2 * SPDX-License-Identifier: BSD-4-Clause
4 * Copyright 1997 Sean Eric Fagan
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Sean Eric Fagan
17 * 4. Neither the name of the author may be used to endorse or promote
18 * products derived from this software without specific prior written
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
38 * Various setup functions for truss. Not the cleanest-written code,
42 #include <sys/ptrace.h>
43 #include <sys/sysctl.h>
56 #include <sysdecode.h>
64 struct procabi_table {
69 static sig_atomic_t detaching;
71 static void enter_syscall(struct trussinfo *, struct threadinfo *,
72 struct ptrace_lwpinfo *);
73 static void new_proc(struct trussinfo *, pid_t, lwpid_t);
76 static struct procabi cloudabi32 = {
78 SYSDECODE_ABI_CLOUDABI32,
79 STAILQ_HEAD_INITIALIZER(cloudabi32.extra_syscalls),
83 static struct procabi cloudabi64 = {
85 SYSDECODE_ABI_CLOUDABI64,
86 STAILQ_HEAD_INITIALIZER(cloudabi64.extra_syscalls),
90 static struct procabi freebsd = {
92 SYSDECODE_ABI_FREEBSD,
93 STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls),
98 static struct procabi freebsd32 = {
100 SYSDECODE_ABI_FREEBSD32,
101 STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls),
106 static struct procabi linux = {
109 STAILQ_HEAD_INITIALIZER(linux.extra_syscalls),
114 static struct procabi linux32 = {
116 SYSDECODE_ABI_LINUX32,
117 STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls),
122 static struct procabi_table abis[] = {
123 { "CloudABI ELF32", &cloudabi32 },
124 { "CloudABI ELF64", &cloudabi64 },
126 { "FreeBSD ELF64", &freebsd },
127 { "FreeBSD ELF32", &freebsd32 },
129 { "FreeBSD ELF32", &freebsd },
131 #if defined(__powerpc64__)
132 { "FreeBSD ELF64 V2", &freebsd },
134 #if defined(__amd64__)
135 { "FreeBSD a.out", &freebsd32 },
137 #if defined(__i386__)
138 { "FreeBSD a.out", &freebsd },
141 { "Linux ELF64", &linux },
142 { "Linux ELF32", &linux32 },
144 { "Linux ELF", &linux },
149 * setup_and_wait() is called to start a process. All it really does
150 * is fork(), enable tracing in the child, and then exec the given
151 * command. At that point, the child process stops, and the parent
152 * can wake up and deal with it.
155 setup_and_wait(struct trussinfo *info, char *command[])
161 err(1, "fork failed");
162 if (pid == 0) { /* Child */
163 ptrace(PT_TRACE_ME, 0, 0, 0);
164 execvp(command[0], command);
165 err(1, "execvp %s", command[0]);
168 /* Only in the parent here */
169 if (waitpid(pid, NULL, 0) < 0)
170 err(1, "unexpect stop in waitpid");
172 new_proc(info, pid, 0);
176 * start_tracing is called to attach to an existing process.
179 start_tracing(struct trussinfo *info, pid_t pid)
185 ret = ptrace(PT_ATTACH, pid, NULL, 0);
187 } while (ret && retry-- > 0);
189 err(1, "can not attach to target process");
191 if (waitpid(pid, NULL, 0) < 0)
192 err(1, "Unexpect stop in waitpid");
194 new_proc(info, pid, 0);
198 * Restore a process back to it's pre-truss state.
199 * Called for SIGINT, SIGTERM, SIGQUIT. This only
200 * applies if truss was told to monitor an already-existing
204 restore_proc(int signo __unused)
211 detach_proc(pid_t pid)
214 /* stop the child so that we can detach */
216 if (waitpid(pid, NULL, 0) < 0)
217 err(1, "Unexpected stop in waitpid");
219 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
220 err(1, "Can not detach the process");
226 * Determine the ABI. This is called after every exec, and when
227 * a process is first monitored.
229 static struct procabi *
241 mib[2] = KERN_PROC_SV_NAME;
243 error = sysctl(mib, 4, progt, &len, NULL, 0);
245 err(2, "can not get sysvec name");
247 for (i = 0; i < nitems(abis); i++) {
248 if (strcmp(abis[i].name, progt) == 0)
249 return (abis[i].abi);
251 warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
255 static struct threadinfo *
256 new_thread(struct procinfo *p, lwpid_t lwpid)
258 struct threadinfo *nt;
261 * If this happens it means there is a bug in truss. Unfortunately
262 * this will kill any processes truss is attached to.
264 LIST_FOREACH(nt, &p->threadlist, entries) {
265 if (nt->tid == lwpid)
266 errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
269 nt = calloc(1, sizeof(struct threadinfo));
271 err(1, "calloc() failed");
274 LIST_INSERT_HEAD(&p->threadlist, nt, entries);
279 free_thread(struct threadinfo *t)
282 LIST_REMOVE(t, entries);
287 add_threads(struct trussinfo *info, struct procinfo *p)
289 struct ptrace_lwpinfo pl;
290 struct threadinfo *t;
294 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
296 err(1, "Unable to fetch number of LWPs");
298 lwps = calloc(nlwps, sizeof(*lwps));
299 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
301 err(1, "Unable to fetch LWP list");
302 for (i = 0; i < nlwps; i++) {
303 t = new_thread(p, lwps[i]);
304 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
305 err(1, "ptrace(PT_LWPINFO)");
306 if (pl.pl_flags & PL_FLAG_SCE) {
308 enter_syscall(info, t, &pl);
315 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
320 * If this happens it means there is a bug in truss. Unfortunately
321 * this will kill any processes truss is attached to.
323 LIST_FOREACH(np, &info->proclist, entries) {
325 errx(1, "Duplicate process for pid %ld", (long)pid);
328 if (info->flags & FOLLOWFORKS)
329 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
330 err(1, "Unable to follow forks for pid %ld", (long)pid);
331 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
332 err(1, "Unable to enable LWP events for pid %ld", (long)pid);
333 np = calloc(1, sizeof(struct procinfo));
335 np->abi = find_abi(pid);
336 LIST_INIT(&np->threadlist);
337 LIST_INSERT_HEAD(&info->proclist, np, entries);
340 new_thread(np, lwpid);
342 add_threads(info, np);
346 free_proc(struct procinfo *p)
348 struct threadinfo *t, *t2;
350 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
353 LIST_REMOVE(p, entries);
358 detach_all_procs(struct trussinfo *info)
360 struct procinfo *p, *p2;
362 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
368 static struct procinfo *
369 find_proc(struct trussinfo *info, pid_t pid)
373 LIST_FOREACH(np, &info->proclist, entries) {
382 * Change curthread member based on (pid, lwpid).
385 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
388 struct threadinfo *nt;
390 np = find_proc(info, pid);
393 LIST_FOREACH(nt, &np->threadlist, entries) {
394 if (nt->tid == lwpid) {
395 info->curthread = nt;
399 errx(1, "could not find thread");
403 * When a process exits, it should have exactly one thread left.
404 * All of the other threads should have reported thread exit events.
407 find_exit_thread(struct trussinfo *info, pid_t pid)
411 p = find_proc(info, pid);
414 info->curthread = LIST_FIRST(&p->threadlist);
415 assert(info->curthread != NULL);
416 assert(LIST_NEXT(info->curthread, entries) == NULL);
420 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
424 assert(t->in_syscall == 0);
425 assert(t->cs.number == 0);
426 assert(t->cs.sc == NULL);
427 assert(t->cs.nargs == 0);
428 for (i = 0; i < nitems(t->cs.s_args); i++)
429 assert(t->cs.s_args[i] == NULL);
430 memset(t->cs.args, 0, sizeof(t->cs.args));
431 t->cs.number = pl->pl_syscall_code;
436 free_syscall(struct threadinfo *t)
440 for (i = 0; i < t->cs.nargs; i++)
441 free(t->cs.s_args[i]);
442 memset(&t->cs, 0, sizeof(t->cs));
447 enter_syscall(struct trussinfo *info, struct threadinfo *t,
448 struct ptrace_lwpinfo *pl)
453 alloc_syscall(t, pl);
454 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
455 if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args,
456 sizeof(t->cs.args)) != 0) {
461 sc = get_syscall(t, t->cs.number, narg);
463 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
464 t->proc->abi->type, t->cs.number);
466 t->cs.nargs = sc->nargs;
467 assert(sc->nargs <= nitems(t->cs.s_args));
472 * At this point, we set up the system call arguments.
473 * We ignore any OUT ones, however -- those are arguments that
474 * are set by the system call, and so are probably meaningless
475 * now. This doesn't currently support arguments that are
476 * passed in *and* out, however.
479 fprintf(stderr, "syscall %s(", sc->name);
481 for (i = 0; i < t->cs.nargs; i++) {
483 fprintf(stderr, "0x%lx%s", t->cs.args[sc->args[i].offset],
484 i < (t->cs.nargs - 1) ? "," : "");
486 if (!(sc->args[i].type & OUT)) {
487 t->cs.s_args[i] = print_arg(&sc->args[i],
488 t->cs.args, NULL, info);
492 fprintf(stderr, ")\n");
495 clock_gettime(CLOCK_REALTIME, &t->before);
499 * When a thread exits voluntarily (including when a thread calls
500 * exit() to trigger a process exit), the thread's internal state
501 * holds the arguments passed to the exit system call. When the
502 * thread's exit is reported, log that system call without a return
506 thread_exit_syscall(struct trussinfo *info)
508 struct threadinfo *t;
514 clock_gettime(CLOCK_REALTIME, &t->after);
516 print_syscall_ret(info, 0, NULL);
521 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
523 struct threadinfo *t;
526 struct ptrace_sc_ret psr;
533 clock_gettime(CLOCK_REALTIME, &t->after);
535 if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) {
542 * Here, we only look for arguments that have OUT masked in --
543 * otherwise, they were handled in enter_syscall().
545 for (i = 0; i < sc->nargs; i++) {
548 if (sc->args[i].type & OUT) {
550 * If an error occurred, then don't bother
551 * getting the data; it may not be valid.
553 if (psr.sr_error != 0) {
554 asprintf(&temp, "0x%lx",
555 t->cs.args[sc->args[i].offset]);
557 temp = print_arg(&sc->args[i],
558 t->cs.args, psr.sr_retval, info);
560 t->cs.s_args[i] = temp;
564 print_syscall_ret(info, psr.sr_error, psr.sr_retval);
568 * If the process executed a new image, check the ABI. If the
569 * new ABI isn't supported, stop tracing this process.
571 if (pl->pl_flags & PL_FLAG_EXEC) {
572 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
573 p->abi = find_abi(p->pid);
574 if (p->abi == NULL) {
575 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
576 err(1, "Can not detach the process");
583 print_line_prefix(struct trussinfo *info)
585 struct timespec timediff;
586 struct threadinfo *t;
591 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
592 if (info->flags & FOLLOWFORKS)
593 len += fprintf(info->outfile, "%5d", t->proc->pid);
594 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
595 (FOLLOWFORKS | DISPLAYTIDS))
596 len += fprintf(info->outfile, " ");
597 if (info->flags & DISPLAYTIDS)
598 len += fprintf(info->outfile, "%6d", t->tid);
599 len += fprintf(info->outfile, ": ");
601 if (info->flags & ABSOLUTETIMESTAMPS) {
602 timespecsub(&t->after, &info->start_time, &timediff);
603 len += fprintf(info->outfile, "%jd.%09ld ",
604 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
606 if (info->flags & RELATIVETIMESTAMPS) {
607 timespecsub(&t->after, &t->before, &timediff);
608 len += fprintf(info->outfile, "%jd.%09ld ",
609 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
615 report_thread_death(struct trussinfo *info)
617 struct threadinfo *t;
620 clock_gettime(CLOCK_REALTIME, &t->after);
621 print_line_prefix(info);
622 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
626 report_thread_birth(struct trussinfo *info)
628 struct threadinfo *t;
631 clock_gettime(CLOCK_REALTIME, &t->after);
632 t->before = t->after;
633 print_line_prefix(info);
634 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
638 report_exit(struct trussinfo *info, siginfo_t *si)
640 struct threadinfo *t;
643 clock_gettime(CLOCK_REALTIME, &t->after);
644 print_line_prefix(info);
645 if (si->si_code == CLD_EXITED)
646 fprintf(info->outfile, "process exit, rval = %u\n",
649 fprintf(info->outfile, "process killed, signal = %u%s\n",
650 si->si_status, si->si_code == CLD_DUMPED ?
651 " (core dumped)" : "");
655 report_new_child(struct trussinfo *info)
657 struct threadinfo *t;
660 clock_gettime(CLOCK_REALTIME, &t->after);
661 t->before = t->after;
662 print_line_prefix(info);
663 fprintf(info->outfile, "<new process>\n");
667 decode_siginfo(FILE *fp, siginfo_t *si)
671 fprintf(fp, " code=");
672 str = sysdecode_sigcode(si->si_signo, si->si_code);
674 fprintf(fp, "%d", si->si_code);
676 fprintf(fp, "%s", str);
677 switch (si->si_code) {
681 fprintf(fp, " value=%p", si->si_value.sival_ptr);
685 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
686 (intmax_t)si->si_uid);
689 fprintf(fp, " value=%p", si->si_value.sival_ptr);
690 fprintf(fp, " timerid=%d", si->si_timerid);
691 fprintf(fp, " overrun=%d", si->si_overrun);
692 if (si->si_errno != 0)
693 fprintf(fp, " errno=%d", si->si_errno);
696 fprintf(fp, " value=%p", si->si_value.sival_ptr);
699 fprintf(fp, " value=%p", si->si_value.sival_ptr);
700 fprintf(fp, " mqd=%d", si->si_mqd);
703 switch (si->si_signo) {
708 fprintf(fp, " trapno=%d", si->si_trapno);
709 fprintf(fp, " addr=%p", si->si_addr);
712 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
713 (intmax_t)si->si_uid);
714 fprintf(fp, " status=%d", si->si_status);
721 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl)
723 struct threadinfo *t;
727 clock_gettime(CLOCK_REALTIME, &t->after);
728 print_line_prefix(info);
729 signame = sysdecode_signal(si->si_status);
732 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame);
733 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI)
734 decode_siginfo(info->outfile, &pl->pl_siginfo);
735 fprintf(info->outfile, "\n");
740 * Wait for events until all the processes have exited or truss has been
744 eventloop(struct trussinfo *info)
746 struct ptrace_lwpinfo pl;
750 while (!LIST_EMPTY(&info->proclist)) {
752 detach_all_procs(info);
756 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
759 err(1, "Unexpected error from waitid");
762 assert(si.si_signo == SIGCHLD);
764 switch (si.si_code) {
768 find_exit_thread(info, si.si_pid);
769 if ((info->flags & COUNTONLY) == 0) {
770 if (si.si_code == CLD_EXITED)
771 thread_exit_syscall(info);
772 report_exit(info, &si);
774 free_proc(info->curthread->proc);
775 info->curthread = NULL;
778 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
780 err(1, "ptrace(PT_LWPINFO)");
782 if (pl.pl_flags & PL_FLAG_CHILD) {
783 new_proc(info, si.si_pid, pl.pl_lwpid);
784 assert(LIST_FIRST(&info->proclist)->abi !=
786 } else if (pl.pl_flags & PL_FLAG_BORN)
787 new_thread(find_proc(info, si.si_pid),
789 find_thread(info, si.si_pid, pl.pl_lwpid);
791 if (si.si_status == SIGTRAP &&
792 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
793 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
794 if (pl.pl_flags & PL_FLAG_BORN) {
795 if ((info->flags & COUNTONLY) == 0)
796 report_thread_birth(info);
797 } else if (pl.pl_flags & PL_FLAG_EXITED) {
798 if ((info->flags & COUNTONLY) == 0)
799 report_thread_death(info);
800 free_thread(info->curthread);
801 info->curthread = NULL;
802 } else if (pl.pl_flags & PL_FLAG_SCE)
803 enter_syscall(info, info->curthread, &pl);
804 else if (pl.pl_flags & PL_FLAG_SCX)
805 exit_syscall(info, &pl);
807 } else if (pl.pl_flags & PL_FLAG_CHILD) {
808 if ((info->flags & COUNTONLY) == 0)
809 report_new_child(info);
812 if ((info->flags & NOSIGS) == 0)
813 report_signal(info, &si, &pl);
814 pending_signal = si.si_status;
816 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
820 errx(1, "waitid reported CLD_STOPPED");