Commit Graph

43 Commits

Author SHA1 Message Date
John Baldwin
b9befd33b4 Use ptrace(2) LWP events to track threads reliably in truss.
- truss can now log the system call invoked by a thread during a
  voluntary process exit.  No return value is logged, but the value passed
  to exit() is included in the trace output.  Arguments passed to thread
  exit system calls such as thr_exit() are not logged as voluntary thread
  exits cannot be distinguished from involuntary thread exits during a
  system call.
- New events are now reported for thread births and exits similar to the
  recently added events for new child processes when following forks.

Reviewed by:	kib
Differential Revision:	https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
John Baldwin
d70876fd7e Add support for displaying thread IDs to truss(1).
- Consolidate duplicate code for printing the metadata at the start of
  each line into a shared function.
- Add an -H option which will log the thread ID of the relevant thread
  for each event.

While here, remove some extraneous calls to clock_gettime() in
print_syscall() and print_syscall_ret().  The caller of print_syscall_ret()
always updates the current thread's "after" time before it is called.

Reviewed by:	kib
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
John Baldwin
00ddbdf2ee Fetch the current thread and it's syscall state from the trussinfo object
instead of passing some of that state as arguments to print_syscall() and
print_syscallret().  This just makes the calls of these functions shorter
and easier to read.
2016-02-16 22:00:01 +00:00
John Baldwin
a5f14abfd2 Add support to libsysdecode for decoding system call names.
A new sysdecode_syscallname() function accepts a system call code and
returns a string of the corresponding name (or NULL if the code is
unknown).  To support different process ABIs, the new function accepts a
value from a new sysdecode_abi enum as its first argument to select the
ABI in use.  Current ABIs supported include FREEBSD (native binaries),
FREEBSD32, LINUX, LINUX32, and CLOUDABI64.  Note that not all ABIs are
supported by all platforms.  In general, a given ABI is only supported
if a platform can execute binaries for that ABI.

To simplify the implementation, libsysdecode's build reuses the
existing pre-generated files from the kernel source tree rather than
duplicating new copies of said files during the build.

kdump(1) and truss(1) now use these functions to map system call
identifiers to names.  For kdump(1), a new 'syscallname()' function
consolidates duplicated code from ktrsyscall() and ktrsyscallret().
The Linux ABI no longer requires custom handling for ktrsyscall() and
linux_ktrsyscall() has been removed as a result.

Reviewed by:	bdrewery
Differential Revision:	https://reviews.freebsd.org/D4823
2016-01-26 19:07:09 +00:00
Bryan Drewery
94746562ff Fix crash if a process sends itself a SIGTRAP. Just forward it as expected.
MFC after:	2 weeks [needs rewrite]
Relnotes:	yes
2015-10-05 21:39:07 +00:00
Bryan Drewery
6c61b0f324 Fix tracking of unknown syscalls for 'truss -c'.
This is done by changing get_syscall() to either lookup the known syscall
or add it into the list with the default handlers for printing.

This also simplifies some code to not have to check if the syscall variable
is set or NULL.

Reviewed by:	jhb
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
John Baldwin
2b75c8ad3d Several changes to truss.
- Refactor the interface between the ABI-independent code and the
  ABI-specific backends.  The backends now provide smaller hooks to
  fetch system call arguments and return values.  The rest of the
  system call entry and exit handling that was previously duplicated
  among all the backends has been moved to one place.
- Merge the loop when waiting for an event with the loop for handling stops.
  This also means not emulating a procfs-like interface on top of ptrace().
  Instead, use a single event loop that fetches process events via waitid().
  Among other things this allows us to report the full 32-bit exit value.
- Use PT_FOLLOW_FORK to follow new child processes instead of forking a new
  truss process for each new child.  This allows one truss process to monitor
  a tree of processes and truss -c should now display one total for the
  entire tree instead of separate summaries per process.
- Use the recently added fields to ptrace_lwpinfo to determine the current
  system call number and argument count.  The latter is especially useful
  and fixes a regression since the conversion from procfs.  truss now
  generally prints the correct number of arguments for most system calls
  rather than printing extra arguments for any call not listed in the
  table in syscalls.c.
- Actually check the new ABI when processes call exec.  The comments claimed
  that this happened but it was not being done (perhaps this was another
  regression in the conversion to ptrace()).  If the new ABI after exec
  is not supported, truss detaches from the process.  If truss does not
  support the ABI for a newly executed process the process is killed
  before it returns from exec.
- Along with the refactor, teach the various ABI-specific backends to
  fetch both return values, not just the first.  Use this to properly
  report the full 64-bit return value from lseek().  In addition, the
  handler for "pipe" now pulls the pair of descriptors out of the
  return values (which is the true kernel system call interface) but
  displays them as an argument (which matches the interface exported by
  libc).
- Each ABI handler adds entries to a linker set rather than requiring
  a statically defined table of handlers in main.c.
- The arm and mips system call fetching code was changed to follow the
  same pattern as amd64 (and the in-kernel handler) of fetching register
  arguments first and then reading any remaining arguments from the
  stack.  This should fix indirect system call arguments on at least
  arm.
- The mipsn32 and n64 ABIs will now look for arguments in A4 through A7.
- Use register %ebp for the 6th system call argument for Linux/i386 ABIs
  to match the in-kernel argument fetch code.
- For powerpc binaries on a powerpc64 system, fetch the extra arguments
  on the stack as 32-bit values that are then copied into the 64-bit
  argument array instead of reading the 32-bit values directly into the
  64-bit array.

Reviewed by:	kib (earlier version)
Tested on:	amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version)
Tested on:	powerpc64 (FreeBSD/powerpc64 & powerpc)
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Andrey Zonov
5695afded4 - Make truss thread-aware.
Approved by:	kib (mentor)
MFC after:	2 weeks
2012-09-16 14:38:01 +00:00
Andrey Zonov
896fc4638a - Fix detaching under some circumstances.
When truss is detaching from very active process it is possible to
  hang on waitpid(2) in restore_proc() forever, because
  ptrace(PT_SYSCALL) must be called before detaching, to allow the
  debugging process to continue execution.  Also when truss called with
  '-c' argument, it does not print anything after detach, because it
  immediately exits from restore_proc().

  To fix these two problems make detaching deferred, but then it is
  impossible to detach from a process which does not do any system call.
  To fix this issue use sigaction(2) instead of signal(3) to disable
  SA_RESTART flag for waitpid(2) that makes it non-restartable.  Remove
  global variable child_pid, because now detaching is handled in context
  where child's pid is known.

Reported by:	mjg
Tested by:	mjg, swills
Approved by:	kib (mentor)
MFC after:	2 weeks
2012-09-12 13:06:57 +00:00
Andrey Zonov
310da894b7 - Remove unused variables.
- Remove redundant return after err(3) call.

Approved by:	kib (mentor)
2012-09-11 16:30:26 +00:00
Andrey Zonov
94355cfdfd - Style(9) cleanup.
Approved by:	kib (mentor)
2012-09-02 11:03:18 +00:00
Andrey Zonov
be305c9c9f - Use pid_t type instead of just int.
Approved by:	kib (mentor)
2012-08-21 14:58:51 +00:00
Konstantin Belousov
97695ad4cd Use explicit information from the kernel to detect the traps due to
syscall entry and leave.

Based on submision by:	Dan Nelson <dnelson allantgroup com>
MFC after:	1 month
2011-12-04 18:43:09 +00:00
John Baldwin
ad01891403 Properly check for errors from waitpid().
Submitted by:	gcooper
MFC after:	1 week
2011-02-15 12:42:18 +00:00
Ed Schouten
a2995e0d9b Remove setpgid() call before executing child process.
Using a separate process group here is bad, since (for example) job
control in the TTY layer prevents interaction with the TTY, causing the
child process to hang.

Mentioned on:	current@
MFC after:	2 weeks
2010-10-20 09:35:20 +00:00
Warner Losh
0a6c71f8fa Fix copyright spelling.
PR:		139825
Submitted by:	Ruslan Mahmatkhanov
2010-03-10 20:31:30 +00:00
Xin LI
821df508e8 Revert most part of 200420 as requested, as more review and polish is
needed.
2009-12-13 03:14:06 +00:00
Xin LI
6f2d322192 Remove unneeded header includes from usr.bin/ except contributed code.
Tested with:	make universe
2009-12-11 23:35:38 +00:00
Xin LI
f0bcd5c3fa Correct a bug where pr_data should have been assigned. 2009-04-13 16:22:38 +00:00
Xin LI
ef29ac7f76 MFp4: Bugfixes for truss(1):
- Fix logic handling execve().  We will not be able to
   obtain information otherwise.
 - truss coredump [1].
 - truss does not work against itself [2].

PR:		bin/58970 [1], bin/45193 [2]
Submitted by:	Howard Su
Approved by:	re (kensmith)
2007-06-26 22:42:37 +00:00
Xin LI
5d2d083c92 Make use of ptrace(2) instead of procfs in truss(1), eliminating
yet another need of an available /proc/ mount.

Tested with:	make universe
Submitted by:	howardsu
Reviewed by:	alfred
2007-04-10 04:03:34 +00:00
Pav Lucistnik
081e5c4890 - Add decoding of kse_release, kevent, sigprocmask, unmount, socket, getrusage,
rename, __getcwd, shutdown, getrlimit, setrlimit, _umtx_lock, _umtx_unlock,
  pathconf, truncate, ftruncate, kill

- Decode more arguments of open, mprot, *stat, and fcntl.

- Convert all constant-macro and bitfield decoding to lookup tables; much
  cleaner than previous code.

- Print the timestamp of process exit and signal reception when -d or -D are in
  use

- Try six times with 1/2 second delay to debug the child

PR:		bin/52190 (updated)
Submitted by:	Dan Nelson <dnelson@allantgroup.com>
Approved by:	alfred
2006-05-15 21:18:28 +00:00
Alfred Perlstein
72aa911a29 When doing the initial open of the proc via procfs, complain if we are
unable to open the /proc/pid/mem file.  Otherwise doing a truss on
a nonexistant pid makes us return success even though no such process
exists.
2005-03-27 12:53:25 +00:00
Alfred Perlstein
5321ae8649 I've been working on this somewhat so I'm moving the
parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
David Malone
1bc99f1144 Move declarations of Procfd to a header file. 2004-01-07 14:29:45 +00:00
Philippe Charnier
b956c13cfe Add FBSDID. Do not \n terminate warnx() argument. fprint() -> warnx(). 2003-09-07 15:50:43 +00:00
Matthew N. Dodd
37169f9446 - Use time.h not sys/time.h.
- Fix printf format errors.

Submitted by:	 bde
2002-08-06 12:46:14 +00:00
Bruce Evans
c69d844294 Include <sys/time.h> for the declaration of struct timeval. Do not
depend on namespace pollution in <signal.h>.  (truss shouldn't be
using timevals anyway, since it was implemented long after timevals
were obsoleted by timespecs.)
2002-08-04 10:57:41 +00:00
Matthew N. Dodd
c03bfcc871 Allow tracking fork()ed children.
PR:		 bin/25587 (in part)
MFC after:	3 weeks
2002-08-04 01:02:52 +00:00
Matthew N. Dodd
ec0bed25ba Parameterize globals.
PR:		bin/25587 (in part)
MFC after:	3 weeks
2002-08-04 00:46:48 +00:00
Mark Murray
1be5d70444 Partial WARNS=1 fizes with NO_WERROR set to prevent world breakage.
Use __FBSDID().
2001-12-11 23:34:02 +00:00
Dag-Erling Smørgrav
6303ee4e2a Back out part of previous commit: remove #include <sys/proc.h>. 2001-10-22 15:32:12 +00:00
Dag-Erling Smørgrav
580e0a2b7a #include <sys/proc.h> where needed (for the stop event definitions) and
reorder includes everywhere to conform to style(9).
2001-10-22 02:02:00 +00:00
Sean Eric Fagan
893618352c Handle the case where we truss an SUGID program -- in particular, we need
to wake up any processes waiting via PIOCWAIT on process exit, and truss
needs to be more aware that a process may actually disappear while it's
waiting.

Reviewed by:	Paul Saab <ps@yahoo-inc.com>
2000-01-10 04:09:05 +00:00
Peter Wemm
c3aac50f28 $Id$ -> $FreeBSD$ 1999-08-28 01:08:13 +00:00
Dag-Erling Smørgrav
1fd98d7d88 Calls one or more of malloc(), warn(), err(), syslog(), execlp() or
execvp() in the child branch of a vfork(). Changed to use fork()
instead.

Some of these (mv, find, apply, xargs) might benefit greatly from
being rewritten to use vfork() properly.

PR:		Loosely related to bin/8252
Approved by:	jkh and bde
1998-10-13 14:52:33 +00:00
Philippe Charnier
3cf51049e0 Sort Xrefs. Use err(3). Remove uneeded #include.
Correct usage: one of {-p pid, command} is required.
Open output file when command line is fully analyzed: incorrect `truss -o f'
command does not create an empty file anymore.
1998-01-05 07:30:26 +00:00
Sean Eric Fagan
09d64da3a4 Add some copyright and license terms, at Jordan's request. Note that
syscall.h just refers to another file for the copyright notice.
1997-12-20 18:40:43 +00:00
Sean Eric Fagan
d7b7dcba41 Change the ioctls for procfs around a bit; in particular, whever possible,
change from

	ioctl(fd, PIOC<foo>, &i);

to

	ioctl(fd, PIOC<foo>, i);

This is going from the _IOW to _IO ioctl macro.  The kernel, procctl, and
truss must be in synch for it all to work (not doing so will get errors about
inappropriate ioctl's, fortunately).  Hopefully I didn't forget anything :).
1997-12-13 03:13:49 +00:00
Sean Eric Fagan
20fa828fac Use the new PF_LINGER flag -- when this is set in a process' proc structure,
said process will not have its event mask cleared (and be restarted) on
the last close of a procfs/mem file for that pid.  This reduces the chance
that a truss-monitored process will be left hanging with these bits set
and nobody looking for it.

This is the least-tested change of all of these, I'm afraid.
1997-12-07 04:08:48 +00:00
Peter Wemm
e09a8fd173 err(3) already includes strerror(errno) and a trailing \n 1997-12-06 14:42:58 +00:00
Sean Eric Fagan
fe41f30547 Set the close-on-exec flag in the child; otherwise, it eats up a
file descriptor that it shouldn't.
1997-12-06 08:01:00 +00:00
Sean Eric Fagan
bbeaf6c0c9 Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00