2 * SPDX-License-Identifier: BSD-4-Clause
4 * Copyright 1997 Sean Eric Fagan
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Sean Eric Fagan
17 * 4. Neither the name of the author may be used to endorse or promote
18 * products derived from this software without specific prior written
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
38 * Various setup functions for truss. Not the cleanest-written code,
42 #include <sys/ptrace.h>
43 #include <sys/sysctl.h>
55 #include <sysdecode.h>
63 SET_DECLARE(procabi, struct procabi);
65 static sig_atomic_t detaching;
67 static void enter_syscall(struct trussinfo *, struct threadinfo *,
68 struct ptrace_lwpinfo *);
69 static void new_proc(struct trussinfo *, pid_t, lwpid_t);
72 * setup_and_wait() is called to start a process. All it really does
73 * is fork(), enable tracing in the child, and then exec the given
74 * command. At that point, the child process stops, and the parent
75 * can wake up and deal with it.
78 setup_and_wait(struct trussinfo *info, char *command[])
84 err(1, "fork failed");
85 if (pid == 0) { /* Child */
86 ptrace(PT_TRACE_ME, 0, 0, 0);
87 execvp(command[0], command);
88 err(1, "execvp %s", command[0]);
91 /* Only in the parent here */
92 if (waitpid(pid, NULL, 0) < 0)
93 err(1, "unexpect stop in waitpid");
95 new_proc(info, pid, 0);
99 * start_tracing is called to attach to an existing process.
102 start_tracing(struct trussinfo *info, pid_t pid)
108 ret = ptrace(PT_ATTACH, pid, NULL, 0);
110 } while (ret && retry-- > 0);
112 err(1, "can not attach to target process");
114 if (waitpid(pid, NULL, 0) < 0)
115 err(1, "Unexpect stop in waitpid");
117 new_proc(info, pid, 0);
121 * Restore a process back to it's pre-truss state.
122 * Called for SIGINT, SIGTERM, SIGQUIT. This only
123 * applies if truss was told to monitor an already-existing
127 restore_proc(int signo __unused)
134 detach_proc(pid_t pid)
137 /* stop the child so that we can detach */
139 if (waitpid(pid, NULL, 0) < 0)
140 err(1, "Unexpected stop in waitpid");
142 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
143 err(1, "Can not detach the process");
149 * Determine the ABI. This is called after every exec, and when
150 * a process is first monitored.
152 static struct procabi *
155 struct procabi **pabi;
164 mib[2] = KERN_PROC_SV_NAME;
166 error = sysctl(mib, 4, progt, &len, NULL, 0);
168 err(2, "can not get sysvec name");
170 SET_FOREACH(pabi, procabi) {
171 if (strcmp((*pabi)->type, progt) == 0)
174 warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
178 static struct threadinfo *
179 new_thread(struct procinfo *p, lwpid_t lwpid)
181 struct threadinfo *nt;
184 * If this happens it means there is a bug in truss. Unfortunately
185 * this will kill any processes truss is attached to.
187 LIST_FOREACH(nt, &p->threadlist, entries) {
188 if (nt->tid == lwpid)
189 errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
192 nt = calloc(1, sizeof(struct threadinfo));
194 err(1, "calloc() failed");
197 LIST_INSERT_HEAD(&p->threadlist, nt, entries);
202 free_thread(struct threadinfo *t)
205 LIST_REMOVE(t, entries);
210 add_threads(struct trussinfo *info, struct procinfo *p)
212 struct ptrace_lwpinfo pl;
213 struct threadinfo *t;
217 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
219 err(1, "Unable to fetch number of LWPs");
221 lwps = calloc(nlwps, sizeof(*lwps));
222 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
224 err(1, "Unable to fetch LWP list");
225 for (i = 0; i < nlwps; i++) {
226 t = new_thread(p, lwps[i]);
227 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
228 err(1, "ptrace(PT_LWPINFO)");
229 if (pl.pl_flags & PL_FLAG_SCE) {
231 enter_syscall(info, t, &pl);
238 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
243 * If this happens it means there is a bug in truss. Unfortunately
244 * this will kill any processes truss is attached to.
246 LIST_FOREACH(np, &info->proclist, entries) {
248 errx(1, "Duplicate process for pid %ld", (long)pid);
251 if (info->flags & FOLLOWFORKS)
252 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
253 err(1, "Unable to follow forks for pid %ld", (long)pid);
254 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
255 err(1, "Unable to enable LWP events for pid %ld", (long)pid);
256 np = calloc(1, sizeof(struct procinfo));
258 np->abi = find_abi(pid);
259 LIST_INIT(&np->threadlist);
260 LIST_INSERT_HEAD(&info->proclist, np, entries);
263 new_thread(np, lwpid);
265 add_threads(info, np);
269 free_proc(struct procinfo *p)
271 struct threadinfo *t, *t2;
273 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
276 LIST_REMOVE(p, entries);
281 detach_all_procs(struct trussinfo *info)
283 struct procinfo *p, *p2;
285 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
291 static struct procinfo *
292 find_proc(struct trussinfo *info, pid_t pid)
296 LIST_FOREACH(np, &info->proclist, entries) {
305 * Change curthread member based on (pid, lwpid).
308 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
311 struct threadinfo *nt;
313 np = find_proc(info, pid);
316 LIST_FOREACH(nt, &np->threadlist, entries) {
317 if (nt->tid == lwpid) {
318 info->curthread = nt;
322 errx(1, "could not find thread");
326 * When a process exits, it should have exactly one thread left.
327 * All of the other threads should have reported thread exit events.
330 find_exit_thread(struct trussinfo *info, pid_t pid)
334 p = find_proc(info, pid);
337 info->curthread = LIST_FIRST(&p->threadlist);
338 assert(info->curthread != NULL);
339 assert(LIST_NEXT(info->curthread, entries) == NULL);
343 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
347 assert(t->in_syscall == 0);
348 assert(t->cs.number == 0);
349 assert(t->cs.sc == NULL);
350 assert(t->cs.nargs == 0);
351 for (i = 0; i < nitems(t->cs.s_args); i++)
352 assert(t->cs.s_args[i] == NULL);
353 memset(t->cs.args, 0, sizeof(t->cs.args));
354 t->cs.number = pl->pl_syscall_code;
359 free_syscall(struct threadinfo *t)
363 for (i = 0; i < t->cs.nargs; i++)
364 free(t->cs.s_args[i]);
365 memset(&t->cs, 0, sizeof(t->cs));
370 enter_syscall(struct trussinfo *info, struct threadinfo *t,
371 struct ptrace_lwpinfo *pl)
376 alloc_syscall(t, pl);
377 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
378 if (narg != 0 && t->proc->abi->fetch_args(info, narg) != 0) {
383 sc = get_syscall(t, t->cs.number, narg);
385 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
386 t->proc->abi->type, t->cs.number);
388 t->cs.nargs = sc->nargs;
389 assert(sc->nargs <= nitems(t->cs.s_args));
394 * At this point, we set up the system call arguments.
395 * We ignore any OUT ones, however -- those are arguments that
396 * are set by the system call, and so are probably meaningless
397 * now. This doesn't currently support arguments that are
398 * passed in *and* out, however.
401 fprintf(stderr, "syscall %s(", sc->name);
403 for (i = 0; i < t->cs.nargs; i++) {
405 fprintf(stderr, "0x%lx%s", t->cs.args[sc->args[i].offset],
406 i < (t->cs.nargs - 1) ? "," : "");
408 if (!(sc->args[i].type & OUT)) {
409 t->cs.s_args[i] = print_arg(&sc->args[i],
410 t->cs.args, 0, info);
414 fprintf(stderr, ")\n");
417 clock_gettime(CLOCK_REALTIME, &t->before);
421 * When a thread exits voluntarily (including when a thread calls
422 * exit() to trigger a process exit), the thread's internal state
423 * holds the arguments passed to the exit system call. When the
424 * thread's exit is reported, log that system call without a return
428 thread_exit_syscall(struct trussinfo *info)
430 struct threadinfo *t;
436 clock_gettime(CLOCK_REALTIME, &t->after);
438 print_syscall_ret(info, 0, NULL);
443 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
445 struct threadinfo *t;
456 clock_gettime(CLOCK_REALTIME, &t->after);
458 if (p->abi->fetch_retval(info, retval, &errorp) < 0) {
465 * Here, we only look for arguments that have OUT masked in --
466 * otherwise, they were handled in enter_syscall().
468 for (i = 0; i < sc->nargs; i++) {
471 if (sc->args[i].type & OUT) {
473 * If an error occurred, then don't bother
474 * getting the data; it may not be valid.
477 asprintf(&temp, "0x%lx",
478 t->cs.args[sc->args[i].offset]);
480 temp = print_arg(&sc->args[i],
481 t->cs.args, retval, info);
483 t->cs.s_args[i] = temp;
487 print_syscall_ret(info, errorp, retval);
491 * If the process executed a new image, check the ABI. If the
492 * new ABI isn't supported, stop tracing this process.
494 if (pl->pl_flags & PL_FLAG_EXEC) {
495 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
496 p->abi = find_abi(p->pid);
497 if (p->abi == NULL) {
498 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
499 err(1, "Can not detach the process");
506 print_line_prefix(struct trussinfo *info)
508 struct timespec timediff;
509 struct threadinfo *t;
514 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
515 if (info->flags & FOLLOWFORKS)
516 len += fprintf(info->outfile, "%5d", t->proc->pid);
517 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
518 (FOLLOWFORKS | DISPLAYTIDS))
519 len += fprintf(info->outfile, " ");
520 if (info->flags & DISPLAYTIDS)
521 len += fprintf(info->outfile, "%6d", t->tid);
522 len += fprintf(info->outfile, ": ");
524 if (info->flags & ABSOLUTETIMESTAMPS) {
525 timespecsubt(&t->after, &info->start_time, &timediff);
526 len += fprintf(info->outfile, "%jd.%09ld ",
527 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
529 if (info->flags & RELATIVETIMESTAMPS) {
530 timespecsubt(&t->after, &t->before, &timediff);
531 len += fprintf(info->outfile, "%jd.%09ld ",
532 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
538 report_thread_death(struct trussinfo *info)
540 struct threadinfo *t;
543 clock_gettime(CLOCK_REALTIME, &t->after);
544 print_line_prefix(info);
545 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
549 report_thread_birth(struct trussinfo *info)
551 struct threadinfo *t;
554 clock_gettime(CLOCK_REALTIME, &t->after);
555 t->before = t->after;
556 print_line_prefix(info);
557 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
561 report_exit(struct trussinfo *info, siginfo_t *si)
563 struct threadinfo *t;
566 clock_gettime(CLOCK_REALTIME, &t->after);
567 print_line_prefix(info);
568 if (si->si_code == CLD_EXITED)
569 fprintf(info->outfile, "process exit, rval = %u\n",
572 fprintf(info->outfile, "process killed, signal = %u%s\n",
573 si->si_status, si->si_code == CLD_DUMPED ?
574 " (core dumped)" : "");
578 report_new_child(struct trussinfo *info)
580 struct threadinfo *t;
583 clock_gettime(CLOCK_REALTIME, &t->after);
584 t->before = t->after;
585 print_line_prefix(info);
586 fprintf(info->outfile, "<new process>\n");
590 decode_siginfo(FILE *fp, siginfo_t *si)
594 fprintf(fp, " code=");
595 str = sysdecode_sigcode(si->si_signo, si->si_code);
597 fprintf(fp, "%d", si->si_code);
599 fprintf(fp, "%s", str);
600 switch (si->si_code) {
604 fprintf(fp, " value=%p", si->si_value.sival_ptr);
608 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
609 (intmax_t)si->si_uid);
612 fprintf(fp, " value=%p", si->si_value.sival_ptr);
613 fprintf(fp, " timerid=%d", si->si_timerid);
614 fprintf(fp, " overrun=%d", si->si_overrun);
615 if (si->si_errno != 0)
616 fprintf(fp, " errno=%d", si->si_errno);
619 fprintf(fp, " value=%p", si->si_value.sival_ptr);
622 fprintf(fp, " value=%p", si->si_value.sival_ptr);
623 fprintf(fp, " mqd=%d", si->si_mqd);
626 switch (si->si_signo) {
631 fprintf(fp, " trapno=%d", si->si_trapno);
632 fprintf(fp, " addr=%p", si->si_addr);
635 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
636 (intmax_t)si->si_uid);
637 fprintf(fp, " status=%d", si->si_status);
644 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl)
646 struct threadinfo *t;
650 clock_gettime(CLOCK_REALTIME, &t->after);
651 print_line_prefix(info);
652 signame = sysdecode_signal(si->si_status);
655 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame);
656 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI)
657 decode_siginfo(info->outfile, &pl->pl_siginfo);
658 fprintf(info->outfile, "\n");
663 * Wait for events until all the processes have exited or truss has been
667 eventloop(struct trussinfo *info)
669 struct ptrace_lwpinfo pl;
673 while (!LIST_EMPTY(&info->proclist)) {
675 detach_all_procs(info);
679 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
682 err(1, "Unexpected error from waitid");
685 assert(si.si_signo == SIGCHLD);
687 switch (si.si_code) {
691 find_exit_thread(info, si.si_pid);
692 if ((info->flags & COUNTONLY) == 0) {
693 if (si.si_code == CLD_EXITED)
694 thread_exit_syscall(info);
695 report_exit(info, &si);
697 free_proc(info->curthread->proc);
698 info->curthread = NULL;
701 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
703 err(1, "ptrace(PT_LWPINFO)");
705 if (pl.pl_flags & PL_FLAG_CHILD) {
706 new_proc(info, si.si_pid, pl.pl_lwpid);
707 assert(LIST_FIRST(&info->proclist)->abi !=
709 } else if (pl.pl_flags & PL_FLAG_BORN)
710 new_thread(find_proc(info, si.si_pid),
712 find_thread(info, si.si_pid, pl.pl_lwpid);
714 if (si.si_status == SIGTRAP &&
715 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
716 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
717 if (pl.pl_flags & PL_FLAG_BORN) {
718 if ((info->flags & COUNTONLY) == 0)
719 report_thread_birth(info);
720 } else if (pl.pl_flags & PL_FLAG_EXITED) {
721 if ((info->flags & COUNTONLY) == 0)
722 report_thread_death(info);
723 free_thread(info->curthread);
724 info->curthread = NULL;
725 } else if (pl.pl_flags & PL_FLAG_SCE)
726 enter_syscall(info, info->curthread, &pl);
727 else if (pl.pl_flags & PL_FLAG_SCX)
728 exit_syscall(info, &pl);
730 } else if (pl.pl_flags & PL_FLAG_CHILD) {
731 if ((info->flags & COUNTONLY) == 0)
732 report_new_child(info);
735 if ((info->flags & NOSIGS) == 0)
736 report_signal(info, &si, &pl);
737 pending_signal = si.si_status;
739 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
743 errx(1, "waitid reported CLD_STOPPED");