]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/blob - usr.bin/truss/setup.c
MFV r308265: Update tzdata to 2016i.
[FreeBSD/FreeBSD.git] / usr.bin / truss / setup.c
1 /*-
2  * Copyright 1997 Sean Eric Fagan
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  * 3. All advertising materials mentioning features or use of this software
13  *    must display the following acknowledgement:
14  *      This product includes software developed by Sean Eric Fagan
15  * 4. Neither the name of the author may be used to endorse or promote
16  *    products derived from this software without specific prior written
17  *    permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34
35 /*
36  * Various setup functions for truss.  Not the cleanest-written code,
37  * I'm afraid.
38  */
39
40 #include <sys/ptrace.h>
41 #include <sys/sysctl.h>
42 #include <sys/wait.h>
43
44 #include <assert.h>
45 #include <err.h>
46 #include <errno.h>
47 #include <signal.h>
48 #include <stdbool.h>
49 #include <stdint.h>
50 #include <stdio.h>
51 #include <stdlib.h>
52 #include <string.h>
53 #include <sysdecode.h>
54 #include <time.h>
55 #include <unistd.h>
56
57 #include "truss.h"
58 #include "syscall.h"
59 #include "extern.h"
60
61 SET_DECLARE(procabi, struct procabi);
62
63 static sig_atomic_t detaching;
64
65 static void     enter_syscall(struct trussinfo *, struct threadinfo *,
66                     struct ptrace_lwpinfo *);
67 static void     new_proc(struct trussinfo *, pid_t, lwpid_t);
68
69 /*
70  * setup_and_wait() is called to start a process.  All it really does
71  * is fork(), enable tracing in the child, and then exec the given
72  * command.  At that point, the child process stops, and the parent
73  * can wake up and deal with it.
74  */
75 void
76 setup_and_wait(struct trussinfo *info, char *command[])
77 {
78         pid_t pid;
79
80         pid = vfork();
81         if (pid == -1)
82                 err(1, "fork failed");
83         if (pid == 0) { /* Child */
84                 ptrace(PT_TRACE_ME, 0, 0, 0);
85                 execvp(command[0], command);
86                 err(1, "execvp %s", command[0]);
87         }
88
89         /* Only in the parent here */
90         if (waitpid(pid, NULL, 0) < 0)
91                 err(1, "unexpect stop in waitpid");
92
93         new_proc(info, pid, 0);
94 }
95
96 /*
97  * start_tracing is called to attach to an existing process.
98  */
99 void
100 start_tracing(struct trussinfo *info, pid_t pid)
101 {
102         int ret, retry;
103
104         retry = 10;
105         do {
106                 ret = ptrace(PT_ATTACH, pid, NULL, 0);
107                 usleep(200);
108         } while (ret && retry-- > 0);
109         if (ret)
110                 err(1, "can not attach to target process");
111
112         if (waitpid(pid, NULL, 0) < 0)
113                 err(1, "Unexpect stop in waitpid");
114
115         new_proc(info, pid, 0);
116 }
117
118 /*
119  * Restore a process back to it's pre-truss state.
120  * Called for SIGINT, SIGTERM, SIGQUIT.  This only
121  * applies if truss was told to monitor an already-existing
122  * process.
123  */
124 void
125 restore_proc(int signo __unused)
126 {
127
128         detaching = 1;
129 }
130
131 static void
132 detach_proc(pid_t pid)
133 {
134
135         /* stop the child so that we can detach */
136         kill(pid, SIGSTOP);
137         if (waitpid(pid, NULL, 0) < 0)
138                 err(1, "Unexpected stop in waitpid");
139
140         if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
141                 err(1, "Can not detach the process");
142
143         kill(pid, SIGCONT);
144 }
145
146 /*
147  * Determine the ABI.  This is called after every exec, and when
148  * a process is first monitored.
149  */
150 static struct procabi *
151 find_abi(pid_t pid)
152 {
153         struct procabi **pabi;
154         size_t len;
155         int error;
156         int mib[4];
157         char progt[32];
158
159         len = sizeof(progt);
160         mib[0] = CTL_KERN;
161         mib[1] = KERN_PROC;
162         mib[2] = KERN_PROC_SV_NAME;
163         mib[3] = pid;
164         error = sysctl(mib, 4, progt, &len, NULL, 0);
165         if (error != 0)
166                 err(2, "can not get sysvec name");
167
168         SET_FOREACH(pabi, procabi) {
169                 if (strcmp((*pabi)->type, progt) == 0)
170                         return (*pabi);
171         }
172         warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
173         return (NULL);
174 }
175
176 static struct threadinfo *
177 new_thread(struct procinfo *p, lwpid_t lwpid)
178 {
179         struct threadinfo *nt;
180
181         /*
182          * If this happens it means there is a bug in truss.  Unfortunately
183          * this will kill any processes truss is attached to.
184          */
185         LIST_FOREACH(nt, &p->threadlist, entries) {
186                 if (nt->tid == lwpid)
187                         errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
188         }
189
190         nt = calloc(1, sizeof(struct threadinfo));
191         if (nt == NULL)
192                 err(1, "calloc() failed");
193         nt->proc = p;
194         nt->tid = lwpid;
195         LIST_INSERT_HEAD(&p->threadlist, nt, entries);
196         return (nt);
197 }
198
199 static void
200 free_thread(struct threadinfo *t)
201 {
202
203         LIST_REMOVE(t, entries);
204         free(t);
205 }
206
207 static void
208 add_threads(struct trussinfo *info, struct procinfo *p)
209 {
210         struct ptrace_lwpinfo pl;
211         struct threadinfo *t;
212         lwpid_t *lwps;
213         int i, nlwps;
214
215         nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
216         if (nlwps == -1)
217                 err(1, "Unable to fetch number of LWPs");
218         assert(nlwps > 0);
219         lwps = calloc(nlwps, sizeof(*lwps));
220         nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
221         if (nlwps == -1)
222                 err(1, "Unable to fetch LWP list");
223         for (i = 0; i < nlwps; i++) {
224                 t = new_thread(p, lwps[i]);
225                 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
226                         err(1, "ptrace(PT_LWPINFO)");
227                 if (pl.pl_flags & PL_FLAG_SCE) {
228                         info->curthread = t;
229                         enter_syscall(info, t, &pl);
230                 }
231         }
232         free(lwps);
233 }
234
235 static void
236 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
237 {
238         struct procinfo *np;
239
240         /*
241          * If this happens it means there is a bug in truss.  Unfortunately
242          * this will kill any processes truss is attached to.
243          */
244         LIST_FOREACH(np, &info->proclist, entries) {
245                 if (np->pid == pid)
246                         errx(1, "Duplicate process for pid %ld", (long)pid);
247         }
248
249         if (info->flags & FOLLOWFORKS)
250                 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
251                         err(1, "Unable to follow forks for pid %ld", (long)pid);
252         if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
253                 err(1, "Unable to enable LWP events for pid %ld", (long)pid);
254         np = calloc(1, sizeof(struct procinfo));
255         np->pid = pid;
256         np->abi = find_abi(pid);
257         LIST_INIT(&np->threadlist);
258         LIST_INSERT_HEAD(&info->proclist, np, entries);
259
260         if (lwpid != 0)
261                 new_thread(np, lwpid);
262         else
263                 add_threads(info, np);
264 }
265
266 static void
267 free_proc(struct procinfo *p)
268 {
269         struct threadinfo *t, *t2;
270
271         LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
272                 free(t);
273         }
274         LIST_REMOVE(p, entries);
275         free(p);
276 }
277
278 static void
279 detach_all_procs(struct trussinfo *info)
280 {
281         struct procinfo *p, *p2;
282
283         LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
284                 detach_proc(p->pid);
285                 free_proc(p);
286         }
287 }
288
289 static struct procinfo *
290 find_proc(struct trussinfo *info, pid_t pid)
291 {
292         struct procinfo *np;
293
294         LIST_FOREACH(np, &info->proclist, entries) {
295                 if (np->pid == pid)
296                         return (np);
297         }
298
299         return (NULL);
300 }
301
302 /*
303  * Change curthread member based on (pid, lwpid).
304  */
305 static void
306 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
307 {
308         struct procinfo *np;
309         struct threadinfo *nt;
310
311         np = find_proc(info, pid);
312         assert(np != NULL);
313
314         LIST_FOREACH(nt, &np->threadlist, entries) {
315                 if (nt->tid == lwpid) {
316                         info->curthread = nt;
317                         return;
318                 }
319         }
320         errx(1, "could not find thread");
321 }
322
323 /*
324  * When a process exits, it should have exactly one thread left.
325  * All of the other threads should have reported thread exit events.
326  */
327 static void
328 find_exit_thread(struct trussinfo *info, pid_t pid)
329 {
330         struct procinfo *p;
331
332         p = find_proc(info, pid);
333         assert(p != NULL);
334
335         info->curthread = LIST_FIRST(&p->threadlist);
336         assert(info->curthread != NULL);
337         assert(LIST_NEXT(info->curthread, entries) == NULL);
338 }
339
340 static void
341 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
342 {
343         u_int i;
344
345         assert(t->in_syscall == 0);
346         assert(t->cs.number == 0);
347         assert(t->cs.name == NULL);
348         assert(t->cs.nargs == 0);
349         for (i = 0; i < nitems(t->cs.s_args); i++)
350                 assert(t->cs.s_args[i] == NULL);
351         memset(t->cs.args, 0, sizeof(t->cs.args));
352         t->cs.number = pl->pl_syscall_code;
353         t->in_syscall = 1;
354 }
355
356 static void
357 free_syscall(struct threadinfo *t)
358 {
359         u_int i;
360
361         for (i = 0; i < t->cs.nargs; i++)
362                 free(t->cs.s_args[i]);
363         memset(&t->cs, 0, sizeof(t->cs));
364         t->in_syscall = 0;
365 }
366
367 static void
368 enter_syscall(struct trussinfo *info, struct threadinfo *t,
369     struct ptrace_lwpinfo *pl)
370 {
371         struct syscall *sc;
372         u_int i, narg;
373
374         alloc_syscall(t, pl);
375         narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
376         if (narg != 0 && t->proc->abi->fetch_args(info, narg) != 0) {
377                 free_syscall(t);
378                 return;
379         }
380
381         t->cs.name = sysdecode_syscallname(t->proc->abi->abi, t->cs.number);
382         if (t->cs.name == NULL)
383                 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
384                     t->proc->abi->type, t->cs.number);
385
386         sc = get_syscall(t->cs.name, narg);
387         t->cs.nargs = sc->nargs;
388         assert(sc->nargs <= nitems(t->cs.s_args));
389
390         t->cs.sc = sc;
391
392         /*
393          * At this point, we set up the system call arguments.
394          * We ignore any OUT ones, however -- those are arguments that
395          * are set by the system call, and so are probably meaningless
396          * now. This doesn't currently support arguments that are
397          * passed in *and* out, however.
398          */
399         if (t->cs.name != NULL) {
400 #if DEBUG
401                 fprintf(stderr, "syscall %s(", t->cs.name);
402 #endif
403                 for (i = 0; i < t->cs.nargs; i++) {
404 #if DEBUG
405                         fprintf(stderr, "0x%lx%s", sc ?
406                             t->cs.args[sc->args[i].offset] : t->cs.args[i],
407                             i < (t->cs.nargs - 1) ? "," : "");
408 #endif
409                         if (!(sc->args[i].type & OUT)) {
410                                 t->cs.s_args[i] = print_arg(&sc->args[i],
411                                     t->cs.args, 0, info);
412                         }
413                 }
414 #if DEBUG
415                 fprintf(stderr, ")\n");
416 #endif
417         }
418
419         clock_gettime(CLOCK_REALTIME, &t->before);
420 }
421
422 /*
423  * When a thread exits voluntarily (including when a thread calls
424  * exit() to trigger a process exit), the thread's internal state
425  * holds the arguments passed to the exit system call.  When the
426  * thread's exit is reported, log that system call without a return
427  * value.
428  */
429 static void
430 thread_exit_syscall(struct trussinfo *info)
431 {
432         struct threadinfo *t;
433
434         t = info->curthread;
435         if (!t->in_syscall)
436                 return;
437
438         clock_gettime(CLOCK_REALTIME, &t->after);
439
440         print_syscall_ret(info, 0, NULL);
441         free_syscall(t);
442 }
443
444 static void
445 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
446 {
447         struct threadinfo *t;
448         struct procinfo *p;
449         struct syscall *sc;
450         long retval[2];
451         u_int i;
452         int errorp;
453
454         t = info->curthread;
455         if (!t->in_syscall)
456                 return;
457
458         clock_gettime(CLOCK_REALTIME, &t->after);
459         p = t->proc;
460         if (p->abi->fetch_retval(info, retval, &errorp) < 0) {
461                 free_syscall(t);
462                 return;
463         }
464
465         sc = t->cs.sc;
466         /*
467          * Here, we only look for arguments that have OUT masked in --
468          * otherwise, they were handled in enter_syscall().
469          */
470         for (i = 0; i < sc->nargs; i++) {
471                 char *temp;
472
473                 if (sc->args[i].type & OUT) {
474                         /*
475                          * If an error occurred, then don't bother
476                          * getting the data; it may not be valid.
477                          */
478                         if (errorp) {
479                                 asprintf(&temp, "0x%lx",
480                                     t->cs.args[sc->args[i].offset]);
481                         } else {
482                                 temp = print_arg(&sc->args[i],
483                                     t->cs.args, retval, info);
484                         }
485                         t->cs.s_args[i] = temp;
486                 }
487         }
488
489         print_syscall_ret(info, errorp, retval);
490         free_syscall(t);
491
492         /*
493          * If the process executed a new image, check the ABI.  If the
494          * new ABI isn't supported, stop tracing this process.
495          */
496         if (pl->pl_flags & PL_FLAG_EXEC) {
497                 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
498                 p->abi = find_abi(p->pid);
499                 if (p->abi == NULL) {
500                         if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
501                                 err(1, "Can not detach the process");
502                         free_proc(p);
503                 }
504         }
505 }
506
507 int
508 print_line_prefix(struct trussinfo *info)
509 {
510         struct timespec timediff;
511         struct threadinfo *t;
512         int len;
513
514         len = 0;
515         t = info->curthread;
516         if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
517                 if (info->flags & FOLLOWFORKS)
518                         len += fprintf(info->outfile, "%5d", t->proc->pid);
519                 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
520                     (FOLLOWFORKS | DISPLAYTIDS))
521                         len += fprintf(info->outfile, " ");
522                 if (info->flags & DISPLAYTIDS)
523                         len += fprintf(info->outfile, "%6d", t->tid);
524                 len += fprintf(info->outfile, ": ");
525         }
526         if (info->flags & ABSOLUTETIMESTAMPS) {
527                 timespecsubt(&t->after, &info->start_time, &timediff);
528                 len += fprintf(info->outfile, "%jd.%09ld ",
529                     (intmax_t)timediff.tv_sec, timediff.tv_nsec);
530         }
531         if (info->flags & RELATIVETIMESTAMPS) {
532                 timespecsubt(&t->after, &t->before, &timediff);
533                 len += fprintf(info->outfile, "%jd.%09ld ",
534                     (intmax_t)timediff.tv_sec, timediff.tv_nsec);
535         }
536         return (len);
537 }
538
539 static void
540 report_thread_death(struct trussinfo *info)
541 {
542         struct threadinfo *t;
543
544         t = info->curthread;
545         clock_gettime(CLOCK_REALTIME, &t->after);
546         print_line_prefix(info);
547         fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
548 }
549
550 static void
551 report_thread_birth(struct trussinfo *info)
552 {
553         struct threadinfo *t;
554
555         t = info->curthread;
556         clock_gettime(CLOCK_REALTIME, &t->after);
557         t->before = t->after;
558         print_line_prefix(info);
559         fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
560 }
561
562 static void
563 report_exit(struct trussinfo *info, siginfo_t *si)
564 {
565         struct threadinfo *t;
566
567         t = info->curthread;
568         clock_gettime(CLOCK_REALTIME, &t->after);
569         print_line_prefix(info);
570         if (si->si_code == CLD_EXITED)
571                 fprintf(info->outfile, "process exit, rval = %u\n",
572                     si->si_status);
573         else
574                 fprintf(info->outfile, "process killed, signal = %u%s\n",
575                     si->si_status, si->si_code == CLD_DUMPED ?
576                     " (core dumped)" : "");
577 }
578
579 static void
580 report_new_child(struct trussinfo *info)
581 {
582         struct threadinfo *t;
583
584         t = info->curthread;
585         clock_gettime(CLOCK_REALTIME, &t->after);
586         t->before = t->after;
587         print_line_prefix(info);
588         fprintf(info->outfile, "<new process>\n");
589 }
590
591 static void
592 report_signal(struct trussinfo *info, siginfo_t *si)
593 {
594         struct threadinfo *t;
595         const char *signame;
596
597         t = info->curthread;
598         clock_gettime(CLOCK_REALTIME, &t->after);
599         print_line_prefix(info);
600         signame = sysdecode_signal(si->si_status);
601         if (signame == NULL)
602                 signame = "?";
603         fprintf(info->outfile, "SIGNAL %u (%s)\n", si->si_status, signame);
604 }
605
606 /*
607  * Wait for events until all the processes have exited or truss has been
608  * asked to stop.
609  */
610 void
611 eventloop(struct trussinfo *info)
612 {
613         struct ptrace_lwpinfo pl;
614         siginfo_t si;
615         int pending_signal;
616
617         while (!LIST_EMPTY(&info->proclist)) {
618                 if (detaching) {
619                         detach_all_procs(info);
620                         return;
621                 }
622
623                 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
624                         if (errno == EINTR)
625                                 continue;
626                         err(1, "Unexpected error from waitid");
627                 }
628
629                 assert(si.si_signo == SIGCHLD);
630
631                 switch (si.si_code) {
632                 case CLD_EXITED:
633                 case CLD_KILLED:
634                 case CLD_DUMPED:
635                         find_exit_thread(info, si.si_pid);
636                         if ((info->flags & COUNTONLY) == 0) {
637                                 if (si.si_code == CLD_EXITED)
638                                         thread_exit_syscall(info);
639                                 report_exit(info, &si);
640                         }
641                         free_proc(info->curthread->proc);
642                         info->curthread = NULL;
643                         break;
644                 case CLD_TRAPPED:
645                         if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
646                             sizeof(pl)) == -1)
647                                 err(1, "ptrace(PT_LWPINFO)");
648
649                         if (pl.pl_flags & PL_FLAG_CHILD) {
650                                 new_proc(info, si.si_pid, pl.pl_lwpid);
651                                 assert(LIST_FIRST(&info->proclist)->abi !=
652                                     NULL);
653                         } else if (pl.pl_flags & PL_FLAG_BORN)
654                                 new_thread(find_proc(info, si.si_pid),
655                                     pl.pl_lwpid);
656                         find_thread(info, si.si_pid, pl.pl_lwpid);
657
658                         if (si.si_status == SIGTRAP &&
659                             (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
660                             PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
661                                 if (pl.pl_flags & PL_FLAG_BORN) {
662                                         if ((info->flags & COUNTONLY) == 0)
663                                                 report_thread_birth(info);
664                                 } else if (pl.pl_flags & PL_FLAG_EXITED) {
665                                         if ((info->flags & COUNTONLY) == 0)
666                                                 report_thread_death(info);
667                                         free_thread(info->curthread);
668                                         info->curthread = NULL;
669                                 } else if (pl.pl_flags & PL_FLAG_SCE)
670                                         enter_syscall(info, info->curthread, &pl);
671                                 else if (pl.pl_flags & PL_FLAG_SCX)
672                                         exit_syscall(info, &pl);
673                                 pending_signal = 0;
674                         } else if (pl.pl_flags & PL_FLAG_CHILD) {
675                                 if ((info->flags & COUNTONLY) == 0)
676                                         report_new_child(info);
677                                 pending_signal = 0;
678                         } else {
679                                 if ((info->flags & NOSIGS) == 0)
680                                         report_signal(info, &si);
681                                 pending_signal = si.si_status;
682                         }
683                         ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
684                             pending_signal);
685                         break;
686                 case CLD_STOPPED:
687                         errx(1, "waitid reported CLD_STOPPED");
688                 case CLD_CONTINUED:
689                         break;
690                 }
691         }
692 }