1 //===-- sanitizer_stoptheworld_linux_libcdep.cc ---------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // See sanitizer_stoptheworld.h for details.
9 // This implementation was inspired by Markus Gutschke's linuxthreads.cc.
11 //===----------------------------------------------------------------------===//
14 #include "sanitizer_platform.h"
15 #if SANITIZER_LINUX && defined(__x86_64__)
17 #include "sanitizer_stoptheworld.h"
19 #include "sanitizer_platform_limits_posix.h"
22 #include <sched.h> // for CLONE_* definitions
24 #include <sys/prctl.h> // for PR_* definitions
25 #include <sys/ptrace.h> // for PTRACE_* definitions
26 #include <sys/types.h> // for pid_t
27 #if SANITIZER_ANDROID && defined(__arm__)
28 # include <linux/user.h> // for pt_regs
30 # include <sys/user.h> // for user_regs_struct
32 #include <sys/wait.h> // for signal-related stuff
42 #include "sanitizer_common.h"
43 #include "sanitizer_flags.h"
44 #include "sanitizer_libc.h"
45 #include "sanitizer_linux.h"
46 #include "sanitizer_mutex.h"
47 #include "sanitizer_placement_new.h"
49 // This module works by spawning a Linux task which then attaches to every
50 // thread in the caller process with ptrace. This suspends the threads, and
51 // PTRACE_GETREGS can then be used to obtain their register state. The callback
52 // supplied to StopTheWorld() is run in the tracer task while the threads are
54 // The tracer task must be placed in a different thread group for ptrace to
55 // work, so it cannot be spawned as a pthread. Instead, we use the low-level
56 // clone() interface (we want to share the address space with the caller
57 // process, so we prefer clone() over fork()).
59 // We don't use any libc functions, relying instead on direct syscalls. There
60 // are two reasons for this:
61 // 1. calling a library function while threads are suspended could cause a
62 // deadlock, if one of the treads happens to be holding a libc lock;
63 // 2. it's generally not safe to call libc functions from the tracer task,
64 // because clone() does not set up a thread-local storage for it. Any
65 // thread-local variables used by libc will be shared between the tracer task
66 // and the thread which spawned it.
68 COMPILER_CHECK(sizeof(SuspendedThreadID
) == sizeof(pid_t
));
70 namespace __sanitizer
{
71 // This class handles thread suspending/unsuspending in the tracer thread.
72 class ThreadSuspender
{
74 explicit ThreadSuspender(pid_t pid
)
78 bool SuspendAllThreads();
79 void ResumeAllThreads();
80 void KillAllThreads();
81 SuspendedThreadsList
&suspended_threads_list() {
82 return suspended_threads_list_
;
85 SuspendedThreadsList suspended_threads_list_
;
87 bool SuspendThread(SuspendedThreadID thread_id
);
90 bool ThreadSuspender::SuspendThread(SuspendedThreadID thread_id
) {
91 // Are we already attached to this thread?
92 // Currently this check takes linear time, however the number of threads is
94 if (suspended_threads_list_
.Contains(thread_id
))
97 if (internal_iserror(internal_ptrace(PTRACE_ATTACH
, thread_id
, NULL
, NULL
),
99 // Either the thread is dead, or something prevented us from attaching.
100 // Log this event and move on.
101 VReport(1, "Could not attach to thread %d (errno %d).\n", thread_id
,
105 VReport(1, "Attached to thread %d.\n", thread_id
);
106 // The thread is not guaranteed to stop before ptrace returns, so we must
109 HANDLE_EINTR(waitpid_status
, internal_waitpid(thread_id
, NULL
, __WALL
));
111 if (internal_iserror(waitpid_status
, &wperrno
)) {
112 // Got a ECHILD error. I don't think this situation is possible, but it
113 // doesn't hurt to report it.
114 VReport(1, "Waiting on thread %d failed, detaching (errno %d).\n",
116 internal_ptrace(PTRACE_DETACH
, thread_id
, NULL
, NULL
);
119 suspended_threads_list_
.Append(thread_id
);
124 void ThreadSuspender::ResumeAllThreads() {
125 for (uptr i
= 0; i
< suspended_threads_list_
.thread_count(); i
++) {
126 pid_t tid
= suspended_threads_list_
.GetThreadID(i
);
128 if (!internal_iserror(internal_ptrace(PTRACE_DETACH
, tid
, NULL
, NULL
),
130 VReport(1, "Detached from thread %d.\n", tid
);
132 // Either the thread is dead, or we are already detached.
133 // The latter case is possible, for instance, if this function was called
134 // from a signal handler.
135 VReport(1, "Could not detach from thread %d (errno %d).\n", tid
, pterrno
);
140 void ThreadSuspender::KillAllThreads() {
141 for (uptr i
= 0; i
< suspended_threads_list_
.thread_count(); i
++)
142 internal_ptrace(PTRACE_KILL
, suspended_threads_list_
.GetThreadID(i
),
146 bool ThreadSuspender::SuspendAllThreads() {
147 ThreadLister
thread_lister(pid_
);
150 // Run through the directory entries once.
151 added_threads
= false;
152 pid_t tid
= thread_lister
.GetNextTID();
154 if (SuspendThread(tid
))
155 added_threads
= true;
156 tid
= thread_lister
.GetNextTID();
158 if (thread_lister
.error()) {
159 // Detach threads and fail.
163 thread_lister
.Reset();
164 } while (added_threads
);
168 // Pointer to the ThreadSuspender instance for use in signal handler.
169 static ThreadSuspender
*thread_suspender_instance
= NULL
;
171 // Signals that should not be blocked (this is used in the parent thread as well
172 // as the tracer thread).
173 static const int kUnblockedSignals
[] = { SIGABRT
, SIGILL
, SIGFPE
, SIGSEGV
,
174 SIGBUS
, SIGXCPU
, SIGXFSZ
};
176 // Structure for passing arguments into the tracer thread.
177 struct TracerThreadArgument
{
178 StopTheWorldCallback callback
;
179 void *callback_argument
;
180 // The tracer thread waits on this mutex while the parent finishes its
186 static DieCallbackType old_die_callback
;
188 // Signal handler to wake up suspended threads when the tracer thread dies.
189 void TracerThreadSignalHandler(int signum
, void *siginfo
, void *) {
190 if (thread_suspender_instance
!= NULL
) {
191 if (signum
== SIGABRT
)
192 thread_suspender_instance
->KillAllThreads();
194 thread_suspender_instance
->ResumeAllThreads();
196 internal__exit((signum
== SIGABRT
) ? 1 : 2);
199 static void TracerThreadDieCallback() {
200 // Generally a call to Die() in the tracer thread should be fatal to the
201 // parent process as well, because they share the address space.
202 // This really only works correctly if all the threads are suspended at this
203 // point. So we correctly handle calls to Die() from within the callback, but
204 // not those that happen before or after the callback. Hopefully there aren't
205 // a lot of opportunities for that to happen...
206 if (thread_suspender_instance
)
207 thread_suspender_instance
->KillAllThreads();
208 if (old_die_callback
)
212 // Size of alternative stack for signal handlers in the tracer thread.
213 static const int kHandlerStackSize
= 4096;
215 // This function will be run as a cloned task.
216 static int TracerThread(void* argument
) {
217 TracerThreadArgument
*tracer_thread_argument
=
218 (TracerThreadArgument
*)argument
;
220 internal_prctl(PR_SET_PDEATHSIG
, SIGKILL
, 0, 0, 0);
221 // Check if parent is already dead.
222 if (internal_getppid() != tracer_thread_argument
->parent_pid
)
225 // Wait for the parent thread to finish preparations.
226 tracer_thread_argument
->mutex
.Lock();
227 tracer_thread_argument
->mutex
.Unlock();
229 SetDieCallback(TracerThreadDieCallback
);
231 ThreadSuspender
thread_suspender(internal_getppid());
232 // Global pointer for the signal handler.
233 thread_suspender_instance
= &thread_suspender
;
235 // Alternate stack for signal handling.
236 InternalScopedBuffer
<char> handler_stack_memory(kHandlerStackSize
);
237 struct sigaltstack handler_stack
;
238 internal_memset(&handler_stack
, 0, sizeof(handler_stack
));
239 handler_stack
.ss_sp
= handler_stack_memory
.data();
240 handler_stack
.ss_size
= kHandlerStackSize
;
241 internal_sigaltstack(&handler_stack
, NULL
);
243 // Install our handler for fatal signals. Other signals should be blocked by
244 // the mask we inherited from the caller thread.
245 for (uptr signal_index
= 0; signal_index
< ARRAY_SIZE(kUnblockedSignals
);
247 __sanitizer_sigaction new_sigaction
;
248 internal_memset(&new_sigaction
, 0, sizeof(new_sigaction
));
249 new_sigaction
.sigaction
= TracerThreadSignalHandler
;
250 new_sigaction
.sa_flags
= SA_ONSTACK
| SA_SIGINFO
;
251 internal_sigfillset(&new_sigaction
.sa_mask
);
252 internal_sigaction_norestorer(kUnblockedSignals
[signal_index
],
253 &new_sigaction
, NULL
);
257 if (!thread_suspender
.SuspendAllThreads()) {
258 VReport(1, "Failed suspending threads.\n");
261 tracer_thread_argument
->callback(thread_suspender
.suspended_threads_list(),
262 tracer_thread_argument
->callback_argument
);
263 thread_suspender
.ResumeAllThreads();
266 thread_suspender_instance
= NULL
;
267 handler_stack
.ss_flags
= SS_DISABLE
;
268 internal_sigaltstack(&handler_stack
, NULL
);
272 class ScopedStackSpaceWithGuard
{
274 explicit ScopedStackSpaceWithGuard(uptr stack_size
) {
275 stack_size_
= stack_size
;
276 guard_size_
= GetPageSizeCached();
277 // FIXME: Omitting MAP_STACK here works in current kernels but might break
279 guard_start_
= (uptr
)MmapOrDie(stack_size_
+ guard_size_
,
280 "ScopedStackWithGuard");
281 CHECK_EQ(guard_start_
, (uptr
)Mprotect((uptr
)guard_start_
, guard_size_
));
283 ~ScopedStackSpaceWithGuard() {
284 UnmapOrDie((void *)guard_start_
, stack_size_
+ guard_size_
);
286 void *Bottom() const {
287 return (void *)(guard_start_
+ stack_size_
+ guard_size_
);
296 // We have a limitation on the stack frame size, so some stuff had to be moved
298 static __sanitizer_sigset_t blocked_sigset
;
299 static __sanitizer_sigset_t old_sigset
;
300 static __sanitizer_sigaction old_sigactions
301 [ARRAY_SIZE(kUnblockedSignals
)];
303 class StopTheWorldScope
{
305 StopTheWorldScope() {
306 // Block all signals that can be blocked safely, and install
307 // default handlers for the remaining signals.
308 // We cannot allow user-defined handlers to run while the ThreadSuspender
309 // thread is active, because they could conceivably call some libc functions
310 // which modify errno (which is shared between the two threads).
311 internal_sigfillset(&blocked_sigset
);
312 for (uptr signal_index
= 0; signal_index
< ARRAY_SIZE(kUnblockedSignals
);
314 // Remove the signal from the set of blocked signals.
315 internal_sigdelset(&blocked_sigset
, kUnblockedSignals
[signal_index
]);
316 // Install the default handler.
317 __sanitizer_sigaction new_sigaction
;
318 internal_memset(&new_sigaction
, 0, sizeof(new_sigaction
));
319 new_sigaction
.handler
= SIG_DFL
;
320 internal_sigfillset(&new_sigaction
.sa_mask
);
321 internal_sigaction_norestorer(kUnblockedSignals
[signal_index
],
322 &new_sigaction
, &old_sigactions
[signal_index
]);
324 int sigprocmask_status
=
325 internal_sigprocmask(SIG_BLOCK
, &blocked_sigset
, &old_sigset
);
326 CHECK_EQ(sigprocmask_status
, 0); // sigprocmask should never fail
327 // Make this process dumpable. Processes that are not dumpable cannot be
329 process_was_dumpable_
= internal_prctl(PR_GET_DUMPABLE
, 0, 0, 0, 0);
330 if (!process_was_dumpable_
)
331 internal_prctl(PR_SET_DUMPABLE
, 1, 0, 0, 0);
332 old_die_callback
= GetDieCallback();
335 ~StopTheWorldScope() {
336 SetDieCallback(old_die_callback
);
337 // Restore the dumpable flag.
338 if (!process_was_dumpable_
)
339 internal_prctl(PR_SET_DUMPABLE
, 0, 0, 0, 0);
340 // Restore the signal handlers.
341 for (uptr signal_index
= 0; signal_index
< ARRAY_SIZE(kUnblockedSignals
);
343 internal_sigaction_norestorer(kUnblockedSignals
[signal_index
],
344 &old_sigactions
[signal_index
], NULL
);
346 internal_sigprocmask(SIG_SETMASK
, &old_sigset
, &old_sigset
);
350 int process_was_dumpable_
;
353 // When sanitizer output is being redirected to file (i.e. by using log_path),
354 // the tracer should write to the parent's log instead of trying to open a new
355 // file. Alert the logging code to the fact that we have a tracer.
356 struct ScopedSetTracerPID
{
357 explicit ScopedSetTracerPID(uptr tracer_pid
) {
358 stoptheworld_tracer_pid
= tracer_pid
;
359 stoptheworld_tracer_ppid
= internal_getpid();
361 ~ScopedSetTracerPID() {
362 stoptheworld_tracer_pid
= 0;
363 stoptheworld_tracer_ppid
= 0;
367 void StopTheWorld(StopTheWorldCallback callback
, void *argument
) {
368 StopTheWorldScope in_stoptheworld
;
369 // Prepare the arguments for TracerThread.
370 struct TracerThreadArgument tracer_thread_argument
;
371 tracer_thread_argument
.callback
= callback
;
372 tracer_thread_argument
.callback_argument
= argument
;
373 tracer_thread_argument
.parent_pid
= internal_getpid();
374 const uptr kTracerStackSize
= 2 * 1024 * 1024;
375 ScopedStackSpaceWithGuard
tracer_stack(kTracerStackSize
);
376 // Block the execution of TracerThread until after we have set ptrace
378 tracer_thread_argument
.mutex
.Lock();
379 uptr tracer_pid
= internal_clone(
380 TracerThread
, tracer_stack
.Bottom(),
381 CLONE_VM
| CLONE_FS
| CLONE_FILES
| CLONE_UNTRACED
,
382 &tracer_thread_argument
, 0 /* parent_tidptr */, 0 /* newtls */, 0
385 if (internal_iserror(tracer_pid
, &local_errno
)) {
386 VReport(1, "Failed spawning a tracer thread (errno %d).\n", local_errno
);
387 tracer_thread_argument
.mutex
.Unlock();
389 ScopedSetTracerPID
scoped_set_tracer_pid(tracer_pid
);
390 // On some systems we have to explicitly declare that we want to be traced
391 // by the tracer thread.
392 #ifdef PR_SET_PTRACER
393 internal_prctl(PR_SET_PTRACER
, tracer_pid
, 0, 0, 0);
395 // Allow the tracer thread to start.
396 tracer_thread_argument
.mutex
.Unlock();
397 // Since errno is shared between this thread and the tracer thread, we
398 // must avoid using errno while the tracer thread is running.
399 // At this point, any signal will either be blocked or kill us, so waitpid
400 // should never return (and set errno) while the tracer thread is alive.
401 uptr waitpid_status
= internal_waitpid(tracer_pid
, NULL
, __WALL
);
402 if (internal_iserror(waitpid_status
, &local_errno
))
403 VReport(1, "Waiting on the tracer thread failed (errno %d).\n",
408 // Platform-specific methods from SuspendedThreadsList.
409 #if SANITIZER_ANDROID && defined(__arm__)
410 typedef pt_regs regs_struct
;
411 #define REG_SP ARM_sp
413 #elif SANITIZER_LINUX && defined(__arm__)
414 typedef user_regs regs_struct
;
415 #define REG_SP uregs[13]
417 #elif defined(__i386__) || defined(__x86_64__)
418 typedef user_regs_struct regs_struct
;
419 #if defined(__i386__)
425 #elif defined(__powerpc__) || defined(__powerpc64__)
426 typedef pt_regs regs_struct
;
427 #define REG_SP gpr[PT_R1]
429 #elif defined(__mips__)
430 typedef struct user regs_struct
;
431 #define REG_SP regs[EF_REG29]
434 #error "Unsupported architecture"
435 #endif // SANITIZER_ANDROID && defined(__arm__)
437 int SuspendedThreadsList::GetRegistersAndSP(uptr index
,
440 pid_t tid
= GetThreadID(index
);
443 if (internal_iserror(internal_ptrace(PTRACE_GETREGS
, tid
, NULL
, ®s
),
445 VReport(1, "Could not get registers from thread %d (errno %d).\n", tid
,
451 internal_memcpy(buffer
, ®s
, sizeof(regs
));
455 uptr
SuspendedThreadsList::RegisterCount() {
456 return sizeof(regs_struct
) / sizeof(uptr
);
458 } // namespace __sanitizer
460 #endif // SANITIZER_LINUX && defined(__x86_64__)