1 /*- 2 * SPDX-License-Identifier: BSD-4-Clause 3 * 4 * Copyright 1997 Sean Eric Fagan 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. All advertising materials mentioning features or use of this software 15 * must display the following acknowledgement: 16 * This product includes software developed by Sean Eric Fagan 17 * 4. Neither the name of the author may be used to endorse or promote 18 * products derived from this software without specific prior written 19 * permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 /* 38 * Various setup functions for truss. Not the cleanest-written code, 39 * I'm afraid. 40 */ 41 42 #include <sys/ptrace.h> 43 #include <sys/sysctl.h> 44 #include <sys/time.h> 45 #include <sys/wait.h> 46 47 #include <assert.h> 48 #include <err.h> 49 #include <errno.h> 50 #include <signal.h> 51 #include <stdbool.h> 52 #include <stdint.h> 53 #include <stdio.h> 54 #include <stdlib.h> 55 #include <string.h> 56 #include <sysdecode.h> 57 #include <time.h> 58 #include <unistd.h> 59 60 #include "truss.h" 61 #include "syscall.h" 62 #include "extern.h" 63 64 struct procabi_table { 65 const char *name; 66 struct procabi *abi; 67 }; 68 69 static sig_atomic_t detaching; 70 71 static void enter_syscall(struct trussinfo *, struct threadinfo *, 72 struct ptrace_lwpinfo *); 73 static void new_proc(struct trussinfo *, pid_t, lwpid_t); 74 75 76 static struct procabi freebsd = { 77 .type = "FreeBSD", 78 .abi = SYSDECODE_ABI_FREEBSD, 79 .pointer_size = sizeof(void *), 80 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls), 81 .syscalls = { NULL } 82 }; 83 84 #if !defined(__SIZEOF_POINTER__) 85 #error "Use a modern compiler." 86 #endif 87 88 #if __SIZEOF_POINTER__ > 4 89 static struct procabi freebsd32 = { 90 .type = "FreeBSD32", 91 .abi = SYSDECODE_ABI_FREEBSD32, 92 .pointer_size = sizeof(uint32_t), 93 .compat_prefix = "freebsd32_", 94 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls), 95 .syscalls = { NULL } 96 }; 97 #endif 98 99 static struct procabi linux = { 100 .type = "Linux", 101 .abi = SYSDECODE_ABI_LINUX, 102 .pointer_size = sizeof(void *), 103 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux.extra_syscalls), 104 .syscalls = { NULL } 105 }; 106 107 #if __SIZEOF_POINTER__ > 4 108 static struct procabi linux32 = { 109 .type = "Linux32", 110 .abi = SYSDECODE_ABI_LINUX32, 111 .pointer_size = sizeof(uint32_t), 112 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls), 113 .syscalls = { NULL } 114 }; 115 #endif 116 117 static struct procabi_table abis[] = { 118 #if __SIZEOF_POINTER__ == 4 119 { "FreeBSD ELF32", &freebsd }, 120 #elif __SIZEOF_POINTER__ == 8 121 { "FreeBSD ELF64", &freebsd }, 122 { "FreeBSD ELF32", &freebsd32 }, 123 #else 124 #error "Unsupported pointer size" 125 #endif 126 #if defined(__powerpc64__) 127 { "FreeBSD ELF64 V2", &freebsd }, 128 #endif 129 #if defined(__amd64__) 130 { "FreeBSD a.out", &freebsd32 }, 131 #endif 132 #if defined(__i386__) 133 { "FreeBSD a.out", &freebsd }, 134 #endif 135 #if __SIZEOF_POINTER__ >= 8 136 { "Linux ELF64", &linux }, 137 { "Linux ELF32", &linux32 }, 138 #else 139 { "Linux ELF32", &linux }, 140 #endif 141 }; 142 143 /* 144 * setup_and_wait() is called to start a process. All it really does 145 * is fork(), enable tracing in the child, and then exec the given 146 * command. At that point, the child process stops, and the parent 147 * can wake up and deal with it. 148 */ 149 void 150 setup_and_wait(struct trussinfo *info, char *command[]) 151 { 152 pid_t pid; 153 154 pid = vfork(); 155 if (pid == -1) 156 err(1, "fork failed"); 157 if (pid == 0) { /* Child */ 158 ptrace(PT_TRACE_ME, 0, 0, 0); 159 execvp(command[0], command); 160 err(1, "execvp %s", command[0]); 161 } 162 163 /* Only in the parent here */ 164 if (waitpid(pid, NULL, 0) < 0) 165 err(1, "unexpect stop in waitpid"); 166 167 new_proc(info, pid, 0); 168 } 169 170 /* 171 * start_tracing is called to attach to an existing process. 172 */ 173 void 174 start_tracing(struct trussinfo *info, pid_t pid) 175 { 176 int ret, retry; 177 178 retry = 10; 179 do { 180 ret = ptrace(PT_ATTACH, pid, NULL, 0); 181 usleep(200); 182 } while (ret && retry-- > 0); 183 if (ret) 184 err(1, "can not attach to target process"); 185 186 if (waitpid(pid, NULL, 0) < 0) 187 err(1, "Unexpect stop in waitpid"); 188 189 new_proc(info, pid, 0); 190 } 191 192 /* 193 * Restore a process back to it's pre-truss state. 194 * Called for SIGINT, SIGTERM, SIGQUIT. This only 195 * applies if truss was told to monitor an already-existing 196 * process. 197 */ 198 void 199 restore_proc(int signo __unused) 200 { 201 202 detaching = 1; 203 } 204 205 static void 206 detach_proc(pid_t pid) 207 { 208 int sig, status; 209 210 /* 211 * Stop the child so that we can detach. Filter out possible 212 * lingering SIGTRAP events buffered in the threads. 213 */ 214 kill(pid, SIGSTOP); 215 for (;;) { 216 if (waitpid(pid, &status, 0) < 0) 217 err(1, "Unexpected error in waitpid"); 218 sig = WIFSTOPPED(status) ? WSTOPSIG(status) : 0; 219 if (sig == SIGSTOP) 220 break; 221 if (sig == SIGTRAP) 222 sig = 0; 223 if (ptrace(PT_CONTINUE, pid, (caddr_t)1, sig) < 0) 224 err(1, "Can not continue for detach"); 225 } 226 227 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0) 228 err(1, "Can not detach the process"); 229 230 kill(pid, SIGCONT); 231 } 232 233 /* 234 * Determine the ABI. This is called after every exec, and when 235 * a process is first monitored. 236 */ 237 static struct procabi * 238 find_abi(pid_t pid) 239 { 240 size_t len; 241 unsigned int i; 242 int error; 243 int mib[4]; 244 char progt[32]; 245 246 len = sizeof(progt); 247 mib[0] = CTL_KERN; 248 mib[1] = KERN_PROC; 249 mib[2] = KERN_PROC_SV_NAME; 250 mib[3] = pid; 251 error = sysctl(mib, 4, progt, &len, NULL, 0); 252 if (error != 0) 253 err(2, "can not get sysvec name"); 254 255 for (i = 0; i < nitems(abis); i++) { 256 if (strcmp(abis[i].name, progt) == 0) 257 return (abis[i].abi); 258 } 259 warnx("ABI %s for pid %ld is not supported", progt, (long)pid); 260 return (NULL); 261 } 262 263 static struct threadinfo * 264 new_thread(struct procinfo *p, lwpid_t lwpid) 265 { 266 struct threadinfo *nt; 267 268 /* 269 * If this happens it means there is a bug in truss. Unfortunately 270 * this will kill any processes truss is attached to. 271 */ 272 LIST_FOREACH(nt, &p->threadlist, entries) { 273 if (nt->tid == lwpid) 274 errx(1, "Duplicate thread for LWP %ld", (long)lwpid); 275 } 276 277 nt = calloc(1, sizeof(struct threadinfo)); 278 if (nt == NULL) 279 err(1, "calloc() failed"); 280 nt->proc = p; 281 nt->tid = lwpid; 282 LIST_INSERT_HEAD(&p->threadlist, nt, entries); 283 return (nt); 284 } 285 286 static void 287 free_thread(struct threadinfo *t) 288 { 289 290 LIST_REMOVE(t, entries); 291 free(t); 292 } 293 294 static void 295 add_threads(struct trussinfo *info, struct procinfo *p) 296 { 297 struct ptrace_lwpinfo pl; 298 struct threadinfo *t; 299 lwpid_t *lwps; 300 int i, nlwps; 301 302 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0); 303 if (nlwps == -1) 304 err(1, "Unable to fetch number of LWPs"); 305 assert(nlwps > 0); 306 lwps = calloc(nlwps, sizeof(*lwps)); 307 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps); 308 if (nlwps == -1) 309 err(1, "Unable to fetch LWP list"); 310 for (i = 0; i < nlwps; i++) { 311 t = new_thread(p, lwps[i]); 312 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1) 313 err(1, "ptrace(PT_LWPINFO)"); 314 if (pl.pl_flags & PL_FLAG_SCE) { 315 info->curthread = t; 316 enter_syscall(info, t, &pl); 317 } 318 } 319 free(lwps); 320 } 321 322 static void 323 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 324 { 325 struct procinfo *np; 326 327 /* 328 * If this happens it means there is a bug in truss. Unfortunately 329 * this will kill any processes truss is attached to. 330 */ 331 LIST_FOREACH(np, &info->proclist, entries) { 332 if (np->pid == pid) 333 errx(1, "Duplicate process for pid %ld", (long)pid); 334 } 335 336 if (info->flags & FOLLOWFORKS) 337 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1) 338 err(1, "Unable to follow forks for pid %ld", (long)pid); 339 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1) 340 err(1, "Unable to enable LWP events for pid %ld", (long)pid); 341 np = calloc(1, sizeof(struct procinfo)); 342 np->pid = pid; 343 np->abi = find_abi(pid); 344 LIST_INIT(&np->threadlist); 345 LIST_INSERT_HEAD(&info->proclist, np, entries); 346 347 if (lwpid != 0) 348 new_thread(np, lwpid); 349 else 350 add_threads(info, np); 351 } 352 353 static void 354 free_proc(struct procinfo *p) 355 { 356 struct threadinfo *t, *t2; 357 358 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) { 359 free(t); 360 } 361 LIST_REMOVE(p, entries); 362 free(p); 363 } 364 365 static void 366 detach_all_procs(struct trussinfo *info) 367 { 368 struct procinfo *p, *p2; 369 370 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) { 371 detach_proc(p->pid); 372 free_proc(p); 373 } 374 } 375 376 static struct procinfo * 377 find_proc(struct trussinfo *info, pid_t pid) 378 { 379 struct procinfo *np; 380 381 LIST_FOREACH(np, &info->proclist, entries) { 382 if (np->pid == pid) 383 return (np); 384 } 385 386 return (NULL); 387 } 388 389 /* 390 * Change curthread member based on (pid, lwpid). 391 */ 392 static void 393 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 394 { 395 struct procinfo *np; 396 struct threadinfo *nt; 397 398 np = find_proc(info, pid); 399 assert(np != NULL); 400 401 LIST_FOREACH(nt, &np->threadlist, entries) { 402 if (nt->tid == lwpid) { 403 info->curthread = nt; 404 return; 405 } 406 } 407 errx(1, "could not find thread"); 408 } 409 410 /* 411 * When a process exits, it should have exactly one thread left. 412 * All of the other threads should have reported thread exit events. 413 */ 414 static void 415 find_exit_thread(struct trussinfo *info, pid_t pid) 416 { 417 struct procinfo *p; 418 419 p = find_proc(info, pid); 420 assert(p != NULL); 421 422 info->curthread = LIST_FIRST(&p->threadlist); 423 assert(info->curthread != NULL); 424 assert(LIST_NEXT(info->curthread, entries) == NULL); 425 } 426 427 static void 428 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl) 429 { 430 u_int i; 431 432 assert(t->in_syscall == 0); 433 assert(t->cs.number == 0); 434 assert(t->cs.sc == NULL); 435 assert(t->cs.nargs == 0); 436 for (i = 0; i < nitems(t->cs.s_args); i++) 437 assert(t->cs.s_args[i] == NULL); 438 memset(t->cs.args, 0, sizeof(t->cs.args)); 439 t->cs.number = pl->pl_syscall_code; 440 t->in_syscall = 1; 441 } 442 443 static void 444 free_syscall(struct threadinfo *t) 445 { 446 u_int i; 447 448 for (i = 0; i < t->cs.nargs; i++) 449 free(t->cs.s_args[i]); 450 memset(&t->cs, 0, sizeof(t->cs)); 451 t->in_syscall = 0; 452 } 453 454 static void 455 enter_syscall(struct trussinfo *info, struct threadinfo *t, 456 struct ptrace_lwpinfo *pl) 457 { 458 struct syscall *sc; 459 u_int i, narg; 460 461 alloc_syscall(t, pl); 462 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args)); 463 if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args, 464 sizeof(t->cs.args)) != 0) { 465 free_syscall(t); 466 return; 467 } 468 469 sc = get_syscall(t, t->cs.number, narg); 470 if (sc->unknown) 471 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n", 472 t->proc->abi->type, t->cs.number); 473 474 t->cs.nargs = sc->decode.nargs; 475 assert(sc->decode.nargs <= nitems(t->cs.s_args)); 476 477 t->cs.sc = sc; 478 479 /* 480 * At this point, we set up the system call arguments. 481 * We ignore any OUT ones, however -- those are arguments that 482 * are set by the system call, and so are probably meaningless 483 * now. This doesn't currently support arguments that are 484 * passed in *and* out, however. 485 */ 486 #if DEBUG 487 fprintf(stderr, "syscall %s(", sc->name); 488 #endif 489 for (i = 0; i < t->cs.nargs; i++) { 490 #if DEBUG 491 fprintf(stderr, "0x%lx%s", 492 t->cs.args[sc->decode.args[i].offset], 493 i < (t->cs.nargs - 1) ? "," : ""); 494 #endif 495 if (!(sc->decode.args[i].type & OUT)) { 496 t->cs.s_args[i] = print_arg(&sc->decode.args[i], 497 t->cs.args, NULL, info); 498 } 499 } 500 #if DEBUG 501 fprintf(stderr, ")\n"); 502 #endif 503 504 clock_gettime(CLOCK_REALTIME, &t->before); 505 } 506 507 /* 508 * When a thread exits voluntarily (including when a thread calls 509 * exit() to trigger a process exit), the thread's internal state 510 * holds the arguments passed to the exit system call. When the 511 * thread's exit is reported, log that system call without a return 512 * value. 513 */ 514 static void 515 thread_exit_syscall(struct trussinfo *info) 516 { 517 struct threadinfo *t; 518 519 t = info->curthread; 520 if (!t->in_syscall) 521 return; 522 523 clock_gettime(CLOCK_REALTIME, &t->after); 524 525 print_syscall_ret(info, 0, NULL); 526 free_syscall(t); 527 } 528 529 static void 530 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl) 531 { 532 struct threadinfo *t; 533 struct procinfo *p; 534 struct syscall *sc; 535 struct ptrace_sc_ret psr; 536 u_int i; 537 538 t = info->curthread; 539 if (!t->in_syscall) 540 return; 541 542 clock_gettime(CLOCK_REALTIME, &t->after); 543 p = t->proc; 544 if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) { 545 free_syscall(t); 546 return; 547 } 548 549 sc = t->cs.sc; 550 /* 551 * Here, we only look for arguments that have OUT masked in -- 552 * otherwise, they were handled in enter_syscall(). 553 */ 554 for (i = 0; i < sc->decode.nargs; i++) { 555 char *temp; 556 557 if (sc->decode.args[i].type & OUT) { 558 /* 559 * If an error occurred, then don't bother 560 * getting the data; it may not be valid. 561 */ 562 if (psr.sr_error != 0) { 563 asprintf(&temp, "0x%lx", 564 (long)t->cs.args[sc->decode.args[i].offset]); 565 } else { 566 temp = print_arg(&sc->decode.args[i], 567 t->cs.args, psr.sr_retval, info); 568 } 569 t->cs.s_args[i] = temp; 570 } 571 } 572 573 print_syscall_ret(info, psr.sr_error, psr.sr_retval); 574 free_syscall(t); 575 576 /* 577 * If the process executed a new image, check the ABI. If the 578 * new ABI isn't supported, stop tracing this process. 579 */ 580 if (pl->pl_flags & PL_FLAG_EXEC) { 581 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL); 582 p->abi = find_abi(p->pid); 583 if (p->abi == NULL) { 584 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0) 585 err(1, "Can not detach the process"); 586 free_proc(p); 587 } 588 } 589 } 590 591 int 592 print_line_prefix(struct trussinfo *info) 593 { 594 struct timespec timediff; 595 struct threadinfo *t; 596 int len; 597 598 len = 0; 599 t = info->curthread; 600 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) { 601 if (info->flags & FOLLOWFORKS) 602 len += fprintf(info->outfile, "%5d", t->proc->pid); 603 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) == 604 (FOLLOWFORKS | DISPLAYTIDS)) 605 len += fprintf(info->outfile, " "); 606 if (info->flags & DISPLAYTIDS) 607 len += fprintf(info->outfile, "%6d", t->tid); 608 len += fprintf(info->outfile, ": "); 609 } 610 if (info->flags & ABSOLUTETIMESTAMPS) { 611 timespecsub(&t->after, &info->start_time, &timediff); 612 len += fprintf(info->outfile, "%jd.%09ld ", 613 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 614 } 615 if (info->flags & RELATIVETIMESTAMPS) { 616 timespecsub(&t->after, &t->before, &timediff); 617 len += fprintf(info->outfile, "%jd.%09ld ", 618 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 619 } 620 return (len); 621 } 622 623 static void 624 report_thread_death(struct trussinfo *info) 625 { 626 struct threadinfo *t; 627 628 t = info->curthread; 629 clock_gettime(CLOCK_REALTIME, &t->after); 630 print_line_prefix(info); 631 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid); 632 } 633 634 static void 635 report_thread_birth(struct trussinfo *info) 636 { 637 struct threadinfo *t; 638 639 t = info->curthread; 640 clock_gettime(CLOCK_REALTIME, &t->after); 641 t->before = t->after; 642 print_line_prefix(info); 643 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid); 644 } 645 646 static void 647 report_exit(struct trussinfo *info, siginfo_t *si) 648 { 649 struct threadinfo *t; 650 651 t = info->curthread; 652 clock_gettime(CLOCK_REALTIME, &t->after); 653 print_line_prefix(info); 654 if (si->si_code == CLD_EXITED) 655 fprintf(info->outfile, "process exit, rval = %u\n", 656 si->si_status); 657 else 658 fprintf(info->outfile, "process killed, signal = %u%s\n", 659 si->si_status, si->si_code == CLD_DUMPED ? 660 " (core dumped)" : ""); 661 } 662 663 static void 664 report_new_child(struct trussinfo *info) 665 { 666 struct threadinfo *t; 667 668 t = info->curthread; 669 clock_gettime(CLOCK_REALTIME, &t->after); 670 t->before = t->after; 671 print_line_prefix(info); 672 fprintf(info->outfile, "<new process>\n"); 673 } 674 675 void 676 decode_siginfo(FILE *fp, siginfo_t *si) 677 { 678 const char *str; 679 680 fprintf(fp, " code="); 681 str = sysdecode_sigcode(si->si_signo, si->si_code); 682 if (str == NULL) 683 fprintf(fp, "%d", si->si_code); 684 else 685 fprintf(fp, "%s", str); 686 switch (si->si_code) { 687 case SI_NOINFO: 688 break; 689 case SI_QUEUE: 690 fprintf(fp, " value=%p", si->si_value.sival_ptr); 691 /* FALLTHROUGH */ 692 case SI_USER: 693 case SI_LWP: 694 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 695 (intmax_t)si->si_uid); 696 break; 697 case SI_TIMER: 698 fprintf(fp, " value=%p", si->si_value.sival_ptr); 699 fprintf(fp, " timerid=%d", si->si_timerid); 700 fprintf(fp, " overrun=%d", si->si_overrun); 701 if (si->si_errno != 0) 702 fprintf(fp, " errno=%d", si->si_errno); 703 break; 704 case SI_ASYNCIO: 705 fprintf(fp, " value=%p", si->si_value.sival_ptr); 706 break; 707 case SI_MESGQ: 708 fprintf(fp, " value=%p", si->si_value.sival_ptr); 709 fprintf(fp, " mqd=%d", si->si_mqd); 710 break; 711 default: 712 switch (si->si_signo) { 713 case SIGILL: 714 case SIGFPE: 715 case SIGSEGV: 716 case SIGBUS: 717 fprintf(fp, " trapno=%d", si->si_trapno); 718 fprintf(fp, " addr=%p", si->si_addr); 719 break; 720 case SIGCHLD: 721 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 722 (intmax_t)si->si_uid); 723 fprintf(fp, " status=%d", si->si_status); 724 break; 725 } 726 } 727 } 728 729 static void 730 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl) 731 { 732 struct threadinfo *t; 733 const char *signame; 734 735 t = info->curthread; 736 clock_gettime(CLOCK_REALTIME, &t->after); 737 print_line_prefix(info); 738 signame = sysdecode_signal(si->si_status); 739 if (signame == NULL) 740 signame = "?"; 741 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame); 742 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI) 743 decode_siginfo(info->outfile, &pl->pl_siginfo); 744 fprintf(info->outfile, "\n"); 745 746 } 747 748 /* 749 * Wait for events until all the processes have exited or truss has been 750 * asked to stop. 751 */ 752 void 753 eventloop(struct trussinfo *info) 754 { 755 struct ptrace_lwpinfo pl; 756 siginfo_t si; 757 int pending_signal; 758 759 while (!LIST_EMPTY(&info->proclist)) { 760 if (detaching) { 761 detach_all_procs(info); 762 return; 763 } 764 765 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) { 766 if (errno == EINTR) 767 continue; 768 err(1, "Unexpected error from waitid"); 769 } 770 771 assert(si.si_signo == SIGCHLD); 772 773 switch (si.si_code) { 774 case CLD_EXITED: 775 case CLD_KILLED: 776 case CLD_DUMPED: 777 find_exit_thread(info, si.si_pid); 778 if ((info->flags & COUNTONLY) == 0) { 779 if (si.si_code == CLD_EXITED) 780 thread_exit_syscall(info); 781 report_exit(info, &si); 782 } 783 free_proc(info->curthread->proc); 784 info->curthread = NULL; 785 break; 786 case CLD_TRAPPED: 787 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl, 788 sizeof(pl)) == -1) 789 err(1, "ptrace(PT_LWPINFO)"); 790 791 if (pl.pl_flags & PL_FLAG_CHILD) { 792 new_proc(info, si.si_pid, pl.pl_lwpid); 793 assert(LIST_FIRST(&info->proclist)->abi != 794 NULL); 795 } else if (pl.pl_flags & PL_FLAG_BORN) 796 new_thread(find_proc(info, si.si_pid), 797 pl.pl_lwpid); 798 find_thread(info, si.si_pid, pl.pl_lwpid); 799 800 if (si.si_status == SIGTRAP && 801 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED| 802 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) { 803 if (pl.pl_flags & PL_FLAG_BORN) { 804 if ((info->flags & COUNTONLY) == 0) 805 report_thread_birth(info); 806 } else if (pl.pl_flags & PL_FLAG_EXITED) { 807 if ((info->flags & COUNTONLY) == 0) 808 report_thread_death(info); 809 free_thread(info->curthread); 810 info->curthread = NULL; 811 } else if (pl.pl_flags & PL_FLAG_SCE) 812 enter_syscall(info, info->curthread, &pl); 813 else if (pl.pl_flags & PL_FLAG_SCX) 814 exit_syscall(info, &pl); 815 pending_signal = 0; 816 } else if (pl.pl_flags & PL_FLAG_CHILD) { 817 if ((info->flags & COUNTONLY) == 0) 818 report_new_child(info); 819 pending_signal = 0; 820 } else { 821 if ((info->flags & NOSIGS) == 0) 822 report_signal(info, &si, &pl); 823 pending_signal = si.si_status; 824 } 825 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1, 826 pending_signal); 827 break; 828 case CLD_STOPPED: 829 errx(1, "waitid reported CLD_STOPPED"); 830 case CLD_CONTINUED: 831 break; 832 } 833 } 834 } 835