Commit Graph

26 Commits

Author SHA1 Message Date
Alex Richardson
7daca4e204 truss: improved support for decoding compat32 arguments
Currently running `truss -a -e` does not decode any
argument values for freebsd32_* syscalls (open/readlink/etc.)

This change checks whether a syscall starts with freebsd{32,64}_ and if
so strips that prefix when looking up the syscall information. To ensure
that the truss logs include the real syscall name we create a copy of
the syscall information struct with the updated.

The other problem is that when reading string array values, truss
naively iterates over an array of char* and fetches the pointer value.
This will result in arguments not being loaded if the pointer is not
aligned to sizeof(void*), which can happens in the compat32 case. If it
happens to be aligned, we would end up printing every other value.
To fix this problem, this changes adds a pointer_size member to the
procabi struct and uses that to correctly read indirect arguments
as 64/32 bit addresses in the the compat32 case (and also compat64 on
CheriBSD).

The motivating use-case for this change is using truss for 64-bit
programs on a CHERI system, but most of the diff also applies to 32-bit
compat on a 64-bit system, so I'm upstreaming this instead of keeping it
as a local CheriBSD patch.

Output of `truss -aef ldd32 /usr/bin/ldd32` before:
39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000)
39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0)
/usr/bin/ldd32:
39113: write(1,"/usr/bin/ldd32:\n",16)		 = 16 (0x10)
39113: fork()					 = 39114 (0x98ca)
39114: <new process>
39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN
39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000)
39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0)
39114: issetugid()				 = 0 (0x0)
39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory'
39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3)
39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80)
39114: freebsd32_fstat(0x3,0xffffbd98)		 = 0 (0x0)
39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23)
39114: close(3)					 = 0 (0x0)
39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3)
39114: freebsd32_fstat(0x3,0xffffc7d0)		 = 0 (0x0)
39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000)

After:
  783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000)
  783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0)    = 0 (0x0)
/usr/bin/ldd32:
  783: write(1,"/usr/bin/ldd32:\n",16)           = 16 (0x10)
  784: <new process>
  783: fork()                                    = 784 (0x310)
  784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN
  784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000)
  784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0)
  784: issetugid()                               = 0 (0x0)
  784: sigfastblock(0x1,0x204234fc)              = 0 (0x0)
  784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory'
  784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3)
  784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80)
  784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0)
  784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb)

Reviewed By:	jhb
Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:14:13 +00:00
John Baldwin
caa449b635 Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss.
This removes all of the architecture-specific functions from truss.

A per-ABI structure is still needed to map syscall numbers to names
and FreeBSD errno values to ABI error values as well as hold syscall
counters.  However, the linker set of ABI structures is now replaced
with a simple table mapping ABI names to structures.  This approach
permits sharing the same ABI structure among separate names such as
i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64.

A few differences are visible due to using PT_GET_SC_RET to fetch the
error value of a system call.  Note that ktrace/kdump have had the
"new" behaviors for a long time already:
- System calls that return with EJUSTRETURN or ERESTART will now be
  noticed and logged as such.  Previously sigreturn (which uses
  EJUSTRETURN) would report whatever random value was in the register
  holding errno from the previous system call for example.  Now it
  reports EJUSTRETURN.
- System calls that return errno as their error value such as
  posix_fallocate() and posix_fadvise() now report non-zero return
  values as errors instead of success with a non-zero return value.

Reviewed by:	kib
MFC after:	1 month
Sponsored by:	DARPA
Differential Revision:	https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
Alan Somers
6040822c4e Make timespecadd(3) and friends public
The timespecadd(3) family of macros were imported from NetBSD back in
r35029. However, they were initially guarded by #ifdef _KERNEL. In the
meantime, we have grown at least 28 syscalls that use timespecs in some
way, leading many programs both inside and outside of the base system to
redefine those macros. It's better just to make the definitions public.

Our kernel currently defines two-argument versions of timespecadd and
timespecsub.  NetBSD, OpenBSD, and FreeDesktop.org's libbsd, however, define
three-argument versions.  Solaris also defines a three-argument version, but
only in its kernel.  This revision changes our definition to match the
common three-argument version.

Bump _FreeBSD_version due to the breaking KPI change.

Discussed with:	cem, jilles, ian, bde
Differential Revision:	https://reviews.freebsd.org/D14725
2018-07-30 15:46:40 +00:00
Pedro F. Giffuni
1de7b4b805 various: general adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 2-Clause license, however the tool I
was using misidentified many licenses so this was mostly a manual - error
prone - task.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

No functional change intended.
2017-11-27 15:37:16 +00:00
John Baldwin
1175b23f77 Rework syscall structure lookups.
Avoid always using an O(n^2) loop over known syscall structures with
strcmp() on each system call.  Instead, use a per-ABI cache indexed by
the system call number. The first 1024 system calls (which should cover
all of the normal system calls in currently-supported ABIs) use a flat array
indexed by the system call number to find system call structure.  For other
system calls, a linked list of structures storing an integer to structure
mapping is stored in the ABI.  The linked list isn't very smart, but it
should only be used by buggy applications invoking unknown system calls.

This also fixes handling of unknown system calls which currently trigger
a NULL pointer dereference.

Reviewed by:	kib
MFC after:	2 weeks
2016-12-06 00:39:00 +00:00
John Baldwin
b9befd33b4 Use ptrace(2) LWP events to track threads reliably in truss.
- truss can now log the system call invoked by a thread during a
  voluntary process exit.  No return value is logged, but the value passed
  to exit() is included in the trace output.  Arguments passed to thread
  exit system calls such as thr_exit() are not logged as voluntary thread
  exits cannot be distinguished from involuntary thread exits during a
  system call.
- New events are now reported for thread births and exits similar to the
  recently added events for new child processes when following forks.

Reviewed by:	kib
Differential Revision:	https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
John Baldwin
d70876fd7e Add support for displaying thread IDs to truss(1).
- Consolidate duplicate code for printing the metadata at the start of
  each line into a shared function.
- Add an -H option which will log the thread ID of the relevant thread
  for each event.

While here, remove some extraneous calls to clock_gettime() in
print_syscall() and print_syscall_ret().  The caller of print_syscall_ret()
always updates the current thread's "after" time before it is called.

Reviewed by:	kib
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
John Baldwin
a5f14abfd2 Add support to libsysdecode for decoding system call names.
A new sysdecode_syscallname() function accepts a system call code and
returns a string of the corresponding name (or NULL if the code is
unknown).  To support different process ABIs, the new function accepts a
value from a new sysdecode_abi enum as its first argument to select the
ABI in use.  Current ABIs supported include FREEBSD (native binaries),
FREEBSD32, LINUX, LINUX32, and CLOUDABI64.  Note that not all ABIs are
supported by all platforms.  In general, a given ABI is only supported
if a platform can execute binaries for that ABI.

To simplify the implementation, libsysdecode's build reuses the
existing pre-generated files from the kernel source tree rather than
duplicating new copies of said files during the build.

kdump(1) and truss(1) now use these functions to map system call
identifiers to names.  For kdump(1), a new 'syscallname()' function
consolidates duplicated code from ktrsyscall() and ktrsyscallret().
The Linux ABI no longer requires custom handling for ktrsyscall() and
linux_ktrsyscall() has been removed as a result.

Reviewed by:	bdrewery
Differential Revision:	https://reviews.freebsd.org/D4823
2016-01-26 19:07:09 +00:00
Bryan Drewery
04a97800bf Correct a comment. 2015-10-08 00:31:11 +00:00
John Baldwin
2b75c8ad3d Several changes to truss.
- Refactor the interface between the ABI-independent code and the
  ABI-specific backends.  The backends now provide smaller hooks to
  fetch system call arguments and return values.  The rest of the
  system call entry and exit handling that was previously duplicated
  among all the backends has been moved to one place.
- Merge the loop when waiting for an event with the loop for handling stops.
  This also means not emulating a procfs-like interface on top of ptrace().
  Instead, use a single event loop that fetches process events via waitid().
  Among other things this allows us to report the full 32-bit exit value.
- Use PT_FOLLOW_FORK to follow new child processes instead of forking a new
  truss process for each new child.  This allows one truss process to monitor
  a tree of processes and truss -c should now display one total for the
  entire tree instead of separate summaries per process.
- Use the recently added fields to ptrace_lwpinfo to determine the current
  system call number and argument count.  The latter is especially useful
  and fixes a regression since the conversion from procfs.  truss now
  generally prints the correct number of arguments for most system calls
  rather than printing extra arguments for any call not listed in the
  table in syscalls.c.
- Actually check the new ABI when processes call exec.  The comments claimed
  that this happened but it was not being done (perhaps this was another
  regression in the conversion to ptrace()).  If the new ABI after exec
  is not supported, truss detaches from the process.  If truss does not
  support the ABI for a newly executed process the process is killed
  before it returns from exec.
- Along with the refactor, teach the various ABI-specific backends to
  fetch both return values, not just the first.  Use this to properly
  report the full 64-bit return value from lseek().  In addition, the
  handler for "pipe" now pulls the pair of descriptors out of the
  return values (which is the true kernel system call interface) but
  displays them as an argument (which matches the interface exported by
  libc).
- Each ABI handler adds entries to a linker set rather than requiring
  a statically defined table of handlers in main.c.
- The arm and mips system call fetching code was changed to follow the
  same pattern as amd64 (and the in-kernel handler) of fetching register
  arguments first and then reading any remaining arguments from the
  stack.  This should fix indirect system call arguments on at least
  arm.
- The mipsn32 and n64 ABIs will now look for arguments in A4 through A7.
- Use register %ebp for the 6th system call argument for Linux/i386 ABIs
  to match the in-kernel argument fetch code.
- For powerpc binaries on a powerpc64 system, fetch the extra arguments
  on the stack as 32-bit values that are then copied into the 64-bit
  argument array instead of reading the 32-bit values directly into the
  64-bit array.

Reviewed by:	kib (earlier version)
Tested on:	amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version)
Tested on:	powerpc64 (FreeBSD/powerpc64 & powerpc)
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Xin LI
d9dcc46365 Revert r247300 for now. I'll post a new changeset for review. 2013-02-26 19:46:59 +00:00
Xin LI
285a4c7c59 Expose timespec and timeval macros when __BSD_VISIBLE is defined. This
allows userland application to use the following macros:

	timespecclear, timespecisset, timespeccmp, timespecadd,
	timespecsub;

	timevalclear, timevalisset, timevalcmp.

MFC after:	1 month
2013-02-26 02:13:02 +00:00
Andrey Zonov
5695afded4 - Make truss thread-aware.
Approved by:	kib (mentor)
MFC after:	2 weeks
2012-09-16 14:38:01 +00:00
Andrey Zonov
896fc4638a - Fix detaching under some circumstances.
When truss is detaching from very active process it is possible to
  hang on waitpid(2) in restore_proc() forever, because
  ptrace(PT_SYSCALL) must be called before detaching, to allow the
  debugging process to continue execution.  Also when truss called with
  '-c' argument, it does not print anything after detach, because it
  immediately exits from restore_proc().

  To fix these two problems make detaching deferred, but then it is
  impossible to detach from a process which does not do any system call.
  To fix this issue use sigaction(2) instead of signal(3) to disable
  SA_RESTART flag for waitpid(2) that makes it non-restartable.  Remove
  global variable child_pid, because now detaching is handled in context
  where child's pid is known.

Reported by:	mjg
Tested by:	mjg, swills
Approved by:	kib (mentor)
MFC after:	2 weeks
2012-09-12 13:06:57 +00:00
Andrey Zonov
94355cfdfd - Style(9) cleanup.
Approved by:	kib (mentor)
2012-09-02 11:03:18 +00:00
Andrey Zonov
be305c9c9f - Use pid_t type instead of just int.
Approved by:	kib (mentor)
2012-08-21 14:58:51 +00:00
Warner Losh
0a6c71f8fa Fix copyright spelling.
PR:		139825
Submitted by:	Ruslan Mahmatkhanov
2010-03-10 20:31:30 +00:00
Diomidis Spinellis
ee3b0f6e2e Add -c option to summarize number of calls, errors, and system time.
Reviewed by:	alfred
2009-05-12 20:42:12 +00:00
Xin LI
5d2d083c92 Make use of ptrace(2) instead of procfs in truss(1), eliminating
yet another need of an available /proc/ mount.

Tested with:	make universe
Submitted by:	howardsu
Reviewed by:	alfred
2007-04-10 04:03:34 +00:00
Pav Lucistnik
081e5c4890 - Add decoding of kse_release, kevent, sigprocmask, unmount, socket, getrusage,
rename, __getcwd, shutdown, getrlimit, setrlimit, _umtx_lock, _umtx_unlock,
  pathconf, truncate, ftruncate, kill

- Decode more arguments of open, mprot, *stat, and fcntl.

- Convert all constant-macro and bitfield decoding to lookup tables; much
  cleaner than previous code.

- Print the timestamp of process exit and signal reception when -d or -D are in
  use

- Try six times with 1/2 second delay to debug the child

PR:		bin/52190 (updated)
Submitted by:	Dan Nelson <dnelson@allantgroup.com>
Approved by:	alfred
2006-05-15 21:18:28 +00:00
Brian Somers
0cf21b4f58 Add a -s flag for the same functionality as strace. Introduce a Name
type which is a String type that has no -s limitations applied to it.
Change most Strings in the code to Names and add a few extra syscalls,
namely munmap, read, rename and symlink.  This was enough to facilitate
following file descriptor allocations in the code more easily and
getting a hint at what's being read/written from/to files.  More
syscalls should really be added.

While here, fix an off-by-one bug in the buffer truncation code and
add a fflush so that truss's output reflects the syscall that the
program is stuck in.

Sponsored by:	Sophos/Activestate
MFC after:	2 weeks
2006-01-02 08:36:25 +00:00
Matthew N. Dodd
203098d816 Use timespec not timeval. 2002-08-05 12:22:55 +00:00
Matthew N. Dodd
9897b20356 Add options to print the argument and environment string parameters to
execve().

This could be done in a more general manner but it still wouldn't
be very pretty.

MFC after:	 3 weeks
2002-08-04 02:24:21 +00:00
Matthew N. Dodd
0d0bd00edd Add options to print absolute and relative timestamps.
PR:		 bin/25587 (in part)
MFC after:	 3 weeks
2002-08-04 01:27:31 +00:00
Matthew N. Dodd
c03bfcc871 Allow tracking fork()ed children.
PR:		 bin/25587 (in part)
MFC after:	3 weeks
2002-08-04 01:02:52 +00:00
Matthew N. Dodd
ec0bed25ba Parameterize globals.
PR:		bin/25587 (in part)
MFC after:	3 weeks
2002-08-04 00:46:48 +00:00