Date: Wed, 3 Dec 2008 17:45:33 +0200 From: "Vlad GALU" <dudu@dudu.ro> To: "Dan Nelson" <dnelson@allantgroup.com> Cc: freebsd-stable@freebsd.org Subject: Re: Weird truss output Message-ID: <ad79ad6b0812030745i5dd344d4qbae54d32579c142c@mail.gmail.com> In-Reply-To: <20081203152330.GD22076@dan.emsphone.com> References: <ad79ad6b0812030147x7b9fa194nf86180f89583cdf5@mail.gmail.com> <20081203152330.GD22076@dan.emsphone.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Dec 3, 2008 at 5:23 PM, Dan Nelson <dnelson@allantgroup.com> wrote:
> In the last episode (Dec 03), Vlad GALU said:
>> I'm running a statically linked binary, which I've built inside a
>> jail. The jail's libc & co are in sync with the host's. Truss then
>> shows this:
>>
>> -- cut here --
>> -- UNKNOWN SYSCALL 1048532 --
>> -- UNKNOWN SYSCALL 1048532 --
>
> Is this a threaded app that you attached truss to after it was started?
> The method that truss uses to catch syscall enter/exit events doesn't
> indicate whether the event is an enter or an exit, so if you attach
> while a syscall is active, truss handles the exit event as if it were a
> syscall entry event, and never gets back in synch. It gets worse with
> threaded apps because each thread is another chance to get out of
> synch. Try this patch:
>
> Index: i386-fbsd.c
> ===================================================================
> RCS file: /home/ncvs/src/usr.bin/truss/i386-fbsd.c,v
> retrieving revision 1.29
> diff -u -p -r1.29 i386-fbsd.c
> --- i386-fbsd.c 28 Jul 2007 23:15:04 -0000 1.29
> +++ i386-fbsd.c 3 Dec 2008 15:20:09 -0000
> @@ -149,7 +149,14 @@ i386_syscall_entry(struct trussinfo *tru
> fsc.name =
> (syscall_num < 0 || syscall_num > nsyscalls) ? NULL : syscallnames[syscall_num];
> if (!fsc.name) {
> - fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %d --\n", syscall_num);
> + fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %u (0x%08x) --\n", syscall_num, syscall_num);
> + if ((unsigned int)syscall_num > 0x1000) {
> + /* When attaching to a running process, we have a 50-50 chance
> + of attaching to a process waiting in a syscall, which means
> + our first trap is an exit instead of an entry and we're out
> + of synch. Reset our flag */
> + trussinfo->curthread->in_syscall = 0;
> + }
> }
>
> if (fsc.name && (trussinfo->flags & FOLLOWFORKS)
>
>
> --
> Dan Nelson
> dnelson@allantgroup.com
>
Hi Dan,
You were right, this application was indeed threaded. The messages
still occur, although at a slightly lower rate. One other thing that's
not particularly helpful is this:
-- cut here--
read(1074283119,"\M-Ry\^A\0",7356800) = 4 (0x4)
-- and here --
I obviously don't have that many descriptors in my process. I can live
with the malformed message, but it's a PITA not to know which fd the
read was actually made from :(
--
~/.signature: no such file or directory
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ad79ad6b0812030745i5dd344d4qbae54d32579c142c>