d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f4cf3aa68b
freebsd-skq/usr.bin/truss/setup.c

840 lines
20 KiB
C
Raw Normal View History

Correct a bug where pr_data should have been assigned.
2009-04-13 16:22:38 +00:00
/*-
spdx: initial adoption of licensing ID tags. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. Special thanks to Wind River for providing access to "The Duke of Highlander" tool: an older (2014) run over FreeBSD tree was useful as a starting point. Initially, only tag files that use BSD 4-Clause "Original" license. RelNotes: yes Differential Revision: https://reviews.freebsd.org/D13133
2017-11-18 14:26:50 +00:00
* SPDX-License-Identifier: BSD-4-Clause
*
Fix copyright spelling. PR: 139825 Submitted by: Ruslan Mahmatkhanov
2010-03-10 20:31:30 +00:00
* Copyright 1997 Sean Eric Fagan
Add some copyright and license terms, at Jordan's request. Note that syscall.h just refers to another file for the copyright notice.
1997-12-20 18:40:43 +00:00
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by Sean Eric Fagan
* 4. Neither the name of the author may be used to endorse or promote
* products derived from this software without specific prior written
* permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
Add FBSDID. Do not \n terminate warnx() argument. fprint() -> warnx().
2003-09-07 15:50:43 +00:00
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore.
1998-01-05 07:30:26 +00:00
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
/*
* Various setup functions for truss. Not the cleanest-written code,
* I'm afraid.
*/
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
#include <sys/ptrace.h>
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#include <sys/sysctl.h>
Make timespecadd(3) and friends public The timespecadd(3) family of macros were imported from NetBSD back in r35029. However, they were initially guarded by #ifdef _KERNEL. In the meantime, we have grown at least 28 syscalls that use timespecs in some way, leading many programs both inside and outside of the base system to redefine those macros. It's better just to make the definitions public. Our kernel currently defines two-argument versions of timespecadd and timespecsub. NetBSD, OpenBSD, and FreeDesktop.org's libbsd, however, define three-argument versions. Solaris also defines a three-argument version, but only in its kernel. This revision changes our definition to match the common three-argument version. Bump _FreeBSD_version due to the breaking KPI change. Discussed with: cem, jilles, ian, bde Differential Revision: https://reviews.freebsd.org/D14725
2018-07-30 15:46:40 +00:00
#include <sys/time.h>
#include <sys/proc.h> where needed (for the stop event definitions) and reorder includes everywhere to conform to style(9).
2001-10-22 02:02:00 +00:00
#include <sys/wait.h>
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#include <assert.h>
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore.
1998-01-05 07:30:26 +00:00
#include <err.h>
Revert most part of 200420 as requested, as more review and polish is needed.
2009-12-13 03:14:06 +00:00
#include <errno.h>
Sort Xrefs. Use err(3). Remove uneeded #include. Correct usage: one of {-p pid, command} is required. Open output file when command line is fully analyzed: incorrect `truss -o f' command does not create an empty file anymore.
1998-01-05 07:30:26 +00:00
#include <signal.h>
Move mksubr from kdump into libsysdecode. Restructure this script so that it generates a header of tables instead of a source file. The tables are included in a flags.c source file which provides functions to decode various system call arguments. For functions that decode an enumeration, the function returns a pointer to a string for known values and NULL for unknown values. For functions that do more complex decoding (typically of a bitmask), the function accepts a pointer to a FILE object (open_memstream() can be used as a string builder) to which decoded values are written. If the function operates on a bitmask, the function returns true if any bits were decoded or false if the entire value was valid. Additionally, the third argument accepts a pointer to a value to which any undecoded bits are stored. This pointer can be NULL if the caller doesn't care about remaining bits. Convert kdump over to using decoder functions from libsysdecode instead of mksubr. truss also uses decoders from libsysdecode instead of private lookup tables, though lookup tables for objects not decoded by kdump remain in truss for now. Eventually most of these tables should move into libsysdecode as the automated table generation approach from mksubr is less stale than the static tables in truss. Some changes have been made to truss and kdump output: - The flags passed to open() are now properly decoded in that one of O_RDONLY, O_RDWR, O_WRONLY, or O_EXEC is always included in a decoded mask. - Optional arguments to open(), openat(), and fcntl() are only printed in kdump if they exist (e.g. the mode is only printed for open() if O_CREAT is set in the flags). - Print argument to F_GETLK/SETLK/SETLKW in kdump as a pointer, not int. - Include all procctl() commands. - Correctly decode pipe2() flags in truss by not assuming full open()-like flags with O_RDONLY, etc. - Decode file flags passed to *chflags() as file flags (UF_* and SF_*) rather than as a file mode. - Fix decoding of quotactl() commands by splitting out the two command components instead of assuming the raw command value matches the primary command component. In addition, truss and kdump now build without triggering any warnings. All of the sysdecode manpages now include the required headers in the synopsis. Reviewed by: kib (several older versions), wblock (manpages) MFC after: 2 months Differential Revision: https://reviews.freebsd.org/D7847
2016-10-17 22:37:07 +00:00
#include <stdbool.h>
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#include <stdint.h>
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
#include <stdio.h>
#include <stdlib.h>
Revert most part of 200420 as requested, as more review and polish is needed.
2009-12-13 03:14:06 +00:00
#include <string.h>
Add support to libsysdecode for decoding system call names. A new sysdecode_syscallname() function accepts a system call code and returns a string of the corresponding name (or NULL if the code is unknown). To support different process ABIs, the new function accepts a value from a new sysdecode_abi enum as its first argument to select the ABI in use. Current ABIs supported include FREEBSD (native binaries), FREEBSD32, LINUX, LINUX32, and CLOUDABI64. Note that not all ABIs are supported by all platforms. In general, a given ABI is only supported if a platform can execute binaries for that ABI. To simplify the implementation, libsysdecode's build reuses the existing pre-generated files from the kernel source tree rather than duplicating new copies of said files during the build. kdump(1) and truss(1) now use these functions to map system call identifiers to names. For kdump(1), a new 'syscallname()' function consolidates duplicated code from ktrsyscall() and ktrsyscallret(). The Linux ABI no longer requires custom handling for ktrsyscall() and linux_ktrsyscall() has been removed as a result. Reviewed by: bdrewery Differential Revision: https://reviews.freebsd.org/D4823
2016-01-26 19:07:09 +00:00
#include <sysdecode.h>
Revert most part of 200420 as requested, as more review and polish is needed.
2009-12-13 03:14:06 +00:00
#include <time.h>
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
#include <unistd.h>
Parameterize globals. PR: bin/25587 (in part) MFC after: 3 weeks
2002-08-04 00:46:48 +00:00
#include "truss.h"
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#include "syscall.h"
Partial WARNS=1 fizes with NO_WERROR set to prevent world breakage. Use __FBSDID().
2001-12-11 23:34:02 +00:00
#include "extern.h"
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
struct procabi_table {
const char *name;
struct procabi *abi;
};
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
static sig_atomic_t detaching;
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
static void enter_syscall(struct trussinfo *, struct threadinfo *,
struct ptrace_lwpinfo *);
static void new_proc(struct trussinfo *, pid_t, lwpid_t);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
static struct procabi cloudabi32 = {
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.type = "CloudABI32",
.abi = SYSDECODE_ABI_CLOUDABI32,
.pointer_size = sizeof(uint32_t),
.extra_syscalls = STAILQ_HEAD_INITIALIZER(cloudabi32.extra_syscalls),
.syscalls = { NULL }
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
};
static struct procabi cloudabi64 = {
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.type = "CloudABI64",
.abi = SYSDECODE_ABI_CLOUDABI64,
.pointer_size = sizeof(uint64_t),
.extra_syscalls = STAILQ_HEAD_INITIALIZER(cloudabi64.extra_syscalls),
.syscalls = { NULL }
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
};
static struct procabi freebsd = {
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.type = "FreeBSD",
.abi = SYSDECODE_ABI_FREEBSD,
.pointer_size = sizeof(void *),
.extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd.extra_syscalls),
.syscalls = { NULL }
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
};
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
#if !defined(__SIZEOF_POINTER__)
#error "Use a modern compiler."
#endif
#if __SIZEOF_POINTER__ > 4
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
static struct procabi freebsd32 = {
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.type = "FreeBSD32",
.abi = SYSDECODE_ABI_FREEBSD32,
.pointer_size = sizeof(uint32_t),
truss: Add missing underscore to compat_prefix for FreeBSD32 I accidentally dropped this in the final version of D27625, so it didn't actually work as intended. I found this while testing the MFC to stable/13. MFC after: immediately Fixes: 7daca4e2043f ("truss: improved support for decoding compat32 arguments")
2021-05-11 09:52:56 +00:00
.compat_prefix = "freebsd32_",
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.extra_syscalls = STAILQ_HEAD_INITIALIZER(freebsd32.extra_syscalls),
.syscalls = { NULL }
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
};
#endif
static struct procabi linux = {
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.type = "Linux",
.abi = SYSDECODE_ABI_LINUX,
.pointer_size = sizeof(void *),
.extra_syscalls = STAILQ_HEAD_INITIALIZER(linux.extra_syscalls),
.syscalls = { NULL }
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
};
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
#if __SIZEOF_POINTER__ > 4
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
static struct procabi linux32 = {
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
.type = "Linux32",
.abi = SYSDECODE_ABI_LINUX32,
.pointer_size = sizeof(uint32_t),
.extra_syscalls = STAILQ_HEAD_INITIALIZER(linux32.extra_syscalls),
.syscalls = { NULL }
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
};
#endif
static struct procabi_table abis[] = {
{ "CloudABI ELF32", &cloudabi32 },
{ "CloudABI ELF64", &cloudabi64 },
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
#if __SIZEOF_POINTER__ == 4
{ "FreeBSD ELF32", &freebsd },
#elif __SIZEOF_POINTER__ == 8
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
{ "FreeBSD ELF64", &freebsd },
{ "FreeBSD ELF32", &freebsd32 },
#else
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
#error "Unsupported pointer size"
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
#endif
#if defined(__powerpc64__)
{ "FreeBSD ELF64 V2", &freebsd },
#endif
#if defined(__amd64__)
{ "FreeBSD a.out", &freebsd32 },
#endif
#if defined(__i386__)
{ "FreeBSD a.out", &freebsd },
#endif
truss: improved support for decoding compat32 arguments Currently running `truss -a -e` does not decode any argument values for freebsd32_* syscalls (open/readlink/etc.) This change checks whether a syscall starts with freebsd{32,64}_ and if so strips that prefix when looking up the syscall information. To ensure that the truss logs include the real syscall name we create a copy of the syscall information struct with the updated. The other problem is that when reading string array values, truss naively iterates over an array of char* and fetches the pointer value. This will result in arguments not being loaded if the pointer is not aligned to sizeof(void*), which can happens in the compat32 case. If it happens to be aligned, we would end up printing every other value. To fix this problem, this changes adds a pointer_size member to the procabi struct and uses that to correctly read indirect arguments as 64/32 bit addresses in the the compat32 case (and also compat64 on CheriBSD). The motivating use-case for this change is using truss for 64-bit programs on a CHERI system, but most of the diff also applies to 32-bit compat on a 64-bit system, so I'm upstreaming this instead of keeping it as a local CheriBSD patch. Output of `truss -aef ldd32 /usr/bin/ldd32` before: 39113: freebsd32_mmap(0x0,0x1000,0x3,0x1002,0xffffffff,0x0,0x0) = 543440896 (0x20644000) 39113: freebsd32_ioctl(0x1,0x402c7413,0xffffd2a0) = 0 (0x0) /usr/bin/ldd32: 39113: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 39113: fork() = 39114 (0x98ca) 39114: <new process> 39114: freebsd32_execve(0xffffd97e,0xffffd680,0x20634000) EJUSTRETURN 39114: freebsd32_mmap(0x0,0x20000,0x3,0x1002,0xffffffff,0x0,0x0) = 541237248 (0x2042a000) 39114: freebsd32_mprotect(0x20427000,0x1000,0x1) = 0 (0x0) 39114: issetugid() = 0 (0x0) 39114: openat(AT_FDCWD,"/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 39114: openat(AT_FDCWD,"/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 39114: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0#\0\0\0\0"...,128) = 128 (0x80) 39114: freebsd32_fstat(0x3,0xffffbd98) = 0 (0x0) 39114: freebsd32_pread(0x3,0x2042f000,0x23,0x80,0x0) = 35 (0x23) 39114: close(3) = 0 (0x0) 39114: openat(AT_FDCWD,"/usr/lib32/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,00) = 3 (0x3) 39114: freebsd32_fstat(0x3,0xffffc7d0) = 0 (0x0) 39114: freebsd32_mmap(0x0,0x1000,0x1,0x40002,0x3,0x0,0x0) = 541368320 (0x2044a000) After: 783: freebsd32_mmap(0x0,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 543543296 (0x2065d000) 783: freebsd32_ioctl(1,TIOCGETA,0xffffd7b0) = 0 (0x0) /usr/bin/ldd32: 783: write(1,"/usr/bin/ldd32:\n",16) = 16 (0x10) 784: <new process> 783: fork() = 784 (0x310) 784: freebsd32_execve("/usr/bin/ldd32",[ "(null)" ],[ "LD_32_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_TRACE_LOADED_OBJECTS_PROGNAME=/usr/bin/ldd32", "LD_32_TRACE_LOADED_OBJECTS=yes", "LD_TRACE_LOADED_OBJECTS=yes", "USER=root", "LOGNAME=root", "HOME=/root", "SHELL=/bin/csh", "BLOCKSIZE=K", "MAIL=/var/mail/root", "MM_CHARSET=UTF-8", "LANG=C.UTF-8", "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/bin", "TERM=vt100", "HOSTTYPE=FreeBSD", "VENDOR=amd", "OSTYPE=FreeBSD", "MACHTYPE=x86_64", "SHLVL=1", "PWD=/root", "GROUP=wheel", "HOST=freebsd-amd64", "EDITOR=vi", "PAGER=less" ]) EJUSTRETURN 784: freebsd32_mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 541212672 (0x20424000) 784: freebsd32_mprotect(0x20421000,4096,PROT_READ) = 0 (0x0) 784: issetugid() = 0 (0x0) 784: sigfastblock(0x1,0x204234fc) = 0 (0x0) 784: open("/etc/libmap32.conf",O_RDONLY|O_CLOEXEC,00) ERR#2 'No such file or directory' 784: open("/var/run/ld-elf32.so.hints",O_RDONLY|O_CLOEXEC,00) = 3 (0x3) 784: read(3,"Ehnt\^A\0\0\0\M^@\0\0\0\v\0\0\0"...,128) = 128 (0x80) 784: freebsd32_fstat(3,{ mode=-r--r--r-- ,inode=18680,size=32768,blksize=0 }) = 0 (0x0) 784: freebsd32_pread(3,"/usr/lib32\0",11,0x80) = 11 (0xb) Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27625
2021-03-25 11:12:17 +00:00
#if __SIZEOF_POINTER__ >= 8
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
{ "Linux ELF64", &linux },
{ "Linux ELF32", &linux32 },
#else
Rename i386's Linux ELF to Linux ELF32 This is what amd64 calls the i386 Linux ABI in order to distinguish it from the amd64 Linux ABI, and matches the nomenclature used for the FreeBSD ABIs where they always have the size suffix in the name. Reviewed by: trasz Differential Revision: https://reviews.freebsd.org/D27647
2021-01-21 01:54:12 +00:00
{ "Linux ELF32", &linux },
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
#endif
};
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
/*
* setup_and_wait() is called to start a process. All it really does
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
* is fork(), enable tracing in the child, and then exec the given
* command. At that point, the child process stops, and the parent
* can wake up and deal with it.
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
*/
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
void
setup_and_wait(struct trussinfo *info, char *command[])
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
{
- Use pid_t type instead of just int. Approved by: kib (mentor)
2012-08-21 14:58:51 +00:00
pid_t pid;
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
pid = vfork();
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
if (pid == -1)
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
err(1, "fork failed");
if (pid == 0) { /* Child */
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
ptrace(PT_TRACE_ME, 0, 0, 0);
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
execvp(command[0], command);
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
err(1, "execvp %s", command[0]);
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
}
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
/* Only in the parent here */
- Remove unused variables. - Remove redundant return after err(3) call. Approved by: kib (mentor)
2012-09-11 16:30:26 +00:00
if (waitpid(pid, NULL, 0) < 0)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
err(1, "unexpect stop in waitpid");
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
new_proc(info, pid, 0);
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
}
/*
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
* start_tracing is called to attach to an existing process.
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
*/
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
void
start_tracing(struct trussinfo *info, pid_t pid)
I've been working on this somewhat so I'm moving the parts I'm touching to be as style(9) compliant as I can.
2005-03-27 12:47:04 +00:00
{
- Remove unused variables. - Remove redundant return after err(3) call. Approved by: kib (mentor)
2012-09-11 16:30:26 +00:00
int ret, retry;
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
retry = 10;
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
do {
ret = ptrace(PT_ATTACH, pid, NULL, 0);
usleep(200);
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
} while (ret && retry-- > 0);
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
if (ret)
err(1, "can not attach to target process");
- Remove unused variables. - Remove redundant return after err(3) call. Approved by: kib (mentor)
2012-09-11 16:30:26 +00:00
if (waitpid(pid, NULL, 0) < 0)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
err(1, "Unexpect stop in waitpid");
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
new_proc(info, pid, 0);
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
}
/*
* Restore a process back to it's pre-truss state.
* Called for SIGINT, SIGTERM, SIGQUIT. This only
* applies if truss was told to monitor an already-existing
* process.
*/
void
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
restore_proc(int signo __unused)
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
{
detaching = 1;
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
static void
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
detach_proc(pid_t pid)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
{
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
/* stop the child so that we can detach */
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
kill(pid, SIGSTOP);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
if (waitpid(pid, NULL, 0) < 0)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
err(1, "Unexpected stop in waitpid");
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
if (ptrace(PT_DETACH, pid, (caddr_t)1, 0) < 0)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
err(1, "Can not detach the process");
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
kill(pid, SIGCONT);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
/*
* Determine the ABI. This is called after every exec, and when
* a process is first monitored.
*/
static struct procabi *
find_abi(pid_t pid)
{
size_t len;
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
unsigned int i;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
int error;
int mib[4];
char progt[32];
len = sizeof(progt);
mib[0] = CTL_KERN;
mib[1] = KERN_PROC;
mib[2] = KERN_PROC_SV_NAME;
mib[3] = pid;
error = sysctl(mib, 4, progt, &len, NULL, 0);
if (error != 0)
err(2, "can not get sysvec name");
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
for (i = 0; i < nitems(abis); i++) {
if (strcmp(abis[i].name, progt) == 0)
return (abis[i].abi);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
warnx("ABI %s for pid %ld is not supported", progt, (long)pid);
return (NULL);
}
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
static struct threadinfo *
new_thread(struct procinfo *p, lwpid_t lwpid)
{
struct threadinfo *nt;
/*
* If this happens it means there is a bug in truss. Unfortunately
* this will kill any processes truss is attached to.
*/
LIST_FOREACH(nt, &p->threadlist, entries) {
if (nt->tid == lwpid)
errx(1, "Duplicate thread for LWP %ld", (long)lwpid);
}
nt = calloc(1, sizeof(struct threadinfo));
if (nt == NULL)
err(1, "calloc() failed");
nt->proc = p;
nt->tid = lwpid;
LIST_INSERT_HEAD(&p->threadlist, nt, entries);
return (nt);
}
static void
free_thread(struct threadinfo *t)
{
LIST_REMOVE(t, entries);
free(t);
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
static void
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
add_threads(struct trussinfo *info, struct procinfo *p)
{
struct ptrace_lwpinfo pl;
struct threadinfo *t;
lwpid_t *lwps;
int i, nlwps;
nlwps = ptrace(PT_GETNUMLWPS, p->pid, NULL, 0);
if (nlwps == -1)
err(1, "Unable to fetch number of LWPs");
assert(nlwps > 0);
lwps = calloc(nlwps, sizeof(*lwps));
nlwps = ptrace(PT_GETLWPLIST, p->pid, (caddr_t)lwps, nlwps);
if (nlwps == -1)
err(1, "Unable to fetch LWP list");
for (i = 0; i < nlwps; i++) {
t = new_thread(p, lwps[i]);
if (ptrace(PT_LWPINFO, lwps[i], (caddr_t)&pl, sizeof(pl)) == -1)
err(1, "ptrace(PT_LWPINFO)");
truss: fix uninitialized trussinfo->curthread in add_threads()/enter_syscall trussinfo->curthread must be initialized before calling enter_syscall(), it is used by t->proc->abi->fetch_args(). Without that truss is segfaulting and the attached program also crash. Submitted by: Nikita Kozlov (nikita@gandi.net) Reviewed by: jhb MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D7399
2016-08-02 22:47:06 +00:00
if (pl.pl_flags & PL_FLAG_SCE) {
info->curthread = t;
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
enter_syscall(info, t, &pl);
truss: fix uninitialized trussinfo->curthread in add_threads()/enter_syscall trussinfo->curthread must be initialized before calling enter_syscall(), it is used by t->proc->abi->fetch_args(). Without that truss is segfaulting and the attached program also crash. Submitted by: Nikita Kozlov (nikita@gandi.net) Reviewed by: jhb MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D7399
2016-08-02 22:47:06 +00:00
}
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
}
free(lwps);
}
static void
new_proc(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
{
struct procinfo *np;
/*
* If this happens it means there is a bug in truss. Unfortunately
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
* this will kill any processes truss is attached to.
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
*/
LIST_FOREACH(np, &info->proclist, entries) {
if (np->pid == pid)
errx(1, "Duplicate process for pid %ld", (long)pid);
}
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
if (info->flags & FOLLOWFORKS)
if (ptrace(PT_FOLLOW_FORK, pid, NULL, 1) == -1)
err(1, "Unable to follow forks for pid %ld", (long)pid);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
if (ptrace(PT_LWP_EVENTS, pid, NULL, 1) == -1)
err(1, "Unable to enable LWP events for pid %ld", (long)pid);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
np = calloc(1, sizeof(struct procinfo));
np->pid = pid;
np->abi = find_abi(pid);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
LIST_INIT(&np->threadlist);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
LIST_INSERT_HEAD(&info->proclist, np, entries);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
if (lwpid != 0)
new_thread(np, lwpid);
else
add_threads(info, np);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
static void
free_proc(struct procinfo *p)
{
struct threadinfo *t, *t2;
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
LIST_FOREACH_SAFE(t, &p->threadlist, entries, t2) {
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
free(t);
}
LIST_REMOVE(p, entries);
free(p);
}
static void
detach_all_procs(struct trussinfo *info)
{
struct procinfo *p, *p2;
LIST_FOREACH_SAFE(p, &info->proclist, entries, p2) {
detach_proc(p->pid);
free_proc(p);
}
}
static struct procinfo *
find_proc(struct trussinfo *info, pid_t pid)
{
struct procinfo *np;
LIST_FOREACH(np, &info->proclist, entries) {
if (np->pid == pid)
return (np);
}
return (NULL);
Truss program. Requires procfs.
1997-12-06 05:23:12 +00:00
}
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
/*
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
* Change curthread member based on (pid, lwpid).
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
*/
static void
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
find_thread(struct trussinfo *info, pid_t pid, lwpid_t lwpid)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
{
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
struct procinfo *np;
struct threadinfo *nt;
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
np = find_proc(info, pid);
assert(np != NULL);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
LIST_FOREACH(nt, &np->threadlist, entries) {
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
if (nt->tid == lwpid) {
info->curthread = nt;
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
return;
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
}
}
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
errx(1, "could not find thread");
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
}
/*
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
* When a process exits, it should have exactly one thread left.
* All of the other threads should have reported thread exit events.
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
*/
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
static void
find_exit_thread(struct trussinfo *info, pid_t pid)
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
{
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
struct procinfo *p;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
p = find_proc(info, pid);
assert(p != NULL);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
info->curthread = LIST_FIRST(&p->threadlist);
assert(info->curthread != NULL);
assert(LIST_NEXT(info->curthread, entries) == NULL);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
static void
alloc_syscall(struct threadinfo *t, struct ptrace_lwpinfo *pl)
{
u_int i;
assert(t->in_syscall == 0);
assert(t->cs.number == 0);
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
assert(t->cs.sc == NULL);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
assert(t->cs.nargs == 0);
for (i = 0; i < nitems(t->cs.s_args); i++)
assert(t->cs.s_args[i] == NULL);
memset(t->cs.args, 0, sizeof(t->cs.args));
t->cs.number = pl->pl_syscall_code;
t->in_syscall = 1;
}
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
static void
free_syscall(struct threadinfo *t)
{
u_int i;
for (i = 0; i < t->cs.nargs; i++)
free(t->cs.s_args[i]);
memset(&t->cs, 0, sizeof(t->cs));
t->in_syscall = 0;
}
static void
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
enter_syscall(struct trussinfo *info, struct threadinfo *t,
struct ptrace_lwpinfo *pl)
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
{
struct syscall *sc;
u_int i, narg;
alloc_syscall(t, pl);
narg = MIN(pl->pl_syscall_narg, nitems(t->cs.args));
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
if (narg != 0 && ptrace(PT_GET_SC_ARGS, t->tid, (caddr_t)t->cs.args,
sizeof(t->cs.args)) != 0) {
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
free_syscall(t);
- Fix detaching under some circumstances. When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
2012-09-12 13:06:57 +00:00
return;
}
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
sc = get_syscall(t, t->cs.number, narg);
if (sc->unknown)
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
fprintf(info->outfile, "-- UNKNOWN %s SYSCALL %d --\n",
t->proc->abi->type, t->cs.number);
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
t->cs.nargs = sc->decode.nargs;
assert(sc->decode.nargs <= nitems(t->cs.s_args));
- Style(9) cleanup. Approved by: kib (mentor)
2012-09-02 11:03:18 +00:00
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
t->cs.sc = sc;
/*
* At this point, we set up the system call arguments.
* We ignore any OUT ones, however -- those are arguments that
* are set by the system call, and so are probably meaningless
* now. This doesn't currently support arguments that are
* passed in *and* out, however.
*/
#if DEBUG
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
fprintf(stderr, "syscall %s(", sc->name);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#endif
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
for (i = 0; i < t->cs.nargs; i++) {
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#if DEBUG
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
fprintf(stderr, "0x%lx%s",
t->cs.args[sc->decode.args[i].offset],
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
i < (t->cs.nargs - 1) ? "," : "");
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#endif
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
if (!(sc->decode.args[i].type & OUT)) {
t->cs.s_args[i] = print_arg(&sc->decode.args[i],
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
t->cs.args, NULL, info);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#if DEBUG
Rework syscall structure lookups. Avoid always using an O(n^2) loop over known syscall structures with strcmp() on each system call. Instead, use a per-ABI cache indexed by the system call number. The first 1024 system calls (which should cover all of the normal system calls in currently-supported ABIs) use a flat array indexed by the system call number to find system call structure. For other system calls, a linked list of structures storing an integer to structure mapping is stored in the ABI. The linked list isn't very smart, but it should only be used by buggy applications invoking unknown system calls. This also fixes handling of unknown system calls which currently trigger a NULL pointer dereference. Reviewed by: kib MFC after: 2 weeks
2016-12-06 00:39:00 +00:00
fprintf(stderr, ")\n");
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
#endif
clock_gettime(CLOCK_REALTIME, &t->before);
}
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
/*
* When a thread exits voluntarily (including when a thread calls
* exit() to trigger a process exit), the thread's internal state
* holds the arguments passed to the exit system call. When the
* thread's exit is reported, log that system call without a return
* value.
*/
static void
thread_exit_syscall(struct trussinfo *info)
{
struct threadinfo *t;
t = info->curthread;
if (!t->in_syscall)
return;
clock_gettime(CLOCK_REALTIME, &t->after);
print_syscall_ret(info, 0, NULL);
free_syscall(t);
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
static void
exit_syscall(struct trussinfo *info, struct ptrace_lwpinfo *pl)
{
struct threadinfo *t;
struct procinfo *p;
struct syscall *sc;
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
struct ptrace_sc_ret psr;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
u_int i;
t = info->curthread;
if (!t->in_syscall)
return;
clock_gettime(CLOCK_REALTIME, &t->after);
p = t->proc;
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
if (ptrace(PT_GET_SC_RET, t->tid, (caddr_t)&psr, sizeof(psr)) != 0) {
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
free_syscall(t);
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
return;
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
sc = t->cs.sc;
Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. Reviewed by: jhb Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
/*
* Here, we only look for arguments that have OUT masked in --
* otherwise, they were handled in enter_syscall().
*/
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
for (i = 0; i < sc->decode.nargs; i++) {
Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. Reviewed by: jhb Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
char *temp;
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
if (sc->decode.args[i].type & OUT) {
Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. Reviewed by: jhb Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
/*
* If an error occurred, then don't bother
* getting the data; it may not be valid.
*/
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
if (psr.sr_error != 0) {
Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. Reviewed by: jhb Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
asprintf(&temp, "0x%lx",
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
t->cs.args[sc->decode.args[i].offset]);
Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. Reviewed by: jhb Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
} else {
truss: split counting of syscalls and syscall calling convention This change is a refactoring cleanup to improve support for compat32 syscalls (and compat64 on CHERI systems). Each process ABI now has it's own struct sycall instead of using one global list. The list of all syscalls is replaced with a list of seen syscalls. Looking up the syscall argument passing convention now interates over the fixed-size array instead of using a link-list that's populated on startup so we no longer need the init_syscall() function. The actual functional changes are in D27625. Reviewed By: jhb Differential Revision: https://reviews.freebsd.org/D27636
2021-03-04 18:28:25 +00:00
temp = print_arg(&sc->decode.args[i],
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
t->cs.args, psr.sr_retval, info);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. Reviewed by: jhb Relnotes: yes Differential Revision: https://reviews.freebsd.org/D3792
2015-10-05 18:08:35 +00:00
t->cs.s_args[i] = temp;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
}
Use PT_GET_SC_ARGS and PT_GET_SC_RET in truss. This removes all of the architecture-specific functions from truss. A per-ABI structure is still needed to map syscall numbers to names and FreeBSD errno values to ABI error values as well as hold syscall counters. However, the linker set of ABI structures is now replaced with a simple table mapping ABI names to structures. This approach permits sharing the same ABI structure among separate names such as i386 a.out and ELF binaries as well as ELF v1 vs ELF v2 for powerpc64. A few differences are visible due to using PT_GET_SC_RET to fetch the error value of a system call. Note that ktrace/kdump have had the "new" behaviors for a long time already: - System calls that return with EJUSTRETURN or ERESTART will now be noticed and logged as such. Previously sigreturn (which uses EJUSTRETURN) would report whatever random value was in the register holding errno from the previous system call for example. Now it reports EJUSTRETURN. - System calls that return errno as their error value such as posix_fallocate() and posix_fadvise() now report non-zero return values as errors instead of success with a non-zero return value. Reviewed by: kib MFC after: 1 month Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D20963
2019-07-16 22:59:15 +00:00
print_syscall_ret(info, psr.sr_error, psr.sr_retval);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
free_syscall(t);
/*
* If the process executed a new image, check the ABI. If the
* new ABI isn't supported, stop tracing this process.
*/
if (pl->pl_flags & PL_FLAG_EXEC) {
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
assert(LIST_NEXT(LIST_FIRST(&p->threadlist), entries) == NULL);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
p->abi = find_abi(p->pid);
if (p->abi == NULL) {
if (ptrace(PT_DETACH, p->pid, (caddr_t)1, 0) < 0)
err(1, "Can not detach the process");
free_proc(p);
}
}
}
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
int
print_line_prefix(struct trussinfo *info)
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
{
struct timespec timediff;
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
struct threadinfo *t;
int len;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
len = 0;
t = info->curthread;
if (info->flags & (FOLLOWFORKS | DISPLAYTIDS)) {
if (info->flags & FOLLOWFORKS)
len += fprintf(info->outfile, "%5d", t->proc->pid);
if ((info->flags & (FOLLOWFORKS | DISPLAYTIDS)) ==
(FOLLOWFORKS | DISPLAYTIDS))
len += fprintf(info->outfile, " ");
if (info->flags & DISPLAYTIDS)
len += fprintf(info->outfile, "%6d", t->tid);
len += fprintf(info->outfile, ": ");
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
if (info->flags & ABSOLUTETIMESTAMPS) {
Make timespecadd(3) and friends public The timespecadd(3) family of macros were imported from NetBSD back in r35029. However, they were initially guarded by #ifdef _KERNEL. In the meantime, we have grown at least 28 syscalls that use timespecs in some way, leading many programs both inside and outside of the base system to redefine those macros. It's better just to make the definitions public. Our kernel currently defines two-argument versions of timespecadd and timespecsub. NetBSD, OpenBSD, and FreeDesktop.org's libbsd, however, define three-argument versions. Solaris also defines a three-argument version, but only in its kernel. This revision changes our definition to match the common three-argument version. Bump _FreeBSD_version due to the breaking KPI change. Discussed with: cem, jilles, ian, bde Differential Revision: https://reviews.freebsd.org/D14725
2018-07-30 15:46:40 +00:00
timespecsub(&t->after, &info->start_time, &timediff);
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
len += fprintf(info->outfile, "%jd.%09ld ",
(intmax_t)timediff.tv_sec, timediff.tv_nsec);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
if (info->flags & RELATIVETIMESTAMPS) {
Make timespecadd(3) and friends public The timespecadd(3) family of macros were imported from NetBSD back in r35029. However, they were initially guarded by #ifdef _KERNEL. In the meantime, we have grown at least 28 syscalls that use timespecs in some way, leading many programs both inside and outside of the base system to redefine those macros. It's better just to make the definitions public. Our kernel currently defines two-argument versions of timespecadd and timespecsub. NetBSD, OpenBSD, and FreeDesktop.org's libbsd, however, define three-argument versions. Solaris also defines a three-argument version, but only in its kernel. This revision changes our definition to match the common three-argument version. Bump _FreeBSD_version due to the breaking KPI change. Discussed with: cem, jilles, ian, bde Differential Revision: https://reviews.freebsd.org/D14725
2018-07-30 15:46:40 +00:00
timespecsub(&t->after, &t->before, &timediff);
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
len += fprintf(info->outfile, "%jd.%09ld ",
(intmax_t)timediff.tv_sec, timediff.tv_nsec);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
return (len);
}
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
static void
report_thread_death(struct trussinfo *info)
{
struct threadinfo *t;
t = info->curthread;
clock_gettime(CLOCK_REALTIME, &t->after);
print_line_prefix(info);
fprintf(info->outfile, "<thread %ld exited>\n", (long)t->tid);
}
static void
report_thread_birth(struct trussinfo *info)
{
struct threadinfo *t;
t = info->curthread;
clock_gettime(CLOCK_REALTIME, &t->after);
t->before = t->after;
print_line_prefix(info);
fprintf(info->outfile, "<new thread %ld>\n", (long)t->tid);
}
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
static void
report_exit(struct trussinfo *info, siginfo_t *si)
{
struct threadinfo *t;
t = info->curthread;
clock_gettime(CLOCK_REALTIME, &t->after);
print_line_prefix(info);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
if (si->si_code == CLD_EXITED)
fprintf(info->outfile, "process exit, rval = %u\n",
si->si_status);
else
fprintf(info->outfile, "process killed, signal = %u%s\n",
si->si_status, si->si_code == CLD_DUMPED ?
" (core dumped)" : "");
}
static void
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
report_new_child(struct trussinfo *info)
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
{
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
struct threadinfo *t;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
t = info->curthread;
clock_gettime(CLOCK_REALTIME, &t->after);
t->before = t->after;
print_line_prefix(info);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
fprintf(info->outfile, "<new process>\n");
}
Decode signal information returned by system calls. Specifically, decode the siginfo structure returned by sigtimedwait(), sigwaitinfo(), and wait6(). While here, also decode the signal number returned in the second argument to sigwait().
2017-08-30 15:45:23 +00:00
void
Decode extra signal information for caught signals. Decode fields from the siginfo_t stored in the PT_LWPINFO structure when a signal is caught by a traced process. This includes the signal code (si_code) as well as additional members such as si_addr, si_pid, etc.
2017-08-28 02:42:20 +00:00
decode_siginfo(FILE *fp, siginfo_t *si)
{
const char *str;
fprintf(fp, " code=");
str = sysdecode_sigcode(si->si_signo, si->si_code);
if (str == NULL)
fprintf(fp, "%d", si->si_code);
else
fprintf(fp, "%s", str);
switch (si->si_code) {
case SI_NOINFO:
break;
case SI_QUEUE:
fprintf(fp, " value=%p", si->si_value.sival_ptr);
/* FALLTHROUGH */
case SI_USER:
case SI_LWP:
fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
(intmax_t)si->si_uid);
break;
case SI_TIMER:
fprintf(fp, " value=%p", si->si_value.sival_ptr);
fprintf(fp, " timerid=%d", si->si_timerid);
fprintf(fp, " overrun=%d", si->si_overrun);
if (si->si_errno != 0)
fprintf(fp, " errno=%d", si->si_errno);
break;
case SI_ASYNCIO:
fprintf(fp, " value=%p", si->si_value.sival_ptr);
break;
case SI_MESGQ:
fprintf(fp, " value=%p", si->si_value.sival_ptr);
fprintf(fp, " mqd=%d", si->si_mqd);
break;
default:
switch (si->si_signo) {
case SIGILL:
case SIGFPE:
case SIGSEGV:
case SIGBUS:
fprintf(fp, " trapno=%d", si->si_trapno);
fprintf(fp, " addr=%p", si->si_addr);
break;
case SIGCHLD:
fprintf(fp, " pid=%jd uid=%jd", (intmax_t)si->si_pid,
(intmax_t)si->si_uid);
fprintf(fp, " status=%d", si->si_status);
break;
}
}
}
static void
report_signal(struct trussinfo *info, siginfo_t *si, struct ptrace_lwpinfo *pl)
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
{
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
struct threadinfo *t;
Move mksubr from kdump into libsysdecode. Restructure this script so that it generates a header of tables instead of a source file. The tables are included in a flags.c source file which provides functions to decode various system call arguments. For functions that decode an enumeration, the function returns a pointer to a string for known values and NULL for unknown values. For functions that do more complex decoding (typically of a bitmask), the function accepts a pointer to a FILE object (open_memstream() can be used as a string builder) to which decoded values are written. If the function operates on a bitmask, the function returns true if any bits were decoded or false if the entire value was valid. Additionally, the third argument accepts a pointer to a value to which any undecoded bits are stored. This pointer can be NULL if the caller doesn't care about remaining bits. Convert kdump over to using decoder functions from libsysdecode instead of mksubr. truss also uses decoders from libsysdecode instead of private lookup tables, though lookup tables for objects not decoded by kdump remain in truss for now. Eventually most of these tables should move into libsysdecode as the automated table generation approach from mksubr is less stale than the static tables in truss. Some changes have been made to truss and kdump output: - The flags passed to open() are now properly decoded in that one of O_RDONLY, O_RDWR, O_WRONLY, or O_EXEC is always included in a decoded mask. - Optional arguments to open(), openat(), and fcntl() are only printed in kdump if they exist (e.g. the mode is only printed for open() if O_CREAT is set in the flags). - Print argument to F_GETLK/SETLK/SETLKW in kdump as a pointer, not int. - Include all procctl() commands. - Correctly decode pipe2() flags in truss by not assuming full open()-like flags with O_RDONLY, etc. - Decode file flags passed to *chflags() as file flags (UF_* and SF_*) rather than as a file mode. - Fix decoding of quotactl() commands by splitting out the two command components instead of assuming the raw command value matches the primary command component. In addition, truss and kdump now build without triggering any warnings. All of the sysdecode manpages now include the required headers in the synopsis. Reviewed by: kib (several older versions), wblock (manpages) MFC after: 2 months Differential Revision: https://reviews.freebsd.org/D7847
2016-10-17 22:37:07 +00:00
const char *signame;
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
t = info->curthread;
clock_gettime(CLOCK_REALTIME, &t->after);
print_line_prefix(info);
Move mksubr from kdump into libsysdecode. Restructure this script so that it generates a header of tables instead of a source file. The tables are included in a flags.c source file which provides functions to decode various system call arguments. For functions that decode an enumeration, the function returns a pointer to a string for known values and NULL for unknown values. For functions that do more complex decoding (typically of a bitmask), the function accepts a pointer to a FILE object (open_memstream() can be used as a string builder) to which decoded values are written. If the function operates on a bitmask, the function returns true if any bits were decoded or false if the entire value was valid. Additionally, the third argument accepts a pointer to a value to which any undecoded bits are stored. This pointer can be NULL if the caller doesn't care about remaining bits. Convert kdump over to using decoder functions from libsysdecode instead of mksubr. truss also uses decoders from libsysdecode instead of private lookup tables, though lookup tables for objects not decoded by kdump remain in truss for now. Eventually most of these tables should move into libsysdecode as the automated table generation approach from mksubr is less stale than the static tables in truss. Some changes have been made to truss and kdump output: - The flags passed to open() are now properly decoded in that one of O_RDONLY, O_RDWR, O_WRONLY, or O_EXEC is always included in a decoded mask. - Optional arguments to open(), openat(), and fcntl() are only printed in kdump if they exist (e.g. the mode is only printed for open() if O_CREAT is set in the flags). - Print argument to F_GETLK/SETLK/SETLKW in kdump as a pointer, not int. - Include all procctl() commands. - Correctly decode pipe2() flags in truss by not assuming full open()-like flags with O_RDONLY, etc. - Decode file flags passed to *chflags() as file flags (UF_* and SF_*) rather than as a file mode. - Fix decoding of quotactl() commands by splitting out the two command components instead of assuming the raw command value matches the primary command component. In addition, truss and kdump now build without triggering any warnings. All of the sysdecode manpages now include the required headers in the synopsis. Reviewed by: kib (several older versions), wblock (manpages) MFC after: 2 months Differential Revision: https://reviews.freebsd.org/D7847
2016-10-17 22:37:07 +00:00
signame = sysdecode_signal(si->si_status);
if (signame == NULL)
signame = "?";
Decode extra signal information for caught signals. Decode fields from the siginfo_t stored in the PT_LWPINFO structure when a signal is caught by a traced process. This includes the signal code (si_code) as well as additional members such as si_addr, si_pid, etc.
2017-08-28 02:42:20 +00:00
fprintf(info->outfile, "SIGNAL %u (%s)", si->si_status, signame);
if (pl->pl_event == PL_EVENT_SIGNAL && pl->pl_flags & PL_FLAG_SI)
decode_siginfo(info->outfile, &pl->pl_siginfo);
fprintf(info->outfile, "\n");
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
}
/*
* Wait for events until all the processes have exited or truss has been
* asked to stop.
*/
void
eventloop(struct trussinfo *info)
{
struct ptrace_lwpinfo pl;
siginfo_t si;
int pending_signal;
while (!LIST_EMPTY(&info->proclist)) {
if (detaching) {
detach_all_procs(info);
return;
}
if (waitid(P_ALL, 0, &si, WTRAPPED | WEXITED) == -1) {
if (errno == EINTR)
continue;
err(1, "Unexpected error from waitid");
}
assert(si.si_signo == SIGCHLD);
switch (si.si_code) {
case CLD_EXITED:
case CLD_KILLED:
case CLD_DUMPED:
find_exit_thread(info, si.si_pid);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
if ((info->flags & COUNTONLY) == 0) {
if (si.si_code == CLD_EXITED)
thread_exit_syscall(info);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
report_exit(info, &si);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
free_proc(info->curthread->proc);
info->curthread = NULL;
break;
case CLD_TRAPPED:
if (ptrace(PT_LWPINFO, si.si_pid, (caddr_t)&pl,
sizeof(pl)) == -1)
err(1, "ptrace(PT_LWPINFO)");
if (pl.pl_flags & PL_FLAG_CHILD) {
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
new_proc(info, si.si_pid, pl.pl_lwpid);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
assert(LIST_FIRST(&info->proclist)->abi !=
NULL);
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
} else if (pl.pl_flags & PL_FLAG_BORN)
new_thread(find_proc(info, si.si_pid),
pl.pl_lwpid);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
find_thread(info, si.si_pid, pl.pl_lwpid);
Fix crash if a process sends itself a SIGTRAP. Just forward it as expected. MFC after: 2 weeks [needs rewrite] Relnotes: yes
2015-10-05 21:39:07 +00:00
if (si.si_status == SIGTRAP &&
Use ptrace(2) LWP events to track threads reliably in truss. - truss can now log the system call invoked by a thread during a voluntary process exit. No return value is logged, but the value passed to exit() is included in the trace output. Arguments passed to thread exit system calls such as thr_exit() are not logged as voluntary thread exits cannot be distinguished from involuntary thread exits during a system call. - New events are now reported for thread births and exits similar to the recently added events for new child processes when following forks. Reviewed by: kib Differential Revision: https://reviews.freebsd.org/D5561
2016-03-09 18:45:41 +00:00
(pl.pl_flags & (PL_FLAG_BORN|PL_FLAG_EXITED|
PL_FLAG_SCE|PL_FLAG_SCX)) != 0) {
if (pl.pl_flags & PL_FLAG_BORN) {
if ((info->flags & COUNTONLY) == 0)
report_thread_birth(info);
} else if (pl.pl_flags & PL_FLAG_EXITED) {
if ((info->flags & COUNTONLY) == 0)
report_thread_death(info);
free_thread(info->curthread);
info->curthread = NULL;
} else if (pl.pl_flags & PL_FLAG_SCE)
enter_syscall(info, info->curthread, &pl);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
else if (pl.pl_flags & PL_FLAG_SCX)
exit_syscall(info, &pl);
pending_signal = 0;
} else if (pl.pl_flags & PL_FLAG_CHILD) {
if ((info->flags & COUNTONLY) == 0)
Add support for displaying thread IDs to truss(1). - Consolidate duplicate code for printing the metadata at the start of each line into a shared function. - Add an -H option which will log the thread ID of the relevant thread for each event. While here, remove some extraneous calls to clock_gettime() in print_syscall() and print_syscall_ret(). The caller of print_syscall_ret() always updates the current thread's "after" time before it is called. Reviewed by: kib MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D5363
2016-02-23 19:56:29 +00:00
report_new_child(info);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
pending_signal = 0;
} else {
if ((info->flags & NOSIGS) == 0)
Decode extra signal information for caught signals. Decode fields from the siginfo_t stored in the PT_LWPINFO structure when a signal is caught by a traced process. This includes the signal code (si_code) as well as additional members such as si_addr, si_pid, etc.
2017-08-28 02:42:20 +00:00
report_signal(info, &si, &pl);
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
pending_signal = si.si_status;
Use explicit information from the kernel to detect the traps due to syscall entry and leave. Based on submision by: Dan Nelson <dnelson allantgroup com> MFC after: 1 month
2011-12-04 18:43:09 +00:00
}
Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. Reviewed by: kib (earlier version) Tested on: amd64 (FreeBSD/amd64 & i386), i386, arm (earlier version) Tested on: powerpc64 (FreeBSD/powerpc64 & powerpc) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D3575
2015-09-30 19:13:32 +00:00
ptrace(PT_SYSCALL, si.si_pid, (caddr_t)1,
pending_signal);
break;
case CLD_STOPPED:
errx(1, "waitid reported CLD_STOPPED");
case CLD_CONTINUED:
Make use of ptrace(2) instead of procfs in truss(1), eliminating yet another need of an available /proc/ mount. Tested with: make universe Submitted by: howardsu Reviewed by: alfred
2007-04-10 04:03:34 +00:00
break;
}
}
}
Reference in New Issue Copy Permalink