1 // Copyright (c) 2006-2010 Nokia Corporation and/or its subsidiary(-ies).

     2 // All rights reserved.

     3 // This component and the accompanying materials are made available

     4 // under the terms of the License "Eclipse Public License v1.0"

     5 // which accompanies this distribution, and is available

     6 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

     7 //

     8 // Initial Contributors:

     9 // Nokia Corporation - initial contribution.

    10 //

    11 // Contributors:

    12 //

    13 // Description:

    14 // Provides the debug security server session implementation.

    15 // 

    16 //

    17 

    18 /**

    19  @file

    20  @internalTechnology

    21  @released

    22 */

    23 

    24 // Needed so we get the text strings for capabilities

    25 #define __INCLUDE_CAPABILITY_NAMES__

    26 

    27 #include <e32std.h>

    28 #include <e32std_private.h>

    29 #include <e32btrace.h>

    30 #include <d32btrace.h>

    31 #include <e32base.h>

    32 #include <e32base_private.h>

    33 #include <e32uid.h>

    34 #include <f32file.h>

    35 #include <e32capability.h>

    36 #include <rm_debug_api.h>

    37 

    38 // required for direct parsing of e32image/tromimage headers

    39 #include <f32image.h>

    40 #include <e32rom.h>

    41 

    42 //added for direct access to media driver

    43 #include <partitions.h>

    44 #include <ftlcontrolio.h>

    45 

    46 #include "c_security_svr_session.h"

    47 #include "c_security_svr_server.h"

    48 #include "c_security_svr_async.h"

    49 #include "rm_debug_logging.h"

    50 #ifdef _DEBUG

    51 #include "low_mem_requests.h"

    52 #endif

    53 

    54 using namespace Debug;

    55 

    56 CSecuritySvrSession::CSecuritySvrSession()

    57 	: iDebugAgentProcessIdStored(EFalse),

    58 	  iDebugAgentProcessId(0),

    59 	  iServerNotified(EFalse),

    60 	  iCrashConnected(EFalse)

    61 	{

    62 	// Ensure that this debug agent has no target capability override

    63 	// by default

    64 	iOEMDebugCapabilities.SetEmpty();

    65 	}

    66 

    67 void CSecuritySvrSession::ServiceError(const RMessage2 &aMessage, TInt aError)

    68 	{

    69 	LOG_MSG2("CSecuritySvrSession::ServiceError(), aError: %d\n", aError);

    70 

    71 	//insert ending heap markers

    72 	HeapWatcher(aMessage.Function(), EFalse);

    73 

    74 	aMessage.Complete(aError);

    75 	}

    76 

    77 /**

    78 Called by the client/server framework as part of session creation.

    79 

    80 Notifies the server that a session is being created

    81 */

    82 void CSecuritySvrSession::CreateL()

    83 	{

    84 	LOG_MSG("CSecuritySvrSession::CreateL()\n");

    85 

    86 	//notify the server that the session has been opened

    87 	Server().SessionOpened();

    88 	iServerNotified = ETrue;

    89 	}

    90 

    91 /**

    92   Returns a reference to the DSS

    93 

    94   @return a reference to the DSS

    95   */

    96 CSecuritySvrServer& CSecuritySvrSession::Server() const

    97     {

    98     return *static_cast<CSecuritySvrServer*>(const_cast<CServer2*>(CSession2::Server()));

    99     }

   100 

   101 /**

   102 Session destructor. Performs necessary cleanup and notifies the server that the

   103 session is being closed

   104 */

   105 CSecuritySvrSession::~CSecuritySvrSession()

   106 	{

   107 	LOG_MSG("CSecuritySvrSession::~CSecuritySvrSession!()\n");

   108 

   109 	//forced detachment if attached to processes

   110 	if(iDebugAgentProcessIdStored)

   111 		{

   112 		// Cancel any outstanding async objects.

   113 		iAsyncHandlers.ResetAndDestroy();

   114 		

   115 		// Inform the device driver of the agent detach.

   116 		Server().iKernelDriver.DetachAgent(iDebugAgentProcessId.Id());

   117 

   118 		LOG_MSG( "CSecuritySvrSession::~CSecuritySvrSession() : -> securityServer.DetachAllProcesses()\n" );

   119 		Server().DetachAllProcesses(iDebugAgentProcessId);

   120 		}

   121 

   122 	//notify the server that the session has closed

   123 	if(iServerNotified)

   124 		{

   125 		Server().SessionClosed();

   126 		}

   127 	}

   128 

   129 void CSecuritySvrSession::ConstructL()

   130 	{

   131 	// nothing to do

   132 	}

   133 

   134 /**

   135   Used to insert heap checking markers.

   136 

   137   @param aFunction The function that heap markers should be added for

   138   @param aEntry if ETrue indicates that heap checking is starting, if EFalse

   139   that heap checking is ending.

   140   */

   141 void CSecuritySvrSession::HeapWatcher(const TUint32 aFunction, const TBool aEntry) const

   142 	{

   143 	switch(aFunction)

   144 		{

   145 		case EDebugServAttachExecutable:

   146 			return;

   147 		case EDebugServDetachExecutable:

   148 			return;

   149 		case EDebugServSuspendThread:

   150 			return;

   151 		case EDebugServResumeThread:

   152 			return;

   153 // used for out-of-memory testing in debug mode

   154 #ifdef _DEBUG

   155 		// start heap marking in on entry, do nothing on exit

   156 		case EDebugServMarkHeap:

   157 			{

   158 			if(aEntry)

   159 				{

   160 				__UHEAP_MARK;

   161 				}

   162 			return;

   163 			}

   164 		// stop heap marking on exit, do nothing on entry

   165 		case EDebugServMarkEnd:

   166 			{

   167 			if(!aEntry)

   168 				{

   169 				__UHEAP_MARKEND;

   170 				}

   171 			return;

   172 			}

   173 #endif

   174 		default:

   175 			if(aEntry)

   176 				{

   177 				__UHEAP_MARK;

   178 				}

   179 			else

   180 				{

   181 				__UHEAP_MARKEND;

   182 				}

   183 			return;

   184 		}

   185 	}

   186 

   187 void CSecuritySvrSession::ServiceL(const RMessage2& aMessage)

   188 //

   189 // Session service handler

   190 //

   191 	{

   192 	//insert starting heap markers

   193 	HeapWatcher(aMessage.Function(), ETrue);

   194 

   195 	switch(aMessage.Function())

   196 		{

   197 		case EDebugServResumeThread:

   198 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServResumeThread\n" );

   199 			ResumeThreadL(aMessage);

   200 			break;

   201 

   202 		case EDebugServSuspendThread:

   203 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServSuspendThread\n" );

   204 			SuspendThreadL(aMessage);

   205 			break;

   206 

   207 		case EDebugServReadMemory:

   208 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServReadMemory\n" );

   209 			ReadMemoryL(aMessage);

   210 			break;

   211 

   212 		case EDebugServWriteMemory:

   213 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServWriteMemory\n" );

   214 			WriteMemoryL(aMessage);

   215 			break;

   216 

   217 		case EDebugServSetBreak:

   218 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServSetBreak\n" );

   219 			SetBreakL(aMessage);

   220 			break;

   221 

   222 		case EDebugServClearBreak:

   223 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServClearBreak\n" );

   224 			ClearBreakL(aMessage);

   225 			break;

   226 

   227 		case EDebugServModifyBreak:

   228 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServModifyBreak\n" );

   229 			ModifyBreakL(aMessage);

   230 			break;

   231 

   232 		case EDebugServModifyProcessBreak:

   233 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServModifyProcessBreak\n" );

   234 			ModifyProcessBreakL(aMessage);

   235 			break;

   236 

   237 		case EDebugServBreakInfo:

   238 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServBreakInfo\n" );

   239 			BreakInfoL(aMessage);

   240 			break;

   241 

   242 		case EDebugServReadRegisters:

   243 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServReadRegisters\n" );

   244 			ReadRegistersL(aMessage);

   245 			break;

   246 

   247 		case EDebugServWriteRegisters:

   248 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServWriteRegisters\n" );

   249 			WriteRegistersL(aMessage);

   250 			break;

   251 

   252 		case EDebugServGetEvent:

   253 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetEvent\n" );

   254 			GetEventL(aMessage);

   255 			break;

   256 

   257 		case EDebugServCancelGetEvent:

   258 			CancelGetEventL(aMessage);

   259 			break;

   260 

   261 		case EDebugServAttachExecutable:

   262 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServAttachExecutable\n" );

   263 			AttachProcessL(aMessage);

   264 			break;

   265 

   266 		case EDebugServDetachExecutable:

   267 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServDetachExecutable\n" );

   268 			DetachProcessL(aMessage);

   269 			break;

   270 

   271 		case EDebugServGetDebugFunctionalityBufSize:

   272 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetDebugFunctionalityBufSize\n" );

   273 			GetDebugFunctionalityBufSizeL(aMessage);

   274 			break;

   275 

   276 		case EDebugServGetDebugFunctionality:

   277 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetDebugFunctionality\n" );

   278 			GetDebugFunctionalityL(aMessage);

   279 			break;

   280 

   281 		case EDebugServSetEventAction:

   282 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServSetEventAction\n" );

   283 			SetEventActionL(aMessage);

   284 			break;

   285 

   286 		case EDebugServGetList:

   287 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetList\n" );

   288 			GetListL(aMessage);

   289 			break;

   290 

   291 		case EDebugServStep:

   292 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServStep\n");

   293 			StepL(aMessage);

   294 			break;

   295 

   296 		case EDebugServSetProcessBreak:

   297 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServSetProcessBreak\n");

   298 			SetProcessBreakL(aMessage);

   299 			break;

   300 		

   301 		case EDebugServProcessBreakInfo:

   302 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServProcessBreakInfo\n");

   303 			ProcessBreakInfoL(aMessage);

   304 			break;

   305 

   306 		case EDebugServKillProcess:

   307 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServKillProcess\n");

   308 			KillProcessL(aMessage);

   309 			break;

   310 

   311 #ifdef _DEBUG

   312 		case EDebugServMarkHeap:

   313 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServMarkHeap\n");

   314 			// all taken care of in HeapWatcher

   315 			aMessage.Complete(KErrNone);

   316 			break;

   317 

   318 		case EDebugServMarkEnd:

   319 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServMarkEnd\n");

   320 			// all taken care of in HeapWatcher

   321 			aMessage.Complete(KErrNone);

   322 			break;

   323 

   324 		case EDebugServFailAlloc:

   325 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServFailAlloc\n");

   326 			DoFailAlloc(aMessage);

   327 			break;

   328 #endif

   329 		case EDebugServReadCrashFlash:

   330 			ReadCrashLogL(aMessage);

   331 			break;		

   332 		case EDebugServWriteCrashFlash:

   333 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServWriteCrashFlash\n");

   334 			WriteCrashConfigL(aMessage);

   335 			break;

   336 		case EDebugServEraseCrashFlash:

   337 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServEraseCrashFlash\n");

   338 			EraseCrashLogL(aMessage);

   339 			break;

   340 		case EDebugServEraseEntireCrashFlash:

   341 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServEraseEntireCrashFlash\n");

   342 			EraseEntireCrashLogL(aMessage);

   343 			break;

   344 		default:

   345 			LOG_MSG( "CSecuritySvrSession::ServiceL() Unknown request, calling User::Leave(KErrNotSupported);\n" );

   346 			User::Leave(KErrNotSupported);

   347 			break;

   348 		}

   349 

   350 	//insert ending heap markers

   351 	HeapWatcher(aMessage.Function(), EFalse);

   352 	}

   353 

   354 #ifdef _DEBUG

   355 /**

   356   Used to control heap failure in debug mode.

   357   @param aMessage If aMessage.Int0 is non-zero then heap will be set to fail on that allocation.

   358   If aMessage.Int0 is zero then the heap failure count is reset

   359   */

   360 void CSecuritySvrSession::DoFailAlloc(const RMessage2& aMessage)

   361 	{

   362 	TInt count = aMessage.Int0();

   363 	if(count == 0)

   364 		{

   365 		__UHEAP_RESET;

   366 		}

   367 	else

   368 		{

   369 		__UHEAP_FAILNEXT(count);

   370 		}

   371 	aMessage.Complete(KErrNone);

   372 	}

   373 #endif

   374 

   375 /**

   376 Suspends execution of the specified thread.

   377 

   378 @param aMessage contains an integer representation of the target thread's

   379        thread ID at offset 0.

   380 

   381 @leave KErrPermissionDenied if security check fails or KErrArgument if the

   382        thread does not exist

   383 */

   384 void CSecuritySvrSession::SuspendThreadL(const RMessage2& aMessage)

   385 	{

   386 

   387 	LOG_MSG( "CSecuritySvrSession::SuspendThreadL()\n" );

   388 

   389 	//get thread ID

   390 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   391 	//check attached

   392 	CheckAttachedL(threadId, aMessage, EFalse);

   393 

   394 	//security check passed so can perform actions

   395 	User::LeaveIfError(Server().iKernelDriver.SuspendThread(threadId));

   396 

   397 	aMessage.Complete(KErrNone);

   398 	}

   399 

   400 /**

   401 Resumes execution of the specified thread.

   402 

   403 @param aMessage contains an integer representation of the target thread's

   404        thread ID at offset 0.

   405 

   406 @leave KErrPermissionDenied if security check fails or KErrArgument if the

   407        thread does not exist

   408 */

   409 void CSecuritySvrSession::ResumeThreadL(const RMessage2& aMessage)

   410 	{

   411 	LOG_MSG( "CSecuritySvrSession::ResumeThreadL()\n" );

   412 

   413 	//get thread ID

   414 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   415 

   416 	//check attached

   417 	CheckAttachedL(threadId, aMessage, EFalse);

   418 	

   419 	//security check passed so can perform actions

   420 	TInt err = Server().iKernelDriver.ResumeThread(threadId);

   421 	aMessage.Complete(err);

   422 	}

   423 

   424 void CSecuritySvrSession::GetDebugFunctionalityBufSizeL(const RMessage2& aMessage)

   425 //

   426 // Retrieve size of functionality data buffer in bytes which must be allocated

   427 // by the client

   428 //

   429 	{

   430 	LOG_MSG( "CSecuritySvrSession::GetDebugFunctionalityBufSizeL()\n" );

   431 

   432 	TUint32 result = 0;

   433 	// Get Buffer size from the kernel driver

   434 	User::LeaveIfError(Server().iKernelDriver.GetDebugFunctionalityBufSize(result));

   435 

   436 	TPtr8 stuff((TUint8*)&result,4, 4);

   437 

   438 	aMessage.WriteL(0,stuff);

   439 

   440 	aMessage.Complete(KErrNone);

   441 	}

   442 

   443 void CSecuritySvrSession::GetDebugFunctionalityL(const RMessage2& aMessage)

   444 //

   445 // Retrieve the functionality data and place it in a buffer

   446 // allocated by the client.

   447 //

   448 	{

   449 	LOG_MSG( "CSecuritySvrSession::GetDebugFunctionalityL()\n" );

   450 

   451 	TUint32 dfsize = 0;

   452 

   453 	// Get Buffer size from the kernel driver

   454 	User::LeaveIfError(Server().iKernelDriver.GetDebugFunctionalityBufSize(dfsize));

   455 

   456 	// Allocate space for the functionality data

   457 	HBufC8* dftext = HBufC8::NewLC(dfsize);

   458 

   459 	const TPtr8& dfPtr = dftext->Des();

   460 

   461 	// Extract said data from the device driver

   462 	User::LeaveIfError(Server().iKernelDriver.GetDebugFunctionality((TDes8&)dfPtr));

   463 

   464 	// Return data to client

   465 	aMessage.WriteL(0,dfPtr);

   466 

   467 	// Free buffer

   468 	CleanupStack::PopAndDestroy(dftext);

   469 

   470 	aMessage.Complete(KErrNone);

   471 	}

   472 

   473 /**

   474 Reads memory from a specified thread using the passed parameters. The user 

   475 should ensure that the TPtr8 that is passed in has size greater than or equal

   476 to the size of the memory that is trying to be read.

   477 

   478 @param aMessage The RMessage2 object should be constructed as follows:

   479     * aMessage.Int0() is the thread ID of the target debug app

   480     * aMessage.Ptr1() is a TMemoryInfo object which contains the following:

   481         * the address of the memory to be read from the target debug thread

   482         * the size of the memory block to be read from the target debug thread

   483 	* the access size to use

   484 	* the endianess to interpret the data as

   485     * aMessage.Ptr2() is the address of the buffer in the debug agent thread 

   486       that the data from the target debug app should be written into 

   487 

   488 @leave KErrPermissionDenied if client is not attached to the target

   489        thread's process,

   490        KErrNoMemory if memory could not be allocated,

   491        KErrArgument if there are problems with the aMessage object,

   492        KErrBadHandle if the thread represented by aMessage.Ptr0() is invalid,

   493        an error value from CSecuritySvrSession::ValidateMemoryInfo if checking

   494        the memory attributes failed,

   495        or another of the system wide error codes

   496 */

   497 void CSecuritySvrSession::ReadMemoryL(const RMessage2& aMessage)

   498 	{

   499 	LOG_MSG( "CSecuritySvrSession::ReadMemoryL()\n" );

   500 

   501 	//get debug app thread ID

   502 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   503 

   504 	CheckAttachedL(threadId, aMessage, ETrue);

   505 

   506 	//create and initialise the memory info object

   507 	TMemoryInfo targetMemory;

   508 	TPtr8 targetMemoryPtr( (TUint8 *)&targetMemory, sizeof(TMemoryInfo) );

   509 

   510 	aMessage.ReadL(1,targetMemoryPtr);

   511 

   512 	//check memory info is acceptable

   513 	ValidateMemoryInfoL(threadId, targetMemory, ETrue);

   514 

   515 	RBuf8 data;

   516 	data.CreateL(targetMemory.iSize);

   517 	data.CleanupClosePushL();

   518 

   519 	//fill buffer with data from target debug thread

   520 	User::LeaveIfError(Server().iKernelDriver.ReadMemory(threadId, targetMemory.iAddress, targetMemory.iSize, data));

   521 

   522 	//attempt to write the data from the target debug thread back to the agent

   523 	aMessage.WriteL(2, data);

   524 

   525 	//delete temporary buffer

   526 	CleanupStack::PopAndDestroy(&data);

   527 

   528 	aMessage.Complete(KErrNone);

   529 	}

   530 

   531 /**

   532 Writes memory to a specified thread using the passed parameters. 

   533 

   534 @param aMessage The RMessage2 object should be constructed as follows:

   535     * aMessage.Ptr0() is the thread ID of the target debug app

   536     * aMessage.Ptr1() is a TMemoryInfo object which contains the following:

   537         * the address of the memory to be written to the target debug thread

   538         * the size of the memory block to be written to the target debug thread

   539 	* the access size to use

   540 	* the endianess to interpret the data as

   541     * aMessage.Ptr2() is the address of the buffer in the debug agent thread 

   542       that the data to write to the target debug app should be read from

   543 

   544 @leave KErrPermissionDenied if client is not attached (actively) to the target

   545        thread's process,

   546        KErrNoMemory if memory could not be allocated,

   547        KErrArgument if there are problems with the aMessage object,

   548        KErrBadHandle if the thread represented by aMessage.Ptr0() is invalid,

   549        an error value from CSecuritySvrSession::ValidateMemoryInfo if checking

   550        the memory attributes failed,

   551        or another of the system wide error codes

   552 */

   553 void CSecuritySvrSession::WriteMemoryL(const RMessage2& aMessage)

   554 	{

   555 	LOG_MSG( "CSecuritySvrSession::WriteMemoryL()\n" );

   556 

   557 	//get debug app thread ID

   558 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   559 

   560 	CheckAttachedL(threadId, aMessage, EFalse);

   561 

   562 	//create and initialise the memory info object

   563 	TMemoryInfo targetMemory;

   564 	TPtr8 targetMemoryPtr( (TUint8 *)&targetMemory, sizeof(TMemoryInfo) );

   565 

   566 	aMessage.ReadL(1,targetMemoryPtr);

   567 

   568 	//check memory info is acceptable

   569 	ValidateMemoryInfoL(threadId, targetMemory, EFalse);

   570 

   571 	//create temporary buffer and read data from client

   572 	RBuf8 data;

   573 	data.CreateL(targetMemory.iSize);

   574 	data.CleanupClosePushL();

   575 	

   576 	aMessage.ReadL(2, data);

   577 

   578 	// what about telling the driver about endianess/access size?

   579 	User::LeaveIfError(Server().iKernelDriver.WriteMemory(threadId, targetMemory.iAddress, targetMemory.iSize, data));

   580 

   581 	//free temporary buffer

   582 	CleanupStack::PopAndDestroy(&data);

   583 

   584 	aMessage.Complete(KErrNone);

   585 	}

   586 

   587 /**

   588 @internalTechnology

   589 

   590 Notes: This call is used to set a thread specific breakpoint. Its input arguments

   591 are the thread id, address and architecture type of the breakpoint. It returns success

   592 or failure, and if successful, it sets the TBreakId in the Debug Agent to the 

   593 breakpoint id by which it can be referenced in future calls to ModifyBreak,ClearBreak and

   594 BreakInfo.

   595 

   596 @param aMessage.Ptr0() - aThreadId is thread id of the target debug process

   597 @param aMessage.Ptr1() - Address of a TBreakInfo in the Debug Agent

   598 @param aMessage.Ptr2() - Address of a TBreakId in the Debug Agent

   599 @leave KErrPermissionDenied if the security check fails.

   600  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   601  KErrNotSupported if the architecture type is unrecognised.

   602  KErrNoMemory if there is no more memory to complete the operation.

   603  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   604  breakpoint.

   605  KErrOverflow if there are too many breakpoints set.

   606 */

   607 void CSecuritySvrSession::SetBreakL(const RMessage2& aMessage)

   608 	{

   609 	LOG_MSG( "CSecuritySvrSession::SetBreakL!()\n" );

   610 

   611 	//get debug app thread ID

   612 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   613 

   614 	//check that the agent has attached to the target process

   615 	CheckAttachedL(threadId, aMessage, EFalse);

   616 

   617 	//create and initialise the memory info object

   618 	TBreakInfo breakInfo;

   619 	TPtr8 breakInfoPtr( (TUint8 *)&breakInfo, sizeof(TBreakInfo) );

   620 

   621 	aMessage.ReadL(1,breakInfoPtr);

   622 

   623 	//set break in target app

   624 	TBreakId breakId = 0;

   625 	User::LeaveIfError(Server().iKernelDriver.SetBreak(breakId, threadId, breakInfo.iAddress, breakInfo.iArchitectureMode));

   626 

   627 	//attempt to write the break id back to the debug agent

   628 	WriteDataL(aMessage, 2, &breakId, sizeof(breakId));

   629 

   630 	aMessage.Complete(KErrNone);

   631 	}

   632 

   633 /**

   634 Clears a breakpoint previously set by a SetBreak() call.

   635 

   636 @param aMessage.Int0() - TBreakId of the breakpoint to be removed.

   637 */

   638 void CSecuritySvrSession::ClearBreakL(const RMessage2& aMessage)

   639 	{

   640 	LOG_MSG( "CSecuritySvrSession::ClearBreakL()\n" );

   641 

   642 	const TInt breakId = aMessage.Int0();

   643 

   644 	// Check that the breakpoint exists

   645 	TUint64 objectId;

   646 	TUint32 address;

   647 	TArchitectureMode mode;

   648 	TBool threadSpecific = EFalse;

   649 

   650 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,objectId,address,mode,threadSpecific));

   651 

   652 	if(threadSpecific)

   653 		{

   654 		// Check that the debug agent is attached to the thread for which the

   655 		// breakpoint is currently set.

   656 		CheckAttachedL(TThreadId(objectId), aMessage, EFalse);

   657 		}

   658 	else

   659 		{

   660 		// Check that the debug agent is attached to the process for which the

   661 		// breakpoint is currently set.

   662 		CheckAttachedL(TProcessId(objectId), aMessage, EFalse);

   663 		}

   664 

   665 	// Finally clear the breakpoint

   666 	User::LeaveIfError(Server().iKernelDriver.ClearBreak(breakId));

   667 

   668 	aMessage.Complete(KErrNone);

   669 	}

   670 

   671 /**

   672 @param aMessage.Int0() - Breakpoint Id of interest

   673 @param aMessage.Ptr1() - Address in Debug Agent to place threadId of the breakpoint

   674 @param aMessage.Ptr2() - Address in Debug Agent to place address of the breakpoint

   675 @param aMessage.Ptr3() - Address in Debug Agent to place the architecture mode of the breakpoint

   676 @leave Any error which may be returned by RSessionBase::SendReceive()

   677 */

   678 void CSecuritySvrSession::BreakInfoL(const RMessage2& aMessage)

   679 	{

   680 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   681 

   682 	TThreadId threadId;

   683 	TUint32 address;

   684 	TArchitectureMode mode;

   685 	TBool threadSpecific = ETrue;

   686 

   687 	TUint64 threadIdData;

   688 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,threadIdData,address,mode,threadSpecific));

   689 

   690 	if(!threadSpecific)

   691 		{

   692 		User::Leave(KErrNotFound);

   693 		}

   694 

   695 	threadId = TThreadId(threadIdData);

   696 

   697 	//check that the agent has attached to the target process

   698 	CheckAttachedL(threadId, aMessage, EFalse);

   699 

   700 	// return the threadId

   701 	WriteDataL(aMessage, 1, &threadId, sizeof(threadId));

   702 

   703 	// return the address

   704 	WriteDataL(aMessage, 2, &address, sizeof(address));

   705 

   706 	// return the mode

   707 	WriteDataL(aMessage, 3, &mode, sizeof(mode));

   708 

   709 	aMessage.Complete(KErrNone);

   710 	}

   711 

   712 /**

   713 @internalTechnology

   714 

   715 Modify a previously set breakpoint.

   716 

   717 @param aMessage.Int0() - The breakpoint id of the breakpoint to modify

   718 @param aMessage.Ptr1() - The new Thread Id for the breakpoint

   719 @param aMessage.Int2() - The new virtual memory address for the breakpoint

   720 @param aMessage.Int3() - The new architecture mode for the breakpoint

   721 @return KErrNone if succesful. KErrPermissionDenied if the security check fails.

   722  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   723  KErrNotSupported if the architecture type is unrecognised.

   724  KErrNoMemory if there is no more memory to complete the operation.

   725  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   726  breakpoint.

   727  KErrOverflow if there are too many breakpoints set.

   728 */

   729 void CSecuritySvrSession::ModifyBreakL(const RMessage2& aMessage)

   730 	{

   731 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   732 	const TThreadId threadId = ReadTThreadIdL(aMessage, 1);

   733 	const TUint32 address = aMessage.Int2();

   734 	const TArchitectureMode mode = (TArchitectureMode)aMessage.Int3();

   735 

   736 	// Get information on the breakpoint to check the security status

   737 	TUint64 checkThreadId;

   738 	TUint32 checkAddress;

   739 	TArchitectureMode checkMode;

   740 	TBool threadSpecific;

   741 

   742 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,checkThreadId,checkAddress,checkMode,threadSpecific));

   743 

   744 	// Security check that the thread Id is associated with the debug agent

   745 

   746 	//check that the agent has attached to the target process

   747 	CheckAttachedL(TThreadId(checkThreadId), aMessage, EFalse);

   748 

   749 	// now check that the thread Id which is being set is permitted

   750 	//check that the agent has attached to the target process

   751 	CheckAttachedL(threadId, aMessage, EFalse);

   752 

   753 	User::LeaveIfError(Server().iKernelDriver.ModifyBreak(breakId,threadId,address,mode));

   754 

   755 	aMessage.Complete(KErrNone);

   756 	}

   757 

   758 /**

   759 @internalTechnology

   760 

   761 Notes: This call is used to set a process wide breakpoint. Its input arguments

   762 are the process id, address and architecture type of the breakpoint. It returns success

   763 or failure, and if successful, it sets the TBreakId in the Debug Agent to the 

   764 breakpoint id by which it can be referenced in future calls to ModifyBreak,ClearBreak and

   765 BreakInfo.

   766 

   767 @param aMessage.Ptr0() - aProcessId is process id of the target debug process

   768 @param aMessage.Ptr1() - Address of a TBreakInfo in the Debug Agent

   769 @param aMessage.Ptr2() - Address of a TBreakId in the Debug Agent

   770 @leave KErrPermissionDenied if the security check fails.

   771  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   772  KErrNotSupported if the architecture type is unrecognised.

   773  KErrNoMemory if there is no more memory to complete the operation.

   774  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   775  breakpoint.

   776  KErrOverflow if there are too many breakpoints set.

   777 */

   778 void CSecuritySvrSession::SetProcessBreakL(const RMessage2& aMessage)

   779 	{

   780 	LOG_MSG( "CSecuritySvrSession::SetProcessBreakL()\n" );

   781 

   782 	//get debug app thread ID

   783 	TProcessId procId = ReadTProcessIdL(aMessage, 0);

   784 

   785 	//check that the agent has attached to the target process

   786 	CheckAttachedL(procId, aMessage, EFalse);

   787 

   788 	//create and initialise the memory info object

   789 	TBreakInfo breakInfo;

   790 	TPtr8 breakInfoPtr( (TUint8 *)&breakInfo, sizeof(TBreakInfo) );

   791 

   792 	aMessage.ReadL(1,breakInfoPtr);

   793 

   794 	//set break in target app

   795 	TBreakId breakId = 0;

   796 	User::LeaveIfError(Server().iKernelDriver.SetProcessBreak(breakId, procId, breakInfo.iAddress, breakInfo.iArchitectureMode));

   797 

   798 	//attempt to write the break id back to the debug agent

   799 	WriteDataL(aMessage, 2, &breakId, sizeof(breakId));

   800 

   801 	aMessage.Complete(KErrNone);

   802 	}

   803 

   804 /**

   805 @internalTechnology

   806 

   807 Modify a previously set process breakpoint.

   808 

   809 @param aMessage.Int0() - The breakpoint id of the breakpoint to modify

   810 @param aMessage.Ptr1() - The new Process Id for the breakpoint

   811 @param aMessage.Int2() - The new virtual memory address for the breakpoint

   812 @param aMessage.Int3() - The new architecture mode for the breakpoint

   813 @return KErrNone if succesful. KErrPermissionDenied if the security check fails.

   814  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   815  KErrNotSupported if the architecture type is unrecognised.

   816  KErrNoMemory if there is no more memory to complete the operation.

   817  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   818  breakpoint.

   819  KErrOverflow if there are too many breakpoints set.

   820 */

   821 void CSecuritySvrSession::ModifyProcessBreakL(const RMessage2& aMessage)

   822 	{

   823 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   824 	const TProcessId processId = ReadTProcessIdL(aMessage, 1);

   825 	const TUint32 address = aMessage.Int2();

   826 	const TArchitectureMode mode = (TArchitectureMode)aMessage.Int3();

   827 

   828 	// Get information on the breakpoint to check the security status

   829 	TUint64 checkProcessId;

   830 	TUint32 checkAddress;

   831 	TArchitectureMode checkMode;

   832 	TBool threadSpecific;

   833 

   834 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,checkProcessId,checkAddress,checkMode,threadSpecific));

   835 

   836 	// Security check that the thread Id is associated with the debug agent

   837 

   838 	//check that the agent has attached to the target process

   839 	CheckAttachedL(TProcessId(checkProcessId), aMessage, EFalse);

   840 

   841 	// now check that the thread Id which is being set is permitted

   842 	//check that the agent has attached to the target process

   843 	CheckAttachedL(processId, aMessage, EFalse);

   844 

   845 	User::LeaveIfError(Server().iKernelDriver.ModifyProcessBreak(breakId,processId,address,mode));

   846 

   847 	aMessage.Complete(KErrNone);

   848 	}

   849 

   850 /**

   851 @param aMessage.Int0() - Breakpoint Id of interest

   852 @param aMessage.Ptr1() - Address in Debug Agent to place process Id of the breakpoint

   853 @param aMessage.Ptr2() - Address in Debug Agent to place address of the breakpoint

   854 @param aMessage.Ptr3() - Address in Debug Agent to place the architecture mode of the breakpoint

   855 @leave Any error which may be returned by RSessionBase::SendReceive()

   856 */

   857 void CSecuritySvrSession::ProcessBreakInfoL(const RMessage2& aMessage)

   858 	{

   859 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   860 

   861 	TProcessId procId;

   862 	TUint32 address;

   863 	TArchitectureMode mode;

   864 	TBool threadSpecific;

   865 

   866 	TUint64 procIdData;

   867 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,procIdData,address,mode,threadSpecific));

   868 	if(threadSpecific)

   869 		{

   870 		User::Leave(KErrNotFound);

   871 		}

   872 	procId = TProcessId(procIdData);

   873 

   874 	//check that the agent has attached to the target process

   875 	CheckAttachedL(procId, aMessage, EFalse);

   876 

   877 	// return the processId

   878 	WriteDataL(aMessage, 1, &procId, sizeof(procId));

   879 

   880 	// return the address

   881 	WriteDataL(aMessage, 2, &address, sizeof(address));

   882 

   883 	// return the mode

   884 	WriteDataL(aMessage, 3, &mode, sizeof(mode));

   885 

   886 	aMessage.Complete(KErrNone);

   887 	}

   888 

   889 /**

   890 Read register values.

   891 

   892 @param aMessage should contain:

   893         * at offset 0 a pointer to the thread ID of the target thread

   894         * at offset 1 a descriptor representing an array of TRegisterInfo 

   895           register IDs

   896         * at offset 2 a descriptor representing an array into which TRegisterValue 

   897           register values will be written

   898         * at offset 3 a descriptor representing an array into which TUint8 

   899           register flags will be written

   900 

   901 @leave KErrArgument if the max length of the array at offset 1 is not a 

   902        multiple of sizeof(TRegisterInfo), if the max length of the array 

   903        at offset 2 is not a multiple of sizeof(TRegisterValue), if the max 

   904        length of the array at offset 3 is not a multiple of sizeof(TUint8), if

   905        any of the descriptors have max length of 0, or if the three 

   906        descriptors do not represent the same number of registers,

   907        KErrNoMemory if there is insufficient memory,

   908        KErrDied, if the thread with thread ID aThreadId is dead

   909 */

   910 void CSecuritySvrSession::ReadRegistersL(const RMessage2& aMessage)

   911 	{

   912 	LOG_MSG( "CSecuritySvrSession::ReadRegistersL()\n" );

   913 

   914 	const TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   915 

   916 	//check the agent is attached to the thread

   917 	CheckAttachedL(threadId, aMessage, ETrue);

   918 

   919 	//number of registers being requested

   920 	TUint32 numberOfRegisters;

   921 

   922 	//check length of descriptors is acceptable

   923 	ValidateRegisterBuffersL(aMessage, numberOfRegisters);

   924 

   925 	// Passed data will be saved in this descriptor.

   926 	RBuf8 ids;

   927 	ids.CreateL(numberOfRegisters * sizeof(TRegisterInfo));

   928 	// Do the right cleanup if anything subsequently goes wrong

   929 	ids.CleanupClosePushL();

   930 	

   931 	//read the data from the client thread

   932 	aMessage.ReadL(1, ids);

   933 

   934 	//create buffer to fill with data from target debug thread

   935 	HBufC8 *data = HBufC8::NewLC(aMessage.GetDesMaxLength(2));

   936 	TPtr8 values(data->Des());   

   937 	

   938 	HBufC8 *flagsData = HBufC8::NewLC(numberOfRegisters * sizeof(TUint8));

   939 	TPtr8 flags(flagsData->Des());   

   940 	

   941 	//get register info and return relevant parts back to agent

   942 	User::LeaveIfError(Server().iKernelDriver.ReadRegisters(threadId, ids, values, flags));

   943 	aMessage.WriteL(2, values);

   944 	aMessage.WriteL(3, flags);

   945 	

   946 	//delete temporary buffers and return status

   947 	CleanupStack::PopAndDestroy(flagsData);

   948 	CleanupStack::PopAndDestroy(data);

   949 	CleanupStack::PopAndDestroy(&ids);

   950 

   951 	aMessage.Complete(KErrNone);

   952 	}

   953 

   954 /**

   955 Write register values.

   956 

   957 @param aMessage should contain:

   958         * at offset 0 a pointer to the thread ID of the target thread

   959         * at offset 1 a descriptor representing an array of TRegisterInfo 

   960           register IDs

   961         * at offset 2 a descriptor representing an array of TRegisterValue register 

   962           values

   963         * at offset 3 a descriptor representing an array into which TUint8 

   964           register flags will be written

   965 

   966 @leave KErrArgument if the max length of the array at offset 1 is not a 

   967        multiple of sizeof(TRegisterInfo), if the max length of the array 

   968        at offset 2 is not a multiple of sizeof(TRegisterValue), if the max 

   969        length of the array at offset 3 is not a multiple of sizeof(TUint8), if

   970        any of the descriptors have max length of 0, or if the three 

   971        descriptors do not represent the same number of registers,

   972        KErrNoMemory if there is insufficient memory,

   973        KErrDied, if the thread with thread ID aThreadId is dead

   974 */

   975 void CSecuritySvrSession::WriteRegistersL(const RMessage2& aMessage)

   976 	{

   977 	LOG_MSG( "CSecuritySvrSession::WriteRegistersL()\n" );

   978 

   979 	const TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   980 

   981 	CheckAttachedL(threadId, aMessage, EFalse);

   982 

   983 	//number of registers attempting to set

   984 	TUint32 numberOfRegisters;

   985 

   986 	//check length of descriptors is acceptable

   987 	ValidateRegisterBuffersL(aMessage, numberOfRegisters);

   988 

   989 	// Passed register ids will be saved in this descriptor.

   990 	RBuf8 ids;

   991 

   992 	//allocate buffer

   993 	ids.CreateL(numberOfRegisters * sizeof(TRegisterInfo));

   994 

   995 	// Do the right cleanup if anything subsequently goes wrong

   996 	ids.CleanupClosePushL();

   997 

   998 	//read the data from the client thread

   999 	aMessage.ReadL(1, ids);

  1000 

  1001 	// Passed register values will be saved in this descriptor.

  1002 	RBuf8 values;

  1003 

  1004 	//allocate buffer

  1005 	values.CreateL(aMessage.GetDesMaxLength(2));

  1006 	// Do the right cleanup if anything subsequently goes wrong

  1007 	values.CleanupClosePushL();

  1008 	//read the data from the client thread

  1009 	aMessage.ReadL(2,values);

  1010 

  1011 	HBufC8 *flagsData = HBufC8::NewLC(numberOfRegisters*sizeof(TUint8));

  1012 	TPtr8 flags(flagsData->Des());

  1013 

  1014 	//get register info and return relevant parts back to agent

  1015 	User::LeaveIfError(Server().iKernelDriver.WriteRegisters(threadId, ids, values, flags));

  1016 

  1017 	//write flags data back

  1018 	aMessage.WriteL(3, flags);

  1019 

  1020 	CleanupStack::PopAndDestroy(flagsData);

  1021 	CleanupStack::PopAndDestroy(&values);

  1022 	CleanupStack::PopAndDestroy(&ids);

  1023 

  1024 	aMessage.Complete(KErrNone);

  1025 	}

  1026 

  1027 /**

  1028 Processes an attach request from a debug agent. Gets the target debug

  1029 processes' original FileName as an argument. The method sets completion

  1030 status of the aMessage argument to KErrNone if successfully attached and to

  1031 another of the system wide error codes if there were problems.

  1032 

  1033 @param aMessage contains:

  1034        * a boolean at offset 0 which indicates whether the agent wishes to

  1035        attach passively

  1036        * a buffer at offset 1 which contains the FileName

  1037        of the target debug process.

  1038 */

  1039 void CSecuritySvrSession::AttachProcessL(const RMessage2& aMessage)

  1040 	{

  1041 	LOG_MSG( "CSecuritySvrSession::AttachProcessL()\n" );

  1042 

  1043 	const TBool passive = aMessage.Int0();

  1044 

  1045 	TInt deslen = aMessage.GetDesLengthL(1);

  1046 

  1047 	// Passed data will be saved in this descriptor.

  1048 	RBuf processName;

  1049 

  1050 	// Max length set to the value of "deslen", but current length is zero

  1051 	processName.CreateL(deslen);

  1052 

  1053 	// Do the right cleanup if anything subsequently goes wrong

  1054 	processName.CleanupClosePushL();

  1055 

  1056 	// Copy the client's descriptor data into our buffer.

  1057 	aMessage.ReadL(1,processName);

  1058 

  1059 	//

  1060 	// Security Check

  1061 	//

  1062 	// It is not permitted to debug the debug security server!

  1063 	//

  1064 	// get the secure id of the executable

  1065 	TUid secureId(TUid::Null());

  1066 	GetSecureIdL(processName, secureId);

  1067 	if (KUidDebugSecurityServer.iUid == secureId.iUid)

  1068 		{

  1069 		// The debug agent has requested to debug the Debug Security Server

  1070 		// This is either an error, or an attempt to breach security. We

  1071 		// therefore refuse to agree to this request, and return KErrPermissionDenied

  1072 		LOG_MSG("CSecuritySvrSession::AttachProcessL() - Debug Agent attempted to debug the Debug Security Server\n");

  1073 

  1074 		User::Leave(KErrPermissionDenied);

  1075 		}

  1076 

  1077 	//get the debug agent's thread and push handle onto clean up stack

  1078 	RThread clientThread;

  1079 	User::LeaveIfError(aMessage.Client(clientThread));

  1080 	CleanupClosePushL(clientThread);

  1081 

  1082 	//get the debug agent's process

  1083 	RProcess clientProcess;

  1084 	User::LeaveIfError(clientThread.Process(clientProcess));

  1085 

  1086 	//finished with thread so close handle and destroy

  1087 	CleanupStack::PopAndDestroy(&clientThread);

  1088 	

  1089 	//get the debug agent's process id

  1090 	TProcessId processId = clientProcess.Id();

  1091 

  1092 	//store the debug agent's process id for forced detaching later if the

  1093 	//agent doesn't tidy up after itself

  1094 	StoreDebugAgentId(processId);

  1095 

  1096 	// Read the OEM Debug token capabilities (if any)

  1097 	GetDebugAgentOEMTokenCapsL();

  1098 

  1099 	//finished with process so close handle

  1100 	clientProcess.Close();

  1101 	

  1102 	// Get the Security info via rlibrary::getinfo

  1103 	RLibrary::TInfo info;

  1104 	TPckg<RLibrary::TInfo> infoBuf(info);

  1105 

  1106 	TInt err = RLibrary::GetInfo(processName, infoBuf);

  1107 	if (err != KErrNone)

  1108 		{

  1109 		LOG_MSG("CSecuritySvrSession::AttachProcessL() - Cannot parse the target executable header\n");

  1110 		

  1111 		// Could not read the header for this executable :-(

  1112 

  1113 		CleanupStack::PopAndDestroy(&processName);

  1114 		

  1115 		aMessage.Complete(KErrPermissionDenied);

  1116  

  1117 		return;

  1118 		}

  1119 	

  1120 	// Special case for AllFiles - OEM Debug tokens MUST have

  1121 	// AllFiles, as this is what allows them to read contents

  1122 	// of other executables.

  1123 	TBool checkDebuggable = ETrue;

  1124 

  1125 	// Does an OEM Debug Token permit debug where it would normally not be

  1126 	// permitted?

  1127 	if ( Server().OEMTokenPermitsDebugL(iOEMDebugCapabilities, info.iSecurityInfo.iCaps) )

  1128 		{

  1129 		// OEM Debug token is valid and has sufficient capabilities

  1130 		LOG_MSG("CSecuritySvrSession::AttachProcessL() - Debug Agent has sufficient capabilites based on OEM Debug Token");	

  1131 		

  1132 		checkDebuggable = EFalse;

  1133 		}

  1134