2 * SPDX-License-Identifier: BSD-4-Clause
4 * Copyright 1997 Sean Eric Fagan
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Sean Eric Fagan
17 * 4. Neither the name of the author may be used to endorse or promote
18 * products derived from this software without specific prior written
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * System call arguments come in several flavours:
36 * Hex -- values that should be printed in hex (addresses)
37 * Octal -- Same as above, but octal
38 * Int -- normal integer values (file descriptors, for example)
39 * LongHex -- long value that should be printed in hex
40 * Name -- pointer to a NULL-terminated string.
41 * BinString -- pointer to an array of chars, printed via strvisx().
42 * Ptr -- pointer to some unspecified structure. Just print as hex for now.
43 * Stat -- a pointer to a stat buffer. Prints a couple fields.
44 * Stat11 -- a pointer to a freebsd 11 stat buffer. Prints a couple fields.
45 * StatFs -- a pointer to a statfs buffer. Prints a few fields.
46 * Ioctl -- an ioctl command. Woefully limited.
47 * Quad -- a double-word value. e.g., lseek(int, offset_t, int)
48 * Signal -- a signal number. Prints the signal name (SIGxxx)
49 * Sockaddr -- a pointer to a struct sockaddr. Prints symbolic AF, and IP:Port
50 * StringArray -- a pointer to an array of string pointers.
51 * Timespec -- a pointer to a struct timespec. Prints both elements.
52 * Timeval -- a pointer to a struct timeval. Prints both elements.
53 * Timeval2 -- a pointer to two struct timevals. Prints both elements of both.
54 * Itimerval -- a pointer to a struct itimerval. Prints all elements.
55 * Pollfd -- a pointer to an array of struct pollfd. Prints .fd and .events.
56 * Fd_set -- a pointer to an array of fd_set. Prints the fds that are set.
57 * Sigaction -- a pointer to a struct sigaction. Prints all elements.
58 * Sigset -- a pointer to a sigset_t. Prints the signals that are set.
59 * Sigprocmask -- the first argument to sigprocmask(). Prints the name.
60 * Kevent -- a pointer to an array of struct kevents. Prints all elements.
61 * Pathconf -- the 2nd argument of pathconf().
62 * Utrace -- utrace(2) buffer.
63 * CapRights -- a pointer to a cap_rights_t. Prints all set capabilities.
65 * In addition, the pointer types (String, Ptr) may have OUT masked in --
66 * this means that the data is set on *return* from the system call -- or
67 * IN (meaning that the data is passed *into* the system call).
73 /* Scalar integers. */
85 /* Encoded scalar values. */
144 /* Pointers to non-structures. */
165 /* Pointers to structures. */
214 #define ARG_MASK 0xff
218 _Static_assert(ARG_MASK > MAX_ARG_TYPE,
219 "ARG_MASK overlaps with Argtype values");
226 struct syscall_decode {
227 const char *name; /* Name for calling convention lookup. */
229 * Syscall return type:
230 * 0: no return value (e.g. exit)
231 * 1: normal return value (a single int/long/pointer)
232 * 2: off_t return value (two values for 32-bit ABIs)
235 u_int nargs; /* number of meaningful arguments */
236 struct syscall_arg args[10]; /* Hopefully no syscalls with > 10 args */
240 STAILQ_ENTRY(syscall) entries;
241 const char *name; /* Name to be displayed, might be malloc()'d */
242 struct syscall_decode decode;
243 struct timespec time; /* Time spent for this call */
244 int ncalls; /* Number of calls */
245 int nerror; /* Number of calls that returned with error */
246 bool unknown; /* Unknown system call */
249 struct syscall *get_syscall(struct threadinfo *, u_int, u_int);
250 char *print_arg(struct syscall_arg *, unsigned long *, register_t *,
254 * Linux Socket defines
256 #define LINUX_SOCKET 1
258 #define LINUX_CONNECT 3
259 #define LINUX_LISTEN 4
260 #define LINUX_ACCEPT 5
261 #define LINUX_GETSOCKNAME 6
262 #define LINUX_GETPEERNAME 7
263 #define LINUX_SOCKETPAIR 8
265 #define LINUX_RECV 10
266 #define LINUX_SENDTO 11
267 #define LINUX_RECVFROM 12
268 #define LINUX_SHUTDOWN 13
269 #define LINUX_SETSOCKOPT 14
270 #define LINUX_GETSOCKOPT 15
271 #define LINUX_SENDMSG 16
272 #define LINUX_RECVMSG 17
274 #define PAD_(t) (sizeof(register_t) <= sizeof(t) ? \
275 0 : sizeof(register_t) - sizeof(t))
277 #if BYTE_ORDER == LITTLE_ENDIAN
279 #define PADR_(t) PAD_(t)
281 #define PADL_(t) PAD_(t)
286 typedef uint32_t l_ulong;
288 struct linux_socketcall_args {
289 char what_l_[PADL_(l_int)]; l_int what; char what_r_[PADR_(l_int)];
290 char args_l_[PADL_(l_ulong)]; l_ulong args; char args_r_[PADR_(l_ulong)];
293 void print_syscall(struct trussinfo *);
294 void print_syscall_ret(struct trussinfo *, int, register_t *);
295 void print_summary(struct trussinfo *trussinfo);