1 #!/usr/sbin/dtrace -s
   2 /*
   3  * This file and its contents are supplied under the terms of the
   4  * Common Development and Distribution License ("CDDL"), version 1.0.
   5  * You may only use this file in accordance with the terms of version
   6  * 1.0 of the CDDL.
   7  *
   8  * A full copy of the text of the CDDL should have accompanied this
   9  * source.  A copy of the CDDL is also available via the Internet at
  10  * http://www.illumos.org/license/CDDL.
  11  */
  12 
  13 /*
  14  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  15  */
  16 
  17 /*
  18  * User-level dtrace for smbd
  19  * Usage: dtrace -s smbd-pipesvc.d -p `pgrep smbd`
  20  */
  21 
  22 #pragma D option flowindent
  23 
  24 self int trace;
  25 self int mask;
  26 
  27 /*
  28  * The pipesvc_worker() function is a good place to start tracing
  29  * to watch RPC service actions.  This worker handles all activity
  30  * for a given named pipe instance, including the payload from all
  31  * SMB read/write requests on this endpoint.
  32  */
  33 pid$target:*smbd:pipesvc_worker:entry
  34 {
  35         self->trace++;
  36 }
  37 
  38 /*
  39  * If traced and not masked, print entry/return
  40  */
  41 pid$target:*smbd::entry,
  42 pid$target:libmlsvc.so.1::entry,
  43 pid$target:libmlrpc.so.2::entry,
  44 pid$target:libsmbns.so.1::entry,
  45 pid$target:libsmb.so.1::entry
  46 /self->trace > 0 && self->mask == 0/
  47 {
  48         printf("\t0x%x", arg0);
  49         printf("\t0x%x", arg1);
  50         printf("\t0x%x", arg2);
  51         printf("\t0x%x", arg3);
  52         printf("\t0x%x", arg4);
  53         printf("\t0x%x", arg5);
  54 }
  55 
  56 /*
  57  * Mask (don't print) all function calls below these functions.
  58  * These make many boring, repetitive function calls like
  59  * smb_mbtowc, smb_msgbuf_has_space, ...
  60  *
  61  * Also, libmlrpc has rather deep call stacks, particularly under
  62  * ndr_encode_decode_common(), so this stops traces below there.
  63  * Remove that from the mask actions to see the details.
  64  */
  65 pid$target::ht_findfirst:entry,
  66 pid$target::ht_findnext:entry,
  67 pid$target::ndr_encode_decode_common:entry,
  68 pid$target::smb_msgbuf_decode:entry,
  69 pid$target::smb_msgbuf_encode:entry,
  70 pid$target::smb_strlwr:entry,
  71 pid$target::smb_strupr:entry,
  72 pid$target::smb_wcequiv_strlen:entry
  73 {
  74         self->mask++;
  75 }
  76 
  77 /*
  78  * Now inverses of above, unwind order.
  79  */
  80 
  81 pid$target::ht_findfirst:return,
  82 pid$target::ht_findnext:return,
  83 pid$target::ndr_encode_decode_common:return,
  84 pid$target::smb_msgbuf_decode:return,
  85 pid$target::smb_msgbuf_encode:return,
  86 pid$target::smb_strlwr:return,
  87 pid$target::smb_strupr:return,
  88 pid$target::smb_wcequiv_strlen:return
  89 {
  90         self->mask--;
  91 }
  92 
  93 pid$target:*smbd::return,
  94 pid$target:libmlsvc.so.1::return,
  95 pid$target:libmlrpc.so.2::return,
  96 pid$target:libsmbns.so.1::return,
  97 pid$target:libsmb.so.1::return
  98 /self->trace > 0 && self->mask == 0/
  99 {
 100         printf("\t0x%x", arg1);
 101 }
 102 
 103 /*
 104  * This function in libmlrpc prints out lots of internal state.
 105  * Comment it out if you don't want that noise.
 106  */
 107 pid$target:libmlrpc.so.2:ndo_trace:entry
 108 /self->trace > 0 && self->mask == 0/
 109 {
 110         printf("ndo_trace: %s", copyinstr(arg0));
 111 }
 112 
 113 pid$target:*smbd:pipesvc_worker:return
 114 {
 115         self->trace--;
 116 }