { sprintf(buf, "deny"); test_assert((ssize_t)strlen(buf) == write(fd, buf, strlen(buf))); test_assert(0 == close(fd)); } fd = open("/proc/self/gid_map", O_WRONLY | O_CREAT); test_assert(fd >= 0); sprintf(buf, "8 %d 1\n", gid); test_assert((ssize_t)strlen(buf) == write(fd, buf, strlen(buf))); test_assert(0 == close(fd)); } static void run_child(void) { pid_t child; int status; child = fork(); if (!child) { test_assert(0 == mkdir("/proc", 0777)); test_assert(0 == mount("dummy", "/proc", "proc", 0, NULL)); write_user_namespace_mappings(); /* Test creating a nested child */ pid_t nested_child = fork(); if (!nested_child) { exit(77); } test_assert(nested_child == wait(&status)); test_assert(WIFEXITED(status) && 77 == WEXITSTATUS(status)); /* Test creating a thread */ pthread_t thread; pthread_create(&thread, NULL, start_thread, NULL); pthread_join(thread, NULL); test_mount(); test_uids(); test_setns(); test_sethostname(); test_setdomainname(); test_assert(0 == umount("/proc")); test_assert(0 == rmdir("/proc")); test_capset_and_drop_privileges(); /* stdout should still be writable due to the unshare() in start_thread */ test_assert(13 == write(STDOUT_FILENO, "EXIT-SUCCESS\n", 13)); exit(55); } test_assert(child == wait(&status)); test_assert(WIFEXITED(status) && 55 == WEXITSTATUS(status)); } static int run_test(void) { int ret; int fd; struct rlimit nofile; int fd_limit; test_assert(0 == getrlimit(RLIMIT_NOFILE, &nofile)); if (nofile.rlim_cur == RLIM_INFINITY || nofile.rlim_cur > MAX_FDS) { fd_limit = MAX_FDS; } else { fd_limit = nofile.rlim_cur; } for (fd = STDERR_FILENO + 1; fd < fd_limit; ++fd) { ret = close(fd); test_assert(ret == 0 || (ret == -1 && errno == EBADF)); } ret = unshare(CLONE_NEWUSER); if (ret == -1 && (errno == EINVAL || errno == EPERM)) { atomic_puts("EXIT-SUCCESS"); return 77; } test_assert(0 == ret); test_assert(0 == unshare(CLONE_NEWNS)); test_assert(0 == unshare(CLONE_NEWIPC)); test_assert(0 == unshare(CLONE_NEWNET)); test_assert(0 == unshare(CLONE_NEWUTS)); ret = unshare(CLONE_NEWPID); if (ret == -1 && errno == EINVAL) { atomic_puts("EXIT-SUCCESS"); return 77; } test_assert(0 == ret); test_assert(0 == chroot(tmp_name)); run_child(); return 77; } int main(void) { pid_t child; int ret; int status; uid = getuid(); gid = getgid(); test_assert(tmp_name == mkdtemp(tmp_name)); child = fork(); if (!child) { return run_test(); } ret = wait(&status); test_assert(0 == rmdir(tmp_name)); test_assert(child == ret); test_assert(WIFEXITED(status) && 77 == WEXITSTATUS(status)); return 0; } rr-4.4.0/src/test/unwind_on_signal.py000066400000000000000000000003601277367620400176340ustar00rootroot00000000000000from rrutil import * send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('p strlen(0)') expect_gdb('received signal SIGSEGV') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('SIGKILL') ok() rr-4.4.0/src/test/unwind_on_signal.run000066400000000000000000000001111277367620400200020ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug unwind_on_signal rr-4.4.0/src/test/usb.c000066400000000000000000000106631277367620400146710ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ /* Based on https://github.com/ktossell/libuvc/blob/master/src/example.c Software License Agreement (BSD License) Copyright (C) 2010-2015 Ken Tossell All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of the author nor other contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* Tests a subset of the USBDEVFS ioctls. Requires libuvc to build: https://github.com/ktossell/libuvc Therefore this test is not built/run by default. */ #include "rrutil.h" #include "libuvc/libuvc.h" static int frame_count = 0; void cb(uvc_frame_t* frame, __attribute__((unused)) void* ptr) { uvc_frame_t* bgr; uvc_error_t ret; bgr = uvc_allocate_frame(frame->width * frame->height * 3); test_assert(bgr != NULL); ret = uvc_any2bgr(frame, bgr); test_assert(ret == 0); ++frame_count; uvc_free_frame(bgr); } int main(void) { uvc_context_t* ctx; uvc_device_t* dev; uvc_device_handle_t* devh; uvc_stream_ctrl_t ctrl; uvc_error_t res; res = uvc_init(&ctx, NULL); test_assert(res >= 0); atomic_puts("UVC initialized"); /* Locates the first attached UVC device, stores in dev */ res = uvc_find_device(ctx, &dev, 0, 0, NULL); /* filter devices: vendor_id, product_id, "serial_num" */ if (res < 0) { atomic_puts("No device found"); atomic_puts("EXIT-SUCCESS"); return 0; } atomic_puts("Device found"); /* Try to open the device: requires exclusive access */ res = uvc_open(dev, &devh); if (res < 0) { atomic_puts("Can't open device"); atomic_puts("EXIT-SUCCESS"); return 0; } atomic_puts("Device opened"); /* Print out a message containing all the information that libuvc * knows about the device */ uvc_print_diag(devh, stdout); /* Try to negotiate a 640x480 30 fps YUYV stream profile */ res = uvc_get_stream_ctrl_format_size( devh, &ctrl, /* result stored in ctrl */ UVC_FRAME_FORMAT_YUYV, /* YUV 422, aka YUV 4:2:2. try _COMPRESSED */ 640, 480, 30 /* width, height, fps */ ); /* Print out the result */ uvc_print_stream_ctrl(&ctrl, stdout); if (res < 0) { atomic_puts("No matching stream"); atomic_puts("EXIT-SUCCESS"); return 0; } /* Start the video stream. The library will call user function cb: * cb(frame, (void*) 12345) */ res = uvc_start_streaming(devh, &ctrl, cb, (void*)12345, 0); test_assert(res >= 0); atomic_puts("Streaming..."); uvc_set_ae_mode(devh, 1); /* e.g., turn on auto exposure */ sleep(2); /* stream for 2 seconds */ atomic_puts("Stopping streaming."); /* End the stream. Blocks until last callback is serviced */ uvc_stop_streaming(devh); atomic_puts("Done streaming."); /* Release our handle on the device */ uvc_close(devh); atomic_puts("Device closed"); /* Release the device descriptor */ uvc_unref_device(dev); /* Close the UVC context. This closes and cleans up any existing device * handles, * and it closes the libusb context if one was not provided. */ uvc_exit(ctx); test_assert(frame_count > 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/user_ignore_sig.c000066400000000000000000000010711277367620400172540ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void handle_usr1(__attribute__((unused)) int sig) { test_assert("Shouldn't have caught SIGUSR1" && 0); } int main(void) { /* NB: unlike most other rr tests, this one verifies that rr * can "intervene" in execution to block signals, for the * purposes of unit tests. This test *will* fail if not run * under rr with the right command-line options. */ signal(SIGUSR1, handle_usr1); raise(SIGUSR1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/user_ignore_sig.run000066400000000000000000000001741277367620400176410ustar00rootroot00000000000000source `dirname $0`/util.sh # Ignore SIGUSR1; block its delivery to tracees. RECORD_ARGS="-i10" compare_test EXIT-SUCCESS rr-4.4.0/src/test/util.sh000066400000000000000000000264011277367620400152420ustar00rootroot00000000000000# # This file is included by foo.run test-driver files. It provides # some helpers for common test operations. A driver file foo.run # will want to include this file as follows # # source `dirname $0`/util.sh # # It is essential that util.sh inherit its $n parameters from the # driver script's parameters. # # Most tests are either "compare_test"s, which check that record and # replay successfully complete and the output is the same, or, # "debug_test"s, which launch a debugger script. So the remainder of # your test runner probably looks like # # compare_test # or, |debug_test| # # Test runners may set the environment variable $RECORD_ARGS to pass # arguments to rr for recording. This is only useful for tweaking the # scheduler, don't use it for anything else. # # delay_kill # # Deliver the signal |sig|, after waiting |delay_secs| seconds, to the # process named |proc|. If there's more than |proc|, the signal is # not delivered. function delay_kill { sig=$1; delay_secs=$2; proc=$3 sleep $delay_secs pid="" for i in `seq 1 5`; do live=`ps ax -o 'pid= cmd=' | awk '{print $1 " " $2}' | grep $proc` num=`echo "$live" | wc -l` if [[ "$num" -eq 1 ]]; then pid=`echo "$live" | awk '{print $1}'` break fi sleep 0.1 done if [[ "$num" -gt 1 ]]; then leave_data=y echo FAILED: "$num" of "'$proc'" >&2 exit 1 elif [[ -z "$pid" ]]; then leave_data=y echo FAILED: process "'$proc'" not located >&2 exit 1 fi kill -s $sig $pid if [[ $? != 0 ]]; then # Sometimes we fail to deliver a signal to a process because # it finished first (due to scheduling races). That's a benign # failure. echo signal $sig not delivered to "'$proc'", letting test succeed anyway else echo Successfully delivered signal $sig to "'$proc'" fi } function fatal { #... echo "$@" >&2 exit 1 } function onexit { cd if [[ "$leave_data" != "y" ]]; then rm -rf $workdir else echo Test $TESTNAME failed, leaving behind $workdir echo To replay the failed test, run echo " " _RR_TRACE_DIR="$workdir" rr replay fi } function parent_pid_of { pid=$1 ps -p $pid -o ppid= } function usage { echo Usage: "util.sh TESTNAME [LIB_ARG] [OBJDIR]" } DEFAULT_FLAGS="--suppress-environment-warnings --check-cached-mmaps --fatal-errors" # Don't bind record/replay tracees to the same logical CPU. When we # do that, the tests take impractically long to run. # # TODO: find a way to run faster with CPU binding GLOBAL_OPTIONS="$DEFAULT_FLAGS" # ... but tests that DO want CPU binding can override the default by # setting # # GLOBAL_OPTIONS="$GLOBAL_OPTIONS_BIND_CPU" # # just after sourcing this file. GLOBAL_OPTIONS_BIND_CPU="$DEFAULT_FLAGS" LIB_ARG=$1 SRCDIR=$2 if [[ ! -d "$SRCDIR" ]]; then fatal "FAILED: srcdir missing" fi OBJDIR=$3 if [[ "$OBJDIR" == "" ]]; then # Default to assuming that the user's working directory is the # src/test/ directory within the rr clone. OBJDIR=`realpath ../../../obj` fi TESTNAME=$4 if [[ "$TESTNAME" == "" ]]; then [[ $0 =~ ([A-Za-z0-9_]+)\.run$ ]] || fatal "FAILED: bad test script name" TESTNAME=${BASH_REMATCH[1]} fi if [[ $TESTNAME =~ ([A-Za-z0-9_]+)_32$ ]]; then bitness=_32 TESTNAME_NO_BITNESS=${BASH_REMATCH[1]} else TESTNAME_NO_BITNESS=$TESTNAME fi # The temporary directory we create for this test run. workdir= # Did the test pass? If not, then we'll leave the recording and # output around for developers to debug. leave_data=n # The unique ID allocated to this test directory. nonce= # Set up the environment and working directory. TESTDIR="${SRCDIR}/src/test" export PATH="${OBJDIR}/bin:${PATH}" export LD_LIBRARY_PATH="${OBJDIR}/lib:/usr/local/lib:${LD_LIBRARY_PATH}" which rr >/dev/null 2>&1 if [[ "$?" != "0" ]]; then fatal FAILED: rr not found in PATH "($PATH)" fi if [[ ! -d $SRCDIR ]]; then fatal FAILED: SRCDIR "($SRCDIR)" not found. objdir and srcdir must share the same parent. fi if [[ ! -d $TESTDIR ]]; then fatal FAILED: TESTDIR "($TESTDIR)" not found. fi # Our test programs intentionally crash a lot. Don't generate coredumps for them. ulimit -c 0 # NB: must set up the trap handler *before* mktemp trap onexit EXIT workdir=`mktemp -dt rr-test-$TESTNAME-XXXXXXXXX` cd $workdir # XXX technically the trailing -XXXXXXXXXX isn't unique, since there # could be "foo-123456789" and "bar-123456789", but if that happens, # buy me a lottery ticket. baseworkdir=$(basename ${workdir}) nonce=${baseworkdir#rr-test-$TESTNAME-} ##-------------------------------------------------- ## Now we come to the helpers available to test runners. This is the ## testing "API". ## function fails { why=$1; echo NOTE: Skipping "'$TESTNAME'" because it fails: $why exit 0 } # If the test takes too long to run without the syscallbuf enabled, # use this to prevent it from running when that's the case. function skip_if_no_syscall_buf { if [[ "-n" == "$LIB_ARG" ]]; then echo NOTE: Skipping "'$TESTNAME'" because syscallbuf is disabled exit 0 fi } # If the test is causing an unrealistic failure when the syscallbuf is # enabled, skip it. This better be a temporary situation! function skip_if_syscall_buf { if [[ "-b" == "$LIB_ARG" || "" == "$LIB_ARG" ]]; then echo NOTE: Skipping "'$TESTNAME'" because syscallbuf is enabled exit 0 fi } function just_record { exe=$1; exeargs=$2; _RR_TRACE_DIR="$workdir" \ rr $GLOBAL_OPTIONS record $LIB_ARG $RECORD_ARGS $exe $exeargs 1> record.out 2> record.err } function save_exe { exe=$1; cp ${OBJDIR}/bin/$exe $exe-$nonce } # Record $exe with $exeargs. function record { exe=$1; save_exe $exe just_record ./$exe-$nonce "$2 $3 $4 $5" } # record_async_signal # # Record $test, delivering $signal to it after $delay-secs. # If for some reason delay_kill doesn't run in time, the signal # will not be delivered but the test will not be aborted. function record_async_signal { sig=$1; delay_secs=$2; exe=$3; exeargs=$4; delay_kill $sig $delay_secs $exe-$nonce & record $exe $exeargs wait } function replay { replayflags=$1 _RR_TRACE_DIR="$workdir" \ rr $GLOBAL_OPTIONS replay -a $replayflags 1> replay.out 2> replay.err } function do_ps { psflags=$1 _RR_TRACE_DIR="$workdir" rr $GLOBAL_OPTIONS ps $psflags } # debug [replay-args] # # Load the "expect" script to drive replay of the recording of |exe|. function debug { expectscript=$1; replayargs=$2 _RR_TRACE_DIR="$workdir" \ python2 $TESTDIR/$expectscript.py \ rr $GLOBAL_OPTIONS replay -x $TESTDIR/test_setup.gdb $replayargs if [[ $? == 0 ]]; then passed else failed "debug script failed" fi } function failed { msg=$1; leave_data=y echo "Test '$TESTNAME' FAILED: $msg" } function passed { echo "Test '$TESTNAME' PASSED" } # Check that (i) no error during replay; (ii) recorded and replayed # output match; (iii) the supplied token was found in the output. # Otherwise the test fails. function check { token=$1; if [ ! -f record.out -o ! -f replay.err -o ! -f replay.out -o ! -f record.err ]; then failed "output files not found." elif [[ $(cat record.err) != "" ]]; then failed ": error during recording:" echo "--------------------------------------------------" cat record.err echo "--------------------------------------------------" echo "record.out:" echo "--------------------------------------------------" cat record.out echo "--------------------------------------------------" elif [[ "$token" != "" && "record.out" != $(grep -l "$token" record.out) ]]; then failed ": token '$token' not in record.out:" echo "--------------------------------------------------" cat record.out echo "--------------------------------------------------" elif [[ $(cat replay.err) != "" ]]; then failed ": error during replay:" echo "--------------------------------------------------" cat replay.err echo "--------------------------------------------------" echo "replay.out:" echo "--------------------------------------------------" cat replay.out echo "--------------------------------------------------" elif [[ $(diff record.out replay.out) != "" ]]; then failed ": output from recording different than replay" echo "diff -U8 $workdir/record.out $workdir/replay.out" diff -U8 record.out replay.out else passed fi } # compare_test [] [executable] # # Record the test name passed to |util.sh|, then replay it (optionally # with $replayflags) and verify record/replay output match and $token # appears in the output. Uses $executable instead of the passed-in testname # if present. function compare_test { token=$1; replayflags=$2; test=$TESTNAME if (( $# >= 3 )); then test=$3 fi if [[ $token == "" ]]; then failed ": didn't pass an exit token" fi record $test replay $replayflags check $token } # debug_test # # Record the test name passed to |util.sh|, then replay the recording # using the "expect" script $test-name.py, which is responsible for # computing test pass/fail. function debug_test { record $TESTNAME debug $TESTNAME_NO_BITNESS } # Return the number of events in the most recent local recording. function count_events { local events=$(rr $GLOBAL_OPTIONS dump -r latest-trace | wc -l) # The |simple| test is just about the simplest possible C program, # and has around 180 events (when recorded on a particular # developer's machine). If we count a number of events # significalty less than that, almost certainly something has gone # wrong. if [ "$events" -le 150 ]; then failed ": Recording had too few events. Is |rr dump -r| broken?" fi # This event count is used to loop over attaching the debugger. # The tests assume that the debugger can be attached at all # events, but at the very last events, EXIT and so forth, rr can't # attach the debugger. So we fudge the event count down to avoid # that edge case. let "events -= 10" echo $events } # Return a random number from the range [min, max], inclusive. function rand_range { min=$1; max=$2 local num=$RANDOM local range="" let "range = 1 + $max - $min" let "num %= $range" let "num += $min" echo $num } # Record |exe|, then replay it using the |restart_finish| debugger # script attaching at every recorded event. To make the # debugger-replays more practical, the events are strided between at a # random interval between [min, max], inclusive. # # So for example, |checkpoint_test simple 3 5| means to record the # "simple" test, and attach the debugger at every X'th event, where X # is a random number in [3, 5]. function checkpoint_test { exe=$1; min=$2; max=$3; record $exe num_events=$(count_events) stride=$(rand_range $min $max) for i in $(seq 1 $stride $num_events); do echo Checkpointing at event $i ... debug restart_finish "-g $i" if [[ "$leave_data" == "y" ]]; then break fi done } rr-4.4.0/src/test/utimes.c000066400000000000000000000015021277367620400153760ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const int MOD_TIME = 888888; static const int ACCESS_TIME = 999999; int main(void) { char path[] = "rr-test-file-XXXXXX"; int fd = mkstemp(path); struct utimbuf utim = { ACCESS_TIME, MOD_TIME }; struct timeval tv[2] = { { ACCESS_TIME + 1, 0 }, { MOD_TIME + 1, 0 } }; struct stat st; test_assert(0 <= fd); test_assert(0 == utime(path, &utim)); test_assert(0 == fstat(fd, &st)); test_assert(st.st_atime == ACCESS_TIME); test_assert(st.st_mtime == MOD_TIME); test_assert(0 == utimes(path, tv)); test_assert(0 == fstat(fd, &st)); test_assert(st.st_atime == ACCESS_TIME + 1); test_assert(st.st_mtime == MOD_TIME + 1); test_assert(0 == unlink(path)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/vfork.c000066400000000000000000000010311277367620400152140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(int argc, char* argv[]) { const char* exe; pid_t child; int status; test_assert(2 == argc); exe = argv[1]; if (0 == (child = vfork())) { execl(exe, exe, NULL); test_assert("Not reached" && 0); } atomic_printf("child %d\n", child); test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); atomic_puts("vforker-EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/vfork.run000066400000000000000000000001761277367620400156070ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe simple$bitness record $TESTNAME simple$bitness-$nonce replay check vforker-EXIT-SUCCESS rr-4.4.0/src/test/vfork_exec.run000066400000000000000000000004261277367620400166110ustar00rootroot00000000000000source `dirname $0`/util.sh save_exe rr_exec_stub$bitness saved_exe="rr_exec_stub$bitness-$nonce" record vfork$bitness "$saved_exe" TARGET_PID=$(grep 'child ' record.out | awk '{print $2}') echo Targeting recorded pid $TARGET_PID ... debug first_instruction "-p $TARGET_PID" rr-4.4.0/src/test/vfork_flush.c000066400000000000000000000011751277367620400164260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void unblock_signals(void) { sigset_t mask; sigemptyset(&mask); sigprocmask(SIG_SETMASK, &mask, NULL); } int main(void) { pid_t child; int status; if (0 == (child = vfork())) { /* Unblocking SIGSYS should be OK */ unblock_signals(); test_assert(0 == close(0)); _exit(77); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); /* Unblocking SIGSYS should be OK */ unblock_signals(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/vfork_shared.c000066400000000000000000000010661277367620400165520ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int* p; int main(void) { pid_t child; int status; if (0 == (child = vfork())) { p = (int*)mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); *p = 88; test_assert(p != MAP_FAILED); _exit(77); } test_assert(child == waitpid(child, &status, 0)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); test_assert(*p == 88); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/video_capture.c000066400000000000000000000142151277367620400167260ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char device_name[] = "/dev/video0"; struct buffer { struct v4l2_buffer vbuf; unsigned char* mmap_data; }; static struct buffer buffers[4]; static size_t buffer_count; static void no_v4l2(void) { atomic_puts("EXIT-SUCCESS"); exit(0); } static int open_device(void) { struct v4l2_capability cap; int fd = open("/dev/video0", O_RDWR); int ret; if (fd < 0 && errno == ENOENT) { atomic_printf("%s not found; aborting test\n", device_name); no_v4l2(); } if (fd < 0 && errno == EACCES) { atomic_printf("%s not accessible; aborting test\n", device_name); no_v4l2(); } test_assert(fd >= 0); ret = ioctl(fd, VIDIOC_QUERYCAP, &cap); if (ret < 0 && errno == EINVAL) { atomic_printf("%s is not a V4L2 device; aborting test\n", device_name); no_v4l2(); } if (ret < 0 && errno == EACCES) { atomic_printf("%s is not accessible; aborting test\n", device_name); no_v4l2(); } if (!(cap.capabilities & V4L2_CAP_VIDEO_CAPTURE)) { atomic_printf("%s is not a V4L2 capture device; aborting test\n", device_name); no_v4l2(); } if (!(cap.capabilities & V4L2_CAP_STREAMING)) { atomic_printf("%s does not support streaming; aborting test\n", device_name); no_v4l2(); } return fd; } static void init_device(int fd) { struct v4l2_format fmt; struct v4l2_requestbuffers req; int ret; size_t i; enum v4l2_buf_type type; fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; test_assert(0 == ioctl(fd, VIDIOC_G_FMT, &fmt)); atomic_printf("%s returning %dx%d frames\n", device_name, fmt.fmt.pix.width, fmt.fmt.pix.height); req.count = 4; req.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; req.memory = V4L2_MEMORY_MMAP; ret = ioctl(fd, VIDIOC_REQBUFS, &req); if (ret < 0 && errno == EINVAL) { atomic_printf("%s does not support memory mapping; aborting test\n", device_name); no_v4l2(); } if (ret < 0 && errno == EBUSY) { atomic_printf("%s is busy; aborting test\n", device_name); no_v4l2(); } test_assert(0 == ret); if (req.count < 2) { atomic_printf("%s only supports one buffer; aborting test\n", device_name); no_v4l2(); } buffer_count = req.count; for (i = 0; i < buffer_count; ++i) { struct buffer* buf = buffers + i; buf->vbuf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; buf->vbuf.memory = V4L2_MEMORY_MMAP; buf->vbuf.index = i; test_assert(0 == ioctl(fd, VIDIOC_QUERYBUF, &buf->vbuf)); buf->mmap_data = mmap(NULL, buf->vbuf.length, PROT_READ | PROT_WRITE, MAP_SHARED, fd, buf->vbuf.m.offset); test_assert(buf->mmap_data != MAP_FAILED); test_assert(0 == ioctl(fd, VIDIOC_QBUF, &buf->vbuf)); } type = V4L2_BUF_TYPE_VIDEO_CAPTURE; test_assert(0 == ioctl(fd, VIDIOC_STREAMON, &type)); } static void print_fourcc(int v) { union { int v; char cs[4]; } u; u.v = v; atomic_printf("%c%c%c%c", u.cs[0], u.cs[1], u.cs[2], u.cs[3]); } static double fract_to_fps(struct v4l2_fract* f) { return (double)f->denominator / f->numerator; } static void dump_sizes(int fd) { struct v4l2_fmtdesc fmt; fmt.index = 0; fmt.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; while (1) { struct v4l2_frmsizeenum size; int ret = ioctl(fd, VIDIOC_ENUM_FMT, &fmt); if (ret < 0) { test_assert(errno == EINVAL); break; } ++fmt.index; atomic_printf("Format %d fourcc ", fmt.index); print_fourcc(fmt.pixelformat); atomic_printf(" name '%s'\n", fmt.description); size.index = 0; size.pixel_format = fmt.pixelformat; while (1) { ret = ioctl(fd, VIDIOC_ENUM_FRAMESIZES, &size); if (ret < 0) { test_assert(errno == EINVAL); break; } ++size.index; if (size.type == V4L2_FRMSIZE_TYPE_DISCRETE) { struct v4l2_frmivalenum interval; atomic_printf(" Frame size %dx%d\n", size.discrete.width, size.discrete.height); interval.index = 0; interval.pixel_format = fmt.pixelformat; interval.width = size.discrete.width; interval.height = size.discrete.height; while (1) { ret = ioctl(fd, VIDIOC_ENUM_FRAMEINTERVALS, &interval); if (ret < 0) { test_assert(errno == EINVAL); break; } ++interval.index; if (interval.type == V4L2_FRMIVAL_TYPE_DISCRETE) { atomic_printf(" %f fps\n", fract_to_fps(&interval.discrete)); } else if (interval.type == V4L2_FRMIVAL_TYPE_CONTINUOUS || interval.type == V4L2_FRMIVAL_TYPE_STEPWISE) { atomic_printf(" %f-%f fps\n", fract_to_fps(&interval.stepwise.min), fract_to_fps(&interval.stepwise.max)); } } } else if (size.type == V4L2_FRMSIZE_TYPE_STEPWISE) { atomic_printf(" Frame size %dx%d to %dx%d step %dx%d\n", size.stepwise.min_width, size.stepwise.min_height, size.stepwise.max_width, size.stepwise.max_height, size.stepwise.step_width, size.stepwise.step_height); } } } } static void read_frames(int fd) { size_t i, j; for (i = 0; i < buffer_count * 2; ++i) { struct v4l2_buffer buf; int ret; size_t bytes; buf.type = V4L2_BUF_TYPE_VIDEO_CAPTURE; buf.memory = V4L2_MEMORY_MMAP; ret = ioctl(fd, VIDIOC_DQBUF, &buf); test_assert(ret == 0); test_assert(buf.index < buffer_count); bytes = buf.length < 16 ? buf.length : 16; atomic_printf("Frame %d: buffer %d: ", (int)i, (int)buf.index); for (j = 0; j < bytes; ++j) { atomic_printf("%2x ", buffers[buf.index].mmap_data[j]); } atomic_printf("...\n"); test_assert(0 == ioctl(fd, VIDIOC_QBUF, &buf)); } } static void close_device(int fd) { enum v4l2_buf_type type; type = V4L2_BUF_TYPE_VIDEO_CAPTURE; test_assert(0 == ioctl(fd, VIDIOC_STREAMOFF, &type)); } int main(void) { int fd = open_device(); init_device(fd); dump_sizes(fd); read_frames(fd); close_device(fd); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/vm_readv_writev.c000066400000000000000000000127421277367620400173030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void clear(unsigned char* p) { size_t i; for (i = 0; i < (unsigned)PAGE_SIZE; ++i) { p[i] = i & 0xFF; } } int main(void) { unsigned char* p = (unsigned char*)mmap(NULL, PAGE_SIZE * 2, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); struct iovec in_iov[2]; struct iovec out_iov[2]; int ret; test_assert(p != MAP_FAILED); test_assert(0 == munmap(p + PAGE_SIZE, PAGE_SIZE)); in_iov[0].iov_base = p; in_iov[0].iov_len = 2; in_iov[1].iov_base = p + 3; in_iov[1].iov_len = 3; out_iov[0].iov_base = p + PAGE_SIZE - 6; out_iov[0].iov_len = 3; out_iov[1].iov_base = p + PAGE_SIZE - 1; out_iov[1].iov_len = 2; clear(p); test_assert(4 == process_vm_readv(getpid(), out_iov, 2, in_iov, 2, 0)); test_assert(out_iov[1].iov_len == 2); test_assert(p[PAGE_SIZE - 7] == ((PAGE_SIZE - 7) & 0xff)); test_assert(p[PAGE_SIZE - 6] == 0); test_assert(p[PAGE_SIZE - 5] == 1); test_assert(p[PAGE_SIZE - 4] == 3); test_assert(p[PAGE_SIZE - 3] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[PAGE_SIZE - 2] == ((PAGE_SIZE - 2) & 0xff)); test_assert(p[PAGE_SIZE - 1] == 4); clear(p); ret = process_vm_writev(getpid(), in_iov, 2, out_iov, 2, 0); if (3 == ret) { test_assert(out_iov[1].iov_len == 2); test_assert(p[PAGE_SIZE - 7] == ((PAGE_SIZE - 7) & 0xff)); test_assert(p[PAGE_SIZE - 6] == 0); test_assert(p[PAGE_SIZE - 5] == 1); test_assert(p[PAGE_SIZE - 4] == 3); test_assert(p[PAGE_SIZE - 3] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[PAGE_SIZE - 2] == ((PAGE_SIZE - 2) & 0xff)); test_assert(p[PAGE_SIZE - 1] == ((PAGE_SIZE - 1) & 0xff)); } else { test_assert(4 == ret); test_assert(out_iov[1].iov_len == 2); test_assert(p[PAGE_SIZE - 7] == ((PAGE_SIZE - 7) & 0xff)); test_assert(p[PAGE_SIZE - 6] == 0); test_assert(p[PAGE_SIZE - 5] == 1); test_assert(p[PAGE_SIZE - 4] == 3); test_assert(p[PAGE_SIZE - 3] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[PAGE_SIZE - 2] == ((PAGE_SIZE - 2) & 0xff)); test_assert(p[PAGE_SIZE - 1] == 4); } out_iov[1].iov_base = p + PAGE_SIZE - 2; out_iov[1].iov_len = 3; clear(p); test_assert(5 == process_vm_readv(getpid(), out_iov, 2, in_iov, 2, 0)); test_assert(p[PAGE_SIZE - 7] == ((PAGE_SIZE - 7) & 0xff)); test_assert(p[PAGE_SIZE - 6] == 0); test_assert(p[PAGE_SIZE - 5] == 1); test_assert(p[PAGE_SIZE - 4] == 3); test_assert(p[PAGE_SIZE - 3] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[PAGE_SIZE - 2] == 4); test_assert(p[PAGE_SIZE - 1] == 5); clear(p); ret = process_vm_writev(getpid(), in_iov, 2, out_iov, 2, 0); if (3 == ret) { test_assert(p[PAGE_SIZE - 7] == ((PAGE_SIZE - 7) & 0xff)); test_assert(p[PAGE_SIZE - 6] == 0); test_assert(p[PAGE_SIZE - 5] == 1); test_assert(p[PAGE_SIZE - 4] == 3); test_assert(p[PAGE_SIZE - 3] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[PAGE_SIZE - 2] == ((PAGE_SIZE - 2) & 0xff)); test_assert(p[PAGE_SIZE - 1] == ((PAGE_SIZE - 1) & 0xff)); } else { test_assert(5 == ret); test_assert(p[PAGE_SIZE - 7] == ((PAGE_SIZE - 7) & 0xff)); test_assert(p[PAGE_SIZE - 6] == 0); test_assert(p[PAGE_SIZE - 5] == 1); test_assert(p[PAGE_SIZE - 4] == 3); test_assert(p[PAGE_SIZE - 3] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[PAGE_SIZE - 2] == 4); test_assert(p[PAGE_SIZE - 1] == 5); } in_iov[0].iov_base = p + PAGE_SIZE - 1; in_iov[0].iov_len = 2; out_iov[0].iov_base = p; out_iov[0].iov_len = 3; clear(p); ret = process_vm_readv(getpid(), out_iov, 1, in_iov, 1, 0); if (ret == -1 && errno == EFAULT) { test_assert(p[0] == 0); test_assert(p[1] == 1); } else { test_assert(1 == ret); test_assert(p[0] == ((PAGE_SIZE - 1) & 0xff)); test_assert(p[1] == 1); } clear(p); test_assert(1 == process_vm_writev(getpid(), in_iov, 1, out_iov, 1, 0)); test_assert(p[0] == ((PAGE_SIZE - 1) & 0xff)); /* Linux kernel bug: should be 1, but sometimes is zero --- extra data written. https://bugzilla.kernel.org/show_bug.cgi?id=113541 */ if (p[1] == 0) { atomic_puts("Kernel bug detected!"); } test_assert(p[1] == 1 || p[1] == 0); in_iov[0].iov_base = p + PAGE_SIZE - 4; in_iov[0].iov_len = 2; in_iov[1].iov_base = p + PAGE_SIZE - 2; in_iov[1].iov_len = 3; out_iov[0].iov_base = p; out_iov[0].iov_len = 1; out_iov[1].iov_base = p + 2; out_iov[1].iov_len = 4; clear(p); ret = process_vm_readv(getpid(), out_iov, 2, in_iov, 2, 0); if (2 == ret) { test_assert(p[0] == ((PAGE_SIZE - 4) & 0xff)); test_assert(p[1] == 1); test_assert(p[2] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[3] == 3); test_assert(p[4] == 4); test_assert(p[5] == 5); } else { test_assert(4 == ret); test_assert(p[0] == ((PAGE_SIZE - 4) & 0xff)); test_assert(p[1] == 1); test_assert(p[2] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[3] == ((PAGE_SIZE - 2) & 0xff)); test_assert(p[4] == ((PAGE_SIZE - 1) & 0xff)); test_assert(p[5] == 5); } clear(p); test_assert(4 == process_vm_writev(getpid(), in_iov, 2, out_iov, 2, 0)); test_assert(p[0] == ((PAGE_SIZE - 4) & 0xff)); test_assert(p[1] == 1); test_assert(p[2] == ((PAGE_SIZE - 3) & 0xff)); test_assert(p[3] == ((PAGE_SIZE - 2) & 0xff)); test_assert(p[4] == ((PAGE_SIZE - 1) & 0xff)); if (p[5] == 0) { atomic_puts("Kernel bug detected!"); } test_assert(p[5] == 5 || p[5] == 0); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/wait.c000066400000000000000000000020511277367620400150340ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { int i = 0; pid_t pid; int status; siginfo_t si; ++i; pid = fork(); if (!pid) { usleep(100); exit(i); } test_assert(pid == wait(&status)); atomic_printf("%d exited with status %#x\n", pid, status); test_assert(WIFEXITED(status) && i == WEXITSTATUS(status)); ++i; pid = fork(); if (!pid) { usleep(100); exit(i); } test_assert(pid == waitpid(pid, &status, 0)); atomic_printf("%d exited with status %#x\n", pid, status); test_assert(WIFEXITED(status) && i == WEXITSTATUS(status)); ++i; pid = fork(); if (!pid) { usleep(100); exit(i); } test_assert(0 == waitid(P_PID, pid, &si, WEXITED | WSTOPPED)); atomic_printf("%d exited with exit-type %d; code %d\n", si.si_pid, si.si_code, si.si_status); test_assert(SIGCHLD == si.si_signo && CLD_EXITED == si.si_code); test_assert(pid == si.si_pid && i == si.si_status); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/wait_for_all.c000066400000000000000000000004071277367620400165350ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int do_child(void) { sleep(1); atomic_puts("EXIT-SUCCESS"); return 0; } int main(void) { if (!fork()) { return do_child(); } return 0; } rr-4.4.0/src/test/wait_for_all.run000066400000000000000000000001101277367620400171060ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS="-w" compare_test EXIT-SUCCESS rr-4.4.0/src/test/wait_sigstop.c000066400000000000000000000023611277367620400166100ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { pid_t child; int status; struct timespec ts = { 0, 5000000 }; /* 1ms */ /* Test case where child receives SIGSTOP while parent is in waitpid */ child = fork(); if (!child) { test_assert(0 == nanosleep(&ts, NULL)); test_assert(0 == kill(getpid(), SIGSTOP)); return 77; } test_assert(child == waitpid(child, &status, WUNTRACED)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); test_assert(0 == kill(child, SIGCONT)); test_assert(child == waitpid(child, &status, WUNTRACED)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); /* Test case where child receives SIGSTOP before parent is in waitpid */ child = fork(); if (!child) { test_assert(0 == kill(getpid(), SIGSTOP)); return 77; } test_assert(0 == nanosleep(&ts, NULL)); test_assert(child == waitpid(child, &status, WUNTRACED)); test_assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGSTOP); test_assert(0 == kill(child, SIGCONT)); test_assert(child == waitpid(child, &status, WUNTRACED)); test_assert(WIFEXITED(status) && WEXITSTATUS(status) == 77); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/watchpoint.c000066400000000000000000000007611277367620400162560ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) { int break_here = 1; (void)break_here; } static int var; static void* thread(__attribute__((unused)) void* unused) { var = 1337; return NULL; } int main(void) { pthread_t t; breakpoint(); var = 42; pthread_create(&t, NULL, thread, NULL); pthread_join(t, NULL); atomic_printf("var=%d\n", var); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/watchpoint.py000066400000000000000000000022011277367620400164530ustar00rootroot00000000000000from rrutil import * send_gdb('break main') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') # Test write watchpoint send_gdb('p &var') expect_gdb(r'\$1 = \(int \*\) ') send_gdb('watch *$1') expect_gdb('Hardware[()/a-z ]+watchpoint 2') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 42') send_gdb('c') expect_gdb('Old value = 42') expect_gdb('New value = 1337') restart_replay() expect_gdb('Breakpoint 1') # Test read-write watchpoint send_gdb('delete 2') send_gdb('awatch *$1') expect_gdb('Hardware[()/a-z ]+watchpoint 3') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 42') send_gdb('c') expect_gdb('Old value = 42') expect_gdb('New value = 1337') send_gdb('c') expect_gdb('Value = 1337') restart_replay() expect_gdb('Breakpoint 1') # Test read watchpoint. x86 treats these as read-write. send_gdb('delete 3') send_gdb('rwatch *$1') expect_gdb('Hardware[()/a-z ]+watchpoint 4') send_gdb('c') expect_gdb('Value = 42') send_gdb('c') expect_gdb('Value = 1337') send_gdb('c') expect_gdb('Value = 1337') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited normally') ok() rr-4.4.0/src/test/watchpoint.run000066400000000000000000000000471277367620400166350ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/watchpoint_at_sched.c000066400000000000000000000007461277367620400201130ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int x; static void* do_thread(__attribute__((unused)) void* p) { while (1) { sched_yield(); } return NULL; } int main(void) { pthread_t thread; int i; int v = 0; pthread_create(&thread, NULL, do_thread, NULL); /* Trigger async SCHED signal */ for (i = 0; i < 1000; ++i) { v = v * 7 + 3; x = v; } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/watchpoint_at_sched.py000066400000000000000000000003661277367620400203170ustar00rootroot00000000000000from rrutil import * send_gdb('handle SIGKILL stop') send_gdb('c') expect_gdb('SIGKILL') send_gdb('watch -l x') expect_gdb('Hardware[()/a-z ]+watchpoint 1') send_gdb('rc') expect_gdb('watchpoint 1') expect_gdb('New value = 1564779003') ok() rr-4.4.0/src/test/watchpoint_at_sched.run000066400000000000000000000000721277367620400204650ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS="-c50" debug_test rr-4.4.0/src/test/watchpoint_before_signal.c000066400000000000000000000010361277367620400211310ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static int x; static void* do_thread(__attribute__((unused)) void* p) { while (1) { sched_yield(); } return NULL; } int main(void) { pthread_t thread; int i; int v = 0; pthread_create(&thread, NULL, do_thread, NULL); x = 1; /* Trigger async SCHED signal */ for (i = 0; i < 1000; ++i) { v = v * 7 + 3; } x = v; /* Trigger synchronous signal */ rdtsc(); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/watchpoint_before_signal.py000066400000000000000000000004771277367620400213470ustar00rootroot00000000000000from rrutil import * send_gdb('watch -l x') expect_gdb('Hardware[()/a-z ]+watchpoint 1') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 1') send_gdb('c') expect_gdb('Old value = 1') expect_gdb('New value = -1931448864') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited normally') ok() rr-4.4.0/src/test/watchpoint_before_signal.run000066400000000000000000000000721277367620400215120ustar00rootroot00000000000000source `dirname $0`/util.sh RECORD_ARGS="-c50" debug_test rr-4.4.0/src/test/watchpoint_syscall.c000066400000000000000000000013361277367620400200070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static void breakpoint(void) {} static char* p; int main(void) { int fd = open("/dev/zero", O_RDONLY); test_assert(fd >= 0); p = (char*)mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); test_assert(p != MAP_FAILED); breakpoint(); *p = 'a'; test_assert(1 == read(fd, p, 1)); test_assert(*p == 0); *p = 'b'; test_assert(p == mmap(p, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0)); test_assert(*p == 0); test_assert(0 == munmap(p, PAGE_SIZE)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/watchpoint_syscall.py000066400000000000000000000011741277367620400202150ustar00rootroot00000000000000from rrutil import * send_gdb('break breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l *p') expect_gdb('Hardware[()/a-z ]+watchpoint 2') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 97') send_gdb('c') expect_gdb('Old value = 97') expect_gdb('New value = 0') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = 98') send_gdb('c') expect_gdb('Old value = 98') expect_gdb('New value = 0') send_gdb('c') expect_gdb('Old value = 0') expect_gdb('New value = ') send_gdb('c') expect_rr('EXIT-SUCCESS') expect_gdb('exited normally') ok() rr-4.4.0/src/test/watchpoint_syscall.run000066400000000000000000000000471277367620400203670ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/watchpoint_unaligned.c000066400000000000000000000007461277367620400203070ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static uint16_t* p2; static uint32_t* p4; static uint64_t* p8; static void breakpoint(void) {} int main(void) { char* m = malloc(0x1000); void* unaligned_p = (void*)((uintptr_t)m | 0xff); p2 = unaligned_p; p4 = unaligned_p; p8 = unaligned_p; breakpoint(); *p2 = 1; breakpoint(); *p4 = 2; breakpoint(); *p8 = 3; atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/watchpoint_unaligned.py000066400000000000000000000010771277367620400205130ustar00rootroot00000000000000from rrutil import * send_gdb('b breakpoint') expect_gdb('Breakpoint 1') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l *p2') expect_gdb('Hardware watchpoint 2') send_gdb('c') expect_gdb('watchpoint 2') send_gdb('delete 2') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l *p4') expect_gdb('Hardware watchpoint 3') send_gdb('c') expect_gdb('watchpoint 3') send_gdb('delete 3') send_gdb('c') expect_gdb('Breakpoint 1') send_gdb('watch -l *p8') expect_gdb('Hardware watchpoint 4') send_gdb('c') expect_gdb('watchpoint 4') send_gdb('delete 4') ok() rr-4.4.0/src/test/watchpoint_unaligned.run000066400000000000000000000000471277367620400206630ustar00rootroot00000000000000source `dirname $0`/util.sh debug_test rr-4.4.0/src/test/when.py000066400000000000000000000023271277367620400152450ustar00rootroot00000000000000from rrutil import * import re send_gdb('when') expect_gdb(re.compile(r'Current event: (\d+)')) t = eval(last_match().group(1)); if t < 1 or t > 10000: failed('ERROR in first "when"') send_gdb('when-ticks') expect_gdb(re.compile(r'Current tick: (\d+)')) ticks = eval(last_match().group(1)); if ticks != 0: failed('ERROR in first "when-ticks"') send_gdb('b main') expect_gdb('Breakpoint 1') send_gdb('c') send_gdb('when') expect_gdb(re.compile(r'Current event: (\d+)')) t2 = eval(last_match().group(1)); if t2 < 1 or t2 > 10000: failed('ERROR in second "when"') if t2 <= t: failed('ERROR ... "when" failed to advance') send_gdb('when-ticks') expect_gdb(re.compile(r'Current tick: (\d+)')) ticks2 = eval(last_match().group(1)); if ticks2 < 0 or ticks2 > 100000: failed('ERROR in second "when-ticks"') if ticks2 <= ticks: failed('ERROR ... "when-ticks" failed to advance') # Ensure 'when' terminates a diversion send_gdb('call strlen("abcd")') send_gdb('when') expect_gdb(re.compile(r'Current event not known \(diversion\?\)')) send_gdb('when-ticks') expect_gdb(re.compile(r'Current event not known \(diversion\?\)')) send_gdb('when-tid') expect_gdb(re.compile(r'Current event not known \(diversion\?\)')) ok() rr-4.4.0/src/test/when.run000066400000000000000000000000751277367620400154170ustar00rootroot00000000000000source `dirname $0`/util.sh record simple$bitness debug when rr-4.4.0/src/test/write_race.c000066400000000000000000000010541277367620400162160ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" #define NUM_PROCESSES 4 #define NUM_ITERATIONS 500 int main(void) { int i; int j; for (i = 0; i < NUM_PROCESSES; ++i) { if (0 == fork()) { for (j = 0; j < NUM_ITERATIONS; ++j) { char buf[1000]; sprintf(buf, "Child %d writing line %d\n", i, j); write(1, buf, strlen(buf)); } return 0; } } for (i = 0; i < NUM_PROCESSES; ++i) { wait(NULL); } atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/writev.c000066400000000000000000000020461277367620400154140ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static char data[10] = "0123456789"; static void test(int use_pwritev) { char name[] = "/tmp/rr-readv-XXXXXX"; int fd = mkstemp(name); struct { char ch[50]; } * buf; struct iovec iovs[2]; ssize_t nwritten; test_assert(fd >= 0); test_assert(0 == unlink(name)); iovs[0].iov_base = data; iovs[0].iov_len = 7; iovs[1].iov_base = data + iovs[0].iov_len; iovs[1].iov_len = sizeof(data) - iovs[0].iov_len; if (use_pwritev) { /* Work around busted pwritev prototype in older libcs */ nwritten = syscall(SYS_pwritev, fd, iovs, 2, 0, 0); } else { nwritten = writev(fd, iovs, 2); } test_assert(sizeof(data) == nwritten); ALLOCATE_GUARD(buf, 'x'); test_assert(sizeof(data) == pread(fd, buf, sizeof(*buf), 0)); test_assert(0 == memcmp(buf, data, sizeof(data))); test_assert(buf->ch[sizeof(data)] == 'x'); VERIFY_GUARD(buf); } int main(void) { test(0); test(1); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/xattr.c000066400000000000000000000137251277367620400152440ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" static const char path_name[] = "rr-test-file"; static const char link_name[] = "rr-test-link"; static const char attr_name1[] = "user.testAttr1"; static const char attr_name2[] = "user.testAttr2"; static const char link_attr_name[] = "trusted.testA1"; static const char attr_value1[] = "hello kitty"; static const char attr_value2[] = "hello scarf"; static int list_contains(const char* buf, size_t buf_size, const char* name) { const char* end = buf + buf_size; while (buf < end) { if (strcmp(buf, name) == 0) { return 1; } buf += strlen(buf) + 1; } return 0; } int main(void) { int ret; int fd; size_t buf_size = sizeof(attr_value1) + 1; char* buf = allocate_guard(buf_size, '-'); int test_link = 1; size_t file_list_size; size_t link_list_size; fd = open(path_name, O_RDWR | O_CREAT, 0700); test_assert(0 <= fd); ret = setxattr(path_name, attr_name1, attr_value1, sizeof(attr_value1), XATTR_CREATE); if (ret < 0 && errno == ENOTSUP) { test_assert(0 == unlink(path_name)); atomic_puts("Filesystem does not support xattrs; skipping tests"); atomic_puts("EXIT-SUCCESS"); return 0; } test_assert(ret == 0); test_assert(0 == fsetxattr(fd, attr_name2, attr_value2, sizeof(attr_value2), XATTR_CREATE)); test_assert(0 == symlink(path_name, link_name)); ret = lsetxattr(link_name, link_attr_name, attr_value1, sizeof(attr_value1), XATTR_CREATE); if (ret < 0 && errno == EPERM) { atomic_puts("Not allowed to create xattrs on links; skipping link tests"); /* Only trusted xattrs can be created on links. Currently Linux does not allow non-root users to create trusted xattrs, even if they're privileged in a user/fs namespace. If it did, we could run link tests in unshare.c... */ test_link = 0; } else { test_assert(ret == 0); } test_assert(-1 == getxattr(path_name, attr_name2, buf, sizeof(attr_value2) - 1)); verify_guard(buf_size, buf); test_assert(errno == ERANGE); memset(buf, '-', buf_size); test_assert(-1 == fgetxattr(fd, attr_name1, buf, sizeof(attr_value1) - 1)); verify_guard(buf_size, buf); test_assert(errno == ERANGE); memset(buf, '-', buf_size); if (test_link) { test_assert(-1 == lgetxattr(link_name, link_attr_name, buf, sizeof(attr_value1) - 1)); verify_guard(buf_size, buf); test_assert(errno == ERANGE); memset(buf, '-', buf_size); } test_assert(sizeof(attr_value2) == getxattr(path_name, attr_name2, buf, sizeof(attr_value2))); verify_guard(buf_size, buf); test_assert(0 == memcmp(attr_value2, buf, sizeof(attr_value2))); test_assert(buf[sizeof(attr_value2)] == '-'); memset(buf, '-', buf_size); test_assert(sizeof(attr_value1) == fgetxattr(fd, attr_name1, buf, sizeof(attr_value1))); verify_guard(buf_size, buf); test_assert(0 == memcmp(attr_value1, buf, sizeof(attr_value1))); test_assert(buf[sizeof(attr_value1)] == '-'); memset(buf, '-', buf_size); if (test_link) { test_assert(sizeof(attr_value2) == lgetxattr(link_name, link_attr_name, buf, sizeof(attr_value1))); verify_guard(buf_size, buf); test_assert(0 == memcmp(attr_value1, buf, sizeof(attr_value1))); test_assert(buf[sizeof(attr_value1)] == '-'); memset(buf, '-', buf_size); } test_assert(-1 == listxattr(path_name, buf, sizeof(attr_name1) - 1)); verify_guard(buf_size, buf); test_assert(errno == ERANGE); test_assert(buf[0] == '-'); test_assert(-1 == flistxattr(fd, buf, sizeof(attr_name1) - 1)); verify_guard(buf_size, buf); test_assert(errno == ERANGE); test_assert(buf[0] == '-'); if (test_link) { test_assert(-1 == llistxattr(link_name, buf, sizeof(link_attr_name) - 1)); verify_guard(buf_size, buf); test_assert(errno == ERANGE); test_assert(buf[0] == '-'); } file_list_size = listxattr(path_name, NULL, 0); test_assert(file_list_size >= sizeof(attr_name1) + sizeof(attr_name2)); if (test_link) { link_list_size = llistxattr(link_name, NULL, 0); test_assert(link_list_size >= sizeof(link_attr_name)); } else { link_list_size = 0; } buf_size = file_list_size + 1; buf = allocate_guard(buf_size, '-'); test_assert(file_list_size == (size_t)listxattr(path_name, buf, buf_size)); verify_guard(buf_size, buf); test_assert(list_contains(buf, file_list_size, attr_name1)); test_assert(list_contains(buf, file_list_size, attr_name2)); test_assert(buf[file_list_size] == '-'); memset(buf, '-', buf_size); test_assert(file_list_size == (size_t)flistxattr(fd, buf, buf_size)); verify_guard(buf_size, buf); test_assert(list_contains(buf, file_list_size, attr_name1)); test_assert(list_contains(buf, file_list_size, attr_name2)); test_assert(buf[file_list_size] == '-'); memset(buf, '-', buf_size); if (test_link) { buf_size = link_list_size + 1; buf = allocate_guard(buf_size, '-'); test_assert(link_list_size == (size_t)llistxattr(link_name, buf, buf_size)); verify_guard(buf_size, buf); test_assert(list_contains(buf, link_list_size, link_attr_name)); test_assert(buf[link_list_size] == '-'); memset(buf, '-', buf_size); } test_assert(0 == removexattr(path_name, attr_name2)); test_assert(-1 == getxattr(path_name, attr_name2, buf, buf_size)); test_assert(errno == ENODATA); test_assert(buf[0] == '-'); test_assert(0 == fremovexattr(fd, attr_name1)); test_assert(-1 == getxattr(path_name, attr_name1, buf, buf_size)); test_assert(errno == ENODATA); test_assert(buf[0] == '-'); if (test_link) { test_assert(0 == lremovexattr(link_name, link_attr_name)); test_assert(-1 == getxattr(link_name, link_attr_name, buf, buf_size)); test_assert(errno == ENODATA); test_assert(buf[0] == '-'); } test_assert(0 == unlink(link_name)); test_assert(0 == unlink(path_name)); atomic_puts("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/test/zero_length_read.c000066400000000000000000000004041277367620400174030ustar00rootroot00000000000000/* -*- Mode: C; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #include "rrutil.h" int main(void) { char buf[1024]; ssize_t count = read(STDIN_FILENO, &buf[0], 0); test_assert(count == 0); atomic_printf("EXIT-SUCCESS"); return 0; } rr-4.4.0/src/util.cc000066400000000000000000000642551277367620400142470ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ //#define FIRST_INTERESTING_EVENT 10700 //#define LAST_INTERESTING_EVENT 10900 #include "util.h" #include #include #include #include #include #include #include #include #include #include #include #include #include "preload/preload_interface.h" #include "AddressSpace.h" #include "AutoRemoteSyscalls.h" #include "Flags.h" #include "ReplaySession.h" #include "ReplayTask.h" #include "TraceStream.h" #include "kernel_abi.h" #include "kernel_metadata.h" #include "log.h" #include "seccomp-bpf.h" using namespace std; namespace rr { // FIXME this function assumes that there's only one address space. // Should instead only look at the address space of the task in // question. static bool is_start_of_scratch_region(Task* t, remote_ptr start_addr) { for (auto& kv : t->session().tasks()) { Task* c = kv.second; if (start_addr == c->scratch_ptr) { return true; } } return false; } bool probably_not_interactive(int fd) { /* Eminently tunable heuristic, but this is guaranteed to be * true during rr unit tests, where we care most about this * check (to a first degree). A failing test shouldn't * hang. */ return !isatty(fd); } int clone_flags_to_task_flags(int flags_arg) { int flags = CLONE_SHARE_NOTHING; // See Task.h for description of the flags. flags |= (CLONE_CHILD_CLEARTID & flags_arg) ? CLONE_CLEARTID : 0; flags |= (CLONE_SETTLS & flags_arg) ? CLONE_SET_TLS : 0; flags |= (CLONE_SIGHAND & flags_arg) ? CLONE_SHARE_SIGHANDLERS : 0; flags |= (CLONE_THREAD & flags_arg) ? CLONE_SHARE_TASK_GROUP : 0; flags |= (CLONE_VM & flags_arg) ? CLONE_SHARE_VM : 0; flags |= (CLONE_FILES & flags_arg) ? CLONE_SHARE_FILES : 0; return flags; } size_t page_size() { return sysconf(_SC_PAGE_SIZE); } size_t ceil_page_size(size_t sz) { size_t page_mask = ~(page_size() - 1); return (sz + page_size() - 1) & page_mask; } size_t floor_page_size(size_t sz) { size_t page_mask = ~(page_size() - 1); return sz & page_mask; } remote_ptr ceil_page_size(remote_ptr addr) { return remote_ptr(ceil_page_size(addr.as_int())); } remote_ptr floor_page_size(remote_ptr addr) { return remote_ptr(floor_page_size(addr.as_int())); } /** * Dump |buf_len| words in |buf| to |out|, starting with a line * containing |label|. See |dump_binary_data()| for a description of * the remaining parameters. */ static void dump_binary_chunk(FILE* out, const char* label, const uint32_t* buf, size_t buf_len, remote_ptr start_addr) { int i; fprintf(out, "%s\n", label); for (i = 0; i < ssize_t(buf_len); i += 1) { uint32_t word = buf[i]; fprintf(out, "0x%08x | [%p]\n", word, (void*)(start_addr.as_int() + i * sizeof(*buf))); } } void dump_binary_data(const char* filename, const char* label, const uint32_t* buf, size_t buf_len, remote_ptr start_addr) { FILE* out = fopen64(filename, "w"); if (!out) { return; } dump_binary_chunk(out, label, buf, buf_len, start_addr); fclose(out); } void format_dump_filename(Task* t, TraceFrame::Time global_time, const char* tag, char* filename, size_t filename_size) { snprintf(filename, filename_size - 1, "%s/%d_%d_%s", t->trace_dir().c_str(), t->rec_tid, global_time, tag); } bool should_dump_memory(const TraceFrame& f) { const Flags* flags = &Flags::get(); #if defined(FIRST_INTERESTING_EVENT) int is_syscall_exit = event >= 0 && state == STATE_SYSCALL_EXIT; if (is_syscall_exit && RECORD == Flags->option && FIRST_INTERESTING_EVENT <= global_time && global_time <= LAST_INTERESTING_EVENT) { return true; } if (global_time > LAST_INTERESTING_EVENT) { return false; } #endif return flags->dump_on == Flags::DUMP_ON_ALL || (f.event().is_syscall_event() && f.event().Syscall().number == flags->dump_on) || (f.event().is_signal_event() && f.event().Signal().siginfo.si_signo == -flags->dump_on) || (flags->dump_on == Flags::DUMP_ON_RDTSC && f.event().type() == EV_SEGV_RDTSC) || flags->dump_at == int(f.time()); } void dump_process_memory(Task* t, TraceFrame::Time global_time, const char* tag) { char filename[PATH_MAX]; FILE* dump_file; format_dump_filename(t, global_time, tag, filename, sizeof(filename)); dump_file = fopen64(filename, "w"); const AddressSpace& as = *(t->vm()); for (auto m : as.maps()) { vector mem; mem.resize(m.map.size()); ssize_t mem_len = t->read_bytes_fallible(m.map.start(), m.map.size(), mem.data()); mem_len = max(ssize_t(0), mem_len); if (!is_start_of_scratch_region(t, m.map.start())) { dump_binary_chunk(dump_file, m.map.str().c_str(), (const uint32_t*)mem.data(), mem_len / sizeof(uint32_t), m.map.start()); } } fclose(dump_file); } static void notify_checksum_error(ReplayTask* t, TraceFrame::Time global_time, unsigned checksum, unsigned rec_checksum, const string& raw_map_line) { char cur_dump[PATH_MAX]; char rec_dump[PATH_MAX]; dump_process_memory(t, global_time, "checksum_error"); /* TODO: if the right recorder memory dump is present, * automatically compare them, taking the oddball * not-mapped-during-replay region(s) into account. And if * not present, tell the user how to make one in a future * run. */ format_dump_filename(t, global_time, "checksum_error", cur_dump, sizeof(cur_dump)); format_dump_filename(t, global_time, "rec", rec_dump, sizeof(rec_dump)); const Event& ev = t->current_trace_frame().event(); ASSERT(t, checksum == rec_checksum) << "Divergence in contents of memory segment after '" << ev << "':\n" "\n" << raw_map_line << " (recorded checksum:" << HEX(rec_checksum) << "; replaying checksum:" << HEX(checksum) << ")\n" "\n" << "Dumped current memory contents to " << cur_dump << ". If you've created a memory dump for\n" << "the '" << ev << "' event (line " << t->trace_time() << ") during recording by using, for example with\n" << "the args\n" "\n" << "$ rr --dump-at=" << t->trace_time() << " record ...\n" "\n" << "then you can use the following to determine which memory cells " "differ:\n" "\n" << "$ diff -u " << rec_dump << " " << cur_dump << " > mem-diverge.diff\n"; } /** * This helper does the heavy lifting of storing or validating * checksums. The iterator data determines which behavior the helper * function takes on, and to/from which file it writes/read. */ enum ChecksumMode { STORE_CHECKSUMS, VALIDATE_CHECKSUMS }; struct checksum_iterator_data { ChecksumMode mode; FILE* checksums_file; TraceFrame::Time global_time; }; static bool checksum_segment_filter(const AddressSpace::Mapping& m) { struct stat st; int may_diverge; if (m.map.fsname() == "[vsyscall]") { // This can't be read/checksummed. return false; } if (stat(m.map.fsname().c_str(), &st)) { /* If there's no persistent resource backing this * mapping, we should expect it to change. */ LOG(debug) << "CHECKSUMMING unlinked '" << m.map.fsname() << "'"; return true; } /* If we're pretty sure the backing resource is effectively * immutable, skip checksumming, it's a waste of time. Except * if the mapping is mutable, for example the rw data segment * of a system library, then it's interesting. */ static const char mmap_clone[] = "mmap_clone_"; may_diverge = m.map.fsname().substr(0, array_length(mmap_clone) - 1) != mmap_clone && (should_copy_mmap_region(m.map, st) || (PROT_WRITE & m.map.prot())); LOG(debug) << (may_diverge ? "CHECKSUMMING" : " skipping") << " '" << m.map.fsname() << "'"; return may_diverge; } static uint32_t compute_checksum(void* data, size_t len) { uint32_t checksum = len; size_t words = len / sizeof(uint32_t); uint32_t* buf = static_cast(data); for (size_t i = 0; i < words; ++i) { checksum = (checksum << 4) + checksum + buf[i]; } return checksum; } static const uint32_t ignored_checksum = 0x98765432; /** * Either create and store checksums for each segment mapped in |t|'s * address space, or validate an existing computed checksum. Behavior * is selected by |mode|. */ static void iterate_checksums(Task* t, ChecksumMode mode, TraceFrame::Time global_time) { struct checksum_iterator_data c; memset(&c, 0, sizeof(c)); char filename[PATH_MAX]; const char* fmode = (STORE_CHECKSUMS == mode) ? "w" : "r"; c.mode = mode; snprintf(filename, sizeof(filename) - 1, "%s/%d_%d", t->trace_dir().c_str(), global_time, t->rec_tid); c.checksums_file = fopen64(filename, fmode); c.global_time = global_time; if (!c.checksums_file) { FATAL() << "Failed to open checksum file " << filename; } remote_ptr in_replay_flag; unsigned char in_replay = 0; if (t->preload_globals) { in_replay_flag = REMOTE_PTR_FIELD(t->preload_globals, in_replay); in_replay = t->read_mem(in_replay_flag); t->write_mem(in_replay_flag, (unsigned char)0); } const AddressSpace& as = *t->vm(); for (auto m : as.maps()) { string raw_map_line = m.map.str(); uint32_t rec_checksum = 0; if (VALIDATE_CHECKSUMS == mode) { char line[1024]; fgets(line, sizeof(line), c.checksums_file); unsigned long rec_start; unsigned long rec_end; unsigned tmp_checksum; int nparsed = sscanf(line, "(%x) %lx-%lx", &tmp_checksum, &rec_start, &rec_end); rec_checksum = tmp_checksum; remote_ptr rec_start_addr = rec_start; remote_ptr rec_end_addr = rec_end; ASSERT(t, 3 == nparsed) << "Parsed " << nparsed << " items"; ASSERT(t, rec_start_addr == m.map.start() && rec_end_addr == m.map.end()) << "Segment " << rec_start_addr << "-" << rec_end_addr << " changed to " << m.map << "??"; if (is_start_of_scratch_region(t, rec_start_addr)) { /* Replay doesn't touch scratch regions, so * their contents are allowed to diverge. * Tracees can't observe those segments unless * they do something sneaky (or disastrously * buggy). */ LOG(debug) << "Not validating scratch starting at " << rec_start_addr; continue; } if (rec_checksum == ignored_checksum) { LOG(debug) << "Checksum not computed during recording"; continue; } } else { if (!checksum_segment_filter(m)) { fprintf(c.checksums_file, "(%x) %s\n", ignored_checksum, raw_map_line.c_str()); continue; } } vector mem; mem.resize(m.map.size()); ssize_t valid_mem_len = t->read_bytes_fallible(m.map.start(), m.map.size(), mem.data()); ASSERT(t, valid_mem_len >= 0); mem.resize(valid_mem_len); if (m.flags & AddressSpace::Mapping::IS_SYSCALLBUF) { /* The syscallbuf consists of a region that's written * deterministically wrt the trace events, and a * region that's written nondeterministically in the * same way as trace scratch buffers. The * deterministic region comprises committed syscallbuf * records, and possibly the one pending record * metadata. The nondeterministic region starts at * the "extra data" for the possibly one pending * record. * * So here, we set things up so that we only checksum * the deterministic region. */ auto child_hdr = m.map.start().cast(); auto hdr = t->read_mem(child_hdr); mem.resize(sizeof(hdr) + hdr.num_rec_bytes + sizeof(struct syscallbuf_record)); /* Zero out the shadow copy of blocked_sigs, we don't keep track of it * during replay, so this makes sure we don't run into problems because * of it. */ ((struct syscallbuf_hdr*)mem.data())->blocked_sigs = 0; } uint32_t checksum = compute_checksum(mem.data(), mem.size()); if (STORE_CHECKSUMS == mode) { fprintf(c.checksums_file, "(%x) %s\n", checksum, raw_map_line.c_str()); } else { ASSERT(t, t->session().is_replaying()); auto rt = static_cast(t); // Ignore checksums when valid_mem_len == 0 if (checksum != rec_checksum) { notify_checksum_error(rt, c.global_time, checksum, rec_checksum, raw_map_line.c_str()); } } } if (in_replay_flag) { t->write_mem(in_replay_flag, in_replay); } fclose(c.checksums_file); } bool should_checksum(const TraceFrame& f) { if (f.event().type() == EV_EXIT || f.event().type() == EV_UNSTABLE_EXIT) { // Task is dead, or at least detached, and we can't read its memory safely. return false; } if (f.event().has_ticks_slop()) { // We may not be at the same point during recording and replay, so don't // compute checksums. return false; } int checksum = Flags::get().checksum; bool is_syscall_exit = EV_SYSCALL == f.event().type() && EXITING_SYSCALL == f.event().Syscall().state; #if defined(FIRST_INTERESTING_EVENT) if (is_syscall_exit && FIRST_INTERESTING_EVENT <= global_time && global_time <= LAST_INTERESTING_EVENT) { return true; } if (global_time > LAST_INTERESTING_EVENT) { return false; } #endif if (Flags::CHECKSUM_NONE == checksum) { return false; } if (Flags::CHECKSUM_ALL == checksum) { return true; } if (Flags::CHECKSUM_SYSCALL == checksum) { return is_syscall_exit; } /* |checksum| is a global time point. */ return checksum <= int(f.time()); } void checksum_process_memory(Task* t, TraceFrame::Time global_time) { iterate_checksums(t, STORE_CHECKSUMS, global_time); } void validate_process_memory(Task* t, TraceFrame::Time global_time) { iterate_checksums(t, VALIDATE_CHECKSUMS, global_time); } signal_action default_action(int sig) { if (32 <= sig && sig <= 64) { return TERMINATE; } switch (sig) { /* TODO: SSoT for signal defs/semantics. */ #define CASE(_sig, _act) \ case SIG##_sig: \ return _act CASE(HUP, TERMINATE); CASE(INT, TERMINATE); CASE(QUIT, DUMP_CORE); CASE(ILL, DUMP_CORE); CASE(ABRT, DUMP_CORE); CASE(FPE, DUMP_CORE); CASE(KILL, TERMINATE); CASE(SEGV, DUMP_CORE); CASE(PIPE, TERMINATE); CASE(ALRM, TERMINATE); CASE(TERM, TERMINATE); CASE(USR1, TERMINATE); CASE(USR2, TERMINATE); CASE(CHLD, IGNORE); CASE(CONT, CONTINUE); CASE(STOP, STOP); CASE(TSTP, STOP); CASE(TTIN, STOP); CASE(TTOU, STOP); CASE(BUS, DUMP_CORE); /*CASE(POLL, TERMINATE);*/ CASE(PROF, TERMINATE); CASE(SYS, DUMP_CORE); CASE(TRAP, DUMP_CORE); CASE(URG, IGNORE); CASE(VTALRM, TERMINATE); CASE(XCPU, DUMP_CORE); CASE(XFSZ, DUMP_CORE); /*CASE(IOT, DUMP_CORE);*/ /*CASE(EMT, TERMINATE);*/ CASE(STKFLT, TERMINATE); CASE(IO, TERMINATE); CASE(PWR, TERMINATE); /*CASE(LOST, TERMINATE);*/ CASE(WINCH, IGNORE); default: FATAL() << "Unknown signal " << sig; return TERMINATE; // not reached #undef CASE } } SignalDeterministic is_deterministic_signal(Task* t) { const siginfo_t& si = t->get_siginfo(); switch (si.si_signo) { /* These signals may be delivered deterministically; * we'll check for sure below. */ case SIGILL: case SIGBUS: case SIGFPE: case SIGSEGV: /* As bits/siginfo.h documents, * * Values for `si_code'. Positive values are * reserved for kernel-generated signals. * * So if the signal is maybe-synchronous, and the * kernel delivered it, then it must have been * delivered deterministically. */ return si.si_code > 0 ? DETERMINISTIC_SIG : NONDETERMINISTIC_SIG; case SIGTRAP: { // The kernel code is wrong about this one. It treats singlestep // traps as deterministic, but they aren't. PTRACE_ATTACH traps aren't // really deterministic either. auto reasons = t->compute_trap_reasons(); return reasons.breakpoint || reasons.watchpoint ? DETERMINISTIC_SIG : NONDETERMINISTIC_SIG; } default: /* All other signals can never be delivered * deterministically (to the approximation required by * rr). */ return NONDETERMINISTIC_SIG; } } static bool has_fs_name(const string& path) { struct stat dummy; return 0 == stat(path.c_str(), &dummy); } static bool is_tmp_file(const string& path) { struct statfs sfs; statfs(path.c_str(), &sfs); return (TMPFS_MAGIC == sfs.f_type // In observed configurations of Ubuntu 13.10, /tmp is // a folder in the / fs, not a separate tmpfs. || path.c_str() == strstr(path.c_str(), "/tmp/")); } bool should_copy_mmap_region(const KernelMapping& mapping, const struct stat& stat) { int flags = mapping.flags(); int prot = mapping.prot(); const string& file_name = mapping.fsname(); bool private_mapping = (flags & MAP_PRIVATE); // TODO: handle mmap'd files that are unlinked during // recording. if (!has_fs_name(file_name)) { LOG(debug) << " copying unlinked file"; return true; } if (is_tmp_file(file_name)) { LOG(debug) << " copying file on tmpfs"; return true; } if (file_name == "/etc/ld.so.cache") { // This file changes on almost every system update so we should copy it. LOG(debug) << " copying " << file_name; return true; } if (private_mapping && (prot & PROT_EXEC)) { /* Be optimistic about private executable mappings */ LOG(debug) << " (no copy for +x private mapping " << file_name << ")"; return false; } if (private_mapping && (0111 & stat.st_mode)) { /* A private mapping of an executable file usually * indicates mapping data sections of object files. * Since we're already assuming those change very * infrequently, we can avoid copying the data * sections too. */ LOG(debug) << " (no copy for private mapping of +x " << file_name << ")"; return false; } bool can_read_file = (0 == access(file_name.c_str(), R_OK)); if (!can_read_file) { // It's possible for a tracee to mmap a file it doesn't have permission // to read, e.g. if a daemon opened the file and passed the fd over a // socket. We should copy the data now because we won't be able to read // it later. nscd does this. return true; } // TODO: using "can the euid of the rr process write this // file" as an approximation of whether the tracee can write // the file. If the tracee is messing around with // set*[gu]id(), the real answer may be different. bool can_write_file = (0 == access(file_name.c_str(), W_OK)); if (!can_write_file && 0 == stat.st_uid) { // We would like to assert this, but on Ubuntu 13.10, // the file /lib/i386-linux-gnu/libdl-2.17.so is // writeable by root for unknown reasons. // assert(!(prot & PROT_WRITE)); /* Mapping a file owned by root: we don't care if this * was a PRIVATE or SHARED mapping, because unless the * program is disastrously buggy or unlucky, the * mapping is effectively PRIVATE. Bad luck can come * from this program running during a system update, * or a user being added, which is probably less * frequent than even system updates. * * XXX what about the fontconfig cache files? */ LOG(debug) << " (no copy for root-owned " << file_name << ")"; return false; } if (private_mapping) { /* Some programs (at least Firefox) have been observed * to use cache files that are expected to be * consistent and unchanged during the bulk of * execution, but may be destroyed or mutated at * shutdown in preparation for the next session. We * don't otherwise know what to do with private * mappings, so err on the safe side. * * TODO: could get into dirty heuristics here like * trying to match "cache" in the filename ... */ LOG(debug) << " copying private mapping of non-system -x " << file_name; return true; } if (!(0222 & stat.st_mode)) { /* We couldn't write the file because it's read only. * But it's not a root-owned file (therefore not a * system file), so it's likely that it could be * temporary. Copy it. */ LOG(debug) << " copying read-only, non-system file"; return true; } if (!can_write_file) { /* mmap'ing another user's (non-system) files? Highly * irregular ... */ FATAL() << "Unhandled mmap " << file_name << "(prot:" << HEX(prot) << ((flags & MAP_SHARED) ? ";SHARED" : "") << "); uid:" << stat.st_uid << " mode:" << stat.st_mode; } return true; } void resize_shmem_segment(ScopedFd& fd, uint64_t num_bytes) { if (ftruncate(fd, num_bytes)) { FATAL() << "Failed to resize shmem to " << num_bytes; } } CPUIDData cpuid(int code, int subrequest) { CPUIDData result; asm volatile("cpuid" : "=a"(result.eax), "=b"(result.ebx), "=c"(result.ecx), "=d"(result.edx) : "a"(code), "c"(subrequest)); return result; } template static CloneParameters extract_clone_parameters_arch(const Registers& regs) { CloneParameters result; result.stack = regs.arg2(); result.ptid = regs.arg3(); switch (Arch::clone_parameter_ordering) { case Arch::FlagsStackParentTLSChild: result.tls = regs.arg4(); result.ctid = regs.arg5(); break; case Arch::FlagsStackParentChildTLS: result.tls = regs.arg5(); result.ctid = regs.arg4(); break; } int flags = (int)regs.arg1(); // If these flags aren't set, the corresponding clone parameters may be // invalid pointers, so make sure they're ignored. if (!(flags & CLONE_PARENT_SETTID)) { result.ptid = nullptr; } if (!(flags & (CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID))) { result.ctid = nullptr; } if (!(flags & CLONE_SETTLS)) { result.tls = nullptr; } return result; } CloneParameters extract_clone_parameters(Task* t) { RR_ARCH_FUNCTION(extract_clone_parameters_arch, t->arch(), t->regs()); } int read_elf_class(const string& filename) { ScopedFd fd(filename.c_str(), O_RDONLY); if (!fd.is_open()) { return NOT_ELF; } char elf_header[EI_CLASS + 1]; static const char magic[4] = { ELFMAG0, ELFMAG1, ELFMAG2, ELFMAG3 }; if (read(fd, elf_header, sizeof(elf_header)) != sizeof(elf_header) || memcmp(magic, elf_header, sizeof(magic)) != 0) { return NOT_ELF; } return elf_header[EI_CLASS]; } // Setting these causes us to trace instructions after // instruction_trace_at_event_start up to and including // instruction_trace_at_event_last static TraceFrame::Time instruction_trace_at_event_start = 0; static TraceFrame::Time instruction_trace_at_event_last = 0; bool trace_instructions_up_to_event(TraceFrame::Time event) { return event > instruction_trace_at_event_start && event <= instruction_trace_at_event_last; } void dump_task_set(const set& tasks) { printf("["); for (auto& t : tasks) { printf("%p (pid=%d, rec=%d),", t, t->tid, t->rec_tid); } printf("]\n"); } void dump_task_map(const map& tasks) { printf("["); for (auto& t : tasks) { printf("%p (pid=%d, rec=%d),", t.second, t.second->tid, t.second->rec_tid); } printf("]\n"); } string real_path(const string& path) { char buf[PATH_MAX]; if (realpath(path.c_str(), buf) == buf) { return string(buf); } return path; } static string read_exe_dir() { KernelMapping km = AddressSpace::read_local_kernel_mapping((uint8_t*)&read_exe_dir); string exe_path = km.fsname(); int end = exe_path.length(); // Chop off the filename while (end > 0 && exe_path[end - 1] != '/') { --end; } exe_path.erase(end); return exe_path; } string exe_directory() { static string exe_path = read_exe_dir(); return exe_path; } /** * Get the current time from the preferred monotonic clock in units of * seconds, relative to an unspecific point in the past. */ double monotonic_now_sec() { struct timespec tp; clock_gettime(CLOCK_MONOTONIC, &tp); return (double)tp.tv_sec + (double)tp.tv_nsec / 1e9; } bool running_under_rr() { return getenv("RUNNING_UNDER_RR") != NULL; } vector read_proc_status_fields(pid_t tid, const char* name, const char* name2, const char* name3) { vector result; char buf[1000]; sprintf(buf, "/proc/%d/status", tid); FILE* f = fopen(buf, "r"); if (!f) { return result; } vector matches; matches.push_back(string(name) + ":"); if (name2) { matches.push_back(string(name2) + ":"); } if (name3) { matches.push_back(string(name3) + ":"); } for (auto& m : matches) { while (true) { if (!fgets(buf, sizeof(buf), f)) { break; } if (strncmp(buf, m.c_str(), m.size()) == 0) { char* b = buf + m.size(); while (*b == ' ' || *b == '\t') { ++b; } char* e = b; while (*e && *e != '\n') { ++e; } result.push_back(string(b, e - b)); break; } } } fclose(f); return result; } static bool check_for_pax_kernel() { auto results = read_proc_status_fields(getpid(), "PaX"); return !results.empty(); } bool uses_invisible_guard_page() { static bool is_pax_kernel = check_for_pax_kernel(); return !is_pax_kernel; } void copy_file(Task* t, int dest_fd, int src_fd) { char buf[1024]; while (1) { ssize_t bytes_read = read(src_fd, buf, sizeof(buf)); ASSERT(t, bytes_read >= 0); if (!bytes_read) { break; } ssize_t bytes_written = write(dest_fd, buf, bytes_read); ASSERT(t, bytes_written == bytes_read); } } } // namespace rr rr-4.4.0/src/util.h000066400000000000000000000214001277367620400140720ustar00rootroot00000000000000/* -*- Mode: C++; tab-width: 8; c-basic-offset: 2; indent-tabs-mode: nil; -*- */ #ifndef RR_UTIL_H_ #define RR_UTIL_H_ #include #include #include #include #include #include "Event.h" #include "ScopedFd.h" #include "TraceFrame.h" #include "remote_ptr.h" #ifndef __has_attribute #define __has_attribute(x) 0 #endif namespace rr { /* * This file is a dumping ground for functionality that needs to be shared but * has no other obvious place to go. * * We should minimize the amount of code here. Code that's only needed in one * place can move out of this file. */ class KernelMapping; class Task; class TraceFrame; template constexpr size_t array_length(T (&)[N]) { return N; } template constexpr size_t array_length(std::array&) { return N; } template T return_dummy_value() { T v; memset(&v, 1, sizeof(T)); return v; } template bool check_type_has_no_holes() { T v; memset(&v, 2, sizeof(T)); v = return_dummy_value(); return memchr(&v, 2, sizeof(T)) == NULL; } /** * Returns true when type T has no holes. Preferably should not be defined * at all otherwise. * This is not 100% reliable since the check_type_has_no_holes may be * compiled to copy holes. However, it has detected at least two bugs. */ template bool type_has_no_holes() { static bool check = check_type_has_no_holes(); return check; } #define SHMEM_FS "/dev/shm" #define PREFIX_FOR_EMPTY_MMAPED_REGIONS "/tmp/rr-emptyfile-" enum Completion { COMPLETE, INCOMPLETE }; /** * During recording, sometimes we need to ensure that an iteration of * RecordSession::record_step schedules the same task as in the previous * iteration. The PREVENT_SWITCH value indicates that this is required. * For example, the futex operation FUTEX_WAKE_OP modifies userspace * memory; those changes are only recorded after the system call completes; * and they must be replayed before we allow a context switch to a woken-up * task (because the kernel guarantees those effects are seen by woken-up * tasks). * Entering a potentially blocking system call must use ALLOW_SWITCH, or * we risk deadlock. Most non-blocking system calls could use PREVENT_SWITCH * or ALLOW_SWITCH; for simplicity we use ALLOW_SWITCH to indicate a call could * block and PREVENT_SWITCH otherwise. * Note that even if a system call uses PREVENT_SWITCH, as soon as we've * recorded the completion of the system call, we can switch to another task. */ enum Switchable { PREVENT_SWITCH, ALLOW_SWITCH }; /** * Create a file named |filename| and dump |buf_len| words in |buf| to * that file, starting with a line containing |label|. |start_addr| * is the client address at which |buf| resides, if meaningful. * |start_addr| is used to compute the output lines of words, which * look like "0xValue | [0xAddr]". */ void dump_binary_data(const char* filename, const char* label, const uint32_t* buf, size_t buf_len, remote_ptr start_addr); /** * Format a suitable filename within the trace directory for dumping * information about |t| at the current global time, to a file that * contains |tag|. The constructed filename is returned through * |filename|. For example, a filengit logame for a task with tid 12345 at * time 111, for a file tagged "foo", would be something like * "trace_0/12345_111_foo". The returned name is not guaranteed to be * unique, caveat emptor. */ void format_dump_filename(Task* t, TraceFrame::Time global_time, const char* tag, char* filename, size_t filename_size); /** * Return true if the user requested memory be dumped at |f|. */ bool should_dump_memory(const TraceFrame& f); /** * Dump all of the memory in |t|'s address to the file * "[trace_dir]/[t->tid]_[global_time]_[tag]". */ void dump_process_memory(Task* t, TraceFrame::Time global_time, const char* tag); /** * Return true if the user has requested |t|'s memory be * checksummed at |f|. */ bool should_checksum(const TraceFrame& f); /** * Write a checksum of each mapped region in |t|'s address space to a * special log, where it can be read by |validate_process_memory()| * during replay. */ void checksum_process_memory(Task* t, TraceFrame::Time global_time); /** * Validate the checksum of |t|'s address space that was written * during recording. */ void validate_process_memory(Task* t, TraceFrame::Time global_time); /** * Return nonzero if the rr session is probably not interactive (that * is, there's probably no user watching or interacting with rr), and * so asking for user input or other actions is probably pointless. */ bool probably_not_interactive(int fd = STDERR_FILENO); /** * Convert the flags passed to the clone() syscall, |flags_arg|, into * the format understood by Task::clone(). */ int clone_flags_to_task_flags(int flags_arg); /** * Return the argument rounded up to the nearest multiple of the * system |page_size()|. */ size_t ceil_page_size(size_t sz); remote_ptr ceil_page_size(remote_ptr addr); /** * Return the argument rounded down to the nearest multiple of the * system |page_size()|. */ size_t floor_page_size(size_t sz); remote_ptr floor_page_size(remote_ptr addr); /** Return the system page size. */ size_t page_size(); /** Return the default action of |sig|. */ enum signal_action { DUMP_CORE, TERMINATE, CONTINUE, STOP, IGNORE }; signal_action default_action(int sig); SignalDeterministic is_deterministic_signal(Task* t); /** * Return nonzero if a mapping of |filename| with metadata |stat|, * using |flags| and |prot|, should almost certainly be copied to * trace; i.e., the file contents are likely to change in the interval * between recording and replay. Zero is returned /if we think we can * get away/ with not copying the region. That doesn't mean it's * necessarily safe to skip copying! */ bool should_copy_mmap_region(const KernelMapping& mapping, const struct stat& stat); /** * Ensure that the shmem segment referred to by |fd| has exactly the * size |num_bytes|. */ void resize_shmem_segment(ScopedFd& fd, uint64_t num_bytes); enum cpuid_requests { CPUID_GETVENDORSTRING, CPUID_GETFEATURES, CPUID_GETTLB, CPUID_GETSERIAL, CPUID_GETXSAVE = 0x0D, CPUID_INTELEXTENDED = 0x80000000, CPUID_INTELFEATURES, CPUID_INTELBRANDSTRING, CPUID_INTELBRANDSTRINGMORE, CPUID_INTELBRANDSTRINGEND, }; const int OSXSAVE_FEATURE_FLAG = 1 << 27; const int AVX_FEATURE_FLAG = 1 << 28; /** issue a single request to CPUID. Fits 'intel features', for instance * note that even if only "eax" and "edx" are of interest, other registers * will be modified by the operation, so we need to tell the compiler about it. * 'code' is placed in EAX. 'subrequest' is placed in ECX. * *a, *c and *d receive EAX, ECX and EDX respectively. */ struct CPUIDData { unsigned int eax, ebx, ecx, edx; }; CPUIDData cpuid(int code, int subrequest); struct CloneParameters { remote_ptr stack; remote_ptr ptid; remote_ptr tls; remote_ptr ctid; }; /** * Extract various clone(2) parameters out of the given Task's registers. */ CloneParameters extract_clone_parameters(Task* t); /** * Read the ELF CLASS from the given filename. If it's unable to be read, * return ELFCLASSNONE. If it's not an ELF file, return NOT_ELF. */ const int NOT_ELF = 0x10000; int read_elf_class(const std::string& filename); bool trace_instructions_up_to_event(TraceFrame::Time event); /* Helpful for broken debuggers */ void dump_task_set(const std::set& tasks); void dump_task_map(const std::map& tasks); std::string real_path(const std::string& path); std::string exe_directory(); /** * Get the current time from the preferred monotonic clock in units of * seconds, relative to an unspecific point in the past. */ double monotonic_now_sec(); bool running_under_rr(); std::vector read_proc_status_fields(pid_t tid, const char* name, const char* name2 = nullptr, const char* name3 = nullptr); /** * Mainline Linux kernels use an invisible (to /proc//maps) guard page * for stacks. grsecurity kernels don't. */ bool uses_invisible_guard_page(); void copy_file(Task* t, int dest_fd, int src_fd); #if defined(__has_feature) #if __has_feature(memory_sanitizer) extern "C" void __msan_unpoison(void*, size_t); inline void msan_unpoison(void* ptr, size_t n) { __msan_unpoison(ptr, n); }; #else inline void msan_unpoison(void* ptr, size_t n) { (void)ptr; (void)n; }; #endif #else inline void msan_unpoison(void* ptr, size_t n) { (void)ptr; (void)n; }; #endif } // namespace rr #endif /* RR_UTIL_H_ */ rr-4.4.0/third-party/000077500000000000000000000000001277367620400144275ustar00rootroot00000000000000rr-4.4.0/third-party/gdb/000077500000000000000000000000001277367620400151635ustar00rootroot00000000000000rr-4.4.0/third-party/gdb/32bit-avx.xml000066400000000000000000000014121277367620400174220ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/32bit-core.xml000066400000000000000000000053021277367620400175560ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/32bit-linux.xml000066400000000000000000000006611277367620400177700ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/32bit-sse.xml000066400000000000000000000040421277367620400174200ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/64bit-avx.xml000066400000000000000000000022501277367620400174300ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/64bit-core.xml000066400000000000000000000060601277367620400175650ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/64bit-linux.xml000066400000000000000000000006611277367620400177750ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/64bit-sse.xml000066400000000000000000000046601277367620400174330ustar00rootroot00000000000000 rr-4.4.0/third-party/gdb/README000066400000000000000000000004531277367620400160450ustar00rootroot00000000000000These files are taken verbatim from binutils-gdb/gdb/features, git tag gdb-7.7-release. Using the latest gdb files we get errors with gdb 10.1 and probably earlier versions, which require flags to have both "start" and "end" attributes. These files all have the same BSD-ish license (thanks FSF!). rr-4.4.0/third-party/gdb/amd64-avx-linux.xml000066400000000000000000000011641277367620400205530ustar00rootroot00000000000000 i386:x86-64 GNU/Linux rr-4.4.0/third-party/gdb/amd64-linux.xml000066400000000000000000000011061277367620400177530ustar00rootroot00000000000000 i386:x86-64 GNU/Linux rr-4.4.0/third-party/gdb/i386-avx-linux.xml000066400000000000000000000011531277367620400203270ustar00rootroot00000000000000 i386 GNU/Linux rr-4.4.0/third-party/gdb/i386-linux.xml000066400000000000000000000011071277367620400175320ustar00rootroot00000000000000 i386 GNU/Linux rr-4.4.0/third-party/proc-service/000077500000000000000000000000001277367620400170305ustar00rootroot00000000000000rr-4.4.0/third-party/proc-service/README000066400000000000000000000013031277367620400177050ustar00rootroot00000000000000proc_service.h provides some declarations used when implementing the API used by libthread_db to find TLS locations. This file is included in rr because it currently isn't installed by glibc. There is a glibc bug open to address this: https://sourceware.org/bugzilla/show_bug.cgi?id=20311 However, rather than use the glibc version of this file and attempt to understand what the LGPL means, we've imported a version from FreeBSD; but slightly modified. In particular, we: * Removed __BEGIN_DECLS and __END_DECLS uses * Renamed ps_pread and ps_pwrite to match glibc's names * Added declarations for ps_getpid and ps_get_thread_area * Reordered ps_err_e so that enumerators have the correct values rr-4.4.0/third-party/proc-service/proc_service.h000066400000000000000000000061201277367620400216630ustar00rootroot00000000000000/* * Copyright (c) 2004 David Xu * Copyright (c) 2004 Marcel Moolenaar * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $FreeBSD: src/include/proc_service.h,v 1.3.2.1 2006/05/17 02:28:14 davidxu Exp $ */ #ifndef _PROC_SERVICE_H_ #define _PROC_SERVICE_H_ #include #include typedef enum { PS_OK = 0, /* No errors. */ PS_ERR, /* Generic error. */ PS_BADPID, /* Bad process Id. */ PS_BADLID, /* Bad LWP Id. */ PS_BADADDR, /* Bad address. */ PS_NOSYM, /* Symbol not found. */ PS_NOFREGS, /* FPU register set not available. */ } ps_err_e; struct ps_prochandle; /* Opaque type. Defined by the implementor. */ ps_err_e ps_lcontinue(struct ps_prochandle *, lwpid_t); ps_err_e ps_lgetfpregs(struct ps_prochandle *, lwpid_t, prfpregset_t *); ps_err_e ps_lgetregs(struct ps_prochandle *, lwpid_t, prgregset_t); ps_err_e ps_lsetfpregs(struct ps_prochandle *, lwpid_t, const prfpregset_t *); ps_err_e ps_lsetregs(struct ps_prochandle *, lwpid_t, const prgregset_t); #ifdef __i386__ ps_err_e ps_lgetxmmregs (struct ps_prochandle *, lwpid_t, char *); ps_err_e ps_lsetxmmregs (struct ps_prochandle *, lwpid_t, const char *); #endif ps_err_e ps_lstop(struct ps_prochandle *, lwpid_t); ps_err_e ps_linfo(struct ps_prochandle *, lwpid_t, void *); ps_err_e ps_pcontinue(struct ps_prochandle *); ps_err_e ps_pdmodel(struct ps_prochandle *, int *); ps_err_e ps_pglobal_lookup(struct ps_prochandle *, const char *, const char *, psaddr_t *); void ps_plog(const char *, ...); ps_err_e ps_pdread(struct ps_prochandle *, psaddr_t, void *, size_t); ps_err_e ps_pstop(struct ps_prochandle *); ps_err_e ps_pdwrite(struct ps_prochandle *, psaddr_t, const void *, size_t); pid_t ps_getpid(struct ps_prochandle *); ps_err_e ps_get_thread_area(const struct ps_prochandle*, lwpid_t, int, psaddr_t *); #endif /* _PROC_SERVICE_H_ */