Date: Wed, 3 Dec 2008 09:23:32 -0600 From: Dan Nelson <dnelson@allantgroup.com> To: Vlad GALU <dudu@dudu.ro> Cc: freebsd-stable@freebsd.org Subject: Re: Weird truss output Message-ID: <20081203152330.GD22076@dan.emsphone.com> In-Reply-To: <ad79ad6b0812030147x7b9fa194nf86180f89583cdf5@mail.gmail.com> References: <ad79ad6b0812030147x7b9fa194nf86180f89583cdf5@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
In the last episode (Dec 03), Vlad GALU said:
> I'm running a statically linked binary, which I've built inside a
> jail. The jail's libc & co are in sync with the host's. Truss then
> shows this:
>
> -- cut here --
> -- UNKNOWN SYSCALL 1048532 --
> -- UNKNOWN SYSCALL 1048532 --
Is this a threaded app that you attached truss to after it was started?
The method that truss uses to catch syscall enter/exit events doesn't
indicate whether the event is an enter or an exit, so if you attach
while a syscall is active, truss handles the exit event as if it were a
syscall entry event, and never gets back in synch. It gets worse with
threaded apps because each thread is another chance to get out of
synch. Try this patch:
Index: i386-fbsd.c
===================================================================
RCS file: /home/ncvs/src/usr.bin/truss/i386-fbsd.c,v
retrieving revision 1.29
diff -u -p -r1.29 i386-fbsd.c
--- i386-fbsd.c 28 Jul 2007 23:15:04 -0000 1.29
+++ i386-fbsd.c 3 Dec 2008 15:20:09 -0000
@@ -149,7 +149,14 @@ i386_syscall_entry(struct trussinfo *tru
fsc.name =
(syscall_num < 0 || syscall_num > nsyscalls) ? NULL : syscallnames[syscall_num];
if (!fsc.name) {
- fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %d --\n", syscall_num);
+ fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %u (0x%08x) --\n", syscall_num, syscall_num);
+ if ((unsigned int)syscall_num > 0x1000) {
+ /* When attaching to a running process, we have a 50-50 chance
+ of attaching to a process waiting in a syscall, which means
+ our first trap is an exit instead of an entry and we're out
+ of synch. Reset our flag */
+ trussinfo->curthread->in_syscall = 0;
+ }
}
if (fsc.name && (trussinfo->flags & FOLLOWFORKS)
--
Dan Nelson
dnelson@allantgroup.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20081203152330.GD22076>