Use ptrace(2) LWP events to track threads reliably in truss.

[jhb]

Summary

Use ptrace(2) LWP events to track threads reliably in truss.

• truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call.
• New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks.

I had originally included this with the truss -H changes, so you've seen
this before (modulo a few comment cleanups and dropping support for trying
to log thr_exit()).

Test Plan

• Run truss against a test program that creates several threads that exit normally.
• Run truss against a test program that creates a child thread and then calls exec to ensure the involuntary thread exit is logged.

[kib]

usr.bin/truss/setup.c

655

Style: Spaces around '|'.

660

Is this and other 'else' linkage of 'if's desirable ? I may imagine some syscalls creating sleeping threads, appearing executing syscalls. E.g. you might report aio thread attachment this way.

My only intent is to note this possibility, I do not think that this must be changed to series of independent ifs.

usr.bin/truss/syscalls.c

2058

Why is this needed ? To handle pthread_exit(2) ?

[jhb]

usr.bin/truss/setup.c

660

Well, thread creation is reported in tandem with system call exit now (since it is "returning" from thr_new() or the like). However, we can't really report that as a system call exit. In this case the system call exit would be ignored since there would not be the saved state from system call entry. This would be true in general (e.g. even if AIO created threads, the syscall that triggered the creation would be reported by the original thread, but the new thread would just "appear"). PL_FLAG_EXITED is similarly somewhat interesting. I think PL_FLAG_SCE can be set as well (and in fact it might always be set since we leave TDB_SCE set for the duration of system call execution), but we don't really want to try to parse it as a syscall entry (in fact, we might already have pending system call entry since we have a "real" SCE stop before the system call begins that should be pending in the threadinfo structure when a thread exit is reported).

usr.bin/truss/syscalls.c

2058

Actually exit(). If I could reliably detect a thread exit from thr_exit() it would use it as well. This is used by the newly added thread_exit_syscall().