xref: /freebsd/usr.bin/truss/setup.c (revision f39bffc62c1395bde25d152c7f68fdf7cbaab414)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright 1997 Sean Eric Fagan
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by Sean Eric Fagan
17  * 4. Neither the name of the author may be used to endorse or promote
18  *    products derived from this software without specific prior written
19  *    permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * Various setup functions for truss.  Not the cleanest-written code,
39  * I'm afraid.
40  */
41 
42 #include <sys/ptrace.h>
43 #include <sys/sysctl.h>
44 #include <sys/wait.h>
45 
46 #include <assert.h>
47 #include <err.h>
48 #include <errno.h>
49 #include <signal.h>
50 #include <stdbool.h>
51 #include <stdint.h>
52 #include <stdio.h>
53 #include <stdlib.h>
54 #include <string.h>
55 #include <sysdecode.h>
56 #include <time.h>
57 #include <unistd.h>
58 
59 #include "truss.h"
60 #include "syscall.h"
61 #include "extern.h"
62 
63 SET_DECLARE(procabi, struct procabi);
64 
65 static sig_atomic_t detaching;
66 
67 static void	enter_syscall(struct trussinfo *, struct threadinfo *,
68 		    struct ptrace_lwpinfo *);
69 static void	new_proc(struct trussinfo *, pid_t, lwpid_t);
70 
71 /*
72  * setup_and_wait() is called to start a process.  All it really does
73  * is fork(), enable tracing in the child, and then exec the given
74  * command.  At that point, the child process stops, and the parent
75  * can wake up and deal with it.
76  */
77 void
78 setup_and_wait(struct trussinfo *info, char *command[])
79 {
80 	pid_t pid;
81 
82 	pid = vfork();
83 	if (pid == -1)
84 		err(1, "fork failed");
85 	if (pid == 0) {	/* Child */
86 		ptrace(PT_TRACE_ME, 0, 0, 0);
87 		execvp(command[0], command);
88 		err(1, "execvp %s", command[0]);
89 	}
90 
91 	/* Only in the parent here */
92 	if (waitpid(pid, NULL, 0) < 0)
93 		err(1, "unexpect stop in waitpid");
94 
95 	new_proc(info, pid, 0);
96 }
97 
98 /*
99  * start_tracing is called to attach to an existing process.
100  */
101 void
102 start_tracing(struct trussinfo *info, pid_t pid)
103 {
104 	int ret, retry;
105 
106 	retry = 10;
107 	do {
108 		ret = ptrace(PT_ATTACH, pid, NULL, 0);
109 		usleep(200);
110 	} while (ret && retry-- > 0);
111 	if (ret)
112 		err(1, "can not attach to target process");
113 
114 	if (waitpid(pid, NULL, 0) < 0)
115 		err(1, "Unexpect stop in waitpid");
116 
117 	new_proc(info, pid, 0);
118 }
119 
120 /*
121  * Restore a process back to it's pre-truss state.
122  * Called for SIGINT, SIGTERM, SIGQUIT.  This only
123  * applies if truss was told to monitor an already-existing
124  * process.
125  */
126 void
127 restore_proc(int signo __unused)
128 {
129 
130 	detaching = 1;
131 }
132 
133 static void
134 detach_proc(pid_t pid)
135 {
136 
137 	/* stop the child so that we can detach */
138 	kill(pid, SIGSTOP);
139 	if (waitpid(pid, NULL, 0) < 0)
140 		err(1, "Unexpected stop in waitpid");
141 
142 	if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
143 		err(1, "Can not detach the process");
144 
145 	kill(pid, SIGCONT);
146 }
147 
148 /*
149  * Determine the ABI.  This is called after every exec, and when
150  * a process is first monitored.
151  */
152 static struct procabi *
153 find_abi(pid_t pid)
154 {
155 	struct procabi **pabi;
156 	size_t len;
157 	int error;
158 	int mib[4];
159 	char progt[32];
160 
161 	len = sizeof(progt);
162 	mib[0] = CTL_KERN;
163 	mib[1] = KERN_PROC;
164 	mib[2] = KERN_PROC_SV_NAME;
165 	mib[3] = pid;
166 	error = sysctl(mib, 4, progt, &len, NULL, 0);
167 	if (error != 0)
168 		err(2, "can not get sysvec name");
169 
170 	SET_FOREACH(pabi, procabi) {
171 		if (strcmp((*pabi)->type, progt) == 0)
172 			return (*pabi);
173 	}
174 	warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
175 	return (NULL);
176 }
177 
178 static struct threadinfo *
179 new_thread(struct procinfo *p, lwpid_t lwpid)
180 {
181 	struct threadinfo *nt;
182 
183 	/*
184 	 * If this happens it means there is a bug in truss.  Unfortunately
185 	 * this will kill any processes truss is attached to.
186 	 */
187 	LIST_FOREACH(nt, &p->threadlist, entries) {
188 		if (nt->tid == lwpid)
189 			errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
190 	}
191 
192 	nt = calloc(1, sizeof(struct threadinfo));
193 	if (nt == NULL)
194 		err(1, "calloc() failed");
195 	nt->proc = p;
196 	nt->tid = lwpid;
197 	LIST_INSERT_HEAD(&p->threadlist, nt, entries);
198 	return (nt);
199 }
200 
201 static void
202 free_thread(struct threadinfo *t)
203 {
204 
205 	LIST_REMOVE(t, entries);
206 	free(t);
207 }
208 
209 static void
210 add_threads(struct trussinfo *info, struct procinfo *p)
211 {
212 	struct ptrace_lwpinfo pl;
213 	struct threadinfo *t;
214 	lwpid_t *lwps;
215 	int i, nlwps;
216 
217 	nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
218 	if (nlwps == -1)
219 		err(1, "Unable to fetch number of LWPs");
220 	assert(nlwps > 0);
221 	lwps = calloc(nlwps, sizeof(*lwps));
222 	nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
223 	if (nlwps == -1)
224 		err(1, "Unable to fetch LWP list");
225 	for (i = 0; i < nlwps; i++) {
226 		t = new_thread(p, lwps[i]);
227 		if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
228 			err(1, "ptrace(PT_LWPINFO)");
229 		if (pl.pl_flags & PL_FLAG_SCE) {
230 			info->curthread = t;
231 			enter_syscall(info, t, &pl);
232 		}
233 	}
234 	free(lwps);
235 }
236 
237 static void
238 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
239 {
240 	struct procinfo *np;
241 
242 	/*
243 	 * If this happens it means there is a bug in truss.  Unfortunately
244 	 * this will kill any processes truss is attached to.
245 	 */
246 	LIST_FOREACH(np, &info->proclist, entries) {
247 		if (np->pid == pid)
248 			errx(1, "Duplicate process for pid %ld", (long)pid);
249 	}
250 
251 	if (info->flags & FOLLOWFORKS)
252 		if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
253 			err(1, "Unable to follow forks for pid %ld", (long)pid);
254 	if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
255 		err(1, "Unable to enable LWP events for pid %ld", (long)pid);
256 	np = calloc(1, sizeof(struct procinfo));
257 	np->pid = pid;
258 	np->abi = find_abi(pid);
259 	LIST_INIT(&np->threadlist);
260 	LIST_INSERT_HEAD(&info->proclist, np, entries);
261 
262 	if (lwpid != 0)
263 		new_thread(np, lwpid);
264 	else
265 		add_threads(info, np);
266 }
267 
268 static void
269 free_proc(struct procinfo *p)
270 {
271 	struct threadinfo *t, *t2;
272 
273 	LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
274 		free(t);
275 	}
276 	LIST_REMOVE(p, entries);
277 	free(p);
278 }
279 
280 static void
281 detach_all_procs(struct trussinfo *info)
282 {
283 	struct procinfo *p, *p2;
284 
285 	LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
286 		detach_proc(p->pid);
287 		free_proc(p);
288 	}
289 }
290 
291 static struct procinfo *
292 find_proc(struct trussinfo *info, pid_t pid)
293 {
294 	struct procinfo *np;
295 
296 	LIST_FOREACH(np, &info->proclist, entries) {
297 		if (np->pid == pid)
298 			return (np);
299 	}
300 
301 	return (NULL);
302 }
303 
304 /*
305  * Change curthread member based on (pid, lwpid).
306  */
307 static void
308 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
309 {
310 	struct procinfo *np;
311 	struct threadinfo *nt;
312 
313 	np = find_proc(info, pid);
314 	assert(np != NULL);
315 
316 	LIST_FOREACH(nt, &np->threadlist, entries) {
317 		if (nt->tid == lwpid) {
318 			info->curthread = nt;
319 			return;
320 		}
321 	}
322 	errx(1, "could not find thread");
323 }
324 
325 /*
326  * When a process exits, it should have exactly one thread left.
327  * All of the other threads should have reported thread exit events.
328  */
329 static void
330 find_exit_thread(struct trussinfo *info, pid_t pid)
331 {
332 	struct procinfo *p;
333 
334 	p = find_proc(info, pid);
335 	assert(p != NULL);
336 
337 	info->curthread = LIST_FIRST(&p->threadlist);
338 	assert(info->curthread != NULL);
339 	assert(LIST_NEXT(info->curthread, entries) == NULL);
340 }
341 
342 static void
343 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
344 {
345 	u_int i;
346 
347 	assert(t->in_syscall == 0);
348 	assert(t->cs.number == 0);
349 	assert(t->cs.sc == NULL);
350 	assert(t->cs.nargs == 0);
351 	for (i = 0; i < nitems(t->cs.s_args); i++)
352 		assert(t->cs.s_args[i] == NULL);
353 	memset(t->cs.args, 0, sizeof(t->cs.args));
354 	t->cs.number = pl->pl_syscall_code;
355 	t->in_syscall = 1;
356 }
357 
358 static void
359 free_syscall(struct threadinfo *t)
360 {
361 	u_int i;
362 
363 	for (i = 0; i < t->cs.nargs; i++)
364 		free(t->cs.s_args[i]);
365 	memset(&t->cs, 0, sizeof(t->cs));
366 	t->in_syscall = 0;
367 }
368 
369 static void
370 enter_syscall(struct trussinfo *info, struct threadinfo *t,
371     struct ptrace_lwpinfo *pl)
372 {
373 	struct syscall *sc;
374 	u_int i, narg;
375 
376 	alloc_syscall(t, pl);
377 	narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
378 	if (narg != 0 && t->proc->abi->fetch_args(info, narg) != 0) {
379 		free_syscall(t);
380 		return;
381 	}
382 
383 	sc = get_syscall(t, t->cs.number, narg);
384 	if (sc->unknown)
385 		fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
386 		    t->proc->abi->type, t->cs.number);
387 
388 	t->cs.nargs = sc->nargs;
389 	assert(sc->nargs <= nitems(t->cs.s_args));
390 
391 	t->cs.sc = sc;
392 
393 	/*
394 	 * At this point, we set up the system call arguments.
395 	 * We ignore any OUT ones, however -- those are arguments that
396 	 * are set by the system call, and so are probably meaningless
397 	 * now.	This doesn't currently support arguments that are
398 	 * passed in *and* out, however.
399 	 */
400 #if DEBUG
401 	fprintf(stderr, "syscall %s(", sc->name);
402 #endif
403 	for (i = 0; i < t->cs.nargs; i++) {
404 #if DEBUG
405 		fprintf(stderr, "0x%lx%s", t->cs.args[sc->args[i].offset],
406 		    i < (t->cs.nargs - 1) ? "," : "");
407 #endif
408 		if (!(sc->args[i].type & OUT)) {
409 			t->cs.s_args[i] = print_arg(&sc->args[i],
410 			    t->cs.args, 0, info);
411 		}
412 	}
413 #if DEBUG
414 	fprintf(stderr, ")\n");
415 #endif
416 
417 	clock_gettime(CLOCK_REALTIME, &t->before);
418 }
419 
420 /*
421  * When a thread exits voluntarily (including when a thread calls
422  * exit() to trigger a process exit), the thread's internal state
423  * holds the arguments passed to the exit system call.  When the
424  * thread's exit is reported, log that system call without a return
425  * value.
426  */
427 static void
428 thread_exit_syscall(struct trussinfo *info)
429 {
430 	struct threadinfo *t;
431 
432 	t = info->curthread;
433 	if (!t->in_syscall)
434 		return;
435 
436 	clock_gettime(CLOCK_REALTIME, &t->after);
437 
438 	print_syscall_ret(info, 0, NULL);
439 	free_syscall(t);
440 }
441 
442 static void
443 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
444 {
445 	struct threadinfo *t;
446 	struct procinfo *p;
447 	struct syscall *sc;
448 	long retval[2];
449 	u_int i;
450 	int errorp;
451 
452 	t = info->curthread;
453 	if (!t->in_syscall)
454 		return;
455 
456 	clock_gettime(CLOCK_REALTIME, &t->after);
457 	p = t->proc;
458 	if (p->abi->fetch_retval(info, retval, &errorp) < 0) {
459 		free_syscall(t);
460 		return;
461 	}
462 
463 	sc = t->cs.sc;
464 	/*
465 	 * Here, we only look for arguments that have OUT masked in --
466 	 * otherwise, they were handled in enter_syscall().
467 	 */
468 	for (i = 0; i < sc->nargs; i++) {
469 		char *temp;
470 
471 		if (sc->args[i].type & OUT) {
472 			/*
473 			 * If an error occurred, then don't bother
474 			 * getting the data; it may not be valid.
475 			 */
476 			if (errorp) {
477 				asprintf(&temp, "0x%lx",
478 				    t->cs.args[sc->args[i].offset]);
479 			} else {
480 				temp = print_arg(&sc->args[i],
481 				    t->cs.args, retval, info);
482 			}
483 			t->cs.s_args[i] = temp;
484 		}
485 	}
486 
487 	print_syscall_ret(info, errorp, retval);
488 	free_syscall(t);
489 
490 	/*
491 	 * If the process executed a new image, check the ABI.  If the
492 	 * new ABI isn't supported, stop tracing this process.
493 	 */
494 	if (pl->pl_flags & PL_FLAG_EXEC) {
495 		assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
496 		p->abi = find_abi(p->pid);
497 		if (p->abi == NULL) {
498 			if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
499 				err(1, "Can not detach the process");
500 			free_proc(p);
501 		}
502 	}
503 }
504 
505 int
506 print_line_prefix(struct trussinfo *info)
507 {
508 	struct timespec timediff;
509 	struct threadinfo *t;
510 	int len;
511 
512 	len = 0;
513 	t = info->curthread;
514 	if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
515 		if (info->flags & FOLLOWFORKS)
516 			len += fprintf(info->outfile, "%5d", t->proc->pid);
517 		if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
518 		    (FOLLOWFORKS | DISPLAYTIDS))
519 			len += fprintf(info->outfile, " ");
520 		if (info->flags & DISPLAYTIDS)
521 			len += fprintf(info->outfile, "%6d", t->tid);
522 		len += fprintf(info->outfile, ": ");
523 	}
524 	if (info->flags & ABSOLUTETIMESTAMPS) {
525 		timespecsubt(&t->after, &info->start_time, &timediff);
526 		len += fprintf(info->outfile, "%jd.%09ld ",
527 		    (intmax_t)timediff.tv_sec, timediff.tv_nsec);
528 	}
529 	if (info->flags & RELATIVETIMESTAMPS) {
530 		timespecsubt(&t->after, &t->before, &timediff);
531 		len += fprintf(info->outfile, "%jd.%09ld ",
532 		    (intmax_t)timediff.tv_sec, timediff.tv_nsec);
533 	}
534 	return (len);
535 }
536 
537 static void
538 report_thread_death(struct trussinfo *info)
539 {
540 	struct threadinfo *t;
541 
542 	t = info->curthread;
543 	clock_gettime(CLOCK_REALTIME, &t->after);
544 	print_line_prefix(info);
545 	fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
546 }
547 
548 static void
549 report_thread_birth(struct trussinfo *info)
550 {
551 	struct threadinfo *t;
552 
553 	t = info->curthread;
554 	clock_gettime(CLOCK_REALTIME, &t->after);
555 	t->before = t->after;
556 	print_line_prefix(info);
557 	fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
558 }
559 
560 static void
561 report_exit(struct trussinfo *info, siginfo_t *si)
562 {
563 	struct threadinfo *t;
564 
565 	t = info->curthread;
566 	clock_gettime(CLOCK_REALTIME, &t->after);
567 	print_line_prefix(info);
568 	if (si->si_code == CLD_EXITED)
569 		fprintf(info->outfile, "process exit, rval = %u\n",
570 		    si->si_status);
571 	else
572 		fprintf(info->outfile, "process killed, signal = %u%s\n",
573 		    si->si_status, si->si_code == CLD_DUMPED ?
574 		    " (core dumped)" : "");
575 }
576 
577 static void
578 report_new_child(struct trussinfo *info)
579 {
580 	struct threadinfo *t;
581 
582 	t = info->curthread;
583 	clock_gettime(CLOCK_REALTIME, &t->after);
584 	t->before = t->after;
585 	print_line_prefix(info);
586 	fprintf(info->outfile, "<new process>\n");
587 }
588 
589 void
590 decode_siginfo(FILE *fp, siginfo_t *si)
591 {
592 	const char *str;
593 
594 	fprintf(fp, " code=");
595 	str = sysdecode_sigcode(si->si_signo, si->si_code);
596 	if (str == NULL)
597 		fprintf(fp, "%d", si->si_code);
598 	else
599 		fprintf(fp, "%s", str);
600 	switch (si->si_code) {
601 	case SI_NOINFO:
602 		break;
603 	case SI_QUEUE:
604 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
605 		/* FALLTHROUGH */
606 	case SI_USER:
607 	case SI_LWP:
608 		fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
609 		    (intmax_t)si->si_uid);
610 		break;
611 	case SI_TIMER:
612 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
613 		fprintf(fp, " timerid=%d", si->si_timerid);
614 		fprintf(fp, " overrun=%d", si->si_overrun);
615 		if (si->si_errno != 0)
616 			fprintf(fp, " errno=%d", si->si_errno);
617 		break;
618 	case SI_ASYNCIO:
619 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
620 		break;
621 	case SI_MESGQ:
622 		fprintf(fp, " value=%p", si->si_value.sival_ptr);
623 		fprintf(fp, " mqd=%d", si->si_mqd);
624 		break;
625 	default:
626 		switch (si->si_signo) {
627 		case SIGILL:
628 		case SIGFPE:
629 		case SIGSEGV:
630 		case SIGBUS:
631 			fprintf(fp, " trapno=%d", si->si_trapno);
632 			fprintf(fp, " addr=%p", si->si_addr);
633 			break;
634 		case SIGCHLD:
635 			fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
636 			    (intmax_t)si->si_uid);
637 			fprintf(fp, " status=%d", si->si_status);
638 			break;
639 		}
640 	}
641 }
642 
643 static void
644 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl)
645 {
646 	struct threadinfo *t;
647 	const char *signame;
648 
649 	t = info->curthread;
650 	clock_gettime(CLOCK_REALTIME, &t->after);
651 	print_line_prefix(info);
652 	signame = sysdecode_signal(si->si_status);
653 	if (signame == NULL)
654 		signame = "?";
655 	fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame);
656 	if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI)
657 		decode_siginfo(info->outfile, &pl->pl_siginfo);
658 	fprintf(info->outfile, "\n");
659 
660 }
661 
662 /*
663  * Wait for events until all the processes have exited or truss has been
664  * asked to stop.
665  */
666 void
667 eventloop(struct trussinfo *info)
668 {
669 	struct ptrace_lwpinfo pl;
670 	siginfo_t si;
671 	int pending_signal;
672 
673 	while (!LIST_EMPTY(&info->proclist)) {
674 		if (detaching) {
675 			detach_all_procs(info);
676 			return;
677 		}
678 
679 		if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
680 			if (errno == EINTR)
681 				continue;
682 			err(1, "Unexpected error from waitid");
683 		}
684 
685 		assert(si.si_signo == SIGCHLD);
686 
687 		switch (si.si_code) {
688 		case CLD_EXITED:
689 		case CLD_KILLED:
690 		case CLD_DUMPED:
691 			find_exit_thread(info, si.si_pid);
692 			if ((info->flags & COUNTONLY) == 0) {
693 				if (si.si_code == CLD_EXITED)
694 					thread_exit_syscall(info);
695 				report_exit(info, &si);
696 			}
697 			free_proc(info->curthread->proc);
698 			info->curthread = NULL;
699 			break;
700 		case CLD_TRAPPED:
701 			if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
702 			    sizeof(pl)) == -1)
703 				err(1, "ptrace(PT_LWPINFO)");
704 
705 			if (pl.pl_flags & PL_FLAG_CHILD) {
706 				new_proc(info, si.si_pid, pl.pl_lwpid);
707 				assert(LIST_FIRST(&info->proclist)->abi !=
708 				    NULL);
709 			} else if (pl.pl_flags & PL_FLAG_BORN)
710 				new_thread(find_proc(info, si.si_pid),
711 				    pl.pl_lwpid);
712 			find_thread(info, si.si_pid, pl.pl_lwpid);
713 
714 			if (si.si_status == SIGTRAP &&
715 			    (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
716 			    PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
717 				if (pl.pl_flags & PL_FLAG_BORN) {
718 					if ((info->flags & COUNTONLY) == 0)
719 						report_thread_birth(info);
720 				} else if (pl.pl_flags & PL_FLAG_EXITED) {
721 					if ((info->flags & COUNTONLY) == 0)
722 						report_thread_death(info);
723 					free_thread(info->curthread);
724 					info->curthread = NULL;
725 				} else if (pl.pl_flags & PL_FLAG_SCE)
726 					enter_syscall(info, info->curthread, &pl);
727 				else if (pl.pl_flags & PL_FLAG_SCX)
728 					exit_syscall(info, &pl);
729 				pending_signal = 0;
730 			} else if (pl.pl_flags & PL_FLAG_CHILD) {
731 				if ((info->flags & COUNTONLY) == 0)
732 					report_new_child(info);
733 				pending_signal = 0;
734 			} else {
735 				if ((info->flags & NOSIGS) == 0)
736 					report_signal(info, &si, &pl);
737 				pending_signal = si.si_status;
738 			}
739 			ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
740 			    pending_signal);
741 			break;
742 		case CLD_STOPPED:
743 			errx(1, "waitid reported CLD_STOPPED");
744 		case CLD_CONTINUED:
745 			break;
746 		}
747 	}
748 }
749