1 /*-
2 * SPDX-License-Identifier: BSD-4-Clause
3 *
4 * Copyright 1997 Sean Eric Fagan
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Sean Eric Fagan
17 * 4. Neither the name of the author may be used to endorse or promote
18 * products derived from this software without specific prior written
19 * permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #include <sys/cdefs.h>
35 /*
36 * Various setup functions for truss. Not the cleanest-written code,
37 * I'm afraid.
38 */
39
40 #include <sys/ptrace.h>
41 #include <sys/sysctl.h>
42 #include <sys/time.h>
43 #include <sys/wait.h>
44
45 #include <assert.h>
46 #include <err.h>
47 #include <errno.h>
48 #include <signal.h>
49 #include <stdbool.h>
50 #include <stdint.h>
51 #include <stdio.h>
52 #include <stdlib.h>
53 #include <string.h>
54 #include <sysdecode.h>
55 #include <time.h>
56 #include <unistd.h>
57
58 #include "truss.h"
59 #include "syscall.h"
60 #include "extern.h"
61
62 struct procabi_table {
63 const char *name;
64 struct procabi *abi;
65 };
66
67 static sig_atomic_t detaching;
68
69 static void enter_syscall(struct trussinfo *, struct threadinfo *,
70 struct ptrace_lwpinfo *);
71 static void new_proc(struct trussinfo *, pid_t, lwpid_t);
72
73
74 static struct procabi freebsd = {
75 .type = "FreeBSD",
76 .abi = SYSDECODE_ABI_FREEBSD,
77 .pointer_size = sizeof(void *),
78 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls),
79 .syscalls = { NULL }
80 };
81
82 #if !defined(__SIZEOF_POINTER__)
83 #error "Use a modern compiler."
84 #endif
85
86 #if __SIZEOF_POINTER__ > 4
87 static struct procabi freebsd32 = {
88 .type = "FreeBSD32",
89 .abi = SYSDECODE_ABI_FREEBSD32,
90 .pointer_size = sizeof(uint32_t),
91 .compat_prefix = "freebsd32_",
92 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls),
93 .syscalls = { NULL }
94 };
95 #endif
96
97 static struct procabi linux = {
98 .type = "Linux",
99 .abi = SYSDECODE_ABI_LINUX,
100 .pointer_size = sizeof(void *),
101 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux.extra_syscalls),
102 .syscalls = { NULL }
103 };
104
105 #if __SIZEOF_POINTER__ > 4
106 static struct procabi linux32 = {
107 .type = "Linux32",
108 .abi = SYSDECODE_ABI_LINUX32,
109 .pointer_size = sizeof(uint32_t),
110 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls),
111 .syscalls = { NULL }
112 };
113 #endif
114
115 static struct procabi_table abis[] = {
116 #if __SIZEOF_POINTER__ == 4
117 { "FreeBSD ELF32", &freebsd },
118 #elif __SIZEOF_POINTER__ == 8
119 { "FreeBSD ELF64", &freebsd },
120 { "FreeBSD ELF32", &freebsd32 },
121 #else
122 #error "Unsupported pointer size"
123 #endif
124 #if defined(__powerpc64__)
125 { "FreeBSD ELF64 V2", &freebsd },
126 #endif
127 #if defined(__amd64__)
128 { "FreeBSD a.out", &freebsd32 },
129 #endif
130 #if defined(__i386__)
131 { "FreeBSD a.out", &freebsd },
132 #endif
133 #if __SIZEOF_POINTER__ >= 8
134 { "Linux ELF64", &linux },
135 { "Linux ELF32", &linux32 },
136 #else
137 { "Linux ELF32", &linux },
138 #endif
139 };
140
141 /*
142 * setup_and_wait() is called to start a process. All it really does
143 * is fork(), enable tracing in the child, and then exec the given
144 * command. At that point, the child process stops, and the parent
145 * can wake up and deal with it.
146 */
147 void
setup_and_wait(struct trussinfo * info,char * command[])148 setup_and_wait(struct trussinfo *info, char *command[])
149 {
150 pid_t pid;
151
152 pid = vfork();
153 if (pid == -1)
154 err(1, "fork failed");
155 if (pid == 0) { /* Child */
156 ptrace(PT_TRACE_ME, 0, 0, 0);
157 execvp(command[0], command);
158 err(1, "execvp %s", command[0]);
159 }
160
161 /* Only in the parent here */
162 if (waitpid(pid, NULL, 0) < 0)
163 err(1, "unexpected stop in waitpid");
164
165 new_proc(info, pid, 0);
166 }
167
168 /*
169 * start_tracing is called to attach to an existing process.
170 */
171 void
start_tracing(struct trussinfo * info,pid_t pid)172 start_tracing(struct trussinfo *info, pid_t pid)
173 {
174 int ret, retry;
175
176 retry = 10;
177 do {
178 ret = ptrace(PT_ATTACH, pid, NULL, 0);
179 usleep(200);
180 } while (ret && retry-- > 0);
181 if (ret)
182 err(1, "Cannot attach to target process");
183
184 if (waitpid(pid, NULL, 0) < 0)
185 err(1, "Unexpected stop in waitpid");
186
187 new_proc(info, pid, 0);
188 }
189
190 /*
191 * Restore a process back to it's pre-truss state.
192 * Called for SIGINT, SIGTERM, SIGQUIT. This only
193 * applies if truss was told to monitor an already-existing
194 * process.
195 */
196 void
restore_proc(int signo __unused)197 restore_proc(int signo __unused)
198 {
199
200 detaching = 1;
201 }
202
203 static void
detach_proc(pid_t pid)204 detach_proc(pid_t pid)
205 {
206 int sig, status;
207
208 /*
209 * Stop the child so that we can detach. Filter out possible
210 * lingering SIGTRAP events buffered in the threads.
211 */
212 kill(pid, SIGSTOP);
213 for (;;) {
214 if (waitpid(pid, &status, 0) < 0)
215 err(1, "Unexpected error in waitpid");
216 sig = WIFSTOPPED(status) ? WSTOPSIG(status) : 0;
217 if (sig == SIGSTOP)
218 break;
219 if (sig == SIGTRAP)
220 sig = 0;
221 if (ptrace(PT_CONTINUE, pid, (caddr_t)1, sig) < 0)
222 err(1, "Can not continue for detach");
223 }
224
225 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
226 err(1, "Can not detach the process");
227
228 kill(pid, SIGCONT);
229 }
230
231 /*
232 * Determine the ABI. This is called after every exec, and when
233 * a process is first monitored.
234 */
235 static struct procabi *
find_abi(pid_t pid)236 find_abi(pid_t pid)
237 {
238 size_t len;
239 unsigned int i;
240 int error;
241 int mib[4];
242 char progt[32];
243
244 len = sizeof(progt);
245 mib[0] = CTL_KERN;
246 mib[1] = KERN_PROC;
247 mib[2] = KERN_PROC_SV_NAME;
248 mib[3] = pid;
249 error = sysctl(mib, 4, progt, &len, NULL, 0);
250 if (error != 0)
251 err(2, "can not get sysvec name");
252
253 for (i = 0; i < nitems(abis); i++) {
254 if (strcmp(abis[i].name, progt) == 0)
255 return (abis[i].abi);
256 }
257 warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
258 return (NULL);
259 }
260
261 static struct threadinfo *
new_thread(struct procinfo * p,lwpid_t lwpid)262 new_thread(struct procinfo *p, lwpid_t lwpid)
263 {
264 struct threadinfo *nt;
265
266 /*
267 * If this happens it means there is a bug in truss. Unfortunately
268 * this will kill any processes truss is attached to.
269 */
270 LIST_FOREACH(nt, &p->threadlist, entries) {
271 if (nt->tid == lwpid)
272 errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
273 }
274
275 nt = calloc(1, sizeof(struct threadinfo));
276 if (nt == NULL)
277 err(1, "calloc() failed");
278 nt->proc = p;
279 nt->tid = lwpid;
280 LIST_INSERT_HEAD(&p->threadlist, nt, entries);
281 return (nt);
282 }
283
284 static void
free_thread(struct threadinfo * t)285 free_thread(struct threadinfo *t)
286 {
287
288 LIST_REMOVE(t, entries);
289 free(t);
290 }
291
292 static void
add_threads(struct trussinfo * info,struct procinfo * p)293 add_threads(struct trussinfo *info, struct procinfo *p)
294 {
295 struct ptrace_lwpinfo pl;
296 struct threadinfo *t;
297 lwpid_t *lwps;
298 int i, nlwps;
299
300 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
301 if (nlwps == -1)
302 err(1, "Unable to fetch number of LWPs");
303 assert(nlwps > 0);
304 lwps = calloc(nlwps, sizeof(*lwps));
305 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
306 if (nlwps == -1)
307 err(1, "Unable to fetch LWP list");
308 for (i = 0; i < nlwps; i++) {
309 t = new_thread(p, lwps[i]);
310 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
311 err(1, "ptrace(PT_LWPINFO)");
312 if (pl.pl_flags & PL_FLAG_SCE) {
313 info->curthread = t;
314 enter_syscall(info, t, &pl);
315 }
316 }
317 free(lwps);
318 }
319
320 static void
new_proc(struct trussinfo * info,pid_t pid,lwpid_t lwpid)321 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
322 {
323 struct procinfo *np;
324
325 /*
326 * If this happens it means there is a bug in truss. Unfortunately
327 * this will kill any processes truss is attached to.
328 */
329 LIST_FOREACH(np, &info->proclist, entries) {
330 if (np->pid == pid)
331 errx(1, "Duplicate process for pid %ld", (long)pid);
332 }
333
334 if (info->flags & FOLLOWFORKS)
335 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
336 err(1, "Unable to follow forks for pid %ld", (long)pid);
337 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
338 err(1, "Unable to enable LWP events for pid %ld", (long)pid);
339 np = calloc(1, sizeof(struct procinfo));
340 np->pid = pid;
341 np->abi = find_abi(pid);
342 LIST_INIT(&np->threadlist);
343 LIST_INSERT_HEAD(&info->proclist, np, entries);
344
345 if (lwpid != 0)
346 new_thread(np, lwpid);
347 else
348 add_threads(info, np);
349 }
350
351 static void
free_proc(struct procinfo * p)352 free_proc(struct procinfo *p)
353 {
354 struct threadinfo *t, *t2;
355
356 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
357 free(t);
358 }
359 LIST_REMOVE(p, entries);
360 free(p);
361 }
362
363 static void
detach_all_procs(struct trussinfo * info)364 detach_all_procs(struct trussinfo *info)
365 {
366 struct procinfo *p, *p2;
367
368 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
369 detach_proc(p->pid);
370 free_proc(p);
371 }
372 }
373
374 static struct procinfo *
find_proc(struct trussinfo * info,pid_t pid)375 find_proc(struct trussinfo *info, pid_t pid)
376 {
377 struct procinfo *np;
378
379 LIST_FOREACH(np, &info->proclist, entries) {
380 if (np->pid == pid)
381 return (np);
382 }
383
384 return (NULL);
385 }
386
387 /*
388 * Change curthread member based on (pid, lwpid).
389 */
390 static void
find_thread(struct trussinfo * info,pid_t pid,lwpid_t lwpid)391 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
392 {
393 struct procinfo *np;
394 struct threadinfo *nt;
395
396 np = find_proc(info, pid);
397 assert(np != NULL);
398
399 LIST_FOREACH(nt, &np->threadlist, entries) {
400 if (nt->tid == lwpid) {
401 info->curthread = nt;
402 return;
403 }
404 }
405 errx(1, "could not find thread");
406 }
407
408 /*
409 * When a process exits, it should have exactly one thread left.
410 * All of the other threads should have reported thread exit events.
411 */
412 static void
find_exit_thread(struct trussinfo * info,pid_t pid)413 find_exit_thread(struct trussinfo *info, pid_t pid)
414 {
415 struct procinfo *p;
416
417 p = find_proc(info, pid);
418 assert(p != NULL);
419
420 info->curthread = LIST_FIRST(&p->threadlist);
421 assert(info->curthread != NULL);
422 assert(LIST_NEXT(info->curthread, entries) == NULL);
423 }
424
425 static void
alloc_syscall(struct threadinfo * t,struct ptrace_lwpinfo * pl)426 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
427 {
428 u_int i;
429
430 assert(t->in_syscall == 0);
431 assert(t->cs.number == 0);
432 assert(t->cs.sc == NULL);
433 assert(t->cs.nargs == 0);
434 for (i = 0; i < nitems(t->cs.s_args); i++)
435 assert(t->cs.s_args[i] == NULL);
436 memset(t->cs.args, 0, sizeof(t->cs.args));
437 t->cs.number = pl->pl_syscall_code;
438 t->in_syscall = 1;
439 }
440
441 static void
free_syscall(struct threadinfo * t)442 free_syscall(struct threadinfo *t)
443 {
444 u_int i;
445
446 for (i = 0; i < t->cs.nargs; i++)
447 free(t->cs.s_args[i]);
448 memset(&t->cs, 0, sizeof(t->cs));
449 t->in_syscall = 0;
450 }
451
452 static void
enter_syscall(struct trussinfo * info,struct threadinfo * t,struct ptrace_lwpinfo * pl)453 enter_syscall(struct trussinfo *info, struct threadinfo *t,
454 struct ptrace_lwpinfo *pl)
455 {
456 struct syscall *sc;
457 u_int i, narg;
458
459 alloc_syscall(t, pl);
460 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
461 if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args,
462 sizeof(t->cs.args)) != 0) {
463 free_syscall(t);
464 return;
465 }
466
467 sc = get_syscall(t, t->cs.number, narg);
468 if (sc->unknown)
469 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
470 t->proc->abi->type, t->cs.number);
471
472 t->cs.nargs = sc->decode.nargs;
473 assert(sc->decode.nargs <= nitems(t->cs.s_args));
474
475 t->cs.sc = sc;
476
477 /*
478 * At this point, we set up the system call arguments.
479 * We ignore any OUT ones, however -- those are arguments that
480 * are set by the system call, and so are probably meaningless
481 * now. This doesn't currently support arguments that are
482 * passed in *and* out, however.
483 */
484 #if DEBUG
485 fprintf(stderr, "syscall %s(", sc->name);
486 #endif
487 for (i = 0; i < t->cs.nargs; i++) {
488 #if DEBUG
489 fprintf(stderr, "0x%lx%s",
490 t->cs.args[sc->decode.args[i].offset],
491 i < (t->cs.nargs - 1) ? "," : "");
492 #endif
493 if (!(sc->decode.args[i].type & OUT)) {
494 t->cs.s_args[i] = print_arg(&sc->decode.args[i],
495 t->cs.args, NULL, info);
496 }
497 }
498 #if DEBUG
499 fprintf(stderr, ")\n");
500 #endif
501
502 clock_gettime(CLOCK_REALTIME, &t->before);
503 }
504
505 /*
506 * When a thread exits voluntarily (including when a thread calls
507 * exit() to trigger a process exit), the thread's internal state
508 * holds the arguments passed to the exit system call. When the
509 * thread's exit is reported, log that system call without a return
510 * value.
511 */
512 static void
thread_exit_syscall(struct trussinfo * info)513 thread_exit_syscall(struct trussinfo *info)
514 {
515 struct threadinfo *t;
516
517 t = info->curthread;
518 if (!t->in_syscall)
519 return;
520
521 clock_gettime(CLOCK_REALTIME, &t->after);
522
523 print_syscall_ret(info, 0, NULL);
524 free_syscall(t);
525 }
526
527 static void
exit_syscall(struct trussinfo * info,struct ptrace_lwpinfo * pl)528 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
529 {
530 struct threadinfo *t;
531 struct procinfo *p;
532 struct syscall *sc;
533 struct ptrace_sc_ret psr;
534 u_int i;
535
536 t = info->curthread;
537 if (!t->in_syscall)
538 return;
539
540 clock_gettime(CLOCK_REALTIME, &t->after);
541 p = t->proc;
542 if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) {
543 free_syscall(t);
544 return;
545 }
546
547 sc = t->cs.sc;
548 /*
549 * Here, we only look for arguments that have OUT masked in --
550 * otherwise, they were handled in enter_syscall().
551 */
552 for (i = 0; i < sc->decode.nargs; i++) {
553 char *temp;
554
555 if (sc->decode.args[i].type & OUT) {
556 /*
557 * If an error occurred, then don't bother
558 * getting the data; it may not be valid.
559 */
560 if (psr.sr_error != 0) {
561 asprintf(&temp, "0x%lx",
562 (long)t->cs.args[sc->decode.args[i].offset]);
563 } else {
564 temp = print_arg(&sc->decode.args[i],
565 t->cs.args, psr.sr_retval, info);
566 }
567 t->cs.s_args[i] = temp;
568 }
569 }
570
571 print_syscall_ret(info, psr.sr_error, psr.sr_retval);
572 free_syscall(t);
573
574 /*
575 * If the process executed a new image, check the ABI. If the
576 * new ABI isn't supported, stop tracing this process.
577 */
578 if (pl->pl_flags & PL_FLAG_EXEC) {
579 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
580 p->abi = find_abi(p->pid);
581 if (p->abi == NULL) {
582 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
583 err(1, "Can not detach the process");
584 free_proc(p);
585 }
586 }
587 }
588
589 int
print_line_prefix(struct trussinfo * info)590 print_line_prefix(struct trussinfo *info)
591 {
592 struct timespec timediff;
593 struct threadinfo *t;
594 int len;
595
596 len = 0;
597 t = info->curthread;
598 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
599 if (info->flags & FOLLOWFORKS)
600 len += fprintf(info->outfile, "%5d", t->proc->pid);
601 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
602 (FOLLOWFORKS | DISPLAYTIDS))
603 len += fprintf(info->outfile, " ");
604 if (info->flags & DISPLAYTIDS)
605 len += fprintf(info->outfile, "%6d", t->tid);
606 len += fprintf(info->outfile, ": ");
607 }
608 if (info->flags & ABSOLUTETIMESTAMPS) {
609 timespecsub(&t->after, &info->start_time, &timediff);
610 len += fprintf(info->outfile, "%jd.%09ld ",
611 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
612 }
613 if (info->flags & RELATIVETIMESTAMPS) {
614 timespecsub(&t->after, &t->before, &timediff);
615 len += fprintf(info->outfile, "%jd.%09ld ",
616 (intmax_t)timediff.tv_sec, timediff.tv_nsec);
617 }
618 return (len);
619 }
620
621 static void
report_thread_death(struct trussinfo * info)622 report_thread_death(struct trussinfo *info)
623 {
624 struct threadinfo *t;
625
626 t = info->curthread;
627 clock_gettime(CLOCK_REALTIME, &t->after);
628 print_line_prefix(info);
629 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
630 }
631
632 static void
report_thread_birth(struct trussinfo * info)633 report_thread_birth(struct trussinfo *info)
634 {
635 struct threadinfo *t;
636
637 t = info->curthread;
638 clock_gettime(CLOCK_REALTIME, &t->after);
639 t->before = t->after;
640 print_line_prefix(info);
641 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
642 }
643
644 static void
report_exit(struct trussinfo * info,siginfo_t * si)645 report_exit(struct trussinfo *info, siginfo_t *si)
646 {
647 struct threadinfo *t;
648
649 t = info->curthread;
650 clock_gettime(CLOCK_REALTIME, &t->after);
651 print_line_prefix(info);
652 if (si->si_code == CLD_EXITED)
653 fprintf(info->outfile, "process exit, rval = %u\n",
654 si->si_status);
655 else
656 fprintf(info->outfile, "process killed, signal = %u%s\n",
657 si->si_status, si->si_code == CLD_DUMPED ?
658 " (core dumped)" : "");
659 }
660
661 static void
report_new_child(struct trussinfo * info)662 report_new_child(struct trussinfo *info)
663 {
664 struct threadinfo *t;
665
666 t = info->curthread;
667 clock_gettime(CLOCK_REALTIME, &t->after);
668 t->before = t->after;
669 print_line_prefix(info);
670 fprintf(info->outfile, "<new process>\n");
671 }
672
673 void
decode_siginfo(FILE * fp,siginfo_t * si)674 decode_siginfo(FILE *fp, siginfo_t *si)
675 {
676 const char *str;
677
678 fprintf(fp, " code=");
679 str = sysdecode_sigcode(si->si_signo, si->si_code);
680 if (str == NULL)
681 fprintf(fp, "%d", si->si_code);
682 else
683 fprintf(fp, "%s", str);
684 switch (si->si_code) {
685 case SI_NOINFO:
686 break;
687 case SI_QUEUE:
688 fprintf(fp, " value=%p", si->si_value.sival_ptr);
689 /* FALLTHROUGH */
690 case SI_USER:
691 case SI_LWP:
692 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
693 (intmax_t)si->si_uid);
694 break;
695 case SI_TIMER:
696 fprintf(fp, " value=%p", si->si_value.sival_ptr);
697 fprintf(fp, " timerid=%d", si->si_timerid);
698 fprintf(fp, " overrun=%d", si->si_overrun);
699 if (si->si_errno != 0)
700 fprintf(fp, " errno=%d", si->si_errno);
701 break;
702 case SI_ASYNCIO:
703 fprintf(fp, " value=%p", si->si_value.sival_ptr);
704 break;
705 case SI_MESGQ:
706 fprintf(fp, " value=%p", si->si_value.sival_ptr);
707 fprintf(fp, " mqd=%d", si->si_mqd);
708 break;
709 default:
710 switch (si->si_signo) {
711 case SIGILL:
712 case SIGFPE:
713 case SIGSEGV:
714 case SIGBUS:
715 fprintf(fp, " trapno=%d", si->si_trapno);
716 fprintf(fp, " addr=%p", si->si_addr);
717 break;
718 case SIGCHLD:
719 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
720 (intmax_t)si->si_uid);
721 fprintf(fp, " status=%d", si->si_status);
722 break;
723 }
724 }
725 }
726
727 static void
report_signal(struct trussinfo * info,siginfo_t * si,struct ptrace_lwpinfo * pl)728 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl)
729 {
730 struct threadinfo *t;
731 const char *signame;
732
733 t = info->curthread;
734 clock_gettime(CLOCK_REALTIME, &t->after);
735 print_line_prefix(info);
736 signame = sysdecode_signal(si->si_status);
737 if (signame == NULL)
738 signame = "?";
739 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame);
740 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI)
741 decode_siginfo(info->outfile, &pl->pl_siginfo);
742 fprintf(info->outfile, "\n");
743
744 }
745
746 /*
747 * Wait for events until all the processes have exited or truss has been
748 * asked to stop.
749 */
750 void
eventloop(struct trussinfo * info)751 eventloop(struct trussinfo *info)
752 {
753 struct ptrace_lwpinfo pl;
754 siginfo_t si;
755 int pending_signal;
756
757 while (!LIST_EMPTY(&info->proclist)) {
758 if (detaching) {
759 detach_all_procs(info);
760 return;
761 }
762
763 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
764 if (errno == EINTR)
765 continue;
766 err(1, "Unexpected error from waitid");
767 }
768
769 assert(si.si_signo == SIGCHLD);
770
771 switch (si.si_code) {
772 case CLD_EXITED:
773 case CLD_KILLED:
774 case CLD_DUMPED:
775 find_exit_thread(info, si.si_pid);
776 if ((info->flags & COUNTONLY) == 0) {
777 if (si.si_code == CLD_EXITED)
778 thread_exit_syscall(info);
779 report_exit(info, &si);
780 }
781 free_proc(info->curthread->proc);
782 info->curthread = NULL;
783 break;
784 case CLD_TRAPPED:
785 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
786 sizeof(pl)) == -1)
787 err(1, "ptrace(PT_LWPINFO)");
788
789 if (pl.pl_flags & PL_FLAG_CHILD) {
790 new_proc(info, si.si_pid, pl.pl_lwpid);
791 assert(LIST_FIRST(&info->proclist)->abi !=
792 NULL);
793 } else if (pl.pl_flags & PL_FLAG_BORN)
794 new_thread(find_proc(info, si.si_pid),
795 pl.pl_lwpid);
796 find_thread(info, si.si_pid, pl.pl_lwpid);
797
798 if (si.si_status == SIGTRAP &&
799 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
800 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
801 if (pl.pl_flags & PL_FLAG_BORN) {
802 if ((info->flags & COUNTONLY) == 0)
803 report_thread_birth(info);
804 } else if (pl.pl_flags & PL_FLAG_EXITED) {
805 if ((info->flags & COUNTONLY) == 0)
806 report_thread_death(info);
807 free_thread(info->curthread);
808 info->curthread = NULL;
809 } else if (pl.pl_flags & PL_FLAG_SCE)
810 enter_syscall(info, info->curthread, &pl);
811 else if (pl.pl_flags & PL_FLAG_SCX)
812 exit_syscall(info, &pl);
813 pending_signal = 0;
814 } else if (pl.pl_flags & PL_FLAG_CHILD) {
815 if ((info->flags & COUNTONLY) == 0)
816 report_new_child(info);
817 pending_signal = 0;
818 } else {
819 if ((info->flags & NOSIGS) == 0)
820 report_signal(info, &si, &pl);
821 pending_signal = si.si_status;
822 }
823 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
824 pending_signal);
825 break;
826 case CLD_STOPPED:
827 errx(1, "waitid reported CLD_STOPPED");
828 case CLD_CONTINUED:
829 break;
830 }
831 }
832 }
833