274 lines
7.7 KiB
C
274 lines
7.7 KiB
C
/* $OpenBSD: ktrace.h,v 1.48 2023/12/15 15:12:08 deraadt Exp $ */
|
|
/* $NetBSD: ktrace.h,v 1.12 1996/02/04 02:12:29 christos Exp $ */
|
|
|
|
/*
|
|
* Copyright (c) 1988, 1993
|
|
* The Regents of the University of California. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the name of the University nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* @(#)ktrace.h 8.1 (Berkeley) 6/2/93
|
|
*/
|
|
|
|
#include <sys/uio.h>
|
|
#include <sys/syslimits.h>
|
|
#include <sys/signal.h>
|
|
#include <sys/time.h>
|
|
|
|
/*
|
|
* operations to ktrace system call (KTROP(op))
|
|
*/
|
|
#define KTROP_SET 0 /* set trace points */
|
|
#define KTROP_CLEAR 1 /* clear trace points */
|
|
#define KTROP_CLEARFILE 2 /* stop all tracing to file */
|
|
#define KTROP(o) ((o)&3) /* macro to extract operation */
|
|
/*
|
|
* flags (ORed in with operation)
|
|
*/
|
|
#define KTRFLAG_DESCEND 4 /* perform op on all children too */
|
|
|
|
/*
|
|
* ktrace record header
|
|
*/
|
|
struct ktr_header {
|
|
uint ktr_type; /* trace record type */
|
|
pid_t ktr_pid; /* process id */
|
|
pid_t ktr_tid; /* thread id */
|
|
struct timespec ktr_time; /* timestamp */
|
|
char ktr_comm[_MAXCOMLEN]; /* command name, incl NUL */
|
|
size_t ktr_len; /* length of buf */
|
|
};
|
|
|
|
/*
|
|
* ktrace record types
|
|
*/
|
|
|
|
/*
|
|
* KTR_START - start of trace record, one per ktrace(KTROP_SET) syscall
|
|
*/
|
|
#define KTR_START 0x4b545200 /* "KTR" */
|
|
|
|
/*
|
|
* KTR_SYSCALL - system call record
|
|
*/
|
|
#define KTR_SYSCALL 1
|
|
struct ktr_syscall {
|
|
int ktr_code; /* syscall number */
|
|
int ktr_argsize; /* size of arguments */
|
|
/*
|
|
* followed by ktr_argsize/sizeof(register_t) "register_t"s
|
|
*/
|
|
};
|
|
|
|
/*
|
|
* KTR_SYSRET - return from system call record
|
|
*/
|
|
#define KTR_SYSRET 2
|
|
struct ktr_sysret {
|
|
int ktr_code;
|
|
int ktr_error;
|
|
/*
|
|
* If ktr_error is zero, then followed by retval: register_t for
|
|
* all syscalls except lseek(), which uses long long
|
|
*/
|
|
};
|
|
|
|
/*
|
|
* KTR_NAMEI - namei record
|
|
*/
|
|
#define KTR_NAMEI 3
|
|
/* record contains pathname */
|
|
|
|
/*
|
|
* KTR_GENIO - trace generic process i/o
|
|
*/
|
|
#define KTR_GENIO 4
|
|
struct ktr_genio {
|
|
int ktr_fd;
|
|
enum uio_rw ktr_rw;
|
|
/*
|
|
* followed by data successfully read/written
|
|
*/
|
|
};
|
|
|
|
/*
|
|
* KTR_PSIG - trace processed signal
|
|
*/
|
|
#define KTR_PSIG 5
|
|
struct ktr_psig {
|
|
int signo;
|
|
sig_t action;
|
|
int mask;
|
|
int code;
|
|
siginfo_t si;
|
|
};
|
|
|
|
/*
|
|
* KTR_STRUCT - misc. structs
|
|
*/
|
|
#define KTR_STRUCT 8
|
|
/*
|
|
* record contains null-terminated struct name followed by
|
|
* struct contents
|
|
*/
|
|
struct sockaddr;
|
|
struct stat;
|
|
|
|
/*
|
|
* KTR_USER - user record
|
|
*/
|
|
#define KTR_USER 9
|
|
#define KTR_USER_MAXIDLEN 20
|
|
#define KTR_USER_MAXLEN 2048 /* maximum length of passed data */
|
|
struct ktr_user {
|
|
char ktr_id[KTR_USER_MAXIDLEN]; /* string id of caller */
|
|
/*
|
|
* Followed by ktr_len - sizeof(struct ktr_user) of user data.
|
|
*/
|
|
};
|
|
|
|
/*
|
|
* KTR_EXECARGS and KTR_EXECENV - args and environment records
|
|
*/
|
|
#define KTR_EXECARGS 10
|
|
#define KTR_EXECENV 11
|
|
|
|
|
|
/*
|
|
* KTR_PLEDGE - details of pledge violation
|
|
*/
|
|
#define KTR_PLEDGE 12
|
|
struct ktr_pledge {
|
|
int error;
|
|
int syscall;
|
|
uint64_t code;
|
|
};
|
|
|
|
/*
|
|
* KTR_PINSYSCALL - details of pinsyscall violation
|
|
*/
|
|
#define KTR_PINSYSCALL 13
|
|
struct ktr_pinsyscall {
|
|
int error;
|
|
int syscall;
|
|
vaddr_t addr;
|
|
};
|
|
|
|
/*
|
|
* kernel trace points (in ps_traceflag)
|
|
*/
|
|
#define KTRFAC_MASK 0x00ffffff
|
|
#define KTRFAC_SYSCALL (1<<KTR_SYSCALL)
|
|
#define KTRFAC_SYSRET (1<<KTR_SYSRET)
|
|
#define KTRFAC_NAMEI (1<<KTR_NAMEI)
|
|
#define KTRFAC_GENIO (1<<KTR_GENIO)
|
|
#define KTRFAC_PSIG (1<<KTR_PSIG)
|
|
#define KTRFAC_STRUCT (1<<KTR_STRUCT)
|
|
#define KTRFAC_USER (1<<KTR_USER)
|
|
#define KTRFAC_EXECARGS (1<<KTR_EXECARGS)
|
|
#define KTRFAC_EXECENV (1<<KTR_EXECENV)
|
|
#define KTRFAC_PLEDGE (1<<KTR_PLEDGE)
|
|
#define KTRFAC_PINSYSCALL (1<<KTR_PINSYSCALL)
|
|
|
|
/*
|
|
* trace flags (also in ps_traceflag)
|
|
*/
|
|
#define KTRFAC_ROOT 0x80000000U /* root set this trace */
|
|
#define KTRFAC_INHERIT 0x40000000 /* pass trace flags to children */
|
|
|
|
#ifndef _KERNEL
|
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__BEGIN_DECLS
|
|
int ktrace(const char *, int, int, pid_t);
|
|
int utrace(const char *, const void *, size_t);
|
|
__END_DECLS
|
|
|
|
#else
|
|
|
|
/*
|
|
* Test for kernel trace point
|
|
*/
|
|
#define KTRPOINT(p, type) \
|
|
((p)->p_p->ps_traceflag & (1<<(type)) && ((p)->p_flag & P_INKTR) == 0)
|
|
|
|
void ktrgenio(struct proc *, int, enum uio_rw, struct iovec *, ssize_t);
|
|
void ktrnamei(struct proc *, char *);
|
|
void ktrpsig(struct proc *, int, sig_t, int, int, siginfo_t *);
|
|
void ktrsyscall(struct proc *, register_t, size_t, register_t []);
|
|
void ktrsysret(struct proc *, register_t, int, const register_t [2]);
|
|
int ktruser(struct proc *, const char *, const void *, size_t);
|
|
void ktrexec(struct proc *, int, const char *, ssize_t);
|
|
void ktrpledge(struct proc *, int, uint64_t, int);
|
|
void ktrpinsyscall(struct proc *, int, int, vaddr_t);
|
|
|
|
void ktrcleartrace(struct process *);
|
|
void ktrsettrace(struct process *, int, struct vnode *, struct ucred *);
|
|
|
|
void ktrstruct(struct proc *, const char *, const void *, size_t);
|
|
#define ktrsockaddr(p, s, l) \
|
|
ktrstruct((p), "sockaddr", (s), (l))
|
|
#define ktrstat(p, s) \
|
|
ktrstruct((p), "stat", (s), sizeof(struct stat))
|
|
#define ktrabstimespec(p, s) \
|
|
ktrstruct((p), "abstimespec", (s), sizeof(struct timespec))
|
|
#define ktrreltimespec(p, s) \
|
|
ktrstruct((p), "reltimespec", (s), sizeof(struct timespec))
|
|
#define ktrabstimeval(p, s) \
|
|
ktrstruct((p), "abstimeval", (s), sizeof(struct timeval))
|
|
#define ktrreltimeval(p, s) \
|
|
ktrstruct((p), "reltimeval", (s), sizeof(struct timeval))
|
|
#define ktrsigaction(p, s) \
|
|
ktrstruct((p), "sigaction", (s), sizeof(struct sigaction))
|
|
#define ktrrlimit(p, s) \
|
|
ktrstruct((p), "rlimit", (s), sizeof(struct rlimit))
|
|
#define ktrrusage(p, s) \
|
|
ktrstruct((p), "rusage", (s), sizeof(struct rusage))
|
|
#define ktrfdset(p, s, l) \
|
|
ktrstruct((p), "fdset", (s), l)
|
|
#define ktrquota(p, s) \
|
|
ktrstruct((p), "quota", (s), sizeof(struct dqblk))
|
|
#define ktrmsghdr(p, s) \
|
|
ktrstruct(p, "msghdr", s, sizeof(struct msghdr))
|
|
#define ktrmmsghdr(p, s) \
|
|
ktrstruct(p, "mmsghdr", s, sizeof(struct mmsghdr))
|
|
#define ktriovec(p, s, count) \
|
|
ktrstruct(p, "iovec", s, (count) * sizeof(struct iovec))
|
|
#define ktrcmsghdr(p, c, len) \
|
|
ktrstruct(p, "cmsghdr", c, len)
|
|
#define ktrevent(p, kev, count) \
|
|
ktrstruct(p, "kevent", kev, (count) * sizeof(struct kevent))
|
|
#define ktrpollfd(p, pfd, count) \
|
|
ktrstruct(p, "pollfd", pfd, (count) * sizeof(struct pollfd))
|
|
#define ktrfds(p, fds, count) \
|
|
ktrstruct(p, "fds", fds, (count) * sizeof(int))
|
|
#define ktrflock(p, fl) \
|
|
ktrstruct(p, "flock", (fl), sizeof(struct flock))
|
|
#define ktrsiginfo(p, si) \
|
|
ktrstruct(p, "siginfo", (si), sizeof(siginfo_t))
|
|
|
|
#endif /* !_KERNEL */
|