debuggerd allows uid-0 processes to dump tombstones or backtraces
of any process, and uid-system processes to dump backtraces of any
processes. Restrict these operations via SELinux based on the
client context, the target process context, and the action.
Depends on I8e120d319512ff207ed22ed87cde4e0432a13dda for the
corresponding policy definitions.
Change-Id: Ib317564e54e07cc21f259e75124b762ad17c6e16
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Also fix dumping of arm64's vector registers, which are actually 128 bits wide.
Also move the arm/arm64 FP registers to the tombstone. (We've never dumped
them at all for the other architectures.)
(cherry picked from commit b40c50351e)
Change-Id: Ic646fb9ea01e9beb42e1757feb8742c1d4efafa7
Also fix dumping of arm64's vector registers, which are actually 128 bits wide.
Also move the arm/arm64 FP registers to the tombstone. (We've never dumped
them at all for the other architectures.)
Change-Id: I239a86dd225b47fa90109bc824b7610df67ad812
There's no good reason to separate "fill the integer registers with
recognizable patterns and crash" from "fill the FP registers with recognizable
patterns and crash".
Also remove the incorrect use of ARCH_ARM_HAVE_VFP_D32 rather than try to fix
it.
Change-Id: I3a4a3aca1575de5489314027ae52168997404d79
Maps output now displays fault address location more intelligently. If
the fault is not in a mapped region, it now shows where that address is
with respect to the other maps.
In addition, the size of the map is now printed as part of the output.
Also, crasher now supports an "mmap" option which mmaps/munmaps a region
of memory and then attempts to access it, causing a fault address in
between mapped regions that can be used to test that new part of the
maps output.
Change-Id: Ia5e1926802bdfcbbdb7857e3631ddf395ae0c5b8
Now the debugging output shows the tid of the crashed thread instead of
the pid of the process that crashed.
Change-Id: I637f409ff02d73d458edc6d1a5c462c21d128211
The debug output was still showing the pathname that worked with
gdbclient before my changes, and therefore did not work after the fact.
Change-Id: Ie12d79f5346088914ce0a70bda69780707b31d31
If the fault address is not within a mapped region, it logs an error
message after the output. Otherwise, it prefixes the location of the
fault address with "--->" to make it easier to locate.
Change-Id: I330adaade4402ffeb09f1a6d34a944c2f054d06d
Now the functionality implemented by these semi-confusing cases has been
replaced with the same logtype enum behavior that is easier to
understand, and cases that used log-looking behavior to print to logcat
(when log = NULL) now use the more transparent ALOGE/ALOGD functions.
Change-Id: I7e38f2d4ca74a828df4d2266b3ea34edd3c6f5bb
Now the map output is only sent to the tombstone, and the entire
contents of /prod/$PID/maps is logged, not just 3 lines. Additionally,
crasher now supports "crasher SIGSEGV-non-null", which attempts to write to a
dereferenced function address, causing a SIGSEGV at a non-zero address.
This new crasher mode can be used to test the new maps output.
Bug: 15343662
Change-Id: I796d92e8352a6b9714bbbfe96f3143c56565ef2f
The system by which debuggerd filters its output to different locations
is now based on an enum called logtype with easy to understand
categories for log messages (like THREAD, MEMORY, etc.) instead of the
old, fairly esoteric scope_flags variable. Now much of the output that
previously went to logcat does not show up on the screen, but all output
can be found in the tombstone file. In addition, the tombstone's
location is now printed so it can be located easily.
Bug: 15341747
Change-Id: Ia2f2051d1dfdea934d0e6ed220f24345e35ba6a2
- auditd spawn log copy to events and main
- logcat delete events as one of the default logs
- debuggerd do not collect events.
- squish multiple spaces
- switch from strcpy to memmove for overlapping buffers
BUG: 14626551
Change-Id: I89b30273ce931ed2b25a53ea9be48e77f4c1bbf4
- auditd switch to recording logs to events log id
- logcat add events as one of the default logs
- debuggerd collect events log as well.
ToDo: debuggerd & bugreport collect intermixed logs.
BUG: 14626551
Change-Id: I958f0e729b7596748be57488a38824db5645be7b
Bionic needs to re-raise various signals, which means the si_code
debuggerd sees has been clobbered. If bionic sends us the original
si_code value, we can use that instead of the one we see when the
ptrace the crashed process' siginfo.
Change-Id: If116a6bc667d55a6fb39b74f96673292af4e4c8c
Use LOCAL_MULTILIB to build multiple versions of executables
instead of manually creating two build rules.
Change-Id: I1a993ff7b5f527a88735f46eec9822bb97d16490
libselinux selinux_android_restorecon API is changing to the more
general interface with flags and dropping the older variants.
Also get rid of the old, no longer used selinux_android_setfilecon API
and rename selinux_android_setfilecon2 to it as it is the only API in use.
Change-Id: I1e71ec398ccdc24cac4ec76f1b858d0f680f4925
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Note that these were two different functions. The definition was unused,
and the declaration was undefined.
Change-Id: I2edd10a0ab9422cd5252bdb9ccdd726dc5fad531
This one makes dump_memory reasonably architecture-agnostic so it is
possible to share the code between architectures.
It also includes a few small improvements in tombstone.cpp.
Change-Id: Ib8a9599bfa420b41e80207988e87aee1b9d79541
Signed-off-by: Kévin PETIT <kevin.petit@arm.com>
Update to handle the new optimized way that libunwind works.
In addition, a small refactor of the BacktraceMap code.
A few new tests of for good measure.
Change-Id: I2f9b4f5ad5a0dfe907b31febee76e4b9b94fb76f
This includes removing the map_info.c source and replacing it with the
BacktraceMap class to handle all map related code.
Change all callers of libbacktrace map functionality.
Also modify the corkscrew thread code so that it doesn't need to build
the map twice (once in the corkscrew format and once in the libbacktrace
format).
Change-Id: I32865a39f83a3dd6f958fc03c2759ba47d12382e
Use the libbacktrace C++ interface instead of the C interface in debuggerd.
Reformat the debuggerd code to be closer to Google C++ style.
Fix all debuggerd casts to be C++ casts.
Add a frame number to the frame data structure for ease of formatting and
add another FormatFrameData function.
Change the format_test to use the new FormatFrameData function.
Modify all of the backtrace_test to use the C++ interface.
Change-Id: I10e1610861acf7f4a3ad53276b74971cfbfda464
This is part 1, only including the bare minimum changes because
our diff tool doesn't easily show differences when a file moves. This
also breaks it into a small chunk in case some other changes break things,
as unlikely as I think that will be.
Change-Id: Ib7a3e7a2cc1ac574d15b65fda23813ebcf5d31af
Allow the use of the same map info to be shared when getting information on
multiple threads from the same pid.
Change-Id: I2e460e20154a10f4894ae563331fb32179e4551f
Also remove a hack that claims to be "just like ARM", but which was
different from the ARM and MIPS behavior.
Change-Id: I9b16da9a56430998ded27d304ce52c7cc8bfedfc
The old code was essentially trying to be C++ in C and was awkward. This
change makes it all objects with a thin layer that C code can use.
There is a C++ backtrace object that is not very useful, this code will
replace it.
This change also includes moving the backtrace test to a gtest, and adding
coverage of all major functionality.
Bug: 8410085
Change-Id: Iae0f1b09b3dd60395f71ed66010c1ea5cdd37841
Remove all of the code in debuggerd that uses libcorkscrew directly
and replace with libbacktrace.
Also do a bit of refactoring to clean up some functions that were
passing around variables that weren't used.
Bug: 8410085
Change-Id: I27da4fbe3f12ce38a85b4432fc1119984c9c391b
Move the liblog headers to log/ instead of cutils/ to complete
the separation of libcutils and liblog. cutils/log.h still
exists and includes log/log.h in order to support the many existing
modules that use cutils/log.h.
Change-Id: I2758c9f4aedcb809ca7ba8383d0f55041dd44345
The system server may prematurely close the connection to
/data/system/ndebugsocket if it's not interested in the data
from debuggerd. If it does so, we don't want to die due to a
SIGPIPE.
Change-Id: Iaef1f497bcd630144e6df6a06644a3293b85b6e0
We should also add a test for heap corruption, but I failed to come up
with a kind of corruption that dlmalloc actually detects (rather than
just crashing accidentally).
Change-Id: I7457e732729635b171ffc44517c3de71f55608e6
Restore the logging of the mem maps around the fault address along
with the rest of the faulting thread's information. (It was still
being written to the tombstone file, but the logging got dropped on
the floor in the refactoring around AM report integration).
Bug 8654694
Change-Id: Id8851fa765dfe6b6ce41ccfc39e85eaac0acc629
Also fixed the LOG() macro to actually write to the log again, tracking
the change in _LOG() argument semantics.
Bug 8322568
Change-Id: I79330c85c26d3ffb734315b6d0f2c0bb80bd234a
The Activity Manager sets up a permission-guarded domain socket, which
debuggerd connects to when a crash happens. If this is successful,
the daemon then mirrors the logged crash report to that socket, then
closes it.
Bug 8322568
Change-Id: Ife0c772a628ef82e8457094e511ce1edbfe57460
Backtracing through eh_frame section is more effective allowing to reuse
ebp register for other purposes within routine. GCC with turned on
optimizations (-O1 and above) implicitly defines -fomit-frame-pointer
anyway. eh_frame sections are generated by default with GCC on any
optimization level.
This change implements remote unwinding (separate process unwinding).
Local unwinding is already implemented through _Unwind_Backtrace call
which is implemented in libgcc.
Change-Id: I1aea1ecd19c21710f9cf5f05dc272fc51b67b7aa
Signed-off-by: Pavel Chupin <pavel.v.chupin@intel.com>
bionic's __stack_chk_fail was preventing debuggerd from dumping
stacks, which was not helpful.
Bug: 2487269
Change-Id: Idba2a274037b960dfb2ac1c21686323268c4b372
So "thread-nostack" runs the "nostack" code on a new thread, and
"thread-abort" runs the "abort" code on a new thread, and so on.
Bug: http://code.google.com/p/android/issues/detail?id=16672
Change-Id: I026a0e43eea147f1a7a74243846954599bcf4238
If somebody sends debuggerd bad data, it logs a complaint
but doesn't give any indication of the source. Now we show
the pid and uid we get from SO_PEERCRED.
Bug 7704699
Change-Id: I2738eb972932cc868ad969b60e16dd0b623212a1
The only common one we were missing is SI_TKILL, but we've had the full
set on the dalvik-dev branch for some time now.
Change-Id: I7cf52d352b8624e0adb17a2ed440e7a10f490dfd
Restore the security contexts of tombstone directory
when initially created.
Change-Id: I25b53730991576eccb62ca57050decd584acc639
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
Provides a new mechanism for dumpstate (while running as root)
to request that debuggerd dump the stacks of native processes that
we care about in bug reports. In this mode, the backtrace
is formatted to look similar to a Dalvik backtrace.
Moved the tombstone generating code into a separate file to
make it easier to maintain.
Fixed a bug where sometimes the stack traces would be incomplete
because we were not waiting for each thread to stop after issuing
PTRACE_ATTACH, only the main thread. So sometimes we were missing
traces for some threads.
Refactored the logging code to prevent accidentally writing data
to logcat when explicitly dumping a tombstone or backtrace from the
console.
Only root or system server can request to dump backtraces but
only root can dump tombstones.
Bug: 6615693
Change-Id: Ib3edcc16f9f3a687e414e3f2d250d9500566123b
Some changes to debuggerd:
(1) Send a SIGSTOP to the target process before doing any of the
PTRACE_ATTACH work. This causes the threads that weren't hit by
the signal to stop moving, which seems to get rid of the "ptrace
detach failed: No such process" problems that result in missed
stack traces and debuggerd self-immolation.
(2) SIGPIPE was in the list of "interesting" signals caught by
debugger_signal_handler(), but debuggerd didn't recognize it, and
you'd get "unexpected signal 13" complaints. It's now in the list.
(3) Fixed a bit-rotted XLOG.
Change-Id: I33297ea6b09ce450671c07dc25846f684afbf480
Show the symbol offset, when available.
Centralized formatting of native stack traces in libcorkscrew.
It's handy for automated tools if all stacks look the same.
Since we already made them all look them same, we might as well
do the formatting in just one place.
Do not strip the Thumb bit on ARM. This fixes an off-by-one
issue that could happen when resolving a PC that was at the
very beginning of a Thumb function, since the symbol table would
have the Thumb bit set but since we stripped the bit from our
PC, we would be looking for an address one byte before the
one listed in the symbol table. It's also quite useful to see
whether a given function is executing in Thumb mode just by glancing
at the PC.
Change-Id: Icaa29add85ce0bcafe24d5ce2098e138d809e2ab
When explicitly requesting a dump, show the user the path of
the tombstone file that was generated.
Change-Id: I7fff7dea606872a61687ca087e99f604107b70c4
Keep track of whether memory maps are readable. Use the information
in try_get_word to try to avoid accidentally dereferencing an invalid
pointer within the current process. (Note that I haven't ever
seen that happen during normal unwinding, but it pays to be
a little more careful.)
Refactored try_get_word a little to make it easier to pass it the
needed state for validation checks by way of a little memory_t struct.
Improved how the memory map for the current process is cached. This is
important because we need up to date information about readable maps.
Use a 5 second cache expiration.
Improved the PC -> LR fallback logic in the unwinder so we can
eke out an extra frame sometimes.
Fixed a bug reading ELF program headers. The phnum & phentsize
fields are half-words. We were incorrectly interpreting
phnum as a whole word.
Used android_atomic_* operations carefully in the unwinder
to prevent possible memory races between the dumper and the dumpee.
This was highly unlikely (or even impossible due to the presence
of other barriers along the way) but the code is clearer now about
its invariants.
Fixed a bug in debuggerd where the pid was being passed to have
its stack dump taken instead of the tid, resulting in short
stacks because ptrace couldn't read the data if pid != tid.
Did a full sweep to ensure that we use pid / tid correctly everywhere.
Ported old code from debuggerd to rewind the program counter back
one instruction so that it points to the branch instruction itself
instead of the return address.
Change-Id: Icc4eb08320052975a4ae7f0f5f0ac9308a2d33d7
This change modifies debuggerd so that it can be used to grab
the native stacks of a process that has hung and not just crashed.
Note that only the root user can do this (for now).
adb shell debuggerd <tid>
Then use logcat to find the tombstone file that was generated
which will have the native stacks of all threads in the
requested process. The specified thread will be shown first
and will also appear in the main log.
Also made some minor tweaks to libcorkscrew so that we
could handle statically compiled executables in the future
if we compiled the library statically.
Improved the "wait_for_user_action" function to support
volume down as an alternative for devices that do not
have home keys.
Removed a mess of gotos.
Change-Id: Ic149653986b0c2f503c7f0e8b7cb1f3be7c84d1e
Dump some memory at addresses for all registers that look like they
might have valid addresses. Previously this was only done for PC
and LR.
(This is expected to be disabled before ship.)
Bug 5484924
Change-Id: I9802eaa396783e1286ae0c53eaf2473892c38a02
When the tombstones are uploaded to APR, they're truncated at 64KB.
This causes the log data, which is at the end, to be lost if the
process has more than about 12 threads (which many do).
This change adds the last few lines of the log right below the
report for the crashing thread, where we should be guaranteed to
keep it.
Also, clean up trailing newlines on log messages (which end up in
the tombstone), and don't print a "------- log" banner if there
aren't any messages in that log file (e.g. slog).
Also also, don't try to show_nearby_maps unless this is the crashing
thread.
Bug 5471955
Change-Id: Iaa4fd2fafbaeda2f20bb95f202177d7744a91f9d
This makes two changes:
(1) Display ASCII values next to the memory dumps. For example:
I DEBUG: 00008ac4 706f6f4c 20676e69 74206425 73656d69 Looping %d times
I DEBUG: 00008ad4 7453000a 6e69726f 6f742067 0a702520 ..Storing to %p.
I DEBUG: 00008ae4 65642f00 657a2f76 55006f72 6c62616e ./dev/zero.Unabl
(The hex values are still displayed as little-endian word values, while
the ASCII part is byte oriented.)
(2) Optionally display memory dumps for all registers, not just LR
and PC, for the crashing thread. This is meant for situations where
we crash dereferencing foo->bar and want to see what the memory near
"foo" looks like -- could be handy if it got stomped by MUTF-16 text
or something recognizable.
Change #2 is currently disabled, via a compile-time setting.
Bug 5471955
Change-Id: Iacfd01c314055bad81db2f43b7d239f10086fcfb
The Android Problem Report site shows tombstones uploaded from
devices. We can see the native stack traces for every thread,
but sometimes there's a very important bit of information sitting
in the log, and without it we can't analyze the failure.
This change modifies debuggerd so that the log contents for the
crashing process are appended to the tombstone. The format matches
the output of "logcat -v threadtime". Both "system" and "main" logs
are included (but not interleaved -- we're not that fancy).
This feature is only enabled when the "ro.debuggable" system property
is set to 1 (indicating a development device).
Bug 5456676
Change-Id: I3be1df59813ccf1058cec496a906f6d31fbc7b04
This adds some additional output to native crashes. For example, if
something tried to access a bit of mmap(/dev/zero) memory that had
been mprotect()ed, you might see output like this:
I DEBUG : memory map around addr 4015a00c:
I DEBUG : 40159000-4015a000 /system/lib/libstdc++.so
I DEBUG : 4015a000-40162000 /dev/zero
I DEBUG : b0001000-b0009000 /system/bin/linker
The idea is to see what's in and around the fault address to make it
easier to identify bus errors due to file truncation and segmentation
faults caused by buffer over/underruns.
No output is generated for accesses below 0x1000 (which are likely
NULL pointer dereferences) or for signals that don't set si_addr.
Also, suppress the fault address for signals that don't set si_addr:
I DEBUG : signal 6 (SIGABRT), code 0 (?), fault addr --------
We still print "fault addr" followed by 8 characters for anything
that is parsing the contents. The "address" shown for signals like
SIGABRT was meaningless and possibly confusing.
Bug 5358516
Change-Id: Icae8ef309ea2d89b129f68d30f96b2ca8a69cc6c
This modifies debuggerd to sleep-poll while waiting for the target
process to crash, rather than block (potentially forever).
Also, add/fix some error reporting.
Bug 5035703
Change-Id: Id62ab79f53104927f8de684dff1a5734dbdb8390
When a process receives a fatal signal, it connects to debuggerd
and initiates a conversation over a socket. When the crashing
process is debuggerd, the conversation stalls forever, and you
stop getting native crash details.
This resets the signal handlers to SIG_DFL, so that debuggerd
simply crashes and gets restarted.
Bug 5035703
Change-Id: Ie081d710d046f701bca7e7d8ea3e1d24766d9f61
The delta between start and end pointers in memory dump has to be
multiples of 4 or 16.
Bug: 3486787
Change-Id: Ie34aa79ffb704ca647805dbc6a16f2c35adf849c
The structure user_vfp is incorrectly defined in bionic/libc/kernel/arch-arm/asm/ptrace.h
at the moment, while it should be under bionic/libc/kernel/arch-arm/asm/user.h instead.
Before moving its definition in the corresponding source files, we need to fix its users.
It happens that debuggerd is the only one for now, so fix this by including <linux/user.h>
instead (which will include <asm/user.h> and <asm/ptrace.h>).
Also, make the debug output less chatty by specifying all symbols to be listed
through XLOG2 instead of XLOG.
Change-Id: I16e0fa700945d86efd44ee885a84ad609c0a9b58
This change ensures that debuggered properly releases
the signal handler that invoked it after the PTRACE_ATTACH.
The previous code simply did a close() of the file descriptor,
but for some reason, this didn't always make the read() blocking
the signal handler exit. Instead, the thread would stay blocked
and never fault, preventing the generation of a useful stack
trace.
Change-Id: I6b0579041165a710d74ec1bece113ff7b828aed4
