1 /*- 2 * Copyright 1997 Sean Eric Fagan 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 3. All advertising materials mentioning features or use of this software 13 * must display the following acknowledgement: 14 * This product includes software developed by Sean Eric Fagan 15 * 4. Neither the name of the author may be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 /* 36 * Various setup functions for truss. Not the cleanest-written code, 37 * I'm afraid. 38 */ 39 40 #include <sys/ptrace.h> 41 #include <sys/sysctl.h> 42 #include <sys/wait.h> 43 44 #include <assert.h> 45 #include <err.h> 46 #include <errno.h> 47 #include <signal.h> 48 #include <stdbool.h> 49 #include <stdint.h> 50 #include <stdio.h> 51 #include <stdlib.h> 52 #include <string.h> 53 #include <sysdecode.h> 54 #include <time.h> 55 #include <unistd.h> 56 57 #include "truss.h" 58 #include "syscall.h" 59 #include "extern.h" 60 61 SET_DECLARE(procabi, struct procabi); 62 63 static sig_atomic_t detaching; 64 65 static void enter_syscall(struct trussinfo *, struct threadinfo *, 66 struct ptrace_lwpinfo *); 67 static void new_proc(struct trussinfo *, pid_t, lwpid_t); 68 69 /* 70 * setup_and_wait() is called to start a process. All it really does 71 * is fork(), enable tracing in the child, and then exec the given 72 * command. At that point, the child process stops, and the parent 73 * can wake up and deal with it. 74 */ 75 void 76 setup_and_wait(struct trussinfo *info, char *command[]) 77 { 78 pid_t pid; 79 80 pid = vfork(); 81 if (pid == -1) 82 err(1, "fork failed"); 83 if (pid == 0) { /* Child */ 84 ptrace(PT_TRACE_ME, 0, 0, 0); 85 execvp(command[0], command); 86 err(1, "execvp %s", command[0]); 87 } 88 89 /* Only in the parent here */ 90 if (waitpid(pid, NULL, 0) < 0) 91 err(1, "unexpect stop in waitpid"); 92 93 new_proc(info, pid, 0); 94 } 95 96 /* 97 * start_tracing is called to attach to an existing process. 98 */ 99 void 100 start_tracing(struct trussinfo *info, pid_t pid) 101 { 102 int ret, retry; 103 104 retry = 10; 105 do { 106 ret = ptrace(PT_ATTACH, pid, NULL, 0); 107 usleep(200); 108 } while (ret && retry-- > 0); 109 if (ret) 110 err(1, "can not attach to target process"); 111 112 if (waitpid(pid, NULL, 0) < 0) 113 err(1, "Unexpect stop in waitpid"); 114 115 new_proc(info, pid, 0); 116 } 117 118 /* 119 * Restore a process back to it's pre-truss state. 120 * Called for SIGINT, SIGTERM, SIGQUIT. This only 121 * applies if truss was told to monitor an already-existing 122 * process. 123 */ 124 void 125 restore_proc(int signo __unused) 126 { 127 128 detaching = 1; 129 } 130 131 static void 132 detach_proc(pid_t pid) 133 { 134 135 /* stop the child so that we can detach */ 136 kill(pid, SIGSTOP); 137 if (waitpid(pid, NULL, 0) < 0) 138 err(1, "Unexpected stop in waitpid"); 139 140 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0) 141 err(1, "Can not detach the process"); 142 143 kill(pid, SIGCONT); 144 } 145 146 /* 147 * Determine the ABI. This is called after every exec, and when 148 * a process is first monitored. 149 */ 150 static struct procabi * 151 find_abi(pid_t pid) 152 { 153 struct procabi **pabi; 154 size_t len; 155 int error; 156 int mib[4]; 157 char progt[32]; 158 159 len = sizeof(progt); 160 mib[0] = CTL_KERN; 161 mib[1] = KERN_PROC; 162 mib[2] = KERN_PROC_SV_NAME; 163 mib[3] = pid; 164 error = sysctl(mib, 4, progt, &len, NULL, 0); 165 if (error != 0) 166 err(2, "can not get sysvec name"); 167 168 SET_FOREACH(pabi, procabi) { 169 if (strcmp((*pabi)->type, progt) == 0) 170 return (*pabi); 171 } 172 warnx("ABI %s for pid %ld is not supported", progt, (long)pid); 173 return (NULL); 174 } 175 176 static struct threadinfo * 177 new_thread(struct procinfo *p, lwpid_t lwpid) 178 { 179 struct threadinfo *nt; 180 181 /* 182 * If this happens it means there is a bug in truss. Unfortunately 183 * this will kill any processes truss is attached to. 184 */ 185 LIST_FOREACH(nt, &p->threadlist, entries) { 186 if (nt->tid == lwpid) 187 errx(1, "Duplicate thread for LWP %ld", (long)lwpid); 188 } 189 190 nt = calloc(1, sizeof(struct threadinfo)); 191 if (nt == NULL) 192 err(1, "calloc() failed"); 193 nt->proc = p; 194 nt->tid = lwpid; 195 LIST_INSERT_HEAD(&p->threadlist, nt, entries); 196 return (nt); 197 } 198 199 static void 200 free_thread(struct threadinfo *t) 201 { 202 203 LIST_REMOVE(t, entries); 204 free(t); 205 } 206 207 static void 208 add_threads(struct trussinfo *info, struct procinfo *p) 209 { 210 struct ptrace_lwpinfo pl; 211 struct threadinfo *t; 212 lwpid_t *lwps; 213 int i, nlwps; 214 215 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0); 216 if (nlwps == -1) 217 err(1, "Unable to fetch number of LWPs"); 218 assert(nlwps > 0); 219 lwps = calloc(nlwps, sizeof(*lwps)); 220 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps); 221 if (nlwps == -1) 222 err(1, "Unable to fetch LWP list"); 223 for (i = 0; i < nlwps; i++) { 224 t = new_thread(p, lwps[i]); 225 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1) 226 err(1, "ptrace(PT_LWPINFO)"); 227 if (pl.pl_flags & PL_FLAG_SCE) { 228 info->curthread = t; 229 enter_syscall(info, t, &pl); 230 } 231 } 232 free(lwps); 233 } 234 235 static void 236 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 237 { 238 struct procinfo *np; 239 240 /* 241 * If this happens it means there is a bug in truss. Unfortunately 242 * this will kill any processes truss is attached to. 243 */ 244 LIST_FOREACH(np, &info->proclist, entries) { 245 if (np->pid == pid) 246 errx(1, "Duplicate process for pid %ld", (long)pid); 247 } 248 249 if (info->flags & FOLLOWFORKS) 250 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1) 251 err(1, "Unable to follow forks for pid %ld", (long)pid); 252 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1) 253 err(1, "Unable to enable LWP events for pid %ld", (long)pid); 254 np = calloc(1, sizeof(struct procinfo)); 255 np->pid = pid; 256 np->abi = find_abi(pid); 257 LIST_INIT(&np->threadlist); 258 LIST_INSERT_HEAD(&info->proclist, np, entries); 259 260 if (lwpid != 0) 261 new_thread(np, lwpid); 262 else 263 add_threads(info, np); 264 } 265 266 static void 267 free_proc(struct procinfo *p) 268 { 269 struct threadinfo *t, *t2; 270 271 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) { 272 free(t); 273 } 274 LIST_REMOVE(p, entries); 275 free(p); 276 } 277 278 static void 279 detach_all_procs(struct trussinfo *info) 280 { 281 struct procinfo *p, *p2; 282 283 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) { 284 detach_proc(p->pid); 285 free_proc(p); 286 } 287 } 288 289 static struct procinfo * 290 find_proc(struct trussinfo *info, pid_t pid) 291 { 292 struct procinfo *np; 293 294 LIST_FOREACH(np, &info->proclist, entries) { 295 if (np->pid == pid) 296 return (np); 297 } 298 299 return (NULL); 300 } 301 302 /* 303 * Change curthread member based on (pid, lwpid). 304 */ 305 static void 306 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 307 { 308 struct procinfo *np; 309 struct threadinfo *nt; 310 311 np = find_proc(info, pid); 312 assert(np != NULL); 313 314 LIST_FOREACH(nt, &np->threadlist, entries) { 315 if (nt->tid == lwpid) { 316 info->curthread = nt; 317 return; 318 } 319 } 320 errx(1, "could not find thread"); 321 } 322 323 /* 324 * When a process exits, it should have exactly one thread left. 325 * All of the other threads should have reported thread exit events. 326 */ 327 static void 328 find_exit_thread(struct trussinfo *info, pid_t pid) 329 { 330 struct procinfo *p; 331 332 p = find_proc(info, pid); 333 assert(p != NULL); 334 335 info->curthread = LIST_FIRST(&p->threadlist); 336 assert(info->curthread != NULL); 337 assert(LIST_NEXT(info->curthread, entries) == NULL); 338 } 339 340 static void 341 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl) 342 { 343 u_int i; 344 345 assert(t->in_syscall == 0); 346 assert(t->cs.number == 0); 347 assert(t->cs.name == NULL); 348 assert(t->cs.nargs == 0); 349 for (i = 0; i < nitems(t->cs.s_args); i++) 350 assert(t->cs.s_args[i] == NULL); 351 memset(t->cs.args, 0, sizeof(t->cs.args)); 352 t->cs.number = pl->pl_syscall_code; 353 t->in_syscall = 1; 354 } 355 356 static void 357 free_syscall(struct threadinfo *t) 358 { 359 u_int i; 360 361 for (i = 0; i < t->cs.nargs; i++) 362 free(t->cs.s_args[i]); 363 memset(&t->cs, 0, sizeof(t->cs)); 364 t->in_syscall = 0; 365 } 366 367 static void 368 enter_syscall(struct trussinfo *info, struct threadinfo *t, 369 struct ptrace_lwpinfo *pl) 370 { 371 struct syscall *sc; 372 u_int i, narg; 373 374 alloc_syscall(t, pl); 375 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args)); 376 if (narg != 0 && t->proc->abi->fetch_args(info, narg) != 0) { 377 free_syscall(t); 378 return; 379 } 380 381 t->cs.name = sysdecode_syscallname(t->proc->abi->abi, t->cs.number); 382 if (t->cs.name == NULL) 383 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n", 384 t->proc->abi->type, t->cs.number); 385 386 sc = get_syscall(t->cs.name, narg); 387 t->cs.nargs = sc->nargs; 388 assert(sc->nargs <= nitems(t->cs.s_args)); 389 390 t->cs.sc = sc; 391 392 /* 393 * At this point, we set up the system call arguments. 394 * We ignore any OUT ones, however -- those are arguments that 395 * are set by the system call, and so are probably meaningless 396 * now. This doesn't currently support arguments that are 397 * passed in *and* out, however. 398 */ 399 if (t->cs.name != NULL) { 400 #if DEBUG 401 fprintf(stderr, "syscall %s(", t->cs.name); 402 #endif 403 for (i = 0; i < t->cs.nargs; i++) { 404 #if DEBUG 405 fprintf(stderr, "0x%lx%s", sc ? 406 t->cs.args[sc->args[i].offset] : t->cs.args[i], 407 i < (t->cs.nargs - 1) ? "," : ""); 408 #endif 409 if (!(sc->args[i].type & OUT)) { 410 t->cs.s_args[i] = print_arg(&sc->args[i], 411 t->cs.args, 0, info); 412 } 413 } 414 #if DEBUG 415 fprintf(stderr, ")\n"); 416 #endif 417 } 418 419 clock_gettime(CLOCK_REALTIME, &t->before); 420 } 421 422 /* 423 * When a thread exits voluntarily (including when a thread calls 424 * exit() to trigger a process exit), the thread's internal state 425 * holds the arguments passed to the exit system call. When the 426 * thread's exit is reported, log that system call without a return 427 * value. 428 */ 429 static void 430 thread_exit_syscall(struct trussinfo *info) 431 { 432 struct threadinfo *t; 433 434 t = info->curthread; 435 if (!t->in_syscall) 436 return; 437 438 clock_gettime(CLOCK_REALTIME, &t->after); 439 440 print_syscall_ret(info, 0, NULL); 441 free_syscall(t); 442 } 443 444 static void 445 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl) 446 { 447 struct threadinfo *t; 448 struct procinfo *p; 449 struct syscall *sc; 450 long retval[2]; 451 u_int i; 452 int errorp; 453 454 t = info->curthread; 455 if (!t->in_syscall) 456 return; 457 458 clock_gettime(CLOCK_REALTIME, &t->after); 459 p = t->proc; 460 if (p->abi->fetch_retval(info, retval, &errorp) < 0) { 461 free_syscall(t); 462 return; 463 } 464 465 sc = t->cs.sc; 466 /* 467 * Here, we only look for arguments that have OUT masked in -- 468 * otherwise, they were handled in enter_syscall(). 469 */ 470 for (i = 0; i < sc->nargs; i++) { 471 char *temp; 472 473 if (sc->args[i].type & OUT) { 474 /* 475 * If an error occurred, then don't bother 476 * getting the data; it may not be valid. 477 */ 478 if (errorp) { 479 asprintf(&temp, "0x%lx", 480 t->cs.args[sc->args[i].offset]); 481 } else { 482 temp = print_arg(&sc->args[i], 483 t->cs.args, retval, info); 484 } 485 t->cs.s_args[i] = temp; 486 } 487 } 488 489 print_syscall_ret(info, errorp, retval); 490 free_syscall(t); 491 492 /* 493 * If the process executed a new image, check the ABI. If the 494 * new ABI isn't supported, stop tracing this process. 495 */ 496 if (pl->pl_flags & PL_FLAG_EXEC) { 497 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL); 498 p->abi = find_abi(p->pid); 499 if (p->abi == NULL) { 500 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0) 501 err(1, "Can not detach the process"); 502 free_proc(p); 503 } 504 } 505 } 506 507 int 508 print_line_prefix(struct trussinfo *info) 509 { 510 struct timespec timediff; 511 struct threadinfo *t; 512 int len; 513 514 len = 0; 515 t = info->curthread; 516 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) { 517 if (info->flags & FOLLOWFORKS) 518 len += fprintf(info->outfile, "%5d", t->proc->pid); 519 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) == 520 (FOLLOWFORKS | DISPLAYTIDS)) 521 len += fprintf(info->outfile, " "); 522 if (info->flags & DISPLAYTIDS) 523 len += fprintf(info->outfile, "%6d", t->tid); 524 len += fprintf(info->outfile, ": "); 525 } 526 if (info->flags & ABSOLUTETIMESTAMPS) { 527 timespecsubt(&t->after, &info->start_time, &timediff); 528 len += fprintf(info->outfile, "%jd.%09ld ", 529 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 530 } 531 if (info->flags & RELATIVETIMESTAMPS) { 532 timespecsubt(&t->after, &t->before, &timediff); 533 len += fprintf(info->outfile, "%jd.%09ld ", 534 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 535 } 536 return (len); 537 } 538 539 static void 540 report_thread_death(struct trussinfo *info) 541 { 542 struct threadinfo *t; 543 544 t = info->curthread; 545 clock_gettime(CLOCK_REALTIME, &t->after); 546 print_line_prefix(info); 547 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid); 548 } 549 550 static void 551 report_thread_birth(struct trussinfo *info) 552 { 553 struct threadinfo *t; 554 555 t = info->curthread; 556 clock_gettime(CLOCK_REALTIME, &t->after); 557 t->before = t->after; 558 print_line_prefix(info); 559 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid); 560 } 561 562 static void 563 report_exit(struct trussinfo *info, siginfo_t *si) 564 { 565 struct threadinfo *t; 566 567 t = info->curthread; 568 clock_gettime(CLOCK_REALTIME, &t->after); 569 print_line_prefix(info); 570 if (si->si_code == CLD_EXITED) 571 fprintf(info->outfile, "process exit, rval = %u\n", 572 si->si_status); 573 else 574 fprintf(info->outfile, "process killed, signal = %u%s\n", 575 si->si_status, si->si_code == CLD_DUMPED ? 576 " (core dumped)" : ""); 577 } 578 579 static void 580 report_new_child(struct trussinfo *info) 581 { 582 struct threadinfo *t; 583 584 t = info->curthread; 585 clock_gettime(CLOCK_REALTIME, &t->after); 586 t->before = t->after; 587 print_line_prefix(info); 588 fprintf(info->outfile, "<new process>\n"); 589 } 590 591 static void 592 report_signal(struct trussinfo *info, siginfo_t *si) 593 { 594 struct threadinfo *t; 595 const char *signame; 596 597 t = info->curthread; 598 clock_gettime(CLOCK_REALTIME, &t->after); 599 print_line_prefix(info); 600 signame = sysdecode_signal(si->si_status); 601 if (signame == NULL) 602 signame = "?"; 603 fprintf(info->outfile, "SIGNAL %u (%s)\n", si->si_status, signame); 604 } 605 606 /* 607 * Wait for events until all the processes have exited or truss has been 608 * asked to stop. 609 */ 610 void 611 eventloop(struct trussinfo *info) 612 { 613 struct ptrace_lwpinfo pl; 614 siginfo_t si; 615 int pending_signal; 616 617 while (!LIST_EMPTY(&info->proclist)) { 618 if (detaching) { 619 detach_all_procs(info); 620 return; 621 } 622 623 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) { 624 if (errno == EINTR) 625 continue; 626 err(1, "Unexpected error from waitid"); 627 } 628 629 assert(si.si_signo == SIGCHLD); 630 631 switch (si.si_code) { 632 case CLD_EXITED: 633 case CLD_KILLED: 634 case CLD_DUMPED: 635 find_exit_thread(info, si.si_pid); 636 if ((info->flags & COUNTONLY) == 0) { 637 if (si.si_code == CLD_EXITED) 638 thread_exit_syscall(info); 639 report_exit(info, &si); 640 } 641 free_proc(info->curthread->proc); 642 info->curthread = NULL; 643 break; 644 case CLD_TRAPPED: 645 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl, 646 sizeof(pl)) == -1) 647 err(1, "ptrace(PT_LWPINFO)"); 648 649 if (pl.pl_flags & PL_FLAG_CHILD) { 650 new_proc(info, si.si_pid, pl.pl_lwpid); 651 assert(LIST_FIRST(&info->proclist)->abi != 652 NULL); 653 } else if (pl.pl_flags & PL_FLAG_BORN) 654 new_thread(find_proc(info, si.si_pid), 655 pl.pl_lwpid); 656 find_thread(info, si.si_pid, pl.pl_lwpid); 657 658 if (si.si_status == SIGTRAP && 659 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED| 660 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) { 661 if (pl.pl_flags & PL_FLAG_BORN) { 662 if ((info->flags & COUNTONLY) == 0) 663 report_thread_birth(info); 664 } else if (pl.pl_flags & PL_FLAG_EXITED) { 665 if ((info->flags & COUNTONLY) == 0) 666 report_thread_death(info); 667 free_thread(info->curthread); 668 info->curthread = NULL; 669 } else if (pl.pl_flags & PL_FLAG_SCE) 670 enter_syscall(info, info->curthread, &pl); 671 else if (pl.pl_flags & PL_FLAG_SCX) 672 exit_syscall(info, &pl); 673 pending_signal = 0; 674 } else if (pl.pl_flags & PL_FLAG_CHILD) { 675 if ((info->flags & COUNTONLY) == 0) 676 report_new_child(info); 677 pending_signal = 0; 678 } else { 679 if ((info->flags & NOSIGS) == 0) 680 report_signal(info, &si); 681 pending_signal = si.si_status; 682 } 683 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1, 684 pending_signal); 685 break; 686 case CLD_STOPPED: 687 errx(1, "waitid reported CLD_STOPPED"); 688 case CLD_CONTINUED: 689 break; 690 } 691 } 692 } 693