xref: /freebsd/usr.bin/truss/setup.c (revision 25ecdc7d52770caf1c9b44b5ec11f468f6b636f3)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright 1997 Sean Eric Fagan
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Sean Eric Fagan
17  * 4. Neither the name of the author may be used to endorse or promote
18  *    products derived from this software without specific prior written
19  *    permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * Various setup functions for truss.  Not the cleanest-written code,
39  * I'm afraid.
40  */
41 
42 #include <sys/ptrace.h>
43 #include <sys/sysctl.h>
44 #include <sys/time.h>
45 #include <sys/wait.h>
46 
47 #include <assert.h>
48 #include <err.h>
49 #include <errno.h>
50 #include <signal.h>
51 #include <stdbool.h>
52 #include <stdint.h>
53 #include <stdio.h>
54 #include <stdlib.h>
55 #include <string.h>
56 #include <sysdecode.h>
57 #include <time.h>
58 #include <unistd.h>
59 
60 #include "truss.h"
61 #include "syscall.h"
62 #include "extern.h"
63 
64 struct procabi_table {
65 	const char *name;
66 	struct procabi *abi;
67 };
68 
69 static sig_atomic_t detaching;
70 
71 static void	enter_syscall(struct trussinfo *, struct threadinfo *,
72 		    struct ptrace_lwpinfo *);
73 static void	new_proc(struct trussinfo *, pid_t, lwpid_t);
74 
75 
76 static struct procabi cloudabi32 = {
77 	.type = "CloudABI32",
78 	.abi = SYSDECODE_ABI_CLOUDABI32,
79 	.pointer_size = sizeof(uint32_t),
80 	.extra_syscalls = STAILQ_HEAD_INITIALIZER(cloudabi32.extra_syscalls),
81 	.syscalls = { NULL }
82 };
83 
84 static struct procabi cloudabi64 = {
85 	.type = "CloudABI64",
86 	.abi = SYSDECODE_ABI_CLOUDABI64,
87 	.pointer_size = sizeof(uint64_t),
88 	.extra_syscalls = STAILQ_HEAD_INITIALIZER(cloudabi64.extra_syscalls),
89 	.syscalls = { NULL }
90 };
91 
92 static struct procabi freebsd = {
93 	.type = "FreeBSD",
94 	.abi = SYSDECODE_ABI_FREEBSD,
95 	.pointer_size = sizeof(void *),
96 	.extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls),
97 	.syscalls = { NULL }
98 };
99 
100 #if !defined(__SIZEOF_POINTER__)
101 #error "Use a modern compiler."
102 #endif
103 
104 #if __SIZEOF_POINTER__ > 4
105 static struct procabi freebsd32 = {
106 	.type = "FreeBSD32",
107 	.abi = SYSDECODE_ABI_FREEBSD32,
108 	.pointer_size = sizeof(uint32_t),
109 	.compat_prefix = "freebsd32_",
110 	.extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls),
111 	.syscalls = { NULL }
112 };
113 #endif
114 
115 static struct procabi linux = {
116 	.type = "Linux",
117 	.abi = SYSDECODE_ABI_LINUX,
118 	.pointer_size = sizeof(void *),
119 	.extra_syscalls = STAILQ_HEAD_INITIALIZER(linux.extra_syscalls),
120 	.syscalls = { NULL }
121 };
122 
123 #if __SIZEOF_POINTER__ > 4
124 static struct procabi linux32 = {
125 	.type = "Linux32",
126 	.abi = SYSDECODE_ABI_LINUX32,
127 	.pointer_size = sizeof(uint32_t),
128 	.extra_syscalls = STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls),
129 	.syscalls = { NULL }
130 };
131 #endif
132 
133 static struct procabi_table abis[] = {
134 	{ "CloudABI ELF32", &cloudabi32 },
135 	{ "CloudABI ELF64", &cloudabi64 },
136 #if __SIZEOF_POINTER__ == 4
137 	{ "FreeBSD ELF32", &freebsd },
138 #elif __SIZEOF_POINTER__ == 8
139 	{ "FreeBSD ELF64", &freebsd },
140 	{ "FreeBSD ELF32", &freebsd32 },
141 #else
142 #error "Unsupported pointer size"
143 #endif
144 #if defined(__powerpc64__)
145 	{ "FreeBSD ELF64 V2", &freebsd },
146 #endif
147 #if defined(__amd64__)
148 	{ "FreeBSD a.out", &freebsd32 },
149 #endif
150 #if defined(__i386__)
151 	{ "FreeBSD a.out", &freebsd },
152 #endif
153 #if __SIZEOF_POINTER__ >= 8
154 	{ "Linux ELF64", &linux },
155 	{ "Linux ELF32", &linux32 },
156 #else
157 	{ "Linux ELF32", &linux },
158 #endif
159 };
160 
161 /*
162  * setup_and_wait() is called to start a process.  All it really does
163  * is fork(), enable tracing in the child, and then exec the given
164  * command.  At that point, the child process stops, and the parent
165  * can wake up and deal with it.
166  */
167 void
168 setup_and_wait(struct trussinfo *info, char *command[])
169 {
170 	pid_t pid;
171 
172 	pid = vfork();
173 	if (pid == -1)
174 		err(1, "fork failed");
175 	if (pid == 0) {	/* Child */
176 		ptrace(PT_TRACE_ME, 0, 0, 0);
177 		execvp(command[0], command);
178 		err(1, "execvp %s", command[0]);
179 	}
180 
181 	/* Only in the parent here */
182 	if (waitpid(pid, NULL, 0) < 0)
183 		err(1, "unexpect stop in waitpid");
184 
185 	new_proc(info, pid, 0);
186 }
187 
188 /*
189  * start_tracing is called to attach to an existing process.
190  */
191 void
192 start_tracing(struct trussinfo *info, pid_t pid)
193 {
194 	int ret, retry;
195 
196 	retry = 10;
197 	do {
198 		ret = ptrace(PT_ATTACH, pid, NULL, 0);
199 		usleep(200);
200 	} while (ret && retry-- > 0);
201 	if (ret)
202 		err(1, "can not attach to target process");
203 
204 	if (waitpid(pid, NULL, 0) < 0)
205 		err(1, "Unexpect stop in waitpid");
206 
207 	new_proc(info, pid, 0);
208 }
209 
210 /*
211  * Restore a process back to it's pre-truss state.
212  * Called for SIGINT, SIGTERM, SIGQUIT.  This only
213  * applies if truss was told to monitor an already-existing
214  * process.
215  */
216 void
217 restore_proc(int signo __unused)
218 {
219 
220 	detaching = 1;
221 }
222 
223 static void
224 detach_proc(pid_t pid)
225 {
226 
227 	/* stop the child so that we can detach */
228 	kill(pid, SIGSTOP);
229 	if (waitpid(pid, NULL, 0) < 0)
230 		err(1, "Unexpected stop in waitpid");
231 
232 	if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
233 		err(1, "Can not detach the process");
234 
235 	kill(pid, SIGCONT);
236 }
237 
238 /*
239  * Determine the ABI.  This is called after every exec, and when
240  * a process is first monitored.
241  */
242 static struct procabi *
243 find_abi(pid_t pid)
244 {
245 	size_t len;
246 	unsigned int i;
247 	int error;
248 	int mib[4];
249 	char progt[32];
250 
251 	len = sizeof(progt);
252 	mib[0] = CTL_KERN;
253 	mib[1] = KERN_PROC;
254 	mib[2] = KERN_PROC_SV_NAME;
255 	mib[3] = pid;
256 	error = sysctl(mib, 4, progt, &len, NULL, 0);
257 	if (error != 0)
258 		err(2, "can not get sysvec name");
259 
260 	for (i = 0; i < nitems(abis); i++) {
261 		if (strcmp(abis[i].name, progt) == 0)
262 			return (abis[i].abi);
263 	}
264 	warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
265 	return (NULL);
266 }
267 
268 static struct threadinfo *
269 new_thread(struct procinfo *p, lwpid_t lwpid)
270 {
271 	struct threadinfo *nt;
272 
273 	/*
274 	 * If this happens it means there is a bug in truss.  Unfortunately
275 	 * this will kill any processes truss is attached to.
276 	 */
277 	LIST_FOREACH(nt, &p->threadlist, entries) {
278 		if (nt->tid == lwpid)
279 			errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
280 	}
281 
282 	nt = calloc(1, sizeof(struct threadinfo));
283 	if (nt == NULL)
284 		err(1, "calloc() failed");
285 	nt->proc = p;
286 	nt->tid = lwpid;
287 	LIST_INSERT_HEAD(&p->threadlist, nt, entries);
288 	return (nt);
289 }
290 
291 static void
292 free_thread(struct threadinfo *t)
293 {
294 
295 	LIST_REMOVE(t, entries);
296 	free(t);
297 }
298 
299 static void
300 add_threads(struct trussinfo *info, struct procinfo *p)
301 {
302 	struct ptrace_lwpinfo pl;
303 	struct threadinfo *t;
304 	lwpid_t *lwps;
305 	int i, nlwps;
306 
307 	nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
308 	if (nlwps == -1)
309 		err(1, "Unable to fetch number of LWPs");
310 	assert(nlwps > 0);
311 	lwps = calloc(nlwps, sizeof(*lwps));
312 	nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
313 	if (nlwps == -1)
314 		err(1, "Unable to fetch LWP list");
315 	for (i = 0; i < nlwps; i++) {
316 		t = new_thread(p, lwps[i]);
317 		if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
318 			err(1, "ptrace(PT_LWPINFO)");
319 		if (pl.pl_flags & PL_FLAG_SCE) {
320 			info->curthread = t;
321 			enter_syscall(info, t, &pl);
322 		}
323 	}
324 	free(lwps);
325 }
326 
327 static void
328 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
329 {
330 	struct procinfo *np;
331 
332 	/*
333 	 * If this happens it means there is a bug in truss.  Unfortunately
334 	 * this will kill any processes truss is attached to.
335 	 */
336 	LIST_FOREACH(np, &info->proclist, entries) {
337 		if (np->pid == pid)
338 			errx(1, "Duplicate process for pid %ld", (long)pid);
339 	}
340 
341 	if (info->flags & FOLLOWFORKS)
342 		if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
343 			err(1, "Unable to follow forks for pid %ld", (long)pid);
344 	if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
345 		err(1, "Unable to enable LWP events for pid %ld", (long)pid);
346 	np = calloc(1, sizeof(struct procinfo));
347 	np->pid = pid;
348 	np->abi = find_abi(pid);
349 	LIST_INIT(&np->threadlist);
350 	LIST_INSERT_HEAD(&info->proclist, np, entries);
351 
352 	if (lwpid != 0)
353 		new_thread(np, lwpid);
354 	else
355 		add_threads(info, np);
356 }
357 
358 static void
359 free_proc(struct procinfo *p)
360 {
361 	struct threadinfo *t, *t2;
362 
363 	LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
364 		free(t);
365 	}
366 	LIST_REMOVE(p, entries);
367 	free(p);
368 }
369 
370 static void
371 detach_all_procs(struct trussinfo *info)
372 {
373 	struct procinfo *p, *p2;
374 
375 	LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
376 		detach_proc(p->pid);
377 		free_proc(p);
378 	}
379 }
380 
381 static struct procinfo *
382 find_proc(struct trussinfo *info, pid_t pid)
383 {
384 	struct procinfo *np;
385 
386 	LIST_FOREACH(np, &info->proclist, entries) {
387 		if (np->pid == pid)
388 			return (np);
389 	}
390 
391 	return (NULL);
392 }
393 
394 /*
395  * Change curthread member based on (pid, lwpid).
396  */
397 static void
398 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
399 {
400 	struct procinfo *np;
401 	struct threadinfo *nt;
402 
403 	np = find_proc(info, pid);
404 	assert(np != NULL);
405 
406 	LIST_FOREACH(nt, &np->threadlist, entries) {
407 		if (nt->tid == lwpid) {
408 			info->curthread = nt;
409 			return;
410 		}
411 	}
412 	errx(1, "could not find thread");
413 }
414 
415 /*
416  * When a process exits, it should have exactly one thread left.
417  * All of the other threads should have reported thread exit events.
418  */
419 static void
420 find_exit_thread(struct trussinfo *info, pid_t pid)
421 {
422 	struct procinfo *p;
423 
424 	p = find_proc(info, pid);
425 	assert(p != NULL);
426 
427 	info->curthread = LIST_FIRST(&p->threadlist);
428 	assert(info->curthread != NULL);
429 	assert(LIST_NEXT(info->curthread, entries) == NULL);
430 }
431 
432 static void
433 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
434 {
435 	u_int i;
436 
437 	assert(t->in_syscall == 0);
438 	assert(t->cs.number == 0);
439 	assert(t->cs.sc == NULL);
440 	assert(t->cs.nargs == 0);
441 	for (i = 0; i < nitems(t->cs.s_args); i++)
442 		assert(t->cs.s_args[i] == NULL);
443 	memset(t->cs.args, 0, sizeof(t->cs.args));
444 	t->cs.number = pl->pl_syscall_code;
445 	t->in_syscall = 1;
446 }
447 
448 static void
449 free_syscall(struct threadinfo *t)
450 {
451 	u_int i;
452 
453 	for (i = 0; i < t->cs.nargs; i++)
454 		free(t->cs.s_args[i]);
455 	memset(&t->cs, 0, sizeof(t->cs));
456 	t->in_syscall = 0;
457 }
458 
459 static void
460 enter_syscall(struct trussinfo *info, struct threadinfo *t,
461     struct ptrace_lwpinfo *pl)
462 {
463 	struct syscall *sc;
464 	u_int i, narg;
465 
466 	alloc_syscall(t, pl);
467 	narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
468 	if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args,
469 	    sizeof(t->cs.args)) != 0) {
470 		free_syscall(t);
471 		return;
472 	}
473 
474 	sc = get_syscall(t, t->cs.number, narg);
475 	if (sc->unknown)
476 		fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
477 		    t->proc->abi->type, t->cs.number);
478 
479 	t->cs.nargs = sc->decode.nargs;
480 	assert(sc->decode.nargs <= nitems(t->cs.s_args));
481 
482 	t->cs.sc = sc;
483 
484 	/*
485 	 * At this point, we set up the system call arguments.
486 	 * We ignore any OUT ones, however -- those are arguments that
487 	 * are set by the system call, and so are probably meaningless
488 	 * now.	This doesn't currently support arguments that are
489 	 * passed in *and* out, however.
490 	 */
491 #if DEBUG
492 	fprintf(stderr, "syscall %s(", sc->name);
493 #endif
494 	for (i = 0; i < t->cs.nargs; i++) {
495 #if DEBUG
496 		fprintf(stderr, "0x%lx%s",
497 		    t->cs.args[sc->decode.args[i].offset],
498 		    i < (t->cs.nargs - 1) ? "," : "");
499 #endif
500 		if (!(sc->decode.args[i].type & OUT)) {
501 			t->cs.s_args[i] = print_arg(&sc->decode.args[i],
502 			    t->cs.args, NULL, info);
503 		}
504 	}
505 #if DEBUG
506 	fprintf(stderr, ")\n");
507 #endif
508 
509 	clock_gettime(CLOCK_REALTIME, &t->before);
510 }
511 
512 /*
513  * When a thread exits voluntarily (including when a thread calls
514  * exit() to trigger a process exit), the thread's internal state
515  * holds the arguments passed to the exit system call.  When the
516  * thread's exit is reported, log that system call without a return
517  * value.
518  */
519 static void
520 thread_exit_syscall(struct trussinfo *info)
521 {
522 	struct threadinfo *t;
523 
524 	t = info->curthread;
525 	if (!t->in_syscall)
526 		return;
527 
528 	clock_gettime(CLOCK_REALTIME, &t->after);
529 
530 	print_syscall_ret(info, 0, NULL);
531 	free_syscall(t);
532 }
533 
534 static void
535 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
536 {
537 	struct threadinfo *t;
538 	struct procinfo *p;
539 	struct syscall *sc;
540 	struct ptrace_sc_ret psr;
541 	u_int i;
542 
543 	t = info->curthread;
544 	if (!t->in_syscall)
545 		return;
546 
547 	clock_gettime(CLOCK_REALTIME, &t->after);
548 	p = t->proc;
549 	if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) {
550 		free_syscall(t);
551 		return;
552 	}
553 
554 	sc = t->cs.sc;
555 	/*
556 	 * Here, we only look for arguments that have OUT masked in --
557 	 * otherwise, they were handled in enter_syscall().
558 	 */
559 	for (i = 0; i < sc->decode.nargs; i++) {
560 		char *temp;
561 
562 		if (sc->decode.args[i].type & OUT) {
563 			/*
564 			 * If an error occurred, then don't bother
565 			 * getting the data; it may not be valid.
566 			 */
567 			if (psr.sr_error != 0) {
568 				asprintf(&temp, "0x%lx",
569 				    t->cs.args[sc->decode.args[i].offset]);
570 			} else {
571 				temp = print_arg(&sc->decode.args[i],
572 				    t->cs.args, psr.sr_retval, info);
573 			}
574 			t->cs.s_args[i] = temp;
575 		}
576 	}
577 
578 	print_syscall_ret(info, psr.sr_error, psr.sr_retval);
579 	free_syscall(t);
580 
581 	/*
582 	 * If the process executed a new image, check the ABI.  If the
583 	 * new ABI isn't supported, stop tracing this process.
584 	 */
585 	if (pl->pl_flags & PL_FLAG_EXEC) {
586 		assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
587 		p->abi = find_abi(p->pid);
588 		if (p->abi == NULL) {
589 			if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
590 				err(1, "Can not detach the process");
591 			free_proc(p);
592 		}
593 	}
594 }
595 
596 int
597 print_line_prefix(struct trussinfo *info)
598 {
599 	struct timespec timediff;
600 	struct threadinfo *t;
601 	int len;
602 
603 	len = 0;
604 	t = info->curthread;
605 	if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
606 		if (info->flags & FOLLOWFORKS)
607 			len += fprintf(info->outfile, "%5d", t->proc->pid);
608 		if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
609 		    (FOLLOWFORKS | DISPLAYTIDS))
610 			len += fprintf(info->outfile, " ");
611 		if (info->flags & DISPLAYTIDS)
612 			len += fprintf(info->outfile, "%6d", t->tid);
613 		len += fprintf(info->outfile, ": ");
614 	}
615 	if (info->flags & ABSOLUTETIMESTAMPS) {
616 		timespecsub(&t->after, &info->start_time, &timediff);
617 		len += fprintf(info->outfile, "%jd.%09ld ",
618 		    (intmax_t)timediff.tv_sec, timediff.tv_nsec);
619 	}
620 	if (info->flags & RELATIVETIMESTAMPS) {
621 		timespecsub(&t->after, &t->before, &timediff);
622 		len += fprintf(info->outfile, "%jd.%09ld ",
623 		    (intmax_t)timediff.tv_sec, timediff.tv_nsec);
624 	}
625 	return (len);
626 }
627 
628 static void
629 report_thread_death(struct trussinfo *info)
630 {
631 	struct threadinfo *t;
632 
633 	t = info->curthread;
634 	clock_gettime(CLOCK_REALTIME, &t->after);
635 	print_line_prefix(info);
636 	fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
637 }
638 
639 static void
640 report_thread_birth(struct trussinfo *info)
641 {
642 	struct threadinfo *t;
643 
644 	t = info->curthread;
645 	clock_gettime(CLOCK_REALTIME, &t->after);
646 	t->before = t->after;
647 	print_line_prefix(info);
648 	fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
649 }
650 
651 static void
652 report_exit(struct trussinfo *info, siginfo_t *si)
653 {
654 	struct threadinfo *t;
655 
656 	t = info->curthread;
657 	clock_gettime(CLOCK_REALTIME, &t->after);
658 	print_line_prefix(info);
659 	if (si->si_code == CLD_EXITED)
660 		fprintf(info->outfile, "process exit, rval = %u\n",
661 		    si->si_status);
662 	else
663 		fprintf(info->outfile, "process killed, signal = %u%s\n",
664 		    si->si_status, si->si_code == CLD_DUMPED ?
665 		    " (core dumped)" : "");
666 }
667 
668 static void
669 report_new_child(struct trussinfo *info)
670 {
671 	struct threadinfo *t;
672 
673 	t = info->curthread;
674 	clock_gettime(CLOCK_REALTIME, &t->after);
675 	t->before = t->after;
676 	print_line_prefix(info);
677 	fprintf(info->outfile, "<new process>\n");
678 }
679 
680 void
681 decode_siginfo(FILE *fp, siginfo_t *si)
682 {
683 	const char *str;
684 
685 	fprintf(fp, " code=");
686 	str = sysdecode_sigcode(si->si_signo, si->si_code);
687 	if (str == NULL)
688 		fprintf(fp, "%d", si->si_code);
689 	else
690 		fprintf(fp, "%s", str);
691 	switch (si->si_code) {
692 	case SI_NOINFO:
693 		break;
694 	case SI_QUEUE:
695 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
696 		/* FALLTHROUGH */
697 	case SI_USER:
698 	case SI_LWP:
699 		fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
700 		    (intmax_t)si->si_uid);
701 		break;
702 	case SI_TIMER:
703 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
704 		fprintf(fp, " timerid=%d", si->si_timerid);
705 		fprintf(fp, " overrun=%d", si->si_overrun);
706 		if (si->si_errno != 0)
707 			fprintf(fp, " errno=%d", si->si_errno);
708 		break;
709 	case SI_ASYNCIO:
710 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
711 		break;
712 	case SI_MESGQ:
713 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
714 		fprintf(fp, " mqd=%d", si->si_mqd);
715 		break;
716 	default:
717 		switch (si->si_signo) {
718 		case SIGILL:
719 		case SIGFPE:
720 		case SIGSEGV:
721 		case SIGBUS:
722 			fprintf(fp, " trapno=%d", si->si_trapno);
723 			fprintf(fp, " addr=%p", si->si_addr);
724 			break;
725 		case SIGCHLD:
726 			fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
727 			    (intmax_t)si->si_uid);
728 			fprintf(fp, " status=%d", si->si_status);
729 			break;
730 		}
731 	}
732 }
733 
734 static void
735 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl)
736 {
737 	struct threadinfo *t;
738 	const char *signame;
739 
740 	t = info->curthread;
741 	clock_gettime(CLOCK_REALTIME, &t->after);
742 	print_line_prefix(info);
743 	signame = sysdecode_signal(si->si_status);
744 	if (signame == NULL)
745 		signame = "?";
746 	fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame);
747 	if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI)
748 		decode_siginfo(info->outfile, &pl->pl_siginfo);
749 	fprintf(info->outfile, "\n");
750 
751 }
752 
753 /*
754  * Wait for events until all the processes have exited or truss has been
755  * asked to stop.
756  */
757 void
758 eventloop(struct trussinfo *info)
759 {
760 	struct ptrace_lwpinfo pl;
761 	siginfo_t si;
762 	int pending_signal;
763 
764 	while (!LIST_EMPTY(&info->proclist)) {
765 		if (detaching) {
766 			detach_all_procs(info);
767 			return;
768 		}
769 
770 		if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
771 			if (errno == EINTR)
772 				continue;
773 			err(1, "Unexpected error from waitid");
774 		}
775 
776 		assert(si.si_signo == SIGCHLD);
777 
778 		switch (si.si_code) {
779 		case CLD_EXITED:
780 		case CLD_KILLED:
781 		case CLD_DUMPED:
782 			find_exit_thread(info, si.si_pid);
783 			if ((info->flags & COUNTONLY) == 0) {
784 				if (si.si_code == CLD_EXITED)
785 					thread_exit_syscall(info);
786 				report_exit(info, &si);
787 			}
788 			free_proc(info->curthread->proc);
789 			info->curthread = NULL;
790 			break;
791 		case CLD_TRAPPED:
792 			if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
793 			    sizeof(pl)) == -1)
794 				err(1, "ptrace(PT_LWPINFO)");
795 
796 			if (pl.pl_flags & PL_FLAG_CHILD) {
797 				new_proc(info, si.si_pid, pl.pl_lwpid);
798 				assert(LIST_FIRST(&info->proclist)->abi !=
799 				    NULL);
800 			} else if (pl.pl_flags & PL_FLAG_BORN)
801 				new_thread(find_proc(info, si.si_pid),
802 				    pl.pl_lwpid);
803 			find_thread(info, si.si_pid, pl.pl_lwpid);
804 
805 			if (si.si_status == SIGTRAP &&
806 			    (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
807 			    PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
808 				if (pl.pl_flags & PL_FLAG_BORN) {
809 					if ((info->flags & COUNTONLY) == 0)
810 						report_thread_birth(info);
811 				} else if (pl.pl_flags & PL_FLAG_EXITED) {
812 					if ((info->flags & COUNTONLY) == 0)
813 						report_thread_death(info);
814 					free_thread(info->curthread);
815 					info->curthread = NULL;
816 				} else if (pl.pl_flags & PL_FLAG_SCE)
817 					enter_syscall(info, info->curthread, &pl);
818 				else if (pl.pl_flags & PL_FLAG_SCX)
819 					exit_syscall(info, &pl);
820 				pending_signal = 0;
821 			} else if (pl.pl_flags & PL_FLAG_CHILD) {
822 				if ((info->flags & COUNTONLY) == 0)
823 					report_new_child(info);
824 				pending_signal = 0;
825 			} else {
826 				if ((info->flags & NOSIGS) == 0)
827 					report_signal(info, &si, &pl);
828 				pending_signal = si.si_status;
829 			}
830 			ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
831 			    pending_signal);
832 			break;
833 		case CLD_STOPPED:
834 			errx(1, "waitid reported CLD_STOPPED");
835 		case CLD_CONTINUED:
836 			break;
837 		}
838 	}
839 }
840