ttrace.2 (2010 09)

t
ttrace(2) ttrace(2)
ttstate_t structure. The path may subsequently be obtained using the
TT_PROC_GET_PATHNAME
request.
TTEVT_SYSCALL_RETURN
This event flag indicates that the traced process will notify the debugger upon return
of all system calls. The traced process will also provide the following information: the
system call number, its number of arguments and all its arguments, its return value
and its error return in the ttstate_t structure. If the system call is a
fork(),
vfork() or exec() and if, respectively, the
TTEVT_FORK, TTEVT_VFORK or
TTEVT_EXEC event is set, only the notification associated with these events is per-
formed. See the TT_PROC_SET_SCBM
request.
TTEVT_SYSCALL_ENTRY
This event flag requests notification of system call entry points. By default, all system
calls stop at this event if it is selected. The information provided is the same as for
TTEVT_SYSCALL_RETURN
events but the return value and error are always zero.
TTEVT_SYSCALL_RESTART
Identical to TTEVT_SYSCALL_ENTRY
but for system call restarts.
TTEVT_EXIT This event flag indicates that the traced process needs to notify the debugger action
when it invokes exit(). When set, the traced thread stops while still potentially
multithreaded.
TTEVT_LWP_CREATE
This event flag indicates that the debugger wants to be notified when the
lwp_create() system call is invoked to create a thread. When set, the calling
thread stops and provides the debugger with the lwpid of the newly created thread.
TTEVT_LWP_EXIT
This event flag indicates that the debugger wants to be notified when a thread is exit-
ing via the lwp_exit() system call. The thread stops upon entry to the system call.
TTEVT_LWP_TERMINATE
This event flag indicates that the debugger wants to be notified when a caller thread
invokes the lwp_terminate()
call on a target thread. When set, the calling
thread stops upon entering the system call and provides the lwpid of the thread to be
terminated in the
ttstate_t structure.
TTEVT_LWP_ABORT_SYSCALL
This event flag indicates that the debugger is to be notified when the
lwp_abort_syscall()
system call is invoked. The lwpid of the target thread is
provided in the
ttstate_t structure.
TTEVT_BPT_SSTEP
This event flag tells the kernel to perform event-based single-stepping and breakpoint
notification. If this event is requested, SIGTRAP loses all special meaning. It is
highly recommended that debuggers use this event instead of the old signal-based
method as it will allow breakpoints and single-steps to take place regardless of the
signals the thread is blocking. Unlike the signal-based method, it also guarantees
that single-steps and breakpoint events are generated in the context of the thread
even if other threads are active in the process.
Note that mixing signal-based and event-based breakpoint/single-stepping may result
in unexpected SIGTRAPs being posted to the process being debugged.
Security Restrictions
For security reasons,
ttrace() inhibits the set-user-ID facility on subsequent exec() calls.
Some or all of the actions associated with this system call require the
OWNER privilege. Processes owned
by the superuser have this privilege. Processes owned by other users may have this privilege, depending
on system configuration. See privileges (5) for more information about privileged access on systems that
support fine-grained privileges.
ERRORS
If a request fails,
ttrace returns -1 and errno is set to one of the following:
HP-UX 11i Version 3: September 2010 − 15 − Hewlett-Packard Company 15