Commit Graph

123 Commits

Author SHA1 Message Date
markj
5d2ce17ff0 Properly print arguments to vfork(2) and rfork(2).
PR:		180976
Submitted by:	Yuri <yuri@tsoft.com> (original patch)
MFC after:	1 week
2013-08-01 02:57:04 +00:00
mjg
be743fe502 truss: recognize O_DIRECTORY, O_EXEC, O_TTY_INIT and O_CLOEXEC
MFC after:	3 days
2013-06-30 13:14:46 +00:00
delphij
8ef4aa5bd2 Revert r247300 for now. I'll post a new changeset for review. 2013-02-26 19:46:59 +00:00
delphij
6eb36900d3 Expose timespec and timeval macros when __BSD_VISIBLE is defined. This
allows userland application to use the following macros:

	timespecclear, timespecisset, timespeccmp, timespecadd,
	timespecsub;

	timevalclear, timevalisset, timevalcmp.

MFC after:	1 month
2013-02-26 02:13:02 +00:00
zont
07b8304d19 - Make truss thread-aware.
Approved by:	kib (mentor)
MFC after:	2 weeks
2012-09-16 14:38:01 +00:00
zont
b328cce0e3 - Style(9) cleanup.
Approved by:	kib (mentor)
2012-09-02 11:03:18 +00:00
zont
89d46bf90a - Use pid_t type instead of just int.
Approved by:	kib (mentor)
2012-08-21 14:58:51 +00:00
ed
e886a142d5 Add more static keywords to truss(1) source code.
There are some tables in the source code that are only used by the
individual source files themselves. Therefore there is no need to export
them.
2011-12-10 18:27:55 +00:00
jh
6664a6800a Don't write the terminating NUL past end of buffer.
PR:		bin/152345
Submitted by:	Mateusz Guzik
2010-12-06 09:18:11 +00:00
imp
9563548aa0 Fix copyright spelling.
PR:		139825
Submitted by:	Ruslan Mahmatkhanov
2010-03-10 20:31:30 +00:00
brooks
a5cc24440b The devices that supported EVFILT_NETDEV kqueue filters were removed in
r195175.  Remove all definitions, documentation, and usage.

fifo_misc.c:
	Remove all kqueue tests as fifo_io.c performs all those that
	would have remained.

Reviewed by:	rwatson
MFC after:	3 weeks
X-MFC note:	don't change vlan_link_state() function signature
2009-12-31 20:29:58 +00:00
ed
a0fa5bcb40 Allow proper tracing of posix_openpt(2). 2009-12-23 15:22:50 +00:00
jh
34da792643 Cast time_t values to intmax_t and use %jd with printf.
OK'ed by:	delphij
Approved by:	trasz (mentor)
2009-12-21 17:41:57 +00:00
jh
2eaf7d742e Remove non-working special case for pipe(2) from amd64-fbsd32.c and
i386-fbsd.c. Add pipe(2) to syscall table to decode it's pointer
argument properly and re-add special handling for pipe(2) return value
to print_syscall_ret().

PR:		bin/120870
Approved by:	trasz (mentor)
2009-12-21 17:38:13 +00:00
jh
d51d2e56fc Add fork(2), getegid(2), geteuid(2), getgid(2), getpid(2), getpgid(2),
getpgrp(2), getppid(2), getsid(2) and getuid(2) to syscall table to
decode their arguments correctly.

OK'ed by:	delphij
Approved by:	trasz (mentor)
2009-12-20 10:58:34 +00:00
dds
bea63f2169 Add -c option to summarize number of calls, errors, and system time.
Reviewed by:	alfred
2009-05-12 20:42:12 +00:00
des
99ec4c843d Try to make this code slightly less painful to read. 2008-07-31 17:15:21 +00:00
jasone
7719fcccbc The break() system call takes a pointer argument, not an integer. This
change fixes output for break() on LP64 systems.
2008-01-03 00:18:03 +00:00
marcel
8be873747a Print integer-typed arguments as integers. This makes sure that
on 64-bit platforms the result is more reliable. For example,
-1 was previously printed as 0xffffffff.

Approved by: re (kensmith)
2007-07-28 23:18:39 +00:00
marcel
aa233d32b1 Fix handling of Quad-type arguments. Previously, syscalls
containing 64-bit arguments would have explicit padding.
On 64-bit platforms there was no padding, so the dummy
argument was not covering anything. On 32-bit platforms
with weak alignment (i.e. i386) the 64-bit argument did
not need to be aligned, so there too an aditional argument
was introduced. On 32-bit platforms with strong alignment
(i.e. PowerPC) the dummy argument in fact cover the padding.
By elimininating the dummy argument, 64-bit platforms now
have 1 argument less. This also applies to 32-bit platforms
with weak alignment. On PowerPC this doesn't matter, because
the padding is still there. We just don't "name" it.
Deal with those 3 cases.

Approved by: re (kensmith)
2007-07-28 23:15:04 +00:00
delphij
70cda62de5 Make use of ptrace(2) instead of procfs in truss(1), eliminating
yet another need of an available /proc/ mount.

Tested with:	make universe
Submitted by:	howardsu
Reviewed by:	alfred
2007-04-10 04:03:34 +00:00
pav
a233d0a2ec - Add decoding of kse_release, kevent, sigprocmask, unmount, socket, getrusage,
rename, __getcwd, shutdown, getrlimit, setrlimit, _umtx_lock, _umtx_unlock,
  pathconf, truncate, ftruncate, kill

- Decode more arguments of open, mprot, *stat, and fcntl.

- Convert all constant-macro and bitfield decoding to lookup tables; much
  cleaner than previous code.

- Print the timestamp of process exit and signal reception when -d or -D are in
  use

- Try six times with 1/2 second delay to debug the child

PR:		bin/52190 (updated)
Submitted by:	Dan Nelson <dnelson@allantgroup.com>
Approved by:	alfred
2006-05-15 21:18:28 +00:00
brian
2a326134d0 Add a -s flag for the same functionality as strace. Introduce a Name
type which is a String type that has no -s limitations applied to it.
Change most Strings in the code to Names and add a few extra syscalls,
namely munmap, read, rename and symlink.  This was enough to facilitate
following file descriptor allocations in the code more easily and
getting a hint at what's being read/written from/to files.  More
syscalls should really be added.

While here, fix an off-by-one bug in the buffer truncation code and
add a fflush so that truss's output reflects the syscall that the
program is stuck in.

Sponsored by:	Sophos/Activestate
MFC after:	2 weeks
2006-01-02 08:36:25 +00:00
alfred
140118d69d The kernel accepts sockaddrs with len set to zero for sockaddr_in
types, so refactor the code here to grab them when length is zero.
2005-10-15 06:17:29 +00:00
alfred
5f6df97a58 Decode chroot(2) args.
Approved by: re
2005-06-14 21:51:08 +00:00
alfred
67f16567dc decode utimes, lutimes, futimes, chflags, lchflags. 2005-05-26 22:49:06 +00:00
alfred
2754f60f30 decode mkdir args. 2005-05-26 20:06:57 +00:00
alfred
6d55822ad3 Change fix a bug where the length of data written by snprintf was
being mishandled by using accumulation (into an uninitialized
variable) instead of direct assignment.

Reviewed by: scottl
2005-03-03 17:20:36 +00:00
marcel
4ac7064824 Fix Quad handling on 64-bit architectures. On 64-bit machines, a Quad
also occupies a single slot. There's no need for any special handling
of Quads. While here, remove the silly make_quad() function. We have
the 2 longs on 32-bit machines already lined up in the argument array,
so we can fetch the Quad with a simple cast.

Before:
  lseek(1,0x123456789,0xd0d0d0d0d0d0d0d0) = 4886718345 (0x123456789)
After:
  lseek(1,0x123456789,SEEK_SET)           = 4886718345 (0x123456789)
2004-09-05 05:27:30 +00:00
alfred
46edc34b3d don't seg if the syscall is invalid for i386fbsd. 2004-08-08 23:29:36 +00:00
stefanf
7cdc27d942 Use the length modifier 'll' instead of 'q' to print long longs. 2004-07-28 16:03:13 +00:00
alfred
f770c48d15 Support readlink(2) better. Readlink does not nul terminate the
result buffer, so we need to format it ourselves.  The problem is
that the length is stored as the return value from readlink, so we
need to pass the return value from our syscall into print_arg.

Motivated by: truss garbage on my screen from reading /etc/malloc.conf.
2004-07-17 19:48:49 +00:00
alfred
4c16bbdae3 When reporting reciept of a signal, print the signal's name. 2004-07-17 19:19:36 +00:00
alfred
008c1be05d Decode the "wence" arg to lseek and linux_lseek. 2004-07-10 09:23:53 +00:00
phk
542eb308da COMPAT_SUNOS is gone. 2004-06-11 11:58:07 +00:00
dwmalone
31968bcd59 Add support for decoding Timespec, Timeval, Itimerval, Pollfd,
Fd_set and Sigaction structures. Use these for printing the arguments
to sigaction(), nanosleep(), select(), poll(), gettimeofday(),
clock_gettime(), recvfrom(), getitimer() and setitimer().

This is based on Dan's patch from the PR but I've hacked it for
style and some other issues. While Dan has checked this patch, any
goofs are probably my fault.

(The PR also contains support for the dual return values of pipe().
These will follow once I've ported that support to platforms other
than i386.)

PR:		52190
Submitted by:	Dan Nelson <dnelson@allantgroup.com>
2004-03-23 12:37:02 +00:00
dwmalone
7a220808b3 Use pread to implement pread, rather than taking a detour throug stdio.
PR:		52190
Submitted by:	Dan Nelson <dnelson@allantgroup.com>
2004-03-23 12:29:17 +00:00
alfred
422a2ca6b4 decode mprotect args while i'm here. 2004-03-23 09:16:18 +00:00
alfred
5b22f04d6d decode fcntl and mmap arguments. 2004-03-23 09:04:06 +00:00
dwmalone
6da7a0d11d Fix a printf format warning. 2004-01-07 14:27:30 +00:00
marcel
2748750ba3 Do not ignore any possible errors that fseeko() may have. The fact
is that fseeko() fails in very predictable and frequent ways on ia64.
This is because the offset is actually an address in the process'
address space, which on ia64 can be larger than long (for lseek) or
off_t (for fseeko). The crux is the signedness. The register stack
and memory stack are in region 4 on ia64. This means that the sign bit
is 1. The large positive virtual address is wrongly interpreted as
a negative file offset.

There's no quick fix. Even if you get around the API by using a
SEEK_SET up to LONG_MAX and follow it up with a SEEK_CUR for the
remainder, the kernel simply cannot deal with it. and the second
seek will just fail.

Therefore, this change does not actually fix the root cause. It just
makes sure we're not spitting out all kinds of garbage or that the
get_struct() function in particular does not cause truss(1) to exit.
This, I might add, invariably happened way too soon for truss(1) to
be of any use on ia64...
2003-11-13 09:04:24 +00:00
marcel
3f532e652b Port truss(1) to 64-bit architectures:
o  Syscall return values do not fit in int on 64-bit architectures.
   Change the type of retval in <arch>_syscall_exit() to long and
   change the prototype of said function to return a long as well.
o  Change the prototype of print_syscall_ret() to take a long for
   the return address and change the format string accordingly.
o  Replace the code sequence
	tmp = malloc(X);
	sprintf(tmp, format, ...);
   with X by definition too small on 64-bit platforms by
        asprintf(&tmp, format, ...);

With these changes the output makes sense again, although it does
mess up the tabulation on ia64. Go widescreen...

Not tested on: alpha, sparc64.
2003-11-09 03:48:13 +00:00
marcel
d270e076a6 Fix truss so that it doesn't abort/exit when a syscall has been given
a NULL-pointer for a sockaddr argument.
2003-10-27 06:50:57 +00:00
des
c8cb809e68 send() and recv() are just wrappers, not actual syscalls. 2003-08-05 19:34:36 +00:00
des
1f50902a45 Add recv(2), recvfrom(2), send(2) and sendfrom(2). 2003-08-05 10:45:06 +00:00
mdodd
ba18538620 Decode a few more syscalls. 2003-04-15 06:12:12 +00:00
dwmalone
7fa8d22f67 Check if name is NULL before we strcmp the syscall name. This was
sometimes triggered if you began trussing a process while it was
in a syscall, as the name is filled in when the syscall is made.
2002-11-09 22:28:38 +00:00
mike
d72c913927 Don't depend on <signal.h> to include <sys/time.h>, instead include
<sys/time.h> directly.  This is mostly bogus since CLOCK_REALTIME
should be defined in <time.h>, which these files already include.
2002-10-06 21:46:04 +00:00
mdodd
582f479cac Remove an unnecessary cast. 2002-08-07 11:35:18 +00:00
mdodd
d20661ba22 - Use time.h not sys/time.h.
- Fix printf format errors.

Submitted by:	 bde
2002-08-06 12:46:14 +00:00
mdodd
e46b84ca00 Remove extra space in output. 2002-08-05 14:56:20 +00:00
mdodd
2ba9baa8d3 Use timespec not timeval. 2002-08-05 12:22:55 +00:00
mdodd
c3ab10b179 Add options to print the argument and environment string parameters to
execve().

This could be done in a more general manner but it still wouldn't
be very pretty.

MFC after:	 3 weeks
2002-08-04 02:24:21 +00:00
mdodd
3cb287247d Add options to print absolute and relative timestamps.
PR:		 bin/25587 (in part)
MFC after:	 3 weeks
2002-08-04 01:27:31 +00:00
mdodd
65f8611398 Allow tracking fork()ed children.
PR:		 bin/25587 (in part)
MFC after:	3 weeks
2002-08-04 01:02:52 +00:00
mdodd
357fc6060d Parameterize globals.
PR:		bin/25587 (in part)
MFC after:	3 weeks
2002-08-04 00:46:48 +00:00
dwmalone
4c92f1efea Use fseeko and uintptr_t to make sure that we get a sensible offset
when trying to read from the stack.

PR:		37104
Submitted by:	Thomas Quinot <thomas@cuivre.fr.eu.org>
MFC after:	3 weeks
2002-04-21 19:04:26 +00:00
alfred
275bf1142e Print open(2) flags in hex instread of decimal for clarity. 2001-12-30 23:11:52 +00:00
markm
87c4eaeeed Partial WARNS=1 fizes with NO_WERROR set to prevent world breakage.
Use __FBSDID().
2001-12-11 23:34:02 +00:00
green
b9c07fd74b Add missing include for <ctype.h>
Make sockaddr printing code unbad.

Always copy in sizeof(sockaddr_un) bytes for an AF_UNIX sockaddr,
despite what the length may be.
2001-11-06 19:26:51 +00:00
des
90be41ff5d Teach truss(1) to display sockaddrs. It currently knows about AF_INET,
AF_INET6 and AF_UNIX sockaddrs, and will recognize accept(), bind(),
connect(), getpeername() and getsockname() as syscalls taking sockaddr
arguments.  Some enterprising soul might want to add (and test) support
for the send() / recv() family of syscalls as well.

MFC after:	1 week
2001-10-21 21:57:10 +00:00
joerg
c9d495ceb8 In get_string(), 0-terminate the contents of buf ``just in case'';
otherwise, if the very first fgetc() already yielded EOF, the returned
string won't get terminated at all.

MFC after:	1 day
2001-08-28 21:27:36 +00:00
sef
855f88c9ee Change the output of truss to more closely resemble SysV's. (Yes, it
really is much nicer looking.)

Submitted by:	"Matthew N. Dodd" <winter@jurai.net>
2000-03-18 08:49:41 +00:00
sef
0446e158ad Fix a leak. (Thanks Bruce, this was a bonehead mistake on my part :).)
Submitted by:	Bruce Evans
2000-02-15 20:25:47 +00:00
peter
3b842d34e8 $Id$ -> $FreeBSD$ 1999-08-28 01:08:13 +00:00
des
6b0342e396 Teach truss to print symbolic signal names (e.g. SIGHUP instead of 0x01). 1999-08-10 16:57:37 +00:00
des
4df48d07f1 Add access(2) to the list of recognized syscalls. 1999-08-05 12:03:50 +00:00
sef
9e0aee1ff0 Add lstat() as a known system call. 1998-10-15 04:31:44 +00:00
bde
0609531ab6 Fixed printf format errors. 1998-07-06 21:01:54 +00:00
charnier
50a2f19faf Sort Xrefs. Use err(3). Remove uneeded #include.
Correct usage: one of {-p pid, command} is required.
Open output file when command line is fully analyzed: incorrect `truss -o f'
command does not create an empty file anymore.
1998-01-05 07:30:26 +00:00
sef
297bd47472 Add some copyright and license terms, at Jordan's request. Note that
syscall.h just refers to another file for the copyright notice.
1997-12-20 18:40:43 +00:00
sef
40d07bddd6 First cut at printing out ioctl names intelligently. Note that this doesn't
handle linux ioctls (yet?).  This uses the mkioctl script from kdump,
bless its little heart.

Reviewed by:	Mike Smith
1997-12-06 06:51:14 +00:00
sef
9e9a114f06 Truss program. Requires procfs. 1997-12-06 05:23:12 +00:00