HP-UX Reference (11i v3 07/02) - 2 System Calls (vol 5)

t
ttrace(2) ttrace(2)
TTEVT_SYSCALL_RETURN
This event flag indicates that the traced process will notify the debugger upon return of
all system calls. The traced process will also provide the following information: the sys-
tem call number, its number of arguments and all its arguments, its return value and its
error return in the ttstate_t structure. If the system call is a
fork(), vfork()
or exec() and if, respectively, the
TTEVT_FORK , TTEVT_VFORK or TTEVT_EXEC
event is set, only the notification associated with these events is performed. See the
TT_PROC_SET_SCBM
request.
TTEVT_SYSCALL_ENTRY
This event flag requests notification of system call entry points. By default, all system
calls stop at this event if it is selected. The information provided is the same as for
TTEVT_SYSCALL_RETURN
events but the return value and error are always zero.
TTEVT_SYSCALL_RESTART
Identical to TTEVT_SYSCALL_ENTRY
but for system call restarts.
TTEVT_EXIT This event flag indicates that the traced process needs to notify the debugger action
when it invokes exit(). When set, the traced thread stops while still potentially mul-
tithreaded.
TTEVT_LWP_CREATE
This event flag indicates that the debugger wants to be notified when the
lwp_create() system call is invoked to create a thread. When set, the calling
thread stops and provides the debugger with the lwpid of the newly created thread.
TTEVT_LWP_EXIT
This event flag indicates that the debugger wants to be notified when a thread is exiting
via the lwp_exit() system call. The thread stops upon entry to the system call.
TTEVT_LWP_TERMINATE
This event flag indicates that the debugger wants to be notified when a caller thread
invokes the lwp_terminate()
call on a target thread. When set, the calling thread
stops upon entering the system call and provides the lwpid of the thread to be ter-
minated in the
ttstate_t structure.
TTEVT_LWP_ABORT_SYSCALL
This event flag indicates that the debugger is to be notified when the
lwp_abort_syscall()
system call is invoked. The lwpid of the target thread is
provided in the
ttstate_t structure.
TTEVT_BPT_SSTEP
This event flag tells the kernel to perform event-based single-stepping and breakpoint
notification. If this event is requested, SIGTRAP loses all special meaning. It is highly
recommended that debuggers use this event instead of the old signal-based method as it
will allow breakpoints and single-steps to take place regardless of the signals the thread
is blocking. Unlike the signal-based method, it also guarantees that single-steps and
breakpoint events are generated in the context of the thread even if other threads are
active in the process.
Note that mixing signal-based and event-based breakpoint/single-stepping may result in
unexpected SIGTRAPs being posted to the process being debugged.
Security Restrictions
For security reasons,
ttrace() inhibits the set-user-ID facility on subsequent exec() calls.
Some or all of the actions associated with this system call require the OWNER privilege. Processes owned
by the superuser have this privilege. Processes owned by other users may have this privilege, depending on
system configuration. See privileges (5) for more information about privileged access on systems that sup-
port fine-grained privileges.
ERRORS
If a request fails, ttrace returns -1 and errno is set to one of the following:
[EACCES] The pid argument to the TT_PROC_ATTACH is the pid of the invoker.
[EACCES] The process identified by the pid argument to TT_PROC_ATTACH is exiting.
HP-UX 11i Version 3: February 2007 − 15 − Hewlett-Packard Company 511