1/*- 2 * SPDX-License-Identifier: BSD-4-Clause 3 * 4 * Copyright 1997 Sean Eric Fagan 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. All advertising materials mentioning features or use of this software 15 * must display the following acknowledgement: 16 * This product includes software developed by Sean Eric Fagan 17 * 4. Neither the name of the author may be used to endorse or promote 18 * products derived from this software without specific prior written 19 * permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#include <sys/cdefs.h> 35/* 36 * Various setup functions for truss. Not the cleanest-written code, 37 * I'm afraid. 38 */ 39 40#include <sys/ptrace.h> 41#include <sys/sysctl.h> 42#include <sys/time.h> 43#include <sys/wait.h> 44 45#include <assert.h> 46#include <err.h> 47#include <errno.h> 48#include <signal.h> 49#include <stdbool.h> 50#include <stdint.h> 51#include <stdio.h> 52#include <stdlib.h> 53#include <string.h> 54#include <sysdecode.h> 55#include <time.h> 56#include <unistd.h> 57 58#include "truss.h" 59#include "syscall.h" 60#include "extern.h" 61 62struct procabi_table { 63 const char *name; 64 struct procabi *abi; 65}; 66 67static sig_atomic_t detaching; 68 69static void enter_syscall(struct trussinfo *, struct threadinfo *, 70 struct ptrace_lwpinfo *); 71static void new_proc(struct trussinfo *, pid_t, lwpid_t); 72 73 74static struct procabi freebsd = { 75 .type = "FreeBSD", 76 .abi = SYSDECODE_ABI_FREEBSD, 77 .pointer_size = sizeof(void *), 78 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls), 79 .syscalls = { NULL } 80}; 81 82#if !defined(__SIZEOF_POINTER__) 83#error "Use a modern compiler." 84#endif 85 86#if __SIZEOF_POINTER__ > 4 87static struct procabi freebsd32 = { 88 .type = "FreeBSD32", 89 .abi = SYSDECODE_ABI_FREEBSD32, 90 .pointer_size = sizeof(uint32_t), 91 .compat_prefix = "freebsd32_", 92 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls), 93 .syscalls = { NULL } 94}; 95#endif 96 97static struct procabi linux = { 98 .type = "Linux", 99 .abi = SYSDECODE_ABI_LINUX, 100 .pointer_size = sizeof(void *), 101 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux.extra_syscalls), 102 .syscalls = { NULL } 103}; 104 105#if __SIZEOF_POINTER__ > 4 106static struct procabi linux32 = { 107 .type = "Linux32", 108 .abi = SYSDECODE_ABI_LINUX32, 109 .pointer_size = sizeof(uint32_t), 110 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls), 111 .syscalls = { NULL } 112}; 113#endif 114 115static struct procabi_table abis[] = { 116#if __SIZEOF_POINTER__ == 4 117 { "FreeBSD ELF32", &freebsd }, 118#elif __SIZEOF_POINTER__ == 8 119 { "FreeBSD ELF64", &freebsd }, 120 { "FreeBSD ELF32", &freebsd32 }, 121#else 122#error "Unsupported pointer size" 123#endif 124#if defined(__powerpc64__) 125 { "FreeBSD ELF64 V2", &freebsd }, 126#endif 127#if defined(__amd64__) 128 { "FreeBSD a.out", &freebsd32 }, 129#endif 130#if defined(__i386__) 131 { "FreeBSD a.out", &freebsd }, 132#endif 133#if __SIZEOF_POINTER__ >= 8 134 { "Linux ELF64", &linux }, 135 { "Linux ELF32", &linux32 }, 136#else 137 { "Linux ELF32", &linux }, 138#endif 139}; 140 141/* 142 * setup_and_wait() is called to start a process. All it really does 143 * is fork(), enable tracing in the child, and then exec the given 144 * command. At that point, the child process stops, and the parent 145 * can wake up and deal with it. 146 */ 147void 148setup_and_wait(struct trussinfo *info, char *command[]) 149{ 150 pid_t pid; 151 152 pid = vfork(); 153 if (pid == -1) 154 err(1, "fork failed"); 155 if (pid == 0) { /* Child */ 156 ptrace(PT_TRACE_ME, 0, 0, 0); 157 execvp(command[0], command); 158 err(1, "execvp %s", command[0]); 159 } 160 161 /* Only in the parent here */ 162 if (waitpid(pid, NULL, 0) < 0) 163 err(1, "unexpect stop in waitpid"); 164 165 new_proc(info, pid, 0); 166} 167 168/* 169 * start_tracing is called to attach to an existing process. 170 */ 171void 172start_tracing(struct trussinfo *info, pid_t pid) 173{ 174 int ret, retry; 175 176 retry = 10; 177 do { 178 ret = ptrace(PT_ATTACH, pid, NULL, 0); 179 usleep(200); 180 } while (ret && retry-- > 0); 181 if (ret) 182 err(1, "can not attach to target process"); 183 184 if (waitpid(pid, NULL, 0) < 0) 185 err(1, "Unexpect stop in waitpid"); 186 187 new_proc(info, pid, 0); 188} 189 190/* 191 * Restore a process back to it's pre-truss state. 192 * Called for SIGINT, SIGTERM, SIGQUIT. This only 193 * applies if truss was told to monitor an already-existing 194 * process. 195 */ 196void 197restore_proc(int signo __unused) 198{ 199 200 detaching = 1; 201} 202 203static void 204detach_proc(pid_t pid) 205{ 206 int sig, status; 207 208 /* 209 * Stop the child so that we can detach. Filter out possible 210 * lingering SIGTRAP events buffered in the threads. 211 */ 212 kill(pid, SIGSTOP); 213 for (;;) { 214 if (waitpid(pid, &status, 0) < 0) 215 err(1, "Unexpected error in waitpid"); 216 sig = WIFSTOPPED(status) ? WSTOPSIG(status) : 0; 217 if (sig == SIGSTOP) 218 break; 219 if (sig == SIGTRAP) 220 sig = 0; 221 if (ptrace(PT_CONTINUE, pid, (caddr_t)1, sig) < 0) 222 err(1, "Can not continue for detach"); 223 } 224 225 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0) 226 err(1, "Can not detach the process"); 227 228 kill(pid, SIGCONT); 229} 230 231/* 232 * Determine the ABI. This is called after every exec, and when 233 * a process is first monitored. 234 */ 235static struct procabi * 236find_abi(pid_t pid) 237{ 238 size_t len; 239 unsigned int i; 240 int error; 241 int mib[4]; 242 char progt[32]; 243 244 len = sizeof(progt); 245 mib[0] = CTL_KERN; 246 mib[1] = KERN_PROC; 247 mib[2] = KERN_PROC_SV_NAME; 248 mib[3] = pid; 249 error = sysctl(mib, 4, progt, &len, NULL, 0); 250 if (error != 0) 251 err(2, "can not get sysvec name"); 252 253 for (i = 0; i < nitems(abis); i++) { 254 if (strcmp(abis[i].name, progt) == 0) 255 return (abis[i].abi); 256 } 257 warnx("ABI %s for pid %ld is not supported", progt, (long)pid); 258 return (NULL); 259} 260 261static struct threadinfo * 262new_thread(struct procinfo *p, lwpid_t lwpid) 263{ 264 struct threadinfo *nt; 265 266 /* 267 * If this happens it means there is a bug in truss. Unfortunately 268 * this will kill any processes truss is attached to. 269 */ 270 LIST_FOREACH(nt, &p->threadlist, entries) { 271 if (nt->tid == lwpid) 272 errx(1, "Duplicate thread for LWP %ld", (long)lwpid); 273 } 274 275 nt = calloc(1, sizeof(struct threadinfo)); 276 if (nt == NULL) 277 err(1, "calloc() failed"); 278 nt->proc = p; 279 nt->tid = lwpid; 280 LIST_INSERT_HEAD(&p->threadlist, nt, entries); 281 return (nt); 282} 283 284static void 285free_thread(struct threadinfo *t) 286{ 287 288 LIST_REMOVE(t, entries); 289 free(t); 290} 291 292static void 293add_threads(struct trussinfo *info, struct procinfo *p) 294{ 295 struct ptrace_lwpinfo pl; 296 struct threadinfo *t; 297 lwpid_t *lwps; 298 int i, nlwps; 299 300 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0); 301 if (nlwps == -1) 302 err(1, "Unable to fetch number of LWPs"); 303 assert(nlwps > 0); 304 lwps = calloc(nlwps, sizeof(*lwps)); 305 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps); 306 if (nlwps == -1) 307 err(1, "Unable to fetch LWP list"); 308 for (i = 0; i < nlwps; i++) { 309 t = new_thread(p, lwps[i]); 310 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1) 311 err(1, "ptrace(PT_LWPINFO)"); 312 if (pl.pl_flags & PL_FLAG_SCE) { 313 info->curthread = t; 314 enter_syscall(info, t, &pl); 315 } 316 } 317 free(lwps); 318} 319 320static void 321new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 322{ 323 struct procinfo *np; 324 325 /* 326 * If this happens it means there is a bug in truss. Unfortunately 327 * this will kill any processes truss is attached to. 328 */ 329 LIST_FOREACH(np, &info->proclist, entries) { 330 if (np->pid == pid) 331 errx(1, "Duplicate process for pid %ld", (long)pid); 332 } 333 334 if (info->flags & FOLLOWFORKS) 335 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1) 336 err(1, "Unable to follow forks for pid %ld", (long)pid); 337 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1) 338 err(1, "Unable to enable LWP events for pid %ld", (long)pid); 339 np = calloc(1, sizeof(struct procinfo)); 340 np->pid = pid; 341 np->abi = find_abi(pid); 342 LIST_INIT(&np->threadlist); 343 LIST_INSERT_HEAD(&info->proclist, np, entries); 344 345 if (lwpid != 0) 346 new_thread(np, lwpid); 347 else 348 add_threads(info, np); 349} 350 351static void 352free_proc(struct procinfo *p) 353{ 354 struct threadinfo *t, *t2; 355 356 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) { 357 free(t); 358 } 359 LIST_REMOVE(p, entries); 360 free(p); 361} 362 363static void 364detach_all_procs(struct trussinfo *info) 365{ 366 struct procinfo *p, *p2; 367 368 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) { 369 detach_proc(p->pid); 370 free_proc(p); 371 } 372} 373 374static struct procinfo * 375find_proc(struct trussinfo *info, pid_t pid) 376{ 377 struct procinfo *np; 378 379 LIST_FOREACH(np, &info->proclist, entries) { 380 if (np->pid == pid) 381 return (np); 382 } 383 384 return (NULL); 385} 386 387/* 388 * Change curthread member based on (pid, lwpid). 389 */ 390static void 391find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 392{ 393 struct procinfo *np; 394 struct threadinfo *nt; 395 396 np = find_proc(info, pid); 397 assert(np != NULL); 398 399 LIST_FOREACH(nt, &np->threadlist, entries) { 400 if (nt->tid == lwpid) { 401 info->curthread = nt; 402 return; 403 } 404 } 405 errx(1, "could not find thread"); 406} 407 408/* 409 * When a process exits, it should have exactly one thread left. 410 * All of the other threads should have reported thread exit events. 411 */ 412static void 413find_exit_thread(struct trussinfo *info, pid_t pid) 414{ 415 struct procinfo *p; 416 417 p = find_proc(info, pid); 418 assert(p != NULL); 419 420 info->curthread = LIST_FIRST(&p->threadlist); 421 assert(info->curthread != NULL); 422 assert(LIST_NEXT(info->curthread, entries) == NULL); 423} 424 425static void 426alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl) 427{ 428 u_int i; 429 430 assert(t->in_syscall == 0); 431 assert(t->cs.number == 0); 432 assert(t->cs.sc == NULL); 433 assert(t->cs.nargs == 0); 434 for (i = 0; i < nitems(t->cs.s_args); i++) 435 assert(t->cs.s_args[i] == NULL); 436 memset(t->cs.args, 0, sizeof(t->cs.args)); 437 t->cs.number = pl->pl_syscall_code; 438 t->in_syscall = 1; 439} 440 441static void 442free_syscall(struct threadinfo *t) 443{ 444 u_int i; 445 446 for (i = 0; i < t->cs.nargs; i++) 447 free(t->cs.s_args[i]); 448 memset(&t->cs, 0, sizeof(t->cs)); 449 t->in_syscall = 0; 450} 451 452static void 453enter_syscall(struct trussinfo *info, struct threadinfo *t, 454 struct ptrace_lwpinfo *pl) 455{ 456 struct syscall *sc; 457 u_int i, narg; 458 459 alloc_syscall(t, pl); 460 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args)); 461 if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args, 462 sizeof(t->cs.args)) != 0) { 463 free_syscall(t); 464 return; 465 } 466 467 sc = get_syscall(t, t->cs.number, narg); 468 if (sc->unknown) 469 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n", 470 t->proc->abi->type, t->cs.number); 471 472 t->cs.nargs = sc->decode.nargs; 473 assert(sc->decode.nargs <= nitems(t->cs.s_args)); 474 475 t->cs.sc = sc; 476 477 /* 478 * At this point, we set up the system call arguments. 479 * We ignore any OUT ones, however -- those are arguments that 480 * are set by the system call, and so are probably meaningless 481 * now. This doesn't currently support arguments that are 482 * passed in *and* out, however. 483 */ 484#if DEBUG 485 fprintf(stderr, "syscall %s(", sc->name); 486#endif 487 for (i = 0; i < t->cs.nargs; i++) { 488#if DEBUG 489 fprintf(stderr, "0x%lx%s", 490 t->cs.args[sc->decode.args[i].offset], 491 i < (t->cs.nargs - 1) ? "," : ""); 492#endif 493 if (!(sc->decode.args[i].type & OUT)) { 494 t->cs.s_args[i] = print_arg(&sc->decode.args[i], 495 t->cs.args, NULL, info); 496 } 497 } 498#if DEBUG 499 fprintf(stderr, ")\n"); 500#endif 501 502 clock_gettime(CLOCK_REALTIME, &t->before); 503} 504 505/* 506 * When a thread exits voluntarily (including when a thread calls 507 * exit() to trigger a process exit), the thread's internal state 508 * holds the arguments passed to the exit system call. When the 509 * thread's exit is reported, log that system call without a return 510 * value. 511 */ 512static void 513thread_exit_syscall(struct trussinfo *info) 514{ 515 struct threadinfo *t; 516 517 t = info->curthread; 518 if (!t->in_syscall) 519 return; 520 521 clock_gettime(CLOCK_REALTIME, &t->after); 522 523 print_syscall_ret(info, 0, NULL); 524 free_syscall(t); 525} 526 527static void 528exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl) 529{ 530 struct threadinfo *t; 531 struct procinfo *p; 532 struct syscall *sc; 533 struct ptrace_sc_ret psr; 534 u_int i; 535 536 t = info->curthread; 537 if (!t->in_syscall) 538 return; 539 540 clock_gettime(CLOCK_REALTIME, &t->after); 541 p = t->proc; 542 if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) { 543 free_syscall(t); 544 return; 545 } 546 547 sc = t->cs.sc; 548 /* 549 * Here, we only look for arguments that have OUT masked in -- 550 * otherwise, they were handled in enter_syscall(). 551 */ 552 for (i = 0; i < sc->decode.nargs; i++) { 553 char *temp; 554 555 if (sc->decode.args[i].type & OUT) { 556 /* 557 * If an error occurred, then don't bother 558 * getting the data; it may not be valid. 559 */ 560 if (psr.sr_error != 0) { 561 asprintf(&temp, "0x%lx", 562 (long)t->cs.args[sc->decode.args[i].offset]); 563 } else { 564 temp = print_arg(&sc->decode.args[i], 565 t->cs.args, psr.sr_retval, info); 566 } 567 t->cs.s_args[i] = temp; 568 } 569 } 570 571 print_syscall_ret(info, psr.sr_error, psr.sr_retval); 572 free_syscall(t); 573 574 /* 575 * If the process executed a new image, check the ABI. If the 576 * new ABI isn't supported, stop tracing this process. 577 */ 578 if (pl->pl_flags & PL_FLAG_EXEC) { 579 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL); 580 p->abi = find_abi(p->pid); 581 if (p->abi == NULL) { 582 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0) 583 err(1, "Can not detach the process"); 584 free_proc(p); 585 } 586 } 587} 588 589int 590print_line_prefix(struct trussinfo *info) 591{ 592 struct timespec timediff; 593 struct threadinfo *t; 594 int len; 595 596 len = 0; 597 t = info->curthread; 598 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) { 599 if (info->flags & FOLLOWFORKS) 600 len += fprintf(info->outfile, "%5d", t->proc->pid); 601 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) == 602 (FOLLOWFORKS | DISPLAYTIDS)) 603 len += fprintf(info->outfile, " "); 604 if (info->flags & DISPLAYTIDS) 605 len += fprintf(info->outfile, "%6d", t->tid); 606 len += fprintf(info->outfile, ": "); 607 } 608 if (info->flags & ABSOLUTETIMESTAMPS) { 609 timespecsub(&t->after, &info->start_time, &timediff); 610 len += fprintf(info->outfile, "%jd.%09ld ", 611 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 612 } 613 if (info->flags & RELATIVETIMESTAMPS) { 614 timespecsub(&t->after, &t->before, &timediff); 615 len += fprintf(info->outfile, "%jd.%09ld ", 616 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 617 } 618 return (len); 619} 620 621static void 622report_thread_death(struct trussinfo *info) 623{ 624 struct threadinfo *t; 625 626 t = info->curthread; 627 clock_gettime(CLOCK_REALTIME, &t->after); 628 print_line_prefix(info); 629 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid); 630} 631 632static void 633report_thread_birth(struct trussinfo *info) 634{ 635 struct threadinfo *t; 636 637 t = info->curthread; 638 clock_gettime(CLOCK_REALTIME, &t->after); 639 t->before = t->after; 640 print_line_prefix(info); 641 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid); 642} 643 644static void 645report_exit(struct trussinfo *info, siginfo_t *si) 646{ 647 struct threadinfo *t; 648 649 t = info->curthread; 650 clock_gettime(CLOCK_REALTIME, &t->after); 651 print_line_prefix(info); 652 if (si->si_code == CLD_EXITED) 653 fprintf(info->outfile, "process exit, rval = %u\n", 654 si->si_status); 655 else 656 fprintf(info->outfile, "process killed, signal = %u%s\n", 657 si->si_status, si->si_code == CLD_DUMPED ? 658 " (core dumped)" : ""); 659} 660 661static void 662report_new_child(struct trussinfo *info) 663{ 664 struct threadinfo *t; 665 666 t = info->curthread; 667 clock_gettime(CLOCK_REALTIME, &t->after); 668 t->before = t->after; 669 print_line_prefix(info); 670 fprintf(info->outfile, "<new process>\n"); 671} 672 673void 674decode_siginfo(FILE *fp, siginfo_t *si) 675{ 676 const char *str; 677 678 fprintf(fp, " code="); 679 str = sysdecode_sigcode(si->si_signo, si->si_code); 680 if (str == NULL) 681 fprintf(fp, "%d", si->si_code); 682 else 683 fprintf(fp, "%s", str); 684 switch (si->si_code) { 685 case SI_NOINFO: 686 break; 687 case SI_QUEUE: 688 fprintf(fp, " value=%p", si->si_value.sival_ptr); 689 /* FALLTHROUGH */ 690 case SI_USER: 691 case SI_LWP: 692 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 693 (intmax_t)si->si_uid); 694 break; 695 case SI_TIMER: 696 fprintf(fp, " value=%p", si->si_value.sival_ptr); 697 fprintf(fp, " timerid=%d", si->si_timerid); 698 fprintf(fp, " overrun=%d", si->si_overrun); 699 if (si->si_errno != 0) 700 fprintf(fp, " errno=%d", si->si_errno); 701 break; 702 case SI_ASYNCIO: 703 fprintf(fp, " value=%p", si->si_value.sival_ptr); 704 break; 705 case SI_MESGQ: 706 fprintf(fp, " value=%p", si->si_value.sival_ptr); 707 fprintf(fp, " mqd=%d", si->si_mqd); 708 break; 709 default: 710 switch (si->si_signo) { 711 case SIGILL: 712 case SIGFPE: 713 case SIGSEGV: 714 case SIGBUS: 715 fprintf(fp, " trapno=%d", si->si_trapno); 716 fprintf(fp, " addr=%p", si->si_addr); 717 break; 718 case SIGCHLD: 719 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 720 (intmax_t)si->si_uid); 721 fprintf(fp, " status=%d", si->si_status); 722 break; 723 } 724 } 725} 726 727static void 728report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl) 729{ 730 struct threadinfo *t; 731 const char *signame; 732 733 t = info->curthread; 734 clock_gettime(CLOCK_REALTIME, &t->after); 735 print_line_prefix(info); 736 signame = sysdecode_signal(si->si_status); 737 if (signame == NULL) 738 signame = "?"; 739 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame); 740 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI) 741 decode_siginfo(info->outfile, &pl->pl_siginfo); 742 fprintf(info->outfile, "\n"); 743 744} 745 746/* 747 * Wait for events until all the processes have exited or truss has been 748 * asked to stop. 749 */ 750void 751eventloop(struct trussinfo *info) 752{ 753 struct ptrace_lwpinfo pl; 754 siginfo_t si; 755 int pending_signal; 756 757 while (!LIST_EMPTY(&info->proclist)) { 758 if (detaching) { 759 detach_all_procs(info); 760 return; 761 } 762 763 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) { 764 if (errno == EINTR) 765 continue; 766 err(1, "Unexpected error from waitid"); 767 } 768 769 assert(si.si_signo == SIGCHLD); 770 771 switch (si.si_code) { 772 case CLD_EXITED: 773 case CLD_KILLED: 774 case CLD_DUMPED: 775 find_exit_thread(info, si.si_pid); 776 if ((info->flags & COUNTONLY) == 0) { 777 if (si.si_code == CLD_EXITED) 778 thread_exit_syscall(info); 779 report_exit(info, &si); 780 } 781 free_proc(info->curthread->proc); 782 info->curthread = NULL; 783 break; 784 case CLD_TRAPPED: 785 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl, 786 sizeof(pl)) == -1) 787 err(1, "ptrace(PT_LWPINFO)"); 788 789 if (pl.pl_flags & PL_FLAG_CHILD) { 790 new_proc(info, si.si_pid, pl.pl_lwpid); 791 assert(LIST_FIRST(&info->proclist)->abi != 792 NULL); 793 } else if (pl.pl_flags & PL_FLAG_BORN) 794 new_thread(find_proc(info, si.si_pid), 795 pl.pl_lwpid); 796 find_thread(info, si.si_pid, pl.pl_lwpid); 797 798 if (si.si_status == SIGTRAP && 799 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED| 800 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) { 801 if (pl.pl_flags & PL_FLAG_BORN) { 802 if ((info->flags & COUNTONLY) == 0) 803 report_thread_birth(info); 804 } else if (pl.pl_flags & PL_FLAG_EXITED) { 805 if ((info->flags & COUNTONLY) == 0) 806 report_thread_death(info); 807 free_thread(info->curthread); 808 info->curthread = NULL; 809 } else if (pl.pl_flags & PL_FLAG_SCE) 810 enter_syscall(info, info->curthread, &pl); 811 else if (pl.pl_flags & PL_FLAG_SCX) 812 exit_syscall(info, &pl); 813 pending_signal = 0; 814 } else if (pl.pl_flags & PL_FLAG_CHILD) { 815 if ((info->flags & COUNTONLY) == 0) 816 report_new_child(info); 817 pending_signal = 0; 818 } else { 819 if ((info->flags & NOSIGS) == 0) 820 report_signal(info, &si, &pl); 821 pending_signal = si.si_status; 822 } 823 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1, 824 pending_signal); 825 break; 826 case CLD_STOPPED: 827 errx(1, "waitid reported CLD_STOPPED"); 828 case CLD_CONTINUED: 829 break; 830 } 831 } 832} 833