summaryrefslogtreecommitdiff
path: root/util/statetrace/arch/arm/tracechild.cc
blob: 97b8d06ec1cd8177d1cdb78d8789b0e1b5b49636 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
/*
 * Copyright (c) 2010 ARM Limited
 * All rights reserved
 *
 * The license below extends only to copyright in the software and shall
 * not be construed as granting a license to any other intellectual
 * property including but not limited to intellectual property relating
 * to a hardware implementation of the functionality of the software
 * licensed hereunder.  You may use the software subject to the license
 * terms below provided that you ensure that this notice is replicated
 * unmodified and in its entirety in all distributions of the software,
 * modified or unmodified, in source code or in binary form.
 *
 * Copyright (c) 2006-2009 The Regents of The University of Michigan
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met: redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer;
 * redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution;
 * neither the name of the copyright holders nor the names of its
 * contributors may be used to endorse or promote products derived from
 * this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Authors: Ali Saidi
 *          Gabe Black
 */

#include <iostream>
#include <errno.h>
#include <stdint.h>
#include <cstring>
#include <cstdio>

#include "arch/arm/tracechild.hh"

using namespace std;

ARMTraceChild::ARMTraceChild()
{
    foundMvn = false;

    for (int x = 0; x < numregs; x++) {
        memset(&regs, 0, sizeof(regs));
        memset(&oldregs, 0, sizeof(regs));
        regDiffSinceUpdate[x] = false;
    }
}

bool
ARMTraceChild::sendState(int socket)
{
    uint32_t regVal = 0;
    uint32_t message[numregs + 1];
    int pos = 1;
    message[0] = 0;
    for (int x = 0; x < numregs; x++) {
        if (regDiffSinceUpdate[x]) {
            message[0] = message[0] | (1 << x);
            message[pos++] = getRegVal(x);
        }
    }

    size_t sent = 0;
    size_t toSend = pos * sizeof(message[0]);
    uint8_t *messagePtr = (uint8_t *)message;
    while (toSend != 0) {
        sent = write(socket, messagePtr, toSend);
        if (sent == -1) {
            cerr << "Write failed! " << strerror(errno) << endl;
            tracing = false;
            return false;
        }
        toSend -= sent;
        messagePtr += sent;
    }

    return true;
}

uint32_t
ARMTraceChild::getRegs(user_regs &myregs, int num)
{
    assert(num < numregs && num >= 0);
    return myregs.uregs[num];
}

bool
ARMTraceChild::update(int pid)
{
    oldregs = regs;
    if (ptrace(PTRACE_GETREGS, pid, 0, &regs) != 0) {
        cerr << "update: " << strerror(errno) << endl;
        return false;
    }

    for (unsigned int x = 0; x < numregs; x++)
        regDiffSinceUpdate[x] = (getRegVal(x) != getOldRegVal(x));
    return true;
}

int64_t
ARMTraceChild::getRegVal(int num)
{
    return getRegs(regs, num);
}

int64_t
ARMTraceChild::getOldRegVal(int num)
{
    return getRegs(oldregs,  num);
}

ostream &
ARMTraceChild::outputStartState(ostream & os)
{
    uint32_t sp = getSP();
    uint32_t pc = getPC();
    uint32_t highestInfo = 0;
    char obuf[1024];
    sprintf(obuf, "Initial stack pointer = 0x%08x\n", sp);
    os << obuf;
    sprintf(obuf, "Initial program counter = 0x%08x\n", pc);
    os << obuf;

    //Output the argument count
    int32_t cargc = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
    sprintf(obuf, "0x%08x: Argc = 0x%08x\n", sp, cargc);
    os << obuf;
    sp += 4;

    //Output argv pointers
    int argCount = 0;
    int32_t cargv;
    do {
        cargv = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
        sprintf(obuf, "0x%08x: argv[%d] = 0x%08x\n",
                sp, argCount++, cargv);
        if(cargv)
            if(highestInfo < cargv)
                highestInfo = cargv;
        os << obuf;
        sp += 4;
    } while(cargv);

    //Output the envp pointers
    int envCount = 0;
    uint32_t cenvp;
    do {
        cenvp = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
        sprintf(obuf, "0x%08x: envp[%d] = 0x%08x\n",
                sp, envCount++, cenvp);
        os << obuf;
        sp += 4;
    } while(cenvp);
    uint32_t auxType, auxVal;
    do {
        auxType = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
        sp += 4;
        auxVal = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
        sp += 4;
        sprintf(obuf, "0x%08x: Auxiliary vector = {0x%08x, 0x%08x}\n",
                sp - 8, auxType, auxVal);
        os << obuf;
    } while(auxType != 0 || auxVal != 0);
    //Print out the argument strings, environment strings, and file name.
    string current;
    uint32_t buf;
    uint32_t currentStart = sp;
    bool clearedInitialPadding = false;
    do {
        buf = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
        char * cbuf = (char *)&buf;
        for (int x = 0; x < sizeof(uint32_t); x++) {
            if (cbuf[x])
                current += cbuf[x];
            else {
                sprintf(obuf, "0x%08x: \"%s\"\n",
                        currentStart, current.c_str());
                os << obuf;
                current = "";
                currentStart = sp + x + 1;
            }
        }
        sp += 4;
        clearedInitialPadding = clearedInitialPadding || buf != 0;
    } while(!clearedInitialPadding || buf != 0 || sp <= highestInfo);
    return os;
}

bool
ARMTraceChild::step()
{
    const uint32_t bkpt_inst = 0xe7f001f0;

    uint32_t lr = getRegVal(14);
    uint32_t pc = getPC();
    uint32_t lrOp, subsOp;
    char obuf[128];
    bool patch = false;

    // Since ARM uses software breakpoints behind the scenes, they don't work
    // in read only areas like the page of routines provided by the kernel. The
    // link register generally holds the address the process wants to the
    // kernel to return to after it's done, so we'll install a software
    // breakpoint there.
    //
    // Calls into the kernel user page always follow the form:
    //  MVN ...
    //  <possible MOV lr,...>
    //  SUB PC, ...
    //
    //  So we look for this pattern and set a breakpoint on the LR at the SUB
    //  instruction.


    subsOp = ptrace(PTRACE_PEEKDATA, pid, pc, 0);
    if ((subsOp & 0xFFFF0FFF) == 0xe3e00a0f)
        foundMvn = true;

    if (foundMvn && ((subsOp & 0xFFF0F000) == 0xe240f000)) {
        foundMvn = false;
        lrOp = ptrace(PTRACE_PEEKDATA, pid, lr, 0);
        ptrace(PTRACE_POKEDATA, pid, lr, bkpt_inst);
        patch = true;
    }
    ptraceSingleStep();

    if (patch)
        ptrace(PTRACE_POKEDATA, pid, lr, lrOp);
}


TraceChild *
genTraceChild()
{
    return new ARMTraceChild;
}