14 #include <sys/ptrace.h>
17 static void handle_signal(Event *event);
18 static void handle_exit(Event *event);
19 static void handle_exit_signal(Event *event);
20 static void handle_syscall(Event *event);
21 static void handle_arch_syscall(Event *event);
22 static void handle_sysret(Event *event);
23 static void handle_arch_sysret(Event *event);
24 static void handle_clone(Event *event);
25 static void handle_exec(Event *event);
26 static void handle_breakpoint(Event *event);
27 static void handle_new(Event *event);
28 static void remove_proc(Process *proc);
30 static void callstack_push_syscall(Process *proc, int sysnum);
31 static void callstack_push_symfunc(Process *proc,
32 struct library_symbol *sym);
33 static void callstack_pop(Process *proc);
35 static char * shortsignal(Process *proc, int signum);
36 static char * sysname(Process *proc, int sysnum);
37 static char * arch_sysname(Process *proc, int sysnum);
40 handle_event(Event *event) {
41 debug(DEBUG_FUNCTION, "handle_event(pid=%d, type=%d)", event->proc ? event->proc->pid : -1, event->type);
42 switch (event->type) {
44 debug(1, "event: none");
47 debug(1, "event: signal (%s [%d])",
48 shortsignal(event->proc, event->e_un.signum),
53 debug(1, "event: exit (%d)", event->e_un.ret_val);
56 case EVENT_EXIT_SIGNAL:
57 debug(1, "event: exit signal (%s [%d])",
58 shortsignal(event->proc, event->e_un.signum),
60 handle_exit_signal(event);
63 debug(1, "event: syscall (%s [%d])",
64 sysname(event->proc, event->e_un.sysnum),
66 handle_syscall(event);
69 debug(1, "event: sysret (%s [%d])",
70 sysname(event->proc, event->e_un.sysnum),
74 case EVENT_ARCH_SYSCALL:
75 debug(1, "event: arch_syscall (%s [%d])",
76 arch_sysname(event->proc, event->e_un.sysnum),
78 handle_arch_syscall(event);
80 case EVENT_ARCH_SYSRET:
81 debug(1, "event: arch_sysret (%s [%d])",
82 arch_sysname(event->proc, event->e_un.sysnum),
84 handle_arch_sysret(event);
87 debug(1, "event: clone (%u)", event->e_un.newpid);
91 debug(1, "event: exec()");
94 case EVENT_BREAKPOINT:
95 debug(1, "event: breakpoint");
96 handle_breakpoint(event);
99 debug(1, "event: new process");
103 fprintf(stderr, "Error! unknown event?\n");
110 address_clone(void * addr) {
111 debug(DEBUG_FUNCTION, "address_clone(%p)", addr);
116 breakpoint_clone(void * bp) {
118 debug(DEBUG_FUNCTION, "breakpoint_clone(%p)", bp);
119 b = malloc(sizeof(Breakpoint));
124 memcpy(b, bp, sizeof(Breakpoint));
128 typedef struct Pending_New Pending_New;
133 static Pending_New * pending_news = NULL;
136 pending_new(pid_t pid) {
139 debug(DEBUG_FUNCTION, "pending_new(%d)", pid);
152 pending_new_insert(pid_t pid) {
155 debug(DEBUG_FUNCTION, "pending_new_insert(%d)", pid);
157 p = malloc(sizeof(Pending_New));
163 p->next = pending_news;
168 pending_new_remove(pid_t pid) {
169 Pending_New *p, *pred;
171 debug(DEBUG_FUNCTION, "pending_new_remove(%d)", pid);
175 pending_news = p->next;
180 pred->next = p->next;
190 handle_clone(Event * event) {
193 debug(DEBUG_FUNCTION, "handle_clone(pid=%d)", event->proc->pid);
195 p = malloc(sizeof(Process));
200 memcpy(p, event->proc, sizeof(Process));
201 p->breakpoints = dict_clone(event->proc->breakpoints, address_clone, breakpoint_clone);
202 p->pid = event->e_un.newpid;
203 p->parent = event->proc;
205 if (pending_new(p->pid)) {
206 pending_new_remove(p->pid);
207 if (p->breakpoint_being_enabled) {
208 enable_breakpoint(p->pid, p->breakpoint_being_enabled);
209 p->breakpoint_being_enabled = NULL;
211 if (event->proc->state == STATE_ATTACHED && options.follow) {
212 p->state = STATE_ATTACHED;
214 p->state = STATE_IGNORED;
216 continue_process(p->pid);
217 p->next = list_of_processes;
218 list_of_processes = p;
220 p->state = STATE_BEING_CREATED;
221 p->next = list_of_processes;
222 list_of_processes = p;
224 continue_process(event->proc->pid);
228 handle_new(Event * event) {
231 debug(DEBUG_FUNCTION, "handle_new(pid=%d)", event->e_un.newpid);
233 proc = pid2proc(event->e_un.newpid);
235 pending_new_insert(event->e_un.newpid);
237 assert(proc->state == STATE_BEING_CREATED);
238 if (proc->breakpoint_being_enabled) {
239 enable_breakpoint(proc->pid, proc->breakpoint_being_enabled);
240 proc->breakpoint_being_enabled = NULL;
242 if (options.follow) {
243 proc->state = STATE_ATTACHED;
245 proc->state = STATE_IGNORED;
247 continue_process(proc->pid);
252 shortsignal(Process *proc, int signum) {
253 static char *signalent0[] = {
254 #include "signalent.h"
256 static char *signalent1[] = {
257 #include "signalent1.h"
259 static char **signalents[] = { signalent0, signalent1 };
260 int nsignals[] = { sizeof signalent0 / sizeof signalent0[0],
261 sizeof signalent1 / sizeof signalent1[0]
264 debug(DEBUG_FUNCTION, "shortsignal(pid=%d, signum=%d)", proc->pid, signum);
266 if (proc->personality > sizeof signalents / sizeof signalents[0])
268 if (signum < 0 || signum >= nsignals[proc->personality]) {
269 return "UNKNOWN_SIGNAL";
271 return signalents[proc->personality][signum];
276 sysname(Process *proc, int sysnum) {
277 static char result[128];
278 static char *syscalent0[] = {
279 #include "syscallent.h"
281 static char *syscalent1[] = {
282 #include "syscallent1.h"
284 static char **syscalents[] = { syscalent0, syscalent1 };
285 int nsyscals[] = { sizeof syscalent0 / sizeof syscalent0[0],
286 sizeof syscalent1 / sizeof syscalent1[0]
289 debug(DEBUG_FUNCTION, "sysname(pid=%d, sysnum=%d)", proc->pid, sysnum);
291 if (proc->personality > sizeof syscalents / sizeof syscalents[0])
293 if (sysnum < 0 || sysnum >= nsyscals[proc->personality]) {
294 sprintf(result, "SYS_%d", sysnum);
297 sprintf(result, "SYS_%s",
298 syscalents[proc->personality][sysnum]);
304 arch_sysname(Process *proc, int sysnum) {
305 static char result[128];
306 static char *arch_syscalent[] = {
307 #include "arch_syscallent.h"
309 int nsyscals = sizeof arch_syscalent / sizeof arch_syscalent[0];
311 debug(DEBUG_FUNCTION, "arch_sysname(pid=%d, sysnum=%d)", proc->pid, sysnum);
313 if (sysnum < 0 || sysnum >= nsyscals) {
314 sprintf(result, "ARCH_%d", sysnum);
317 sprintf(result, "ARCH_%s",
318 arch_syscalent[sysnum]);
324 handle_signal(Event *event) {
325 debug(DEBUG_FUNCTION, "handle_signal(pid=%d, signum=%d)", event->proc->pid, event->e_un.signum);
326 if (exiting && event->e_un.signum == SIGSTOP) {
327 pid_t pid = event->proc->pid;
328 disable_all_breakpoints(event->proc);
330 remove_proc(event->proc);
333 if (event->proc->state != STATE_IGNORED) {
334 output_line(event->proc, "--- %s (%s) ---",
335 shortsignal(event->proc, event->e_un.signum),
336 strsignal(event->e_un.signum));
338 continue_after_signal(event->proc->pid, event->e_un.signum);
342 handle_exit(Event *event) {
343 debug(DEBUG_FUNCTION, "handle_exit(pid=%d, status=%d)", event->proc->pid, event->e_un.ret_val);
344 if (event->proc->state != STATE_IGNORED) {
345 output_line(event->proc, "+++ exited (status %d) +++",
346 event->e_un.ret_val);
348 remove_proc(event->proc);
352 handle_exit_signal(Event *event) {
353 debug(DEBUG_FUNCTION, "handle_exit_signal(pid=%d, signum=%d)", event->proc->pid, event->e_un.signum);
354 if (event->proc->state != STATE_IGNORED) {
355 output_line(event->proc, "+++ killed by %s +++",
356 shortsignal(event->proc, event->e_un.signum));
358 remove_proc(event->proc);
362 remove_proc(Process *proc) {
365 debug(DEBUG_FUNCTION, "remove_proc(pid=%d)", proc->pid);
367 if (list_of_processes == proc) {
368 tmp = list_of_processes;
369 list_of_processes = list_of_processes->next;
373 tmp = list_of_processes;
375 if (tmp->next == proc) {
377 tmp->next = tmp->next->next;
386 handle_syscall(Event *event) {
387 debug(DEBUG_FUNCTION, "handle_syscall(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
388 if (event->proc->state != STATE_IGNORED) {
389 if (options.syscalls) {
390 output_left(LT_TOF_SYSCALL, event->proc,
391 sysname(event->proc, event->e_un.sysnum));
393 if (event->proc->breakpoints_enabled == 0) {
394 enable_all_breakpoints(event->proc);
396 callstack_push_syscall(event->proc, event->e_un.sysnum);
398 continue_process(event->proc->pid);
402 handle_exec(Event * event) {
403 Process * proc = event->proc;
406 debug(DEBUG_FUNCTION, "handle_exec(pid=%d)", proc->pid);
407 if (proc->state == STATE_IGNORED) {
408 untrace_pid(proc->pid);
412 output_line(proc, "--- Called exec() ---");
413 proc->mask_32bit = 0;
414 proc->personality = 0;
415 proc->arch_ptr = NULL;
416 free(proc->filename);
417 proc->filename = pid2name(proc->pid);
418 saved_pid = proc->pid;
420 breakpoints_init(proc);
421 proc->pid = saved_pid;
422 proc->callstack_depth = 0;
423 continue_process(proc->pid);
427 handle_arch_syscall(Event *event) {
428 debug(DEBUG_FUNCTION, "handle_arch_syscall(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
429 if (event->proc->state != STATE_IGNORED) {
430 if (options.syscalls) {
431 output_left(LT_TOF_SYSCALL, event->proc,
432 arch_sysname(event->proc, event->e_un.sysnum));
434 if (event->proc->breakpoints_enabled == 0) {
435 enable_all_breakpoints(event->proc);
437 callstack_push_syscall(event->proc, 0xf0000 + event->e_un.sysnum);
439 continue_process(event->proc->pid);
442 struct timeval current_time_spent;
445 calc_time_spent(Process *proc) {
449 struct callstack_element *elem;
451 debug(DEBUG_FUNCTION, "calc_time_spent(pid=%d)", proc->pid);
452 elem = &proc->callstack[proc->callstack_depth - 1];
454 gettimeofday(&tv, &tz);
456 diff.tv_sec = tv.tv_sec - elem->time_spent.tv_sec;
457 if (tv.tv_usec >= elem->time_spent.tv_usec) {
458 diff.tv_usec = tv.tv_usec - elem->time_spent.tv_usec;
461 diff.tv_usec = 1000000 + tv.tv_usec - elem->time_spent.tv_usec;
463 current_time_spent = diff;
467 handle_sysret(Event *event) {
468 debug(DEBUG_FUNCTION, "handle_sysret(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
469 if (event->proc->state != STATE_IGNORED) {
470 if (opt_T || options.summary) {
471 calc_time_spent(event->proc);
473 callstack_pop(event->proc);
474 if (options.syscalls) {
475 output_right(LT_TOF_SYSCALLR, event->proc,
476 sysname(event->proc, event->e_un.sysnum));
479 continue_process(event->proc->pid);
483 handle_arch_sysret(Event *event) {
484 debug(DEBUG_FUNCTION, "handle_arch_sysret(pid=%d, sysnum=%d)", event->proc->pid, event->e_un.sysnum);
485 if (event->proc->state != STATE_IGNORED) {
486 if (opt_T || options.summary) {
487 calc_time_spent(event->proc);
489 callstack_pop(event->proc);
490 if (options.syscalls) {
491 output_right(LT_TOF_SYSCALLR, event->proc,
492 arch_sysname(event->proc, event->e_un.sysnum));
495 continue_process(event->proc->pid);
499 handle_breakpoint(Event *event) {
503 debug(DEBUG_FUNCTION, "handle_breakpoint(pid=%d, addr=%p)", event->proc->pid, event->e_un.brk_addr);
504 debug(2, "event: breakpoint (%p)", event->e_un.brk_addr);
507 /* Need to skip following NOP's to prevent a fake function from being stacked. */
508 long stub_addr = (long) get_count_register(event->proc);
509 Breakpoint *stub_bp = NULL;
510 char nop_instruction[] = PPC_NOP;
512 stub_bp = address2bpstruct (event->proc, event->e_un.brk_addr);
515 unsigned char *bp_instruction = stub_bp->orig_value;
517 if (memcmp(bp_instruction, nop_instruction,
518 PPC_NOP_LENGTH) == 0) {
519 if (stub_addr != (long) event->e_un.brk_addr) {
520 set_instruction_pointer (event->proc, event->e_un.brk_addr + 4);
521 continue_process(event->proc->pid);
527 if ((sbp = event->proc->breakpoint_being_enabled) != 0) {
528 /* Reinsert breakpoint */
529 continue_enabling_breakpoint(event->proc->pid,
531 breakpoint_being_enabled);
532 event->proc->breakpoint_being_enabled = NULL;
536 for (i = event->proc->callstack_depth - 1; i >= 0; i--) {
537 if (event->e_un.brk_addr ==
538 event->proc->callstack[i].return_addr) {
541 * PPC HACK! (XXX FIXME TODO)
542 * The PLT gets modified during the first call,
543 * so be sure to re-enable the breakpoint.
546 struct library_symbol *libsym =
547 event->proc->callstack[i].c_un.libfunc;
548 void *addr = sym2addr(event->proc, libsym);
550 if (libsym->plt_type != LS_TOPLT_POINT) {
551 unsigned char break_insn[] = BREAKPOINT_VALUE;
553 sbp = address2bpstruct(event->proc, addr);
555 a = ptrace(PTRACE_PEEKTEXT, event->proc->pid,
558 if (memcmp(&a, break_insn, BREAKPOINT_LENGTH)) {
560 insert_breakpoint(event->proc, addr,
564 sbp = dict_find_entry(event->proc->breakpoints, sym2addr(event->proc, libsym));
566 if (addr != sbp->addr) {
567 insert_breakpoint(event->proc, addr,
571 #elif defined(__mips__)
574 struct library_symbol *sym= event->proc->callstack[i].c_un.libfunc;
576 old_addr = dict_find_entry(event->proc->breakpoints, sym2addr(event->proc, sym))->addr;
577 addr=sym2addr(event->proc,sym);
578 assert(old_addr !=0 && addr !=0);
579 if(addr != old_addr){
580 struct library_symbol *new_sym;
581 new_sym=malloc(sizeof(*new_sym));
582 memcpy(new_sym,sym,sizeof(*new_sym));
583 new_sym->next=event->proc->list_of_symbols;
584 event->proc->list_of_symbols=new_sym;
585 insert_breakpoint(event->proc, addr, new_sym);
588 for (j = event->proc->callstack_depth - 1; j > i; j--) {
589 callstack_pop(event->proc);
591 if (event->proc->state != STATE_IGNORED) {
592 if (opt_T || options.summary) {
593 calc_time_spent(event->proc);
596 callstack_pop(event->proc);
597 event->proc->return_addr = event->e_un.brk_addr;
598 if (event->proc->state != STATE_IGNORED) {
599 output_right(LT_TOF_FUNCTIONR, event->proc,
600 event->proc->callstack[i].c_un.libfunc->name);
602 continue_after_breakpoint(event->proc,
603 address2bpstruct(event->proc,
604 event->e_un.brk_addr));
609 if ((sbp = address2bpstruct(event->proc, event->e_un.brk_addr))) {
610 if (event->proc->state != STATE_IGNORED) {
611 event->proc->stack_pointer = get_stack_pointer(event->proc);
612 event->proc->return_addr =
613 get_return_addr(event->proc, event->proc->stack_pointer);
614 output_left(LT_TOF_FUNCTION, event->proc, sbp->libsym->name);
615 callstack_push_symfunc(event->proc, sbp->libsym);
617 #ifdef PLT_REINITALISATION_BP
618 if (event->proc->need_to_reinitialize_breakpoints
619 && (strcmp(sbp->libsym->name, PLTs_initialized_by_here) ==
621 reinitialize_breakpoints(event->proc);
624 continue_after_breakpoint(event->proc, sbp);
628 if (event->proc->state != STATE_IGNORED) {
629 output_line(event->proc, "unexpected breakpoint at %p",
630 (void *)event->e_un.brk_addr);
632 continue_process(event->proc->pid);
636 callstack_push_syscall(Process *proc, int sysnum) {
637 struct callstack_element *elem;
639 debug(DEBUG_FUNCTION, "callstack_push_syscall(pid=%d, sysnum=%d)", proc->pid, sysnum);
640 /* FIXME: not good -- should use dynamic allocation. 19990703 mortene. */
641 if (proc->callstack_depth == MAX_CALLDEPTH - 1) {
642 fprintf(stderr, "Error: call nesting too deep!\n");
646 elem = &proc->callstack[proc->callstack_depth];
647 elem->is_syscall = 1;
648 elem->c_un.syscall = sysnum;
649 elem->return_addr = NULL;
651 proc->callstack_depth++;
652 if (opt_T || options.summary) {
654 gettimeofday(&elem->time_spent, &tz);
659 callstack_push_symfunc(Process *proc, struct library_symbol *sym) {
660 struct callstack_element *elem;
662 debug(DEBUG_FUNCTION, "callstack_push_symfunc(pid=%d, symbol=%s)", proc->pid, sym->name);
663 /* FIXME: not good -- should use dynamic allocation. 19990703 mortene. */
664 if (proc->callstack_depth == MAX_CALLDEPTH - 1) {
665 fprintf(stderr, "Error: call nesting too deep!\n");
669 elem = &proc->callstack[proc->callstack_depth];
670 elem->is_syscall = 0;
671 elem->c_un.libfunc = sym;
673 elem->return_addr = proc->return_addr;
674 if (elem->return_addr) {
675 insert_breakpoint(proc, elem->return_addr, 0);
678 proc->callstack_depth++;
679 if (opt_T || options.summary) {
681 gettimeofday(&elem->time_spent, &tz);
686 callstack_pop(Process *proc) {
687 struct callstack_element *elem;
688 assert(proc->callstack_depth > 0);
690 debug(DEBUG_FUNCTION, "callstack_pop(pid=%d)", proc->pid);
691 elem = &proc->callstack[proc->callstack_depth - 1];
692 if (!elem->is_syscall && elem->return_addr) {
693 delete_breakpoint(proc, elem->return_addr);
695 proc->callstack_depth--;