1 /*- 2 * SPDX-License-Identifier: BSD-4-Clause 3 * 4 * Copyright 1997 Sean Eric Fagan 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. All advertising materials mentioning features or use of this software 15 * must display the following acknowledgement: 16 * This product includes software developed by Sean Eric Fagan 17 * 4. Neither the name of the author may be used to endorse or promote 18 * products derived from this software without specific prior written 19 * permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 /* 38 * Various setup functions for truss. Not the cleanest-written code, 39 * I'm afraid. 40 */ 41 42 #include <sys/ptrace.h> 43 #include <sys/sysctl.h> 44 #include <sys/time.h> 45 #include <sys/wait.h> 46 47 #include <assert.h> 48 #include <err.h> 49 #include <errno.h> 50 #include <signal.h> 51 #include <stdbool.h> 52 #include <stdint.h> 53 #include <stdio.h> 54 #include <stdlib.h> 55 #include <string.h> 56 #include <sysdecode.h> 57 #include <time.h> 58 #include <unistd.h> 59 60 #include "truss.h" 61 #include "syscall.h" 62 #include "extern.h" 63 64 struct procabi_table { 65 const char *name; 66 struct procabi *abi; 67 }; 68 69 static sig_atomic_t detaching; 70 71 static void enter_syscall(struct trussinfo *, struct threadinfo *, 72 struct ptrace_lwpinfo *); 73 static void new_proc(struct trussinfo *, pid_t, lwpid_t); 74 75 76 static struct procabi cloudabi32 = { 77 "CloudABI32", 78 SYSDECODE_ABI_CLOUDABI32, 79 STAILQ_HEAD_INITIALIZER(cloudabi32.extra_syscalls), 80 { NULL } 81 }; 82 83 static struct procabi cloudabi64 = { 84 "CloudABI64", 85 SYSDECODE_ABI_CLOUDABI64, 86 STAILQ_HEAD_INITIALIZER(cloudabi64.extra_syscalls), 87 { NULL } 88 }; 89 90 static struct procabi freebsd = { 91 "FreeBSD", 92 SYSDECODE_ABI_FREEBSD, 93 STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls), 94 { NULL } 95 }; 96 97 #ifdef __LP64__ 98 static struct procabi freebsd32 = { 99 "FreeBSD32", 100 SYSDECODE_ABI_FREEBSD32, 101 STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls), 102 { NULL } 103 }; 104 #endif 105 106 static struct procabi linux = { 107 "Linux", 108 SYSDECODE_ABI_LINUX, 109 STAILQ_HEAD_INITIALIZER(linux.extra_syscalls), 110 { NULL } 111 }; 112 113 #ifdef __LP64__ 114 static struct procabi linux32 = { 115 "Linux32", 116 SYSDECODE_ABI_LINUX32, 117 STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls), 118 { NULL } 119 }; 120 #endif 121 122 static struct procabi_table abis[] = { 123 { "CloudABI ELF32", &cloudabi32 }, 124 { "CloudABI ELF64", &cloudabi64 }, 125 #ifdef __LP64__ 126 { "FreeBSD ELF64", &freebsd }, 127 { "FreeBSD ELF32", &freebsd32 }, 128 #else 129 { "FreeBSD ELF32", &freebsd }, 130 #endif 131 #if defined(__powerpc64__) 132 { "FreeBSD ELF64 V2", &freebsd }, 133 #endif 134 #if defined(__amd64__) 135 { "FreeBSD a.out", &freebsd32 }, 136 #endif 137 #if defined(__i386__) 138 { "FreeBSD a.out", &freebsd }, 139 #endif 140 #ifdef __LP64__ 141 { "Linux ELF64", &linux }, 142 { "Linux ELF32", &linux32 }, 143 #else 144 { "Linux ELF32", &linux }, 145 #endif 146 }; 147 148 /* 149 * setup_and_wait() is called to start a process. All it really does 150 * is fork(), enable tracing in the child, and then exec the given 151 * command. At that point, the child process stops, and the parent 152 * can wake up and deal with it. 153 */ 154 void 155 setup_and_wait(struct trussinfo *info, char *command[]) 156 { 157 pid_t pid; 158 159 pid = vfork(); 160 if (pid == -1) 161 err(1, "fork failed"); 162 if (pid == 0) { /* Child */ 163 ptrace(PT_TRACE_ME, 0, 0, 0); 164 execvp(command[0], command); 165 err(1, "execvp %s", command[0]); 166 } 167 168 /* Only in the parent here */ 169 if (waitpid(pid, NULL, 0) < 0) 170 err(1, "unexpect stop in waitpid"); 171 172 new_proc(info, pid, 0); 173 } 174 175 /* 176 * start_tracing is called to attach to an existing process. 177 */ 178 void 179 start_tracing(struct trussinfo *info, pid_t pid) 180 { 181 int ret, retry; 182 183 retry = 10; 184 do { 185 ret = ptrace(PT_ATTACH, pid, NULL, 0); 186 usleep(200); 187 } while (ret && retry-- > 0); 188 if (ret) 189 err(1, "can not attach to target process"); 190 191 if (waitpid(pid, NULL, 0) < 0) 192 err(1, "Unexpect stop in waitpid"); 193 194 new_proc(info, pid, 0); 195 } 196 197 /* 198 * Restore a process back to it's pre-truss state. 199 * Called for SIGINT, SIGTERM, SIGQUIT. This only 200 * applies if truss was told to monitor an already-existing 201 * process. 202 */ 203 void 204 restore_proc(int signo __unused) 205 { 206 207 detaching = 1; 208 } 209 210 static void 211 detach_proc(pid_t pid) 212 { 213 214 /* stop the child so that we can detach */ 215 kill(pid, SIGSTOP); 216 if (waitpid(pid, NULL, 0) < 0) 217 err(1, "Unexpected stop in waitpid"); 218 219 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0) 220 err(1, "Can not detach the process"); 221 222 kill(pid, SIGCONT); 223 } 224 225 /* 226 * Determine the ABI. This is called after every exec, and when 227 * a process is first monitored. 228 */ 229 static struct procabi * 230 find_abi(pid_t pid) 231 { 232 size_t len; 233 unsigned int i; 234 int error; 235 int mib[4]; 236 char progt[32]; 237 238 len = sizeof(progt); 239 mib[0] = CTL_KERN; 240 mib[1] = KERN_PROC; 241 mib[2] = KERN_PROC_SV_NAME; 242 mib[3] = pid; 243 error = sysctl(mib, 4, progt, &len, NULL, 0); 244 if (error != 0) 245 err(2, "can not get sysvec name"); 246 247 for (i = 0; i < nitems(abis); i++) { 248 if (strcmp(abis[i].name, progt) == 0) 249 return (abis[i].abi); 250 } 251 warnx("ABI %s for pid %ld is not supported", progt, (long)pid); 252 return (NULL); 253 } 254 255 static struct threadinfo * 256 new_thread(struct procinfo *p, lwpid_t lwpid) 257 { 258 struct threadinfo *nt; 259 260 /* 261 * If this happens it means there is a bug in truss. Unfortunately 262 * this will kill any processes truss is attached to. 263 */ 264 LIST_FOREACH(nt, &p->threadlist, entries) { 265 if (nt->tid == lwpid) 266 errx(1, "Duplicate thread for LWP %ld", (long)lwpid); 267 } 268 269 nt = calloc(1, sizeof(struct threadinfo)); 270 if (nt == NULL) 271 err(1, "calloc() failed"); 272 nt->proc = p; 273 nt->tid = lwpid; 274 LIST_INSERT_HEAD(&p->threadlist, nt, entries); 275 return (nt); 276 } 277 278 static void 279 free_thread(struct threadinfo *t) 280 { 281 282 LIST_REMOVE(t, entries); 283 free(t); 284 } 285 286 static void 287 add_threads(struct trussinfo *info, struct procinfo *p) 288 { 289 struct ptrace_lwpinfo pl; 290 struct threadinfo *t; 291 lwpid_t *lwps; 292 int i, nlwps; 293 294 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0); 295 if (nlwps == -1) 296 err(1, "Unable to fetch number of LWPs"); 297 assert(nlwps > 0); 298 lwps = calloc(nlwps, sizeof(*lwps)); 299 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps); 300 if (nlwps == -1) 301 err(1, "Unable to fetch LWP list"); 302 for (i = 0; i < nlwps; i++) { 303 t = new_thread(p, lwps[i]); 304 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1) 305 err(1, "ptrace(PT_LWPINFO)"); 306 if (pl.pl_flags & PL_FLAG_SCE) { 307 info->curthread = t; 308 enter_syscall(info, t, &pl); 309 } 310 } 311 free(lwps); 312 } 313 314 static void 315 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 316 { 317 struct procinfo *np; 318 319 /* 320 * If this happens it means there is a bug in truss. Unfortunately 321 * this will kill any processes truss is attached to. 322 */ 323 LIST_FOREACH(np, &info->proclist, entries) { 324 if (np->pid == pid) 325 errx(1, "Duplicate process for pid %ld", (long)pid); 326 } 327 328 if (info->flags & FOLLOWFORKS) 329 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1) 330 err(1, "Unable to follow forks for pid %ld", (long)pid); 331 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1) 332 err(1, "Unable to enable LWP events for pid %ld", (long)pid); 333 np = calloc(1, sizeof(struct procinfo)); 334 np->pid = pid; 335 np->abi = find_abi(pid); 336 LIST_INIT(&np->threadlist); 337 LIST_INSERT_HEAD(&info->proclist, np, entries); 338 339 if (lwpid != 0) 340 new_thread(np, lwpid); 341 else 342 add_threads(info, np); 343 } 344 345 static void 346 free_proc(struct procinfo *p) 347 { 348 struct threadinfo *t, *t2; 349 350 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) { 351 free(t); 352 } 353 LIST_REMOVE(p, entries); 354 free(p); 355 } 356 357 static void 358 detach_all_procs(struct trussinfo *info) 359 { 360 struct procinfo *p, *p2; 361 362 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) { 363 detach_proc(p->pid); 364 free_proc(p); 365 } 366 } 367 368 static struct procinfo * 369 find_proc(struct trussinfo *info, pid_t pid) 370 { 371 struct procinfo *np; 372 373 LIST_FOREACH(np, &info->proclist, entries) { 374 if (np->pid == pid) 375 return (np); 376 } 377 378 return (NULL); 379 } 380 381 /* 382 * Change curthread member based on (pid, lwpid). 383 */ 384 static void 385 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 386 { 387 struct procinfo *np; 388 struct threadinfo *nt; 389 390 np = find_proc(info, pid); 391 assert(np != NULL); 392 393 LIST_FOREACH(nt, &np->threadlist, entries) { 394 if (nt->tid == lwpid) { 395 info->curthread = nt; 396 return; 397 } 398 } 399 errx(1, "could not find thread"); 400 } 401 402 /* 403 * When a process exits, it should have exactly one thread left. 404 * All of the other threads should have reported thread exit events. 405 */ 406 static void 407 find_exit_thread(struct trussinfo *info, pid_t pid) 408 { 409 struct procinfo *p; 410 411 p = find_proc(info, pid); 412 assert(p != NULL); 413 414 info->curthread = LIST_FIRST(&p->threadlist); 415 assert(info->curthread != NULL); 416 assert(LIST_NEXT(info->curthread, entries) == NULL); 417 } 418 419 static void 420 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl) 421 { 422 u_int i; 423 424 assert(t->in_syscall == 0); 425 assert(t->cs.number == 0); 426 assert(t->cs.sc == NULL); 427 assert(t->cs.nargs == 0); 428 for (i = 0; i < nitems(t->cs.s_args); i++) 429 assert(t->cs.s_args[i] == NULL); 430 memset(t->cs.args, 0, sizeof(t->cs.args)); 431 t->cs.number = pl->pl_syscall_code; 432 t->in_syscall = 1; 433 } 434 435 static void 436 free_syscall(struct threadinfo *t) 437 { 438 u_int i; 439 440 for (i = 0; i < t->cs.nargs; i++) 441 free(t->cs.s_args[i]); 442 memset(&t->cs, 0, sizeof(t->cs)); 443 t->in_syscall = 0; 444 } 445 446 static void 447 enter_syscall(struct trussinfo *info, struct threadinfo *t, 448 struct ptrace_lwpinfo *pl) 449 { 450 struct syscall *sc; 451 u_int i, narg; 452 453 alloc_syscall(t, pl); 454 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args)); 455 if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args, 456 sizeof(t->cs.args)) != 0) { 457 free_syscall(t); 458 return; 459 } 460 461 sc = get_syscall(t, t->cs.number, narg); 462 if (sc->unknown) 463 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n", 464 t->proc->abi->type, t->cs.number); 465 466 t->cs.nargs = sc->decode.nargs; 467 assert(sc->decode.nargs <= nitems(t->cs.s_args)); 468 469 t->cs.sc = sc; 470 471 /* 472 * At this point, we set up the system call arguments. 473 * We ignore any OUT ones, however -- those are arguments that 474 * are set by the system call, and so are probably meaningless 475 * now. This doesn't currently support arguments that are 476 * passed in *and* out, however. 477 */ 478 #if DEBUG 479 fprintf(stderr, "syscall %s(", sc->name); 480 #endif 481 for (i = 0; i < t->cs.nargs; i++) { 482 #if DEBUG 483 fprintf(stderr, "0x%lx%s", 484 t->cs.args[sc->decode.args[i].offset], 485 i < (t->cs.nargs - 1) ? "," : ""); 486 #endif 487 if (!(sc->decode.args[i].type & OUT)) { 488 t->cs.s_args[i] = print_arg(&sc->decode.args[i], 489 t->cs.args, NULL, info); 490 } 491 } 492 #if DEBUG 493 fprintf(stderr, ")\n"); 494 #endif 495 496 clock_gettime(CLOCK_REALTIME, &t->before); 497 } 498 499 /* 500 * When a thread exits voluntarily (including when a thread calls 501 * exit() to trigger a process exit), the thread's internal state 502 * holds the arguments passed to the exit system call. When the 503 * thread's exit is reported, log that system call without a return 504 * value. 505 */ 506 static void 507 thread_exit_syscall(struct trussinfo *info) 508 { 509 struct threadinfo *t; 510 511 t = info->curthread; 512 if (!t->in_syscall) 513 return; 514 515 clock_gettime(CLOCK_REALTIME, &t->after); 516 517 print_syscall_ret(info, 0, NULL); 518 free_syscall(t); 519 } 520 521 static void 522 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl) 523 { 524 struct threadinfo *t; 525 struct procinfo *p; 526 struct syscall *sc; 527 struct ptrace_sc_ret psr; 528 u_int i; 529 530 t = info->curthread; 531 if (!t->in_syscall) 532 return; 533 534 clock_gettime(CLOCK_REALTIME, &t->after); 535 p = t->proc; 536 if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) { 537 free_syscall(t); 538 return; 539 } 540 541 sc = t->cs.sc; 542 /* 543 * Here, we only look for arguments that have OUT masked in -- 544 * otherwise, they were handled in enter_syscall(). 545 */ 546 for (i = 0; i < sc->decode.nargs; i++) { 547 char *temp; 548 549 if (sc->decode.args[i].type & OUT) { 550 /* 551 * If an error occurred, then don't bother 552 * getting the data; it may not be valid. 553 */ 554 if (psr.sr_error != 0) { 555 asprintf(&temp, "0x%lx", 556 t->cs.args[sc->decode.args[i].offset]); 557 } else { 558 temp = print_arg(&sc->decode.args[i], 559 t->cs.args, psr.sr_retval, info); 560 } 561 t->cs.s_args[i] = temp; 562 } 563 } 564 565 print_syscall_ret(info, psr.sr_error, psr.sr_retval); 566 free_syscall(t); 567 568 /* 569 * If the process executed a new image, check the ABI. If the 570 * new ABI isn't supported, stop tracing this process. 571 */ 572 if (pl->pl_flags & PL_FLAG_EXEC) { 573 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL); 574 p->abi = find_abi(p->pid); 575 if (p->abi == NULL) { 576 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0) 577 err(1, "Can not detach the process"); 578 free_proc(p); 579 } 580 } 581 } 582 583 int 584 print_line_prefix(struct trussinfo *info) 585 { 586 struct timespec timediff; 587 struct threadinfo *t; 588 int len; 589 590 len = 0; 591 t = info->curthread; 592 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) { 593 if (info->flags & FOLLOWFORKS) 594 len += fprintf(info->outfile, "%5d", t->proc->pid); 595 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) == 596 (FOLLOWFORKS | DISPLAYTIDS)) 597 len += fprintf(info->outfile, " "); 598 if (info->flags & DISPLAYTIDS) 599 len += fprintf(info->outfile, "%6d", t->tid); 600 len += fprintf(info->outfile, ": "); 601 } 602 if (info->flags & ABSOLUTETIMESTAMPS) { 603 timespecsub(&t->after, &info->start_time, &timediff); 604 len += fprintf(info->outfile, "%jd.%09ld ", 605 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 606 } 607 if (info->flags & RELATIVETIMESTAMPS) { 608 timespecsub(&t->after, &t->before, &timediff); 609 len += fprintf(info->outfile, "%jd.%09ld ", 610 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 611 } 612 return (len); 613 } 614 615 static void 616 report_thread_death(struct trussinfo *info) 617 { 618 struct threadinfo *t; 619 620 t = info->curthread; 621 clock_gettime(CLOCK_REALTIME, &t->after); 622 print_line_prefix(info); 623 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid); 624 } 625 626 static void 627 report_thread_birth(struct trussinfo *info) 628 { 629 struct threadinfo *t; 630 631 t = info->curthread; 632 clock_gettime(CLOCK_REALTIME, &t->after); 633 t->before = t->after; 634 print_line_prefix(info); 635 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid); 636 } 637 638 static void 639 report_exit(struct trussinfo *info, siginfo_t *si) 640 { 641 struct threadinfo *t; 642 643 t = info->curthread; 644 clock_gettime(CLOCK_REALTIME, &t->after); 645 print_line_prefix(info); 646 if (si->si_code == CLD_EXITED) 647 fprintf(info->outfile, "process exit, rval = %u\n", 648 si->si_status); 649 else 650 fprintf(info->outfile, "process killed, signal = %u%s\n", 651 si->si_status, si->si_code == CLD_DUMPED ? 652 " (core dumped)" : ""); 653 } 654 655 static void 656 report_new_child(struct trussinfo *info) 657 { 658 struct threadinfo *t; 659 660 t = info->curthread; 661 clock_gettime(CLOCK_REALTIME, &t->after); 662 t->before = t->after; 663 print_line_prefix(info); 664 fprintf(info->outfile, "<new process>\n"); 665 } 666 667 void 668 decode_siginfo(FILE *fp, siginfo_t *si) 669 { 670 const char *str; 671 672 fprintf(fp, " code="); 673 str = sysdecode_sigcode(si->si_signo, si->si_code); 674 if (str == NULL) 675 fprintf(fp, "%d", si->si_code); 676 else 677 fprintf(fp, "%s", str); 678 switch (si->si_code) { 679 case SI_NOINFO: 680 break; 681 case SI_QUEUE: 682 fprintf(fp, " value=%p", si->si_value.sival_ptr); 683 /* FALLTHROUGH */ 684 case SI_USER: 685 case SI_LWP: 686 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 687 (intmax_t)si->si_uid); 688 break; 689 case SI_TIMER: 690 fprintf(fp, " value=%p", si->si_value.sival_ptr); 691 fprintf(fp, " timerid=%d", si->si_timerid); 692 fprintf(fp, " overrun=%d", si->si_overrun); 693 if (si->si_errno != 0) 694 fprintf(fp, " errno=%d", si->si_errno); 695 break; 696 case SI_ASYNCIO: 697 fprintf(fp, " value=%p", si->si_value.sival_ptr); 698 break; 699 case SI_MESGQ: 700 fprintf(fp, " value=%p", si->si_value.sival_ptr); 701 fprintf(fp, " mqd=%d", si->si_mqd); 702 break; 703 default: 704 switch (si->si_signo) { 705 case SIGILL: 706 case SIGFPE: 707 case SIGSEGV: 708 case SIGBUS: 709 fprintf(fp, " trapno=%d", si->si_trapno); 710 fprintf(fp, " addr=%p", si->si_addr); 711 break; 712 case SIGCHLD: 713 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 714 (intmax_t)si->si_uid); 715 fprintf(fp, " status=%d", si->si_status); 716 break; 717 } 718 } 719 } 720 721 static void 722 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl) 723 { 724 struct threadinfo *t; 725 const char *signame; 726 727 t = info->curthread; 728 clock_gettime(CLOCK_REALTIME, &t->after); 729 print_line_prefix(info); 730 signame = sysdecode_signal(si->si_status); 731 if (signame == NULL) 732 signame = "?"; 733 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame); 734 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI) 735 decode_siginfo(info->outfile, &pl->pl_siginfo); 736 fprintf(info->outfile, "\n"); 737 738 } 739 740 /* 741 * Wait for events until all the processes have exited or truss has been 742 * asked to stop. 743 */ 744 void 745 eventloop(struct trussinfo *info) 746 { 747 struct ptrace_lwpinfo pl; 748 siginfo_t si; 749 int pending_signal; 750 751 while (!LIST_EMPTY(&info->proclist)) { 752 if (detaching) { 753 detach_all_procs(info); 754 return; 755 } 756 757 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) { 758 if (errno == EINTR) 759 continue; 760 err(1, "Unexpected error from waitid"); 761 } 762 763 assert(si.si_signo == SIGCHLD); 764 765 switch (si.si_code) { 766 case CLD_EXITED: 767 case CLD_KILLED: 768 case CLD_DUMPED: 769 find_exit_thread(info, si.si_pid); 770 if ((info->flags & COUNTONLY) == 0) { 771 if (si.si_code == CLD_EXITED) 772 thread_exit_syscall(info); 773 report_exit(info, &si); 774 } 775 free_proc(info->curthread->proc); 776 info->curthread = NULL; 777 break; 778 case CLD_TRAPPED: 779 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl, 780 sizeof(pl)) == -1) 781 err(1, "ptrace(PT_LWPINFO)"); 782 783 if (pl.pl_flags & PL_FLAG_CHILD) { 784 new_proc(info, si.si_pid, pl.pl_lwpid); 785 assert(LIST_FIRST(&info->proclist)->abi != 786 NULL); 787 } else if (pl.pl_flags & PL_FLAG_BORN) 788 new_thread(find_proc(info, si.si_pid), 789 pl.pl_lwpid); 790 find_thread(info, si.si_pid, pl.pl_lwpid); 791 792 if (si.si_status == SIGTRAP && 793 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED| 794 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) { 795 if (pl.pl_flags & PL_FLAG_BORN) { 796 if ((info->flags & COUNTONLY) == 0) 797 report_thread_birth(info); 798 } else if (pl.pl_flags & PL_FLAG_EXITED) { 799 if ((info->flags & COUNTONLY) == 0) 800 report_thread_death(info); 801 free_thread(info->curthread); 802 info->curthread = NULL; 803 } else if (pl.pl_flags & PL_FLAG_SCE) 804 enter_syscall(info, info->curthread, &pl); 805 else if (pl.pl_flags & PL_FLAG_SCX) 806 exit_syscall(info, &pl); 807 pending_signal = 0; 808 } else if (pl.pl_flags & PL_FLAG_CHILD) { 809 if ((info->flags & COUNTONLY) == 0) 810 report_new_child(info); 811 pending_signal = 0; 812 } else { 813 if ((info->flags & NOSIGS) == 0) 814 report_signal(info, &si, &pl); 815 pending_signal = si.si_status; 816 } 817 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1, 818 pending_signal); 819 break; 820 case CLD_STOPPED: 821 errx(1, "waitid reported CLD_STOPPED"); 822 case CLD_CONTINUED: 823 break; 824 } 825 } 826 } 827