1 // Copyright (c) 2006-2010 Nokia Corporation and/or its subsidiary(-ies).

     2 // All rights reserved.

     3 // This component and the accompanying materials are made available

     4 // under the terms of the License "Eclipse Public License v1.0"

     5 // which accompanies this distribution, and is available

     6 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

     7 //

     8 // Initial Contributors:

     9 // Nokia Corporation - initial contribution.

    10 //

    11 // Contributors:

    12 //

    13 // Description:

    14 // Provides the debug security server session implementation.

    15 // 

    16 //

    17 

    18 /**

    19  @file

    20  @internalTechnology

    21  @released

    22 */

    23 

    24 // Needed so we get the text strings for capabilities

    25 #define __INCLUDE_CAPABILITY_NAMES__

    26 

    27 #include <e32std.h>

    28 #include <e32std_private.h>

    29 #include <e32btrace.h>

    30 #include <d32btrace.h>

    31 #include <e32base.h>

    32 #include <e32base_private.h>

    33 #include <e32uid.h>

    34 #include <f32file.h>

    35 #include <e32capability.h>

    36 #include <rm_debug_api.h>

    37 

    38 // required for direct parsing of e32image/tromimage headers

    39 #include <f32image.h>

    40 #include <e32rom.h>

    41 

    42 //added for direct access to media driver

    43 #include <partitions.h>

    44 #include <ftlcontrolio.h>

    45 

    46 #include "c_security_svr_session.h"

    47 #include "c_security_svr_server.h"

    48 #include "c_security_svr_async.h"

    49 #include "rm_debug_logging.h"

    50 #ifdef _DEBUG

    51 #include "low_mem_requests.h"

    52 #endif

    53 

    54 using namespace Debug;

    55 

    56 CSecuritySvrSession::CSecuritySvrSession(const TProcessId& aDebugAgentProcessId)

    57 	: iDebugAgentProcessId(aDebugAgentProcessId),

    58 	  iServerNotified(EFalse),

    59 	  iCrashConnected(EFalse)

    60 	{

    61 	// Ensure that this debug agent has no target capability override

    62 	// by default

    63 	iOEMDebugCapabilities.SetEmpty();

    64 	}

    65 

    66 void CSecuritySvrSession::ServiceError(const RMessage2 &aMessage, TInt aError)

    67 	{

    68 	LOG_MSG2("CSecuritySvrSession::ServiceError(), aError: %d\n", aError);

    69 

    70 	//insert ending heap markers

    71 	HeapWatcher(aMessage.Function(), EFalse);

    72 

    73 	aMessage.Complete(aError);

    74 	}

    75 

    76 /**

    77 Called by the client/server framework as part of session creation.

    78 

    79 Notifies the server that a session is being created

    80 */

    81 void CSecuritySvrSession::CreateL()

    82 	{

    83 	LOG_MSG("CSecuritySvrSession::CreateL()\n");

    84 

    85 	//notify the server that the session has been opened

    86 	Server().SessionOpened();

    87 	iServerNotified = ETrue;

    88 	}

    89 

    90 /**

    91   Returns a reference to the DSS

    92 

    93   @return a reference to the DSS

    94   */

    95 CSecuritySvrServer& CSecuritySvrSession::Server() const

    96     {

    97     return *static_cast<CSecuritySvrServer*>(const_cast<CServer2*>(CSession2::Server()));

    98     }

    99 

   100 /**

   101 Session destructor. Performs necessary cleanup and notifies the server that the

   102 session is being closed

   103 */

   104 CSecuritySvrSession::~CSecuritySvrSession()

   105 	{

   106 	LOG_MSG("CSecuritySvrSession::~CSecuritySvrSession!()\n");

   107 

   108 	// Cancel any outstanding async objects.

   109 	iAsyncHandlers.ResetAndDestroy();

   110 		

   111 	// Inform the device driver of the agent detach.

   112 	Server().iKernelDriver.DetachAgent(iDebugAgentProcessId.Id());

   113 

   114 	LOG_MSG( "CSecuritySvrSession::~CSecuritySvrSession() : -> securityServer.DetachAllProcesses()\n" );

   115 	Server().DetachAllProcesses(iDebugAgentProcessId);

   116 

   117 	//notify the server that the session has closed

   118 	if(iServerNotified)

   119 		{

   120 		Server().SessionClosed();

   121 		}

   122 	}

   123 

   124 void CSecuritySvrSession::ConstructL()

   125 	{

   126 	// nothing to do

   127 	}

   128 

   129 /**

   130   Used to insert heap checking markers.

   131 

   132   @param aFunction The function that heap markers should be added for

   133   @param aEntry if ETrue indicates that heap checking is starting, if EFalse

   134   that heap checking is ending.

   135   */

   136 void CSecuritySvrSession::HeapWatcher(const TUint32 aFunction, const TBool aEntry) const

   137 	{

   138 	switch(aFunction)

   139 		{

   140 		case EDebugServAttachExecutable:

   141 			return;

   142 		case EDebugServDetachExecutable:

   143 			return;

   144 		case EDebugServSuspendThread:

   145 			return;

   146 		case EDebugServResumeThread:

   147 			return;

   148 		case EDebugServAttachAll:

   149 			return;

   150 		case EDebugServDetachAll:

   151 			return;

   152 // used for out-of-memory testing in debug mode

   153 #ifdef _DEBUG

   154 		// start heap marking in on entry, do nothing on exit

   155 		case EDebugServMarkHeap:

   156 			{

   157 			if(aEntry)

   158 				{

   159 				__UHEAP_MARK;

   160 				}

   161 			return;

   162 			}

   163 		// stop heap marking on exit, do nothing on entry

   164 		case EDebugServMarkEnd:

   165 			{

   166 			if(!aEntry)

   167 				{

   168 				__UHEAP_MARKEND;

   169 				}

   170 			return;

   171 			}

   172 #endif

   173 		default:

   174 			if(aEntry)

   175 				{

   176 				__UHEAP_MARK;

   177 				}

   178 			else

   179 				{

   180 				__UHEAP_MARKEND;

   181 				}

   182 			return;

   183 		}

   184 	}

   185 

   186 void CSecuritySvrSession::ServiceL(const RMessage2& aMessage)

   187 //

   188 // Session service handler

   189 //

   190 	{

   191 	//insert starting heap markers

   192 	HeapWatcher(aMessage.Function(), ETrue);

   193 

   194 	switch(aMessage.Function())

   195 		{

   196 		case EDebugServResumeThread:

   197 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServResumeThread\n" );

   198 			ResumeThreadL(aMessage);

   199 			break;

   200 

   201 		case EDebugServSuspendThread:

   202 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServSuspendThread\n" );

   203 			SuspendThreadL(aMessage);

   204 			break;

   205 

   206 		case EDebugServReadMemory:

   207 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServReadMemory\n" );

   208 			ReadMemoryL(aMessage);

   209 			break;

   210 

   211 		case EDebugServWriteMemory:

   212 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServWriteMemory\n" );

   213 			WriteMemoryL(aMessage);

   214 			break;

   215 

   216 		case EDebugServSetBreak:

   217 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServSetBreak\n" );

   218 			SetBreakL(aMessage);

   219 			break;

   220 

   221 		case EDebugServClearBreak:

   222 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServClearBreak\n" );

   223 			ClearBreakL(aMessage);

   224 			break;

   225 

   226 		case EDebugServModifyBreak:

   227 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServModifyBreak\n" );

   228 			ModifyBreakL(aMessage);

   229 			break;

   230 

   231 		case EDebugServModifyProcessBreak:

   232 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServModifyProcessBreak\n" );

   233 			ModifyProcessBreakL(aMessage);

   234 			break;

   235 

   236 		case EDebugServBreakInfo:

   237 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServBreakInfo\n" );

   238 			BreakInfoL(aMessage);

   239 			break;

   240 

   241 		case EDebugServReadRegisters:

   242 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServReadRegisters\n" );

   243 			ReadRegistersL(aMessage);

   244 			break;

   245 

   246 		case EDebugServWriteRegisters:

   247 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServWriteRegisters\n" );

   248 			WriteRegistersL(aMessage);

   249 			break;

   250 

   251 		case EDebugServGetEvent:

   252 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetEvent\n" );

   253 			GetEventL(aMessage);

   254 			break;

   255 

   256 		case EDebugServCancelGetEvent:

   257 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServCancelGetEvent\n" );

   258 			CancelGetEventL(aMessage);

   259 			break;

   260 

   261 		case EDebugServAttachExecutable:

   262 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServAttachExecutable\n" );

   263 			AttachProcessL(aMessage);

   264 			break;

   265 

   266 		case EDebugServDetachExecutable:

   267 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServDetachExecutable\n" );

   268 			DetachProcessL(aMessage);

   269 			break;

   270 

   271 		case EDebugServAttachAll:

   272 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServAttachAll\n" );

   273 			AttachAllL(aMessage);

   274 			break;

   275 

   276 		case EDebugServDetachAll:

   277 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServDetachAll\n" );

   278 			DetachAllL(aMessage);

   279 			break;			

   280 			

   281 		case EDebugServGetDebugFunctionalityBufSize:

   282 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetDebugFunctionalityBufSize\n" );

   283 			GetDebugFunctionalityBufSizeL(aMessage);

   284 			break;

   285 

   286 		case EDebugServGetDebugFunctionality:

   287 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetDebugFunctionality\n" );

   288 			GetDebugFunctionalityL(aMessage);

   289 			break;

   290 

   291 		case EDebugServSetEventAction:

   292 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServSetEventAction\n" );

   293 			SetEventActionL(aMessage);

   294 			break;

   295 

   296 		case EDebugServGetList:

   297 			LOG_MSG( "CSecuritySvrSession::ServiceL() EDebugServGetList\n" );

   298 			GetListL(aMessage);

   299 			break;

   300 

   301 		case EDebugServStep:

   302 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServStep\n");

   303 			StepL(aMessage);

   304 			break;

   305 

   306 		case EDebugServSetProcessBreak:

   307 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServSetProcessBreak\n");

   308 			SetProcessBreakL(aMessage);

   309 			break;

   310 		

   311 		case EDebugServProcessBreakInfo:

   312 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServProcessBreakInfo\n");

   313 			ProcessBreakInfoL(aMessage);

   314 			break;

   315 

   316 		case EDebugServKillProcess:

   317 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServKillProcess\n");

   318 			KillProcessL(aMessage);

   319 			break;

   320 

   321 #ifdef _DEBUG

   322 		case EDebugServMarkHeap:

   323 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServMarkHeap\n");

   324 			// all taken care of in HeapWatcher

   325 			aMessage.Complete(KErrNone);

   326 			break;

   327 

   328 		case EDebugServMarkEnd:

   329 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServMarkEnd\n");

   330 			// all taken care of in HeapWatcher

   331 			aMessage.Complete(KErrNone);

   332 			break;

   333 

   334 		case EDebugServFailAlloc:

   335 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServFailAlloc\n");

   336 			DoFailAlloc(aMessage);

   337 			break;

   338 #endif

   339 		case EDebugServReadCrashFlash:

   340 			ReadCrashLogL(aMessage);

   341 			break;		

   342 		case EDebugServWriteCrashFlash:

   343 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServWriteCrashFlash\n");

   344 			WriteCrashConfigL(aMessage);

   345 			break;

   346 		case EDebugServEraseCrashFlash:

   347 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServEraseCrashFlash\n");

   348 			EraseCrashLogL(aMessage);

   349 			break;

   350 		case EDebugServEraseEntireCrashFlash:

   351 			LOG_MSG("CSecuritySvrSession::ServiceL() EDebugServEraseEntireCrashFlash\n");

   352 			EraseEntireCrashLogL(aMessage);

   353 			break;

   354 		default:

   355 			LOG_MSG( "CSecuritySvrSession::ServiceL() Unknown request, calling User::Leave(KErrNotSupported);\n" );

   356 			User::Leave(KErrNotSupported);

   357 			break;

   358 		}

   359 

   360 	//insert ending heap markers

   361 	HeapWatcher(aMessage.Function(), EFalse);

   362 	

   363 	LOG_EXIT();

   364 	}

   365 

   366 #ifdef _DEBUG

   367 /**

   368   Used to control heap failure in debug mode.

   369   @param aMessage If aMessage.Int0 is non-zero then heap will be set to fail on that allocation.

   370   If aMessage.Int0 is zero then the heap failure count is reset

   371   */

   372 void CSecuritySvrSession::DoFailAlloc(const RMessage2& aMessage)

   373 	{

   374 	TInt count = aMessage.Int0();

   375 	if(count == 0)

   376 		{

   377 		__UHEAP_RESET;

   378 		}

   379 	else

   380 		{

   381 		__UHEAP_FAILNEXT(count);

   382 		}

   383 	aMessage.Complete(KErrNone);

   384 	}

   385 #endif

   386 

   387 /**

   388 Suspends execution of the specified thread.

   389 

   390 @param aMessage contains an integer representation of the target thread's

   391        thread ID at offset 0.

   392 

   393 @leave KErrPermissionDenied if security check fails or KErrArgument if the

   394        thread does not exist

   395 */

   396 void CSecuritySvrSession::SuspendThreadL(const RMessage2& aMessage)

   397 	{

   398 

   399 	LOG_MSG( "CSecuritySvrSession::SuspendThreadL()\n" );

   400 

   401 	//get thread ID

   402 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   403 	//check attached

   404 	CheckAttachedL(threadId, aMessage, EFalse);

   405 

   406 	//security check passed so can perform actions

   407 	User::LeaveIfError(Server().iKernelDriver.SuspendThread(threadId));

   408 

   409 	aMessage.Complete(KErrNone);

   410 	}

   411 

   412 /**

   413 Resumes execution of the specified thread.

   414 

   415 @param aMessage contains an integer representation of the target thread's

   416        thread ID at offset 0.

   417 

   418 @leave KErrPermissionDenied if security check fails or KErrArgument if the

   419        thread does not exist

   420 */

   421 void CSecuritySvrSession::ResumeThreadL(const RMessage2& aMessage)

   422 	{

   423 	LOG_MSG( "CSecuritySvrSession::ResumeThreadL()\n" );

   424 

   425 	//get thread ID

   426 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   427 

   428 	//check attached

   429 	CheckAttachedL(threadId, aMessage, EFalse);

   430 	

   431 	//security check passed so can perform actions

   432 	TInt err = Server().iKernelDriver.ResumeThread(threadId);

   433 	aMessage.Complete(err);

   434 	}

   435 

   436 void CSecuritySvrSession::GetDebugFunctionalityBufSizeL(const RMessage2& aMessage)

   437 //

   438 // Retrieve size of functionality data buffer in bytes which must be allocated

   439 // by the client

   440 //

   441 	{

   442 	LOG_MSG( "CSecuritySvrSession::GetDebugFunctionalityBufSizeL()\n" );

   443 

   444 	TUint32 result = 0;

   445 	// Get Buffer size from the kernel driver

   446 	User::LeaveIfError(Server().iKernelDriver.GetDebugFunctionalityBufSize(result));

   447 

   448 	TPtr8 stuff((TUint8*)&result,4, 4);

   449 

   450 	aMessage.WriteL(0,stuff);

   451 

   452 	aMessage.Complete(KErrNone);

   453 	}

   454 

   455 void CSecuritySvrSession::GetDebugFunctionalityL(const RMessage2& aMessage)

   456 //

   457 // Retrieve the functionality data and place it in a buffer

   458 // allocated by the client.

   459 //

   460 	{

   461 	LOG_MSG( "CSecuritySvrSession::GetDebugFunctionalityL()\n" );

   462 

   463 	TUint32 dfsize = 0;

   464 

   465 	// Get Buffer size from the kernel driver

   466 	User::LeaveIfError(Server().iKernelDriver.GetDebugFunctionalityBufSize(dfsize));

   467 

   468 	// Allocate space for the functionality data

   469 	HBufC8* dftext = HBufC8::NewLC(dfsize);

   470 

   471 	const TPtr8& dfPtr = dftext->Des();

   472 

   473 	// Extract said data from the device driver

   474 	User::LeaveIfError(Server().iKernelDriver.GetDebugFunctionality((TDes8&)dfPtr));

   475 

   476 	// Return data to client

   477 	aMessage.WriteL(0,dfPtr);

   478 

   479 	// Free buffer

   480 	CleanupStack::PopAndDestroy(dftext);

   481 

   482 	aMessage.Complete(KErrNone);

   483 	}

   484 

   485 /**

   486 Reads memory from a specified thread using the passed parameters. The user 

   487 should ensure that the TPtr8 that is passed in has size greater than or equal

   488 to the size of the memory that is trying to be read.

   489 

   490 @param aMessage The RMessage2 object should be constructed as follows:

   491     * aMessage.Int0() is the thread ID of the target debug app

   492     * aMessage.Ptr1() is a TMemoryInfo object which contains the following:

   493         * the address of the memory to be read from the target debug thread

   494         * the size of the memory block to be read from the target debug thread

   495 	* the access size to use

   496 	* the endianess to interpret the data as

   497     * aMessage.Ptr2() is the address of the buffer in the debug agent thread 

   498       that the data from the target debug app should be written into 

   499 

   500 @leave KErrPermissionDenied if client is not attached to the target

   501        thread's process,

   502        KErrNoMemory if memory could not be allocated,

   503        KErrArgument if there are problems with the aMessage object,

   504        KErrBadHandle if the thread represented by aMessage.Ptr0() is invalid,

   505        an error value from CSecuritySvrSession::ValidateMemoryInfo if checking

   506        the memory attributes failed,

   507        or another of the system wide error codes

   508 */

   509 void CSecuritySvrSession::ReadMemoryL(const RMessage2& aMessage)

   510 	{

   511 	LOG_MSG( "CSecuritySvrSession::ReadMemoryL()\n" );

   512 

   513 	//get debug app thread ID

   514 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   515 

   516 	CheckAttachedL(threadId, aMessage, ETrue);

   517 

   518 	//create and initialise the memory info object

   519 	TMemoryInfo targetMemory;

   520 	TPtr8 targetMemoryPtr( (TUint8 *)&targetMemory, sizeof(TMemoryInfo) );

   521 

   522 	aMessage.ReadL(1,targetMemoryPtr);

   523 

   524 	//check memory info is acceptable

   525 	ValidateMemoryInfoL(threadId, targetMemory, ETrue);

   526 

   527 	RBuf8 data;

   528 	data.CreateL(targetMemory.iSize);

   529 	data.CleanupClosePushL();

   530 

   531 	//fill buffer with data from target debug thread

   532 	User::LeaveIfError(Server().iKernelDriver.ReadMemory(threadId, targetMemory.iAddress, targetMemory.iSize, data));

   533 

   534 	//attempt to write the data from the target debug thread back to the agent

   535 	aMessage.WriteL(2, data);

   536 

   537 	//delete temporary buffer

   538 	CleanupStack::PopAndDestroy(&data);

   539 

   540 	aMessage.Complete(KErrNone);

   541 	}

   542 

   543 /**

   544 Writes memory to a specified thread using the passed parameters. 

   545 

   546 @param aMessage The RMessage2 object should be constructed as follows:

   547     * aMessage.Ptr0() is the thread ID of the target debug app

   548     * aMessage.Ptr1() is a TMemoryInfo object which contains the following:

   549         * the address of the memory to be written to the target debug thread

   550         * the size of the memory block to be written to the target debug thread

   551 	* the access size to use

   552 	* the endianess to interpret the data as

   553     * aMessage.Ptr2() is the address of the buffer in the debug agent thread 

   554       that the data to write to the target debug app should be read from

   555 

   556 @leave KErrPermissionDenied if client is not attached (actively) to the target

   557        thread's process,

   558        KErrNoMemory if memory could not be allocated,

   559        KErrArgument if there are problems with the aMessage object,

   560        KErrBadHandle if the thread represented by aMessage.Ptr0() is invalid,

   561        an error value from CSecuritySvrSession::ValidateMemoryInfo if checking

   562        the memory attributes failed,

   563        or another of the system wide error codes

   564 */

   565 void CSecuritySvrSession::WriteMemoryL(const RMessage2& aMessage)

   566 	{

   567 	LOG_MSG( "CSecuritySvrSession::WriteMemoryL()\n" );

   568 

   569 	//get debug app thread ID

   570 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   571 

   572 	CheckAttachedL(threadId, aMessage, EFalse);

   573 

   574 	//create and initialise the memory info object

   575 	TMemoryInfo targetMemory;

   576 	TPtr8 targetMemoryPtr( (TUint8 *)&targetMemory, sizeof(TMemoryInfo) );

   577 

   578 	aMessage.ReadL(1,targetMemoryPtr);

   579 

   580 	//check memory info is acceptable

   581 	ValidateMemoryInfoL(threadId, targetMemory, EFalse);

   582 

   583 	//create temporary buffer and read data from client

   584 	RBuf8 data;

   585 	data.CreateL(targetMemory.iSize);

   586 	data.CleanupClosePushL();

   587 	

   588 	aMessage.ReadL(2, data);

   589 

   590 	// what about telling the driver about endianess/access size?

   591 	User::LeaveIfError(Server().iKernelDriver.WriteMemory(threadId, targetMemory.iAddress, targetMemory.iSize, data));

   592 

   593 	//free temporary buffer

   594 	CleanupStack::PopAndDestroy(&data);

   595 

   596 	aMessage.Complete(KErrNone);

   597 	}

   598 

   599 /**

   600 @internalTechnology

   601 

   602 Notes: This call is used to set a thread specific breakpoint. Its input arguments

   603 are the thread id, address and architecture type of the breakpoint. It returns success

   604 or failure, and if successful, it sets the TBreakId in the Debug Agent to the 

   605 breakpoint id by which it can be referenced in future calls to ModifyBreak,ClearBreak and

   606 BreakInfo.

   607 

   608 @param aMessage.Ptr0() - aThreadId is thread id of the target debug process

   609 @param aMessage.Ptr1() - Address of a TBreakInfo in the Debug Agent

   610 @param aMessage.Ptr2() - Address of a TBreakId in the Debug Agent

   611 @leave KErrPermissionDenied if the security check fails.

   612  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   613  KErrNotSupported if the architecture type is unrecognised.

   614  KErrNoMemory if there is no more memory to complete the operation.

   615  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   616  breakpoint.

   617  KErrOverflow if there are too many breakpoints set.

   618 */

   619 void CSecuritySvrSession::SetBreakL(const RMessage2& aMessage)

   620 	{

   621 	LOG_MSG( "CSecuritySvrSession::SetBreakL!()\n" );

   622 

   623 	//get debug app thread ID

   624 	TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   625 

   626 	//check that the agent has attached to the target process

   627 	CheckAttachedL(threadId, aMessage, EFalse);

   628 

   629 	//create and initialise the break info object

   630 	TBreakInfo breakInfo;

   631 	TPtr8 breakInfoPtr( (TUint8 *)&breakInfo, sizeof(TBreakInfo) );

   632 

   633 	aMessage.ReadL(1,breakInfoPtr);

   634 

   635 	LOG_MSG4( "CSecuritySvrSession::SetBreakL, threadId=0x%lx, addr=0x%x, mode=%d", 

   636 			threadId.Id(), breakInfo.iAddress, breakInfo.iArchitectureMode);

   637 			

   638 	//set break in target app

   639 	TBreakId breakId = 0;

   640 	User::LeaveIfError(Server().iKernelDriver.SetBreak(breakId, threadId, breakInfo.iAddress, breakInfo.iArchitectureMode));

   641 

   642 	//attempt to write the break id back to the debug agent

   643 	WriteDataL(aMessage, 2, &breakId, sizeof(breakId));

   644 

   645 	aMessage.Complete(KErrNone);

   646 	}

   647 

   648 /**

   649 Clears a breakpoint previously set by a SetBreak() call.

   650 

   651 @param aMessage.Int0() - TBreakId of the breakpoint to be removed.

   652 */

   653 void CSecuritySvrSession::ClearBreakL(const RMessage2& aMessage)

   654 	{

   655 	LOG_MSG( "CSecuritySvrSession::ClearBreakL()\n" );

   656 

   657 	const TInt breakId = aMessage.Int0();

   658 

   659 	// Check that the breakpoint exists

   660 	TUint64 objectId;

   661 	TUint32 address;

   662 	TArchitectureMode mode;

   663 	TBool threadSpecific = EFalse;

   664 

   665 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,objectId,address,mode,threadSpecific));

   666 

   667 	if(threadSpecific)

   668 		{

   669 		// Check that the debug agent is attached to the thread for which the

   670 		// breakpoint is currently set.

   671 		LOG_MSG4( "CSecuritySvrSession::ClearBreakL( brkId=%d), addr=0x%x, tId=0x%x", 

   672 			breakId, address, I64LOW(objectId) );		

   673 		CheckAttachedL(TThreadId(objectId), aMessage, EFalse);		

   674 		}

   675 	else

   676 		{

   677 		// Check that the debug agent is attached to the process for which the

   678 		// breakpoint is currently set.

   679 		LOG_MSG4( "CSecuritySvrSession::ClearBreakL( brkId=%d), addr=0x%x, pId=0x%x", 

   680 			breakId, address, I64LOW(objectId) );		

   681 		CheckAttachedL(TProcessId(objectId), aMessage, EFalse);

   682 		}

   683 

   684 	// Finally clear the breakpoint

   685 	User::LeaveIfError(Server().iKernelDriver.ClearBreak(breakId));

   686 

   687 	aMessage.Complete(KErrNone);

   688 	}

   689 

   690 /**

   691 @param aMessage.Int0() - Breakpoint Id of interest

   692 @param aMessage.Ptr1() - Address in Debug Agent to place threadId of the breakpoint

   693 @param aMessage.Ptr2() - Address in Debug Agent to place address of the breakpoint

   694 @param aMessage.Ptr3() - Address in Debug Agent to place the architecture mode of the breakpoint

   695 @leave Any error which may be returned by RSessionBase::SendReceive()

   696 */

   697 void CSecuritySvrSession::BreakInfoL(const RMessage2& aMessage)

   698 	{

   699 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   700 

   701 	TThreadId threadId;

   702 	TUint32 address;

   703 	TArchitectureMode mode;

   704 	TBool threadSpecific = ETrue;

   705 

   706 	TUint64 threadIdData;

   707 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,threadIdData,address,mode,threadSpecific));

   708 

   709 	if(!threadSpecific)

   710 		{

   711 		User::Leave(KErrNotFound);

   712 		}

   713 

   714 	threadId = TThreadId(threadIdData);

   715 

   716 	//check that the agent has attached to the target process

   717 	CheckAttachedL(threadId, aMessage, EFalse);

   718 

   719 	// return the threadId

   720 	WriteDataL(aMessage, 1, &threadId, sizeof(threadId));

   721 

   722 	// return the address

   723 	WriteDataL(aMessage, 2, &address, sizeof(address));

   724 

   725 	// return the mode

   726 	WriteDataL(aMessage, 3, &mode, sizeof(mode));

   727 

   728 	aMessage.Complete(KErrNone);

   729 	}

   730 

   731 /**

   732 @internalTechnology

   733 

   734 Modify a previously set breakpoint.

   735 

   736 @param aMessage.Int0() - The breakpoint id of the breakpoint to modify

   737 @param aMessage.Ptr1() - The new Thread Id for the breakpoint

   738 @param aMessage.Int2() - The new virtual memory address for the breakpoint

   739 @param aMessage.Int3() - The new architecture mode for the breakpoint

   740 @return KErrNone if succesful. KErrPermissionDenied if the security check fails.

   741  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   742  KErrNotSupported if the architecture type is unrecognised.

   743  KErrNoMemory if there is no more memory to complete the operation.

   744  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   745  breakpoint.

   746  KErrOverflow if there are too many breakpoints set.

   747 */

   748 void CSecuritySvrSession::ModifyBreakL(const RMessage2& aMessage)

   749 	{

   750 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   751 	const TThreadId threadId = ReadTThreadIdL(aMessage, 1);

   752 	const TUint32 address = aMessage.Int2();

   753 	const TArchitectureMode mode = (TArchitectureMode)aMessage.Int3();

   754 

   755 	// Get information on the breakpoint to check the security status

   756 	TUint64 checkThreadId;

   757 	TUint32 checkAddress;

   758 	TArchitectureMode checkMode;

   759 	TBool threadSpecific;

   760 

   761 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,checkThreadId,checkAddress,checkMode,threadSpecific));

   762 

   763 	LOG_MSG4( "CSecuritySvrSession::ModifyBreakL(brkId=%d) tId=0x%x, addr=0x%x", 

   764 			breakId, I64LOW(threadId.Id()), address );

   765 			

   766 	// Security check that the thread Id is associated with the debug agent

   767 

   768 	//check that the agent has attached to the target process

   769 	CheckAttachedL(TThreadId(checkThreadId), aMessage, EFalse);

   770 

   771 	// now check that the thread Id which is being set is permitted

   772 	//check that the agent has attached to the target process

   773 	CheckAttachedL(threadId, aMessage, EFalse);

   774 

   775 	User::LeaveIfError(Server().iKernelDriver.ModifyBreak(breakId,threadId,address,mode));

   776 

   777 	aMessage.Complete(KErrNone);

   778 	}

   779 

   780 /**

   781 @internalTechnology

   782 

   783 Notes: This call is used to set a process wide breakpoint. Its input arguments

   784 are the process id, address and architecture type of the breakpoint. It returns success

   785 or failure, and if successful, it sets the TBreakId in the Debug Agent to the 

   786 breakpoint id by which it can be referenced in future calls to ModifyBreak,ClearBreak and

   787 BreakInfo.

   788 

   789 @param aMessage.Ptr0() - aProcessId is process id of the target debug process

   790 @param aMessage.Ptr1() - Address of a TBreakInfo in the Debug Agent

   791 @param aMessage.Ptr2() - Address of a TBreakId in the Debug Agent

   792 @leave KErrPermissionDenied if the security check fails.

   793  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   794  KErrNotSupported if the architecture type is unrecognised.

   795  KErrNoMemory if there is no more memory to complete the operation.

   796  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   797  breakpoint.

   798  KErrOverflow if there are too many breakpoints set.

   799 */

   800 void CSecuritySvrSession::SetProcessBreakL(const RMessage2& aMessage)

   801 	{

   802 	LOG_MSG( "CSecuritySvrSession::SetProcessBreakL()\n" );

   803 

   804 	//get debug app thread ID

   805 	TProcessId procId = ReadTProcessIdL(aMessage, 0);

   806 

   807 	//check that the agent has attached to the target process

   808 	CheckAttachedL(procId, aMessage, EFalse);

   809 

   810 	//create and initialise the memory info object

   811 	TBreakInfo breakInfo;

   812 	TPtr8 breakInfoPtr( (TUint8 *)&breakInfo, sizeof(TBreakInfo) );

   813 

   814 	aMessage.ReadL(1,breakInfoPtr);

   815 

   816 	LOG_MSG4( "CSecuritySvrSession::SetProcessBreakL pId=0x%x, addr=0x%x, mode=%d ", 

   817 			I64LOW(procId.Id()), breakInfo.iAddress, breakInfo.iArchitectureMode );

   818 

   819 	//set break in target app

   820 	TBreakId breakId = 0;

   821 	User::LeaveIfError(Server().iKernelDriver.SetProcessBreak(breakId, procId, breakInfo.iAddress, breakInfo.iArchitectureMode));

   822 

   823 	//attempt to write the break id back to the debug agent

   824 	WriteDataL(aMessage, 2, &breakId, sizeof(breakId));

   825 

   826 	aMessage.Complete(KErrNone);

   827 	}

   828 

   829 /**

   830 @internalTechnology

   831 

   832 Modify a previously set process breakpoint.

   833 

   834 @param aMessage.Int0() - The breakpoint id of the breakpoint to modify

   835 @param aMessage.Ptr1() - The new Process Id for the breakpoint

   836 @param aMessage.Int2() - The new virtual memory address for the breakpoint

   837 @param aMessage.Int3() - The new architecture mode for the breakpoint

   838 @return KErrNone if succesful. KErrPermissionDenied if the security check fails.

   839  KErrAlreadyExists if there is a breakpoint overlapping the desired address.

   840  KErrNotSupported if the architecture type is unrecognised.

   841  KErrNoMemory if there is no more memory to complete the operation.

   842  KErrArgument if the breakpoint address alignment is unsuitable for the requested

   843  breakpoint.

   844  KErrOverflow if there are too many breakpoints set.

   845 */

   846 void CSecuritySvrSession::ModifyProcessBreakL(const RMessage2& aMessage)

   847 	{

   848 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   849 	const TProcessId processId = ReadTProcessIdL(aMessage, 1);

   850 	const TUint32 address = aMessage.Int2();

   851 	const TArchitectureMode mode = (TArchitectureMode)aMessage.Int3();

   852 

   853 	// Get information on the breakpoint to check the security status

   854 	TUint64 checkProcessId;

   855 	TUint32 checkAddress;

   856 	TArchitectureMode checkMode;

   857 	TBool threadSpecific;

   858 

   859 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,checkProcessId,checkAddress,checkMode,threadSpecific));

   860 

   861 	LOG_MSG4( "CSecuritySvrSession::ModifyProcessBreakL(brkId=%d) pId=0x%x, addr=0x%x", 

   862 			breakId, I64LOW(processId.Id()), address );

   863 

   864 

   865 	// Security check that the process Id is associated with the debug agent

   866 

   867 	//check that the agent has attached to the target process

   868 	CheckAttachedL(TProcessId(checkProcessId), aMessage, EFalse);

   869 

   870 	// now check that the process Id which is being set is permitted

   871 	//check that the agent has attached to the target process

   872 	CheckAttachedL(processId, aMessage, EFalse);

   873 

   874 	User::LeaveIfError(Server().iKernelDriver.ModifyProcessBreak(breakId,processId,address,mode));

   875 

   876 	aMessage.Complete(KErrNone);

   877 	}

   878 

   879 /**

   880 @param aMessage.Int0() - Breakpoint Id of interest

   881 @param aMessage.Ptr1() - Address in Debug Agent to place process Id of the breakpoint

   882 @param aMessage.Ptr2() - Address in Debug Agent to place address of the breakpoint

   883 @param aMessage.Ptr3() - Address in Debug Agent to place the architecture mode of the breakpoint

   884 @leave Any error which may be returned by RSessionBase::SendReceive()

   885 */

   886 void CSecuritySvrSession::ProcessBreakInfoL(const RMessage2& aMessage)

   887 	{

   888 	const TBreakId breakId = (TBreakId)aMessage.Int0();

   889 

   890 	TProcessId procId;

   891 	TUint32 address;

   892 	TArchitectureMode mode;

   893 	TBool threadSpecific;

   894 

   895 	TUint64 procIdData;

   896 	User::LeaveIfError(Server().iKernelDriver.BreakInfo(breakId,procIdData,address,mode,threadSpecific));

   897 	if(threadSpecific)

   898 		{

   899 		User::Leave(KErrNotFound);

   900 		}

   901 	procId = TProcessId(procIdData);

   902 

   903 	//check that the agent has attached to the target process

   904 	CheckAttachedL(procId, aMessage, EFalse);

   905 

   906 	// return the processId

   907 	WriteDataL(aMessage, 1, &procId, sizeof(procId));

   908 

   909 	// return the address

   910 	WriteDataL(aMessage, 2, &address, sizeof(address));

   911 

   912 	// return the mode

   913 	WriteDataL(aMessage, 3, &mode, sizeof(mode));

   914 

   915 	aMessage.Complete(KErrNone);

   916 	}

   917 

   918 /**

   919 Read register values.

   920 

   921 @param aMessage should contain:

   922         * at offset 0 a pointer to the thread ID of the target thread

   923         * at offset 1 a descriptor representing an array of TRegisterInfo 

   924           register IDs

   925         * at offset 2 a descriptor representing an array into which TRegister 

   926           register values will be written

   927         * at offset 3 a descriptor representing an array into which TUint8 

   928           register flags will be written

   929 

   930 @leave KErrArgument if the max length of the array at offset 1 is not a 

   931        multiple of sizeof(TRegisterInfo), if the max length of the array 

   932        at offset 2 is not a multiple of sizeof(TRegister), if the max 

   933        length of the array at offset 3 is not a multiple of sizeof(TUint8), if

   934        any of the descriptors have max length of 0, or if the three 

   935        descriptors do not represent the same number of registers,

   936        KErrNoMemory if there is insufficient memory,

   937        KErrDied, if the thread with thread ID aThreadId is dead

   938 */

   939 void CSecuritySvrSession::ReadRegistersL(const RMessage2& aMessage)

   940 	{

   941 	LOG_MSG( "CSecuritySvrSession::ReadRegistersL()\n" );

   942 

   943 	const TThreadId threadId = ReadTThreadIdL(aMessage, 0);

   944 

   945 	//check the agent is attached to the thread

   946 	CheckAttachedL(threadId, aMessage, ETrue);

   947 

   948 	//number of registers being requested

   949 	TUint32 numberOfRegisters;

   950 

   951 	//check length of descriptors is acceptable

   952 	ValidateRegisterBuffersL(aMessage, numberOfRegisters);

   953 

   954 	// Passed data will be saved in this descriptor.

   955 	RBuf8 ids;

   956 	ids.CreateL(numberOfRegisters * sizeof(TRegisterInfo));

   957 	// Do the right cleanup if anything subsequently goes wrong

   958 	ids.CleanupClosePushL();

   959 	

   960 	//read the data from the client thread

   961 	aMessage.ReadL(1, ids);

   962 

   963 	//create buffer to fill with data from target debug thread

   964 	HBufC8 *data = HBufC8::NewLC(aMessage.GetDesMaxLength(2));

   965 	TPtr8 values(data->Des());   

   966 	

   967 	HBufC8 *flagsData = HBufC8::NewLC(numberOfRegisters * sizeof(TUint8));

   968 	TPtr8 flags(flagsData->Des());   

   969 	

   970 	//get register info and return relevant parts back to agent

   971 	User::LeaveIfError(Server().iKernelDriver.ReadRegisters(threadId, ids, values, flags));

   972 	aMessage.WriteL(2, values);

   973 	aMessage.WriteL(3, flags);

   974 	

   975 	//delete temporary buffers and return status

   976 	CleanupStack::PopAndDestroy(flagsData);

   977 	CleanupStack::PopAndDestroy(data);

   978 	CleanupStack::PopAndDestroy(&ids);

   979 

   980 	aMessage.Complete(KErrNone);

   981 	}

   982 

   983 /**

   984 Write register values.

   985 

   986 @param aMessage should contain:

   987         * at offset 0 a pointer to the thread ID of the target thread

   988         * at offset 1 a descriptor representing an array of TRegisterInfo 

   989           register IDs

   990         * at offset 2 a descriptor representing an array of TRegister register 

   991           values

   992         * at offset 3 a descriptor representing an array into which TUint8 

   993           register flags will be written

   994 

   995 @leave KErrArgument if the max length of the array at offset 1 is not a 

   996        multiple of sizeof(TRegisterInfo), if the max length of the array 

   997        at offset 2 is not a multiple of sizeof(TRegister), if the max 

   998        length of the array at offset 3 is not a multiple of sizeof(TUint8), if

   999        any of the descriptors have max length of 0, or if the three 

  1000        descriptors do not represent the same number of registers,

  1001        KErrNoMemory if there is insufficient memory,

  1002        KErrDied, if the thread with thread ID aThreadId is dead

  1003 */

  1004 void CSecuritySvrSession::WriteRegistersL(const RMessage2& aMessage)

  1005 	{

  1006 	LOG_MSG( "CSecuritySvrSession::WriteRegistersL()\n" );

  1007 

  1008 	const TThreadId threadId = ReadTThreadIdL(aMessage, 0);

  1009 

  1010 	CheckAttachedL(threadId, aMessage, EFalse);

  1011 

  1012 	//number of registers attempting to set

  1013 	TUint32 numberOfRegisters;

  1014 

  1015 	//check length of descriptors is acceptable

  1016 	ValidateRegisterBuffersL(aMessage, numberOfRegisters);

  1017 

  1018 	// Passed register ids will be saved in this descriptor.

  1019 	RBuf8 ids;

  1020 

  1021 	//allocate buffer

  1022 	ids.CreateL(numberOfRegisters * sizeof(TRegisterInfo));

  1023 

  1024 	// Do the right cleanup if anything subsequently goes wrong

  1025 	ids.CleanupClosePushL();

  1026 

  1027 	//read the data from the client thread

  1028 	aMessage.ReadL(1, ids);

  1029 

  1030 	// Passed register values will be saved in this descriptor.

  1031 	RBuf8 values;

  1032 

  1033 	//allocate buffer

  1034 	values.CreateL(aMessage.GetDesMaxLength(2));

  1035 	// Do the right cleanup if anything subsequently goes wrong

  1036 	values.CleanupClosePushL();

  1037 	//read the data from the client thread

  1038 	aMessage.ReadL(2,values);

  1039 

  1040 	HBufC8 *flagsData = HBufC8::NewLC(numberOfRegisters*sizeof(TUint8));

  1041 	TPtr8 flags(flagsData->Des());

  1042 

  1043 	//get register info and return relevant parts back to agent

  1044 	User::LeaveIfError(Server().iKernelDriver.WriteRegisters(threadId, ids, values, flags));

  1045 

  1046 	//write flags data back

  1047 	aMessage.WriteL(3, flags);

  1048 

  1049 	CleanupStack::PopAndDestroy(flagsData);

  1050 	CleanupStack::PopAndDestroy(&values);

  1051 	CleanupStack::PopAndDestroy(&ids);

  1052 

  1053 	aMessage.Complete(KErrNone);

  1054 	}

  1055 

  1056 /**

  1057 Processes an attach request from a debug agent. Gets the target debug

  1058 processes' original FileName as an argument. The method sets completion

  1059 status of the aMessage argument to KErrNone if successfully attached and to

  1060 another of the system wide error codes if there were problems.

  1061 

  1062 @param aMessage contains:

  1063        * a boolean at offset 0 which indicates whether the agent wishes to

  1064        attach passively

  1065        * a buffer at offset 1 which contains the FileName

  1066        of the target debug process.

  1067 */

  1068 void CSecuritySvrSession::AttachProcessL(const RMessage2& aMessage)

  1069 	{

  1070 	LOG_MSG( "CSecuritySvrSession::AttachProcessL()\n" );

  1071 

  1072 	const TBool passive = aMessage.Int0();

  1073 

  1074 	TInt deslen = aMessage.GetDesLengthL(1);

  1075 

  1076 	// Passed data will be saved in this descriptor.

  1077 	RBuf processName;

  1078 

  1079 	// Max length set to the value of "deslen", but current length is zero

  1080 	processName.CreateL(deslen);

  1081 

  1082 	// Do the right cleanup if anything subsequently goes wrong

  1083 	processName.CleanupClosePushL();

  1084 

  1085 	// Copy the client's descriptor data into our buffer.

  1086 	aMessage.ReadL(1,processName);

  1087 

  1088 	//

  1089 	// Security Check

  1090 	//

  1091 	// It is not permitted to debug the debug security server!

  1092 	//

  1093 	// get the secure id of the executable

  1094 	TUid secureId(TUid::Null());

  1095 	GetSecureIdL(processName, secureId);

  1096 	if (KUidDebugSecurityServer.iUid == secureId.iUid)

  1097 		{

  1098 		// The debug agent has requested to debug the Debug Security Server

  1099 		// This is either an error, or an attempt to breach security. We

  1100 		// therefore refuse to agree to this request, and return KErrPermissionDenied

  1101 		LOG_MSG("Debug Agent attempted to debug the Debug Security Server");

  1102 		User::Leave(KErrPermissionDenied);

  1103 		}

  1104 

  1105 	// Check the OEM Debug token capabilities 

  1106 	GetDebugAgentOEMTokenCapsL();

  1107 	

  1108 	// Get the Security info via rlibrary::getinfo

  1109 	RLibrary::TInfo info;

  1110 	TPckg<RLibrary::TInfo> infoBuf(info);

  1111 

  1112 	TInt err = RLibrary::GetInfo(processName, infoBuf);

  1113 	if (err != KErrNone)

  1114 		{

  1115 		LOG_MSG2("Cannot parse the target executable header, err=%d", err);

  1116 		// Could not read the header for this executable :-(

  1117 		CleanupStack::PopAndDestroy(&processName);

  1118 		aMessage.Complete(err);

  1119 		return;

  1120 		}

  1121 	

  1122 	// Special case for AllFiles - OEM Debug tokens MUST have

  1123 	// AllFiles, as this is what allows them to read contents

  1124 	// of other executables.

  1125 	TBool checkDebuggable = ETrue;

  1126 

  1127 	// Does an OEM Debug Token permit debug where it would normally not be

  1128 	// permitted?

  1129 	if ( Server().OEMTokenPermitsDebugL(iOEMDebugCapabilities, info.iSecurityInfo.iCaps) )

  1130 		{

  1131 		// OEM Debug token is valid and has sufficient capabilities

  1132 		LOG_MSG("CSecuritySvrSession::AttachProcessL() - Debug Agent has sufficient capabilites based on OEM Debug Token");	

  1133 		

  1134 		checkDebuggable = EFalse;