2 * This file is part of ltrace.
3 * Copyright (C) 2011,2012 Petr Machata, Red Hat Inc.
4 * Copyright (C) 2010 Arnaud Patard, Mandriva SA
5 * Copyright (C) 1998,2001,2002,2003,2004,2007,2008,2009 Juan Cespedes
6 * Copyright (C) 2008 Luis Machado, IBM Corporation
7 * Copyright (C) 2006 Ian Wienand
8 * Copyright (C) 2006 Paul Gilliam, IBM Corporation
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
38 #include "breakpoint.h"
43 #include "value_dict.h"
45 static void handle_signal(Event *event);
46 static void handle_exit(Event *event);
47 static void handle_exit_signal(Event *event);
48 static void handle_syscall(Event *event);
49 static void handle_arch_syscall(Event *event);
50 static void handle_sysret(Event *event);
51 static void handle_arch_sysret(Event *event);
52 static void handle_clone(Event *event);
53 static void handle_exec(Event *event);
54 static void handle_breakpoint(Event *event);
55 static void handle_new(Event *event);
57 static void callstack_push_syscall(Process *proc, int sysnum);
58 static void callstack_push_symfunc(Process *proc,
59 struct library_symbol *sym);
60 /* XXX Stack maintenance should be moved to a dedicated module, or to
61 * proc.c, and push/pop should be visible outside this module. For
62 * now, because we need this in proc.c, this is non-static. */
63 void callstack_pop(struct Process *proc);
65 static char * shortsignal(Process *proc, int signum);
66 static char * sysname(Process *proc, int sysnum);
67 static char * arch_sysname(Process *proc, int sysnum);
70 call_handler(Process * proc, Event * event)
74 struct event_handler *handler = proc->event_handler;
78 return (*handler->on_event) (handler, event);
82 handle_event(Event *event)
85 debug(1, "ltrace about to exit");
89 debug(DEBUG_FUNCTION, "handle_event(pid=%d, type=%d)",
90 event->proc ? event->proc->pid : -1, event->type);
92 /* If the thread group or an individual task define an
93 overriding event handler, give them a chance to kick in.
94 We will end up calling both handlers, if the first one
95 doesn't sink the event. */
96 if (event->proc != NULL) {
97 event = call_handler(event->proc, event);
102 /* Note: the previous handler has a chance to alter
104 if (event->proc != NULL
105 && event->proc->leader != NULL
106 && event->proc != event->proc->leader) {
107 event = call_handler(event->proc->leader, event);
113 switch (event->type) {
115 debug(1, "event: none");
118 debug(1, "[%d] event: signal (%s [%d])",
120 shortsignal(event->proc, event->e_un.signum),
122 handle_signal(event);
125 debug(1, "[%d] event: exit (%d)",
127 event->e_un.ret_val);
130 case EVENT_EXIT_SIGNAL:
131 debug(1, "[%d] event: exit signal (%s [%d])",
133 shortsignal(event->proc, event->e_un.signum),
135 handle_exit_signal(event);
138 debug(1, "[%d] event: syscall (%s [%d])",
140 sysname(event->proc, event->e_un.sysnum),
142 handle_syscall(event);
145 debug(1, "[%d] event: sysret (%s [%d])",
147 sysname(event->proc, event->e_un.sysnum),
149 handle_sysret(event);
151 case EVENT_ARCH_SYSCALL:
152 debug(1, "[%d] event: arch_syscall (%s [%d])",
154 arch_sysname(event->proc, event->e_un.sysnum),
156 handle_arch_syscall(event);
158 case EVENT_ARCH_SYSRET:
159 debug(1, "[%d] event: arch_sysret (%s [%d])",
161 arch_sysname(event->proc, event->e_un.sysnum),
163 handle_arch_sysret(event);
167 debug(1, "[%d] event: clone (%u)",
168 event->proc->pid, event->e_un.newpid);
172 debug(1, "[%d] event: exec()",
176 case EVENT_BREAKPOINT:
177 debug(1, "[%d] event: breakpoint %p",
178 event->proc->pid, event->e_un.brk_addr);
179 handle_breakpoint(event);
182 debug(1, "[%d] event: new process",
187 fprintf(stderr, "Error! unknown event?\n");
192 typedef struct Pending_New Pending_New;
197 static Pending_New * pending_news = NULL;
200 pending_new(pid_t pid) {
203 debug(DEBUG_FUNCTION, "pending_new(%d)", pid);
216 pending_new_insert(pid_t pid) {
219 debug(DEBUG_FUNCTION, "pending_new_insert(%d)", pid);
221 p = malloc(sizeof(Pending_New));
227 p->next = pending_news;
232 pending_new_remove(pid_t pid) {
233 Pending_New *p, *pred;
235 debug(DEBUG_FUNCTION, "pending_new_remove(%d)", pid);
240 pending_news = p->next;
245 pred->next = p->next;
255 handle_clone(Event *event)
257 debug(DEBUG_FUNCTION, "handle_clone(pid=%d)", event->proc->pid);
259 struct Process *proc = malloc(sizeof(*proc));
264 "Error during init of tracing process %d\n"
265 "This process won't be traced.\n",
270 if (process_clone(proc, event->proc, event->e_un.newpid) < 0)
272 proc->parent = event->proc;
274 /* We save register values to the arch pointer, and these need
276 proc->arch_ptr = NULL;
278 if (pending_new(proc->pid)) {
279 pending_new_remove(proc->pid);
280 /* XXX this used to be destroy_event_handler call, but
281 * I don't think we want to call that on a shared
283 proc->event_handler = NULL;
284 if (event->proc->state == STATE_ATTACHED && options.follow)
285 proc->state = STATE_ATTACHED;
287 proc->state = STATE_IGNORED;
288 continue_process(proc->pid);
290 proc->state = STATE_BEING_CREATED;
293 if (event->type == EVENT_VFORK)
294 continue_after_vfork(proc);
296 continue_process(event->proc->pid);
300 handle_new(Event * event) {
303 debug(DEBUG_FUNCTION, "handle_new(pid=%d)", event->e_un.newpid);
305 proc = pid2proc(event->e_un.newpid);
307 pending_new_insert(event->e_un.newpid);
309 assert(proc->state == STATE_BEING_CREATED);
310 if (options.follow) {
311 proc->state = STATE_ATTACHED;
313 proc->state = STATE_IGNORED;
315 continue_process(proc->pid);
320 shortsignal(Process *proc, int signum) {
321 static char *signalent0[] = {
322 #include "signalent.h"
324 static char *signalent1[] = {
325 #include "signalent1.h"
327 static char **signalents[] = { signalent0, signalent1 };
328 int nsignals[] = { sizeof signalent0 / sizeof signalent0[0],
329 sizeof signalent1 / sizeof signalent1[0]
332 debug(DEBUG_FUNCTION, "shortsignal(pid=%d, signum=%d)", proc->pid, signum);
334 if (proc->personality > sizeof signalents / sizeof signalents[0])
336 if (signum < 0 || signum >= nsignals[proc->personality]) {
337 return "UNKNOWN_SIGNAL";
339 return signalents[proc->personality][signum];
344 sysname(Process *proc, int sysnum) {
345 static char result[128];
346 static char *syscalent0[] = {
347 #include "syscallent.h"
349 static char *syscalent1[] = {
350 #include "syscallent1.h"
352 static char **syscalents[] = { syscalent0, syscalent1 };
353 int nsyscals[] = { sizeof syscalent0 / sizeof syscalent0[0],
354 sizeof syscalent1 / sizeof syscalent1[0]
357 debug(DEBUG_FUNCTION, "sysname(pid=%d, sysnum=%d)", proc->pid, sysnum);
359 if (proc->personality > sizeof syscalents / sizeof syscalents[0])
361 if (sysnum < 0 || sysnum >= nsyscals[proc->personality]) {
362 sprintf(result, "SYS_%d", sysnum);
365 sprintf(result, "SYS_%s",
366 syscalents[proc->personality][sysnum]);
372 arch_sysname(Process *proc, int sysnum) {
373 static char result[128];
374 static char *arch_syscalent[] = {
375 #include "arch_syscallent.h"
377 int nsyscals = sizeof arch_syscalent / sizeof arch_syscalent[0];
379 debug(DEBUG_FUNCTION, "arch_sysname(pid=%d, sysnum=%d)", proc->pid, sysnum);
381 if (sysnum < 0 || sysnum >= nsyscals) {
382 sprintf(result, "ARCH_%d", sysnum);
385 sprintf(result, "ARCH_%s",
386 arch_syscalent[sysnum]);
392 handle_signal(Event *event) {
393 debug(DEBUG_FUNCTION, "handle_signal(pid=%d, signum=%d)", event->proc->pid, event->e_un.signum);
394 if (event->proc->state != STATE_IGNORED && !options.no_signals) {
395 output_line(event->proc, "--- %s (%s) ---",
396 shortsignal(event->proc, event->e_un.signum),
397 strsignal(event->e_un.signum));
399 continue_after_signal(event->proc->pid, event->e_un.signum);
403 handle_exit(Event *event) {
404 debug(DEBUG_FUNCTION, "handle_exit(pid=%d, status=%d)", event->proc->pid, event->e_un.ret_val);
405 if (event->proc->state != STATE_IGNORED) {
406 output_line(event->proc, "+++ exited (status %d) +++",
407 event->e_un.ret_val);
409 remove_process(event->proc);
413 handle_exit_signal(Event *event) {
414 debug(DEBUG_FUNCTION, "handle_exit_signal(pid=%d, signum=%d)", event->proc->pid, event->e_un.signum);
415 if (event->proc->state != STATE_IGNORED) {
416 output_line(event->proc, "+++ killed by %s +++",
417 shortsignal(event->proc, event->e_un.signum));
419 remove_process(event->proc);
423 output_syscall(struct Process *proc, const char *name, enum tof tof,
424 void (*output)(enum tof, struct Process *,
425 struct library_symbol *))
427 struct library_symbol syscall;
428 if (library_symbol_init(&syscall, 0, name, 0, LS_TOPLT_NONE) >= 0) {
429 (*output)(tof, proc, &syscall);
430 library_symbol_destroy(&syscall);
435 output_syscall_left(struct Process *proc, const char *name)
437 output_syscall(proc, name, LT_TOF_SYSCALL, &output_left);
441 output_syscall_right(struct Process *proc, const char *name)
443 output_syscall(proc, name, LT_TOF_SYSCALLR, &output_right);
447 handle_syscall(Event *event) {
448 debug(DEBUG_FUNCTION, "handle_syscall(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
449 if (event->proc->state != STATE_IGNORED) {
450 callstack_push_syscall(event->proc, event->e_un.sysnum);
451 if (options.syscalls)
452 output_syscall_left(event->proc,
454 event->e_un.sysnum));
456 continue_after_syscall(event->proc, event->e_un.sysnum, 0);
460 handle_exec(Event * event) {
461 Process * proc = event->proc;
463 /* Save the PID so that we can use it after unsuccessful
465 pid_t pid = proc->pid;
467 debug(DEBUG_FUNCTION, "handle_exec(pid=%d)", proc->pid);
468 if (proc->state == STATE_IGNORED) {
471 remove_process(proc);
474 output_line(proc, "--- Called exec() ---");
476 if (process_exec(proc) < 0) {
478 "couldn't reinitialize process %d after exec\n", pid);
482 continue_process(proc->pid);
484 /* After the exec, we expect to hit the first executable
487 * XXX TODO It would be nice to have this removed, but then we
488 * need to do that also for initial call to wait_for_proc in
489 * execute_program. In that case we could generate a
490 * EVENT_FIRST event or something, or maybe this could somehow
491 * be rolled into EVENT_NEW. */
492 wait_for_proc(proc->pid);
493 continue_process(proc->pid);
497 handle_arch_syscall(Event *event) {
498 debug(DEBUG_FUNCTION, "handle_arch_syscall(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
499 if (event->proc->state != STATE_IGNORED) {
500 callstack_push_syscall(event->proc, 0xf0000 + event->e_un.sysnum);
501 if (options.syscalls) {
502 output_syscall_left(event->proc,
503 arch_sysname(event->proc,
504 event->e_un.sysnum));
507 continue_process(event->proc->pid);
510 struct timeval current_time_spent;
513 calc_time_spent(Process *proc) {
517 struct callstack_element *elem;
519 debug(DEBUG_FUNCTION, "calc_time_spent(pid=%d)", proc->pid);
520 elem = &proc->callstack[proc->callstack_depth - 1];
522 gettimeofday(&tv, &tz);
524 diff.tv_sec = tv.tv_sec - elem->time_spent.tv_sec;
525 if (tv.tv_usec >= elem->time_spent.tv_usec) {
526 diff.tv_usec = tv.tv_usec - elem->time_spent.tv_usec;
529 diff.tv_usec = 1000000 + tv.tv_usec - elem->time_spent.tv_usec;
531 current_time_spent = diff;
535 handle_sysret(Event *event) {
536 debug(DEBUG_FUNCTION, "handle_sysret(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
537 if (event->proc->state != STATE_IGNORED) {
538 if (opt_T || options.summary) {
539 calc_time_spent(event->proc);
541 if (options.syscalls)
542 output_syscall_right(event->proc,
544 event->e_un.sysnum));
546 assert(event->proc->callstack_depth > 0);
547 unsigned d = event->proc->callstack_depth - 1;
548 assert(event->proc->callstack[d].is_syscall);
549 callstack_pop(event->proc);
551 continue_after_syscall(event->proc, event->e_un.sysnum, 1);
555 handle_arch_sysret(Event *event) {
556 debug(DEBUG_FUNCTION, "handle_arch_sysret(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
557 if (event->proc->state != STATE_IGNORED) {
558 if (opt_T || options.summary) {
559 calc_time_spent(event->proc);
561 if (options.syscalls)
562 output_syscall_right(event->proc,
563 arch_sysname(event->proc,
564 event->e_un.sysnum));
565 callstack_pop(event->proc);
567 continue_process(event->proc->pid);
571 output_right_tos(struct Process *proc)
573 size_t d = proc->callstack_depth;
574 struct callstack_element *elem = &proc->callstack[d - 1];
575 if (proc->state != STATE_IGNORED)
576 output_right(LT_TOF_FUNCTIONR, proc, elem->c_un.libfunc);
579 #ifndef ARCH_HAVE_SYMBOL_RET
580 void arch_symbol_ret(struct Process *proc, struct library_symbol *libsym)
586 handle_breakpoint(Event *event)
589 struct breakpoint *sbp;
590 Process *leader = event->proc->leader;
591 void *brk_addr = event->e_un.brk_addr;
593 /* The leader has terminated. */
594 if (leader == NULL) {
595 continue_process(event->proc->pid);
599 debug(DEBUG_FUNCTION, "handle_breakpoint(pid=%d, addr=%p)",
600 event->proc->pid, brk_addr);
601 debug(2, "event: breakpoint (%p)", brk_addr);
603 for (i = event->proc->callstack_depth - 1; i >= 0; i--) {
604 if (brk_addr == event->proc->callstack[i].return_addr) {
605 for (j = event->proc->callstack_depth - 1; j > i; j--) {
606 callstack_pop(event->proc);
608 if (event->proc->state != STATE_IGNORED) {
609 if (opt_T || options.summary) {
610 calc_time_spent(event->proc);
613 event->proc->return_addr = brk_addr;
615 struct library_symbol *libsym =
616 event->proc->callstack[i].c_un.libfunc;
618 arch_symbol_ret(event->proc, libsym);
619 output_right_tos(event->proc);
620 callstack_pop(event->proc);
622 /* Pop also any other entries that seem like
623 * they are linked to the current one: they
624 * have the same return address, but were made
625 * for different symbols. This should only
626 * happen for entry point tracing, i.e. for -x
627 * everywhere, or -x and -e on MIPS. */
628 while (event->proc->callstack_depth > 0) {
629 struct callstack_element *prev;
630 size_t d = event->proc->callstack_depth;
631 prev = &event->proc->callstack[d - 1];
633 if (prev->c_un.libfunc == libsym
634 || prev->return_addr != brk_addr)
637 arch_symbol_ret(event->proc,
639 output_right_tos(event->proc);
640 callstack_pop(event->proc);
643 /* Maybe the previous callstack_pop's got rid
644 * of the breakpoint, but if we are in a
645 * recursive call, it's still enabled. In
646 * that case we need to skip it properly. */
647 if ((sbp = address2bpstruct(leader, brk_addr)) != NULL) {
648 continue_after_breakpoint(event->proc, sbp);
650 set_instruction_pointer(event->proc, brk_addr);
651 continue_process(event->proc->pid);
657 if ((sbp = address2bpstruct(leader, brk_addr)) != NULL)
658 breakpoint_on_hit(sbp, event->proc);
659 else if (event->proc->state != STATE_IGNORED)
660 output_line(event->proc,
661 "unexpected breakpoint at %p", brk_addr);
663 /* breakpoint_on_hit may delete its own breakpoint, so we have
664 * to look it up again. */
665 if ((sbp = address2bpstruct(leader, brk_addr)) != NULL) {
666 if (event->proc->state != STATE_IGNORED
667 && sbp->libsym != NULL) {
668 event->proc->stack_pointer = get_stack_pointer(event->proc);
669 event->proc->return_addr =
670 get_return_addr(event->proc, event->proc->stack_pointer);
671 callstack_push_symfunc(event->proc, sbp->libsym);
672 output_left(LT_TOF_FUNCTION, event->proc, sbp->libsym);
675 breakpoint_on_continue(sbp, event->proc);
678 set_instruction_pointer(event->proc, brk_addr);
681 continue_process(event->proc->pid);
685 callstack_push_syscall(Process *proc, int sysnum) {
686 struct callstack_element *elem;
688 debug(DEBUG_FUNCTION, "callstack_push_syscall(pid=%d, sysnum=%d)", proc->pid, sysnum);
689 /* FIXME: not good -- should use dynamic allocation. 19990703 mortene. */
690 if (proc->callstack_depth == MAX_CALLDEPTH - 1) {
691 fprintf(stderr, "%s: Error: call nesting too deep!\n", __func__);
696 elem = &proc->callstack[proc->callstack_depth];
697 *elem = (struct callstack_element){};
698 elem->is_syscall = 1;
699 elem->c_un.syscall = sysnum;
700 elem->return_addr = NULL;
702 proc->callstack_depth++;
703 if (opt_T || options.summary) {
705 gettimeofday(&elem->time_spent, &tz);
710 callstack_push_symfunc(Process *proc, struct library_symbol *sym) {
711 struct callstack_element *elem;
713 debug(DEBUG_FUNCTION, "callstack_push_symfunc(pid=%d, symbol=%s)", proc->pid, sym->name);
714 /* FIXME: not good -- should use dynamic allocation. 19990703 mortene. */
715 if (proc->callstack_depth == MAX_CALLDEPTH - 1) {
716 fprintf(stderr, "%s: Error: call nesting too deep!\n", __func__);
721 elem = &proc->callstack[proc->callstack_depth++];
722 *elem = (struct callstack_element){};
723 elem->is_syscall = 0;
724 elem->c_un.libfunc = sym;
726 elem->return_addr = proc->return_addr;
727 if (elem->return_addr)
728 insert_breakpoint(proc, elem->return_addr, NULL);
730 if (opt_T || options.summary) {
732 gettimeofday(&elem->time_spent, &tz);
737 callstack_pop(struct Process *proc)
739 struct callstack_element *elem;
740 assert(proc->callstack_depth > 0);
742 debug(DEBUG_FUNCTION, "callstack_pop(pid=%d)", proc->pid);
743 elem = &proc->callstack[proc->callstack_depth - 1];
744 if (!elem->is_syscall && elem->return_addr)
745 delete_breakpoint(proc, elem->return_addr);
747 if (elem->fetch_context != NULL)
748 fetch_arg_done(elem->fetch_context);
750 if (elem->arguments != NULL) {
751 val_dict_destroy(elem->arguments);
752 free(elem->arguments);
755 proc->callstack_depth--;