2 * Copyright 1997 Sean Eric Fagan
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 * 3. All advertising materials mentioning features or use of this software
13 * must display the following acknowledgement:
14 * This product includes software developed by Sean Eric Fagan
15 * 4. Neither the name of the author may be used to endorse or promote
16 * products derived from this software without specific prior written
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
36 * Various setup functions for truss. Not the cleanest-written code,
40 #include <sys/ptrace.h>
41 #include <sys/sysctl.h>
52 #include <sysdecode.h>
60 SET_DECLARE(procabi, struct procabi);
62 static sig_atomic_t detaching;
64 static void enter_syscall(struct trussinfo *, struct threadinfo *,
65 struct ptrace_lwpinfo *);
66 static void new_proc(struct trussinfo *, pid_t, lwpid_t);
69 * setup_and_wait() is called to start a process. All it really does
70 * is fork(), enable tracing in the child, and then exec the given
71 * command. At that point, the child process stops, and the parent
72 * can wake up and deal with it.
75 setup_and_wait(struct trussinfo *info, char *command[])
81 err(1, "fork failed");
82 if (pid == 0) { /* Child */
83 ptrace(PT_TRACE_ME, 0, 0, 0);
84 execvp(command[0], command);
85 err(1, "execvp %s", command[0]);
88 /* Only in the parent here */
89 if (waitpid(pid, NULL, 0) < 0)
90 err(1, "unexpect stop in waitpid");
92 new_proc(info, pid, 0);
96 * start_tracing is called to attach to an existing process.
99 start_tracing(struct trussinfo *info, pid_t pid)
105 ret = ptrace(PT_ATTACH, pid, NULL, 0);
107 } while (ret && retry-- > 0);
109 err(1, "can not attach to target process");
111 if (waitpid(pid, NULL, 0) < 0)
112 err(1, "Unexpect stop in waitpid");
114 new_proc(info, pid, 0);
118 * Restore a process back to it's pre-truss state.
119 * Called for SIGINT, SIGTERM, SIGQUIT. This only
120 * applies if truss was told to monitor an already-existing
124 restore_proc(int signo __unused)
131 detach_proc(pid_t pid)
134 /* stop the child so that we can detach */
136 if (waitpid(pid, NULL, 0) < 0)
137 err(1, "Unexpected stop in waitpid");
139 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
140 err(1, "Can not detach the process");
146 * Determine the ABI. This is called after every exec, and when
147 * a process is first monitored.
149 static struct procabi *
152 struct procabi **pabi;
161 mib[2] = KERN_PROC_SV_NAME;
163 error = sysctl(mib, 4, progt, &len, NULL, 0);
165 err(2, "can not get sysvec name");
167 SET_FOREACH(pabi, procabi) {
168 if (strcmp((*pabi)->type, progt) == 0)
171 warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
175 static struct threadinfo *
176 new_thread(struct procinfo *p, lwpid_t lwpid)
178 struct threadinfo *nt;
181 * If this happens it means there is a bug in truss. Unfortunately
182 * this will kill any processes truss is attached to.
184 LIST_FOREACH(nt, &p->threadlist, entries) {
185 if (nt->tid == lwpid)
186 errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
189 nt = calloc(1, sizeof(struct threadinfo));
191 err(1, "calloc() failed");
194 LIST_INSERT_HEAD(&p->threadlist, nt, entries);
199 free_thread(struct threadinfo *t)
202 LIST_REMOVE(t, entries);
207 add_threads(struct trussinfo *info, struct procinfo *p)
209 struct ptrace_lwpinfo pl;
210 struct threadinfo *t;
214 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
216 err(1, "Unable to fetch number of LWPs");
218 lwps = calloc(nlwps, sizeof(*lwps));
219 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
221 err(1, "Unable to fetch LWP list");
222 for (i = 0; i < nlwps; i++) {
223 t = new_thread(p, lwps[i]);
224 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
225 err(1, "ptrace(PT_LWPINFO)");
226 if (pl.pl_flags & PL_FLAG_SCE)
227 enter_syscall(info, t, &pl);
233 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
238 * If this happens it means there is a bug in truss. Unfortunately
239 * this will kill any processes truss is attached to.
241 LIST_FOREACH(np, &info->proclist, entries) {
243 errx(1, "Duplicate process for pid %ld", (long)pid);
246 if (info->flags & FOLLOWFORKS)
247 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
248 err(1, "Unable to follow forks for pid %ld", (long)pid);
249 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
250 err(1, "Unable to enable LWP events for pid %ld", (long)pid);
251 np = calloc(1, sizeof(struct procinfo));
253 np->abi = find_abi(pid);
254 LIST_INIT(&np->threadlist);
255 LIST_INSERT_HEAD(&info->proclist, np, entries);
258 new_thread(np, lwpid);
260 add_threads(info, np);
264 free_proc(struct procinfo *p)
266 struct threadinfo *t, *t2;
268 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
271 LIST_REMOVE(p, entries);
276 detach_all_procs(struct trussinfo *info)
278 struct procinfo *p, *p2;
280 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
286 static struct procinfo *
287 find_proc(struct trussinfo *info, pid_t pid)
291 LIST_FOREACH(np, &info->proclist, entries) {
300 * Change curthread member based on (pid, lwpid).
303 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
306 struct threadinfo *nt;
308 np = find_proc(info, pid);
311 LIST_FOREACH(nt, &np->threadlist, entries) {
312 if (nt->tid == lwpid) {
313 info->curthread = nt;
317 errx(1, "could not find thread");
321 * When a process exits, it should have exactly one thread left.
322 * All of the other threads should have reported thread exit events.
325 find_exit_thread(struct trussinfo *info, pid_t pid)
329 p = find_proc(info, pid);
332 info->curthread = LIST_FIRST(&p->threadlist);
333 assert(info->curthread != NULL);
334 assert(LIST_NEXT(info->curthread, entries) == NULL);
338 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
342 assert(t->in_syscall == 0);
343 assert(t->cs.number == 0);
344 assert(t->cs.name == NULL);
345 assert(t->cs.nargs == 0);
346 for (i = 0; i < nitems(t->cs.s_args); i++)
347 assert(t->cs.s_args[i] == NULL);
348 memset(t->cs.args, 0, sizeof(t->cs.args));
349 t->cs.number = pl->pl_syscall_code;
354 free_syscall(struct threadinfo *t)
358 for (i = 0; i < t->cs.nargs; i++)
359 free(t->cs.s_args[i]);
360 memset(&t->cs, 0, sizeof(t->cs));
365 enter_syscall(struct trussinfo *info, struct threadinfo *t,
366 struct ptrace_lwpinfo *pl)
371 alloc_syscall(t, pl);
372 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
373 if (narg != 0 && t->proc->abi->fetch_args(info, narg) != 0) {
378 t->cs.name = sysdecode_syscallname(t->proc->abi->abi, t->cs.number);
379 if (t->cs.name == NULL)
380 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
381 t->proc->abi->type, t->cs.number);
383 sc = get_syscall(t->cs.name, narg);
384 t->cs.nargs = sc->nargs;
385 assert(sc->nargs <= nitems(t->cs.s_args));
390 * At this point, we set up the system call arguments.
391 * We ignore any OUT ones, however -- those are arguments that
392 * are set by the system call, and so are probably meaningless
393 * now. This doesn't currently support arguments that are
394 * passed in *and* out, however.
396 if (t->cs.name != NULL) {
398 fprintf(stderr, "syscall %s(", t->cs.name);
400 for (i = 0; i < t->cs.nargs; i++) {
402 fprintf(stderr, "0x%lx%s", sc ?
403 t->cs.args[sc->args[i].offset] : t->cs.args[i],
404 i < (t->cs.nargs - 1) ? "," : "");
406 if (!(sc->args[i].type & OUT)) {
407 t->cs.s_args[i] = print_arg(&sc->args[i],
408 t->cs.args, 0, info);
412 fprintf(stderr, ")\n");
416 clock_gettime(CLOCK_REALTIME, &t->before);
420 * When a thread exits voluntarily (including when a thread calls
421 * exit() to trigger a process exit), the thread's internal state
422 * holds the arguments passed to the exit system call. When the
423 * thread's exit is reported, log that system call without a return
427 thread_exit_syscall(struct trussinfo *info)
429 struct threadinfo *t;
435 clock_gettime(CLOCK_REALTIME, &t->after);
437 print_syscall_ret(info, 0, NULL);
442 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
444 struct threadinfo *t;
455 clock_gettime(CLOCK_REALTIME, &t->after);
457 if (p->abi->fetch_retval(info, retval, &errorp) < 0) {
464 * Here, we only look for arguments that have OUT masked in --
465 * otherwise, they were handled in enter_syscall().
467 for (i = 0; i < sc->nargs; i++) {
470 if (sc->args[i].type & OUT) {
472 * If an error occurred, then don't bother
473 * getting the data; it may not be valid.
476 asprintf(&temp, "0x%lx",
477 t->cs.args[sc->args[i].offset]);
479 temp = print_arg(&sc->args[i],
480 t->cs.args, retval, info);
482 t->cs.s_args[i] = temp;
486 print_syscall_ret(info, errorp, retval);
490 * If the process executed a new image, check the ABI. If the
491 * new ABI isn't supported, stop tracing this process.
493 if (pl->pl_flags & PL_FLAG_EXEC) {
494 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
495 p->abi = find_abi(p->pid);
496 if (p->abi == NULL) {
497 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
498 err(1, "Can not detach the process");
505 print_line_prefix(struct trussinfo *info)
507 struct timespec timediff;
508 struct threadinfo *t;
513 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
514 if (info->flags & FOLLOWFORKS)
515 len += fprintf(info->outfile, "%5d", t->proc->pid);
516 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
517 (FOLLOWFORKS | DISPLAYTIDS))
518 len += fprintf(info->outfile, " ");
519 if (info->flags & DISPLAYTIDS)
520 len += fprintf(info->outfile, "%6d", t->tid);
521 len += fprintf(info->outfile, ": ");
523 if (info->flags & ABSOLUTETIMESTAMPS) {
524 timespecsubt(&t->after, &info->start_time, &timediff);
525 len += fprintf(info->outfile, "%jd.%09ld ",
526 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
528 if (info->flags & RELATIVETIMESTAMPS) {
529 timespecsubt(&t->after, &t->before, &timediff);
530 len += fprintf(info->outfile, "%jd.%09ld ",
531 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
537 report_thread_death(struct trussinfo *info)
539 struct threadinfo *t;
542 clock_gettime(CLOCK_REALTIME, &t->after);
543 print_line_prefix(info);
544 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
548 report_thread_birth(struct trussinfo *info)
550 struct threadinfo *t;
553 clock_gettime(CLOCK_REALTIME, &t->after);
554 t->before = t->after;
555 print_line_prefix(info);
556 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
560 report_exit(struct trussinfo *info, siginfo_t *si)
562 struct threadinfo *t;
565 clock_gettime(CLOCK_REALTIME, &t->after);
566 print_line_prefix(info);
567 if (si->si_code == CLD_EXITED)
568 fprintf(info->outfile, "process exit, rval = %u\n",
571 fprintf(info->outfile, "process killed, signal = %u%s\n",
572 si->si_status, si->si_code == CLD_DUMPED ?
573 " (core dumped)" : "");
577 report_new_child(struct trussinfo *info)
579 struct threadinfo *t;
582 clock_gettime(CLOCK_REALTIME, &t->after);
583 t->before = t->after;
584 print_line_prefix(info);
585 fprintf(info->outfile, "<new process>\n");
589 report_signal(struct trussinfo *info, siginfo_t *si)
591 struct threadinfo *t;
595 clock_gettime(CLOCK_REALTIME, &t->after);
596 print_line_prefix(info);
597 signame = strsig(si->si_status);
598 fprintf(info->outfile, "SIGNAL %u (%s)\n", si->si_status,
599 signame == NULL ? "?" : signame);
603 * Wait for events until all the processes have exited or truss has been
607 eventloop(struct trussinfo *info)
609 struct ptrace_lwpinfo pl;
613 while (!LIST_EMPTY(&info->proclist)) {
615 detach_all_procs(info);
619 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
622 err(1, "Unexpected error from waitid");
625 assert(si.si_signo == SIGCHLD);
627 switch (si.si_code) {
631 find_exit_thread(info, si.si_pid);
632 if ((info->flags & COUNTONLY) == 0) {
633 if (si.si_code == CLD_EXITED)
634 thread_exit_syscall(info);
635 report_exit(info, &si);
637 free_proc(info->curthread->proc);
638 info->curthread = NULL;
641 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
643 err(1, "ptrace(PT_LWPINFO)");
645 if (pl.pl_flags & PL_FLAG_CHILD) {
646 new_proc(info, si.si_pid, pl.pl_lwpid);
647 assert(LIST_FIRST(&info->proclist)->abi !=
649 } else if (pl.pl_flags & PL_FLAG_BORN)
650 new_thread(find_proc(info, si.si_pid),
652 find_thread(info, si.si_pid, pl.pl_lwpid);
654 if (si.si_status == SIGTRAP &&
655 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
656 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
657 if (pl.pl_flags & PL_FLAG_BORN) {
658 if ((info->flags & COUNTONLY) == 0)
659 report_thread_birth(info);
660 } else if (pl.pl_flags & PL_FLAG_EXITED) {
661 if ((info->flags & COUNTONLY) == 0)
662 report_thread_death(info);
663 free_thread(info->curthread);
664 info->curthread = NULL;
665 } else if (pl.pl_flags & PL_FLAG_SCE)
666 enter_syscall(info, info->curthread, &pl);
667 else if (pl.pl_flags & PL_FLAG_SCX)
668 exit_syscall(info, &pl);
670 } else if (pl.pl_flags & PL_FLAG_CHILD) {
671 if ((info->flags & COUNTONLY) == 0)
672 report_new_child(info);
675 if ((info->flags & NOSIGS) == 0)
676 report_signal(info, &si);
677 pending_signal = si.si_status;
679 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
683 errx(1, "waitid reported CLD_STOPPED");