1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
|
// Copyright 2018 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
// +build amd64
// +build linux
package runtime
import (
"runtime/internal/sys"
"unsafe"
)
// InjectDebugCall injects a debugger call to fn into g. args must be
// a pointer to a valid call frame (including arguments and return
// space) for fn, or nil. tkill must be a function that will send
// SIGTRAP to thread ID tid. gp must be locked to its OS thread and
// running.
//
// On success, InjectDebugCall returns the panic value of fn or nil.
// If fn did not panic, its results will be available in args.
func InjectDebugCall(gp *g, fn, args interface{}, tkill func(tid int)) (interface{}, error) {
if gp.lockedm == 0 {
return nil, plainError("goroutine not locked to thread")
}
tid := int(gp.lockedm.ptr().procid)
if tid == 0 {
return nil, plainError("missing tid")
}
f := efaceOf(&fn)
if f._type == nil || f._type.kind&kindMask != kindFunc {
return nil, plainError("fn must be a function")
}
fv := (*funcval)(f.data)
a := efaceOf(&args)
if a._type != nil && a._type.kind&kindMask != kindPtr {
return nil, plainError("args must be a pointer or nil")
}
argp := a.data
var argSize uintptr
if argp != nil {
argSize = (*ptrtype)(unsafe.Pointer(a._type)).elem.size
}
h := new(debugCallHandler)
h.gp = gp
h.fv, h.argp, h.argSize = fv, argp, argSize
h.handleF = h.handle // Avoid allocating closure during signal
noteclear(&h.done)
defer func() { testSigtrap = nil }()
testSigtrap = h.inject
tkill(tid)
// Wait for completion.
notetsleepg(&h.done, -1)
if len(h.err) != 0 {
return nil, h.err
}
return h.panic, nil
}
type debugCallHandler struct {
gp *g
fv *funcval
argp unsafe.Pointer
argSize uintptr
panic interface{}
handleF func(info *siginfo, ctxt *sigctxt, gp2 *g) bool
err plainError
done note
savedRegs sigcontext
savedFP fpstate1
}
func (h *debugCallHandler) inject(info *siginfo, ctxt *sigctxt, gp2 *g) bool {
switch h.gp.atomicstatus {
case _Grunning:
if getg().m != h.gp.m {
println("trap on wrong M", getg().m, h.gp.m)
return false
}
// Push current PC on the stack.
rsp := ctxt.rsp() - sys.PtrSize
*(*uint64)(unsafe.Pointer(uintptr(rsp))) = ctxt.rip()
ctxt.set_rsp(rsp)
// Write the argument frame size.
*(*uintptr)(unsafe.Pointer(uintptr(rsp - 16))) = h.argSize
// Save current registers.
h.savedRegs = *ctxt.regs()
h.savedFP = *h.savedRegs.fpstate
h.savedRegs.fpstate = nil
// Set PC to debugCallV1.
ctxt.set_rip(uint64(funcPC(debugCallV1)))
default:
h.err = plainError("goroutine in unexpected state at call inject")
return true
}
// Switch to the debugCall protocol and resume execution.
testSigtrap = h.handleF
return true
}
func (h *debugCallHandler) handle(info *siginfo, ctxt *sigctxt, gp2 *g) bool {
// Sanity check.
if getg().m != h.gp.m {
println("trap on wrong M", getg().m, h.gp.m)
return false
}
f := findfunc(uintptr(ctxt.rip()))
if !(hasprefix(funcname(f), "runtime.debugCall") || hasprefix(funcname(f), "debugCall")) {
println("trap in unknown function", funcname(f))
return false
}
if *(*byte)(unsafe.Pointer(uintptr(ctxt.rip() - 1))) != 0xcc {
println("trap at non-INT3 instruction pc =", hex(ctxt.rip()))
return false
}
switch status := ctxt.rax(); status {
case 0:
// Frame is ready. Copy the arguments to the frame.
sp := ctxt.rsp()
memmove(unsafe.Pointer(uintptr(sp)), h.argp, h.argSize)
// Push return PC.
sp -= sys.PtrSize
ctxt.set_rsp(sp)
*(*uint64)(unsafe.Pointer(uintptr(sp))) = ctxt.rip()
// Set PC to call and context register.
ctxt.set_rip(uint64(h.fv.fn))
ctxt.regs().rcx = uint64(uintptr(unsafe.Pointer(h.fv)))
case 1:
// Function returned. Copy frame back out.
sp := ctxt.rsp()
memmove(h.argp, unsafe.Pointer(uintptr(sp)), h.argSize)
case 2:
// Function panicked. Copy panic out.
sp := ctxt.rsp()
memmove(unsafe.Pointer(&h.panic), unsafe.Pointer(uintptr(sp)), 2*sys.PtrSize)
case 8:
// Call isn't safe. Get the reason.
sp := ctxt.rsp()
reason := *(*string)(unsafe.Pointer(uintptr(sp)))
h.err = plainError(reason)
case 16:
// Restore all registers except RIP and RSP.
rip, rsp := ctxt.rip(), ctxt.rsp()
fp := ctxt.regs().fpstate
*ctxt.regs() = h.savedRegs
ctxt.regs().fpstate = fp
*fp = h.savedFP
ctxt.set_rip(rip)
ctxt.set_rsp(rsp)
// Done
notewakeup(&h.done)
default:
h.err = plainError("unexpected debugCallV1 status")
}
// Resume execution.
return true
}
|
