Hello, I'm running a statically linked binary, which I've built inside a jail. The jail's libc & co are in sync with the host's. Truss then shows this: -- cut here -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048524 -- -- UNKNOWN SYSCALL 1048516 -- -- UNKNOWN SYSCALL 1048572 -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048556 -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048524 -- -- UNKNOWN SYSCALL 1048564 -- -- UNKNOWN SYSCALL 1048548 -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048532 -- -- UNKNOWN SYSCALL 1048564 -- -- and here -- Is this a bug or a feature? -- ~/.signature: no such file or directory
On Wed, Dec 3, 2008 at 5:23 PM, Dan Nelson <dnelson@allantgroup.com> wrote:> In the last episode (Dec 03), Vlad GALU said: >> I'm running a statically linked binary, which I've built inside a >> jail. The jail's libc & co are in sync with the host's. Truss then >> shows this: >> >> -- cut here -- >> -- UNKNOWN SYSCALL 1048532 -- >> -- UNKNOWN SYSCALL 1048532 -- > > Is this a threaded app that you attached truss to after it was started? > The method that truss uses to catch syscall enter/exit events doesn't > indicate whether the event is an enter or an exit, so if you attach > while a syscall is active, truss handles the exit event as if it were a > syscall entry event, and never gets back in synch. It gets worse with > threaded apps because each thread is another chance to get out of > synch. Try this patch: > > Index: i386-fbsd.c > ==================================================================> RCS file: /home/ncvs/src/usr.bin/truss/i386-fbsd.c,v > retrieving revision 1.29 > diff -u -p -r1.29 i386-fbsd.c > --- i386-fbsd.c 28 Jul 2007 23:15:04 -0000 1.29 > +++ i386-fbsd.c 3 Dec 2008 15:20:09 -0000 > @@ -149,7 +149,14 @@ i386_syscall_entry(struct trussinfo *tru > fsc.name > (syscall_num < 0 || syscall_num > nsyscalls) ? NULL : syscallnames[syscall_num]; > if (!fsc.name) { > - fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %d --\n", syscall_num); > + fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %u (0x%08x) --\n", syscall_num, syscall_num); > + if ((unsigned int)syscall_num > 0x1000) { > + /* When attaching to a running process, we have a 50-50 chance > + of attaching to a process waiting in a syscall, which means > + our first trap is an exit instead of an entry and we're out > + of synch. Reset our flag */ > + trussinfo->curthread->in_syscall = 0; > + } > } > > if (fsc.name && (trussinfo->flags & FOLLOWFORKS) > > > -- > Dan Nelson > dnelson@allantgroup.com >Hi Dan, You were right, this application was indeed threaded. The messages still occur, although at a slightly lower rate. One other thing that's not particularly helpful is this: -- cut here-- read(1074283119,"\M-Ry\^A\0",7356800) = 4 (0x4) -- and here -- I obviously don't have that many descriptors in my process. I can live with the malformed message, but it's a PITA not to know which fd the read was actually made from :( -- ~/.signature: no such file or directory
In the last episode (Dec 03), Vlad GALU said:> I'm running a statically linked binary, which I've built inside a > jail. The jail's libc & co are in sync with the host's. Truss then > shows this: > > -- cut here -- > -- UNKNOWN SYSCALL 1048532 -- > -- UNKNOWN SYSCALL 1048532 --Is this a threaded app that you attached truss to after it was started? The method that truss uses to catch syscall enter/exit events doesn't indicate whether the event is an enter or an exit, so if you attach while a syscall is active, truss handles the exit event as if it were a syscall entry event, and never gets back in synch. It gets worse with threaded apps because each thread is another chance to get out of synch. Try this patch: Index: i386-fbsd.c ==================================================================RCS file: /home/ncvs/src/usr.bin/truss/i386-fbsd.c,v retrieving revision 1.29 diff -u -p -r1.29 i386-fbsd.c --- i386-fbsd.c 28 Jul 2007 23:15:04 -0000 1.29 +++ i386-fbsd.c 3 Dec 2008 15:20:09 -0000 @@ -149,7 +149,14 @@ i386_syscall_entry(struct trussinfo *tru fsc.name (syscall_num < 0 || syscall_num > nsyscalls) ? NULL : syscallnames[syscall_num]; if (!fsc.name) { - fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %d --\n", syscall_num); + fprintf(trussinfo->outfile, "-- UNKNOWN SYSCALL %u (0x%08x) --\n", syscall_num, syscall_num); + if ((unsigned int)syscall_num > 0x1000) { + /* When attaching to a running process, we have a 50-50 chance + of attaching to a process waiting in a syscall, which means + our first trap is an exit instead of an entry and we're out + of synch. Reset our flag */ + trussinfo->curthread->in_syscall = 0; + } } if (fsc.name && (trussinfo->flags & FOLLOWFORKS) -- Dan Nelson dnelson@allantgroup.com