From owner-freebsd-stable@FreeBSD.ORG Wed Dec 3 16:00:42 2008 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 115FE1065673 for ; Wed, 3 Dec 2008 16:00:42 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.freebsd.org (Postfix) with ESMTP id C79C98FC0C for ; Wed, 3 Dec 2008 16:00:41 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (smmsp@localhost [127.0.0.1]) by dan.emsphone.com (8.14.3/8.14.3) with ESMTP id mB3FNXHo021672 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 3 Dec 2008 09:23:33 -0600 (CST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.14.3/8.14.3/Submit) id mB3FNWfE021667; Wed, 3 Dec 2008 09:23:32 -0600 (CST) (envelope-from dan) Date: Wed, 3 Dec 2008 09:23:32 -0600 From: Dan Nelson To: Vlad GALU Message-ID: <20081203152330.GD22076@dan.emsphone.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-OS: FreeBSD 7.1-PRERELEASE User-Agent: Mutt/1.5.18 (2008-05-17) Cc: freebsd-stable@freebsd.org Subject: Re: Weird truss output X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Dec 2008 16:00:42 -0000 In the last episode (Dec 03), Vlad GALU said: > I'm running a statically linked binary, which I've built inside a > jail. The jail's libc & co are in sync with the host's. Truss then > shows this: > > -- cut here -- > -- UNKNOWN SYSCALL 1048532 -- > -- UNKNOWN SYSCALL 1048532 -- Is this a threaded app that you attached truss to after it was started? The method that truss uses to catch syscall enter/exit events doesn't indicate whether the event is an enter or an exit, so if you attach while a syscall is active, truss handles the exit event as if it were a syscall entry event, and never gets back in synch. It gets worse with threaded apps because each thread is another chance to get out of synch. Try this patch: Index: i386-fbsd.c =================================================================== RCS file: /home/ncvs/src/usr.bin/truss/i386-fbsd.c,v retrieving revision 1.29 diff -u -p -r1.29 i386-fbsd.c --- i386-fbsd.c 28 Jul 2007 23:15:04 -0000 1.29 +++ i386-fbsd.c 3 Dec 2008 15:20:09 -0000 @@ -149,7 +149,14 @@ i386_syscall_entry(struct trussinfo *tru fsc.name = (syscall_num < 0 || syscall_num > nsyscalls) ? NULL : syscallnames[syscall_num]; if (!fsc.name) { - fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %d --\n", syscall_num); + fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %u (0x%08x) --\n", syscall_num, syscall_num); + if ((unsigned int)syscall_num > 0x1000) { + /* When attaching to a running process, we have a 50-50 chance + of attaching to a process waiting in a syscall, which means + our first trap is an exit instead of an entry and we're out + of synch. Reset our flag */ + trussinfo->curthread->in_syscall = 0; + } } if (fsc.name && (trussinfo->flags & FOLLOWFORKS) -- Dan Nelson dnelson@allantgroup.com