1 /* 2 * Copryight 1997 Sean Eric Fagan 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions 6 * are met: 7 * 1. Redistributions of source code must retain the above copyright 8 * notice, this list of conditions and the following disclaimer. 9 * 2. Redistributions in binary form must reproduce the above copyright 10 * notice, this list of conditions and the following disclaimer in the 11 * documentation and/or other materials provided with the distribution. 12 * 3. All advertising materials mentioning features or use of this software 13 * must display the following acknowledgement: 14 * This product includes software developed by Sean Eric Fagan 15 * 4. Neither the name of the author may be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #ifndef lint 33 static const char rcsid[] = 34 "$FreeBSD$"; 35 #endif /* not lint */ 36 37 /* 38 * This file has routines used to print out system calls and their 39 * arguments. 40 */ 41 42 #include <sys/mman.h> 43 #include <sys/types.h> 44 #include <sys/socket.h> 45 #include <sys/time.h> 46 #include <sys/un.h> 47 #include <netinet/in.h> 48 #include <arpa/inet.h> 49 50 #include <ctype.h> 51 #include <err.h> 52 #include <fcntl.h> 53 #include <poll.h> 54 #define COMPAT_SUNOS 55 #include <signal.h> 56 #include <stdint.h> 57 #include <stdio.h> 58 #include <stdlib.h> 59 #include <string.h> 60 #include <time.h> 61 #include <unistd.h> 62 63 #include "truss.h" 64 #include "extern.h" 65 #include "syscall.h" 66 67 /* 68 * This should probably be in its own file. 69 */ 70 71 struct syscall syscalls[] = { 72 { "fcntl", 1, 3, 73 { { Int, 0 } , { Fcntl, 1 }, { Hex, 2 }}}, 74 { "readlink", 1, 3, 75 { { String, 0 } , { String | OUT, 1 }, { Int, 2 }}}, 76 { "lseek", 2, 3, 77 { { Int, 0 }, {Quad, 2 }, { Int, 4 }}}, 78 { "mmap", 2, 6, 79 { { Ptr, 0 }, {Int, 1}, {Mprot, 2}, {Mmapflags, 3}, {Int, 4}, {Quad, 6}}}, 80 { "mprotect", 1, 3, 81 { { Ptr, 0 }, {Int, 1}, {Mprot, 2}}}, 82 { "open", 1, 3, 83 { { String | IN, 0} , { Hex, 1}, {Octal, 2}}}, 84 { "linux_open", 1, 3, 85 { { String, 0 }, { Hex, 1}, { Octal, 2 }}}, 86 { "close", 1, 1, 87 { { Int, 0 } } }, 88 { "link", 0, 2, 89 { { String, 0 }, { String, 1 }}}, 90 { "unlink", 0, 1, 91 { { String, 0 }}}, 92 { "chdir", 0, 1, 93 { { String, 0 }}}, 94 { "mknod", 0, 3, 95 { { String, 0 }, { Octal, 1 }, { Int, 3 }}}, 96 { "chmod", 0, 2, 97 { { String, 0 }, { Octal, 1 }}}, 98 { "chown", 0, 3, 99 { { String, 0 }, { Int, 1 }, { Int, 2 }}}, 100 { "mount", 0, 4, 101 { { String, 0 }, { String, 1 }, { Int, 2 }, { Ptr, 3 }}}, 102 { "umount", 0, 2, 103 { { String, 0 }, { Int, 2 }}}, 104 { "fstat", 1, 2, 105 { { Int, 0}, {Ptr | OUT , 1 }}}, 106 { "stat", 1, 2, 107 { { String | IN, 0 }, { Ptr | OUT, 1 }}}, 108 { "lstat", 1, 2, 109 { { String | IN, 0 }, { Ptr | OUT, 1 }}}, 110 { "linux_newstat", 1, 2, 111 { { String | IN, 0 }, { Ptr | OUT, 1 }}}, 112 { "linux_newfstat", 1, 2, 113 { { Int, 0 }, { Ptr | OUT, 1 }}}, 114 { "write", 1, 3, 115 { { Int, 0 }, { Ptr | IN, 1 }, { Int, 2 }}}, 116 { "ioctl", 1, 3, 117 { { Int, 0 }, { Ioctl, 1 }, { Hex, 2 }}}, 118 { "break", 1, 1, { { Hex, 0 }}}, 119 { "exit", 0, 1, { { Hex, 0 }}}, 120 { "access", 1, 2, { { String | IN, 0 }, { Int, 1 }}}, 121 { "sigaction", 1, 3, 122 { { Signal, 0 }, { Sigaction | IN, 1 }, { Sigaction | OUT, 2 }}}, 123 { "accept", 1, 3, 124 { { Hex, 0 }, { Sockaddr | OUT, 1 }, { Ptr | OUT, 2 } } }, 125 { "bind", 1, 3, 126 { { Hex, 0 }, { Sockaddr | IN, 1 }, { Int, 2 } } }, 127 { "connect", 1, 3, 128 { { Hex, 0 }, { Sockaddr | IN, 1 }, { Int, 2 } } }, 129 { "getpeername", 1, 3, 130 { { Hex, 0 }, { Sockaddr | OUT, 1 }, { Ptr | OUT, 2 } } }, 131 { "getsockname", 1, 3, 132 { { Hex, 0 }, { Sockaddr | OUT, 1 }, { Ptr | OUT, 2 } } }, 133 { "recvfrom", 1, 6, 134 { { Hex, 0 }, { Ptr | IN, 1 }, { Int, 3 }, { Hex, 3 }, { Sockaddr | OUT, 4 }, { Ptr | OUT, 5 } } }, 135 { "sendto", 1, 6, 136 { { Hex, 0 }, { Ptr | IN, 1 }, { Int, 3 }, { Hex, 3 }, { Sockaddr | IN, 4 }, { Ptr | IN, 5 } } }, 137 { "execve", 1, 3, 138 { { String | IN, 0 }, { StringArray | IN, 1 }, { StringArray | IN, 2 } } }, 139 { "linux_execve", 1, 3, 140 { { String | IN, 0 }, { StringArray | IN, 1 }, { StringArray | IN, 2 } } }, 141 { "kldload", 0, 1, { { String | IN, 0 }}}, 142 { "kldunload", 0, 1, { { Int, 0 }}}, 143 { "kldfind", 0, 1, { { String | IN, 0 }}}, 144 { "kldnext", 0, 1, { { Int, 0 }}}, 145 { "kldstat", 0, 2, { { Int, 0 }, { Ptr, 1 }}}, 146 { "kldfirstmod", 0, 1, { { Int, 0 }}}, 147 { "nanosleep", 0, 1, { { Timespec, 0 }}}, 148 { "select", 1, 5, { { Int, 0 }, { Fd_set, 1 }, { Fd_set, 2 }, { Fd_set, 3 }, { Timeval, 4 }}}, 149 { "poll", 1, 3, { { Pollfd, 0 }, { Int, 1 }, { Int, 2 }}}, 150 { "gettimeofday", 1, 2, { { Timeval | OUT, 0 }, { Ptr, 1 }}}, 151 { "clock_gettime", 1, 2, { { Int, 0 }, { Timeval | OUT, 1 }}}, 152 { "recvfrom", 1, 6, { { Int, 0 }, { Ptr | OUT, 1 }, { Int, 2 }, { Int, 3 }, { Sockaddr | OUT, 4}, {Ptr | OUT, 5}}}, 153 { "getitimer", 1, 2, { { Int, 0 }, { Itimerval | OUT, 2 }}}, 154 { "setitimer", 1, 3, { { Int, 0 }, { Itimerval, 1} , { Itimerval | OUT, 2 }}}, 155 { 0, 0, 0, { { 0, 0 }}}, 156 }; 157 158 /* 159 * If/when the list gets big, it might be desirable to do it 160 * as a hash table or binary search. 161 */ 162 163 struct syscall * 164 get_syscall(const char *name) { 165 struct syscall *sc = syscalls; 166 167 while (sc->name) { 168 if (!strcmp(name, sc->name)) 169 return sc; 170 sc++; 171 } 172 return NULL; 173 } 174 175 /* 176 * get_struct 177 * 178 * Copy a fixed amount of bytes from the process. 179 */ 180 181 static int 182 get_struct(int procfd, void *offset, void *buf, int len) { 183 184 if (pread(procfd, buf, len, (uintptr_t)offset) != len) 185 return -1; 186 return 0; 187 } 188 189 /* 190 * get_string 191 * Copy a string from the process. Note that it is 192 * expected to be a C string, but if max is set, it will 193 * only get that much. 194 */ 195 196 char * 197 get_string(int procfd, void *offset, int max) { 198 char *buf; 199 int size, len, c, fd; 200 FILE *p; 201 202 if ((fd = dup(procfd)) == -1) 203 err(1, "dup"); 204 if ((p = fdopen(fd, "r")) == NULL) 205 err(1, "fdopen"); 206 buf = malloc( size = (max ? max : 64 ) ); 207 len = 0; 208 buf[0] = 0; 209 if (fseeko(p, (uintptr_t)offset, SEEK_SET) == 0) { 210 while ((c = fgetc(p)) != EOF) { 211 buf[len++] = c; 212 if (c == 0 || len == max) { 213 buf[len] = 0; 214 break; 215 } 216 if (len == size) { 217 char *tmp; 218 tmp = realloc(buf, size+64); 219 if (tmp == NULL) { 220 buf[len] = 0; 221 break; 222 } 223 size += 64; 224 buf = tmp; 225 } 226 } 227 } 228 fclose(p); 229 return (buf); 230 } 231 232 233 /* 234 * Gag. This is really unportable. Multiplication is more portable. 235 * But slower, from the code I saw. 236 */ 237 238 static long long 239 make_quad(unsigned long p1, unsigned long p2) { 240 union { 241 long long ll; 242 unsigned long l[2]; 243 } t; 244 t.l[0] = p1; 245 t.l[1] = p2; 246 return t.ll; 247 } 248 249 /* 250 * Remove a trailing '|' in a string, useful for fixup after decoding 251 * a "flags" argument. 252 */ 253 254 void 255 remove_trailing_or(char *str) 256 { 257 258 if (str != NULL && (str = rindex(str, '|')) != NULL && str[1] == '\0') 259 *str = '\0'; 260 } 261 262 /* 263 * print_arg 264 * Converts a syscall argument into a string. Said string is 265 * allocated via malloc(), so needs to be free()'d. The file 266 * descriptor is for the process' memory (via /proc), and is used 267 * to get any data (where the argument is a pointer). sc is 268 * a pointer to the syscall description (see above); args is 269 * an array of all of the system call arguments. 270 */ 271 272 char * 273 print_arg(int fd, struct syscall_args *sc, unsigned long *args) { 274 char *tmp = NULL; 275 switch (sc->type & ARG_MASK) { 276 case Hex: 277 asprintf(&tmp, "0x%lx", args[sc->offset]); 278 break; 279 case Octal: 280 asprintf(&tmp, "0%lo", args[sc->offset]); 281 break; 282 case Int: 283 asprintf(&tmp, "%ld", args[sc->offset]); 284 break; 285 case String: 286 { 287 char *tmp2; 288 tmp2 = get_string(fd, (void*)args[sc->offset], 0); 289 asprintf(&tmp, "\"%s\"", tmp2); 290 free(tmp2); 291 } 292 break; 293 case StringArray: 294 { 295 int num, size, i; 296 char *tmp2; 297 char *string; 298 char *strarray[100]; /* XXX This is ugly. */ 299 300 if (get_struct(fd, (void *)args[sc->offset], (void *)&strarray, 301 sizeof(strarray)) == -1) { 302 err(1, "get_struct %p", (void *)args[sc->offset]); 303 } 304 num = 0; 305 size = 0; 306 307 /* Find out how large of a buffer we'll need. */ 308 while (strarray[num] != NULL) { 309 string = get_string(fd, (void*)strarray[num], 0); 310 size += strlen(string); 311 free(string); 312 num++; 313 } 314 size += 4 + (num * 4); 315 tmp = (char *)malloc(size); 316 tmp2 = tmp; 317 318 tmp2 += sprintf(tmp2, " ["); 319 for (i = 0; i < num; i++) { 320 string = get_string(fd, (void*)strarray[i], 0); 321 tmp2 += sprintf(tmp2, " \"%s\"%c", string, (i+1 == num) ? ' ' : ','); 322 free(string); 323 } 324 tmp2 += sprintf(tmp2, "]"); 325 } 326 break; 327 case Quad: 328 { 329 unsigned long long t; 330 unsigned long l1, l2; 331 l1 = args[sc->offset]; 332 l2 = args[sc->offset+1]; 333 t = make_quad(l1, l2); 334 asprintf(&tmp, "0x%qx", t); 335 break; 336 } 337 case Ptr: 338 asprintf(&tmp, "0x%lx", args[sc->offset]); 339 break; 340 case Ioctl: 341 { 342 const char *temp = ioctlname(args[sc->offset]); 343 if (temp) 344 tmp = strdup(temp); 345 else 346 asprintf(&tmp, "0x%lx", args[sc->offset]); 347 } 348 break; 349 case Timespec: 350 { 351 struct timespec ts; 352 if (get_struct(fd, (void *)args[sc->offset], &ts, sizeof(ts)) != -1) 353 asprintf(&tmp, "{%jd %jd}", (intmax_t)ts.tv_sec, (intmax_t)ts.tv_nsec); 354 else 355 asprintf(&tmp, "0x%lx", args[sc->offset]); 356 } 357 break; 358 case Timeval: 359 { 360 struct timeval tv; 361 if (get_struct(fd, (void *)args[sc->offset], &tv, sizeof(tv)) != -1) 362 asprintf(&tmp, "{%jd %jd}", (intmax_t)tv.tv_sec, (intmax_t)tv.tv_usec); 363 else 364 asprintf(&tmp, "0x%lx", args[sc->offset]); 365 } 366 break; 367 case Itimerval: 368 { 369 struct itimerval itv; 370 if (get_struct(fd, (void *)args[sc->offset], &itv, sizeof(itv)) != -1) 371 asprintf(&tmp, "{%jd %jd, %jd %jd}", 372 (intmax_t)itv.it_interval.tv_sec, 373 (intmax_t)itv.it_interval.tv_usec, 374 (intmax_t)itv.it_value.tv_sec, 375 (intmax_t)itv.it_value.tv_usec); 376 else 377 asprintf(&tmp, "0x%lx", args[sc->offset]); 378 } 379 break; 380 case Pollfd: 381 { 382 /* 383 * XXX: A Pollfd argument expects the /next/ syscall argument to be 384 * the number of fds in the array. This matches the poll syscall. 385 */ 386 struct pollfd *pfd; 387 int numfds = args[sc->offset+1]; 388 int bytes = sizeof(struct pollfd) * numfds; 389 int i, tmpsize, u, used; 390 const int per_fd = 100; 391 392 if ((pfd = malloc(bytes)) == NULL) 393 err(1, "Cannot malloc %d bytes for pollfd array", bytes); 394 if (get_struct(fd, (void *)args[sc->offset], pfd, bytes) != -1) { 395 396 used = 0; 397 tmpsize = 1 + per_fd * numfds + 2; 398 if ((tmp = malloc(tmpsize)) == NULL) 399 err(1, "Cannot alloc %d bytes for poll output", tmpsize); 400 401 tmp[used++] = '{'; 402 for (i = 0; i < numfds; i++) { 403 #define POLLKNOWN_EVENTS \ 404 (POLLIN | POLLPRI | POLLOUT | POLLERR | POLLHUP | POLLNVAL | \ 405 POLLRDNORM |POLLRDBAND | POLLWRBAND | POLLINIGNEOF) 406 407 u += snprintf(tmp + used, per_fd, 408 "%s%d 0x%hx%s%s%s%s%s%s%s%s%s ", 409 i > 0 ? " " : "", 410 pfd[i].fd, 411 pfd[i].events & ~POLLKNOWN_EVENTS, 412 pfd[i].events & POLLIN ? "" : "|IN", 413 pfd[i].events & POLLPRI ? "" : "|PRI", 414 pfd[i].events & POLLOUT ? "" : "|OUT", 415 pfd[i].events & POLLERR ? "" : "|ERR", 416 pfd[i].events & POLLHUP ? "" : "|HUP", 417 pfd[i].events & POLLNVAL ? "" : "|NVAL", 418 pfd[i].events & POLLRDNORM ? "" : "|RDNORM", 419 pfd[i].events & POLLRDBAND ? "" : "|RDBAND", 420 pfd[i].events & POLLWRBAND ? "" : "|WRBAND"); 421 if (u > 0) 422 used += u < per_fd ? u : per_fd; 423 } 424 tmp[used++] = '}'; 425 tmp[used++] = '\0'; 426 } else 427 asprintf(&tmp, "0x%lx", args[sc->offset]); 428 free(pfd); 429 } 430 break; 431 case Fd_set: 432 { 433 /* 434 * XXX: A Fd_set argument expects the /first/ syscall argument to be 435 * the number of fds in the array. This matches the select syscall. 436 */ 437 fd_set *fds; 438 int numfds = args[0]; 439 int bytes = _howmany(numfds, _NFDBITS) * _NFDBITS; 440 int i, tmpsize, u, used; 441 const int per_fd = 20; 442 443 if ((fds = malloc(bytes)) == NULL) 444 err(1, "Cannot malloc %d bytes for fd_set array", bytes); 445 if (get_struct(fd, (void *)args[sc->offset], fds, bytes) != -1) { 446 used = 0; 447 tmpsize = 1 + numfds * per_fd + 2; 448 if ((tmp = malloc(tmpsize)) == NULL) 449 err(1, "Cannot alloc %d bytes for fd_set output", tmpsize); 450 451 tmp[used++] = '{'; 452 for (i = 0; i < numfds; i++) { 453 if (FD_ISSET(i, fds)) { 454 u = snprintf(tmp + used, per_fd, "%d ", i); 455 if (u > 0) 456 used += u < per_fd ? u : per_fd; 457 } 458 } 459 if (tmp[used-1] == ' ') 460 used--; 461 tmp[used++] = '}'; 462 tmp[used++] = '\0'; 463 } else 464 asprintf(&tmp, "0x%lx", args[sc->offset]); 465 free(fds); 466 } 467 break; 468 case Signal: 469 { 470 long sig; 471 472 sig = args[sc->offset]; 473 if (sig > 0 && sig < NSIG) { 474 int i; 475 asprintf(&tmp, "sig%s", sys_signame[sig]); 476 for (i = 0; tmp[i] != '\0'; ++i) 477 tmp[i] = toupper(tmp[i]); 478 } else 479 asprintf(&tmp, "%ld", sig); 480 } 481 break; 482 case Fcntl: 483 { 484 switch (args[sc->offset]) { 485 #define S(a) case a: tmp = strdup(#a); break; 486 S(F_DUPFD); 487 S(F_GETFD); 488 S(F_SETFD); 489 S(F_GETFL); 490 S(F_SETFL); 491 S(F_GETOWN); 492 S(F_SETOWN); 493 S(F_GETLK); 494 S(F_SETLK); 495 S(F_SETLKW); 496 #undef S 497 } 498 if (tmp == NULL) 499 asprintf(&tmp, "0x%lx", args[sc->offset]); 500 } 501 break; 502 503 case Mprot: 504 { 505 506 #define S(a) ((args[sc->offset] & a) ? #a "|" : "") 507 asprintf(&tmp, "(0x%lx)%s%s%s%s", args[sc->offset], 508 S(PROT_NONE), S(PROT_READ), S(PROT_WRITE), S(PROT_EXEC)); 509 #undef S 510 remove_trailing_or(tmp); 511 512 } 513 break; 514 515 case Mmapflags: 516 { 517 #define S(a) ((args[sc->offset] & a) ? #a "|" : "") 518 asprintf(&tmp, "(0x%lx)%s%s%s%s%s%s%s%s", args[sc->offset], 519 S(MAP_ANON), S(MAP_FIXED), S(MAP_HASSEMAPHORE), 520 S(MAP_NOCORE), S(MAP_NOSYNC), S(MAP_PRIVATE), 521 S(MAP_SHARED), S(MAP_STACK)); 522 #undef S 523 524 remove_trailing_or(tmp); 525 } 526 break; 527 528 case Sockaddr: 529 { 530 struct sockaddr_storage ss; 531 char addr[64]; 532 struct sockaddr_in *lsin; 533 struct sockaddr_in6 *lsin6; 534 struct sockaddr_un *sun; 535 struct sockaddr *sa; 536 char *p; 537 u_char *q; 538 int i; 539 540 if (args[sc->offset] == 0) { 541 asprintf(&tmp, "NULL"); 542 break; 543 } 544 545 /* yuck: get ss_len */ 546 if (get_struct(fd, (void *)args[sc->offset], (void *)&ss, 547 sizeof(ss.ss_len) + sizeof(ss.ss_family)) == -1) 548 err(1, "get_struct %p", (void *)args[sc->offset]); 549 /* sockaddr_un never have the length filled in! */ 550 if (ss.ss_family == AF_UNIX) { 551 if (get_struct(fd, (void *)args[sc->offset], (void *)&ss, 552 sizeof(*sun)) 553 == -1) 554 err(2, "get_struct %p", (void *)args[sc->offset]); 555 } else { 556 if (get_struct(fd, (void *)args[sc->offset], (void *)&ss, ss.ss_len) 557 == -1) 558 err(2, "get_struct %p", (void *)args[sc->offset]); 559 } 560 561 switch (ss.ss_family) { 562 case AF_INET: 563 lsin = (struct sockaddr_in *)&ss; 564 inet_ntop(AF_INET, &lsin->sin_addr, addr, sizeof addr); 565 asprintf(&tmp, "{ AF_INET %s:%d }", addr, htons(lsin->sin_port)); 566 break; 567 case AF_INET6: 568 lsin6 = (struct sockaddr_in6 *)&ss; 569 inet_ntop(AF_INET6, &lsin6->sin6_addr, addr, sizeof addr); 570 asprintf(&tmp, "{ AF_INET6 [%s]:%d }", addr, htons(lsin6->sin6_port)); 571 break; 572 case AF_UNIX: 573 sun = (struct sockaddr_un *)&ss; 574 asprintf(&tmp, "{ AF_UNIX \"%s\" }", sun->sun_path); 575 break; 576 default: 577 sa = (struct sockaddr *)&ss; 578 asprintf(&tmp, "{ sa_len = %d, sa_family = %d, sa_data = {%n%*s } }", 579 (int)sa->sa_len, (int)sa->sa_family, &i, 580 6 * (int)(sa->sa_len - ((char *)&sa->sa_data - (char *)sa)), ""); 581 if (tmp != NULL) { 582 p = tmp + i; 583 for (q = (u_char *)&sa->sa_data; q < (u_char *)sa + sa->sa_len; q++) 584 p += sprintf(p, " %#02x,", *q); 585 } 586 } 587 } 588 break; 589 case Sigaction: 590 { 591 struct sigaction sa; 592 char *hand; 593 const char *h; 594 #define SA_KNOWN_FLAGS \ 595 (SA_ONSTACK | SA_RESTART | SA_RESETHAND | SA_NOCLDSTOP | SA_NODEFER | \ 596 SA_NOCLDWAIT | SA_SIGINFO | SA_USERTRAMP) 597 598 599 if (get_struct(fd, (void *)args[sc->offset], &sa, sizeof(sa)) != -1) { 600 601 asprintf(&hand, "%p", sa.sa_handler); 602 if (sa.sa_handler == SIG_DFL) 603 h = "SIG_DFL"; 604 else if (sa.sa_handler == SIG_IGN) 605 h = "SIG_IGN"; 606 else 607 h = hand; 608 asprintf(&tmp, "{ %s 0x%x%s%s%s%s%s%s%s%s ss_t }", 609 h, 610 sa.sa_flags & ~SA_KNOWN_FLAGS, 611 sa.sa_flags & SA_ONSTACK ? "" : "|ONSTACK", 612 sa.sa_flags & SA_RESTART ? "" : "|RESTART", 613 sa.sa_flags & SA_RESETHAND ? "" : "|RESETHAND", 614 sa.sa_flags & SA_NOCLDSTOP ? "" : "|NOCLDSTOP", 615 sa.sa_flags & SA_NODEFER ? "" : "|NODEFER", 616 sa.sa_flags & SA_NOCLDWAIT ? "" : "|NOCLDWAIT", 617 sa.sa_flags & SA_SIGINFO ? "" : "|SIGINFO", 618 sa.sa_flags & SA_USERTRAMP ? "" : "|USERTRAMP"); 619 free(hand); 620 } else 621 asprintf(&tmp, "0x%lx", args[sc->offset]); 622 623 } 624 break; 625 } 626 return tmp; 627 } 628 629 #define timespecsubt(tvp, uvp, vvp) \ 630 do { \ 631 (vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec; \ 632 (vvp)->tv_nsec = (tvp)->tv_nsec - (uvp)->tv_nsec; \ 633 if ((vvp)->tv_nsec < 0) { \ 634 (vvp)->tv_sec--; \ 635 (vvp)->tv_nsec += 1000000000; \ 636 } \ 637 } while (0) 638 639 /* 640 * print_syscall 641 * Print (to outfile) the system call and its arguments. Note that 642 * nargs is the number of arguments (not the number of words; this is 643 * potentially confusing, I know). 644 */ 645 646 void 647 print_syscall(struct trussinfo *trussinfo, const char *name, int nargs, char **s_args) { 648 int i; 649 int len = 0; 650 struct timespec timediff; 651 652 if (trussinfo->flags & FOLLOWFORKS) 653 len += fprintf(trussinfo->outfile, "%5d: ", trussinfo->pid); 654 655 if (name != NULL && (!strcmp(name, "execve") || !strcmp(name, "exit"))) { 656 clock_gettime(CLOCK_REALTIME, &trussinfo->after); 657 } 658 659 if (trussinfo->flags & ABSOLUTETIMESTAMPS) { 660 timespecsubt(&trussinfo->after, &trussinfo->start_time, &timediff); 661 len += fprintf(trussinfo->outfile, "%ld.%09ld ", 662 (long)timediff.tv_sec, timediff.tv_nsec); 663 } 664 665 if (trussinfo->flags & RELATIVETIMESTAMPS) { 666 timespecsubt(&trussinfo->after, &trussinfo->before, &timediff); 667 len += fprintf(trussinfo->outfile, "%ld.%09ld ", 668 (long)timediff.tv_sec, timediff.tv_nsec); 669 } 670 671 len += fprintf(trussinfo->outfile, "%s(", name); 672 673 for (i = 0; i < nargs; i++) { 674 if (s_args[i]) 675 len += fprintf(trussinfo->outfile, "%s", s_args[i]); 676 else 677 len += fprintf(trussinfo->outfile, "<missing argument>"); 678 len += fprintf(trussinfo->outfile, "%s", i < (nargs - 1) ? "," : ""); 679 } 680 len += fprintf(trussinfo->outfile, ")"); 681 for (i = 0; i < 6 - (len / 8); i++) 682 fprintf(trussinfo->outfile, "\t"); 683 } 684 685 void 686 print_syscall_ret(struct trussinfo *trussinfo, const char *name, int nargs, 687 char **s_args, int errorp, long retval) 688 { 689 print_syscall(trussinfo, name, nargs, s_args); 690 if (errorp) { 691 fprintf(trussinfo->outfile, " ERR#%ld '%s'\n", retval, strerror(retval)); 692 } else { 693 fprintf(trussinfo->outfile, " = %ld (0x%lx)\n", retval, retval); 694 } 695 } 696