summaryrefslogtreecommitdiffstats
path: root/usr.bin/truss
Commit message (Collapse)AuthorAgeFilesLines
* Now that futimens() and utimensat() have been merged, add decoding forjhb2016-01-142-1/+37
| | | | | those system calls that was left out of the previous merge of r286381 in r290052.
* MFC 271389,286330,286331,286358,286378,286380,286381,286383,286388,286848,jhb2015-10-2718-3779/+1926
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 286849,286857,286860,286913,286914,286937-286940,286962,286963,288405, 288406,288424,288454-288456,288625,288626,288832,288834,288950,288997, 289080: Merge most of the recent changes to truss in HEAD. The largest effects are that fork following now uses a single truss process (and thus truss -c reports counts for the entire tree of processes instead of separate dumps for each process). truss -c also reports counts for all system calls instead of only a subset. More system call arguments are also decoded. System calls should now report the correct number of arguments (instead of 6), and some platforms that did not properly decode arguments might now do so (e.g. mips64). Changes relative to the equivalent commits to HEAD include: - The ia64 backend was refactored similar to the other backends. - _umtx_lock/_umtx_unlock entries were updated similar to other system call entries. - 10 does not have futimens(), utimensat(), EVFILT_PROCDESC, EVFILT_SENDFILE, RLIMIT_KQUEUES, O_VERIFY, NOTE_FILE_POLL, or EV_FORCEONESHOT. 271389: Stop accessing the saved stack pointer by looking past the end of the array of registers. 286330: Whitespace fix: remove some spurious spaces before commas. 286331: Rework get_string() to make it more robust when fetching strings of unknown length. In particular, instead of blinding fetching 1k blocks, do an initial fetch up to the end of the current page followed by page-sized fetches up to the maximum size. Previously if the 1k buffer crossed a page boundary and the second page was not valid, the entire operation would fail. 286358: Add recently added values of various flags and enumerations including kevent filters, kevent flags, flags to mmap, seek locations, fcntl operations, file flags, socket domains, open flags, resource limits, and pathconf values. 286378: Don't mark the fcntl flag argument as an output parameter so that it is always decoded. Previously the argument was not decoded if fcntl() failed. 286380: Decode the arguments to mkfifo() and fix an off-by-one error in the arguments to mknod(). 286381: Decode the arguments passed to the *at() family of system calls. This is especially useful now that libc's open() always calls openat(). While here, fix a few other things: - Decode the mode argument passed to access(), eaccess(), and faccessat(). - Decode the atfd paramete to pretty-print AT_FDCWD. - Decode the special AT_* flags used with some of the *at() system calls. - Decode arguments for fchmod(), lchmod(), fchown(), lchown(), eaccess(), and futimens(). - Decode both of the timeval structures passed to futimes() instead of just the first one. 286383: Whitespace fixes to consistently use spaces before }'s and wrap long lines. 286388: Consistently use both leading and trailing spaces inside of the {}'s when pretty-printing structures. Most structures used both spaces, but some only used a trailing space and some used neither. 286848: - Decode the arguments for several signal-related system calls: sigpending, sigqueue, sigreturn, sigsuspend, sigtimedwait, sigwait, sigwaitinfo, and thr_kill. - Print signal sets as a structure (with {}'s) and in particular use this to differentiate empty sets from a NULL pointer. - Decode arguments for some other system calls: issetugid, pipe2, sysarch (operations are only decoded for amd64 and i386), and thr_self. 286849: Decode the optional SOCK_NONBLOCK and SOCK_CLOEXEC flags passed in a socket type. 286857: Tidy the linux_socketcall decoding: - Don't exit if get_struct() fails, instead print the raw pointer value to match all other argument decoding cases. - Use an xlat table instead of a home-rolled switch for the operation name. - Display the nested socketcall args structure as a structure instead of as two inline arguments. 286860: Use an xlat table and xlookup() instead of a home-rolled version for the sigprocmask operation type. 286913: Change the argument formatting function to use a stdio FILE object opened with open_memstream() to build the string for each argument. This allows for more complicated argument building without resorting to intermediate malloc's, etc. Related, the strsig*() functions no longer return allocated strings but use a static global buffer instead. 286914: Expand the decoding of kevent structures. - Print the ident value as decimal instead of hexadecimal for filter types that use "small" values such as file descriptors and PIDs. - Decode NOTE_* flags in the fflags field of kevents for several system filter types. 286937: Use nitems(). 286938: Various style and whitespace fixes. 287939: Always use %j with an intmax_t cast to print time_t values. time_t is longer than long on 32-bit platforms with a 64-bit time_t. 286940: ino_t is unsigned, so use uintmax_t instead of intmax_t when printing it. 286962: Rework the argv and env string fetching for execve to be more robust. Before truss would fetch 100 string pointers and happily walk off the end of the array if it never found a NULL. This also means for a short argv list it could fail entirely if the 100 string pointers spanned into an unmapped page. Instead, fetch page-aligned blocks of string pointers in a loop fetching each string until a NULL is found. While here, make use of the open memstream file descriptor instead of allocating a temporary array. This allows us to fetch each string once instead of twice. 286963: Handle the conditional decoding of execve() argument and environment arrays generically rather than duplicating a hack in all of the backends. - Add two new system call argument types and use them instead of StringArray for the argument and environment arguments execve and linux_execve. - Honor the -a/-e flags in the handling of these new types. - Instead of printing "<missing argument>" when the decoding is disabled, print the raw pointer value. 288405: Decode recently added procctl(2) operations. 288406: Trim trailing whitespace. 288424: Several changes to truss. - Refactor the interface between the ABI-independent code and the ABI-specific backends. The backends now provide smaller hooks to fetch system call arguments and return values. The rest of the system call entry and exit handling that was previously duplicated among all the backends has been moved to one place. - Merge the loop when waiting for an event with the loop for handling stops. This also means not emulating a procfs-like interface on top of ptrace(). Instead, use a single event loop that fetches process events via waitid(). Among other things this allows us to report the full 32-bit exit value. - Use PT_FOLLOW_FORK to follow new child processes instead of forking a new truss process for each new child. This allows one truss process to monitor a tree of processes and truss -c should now display one total for the entire tree instead of separate summaries per process. - Use the recently added fields to ptrace_lwpinfo to determine the current system call number and argument count. The latter is especially useful and fixes a regression since the conversion from procfs. truss now generally prints the correct number of arguments for most system calls rather than printing extra arguments for any call not listed in the table in syscalls.c. - Actually check the new ABI when processes call exec. The comments claimed that this happened but it was not being done (perhaps this was another regression in the conversion to ptrace()). If the new ABI after exec is not supported, truss detaches from the process. If truss does not support the ABI for a newly executed process the process is killed before it returns from exec. - Along with the refactor, teach the various ABI-specific backends to fetch both return values, not just the first. Use this to properly report the full 64-bit return value from lseek(). In addition, the handler for "pipe" now pulls the pair of descriptors out of the return values (which is the true kernel system call interface) but displays them as an argument (which matches the interface exported by libc). - Each ABI handler adds entries to a linker set rather than requiring a statically defined table of handlers in main.c. - The arm and mips system call fetching code was changed to follow the same pattern as amd64 (and the in-kernel handler) of fetching register arguments first and then reading any remaining arguments from the stack. This should fix indirect system call arguments on at least arm. - The mipsn32 and n64 ABIs will now look for arguments in A4 through A7. - Use register %ebp for the 6th system call argument for Linux/i386 ABIs to match the in-kernel argument fetch code. - For powerpc binaries on a powerpc64 system, fetch the extra arguments on the stack as 32-bit values that are then copied into the 64-bit argument array instead of reading the 32-bit values directly into the 64-bit array. 288454: - Remove extra integer argument from truncate() and ftruncate(). This is probably fallout from the removal of the extra padding argument before off_t in 7. However, that padding still exists for 32-bit powerpc, so use QUAD_ALIGN. - Fix QUAD_ALIGN to be zero for powerpc64. It should only be set to 1 for 32-bit platforms that add padding to align 64-bit arguments. 288455: The id_t type used to pass IDs to wait6(2) and procctl(6) is a 64-bit integer. Fix the argument decoding to treat this as a quad instead of an int. This includes using QUAD_ALIGN and QUAD_SLOTS as necessary. To continue printing IDs in decimal, add a new QuadHex argument type that prints a 64-bit integer in hex, use QuadHex for the existing off_t arguments, repurpose Quad to print a 64-bit integer in decimal, and use Quad for id_t arguments. This fixes the decoding of wait6(2) and procctl(2) on 32-bit platforms. 288456: Rather than groveling around in a socket address structure for a socket address's length (and then overriding it if it "looks wrong"), use the next argument to the system call to determine the length. This is more reliable since this is what the kernel depends on anyway and is also simpler. 288625: Add decoding for struct statfs. 288626: Style fix. 288832: Fix tracking of unknown syscalls for 'truss -c'. This is done by changing get_syscall() to either lookup the known syscall or add it into the list with the default handlers for printing. This also simplifies some code to not have to check if the syscall variable is set or NULL. 288834: Add decoding for modfind(2) 288950: Group the decoded system calls by ABI and sort the calls within each ABI. 288997: Correct a comment. 289080: Let -c imply -S (hide signal output). Without this, the signals are shown seemingly randomly in the output before the final summary is shown. This is especially noticeable when there is not much output from the application being traced.
* MFC r288903:bdrewery2015-10-201-4/+2
| | | | | | | | Fix crash if a process sends itself a SIGTRAP. Just forward it as expected. This does not match head as the code was rewritten significantly there. Relnotes: yes
* MFC r285842: truss: follow pdfork()ed descendents with -femaste2015-08-148-0/+8
|
* MFC r271394, r271398:ian2015-02-121-1/+1
| | | | | | | Add more register values to armreg.h and remove CPU_CONTROL_32BP_ENABLE from asm.h as they were already defined in armreg.h. Unify interrupts bit definition and usage. While here remove PSR_C_bit.
* MFC 273053:jhb2014-12-162-2/+24
| | | | | Decode the arguments passed to _umtx_op(). In particular, decode the opcode.
* MFC r264881smh2014-05-262-1/+123
| | | | | | Add Linux socket call decoding to truss Sponsored by: Multiplay
* Extend the support for exempting processes from being killed when swap isjhb2013-09-192-1/+11
| | | | | | | | | | | | | | | | | | | | | | exhausted. - Add a new protect(1) command that can be used to set or revoke protection from arbitrary processes. Similar to ktrace it can apply a change to all existing descendants of a process as well as future descendants. - Add a new procctl(2) system call that provides a generic interface for control operations on processes (as opposed to the debugger-specific operations provided by ptrace(2)). procctl(2) uses a combination of idtype_t and an id to identify the set of processes on which to operate similar to wait6(). - Add a PROC_SPROTECT control operation to manage the protection status of a set of processes. MADV_PROTECT still works for backwards compatability. - Add a p_flag2 to struct proc (and a corresponding ki_flag2 to kinfo_proc) the first bit of which is used to track if P_PROTECT should be inherited by new child processes. Reviewed by: kib, jilles (earlier version) Approved by: re (delphij) MFC after: 1 month
* - Decode the idtype argument passed to wait6() in kdump and truss.jhb2013-09-122-12/+67
| | | | | | | | | | - Don't treat an options argument of 0 to wait4() as an error in kdump. - Decode the wait options passed to wait4() and wait6() in truss and decode the returned rusage and exit status. Approved by: re (kib) MFC after: 1 week
* Add a mmap flag (MAP_32BIT) on 64-bit platforms to request that a mapping usejhb2013-09-091-1/+5
| | | | | | | | | | | | | an address in the first 2GB of the process's address space. This flag should have the same semantics as the same flag on Linux. To facilitate this, add a new parameter to vm_map_find() that specifies an optional maximum virtual address. While here, fix several callers of vm_map_find() to use a VMFS_* constant for the findspace argument instead of TRUE and FALSE. Reviewed by: alc Approved by: re (kib)
* Remove incorrect 'const' qualifier from pointers to dynamic stringjhb2013-08-191-1/+1
| | | | | | | buffers I added in the previous commit. Pointy hat to: jhb MFC after: 1 month
* Add new mmap(2) flags to permit applications to request specific virtualjhb2013-08-161-3/+35
| | | | | | | | | | | | | | | | | | | | | | | | | address alignment of mappings. - MAP_ALIGNED(n) requests a mapping aligned on a boundary of (1 << n). Requests for n >= number of bits in a pointer or less than the size of a page fail with EINVAL. This matches the API provided by NetBSD. - MAP_ALIGNED_SUPER is a special case of MAP_ALIGNED. It can be used to optimize the chances of using large pages. By default it will align the mapping on a large page boundary (the system is free to choose any large page size to align to that seems best for the mapping request). However, if the object being mapped is already using large pages, then it will align the virtual mapping to match the existing large pages in the object instead. - Internally, VMFS_ALIGNED_SPACE is now renamed to VMFS_SUPER_SPACE, and VMFS_ALIGNED_SPACE(n) is repurposed for specifying a specific alignment. MAP_ALIGNED(n) maps to using VMFS_ALIGNED_SPACE(n), while MAP_ALIGNED_SUPER maps to VMFS_SUPER_SPACE. - mmap() of a device object now uses VMFS_OPTIMAL_SPACE rather than explicitly using VMFS_SUPER_SPACE. All device objects are forced to use a specific color on creation, so VMFS_OPTIMAL_SPACE is effectively equivalent. Reviewed by: alc MFC after: 1 month
* Properly print arguments to vfork(2) and rfork(2).markj2013-08-012-1/+12
| | | | | | PR: 180976 Submitted by: Yuri <yuri@tsoft.com> (original patch) MFC after: 1 week
* truss: recognize O_DIRECTORY, O_EXEC, O_TTY_INIT and O_CLOEXECmjg2013-06-301-1/+1
| | | | MFC after: 3 days
* Add arm bits to truss.cognet2013-03-073-0/+376
|
* Revert r247300 for now. I'll post a new changeset for review.delphij2013-02-263-11/+11
|
* Expose timespec and timeval macros when __BSD_VISIBLE is defined. Thisdelphij2013-02-263-11/+11
| | | | | | | | | | | allows userland application to use the following macros: timespecclear, timespecisset, timespeccmp, timespecadd, timespecsub; timevalclear, timevalisset, timevalcmp. MFC after: 1 month
* truss: use 'e' flag for fopen instead of fcntl(.., FD_CLOEXEC)mjg2013-01-271-7/+4
|
* truss: if file requested with -o flag could not be opened print the reasonmjg2013-01-271-1/+1
| | | | MFC after: 3 days
* - Make truss thread-aware.zont2012-09-1614-721/+804
| | | | | Approved by: kib (mentor) MFC after: 2 weeks
* - Fix detaching under some circumstances.zont2012-09-123-14/+37
| | | | | | | | | | | | | | | | | | | | | When truss is detaching from very active process it is possible to hang on waitpid(2) in restore_proc() forever, because ptrace(PT_SYSCALL) must be called before detaching, to allow the debugging process to continue execution. Also when truss called with '-c' argument, it does not print anything after detach, because it immediately exits from restore_proc(). To fix these two problems make detaching deferred, but then it is impossible to detach from a process which does not do any system call. To fix this issue use sigaction(2) instead of signal(3) to disable SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove global variable child_pid, because now detaching is handled in context where child's pid is known. Reported by: mjg Tested by: mjg, swills Approved by: kib (mentor) MFC after: 2 weeks
* - Remove unused variables.zont2012-09-111-6/+3
| | | | | | - Remove redundant return after err(3) call. Approved by: kib (mentor)
* - Style(9) cleanup.zont2012-09-0215-2132/+2202
| | | | Approved by: kib (mentor)
* - Remove unused variables.zont2012-08-302-4/+2
| | | | | | - Fix warnings about comparing signed and unsigned ints. Approved by: kib (mentor)
* - Put arguments for print_syscall_ret() function in proper order.zont2012-08-231-1/+1
| | | | | | Bug was introduced in r192025. Approved by: kib (mentor)
* - Use pid_t type instead of just int.zont2012-08-214-7/+7
| | | | Approved by: kib (mentor)
* Since truss also uses kdump's mkioctls script, pass the value of ${CPP}dim2012-04-091-1/+1
| | | | | | there too, similar to r234058. MFC after: 1 week
* Add more static keywords to truss(1) source code.ed2011-12-104-5/+5
| | | | | | There are some tables in the source code that are only used by the individual source files themselves. Therefore there is no need to export them.
* Use explicit information from the kernel to detect the traps due tokib2011-12-041-3/+13
| | | | | | | syscall entry and leave. Based on submision by: Dan Nelson <dnelson allantgroup com> MFC after: 1 month
* It turns out that truss also used kdump's mkioctls script, and expecteddes2011-10-212-2/+3
| | | | | | | | | | | | ioctlname() to return a pointer to the name rather than print it. This did not show up in testing because truss had its own prototype for ioctlname(), so it would build fine and run fine as long as the program being traced did not issue an ioctl. Teach mkioctls to generate different versions of ioctlname() based on its first command-line argument. Pointed out by: Garrett Cooper <yanegomi@gmail.com>
* Fix typos in comments, no functional changes.bcr2011-05-198-8/+8
| | | | | | Found by: codespell Reviewed by: alfred MFC after: 1 week
* Simplify various code that allowed for sys_signame being lower case.jilles2011-03-061-4/+0
| | | | This was changed in r218285.
* Properly check for errors from waitpid().jhb2011-02-151-4/+4
| | | | | Submitted by: gcooper MFC after: 1 week
* Make sys_signame upper case.jilles2011-02-041-1/+1
| | | | | | | | | | | | This matches the constants from <signal.h> with 'SIG' removed, which POSIX requires kill and trap to accept and 'kill -l' to write. 'kill -l', 'trap', 'trap -l' output is now upper case. In Turkish locales, signal names with an upper case 'I' are now accepted, while signal names with a lower case 'i' are no longer accepted, and the output of 'killall -l' now contains proper capital 'I' without dot instead of a dotted capital 'I'.
* Don't write the terminating NUL past end of buffer.jh2010-12-061-1/+1
| | | | | PR: bin/152345 Submitted by: Mateusz Guzik
* Set FD_CLOEXEC for the output file only when the file has been specifiedjh2010-11-131-6/+7
| | | | | | | | | with the -o option. Setting the flag for stderr (the default) could cause the traced process to redirect stderr to a random file. PR: bin/152151 Submitted by: ashish MFC after: 5 days
* Remove setpgid() call before executing child process.ed2010-10-201-1/+0
| | | | | | | | | Using a separate process group here is bad, since (for example) job control in the TTY layer prevents interaction with the TTY, causing the child process to hang. Mentioned on: current@ MFC after: 2 weeks
* s/sytem/system in comments, no functional changes.bcr2010-10-138-8/+8
| | | | Reviewed by: alfred@
* Fix breakage introduced in r211725 and improve functionality of truss onnwhitehorn2010-08-285-3/+31
| | | | 64-bit powerpc by adding 32-bit compatibility features.
* MFtbemd:imp2010-08-231-3/+3
| | | | | Prefer MACHNE_CPUARCH to MACHINE_ARCH in most contexts where you want to test of all the CPUs of a given family conform.
* Teach truss and xlint how to operate on 64-bit PowerPC systems.nwhitehorn2010-07-121-0/+323
|
* Fix copyright spelling.imp2010-03-1014-15/+15
| | | | | PR: 139825 Submitted by: Ruslan Mahmatkhanov
* This fix makes it so the args are malloc'd beforerrs2010-02-031-1/+1
| | | | | | | | we use them (always a good idea ;-0) This was found and fixed by JC Obtained from: JC (c.jayachandran@gmail.com)
* Build usr.bin/ with WARNS=6 by default.ed2010-01-021-1/+0
| | | | Also add some missing $FreeBSD$ to keep svn happy.
* The devices that supported EVFILT_NETDEV kqueue filters were removed inbrooks2009-12-311-1/+1
| | | | | | | | | | | | r195175. Remove all definitions, documentation, and usage. fifo_misc.c: Remove all kqueue tests as fifo_io.c performs all those that would have remained. Reviewed by: rwatson MFC after: 3 weeks X-MFC note: don't change vlan_link_state() function signature
* Allow proper tracing of posix_openpt(2).ed2009-12-231-0/+2
|
* Cast time_t values to intmax_t and use %jd with printf.jh2009-12-211-5/+5
| | | | | OK'ed by: delphij Approved by: trasz (mentor)
* Remove non-working special case for pipe(2) from amd64-fbsd32.c andjh2009-12-213-26/+8
| | | | | | | | | i386-fbsd.c. Add pipe(2) to syscall table to decode it's pointer argument properly and re-add special handling for pipe(2) return value to print_syscall_ret(). PR: bin/120870 Approved by: trasz (mentor)
* Avoid sharing the file descriptor of the output file with tracedjh2009-12-201-0/+6
| | | | | | | | | processes by setting the FD_CLOEXEC flag for the output file. PR: bin/140493 Submitted by: Erik Lax OK'ed by: delphij Approved by: trasz (mentor)
* Add fork(2), getegid(2), geteuid(2), getgid(2), getpid(2), getpgid(2),jh2009-12-201-0/+12
| | | | | | | | getpgrp(2), getppid(2), getsid(2) and getuid(2) to syscall table to decode their arguments correctly. OK'ed by: delphij Approved by: trasz (mentor)
OpenPOWER on IntegriCloud