1 /*- 2 * SPDX-License-Identifier: BSD-4-Clause 3 * 4 * Copyright 1997 Sean Eric Fagan 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. All advertising materials mentioning features or use of this software 15 * must display the following acknowledgement: 16 * This product includes software developed by Sean Eric Fagan 17 * 4. Neither the name of the author may be used to endorse or promote 18 * products derived from this software without specific prior written 19 * permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 /* 38 * Various setup functions for truss. Not the cleanest-written code, 39 * I'm afraid. 40 */ 41 42 #include <sys/ptrace.h> 43 #include <sys/sysctl.h> 44 #include <sys/time.h> 45 #include <sys/wait.h> 46 47 #include <assert.h> 48 #include <err.h> 49 #include <errno.h> 50 #include <signal.h> 51 #include <stdbool.h> 52 #include <stdint.h> 53 #include <stdio.h> 54 #include <stdlib.h> 55 #include <string.h> 56 #include <sysdecode.h> 57 #include <time.h> 58 #include <unistd.h> 59 60 #include "truss.h" 61 #include "syscall.h" 62 #include "extern.h" 63 64 struct procabi_table { 65 const char *name; 66 struct procabi *abi; 67 }; 68 69 static sig_atomic_t detaching; 70 71 static void enter_syscall(struct trussinfo *, struct threadinfo *, 72 struct ptrace_lwpinfo *); 73 static void new_proc(struct trussinfo *, pid_t, lwpid_t); 74 75 76 static struct procabi cloudabi32 = { 77 .type = "CloudABI32", 78 .abi = SYSDECODE_ABI_CLOUDABI32, 79 .pointer_size = sizeof(uint32_t), 80 .extra_syscalls = STAILQ_HEAD_INITIALIZER(cloudabi32.extra_syscalls), 81 .syscalls = { NULL } 82 }; 83 84 static struct procabi cloudabi64 = { 85 .type = "CloudABI64", 86 .abi = SYSDECODE_ABI_CLOUDABI64, 87 .pointer_size = sizeof(uint64_t), 88 .extra_syscalls = STAILQ_HEAD_INITIALIZER(cloudabi64.extra_syscalls), 89 .syscalls = { NULL } 90 }; 91 92 static struct procabi freebsd = { 93 .type = "FreeBSD", 94 .abi = SYSDECODE_ABI_FREEBSD, 95 .pointer_size = sizeof(void *), 96 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls), 97 .syscalls = { NULL } 98 }; 99 100 #if !defined(__SIZEOF_POINTER__) 101 #error "Use a modern compiler." 102 #endif 103 104 #if __SIZEOF_POINTER__ > 4 105 static struct procabi freebsd32 = { 106 .type = "FreeBSD32", 107 .abi = SYSDECODE_ABI_FREEBSD32, 108 .pointer_size = sizeof(uint32_t), 109 .compat_prefix = "freebsd32_", 110 .extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls), 111 .syscalls = { NULL } 112 }; 113 #endif 114 115 static struct procabi linux = { 116 .type = "Linux", 117 .abi = SYSDECODE_ABI_LINUX, 118 .pointer_size = sizeof(void *), 119 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux.extra_syscalls), 120 .syscalls = { NULL } 121 }; 122 123 #if __SIZEOF_POINTER__ > 4 124 static struct procabi linux32 = { 125 .type = "Linux32", 126 .abi = SYSDECODE_ABI_LINUX32, 127 .pointer_size = sizeof(uint32_t), 128 .extra_syscalls = STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls), 129 .syscalls = { NULL } 130 }; 131 #endif 132 133 static struct procabi_table abis[] = { 134 { "CloudABI ELF32", &cloudabi32 }, 135 { "CloudABI ELF64", &cloudabi64 }, 136 #if __SIZEOF_POINTER__ == 4 137 { "FreeBSD ELF32", &freebsd }, 138 #elif __SIZEOF_POINTER__ == 8 139 { "FreeBSD ELF64", &freebsd }, 140 { "FreeBSD ELF32", &freebsd32 }, 141 #else 142 #error "Unsupported pointer size" 143 #endif 144 #if defined(__powerpc64__) 145 { "FreeBSD ELF64 V2", &freebsd }, 146 #endif 147 #if defined(__amd64__) 148 { "FreeBSD a.out", &freebsd32 }, 149 #endif 150 #if defined(__i386__) 151 { "FreeBSD a.out", &freebsd }, 152 #endif 153 #if __SIZEOF_POINTER__ >= 8 154 { "Linux ELF64", &linux }, 155 { "Linux ELF32", &linux32 }, 156 #else 157 { "Linux ELF32", &linux }, 158 #endif 159 }; 160 161 /* 162 * setup_and_wait() is called to start a process. All it really does 163 * is fork(), enable tracing in the child, and then exec the given 164 * command. At that point, the child process stops, and the parent 165 * can wake up and deal with it. 166 */ 167 void 168 setup_and_wait(struct trussinfo *info, char *command[]) 169 { 170 pid_t pid; 171 172 pid = vfork(); 173 if (pid == -1) 174 err(1, "fork failed"); 175 if (pid == 0) { /* Child */ 176 ptrace(PT_TRACE_ME, 0, 0, 0); 177 execvp(command[0], command); 178 err(1, "execvp %s", command[0]); 179 } 180 181 /* Only in the parent here */ 182 if (waitpid(pid, NULL, 0) < 0) 183 err(1, "unexpect stop in waitpid"); 184 185 new_proc(info, pid, 0); 186 } 187 188 /* 189 * start_tracing is called to attach to an existing process. 190 */ 191 void 192 start_tracing(struct trussinfo *info, pid_t pid) 193 { 194 int ret, retry; 195 196 retry = 10; 197 do { 198 ret = ptrace(PT_ATTACH, pid, NULL, 0); 199 usleep(200); 200 } while (ret && retry-- > 0); 201 if (ret) 202 err(1, "can not attach to target process"); 203 204 if (waitpid(pid, NULL, 0) < 0) 205 err(1, "Unexpect stop in waitpid"); 206 207 new_proc(info, pid, 0); 208 } 209 210 /* 211 * Restore a process back to it's pre-truss state. 212 * Called for SIGINT, SIGTERM, SIGQUIT. This only 213 * applies if truss was told to monitor an already-existing 214 * process. 215 */ 216 void 217 restore_proc(int signo __unused) 218 { 219 220 detaching = 1; 221 } 222 223 static void 224 detach_proc(pid_t pid) 225 { 226 227 /* stop the child so that we can detach */ 228 kill(pid, SIGSTOP); 229 if (waitpid(pid, NULL, 0) < 0) 230 err(1, "Unexpected stop in waitpid"); 231 232 if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0) 233 err(1, "Can not detach the process"); 234 235 kill(pid, SIGCONT); 236 } 237 238 /* 239 * Determine the ABI. This is called after every exec, and when 240 * a process is first monitored. 241 */ 242 static struct procabi * 243 find_abi(pid_t pid) 244 { 245 size_t len; 246 unsigned int i; 247 int error; 248 int mib[4]; 249 char progt[32]; 250 251 len = sizeof(progt); 252 mib[0] = CTL_KERN; 253 mib[1] = KERN_PROC; 254 mib[2] = KERN_PROC_SV_NAME; 255 mib[3] = pid; 256 error = sysctl(mib, 4, progt, &len, NULL, 0); 257 if (error != 0) 258 err(2, "can not get sysvec name"); 259 260 for (i = 0; i < nitems(abis); i++) { 261 if (strcmp(abis[i].name, progt) == 0) 262 return (abis[i].abi); 263 } 264 warnx("ABI %s for pid %ld is not supported", progt, (long)pid); 265 return (NULL); 266 } 267 268 static struct threadinfo * 269 new_thread(struct procinfo *p, lwpid_t lwpid) 270 { 271 struct threadinfo *nt; 272 273 /* 274 * If this happens it means there is a bug in truss. Unfortunately 275 * this will kill any processes truss is attached to. 276 */ 277 LIST_FOREACH(nt, &p->threadlist, entries) { 278 if (nt->tid == lwpid) 279 errx(1, "Duplicate thread for LWP %ld", (long)lwpid); 280 } 281 282 nt = calloc(1, sizeof(struct threadinfo)); 283 if (nt == NULL) 284 err(1, "calloc() failed"); 285 nt->proc = p; 286 nt->tid = lwpid; 287 LIST_INSERT_HEAD(&p->threadlist, nt, entries); 288 return (nt); 289 } 290 291 static void 292 free_thread(struct threadinfo *t) 293 { 294 295 LIST_REMOVE(t, entries); 296 free(t); 297 } 298 299 static void 300 add_threads(struct trussinfo *info, struct procinfo *p) 301 { 302 struct ptrace_lwpinfo pl; 303 struct threadinfo *t; 304 lwpid_t *lwps; 305 int i, nlwps; 306 307 nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0); 308 if (nlwps == -1) 309 err(1, "Unable to fetch number of LWPs"); 310 assert(nlwps > 0); 311 lwps = calloc(nlwps, sizeof(*lwps)); 312 nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps); 313 if (nlwps == -1) 314 err(1, "Unable to fetch LWP list"); 315 for (i = 0; i < nlwps; i++) { 316 t = new_thread(p, lwps[i]); 317 if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1) 318 err(1, "ptrace(PT_LWPINFO)"); 319 if (pl.pl_flags & PL_FLAG_SCE) { 320 info->curthread = t; 321 enter_syscall(info, t, &pl); 322 } 323 } 324 free(lwps); 325 } 326 327 static void 328 new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 329 { 330 struct procinfo *np; 331 332 /* 333 * If this happens it means there is a bug in truss. Unfortunately 334 * this will kill any processes truss is attached to. 335 */ 336 LIST_FOREACH(np, &info->proclist, entries) { 337 if (np->pid == pid) 338 errx(1, "Duplicate process for pid %ld", (long)pid); 339 } 340 341 if (info->flags & FOLLOWFORKS) 342 if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1) 343 err(1, "Unable to follow forks for pid %ld", (long)pid); 344 if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1) 345 err(1, "Unable to enable LWP events for pid %ld", (long)pid); 346 np = calloc(1, sizeof(struct procinfo)); 347 np->pid = pid; 348 np->abi = find_abi(pid); 349 LIST_INIT(&np->threadlist); 350 LIST_INSERT_HEAD(&info->proclist, np, entries); 351 352 if (lwpid != 0) 353 new_thread(np, lwpid); 354 else 355 add_threads(info, np); 356 } 357 358 static void 359 free_proc(struct procinfo *p) 360 { 361 struct threadinfo *t, *t2; 362 363 LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) { 364 free(t); 365 } 366 LIST_REMOVE(p, entries); 367 free(p); 368 } 369 370 static void 371 detach_all_procs(struct trussinfo *info) 372 { 373 struct procinfo *p, *p2; 374 375 LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) { 376 detach_proc(p->pid); 377 free_proc(p); 378 } 379 } 380 381 static struct procinfo * 382 find_proc(struct trussinfo *info, pid_t pid) 383 { 384 struct procinfo *np; 385 386 LIST_FOREACH(np, &info->proclist, entries) { 387 if (np->pid == pid) 388 return (np); 389 } 390 391 return (NULL); 392 } 393 394 /* 395 * Change curthread member based on (pid, lwpid). 396 */ 397 static void 398 find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid) 399 { 400 struct procinfo *np; 401 struct threadinfo *nt; 402 403 np = find_proc(info, pid); 404 assert(np != NULL); 405 406 LIST_FOREACH(nt, &np->threadlist, entries) { 407 if (nt->tid == lwpid) { 408 info->curthread = nt; 409 return; 410 } 411 } 412 errx(1, "could not find thread"); 413 } 414 415 /* 416 * When a process exits, it should have exactly one thread left. 417 * All of the other threads should have reported thread exit events. 418 */ 419 static void 420 find_exit_thread(struct trussinfo *info, pid_t pid) 421 { 422 struct procinfo *p; 423 424 p = find_proc(info, pid); 425 assert(p != NULL); 426 427 info->curthread = LIST_FIRST(&p->threadlist); 428 assert(info->curthread != NULL); 429 assert(LIST_NEXT(info->curthread, entries) == NULL); 430 } 431 432 static void 433 alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl) 434 { 435 u_int i; 436 437 assert(t->in_syscall == 0); 438 assert(t->cs.number == 0); 439 assert(t->cs.sc == NULL); 440 assert(t->cs.nargs == 0); 441 for (i = 0; i < nitems(t->cs.s_args); i++) 442 assert(t->cs.s_args[i] == NULL); 443 memset(t->cs.args, 0, sizeof(t->cs.args)); 444 t->cs.number = pl->pl_syscall_code; 445 t->in_syscall = 1; 446 } 447 448 static void 449 free_syscall(struct threadinfo *t) 450 { 451 u_int i; 452 453 for (i = 0; i < t->cs.nargs; i++) 454 free(t->cs.s_args[i]); 455 memset(&t->cs, 0, sizeof(t->cs)); 456 t->in_syscall = 0; 457 } 458 459 static void 460 enter_syscall(struct trussinfo *info, struct threadinfo *t, 461 struct ptrace_lwpinfo *pl) 462 { 463 struct syscall *sc; 464 u_int i, narg; 465 466 alloc_syscall(t, pl); 467 narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args)); 468 if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args, 469 sizeof(t->cs.args)) != 0) { 470 free_syscall(t); 471 return; 472 } 473 474 sc = get_syscall(t, t->cs.number, narg); 475 if (sc->unknown) 476 fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n", 477 t->proc->abi->type, t->cs.number); 478 479 t->cs.nargs = sc->decode.nargs; 480 assert(sc->decode.nargs <= nitems(t->cs.s_args)); 481 482 t->cs.sc = sc; 483 484 /* 485 * At this point, we set up the system call arguments. 486 * We ignore any OUT ones, however -- those are arguments that 487 * are set by the system call, and so are probably meaningless 488 * now. This doesn't currently support arguments that are 489 * passed in *and* out, however. 490 */ 491 #if DEBUG 492 fprintf(stderr, "syscall %s(", sc->name); 493 #endif 494 for (i = 0; i < t->cs.nargs; i++) { 495 #if DEBUG 496 fprintf(stderr, "0x%lx%s", 497 t->cs.args[sc->decode.args[i].offset], 498 i < (t->cs.nargs - 1) ? "," : ""); 499 #endif 500 if (!(sc->decode.args[i].type & OUT)) { 501 t->cs.s_args[i] = print_arg(&sc->decode.args[i], 502 t->cs.args, NULL, info); 503 } 504 } 505 #if DEBUG 506 fprintf(stderr, ")\n"); 507 #endif 508 509 clock_gettime(CLOCK_REALTIME, &t->before); 510 } 511 512 /* 513 * When a thread exits voluntarily (including when a thread calls 514 * exit() to trigger a process exit), the thread's internal state 515 * holds the arguments passed to the exit system call. When the 516 * thread's exit is reported, log that system call without a return 517 * value. 518 */ 519 static void 520 thread_exit_syscall(struct trussinfo *info) 521 { 522 struct threadinfo *t; 523 524 t = info->curthread; 525 if (!t->in_syscall) 526 return; 527 528 clock_gettime(CLOCK_REALTIME, &t->after); 529 530 print_syscall_ret(info, 0, NULL); 531 free_syscall(t); 532 } 533 534 static void 535 exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl) 536 { 537 struct threadinfo *t; 538 struct procinfo *p; 539 struct syscall *sc; 540 struct ptrace_sc_ret psr; 541 u_int i; 542 543 t = info->curthread; 544 if (!t->in_syscall) 545 return; 546 547 clock_gettime(CLOCK_REALTIME, &t->after); 548 p = t->proc; 549 if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) { 550 free_syscall(t); 551 return; 552 } 553 554 sc = t->cs.sc; 555 /* 556 * Here, we only look for arguments that have OUT masked in -- 557 * otherwise, they were handled in enter_syscall(). 558 */ 559 for (i = 0; i < sc->decode.nargs; i++) { 560 char *temp; 561 562 if (sc->decode.args[i].type & OUT) { 563 /* 564 * If an error occurred, then don't bother 565 * getting the data; it may not be valid. 566 */ 567 if (psr.sr_error != 0) { 568 asprintf(&temp, "0x%lx", 569 t->cs.args[sc->decode.args[i].offset]); 570 } else { 571 temp = print_arg(&sc->decode.args[i], 572 t->cs.args, psr.sr_retval, info); 573 } 574 t->cs.s_args[i] = temp; 575 } 576 } 577 578 print_syscall_ret(info, psr.sr_error, psr.sr_retval); 579 free_syscall(t); 580 581 /* 582 * If the process executed a new image, check the ABI. If the 583 * new ABI isn't supported, stop tracing this process. 584 */ 585 if (pl->pl_flags & PL_FLAG_EXEC) { 586 assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL); 587 p->abi = find_abi(p->pid); 588 if (p->abi == NULL) { 589 if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0) 590 err(1, "Can not detach the process"); 591 free_proc(p); 592 } 593 } 594 } 595 596 int 597 print_line_prefix(struct trussinfo *info) 598 { 599 struct timespec timediff; 600 struct threadinfo *t; 601 int len; 602 603 len = 0; 604 t = info->curthread; 605 if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) { 606 if (info->flags & FOLLOWFORKS) 607 len += fprintf(info->outfile, "%5d", t->proc->pid); 608 if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) == 609 (FOLLOWFORKS | DISPLAYTIDS)) 610 len += fprintf(info->outfile, " "); 611 if (info->flags & DISPLAYTIDS) 612 len += fprintf(info->outfile, "%6d", t->tid); 613 len += fprintf(info->outfile, ": "); 614 } 615 if (info->flags & ABSOLUTETIMESTAMPS) { 616 timespecsub(&t->after, &info->start_time, &timediff); 617 len += fprintf(info->outfile, "%jd.%09ld ", 618 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 619 } 620 if (info->flags & RELATIVETIMESTAMPS) { 621 timespecsub(&t->after, &t->before, &timediff); 622 len += fprintf(info->outfile, "%jd.%09ld ", 623 (intmax_t)timediff.tv_sec, timediff.tv_nsec); 624 } 625 return (len); 626 } 627 628 static void 629 report_thread_death(struct trussinfo *info) 630 { 631 struct threadinfo *t; 632 633 t = info->curthread; 634 clock_gettime(CLOCK_REALTIME, &t->after); 635 print_line_prefix(info); 636 fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid); 637 } 638 639 static void 640 report_thread_birth(struct trussinfo *info) 641 { 642 struct threadinfo *t; 643 644 t = info->curthread; 645 clock_gettime(CLOCK_REALTIME, &t->after); 646 t->before = t->after; 647 print_line_prefix(info); 648 fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid); 649 } 650 651 static void 652 report_exit(struct trussinfo *info, siginfo_t *si) 653 { 654 struct threadinfo *t; 655 656 t = info->curthread; 657 clock_gettime(CLOCK_REALTIME, &t->after); 658 print_line_prefix(info); 659 if (si->si_code == CLD_EXITED) 660 fprintf(info->outfile, "process exit, rval = %u\n", 661 si->si_status); 662 else 663 fprintf(info->outfile, "process killed, signal = %u%s\n", 664 si->si_status, si->si_code == CLD_DUMPED ? 665 " (core dumped)" : ""); 666 } 667 668 static void 669 report_new_child(struct trussinfo *info) 670 { 671 struct threadinfo *t; 672 673 t = info->curthread; 674 clock_gettime(CLOCK_REALTIME, &t->after); 675 t->before = t->after; 676 print_line_prefix(info); 677 fprintf(info->outfile, "<new process>\n"); 678 } 679 680 void 681 decode_siginfo(FILE *fp, siginfo_t *si) 682 { 683 const char *str; 684 685 fprintf(fp, " code="); 686 str = sysdecode_sigcode(si->si_signo, si->si_code); 687 if (str == NULL) 688 fprintf(fp, "%d", si->si_code); 689 else 690 fprintf(fp, "%s", str); 691 switch (si->si_code) { 692 case SI_NOINFO: 693 break; 694 case SI_QUEUE: 695 fprintf(fp, " value=%p", si->si_value.sival_ptr); 696 /* FALLTHROUGH */ 697 case SI_USER: 698 case SI_LWP: 699 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 700 (intmax_t)si->si_uid); 701 break; 702 case SI_TIMER: 703 fprintf(fp, " value=%p", si->si_value.sival_ptr); 704 fprintf(fp, " timerid=%d", si->si_timerid); 705 fprintf(fp, " overrun=%d", si->si_overrun); 706 if (si->si_errno != 0) 707 fprintf(fp, " errno=%d", si->si_errno); 708 break; 709 case SI_ASYNCIO: 710 fprintf(fp, " value=%p", si->si_value.sival_ptr); 711 break; 712 case SI_MESGQ: 713 fprintf(fp, " value=%p", si->si_value.sival_ptr); 714 fprintf(fp, " mqd=%d", si->si_mqd); 715 break; 716 default: 717 switch (si->si_signo) { 718 case SIGILL: 719 case SIGFPE: 720 case SIGSEGV: 721 case SIGBUS: 722 fprintf(fp, " trapno=%d", si->si_trapno); 723 fprintf(fp, " addr=%p", si->si_addr); 724 break; 725 case SIGCHLD: 726 fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid, 727 (intmax_t)si->si_uid); 728 fprintf(fp, " status=%d", si->si_status); 729 break; 730 } 731 } 732 } 733 734 static void 735 report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl) 736 { 737 struct threadinfo *t; 738 const char *signame; 739 740 t = info->curthread; 741 clock_gettime(CLOCK_REALTIME, &t->after); 742 print_line_prefix(info); 743 signame = sysdecode_signal(si->si_status); 744 if (signame == NULL) 745 signame = "?"; 746 fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame); 747 if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI) 748 decode_siginfo(info->outfile, &pl->pl_siginfo); 749 fprintf(info->outfile, "\n"); 750 751 } 752 753 /* 754 * Wait for events until all the processes have exited or truss has been 755 * asked to stop. 756 */ 757 void 758 eventloop(struct trussinfo *info) 759 { 760 struct ptrace_lwpinfo pl; 761 siginfo_t si; 762 int pending_signal; 763 764 while (!LIST_EMPTY(&info->proclist)) { 765 if (detaching) { 766 detach_all_procs(info); 767 return; 768 } 769 770 if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) { 771 if (errno == EINTR) 772 continue; 773 err(1, "Unexpected error from waitid"); 774 } 775 776 assert(si.si_signo == SIGCHLD); 777 778 switch (si.si_code) { 779 case CLD_EXITED: 780 case CLD_KILLED: 781 case CLD_DUMPED: 782 find_exit_thread(info, si.si_pid); 783 if ((info->flags & COUNTONLY) == 0) { 784 if (si.si_code == CLD_EXITED) 785 thread_exit_syscall(info); 786 report_exit(info, &si); 787 } 788 free_proc(info->curthread->proc); 789 info->curthread = NULL; 790 break; 791 case CLD_TRAPPED: 792 if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl, 793 sizeof(pl)) == -1) 794 err(1, "ptrace(PT_LWPINFO)"); 795 796 if (pl.pl_flags & PL_FLAG_CHILD) { 797 new_proc(info, si.si_pid, pl.pl_lwpid); 798 assert(LIST_FIRST(&info->proclist)->abi != 799 NULL); 800 } else if (pl.pl_flags & PL_FLAG_BORN) 801 new_thread(find_proc(info, si.si_pid), 802 pl.pl_lwpid); 803 find_thread(info, si.si_pid, pl.pl_lwpid); 804 805 if (si.si_status == SIGTRAP && 806 (pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED| 807 PL_FLAG_SCE|PL_FLAG_SCX)) != 0) { 808 if (pl.pl_flags & PL_FLAG_BORN) { 809 if ((info->flags & COUNTONLY) == 0) 810 report_thread_birth(info); 811 } else if (pl.pl_flags & PL_FLAG_EXITED) { 812 if ((info->flags & COUNTONLY) == 0) 813 report_thread_death(info); 814 free_thread(info->curthread); 815 info->curthread = NULL; 816 } else if (pl.pl_flags & PL_FLAG_SCE) 817 enter_syscall(info, info->curthread, &pl); 818 else if (pl.pl_flags & PL_FLAG_SCX) 819 exit_syscall(info, &pl); 820 pending_signal = 0; 821 } else if (pl.pl_flags & PL_FLAG_CHILD) { 822 if ((info->flags & COUNTONLY) == 0) 823 report_new_child(info); 824 pending_signal = 0; 825 } else { 826 if ((info->flags & NOSIGS) == 0) 827 report_signal(info, &si, &pl); 828 pending_signal = si.si_status; 829 } 830 ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1, 831 pending_signal); 832 break; 833 case CLD_STOPPED: 834 errx(1, "waitid reported CLD_STOPPED"); 835 case CLD_CONTINUED: 836 break; 837 } 838 } 839 } 840