2 * Copyright (c) 1991, 1992 Paul Kranenburg <pk@cs.few.eur.nl>
3 * Copyright (c) 1993 Branko Lankester <branko@hacktic.nl>
4 * Copyright (c) 1993, 1994, 1995, 1996 Rick Sladkey <jrs@world.std.com>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
42 #ifdef _LARGEFILE64_SOURCE
43 /* This is the macro everything checks before using foo64 names. */
44 # ifndef _LFS64_LARGEFILE
45 # define _LFS64_LARGEFILE 1
49 /* Configuration section */
52 # define MAX_QUALS 7000 /* maximum number of syscalls, signals, etc. */
54 # define MAX_QUALS 2048 /* maximum number of syscalls, signals, etc. */
57 #ifndef DEFAULT_STRLEN
58 /* default maximum # of bytes printed in `printstr', change with -s switch */
59 # define DEFAULT_STRLEN 32
61 #ifndef DEFAULT_ACOLUMN
62 # define DEFAULT_ACOLUMN 40 /* default alignment column for results */
65 /* Maximum number of args to a syscall.
67 * Make sure that all entries in all syscallent.h files have nargs <= MAX_ARGS!
68 * linux/<ARCH>/syscallent.h: all have nargs <= 6.
74 #ifndef DEFAULT_SORTBY
75 # define DEFAULT_SORTBY "time" /* default sorting method for call profiling */
78 #include <sys/types.h>
94 #endif /* STDC_HEADERS */
100 #if defined(SPARC) || defined(SPARC64)
103 #if defined(MIPS) && _MIPS_SIM == _MIPS_SIM_ABI32
104 # define LINUX_MIPSO32
106 #if defined(MIPS) && _MIPS_SIM == _MIPS_SIM_NABI32
107 # define LINUX_MIPSN32
108 # define LINUX_MIPS64
110 #if defined(MIPS) && _MIPS_SIM == _MIPS_SIM_ABI64
111 # define LINUX_MIPSN64
112 # define LINUX_MIPS64
115 #if (defined(LINUXSPARC) || defined(X86_64) || defined(ARM) || defined(AVR32)) && defined(__GLIBC__)
116 # include <sys/ptrace.h>
118 /* Work around awkward prototype in ptrace.h. */
119 # define ptrace xptrace
120 # include <sys/ptrace.h>
124 # include <asm/ptrace.h>
127 extern long ptrace(int, int, char *, long);
130 #if !defined(__GLIBC__)
131 # define PTRACE_PEEKUSER PTRACE_PEEKUSR
132 # define PTRACE_POKEUSER PTRACE_POKEUSR
134 #if defined(X86_64) || defined(I386)
135 /* For struct pt_regs. x86 strace uses PTRACE_GETREGS.
136 * PTRACE_GETREGS returns registers in the layout of this struct.
138 # include <asm/ptrace.h>
155 # define PT_GR20 (20*4)
156 # define PT_GR26 (26*4)
157 # define PT_GR28 (28*4)
158 # define PT_IAOQ0 (106*4)
159 # define PT_IAOQ1 (107*4)
162 /* SH64 Linux - this code assumes the following kernel API for system calls:
164 System Call Offset 16 (actually, (syscall no.) | (0x1n << 16),
165 where n = no. of parameters.
166 Other regs Offset 24+
168 On entry: R2-7 = parameters 1-6 (as many as necessary)
169 On return: R9 = result. */
171 /* Offset for peeks of registers */
172 # define REG_OFFSET (24)
173 # define REG_GENERAL(x) (8*(x)+REG_OFFSET)
174 # define REG_PC (0*8)
175 # define REG_SYSCALL (2*8)
178 #define SUPPORTED_PERSONALITIES 1
179 #define DEFAULT_PERSONALITY 0
182 /* Indexes into the pt_regs.u_reg[] array -- UREG_XX from kernel are all off
183 * by 1 and use Ix instead of Ox. These work for both 32 and 64 bit Linux. */
187 # define PERSONALITY0_WORDSIZE 4
188 # define PERSONALITY1_WORDSIZE 4
189 # undef SUPPORTED_PERSONALITIES
190 # if defined(SPARC64)
191 # include <asm/psrcompat.h>
192 # define SUPPORTED_PERSONALITIES 3
193 # define PERSONALITY2_WORDSIZE 8
195 # include <asm/psr.h>
196 # define SUPPORTED_PERSONALITIES 2
197 # endif /* SPARC64 */
198 #endif /* LINUXSPARC */
201 # undef SUPPORTED_PERSONALITIES
202 # define SUPPORTED_PERSONALITIES 2
203 # define PERSONALITY0_WORDSIZE 8
204 # define PERSONALITY1_WORDSIZE 4
208 # undef SUPPORTED_PERSONALITIES
209 # define SUPPORTED_PERSONALITIES 2
210 # define PERSONALITY0_WORDSIZE 4
211 # define PERSONALITY1_WORDSIZE 4
215 # undef SUPPORTED_PERSONALITIES
216 # define SUPPORTED_PERSONALITIES 2
217 # define PERSONALITY0_WORDSIZE 8
218 # define PERSONALITY1_WORDSIZE 4
221 #if !HAVE_DECL_PTRACE_SETOPTIONS
222 # define PTRACE_SETOPTIONS 0x4200
224 #if !HAVE_DECL_PTRACE_GETEVENTMSG
225 # define PTRACE_GETEVENTMSG 0x4201
227 #if !HAVE_DECL_PTRACE_GETSIGINFO
228 # define PTRACE_GETSIGINFO 0x4202
231 #if !HAVE_DECL_PTRACE_O_TRACESYSGOOD
232 # define PTRACE_O_TRACESYSGOOD 0x00000001
234 #if !HAVE_DECL_PTRACE_O_TRACEFORK
235 # define PTRACE_O_TRACEFORK 0x00000002
237 #if !HAVE_DECL_PTRACE_O_TRACEVFORK
238 # define PTRACE_O_TRACEVFORK 0x00000004
240 #if !HAVE_DECL_PTRACE_O_TRACECLONE
241 # define PTRACE_O_TRACECLONE 0x00000008
243 #if !HAVE_DECL_PTRACE_O_TRACEEXEC
244 # define PTRACE_O_TRACEEXEC 0x00000010
246 #if !HAVE_DECL_PTRACE_O_TRACEEXIT
247 # define PTRACE_O_TRACEEXIT 0x00000040
250 #if !HAVE_DECL_PTRACE_EVENT_FORK
251 # define PTRACE_EVENT_FORK 1
253 #if !HAVE_DECL_PTRACE_EVENT_VFORK
254 # define PTRACE_EVENT_VFORK 2
256 #if !HAVE_DECL_PTRACE_EVENT_CLONE
257 # define PTRACE_EVENT_CLONE 3
259 #if !HAVE_DECL_PTRACE_EVENT_EXEC
260 # define PTRACE_EVENT_EXEC 4
262 #if !HAVE_DECL_PTRACE_EVENT_VFORK_DONE
263 # define PTRACE_EVENT_VFORK_DONE 5
265 #if !HAVE_DECL_PTRACE_EVENT_EXIT
266 # define PTRACE_EVENT_EXIT 6
269 /* Experimental code using PTRACE_SEIZE can be enabled here: */
270 //# define USE_SEIZE 1
274 # define PTRACE_SEIZE 0x4206
275 # undef PTRACE_INTERRUPT
276 # define PTRACE_INTERRUPT 0x4207
277 # undef PTRACE_LISTEN
278 # define PTRACE_LISTEN 0x4208
279 # undef PTRACE_SEIZE_DEVEL
280 # define PTRACE_SEIZE_DEVEL 0x80000000
281 # undef PTRACE_EVENT_STOP
282 # define PTRACE_EVENT_STOP 7
283 # define PTRACE_EVENT_STOP1 128
286 #if !defined __GNUC__
287 # define __attribute__(x) /*nothing*/
290 #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
293 extern struct pt_regs i386_regs;
296 /* Trace Control Block */
298 int flags; /* See below for TCB_ values */
299 int pid; /* Process Id of this entry */
300 int u_nargs; /* System call argument count */
301 int u_error; /* Error code */
302 long scno; /* System call number */
303 long u_arg[MAX_ARGS]; /* System call arguments */
304 #if defined(LINUX_MIPSN32)
305 long long ext_arg[MAX_ARGS]; /* System call arguments */
307 long u_rval; /* (first) return value */
308 #ifdef HAVE_LONG_LONG
309 long long u_lrval; /* long long return value */
312 #if SUPPORTED_PERSONALITIES > 1
313 int currpers; /* Personality at the time of scno update */
315 int curcol; /* Output column for this process */
316 FILE *outf; /* Output file for this process */
317 const char *auxstr; /* Auxiliary info from syscall (see RVAL_STR) */
318 struct timeval stime; /* System time usage as of last process wait */
319 struct timeval dtime; /* Delta for system time usage */
320 struct timeval etime; /* Syscall entry time */
321 /* Support for tracing forked processes */
322 long baddr; /* `Breakpoint' address */
323 long inst[2]; /* Instructions on above */
327 #define TCB_INUSE 00001 /* This table entry is in use */
328 /* We have attached to this process, but did not see it stopping yet.
329 * (If this bit is not set, we either didn't attach yet,
330 * or we did attach to it, already saw it stopping at least once,
331 * did some init work on it and cleared this bit. TODO: maybe it makes sense
332 * to split these two states?)
334 #define TCB_STARTUP 00002
335 #define TCB_IGNORE_ONE_SIGSTOP 00004 /* Next SIGSTOP is to be ignored */
337 * Are we in system call entry or in syscall exit?
339 * This bit is set after all syscall entry processing is done.
340 * Therefore, this bit will be set when next ptrace stop occurs,
341 * which should be syscall exit stop. Other stops which are possible
342 * directly after syscall entry (death, ptrace event stop)
343 * are simpler and handled without calling trace_syscall(), therefore
344 * the places where TCB_INSYSCALL can be set but we aren't in syscall stop
345 * are limited to trace(), this condition is never observed in trace_syscall()
347 * The bit is cleared after all syscall exit processing is done.
348 * User-generated SIGTRAPs and post-execve SIGTRAP make it necessary
349 * to be very careful and NOT set TCB_INSYSCALL bit when they are encountered.
350 * TCB_WAITEXECVE bit is used for this purpose (see below).
352 * Use entering(tcp) / exiting(tcp) to check this bit to make code more readable.
354 #define TCB_INSYSCALL 00010
355 #define TCB_ATTACHED 00020 /* It is attached already */
356 /* Are we PROG from "strace PROG [ARGS]" invocation? */
357 #define TCB_STRACE_CHILD 00040
358 #define TCB_BPTSET 00100 /* "Breakpoint" set after fork(2) */
359 #define TCB_REPRINT 01000 /* We should reprint this syscall on exit */
360 #define TCB_FILTERED 02000 /* This system call has been filtered out */
361 /* x86 does not need TCB_WAITEXECVE.
362 * It can detect SIGTRAP by looking at eax/rax.
363 * See "not a syscall entry (eax = %ld)\n" message
364 * in syscall_fixup_on_sysenter().
366 #if defined(ALPHA) || defined(AVR32) || defined(SPARC) || defined(SPARC64) \
367 || defined(POWERPC) || defined(IA64) || defined(HPPA) \
368 || defined(SH) || defined(SH64) || defined(S390) || defined(S390X) \
369 || defined(ARM) || defined(MIPS) || defined(BFIN) || defined(TILE)
370 /* This tracee has entered into execve syscall. Expect post-execve SIGTRAP
371 * to happen. (When it is detected, tracee is continued and this bit is cleared.)
373 # define TCB_WAITEXECVE 04000
375 #include <sys/syscall.h>
377 /* qualifier flags */
378 #define QUAL_TRACE 0001 /* this system call should be traced */
379 #define QUAL_ABBREV 0002 /* abbreviate the structures of this syscall */
380 #define QUAL_VERBOSE 0004 /* decode the structures of this syscall */
381 #define QUAL_RAW 0010 /* print all args in hex for this syscall */
382 #define QUAL_SIGNAL 0020 /* report events with this signal */
383 #define QUAL_FAULT 0040 /* report events with this fault */
384 #define QUAL_READ 0100 /* dump data read on this file descriptor */
385 #define QUAL_WRITE 0200 /* dump data written to this file descriptor */
387 #define entering(tcp) (!((tcp)->flags & TCB_INSYSCALL))
388 #define exiting(tcp) ((tcp)->flags & TCB_INSYSCALL)
389 #define syserror(tcp) ((tcp)->u_error != 0)
390 #define verbose(tcp) (qual_flags[(tcp)->scno] & QUAL_VERBOSE)
391 #define abbrev(tcp) (qual_flags[(tcp)->scno] & QUAL_ABBREV)
392 #define filtered(tcp) ((tcp)->flags & TCB_FILTERED)
399 extern const struct xlat open_mode_flags[];
400 extern const struct xlat addrfams[];
401 extern const struct xlat struct_user_offsets[];
402 extern const struct xlat open_access_modes[];
404 /* Format of syscall return values */
405 #define RVAL_DECIMAL 000 /* decimal format */
406 #define RVAL_HEX 001 /* hex format */
407 #define RVAL_OCTAL 002 /* octal format */
408 #define RVAL_UDECIMAL 003 /* unsigned decimal format */
409 #define RVAL_LDECIMAL 004 /* long decimal format */
410 #define RVAL_LHEX 005 /* long hex format */
411 #define RVAL_LOCTAL 006 /* long octal format */
412 #define RVAL_LUDECIMAL 007 /* long unsigned decimal format */
413 #define RVAL_MASK 007 /* mask for these values */
415 #define RVAL_STR 010 /* Print `auxstr' field after return val */
416 #define RVAL_NONE 020 /* Print nothing */
419 # define offsetof(type, member) (((char *) &(((type *) NULL)->member)) - \
420 ((char *) (type *) NULL))
423 /* get offset of member within a user struct */
424 #define uoff(member) offsetof(struct user, member)
426 #define TRACE_FILE 001 /* Trace file-related syscalls. */
427 #define TRACE_IPC 002 /* Trace IPC-related syscalls. */
428 #define TRACE_NETWORK 004 /* Trace network-related syscalls. */
429 #define TRACE_PROCESS 010 /* Trace process-related syscalls. */
430 #define TRACE_SIGNAL 020 /* Trace signal-related syscalls. */
431 #define TRACE_DESC 040 /* Trace file descriptor-related syscalls. */
432 #define SYSCALL_NEVER_FAILS 0100 /* Syscall is always successful. */
440 extern int *qual_flags;
441 extern int debug, followfork;
442 extern unsigned int ptrace_setoptions;
443 extern int dtime, xflag, qflag;
444 extern cflag_t cflag;
445 extern int max_strlen;
446 enum bitness_t { BITNESS_CURRENT = 0, BITNESS_32 };
448 void error_msg(const char *fmt, ...) __attribute__ ((format(printf, 1, 2)));
449 void perror_msg(const char *fmt, ...) __attribute__ ((format(printf, 1, 2)));
450 void error_msg_and_die(const char *fmt, ...) __attribute__ ((noreturn, format(printf, 1, 2)));
451 void perror_msg_and_die(const char *fmt, ...) __attribute__ ((noreturn, format(printf, 1, 2)));
452 void die_out_of_memory(void) __attribute__ ((noreturn));
454 extern void set_personality(int personality);
455 extern const char *xlookup(const struct xlat *, int);
456 extern struct tcb *alloc_tcb(int, int);
457 extern void droptcb(struct tcb *);
459 #define alloctcb(pid) alloc_tcb((pid), 1)
461 extern void set_sortby(const char *);
462 extern void set_overhead(int);
463 extern void qualify(const char *);
464 extern int ptrace_restart(int request, struct tcb *tcp, int sig);
465 extern int trace_syscall(struct tcb *);
466 extern void count_syscall(struct tcb *, struct timeval *);
467 extern void printxval(const struct xlat *, int, const char *);
468 extern int printargs(struct tcb *);
469 extern int printargs_lu(struct tcb *);
470 extern int printargs_ld(struct tcb *);
471 extern void addflags(const struct xlat *, int);
472 extern int printflags(const struct xlat *, int, const char *);
473 extern const char *sprintflags(const char *, const struct xlat *, int);
474 extern int umoven(struct tcb *, long, int, char *);
475 extern int umovestr(struct tcb *, long, int, char *);
476 extern int upeek(struct tcb *, long, long *);
477 extern void dumpiov(struct tcb *, int, long);
478 extern void dumpstr(struct tcb *, long, int);
479 extern void printstr(struct tcb *, long, int);
480 extern void printnum(struct tcb *, long, const char *);
481 extern void printnum_int(struct tcb *, long, const char *);
482 extern void printpath(struct tcb *, long);
483 extern void printpathn(struct tcb *, long, int);
484 #define TIMESPEC_TEXT_BUFSIZE (sizeof(long)*3 * 2 + sizeof("{%u, %u}"))
485 #define TIMEVAL_TEXT_BUFSIZE TIMESPEC_TEXT_BUFSIZE
486 extern void printtv_bitness(struct tcb *, long, enum bitness_t, int);
487 extern char *sprinttv(char *, struct tcb *, long, enum bitness_t, int special);
488 extern void print_timespec(struct tcb *, long);
489 extern void sprint_timespec(char *, struct tcb *, long);
490 #ifdef HAVE_SIGINFO_T
491 extern void printsiginfo(siginfo_t *, int);
493 extern const char *getfdpath(struct tcb *, int);
494 extern void printfd(struct tcb *, int);
495 extern void printsock(struct tcb *, long, int);
496 extern void print_sock_optmgmt(struct tcb *, long, int);
497 extern void printrusage(struct tcb *, long);
499 extern void printrusage32(struct tcb *, long);
501 extern void printuid(const char *, unsigned long);
502 extern int clearbpt(struct tcb *);
504 * On Linux, "setbpt" is a misnomer: we don't set a breakpoint
505 * (IOW: no poking in user's text segment),
506 * instead we change fork/vfork/clone into clone(CLONE_PTRACE).
507 * On newer kernels, we use PTRACE_O_TRACECLONE/TRACE[V]FORK instead.
509 extern int setbpt(struct tcb *);
510 extern void printcall(struct tcb *);
511 extern const char *signame(int);
512 extern void print_sigset(struct tcb *, long, int);
513 extern void printsignal(int);
516 extern void call_summary(FILE *);
517 extern void tprint_iov(struct tcb *, unsigned long, unsigned long, int decode_iov);
518 extern void tprint_open_modes(mode_t);
519 extern const char *sprint_open_modes(mode_t);
520 extern int is_restart_error(struct tcb *);
522 extern int pathtrace_select(const char *);
523 extern int pathtrace_match(struct tcb *);
525 extern int change_syscall(struct tcb *, int);
526 extern int internal_fork(struct tcb *);
527 extern int internal_exec(struct tcb *);
529 extern const struct ioctlent *ioctl_lookup(long);
530 extern const struct ioctlent *ioctl_next_match(const struct ioctlent *);
531 extern int ioctl_decode(struct tcb *, long, long);
532 extern int term_ioctl(struct tcb *, long, long);
533 extern int sock_ioctl(struct tcb *, long, long);
534 extern int proc_ioctl(struct tcb *, int, int);
535 extern int rtc_ioctl(struct tcb *, long, long);
536 extern int scsi_ioctl(struct tcb *, long, long);
537 extern int block_ioctl(struct tcb *, long, long);
539 extern int tv_nz(struct timeval *);
540 extern int tv_cmp(struct timeval *, struct timeval *);
541 extern double tv_float(struct timeval *);
542 extern void tv_add(struct timeval *, struct timeval *, struct timeval *);
543 extern void tv_sub(struct timeval *, struct timeval *, struct timeval *);
544 extern void tv_mul(struct timeval *, struct timeval *, int);
545 extern void tv_div(struct timeval *, struct timeval *, int);
547 #if !defined HAVE_STPCPY
548 /* Some libc have stpcpy, some don't. Sigh...
549 * Roll our private implementation...
552 #define stpcpy strace_stpcpy
553 extern char *stpcpy(char *dst, const char *src);
556 #if defined(SPARC) || defined(SPARC64) || defined(IA64) || defined(SH)
557 extern long getrval2(struct tcb *);
560 /* Strace log generation machinery.
562 * printing_tcp: tcb which has incomplete line being printed right now.
563 * NULL if last line has been completed ('\n'-terminated).
564 * printleader(tcp) examines it, finishes incomplete line if needed,
565 * the sets it to tcp.
566 * line_ended() clears printing_tcp and resets ->curcol = 0.
567 * tcp->curcol == 0 check is also used to detect completeness
568 * of last line, since in -ff mode just checking printing_tcp for NULL
571 * If you change this code, test log generation in both -f and -ff modes
573 * strace -oLOG -f[f] test/threaded_execve
574 * strace -oLOG -f[f] test/sigkill_rain
575 * strace -oLOG -f[f] -p "`pidof web_browser`"
577 extern struct tcb *printing_tcp;
578 extern void printleader(struct tcb *);
579 extern void line_ended(void);
580 extern void tabto(void);
581 extern void tprintf(const char *fmt, ...) __attribute__ ((format (printf, 1, 2)));
582 extern void tprints(const char *str);
584 #define umove(pid, addr, objp) \
585 umoven((pid), (addr), sizeof *(objp), (char *) (objp))
587 #define printtv(tcp, addr) \
588 printtv_bitness((tcp), (addr), BITNESS_CURRENT, 0)
589 #define printtv_special(tcp, addr) \
590 printtv_bitness((tcp), (addr), BITNESS_CURRENT, 1)
592 #ifndef HAVE_STRERROR
593 const char *strerror(int);
595 #ifndef HAVE_STRSIGNAL
596 const char *strsignal(int);
599 extern int current_personality;
600 extern const int personality_wordsize[];
606 const char *sys_name;
615 extern const struct sysent *sysent;
616 extern unsigned nsyscalls;
617 extern const char *const *errnoent;
618 extern unsigned nerrnos;
619 extern const struct ioctlent *ioctlent;
620 extern unsigned nioctlents;
621 extern const char *const *signalent;
622 extern unsigned nsignals;
624 #define SCNO_IN_RANGE(scno) \
625 ((unsigned long)(scno) < nsyscalls && sysent[scno].sys_func)
629 /* _l refers to the lower numbered u_arg,
630 * _h refers to the higher numbered u_arg
633 #if HAVE_LITTLE_ENDIAN_LONG_LONG
634 #define LONG_LONG(_l,_h) \
635 ((long long)((unsigned long long)(unsigned)(_l) | ((unsigned long long)(_h)<<32)))
637 #define LONG_LONG(_l,_h) \
638 ((long long)((unsigned long long)(unsigned)(_h) | ((unsigned long long)(_l)<<32)))
641 extern int printllval(struct tcb *, const char *, int);
648 extern int not_failing_only;
649 extern int show_fd_path;
650 extern int tracing_paths;