granicus.if.org Git - strace/blob - strace.c

   1 /*
   2  * Copyright (c) 1991, 1992 Paul Kranenburg <pk@cs.few.eur.nl>
   3  * Copyright (c) 1993 Branko Lankester <branko@hacktic.nl>
   4  * Copyright (c) 1993, 1994, 1995, 1996 Rick Sladkey <jrs@world.std.com>
   5  * Copyright (c) 1996-1999 Wichert Akkerman <wichert@cistron.nl>
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. The name of the author may not be used to endorse or promote products
  17  *    derived from this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29  *
  30  *      $Id$
  31  */
  32
  33 #include "defs.h"
  34
  35 #include <sys/types.h>
  36 #include <stdarg.h>
  37 #include <signal.h>
  38 #include <errno.h>
  39 #include <sys/param.h>
  40 #include <fcntl.h>
  41 #include <sys/resource.h>
  42 #include <sys/wait.h>
  43 #include <sys/stat.h>
  44 #include <pwd.h>
  45 #include <grp.h>
  46 #include <string.h>
  47 #include <dirent.h>
  48 #include <sys/utsname.h>
  49
  50 #ifdef LINUX
  51 # include <asm/unistd.h>
  52 # if defined __NR_tkill
  53 #  define my_tkill(tid, sig) syscall(__NR_tkill, (tid), (sig))
  54 # else
  55    /* kill() may choose arbitrarily the target task of the process group
  56       while we later wait on a that specific TID.  PID process waits become
  57       TID task specific waits for a process under ptrace(2).  */
  58 #  warning "Neither tkill(2) nor tgkill(2) available, risk of strace hangs!"
  59 #  define my_tkill(tid, sig) kill((tid), (sig))
  60 # endif
  61 #endif
  62
  63 #if defined(IA64) && defined(LINUX)
  64 # include <asm/ptrace_offsets.h>
  65 #endif
  66
  67 #ifdef USE_PROCFS
  68 #include <poll.h>
  69 #endif
  70
  71 #ifdef SVR4
  72 #include <sys/stropts.h>
  73 #ifdef HAVE_MP_PROCFS
  74 #ifdef HAVE_SYS_UIO_H
  75 #include <sys/uio.h>
  76 #endif
  77 #endif
  78 #endif
  79 extern char **environ;
  80 extern int optind;
  81 extern char *optarg;
  82
  83
  84 int debug = 0, followfork = 0;
  85 unsigned int ptrace_setoptions = 0;
  86 /* Which WSTOPSIG(status) value marks syscall traps? */
  87 static unsigned int syscall_trap_sig = SIGTRAP;
  88 int dtime = 0, xflag = 0, qflag = 0;
  89 cflag_t cflag = CFLAG_NONE;
  90 static int iflag = 0, pflag_seen = 0, rflag = 0, tflag = 0;
  91
  92 /* -I n */
  93 enum {
  94     INTR_NOT_SET        = 0,
  95     INTR_ANYWHERE       = 1, /* don't block/ignore any signals */
  96     INTR_WHILE_WAIT     = 2, /* block fatal signals while decoding syscall. default */
  97     INTR_NEVER          = 3, /* block fatal signals. default if '-o FILE PROG' */
  98     INTR_BLOCK_TSTP_TOO = 4, /* block fatal signals and SIGTSTP (^Z) */
  99     NUM_INTR_OPTS
 100 };
 101 static int opt_intr;
 102 /* We play with signal mask only if this mode is active: */
 103 #define interactive (opt_intr == INTR_WHILE_WAIT)
 104
 105 /*
 106  * daemonized_tracer supports -D option.
 107  * With this option, strace forks twice.
 108  * Unlike normal case, with -D *grandparent* process exec's,
 109  * becoming a traced process. Child exits (this prevents traced process
 110  * from having children it doesn't expect to have), and grandchild
 111  * attaches to grandparent similarly to strace -p PID.
 112  * This allows for more transparent interaction in cases
 113  * when process and its parent are communicating via signals,
 114  * wait() etc. Without -D, strace process gets lodged in between,
 115  * disrupting parent<->child link.
 116  */
 117 static bool daemonized_tracer = 0;
 118
 119 #ifdef USE_SEIZE
 120 static int post_attach_sigstop = TCB_IGNORE_ONE_SIGSTOP;
 121 # define use_seize (post_attach_sigstop == 0)
 122 #else
 123 # define post_attach_sigstop TCB_IGNORE_ONE_SIGSTOP
 124 # define use_seize 0
 125 #endif
 126
 127 /* Sometimes we want to print only succeeding syscalls. */
 128 int not_failing_only = 0;
 129
 130 /* Show path associated with fd arguments */
 131 int show_fd_path = 0;
 132
 133 /* are we filtering traces based on paths? */
 134 int tracing_paths = 0;
 135
 136 static int exit_code = 0;
 137 static int strace_child = 0;
 138 static int strace_tracer_pid = 0;
 139
 140 static char *username = NULL;
 141 static uid_t run_uid;
 142 static gid_t run_gid;
 143
 144 int max_strlen = DEFAULT_STRLEN;
 145 static int acolumn = DEFAULT_ACOLUMN;
 146 static char *acolumn_spaces;
 147 static char *outfname = NULL;
 148 static FILE *outf;
 149 struct tcb *printing_tcp = NULL;
 150 static int curcol;
 151 static struct tcb **tcbtab;
 152 static unsigned int nprocs, tcbtabsize;
 153 static const char *progname;
 154
 155 static char *os_release; /* from uname() */
 156
 157 static int detach(struct tcb *tcp);
 158 static int trace(void);
 159 static void cleanup(void);
 160 static void interrupt(int sig);
 161 static sigset_t empty_set, blocked_set;
 162
 163 #ifdef HAVE_SIG_ATOMIC_T
 164 static volatile sig_atomic_t interrupted;
 165 #else
 166 static volatile int interrupted;
 167 #endif
 168
 169 #ifdef USE_PROCFS
 170
 171 static struct tcb *pfd2tcb(int pfd);
 172 static void reaper(int sig);
 173 static void rebuild_pollv(void);
 174 static struct pollfd *pollv;
 175
 176 #ifndef HAVE_POLLABLE_PROCFS
 177
 178 static void proc_poll_open(void);
 179 static void proc_poller(int pfd);
 180
 181 struct proc_pollfd {
 182         int fd;
 183         int revents;
 184         int pid;
 185 };
 186
 187 static int poller_pid;
 188 static int proc_poll_pipe[2] = { -1, -1 };
 189
 190 #endif /* !HAVE_POLLABLE_PROCFS */
 191
 192 #ifdef HAVE_MP_PROCFS
 193 #define POLLWANT        POLLWRNORM
 194 #else
 195 #define POLLWANT        POLLPRI
 196 #endif
 197 #endif /* USE_PROCFS */
 198
 199 static void
 200 usage(FILE *ofp, int exitval)
 201 {
 202         fprintf(ofp, "\
 203 usage: strace [-CdDffhiqrtttTvVxxy] [-I n] [-a column] [-e expr]... [-o file]\n\
 204               [-p pid]... [-s strsize] [-u username] [-E var=val]...\n\
 205               [-P path] [PROG [ARGS]]\n\
 206    or: strace -c [-D] [-I n] [-e expr]... [-O overhead] [-S sortby] [-E var=val]...\n\
 207               [PROG [ARGS]]\n\
 208 -c -- count time, calls, and errors for each syscall and report summary\n\
 209 -C -- like -c but also print regular output while processes are running\n\
 210 -D -- run tracer process as a detached grandchild, not as parent\n\
 211 -f -- follow forks, -ff -- with output into separate files\n\
 212 -F -- attempt to follow vforks\n\
 213 -i -- print instruction pointer at time of syscall\n\
 214 -I interruptible\n\
 215    1: no signals are blocked\n\
 216    2: fatal signals are blocked while decoding syscall (default)\n\
 217    3: fatal signals are always blocked (default if '-o FILE PROG')\n\
 218    4: fatal signals and SIGTSTP (^Z) are always blocked\n\
 219       (useful to make 'strace -o FILE PROG' not stop on ^Z)\n\
 220 -q -- suppress messages about attaching, detaching, etc.\n\
 221 -r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs\n\
 222 -T -- print time spent in each syscall\n\
 223 -v -- verbose mode: print unabbreviated argv, stat, termios, etc. args\n\
 224 -x -- print non-ascii strings in hex, -xx -- print all strings in hex\n\
 225 -y -- print paths associated with file descriptor arguments\n\
 226 -h -- print help message\n\
 227 -V -- print version\n\
 228 -a column -- alignment COLUMN for printing syscall results (default %d)\n\
 229 -e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]...\n\
 230    options: trace, abbrev, verbose, raw, signal, read, or write\n\
 231 -o file -- send trace output to FILE instead of stderr\n\
 232 -O overhead -- set overhead for tracing syscalls to OVERHEAD usecs\n\
 233 -p pid -- trace process with process id PID, may be repeated\n\
 234 -s strsize -- limit length of print strings to STRSIZE chars (default %d)\n\
 235 -S sortby -- sort syscall counts by: time, calls, name, nothing (default %s)\n\
 236 -u username -- run command as username handling setuid and/or setgid\n\
 237 -E var=val -- put var=val in the environment for command\n\
 238 -E var -- remove var from the environment for command\n\
 239 -P path -- trace accesses to path\n\
 240 " /* this is broken, so don't document it
 241 -z -- print only succeeding syscalls\n\
 242   */
 243 , DEFAULT_ACOLUMN, DEFAULT_STRLEN, DEFAULT_SORTBY);
 244         exit(exitval);
 245 }
 246
 247 static void die(void) __attribute__ ((noreturn));
 248 static void die(void)
 249 {
 250         if (strace_tracer_pid == getpid()) {
 251                 cflag = 0;
 252                 cleanup();
 253         }
 254         exit(1);
 255 }
 256
 257 static void verror_msg(int err_no, const char *fmt, va_list p)
 258 {
 259         char *msg;
 260
 261         fflush(NULL);
 262
 263         /* We want to print entire message with single fprintf to ensure
 264          * message integrity if stderr is shared with other programs.
 265          * Thus we use vasprintf + single fprintf.
 266          */
 267         msg = NULL;
 268         if (vasprintf(&msg, fmt, p) >= 0) {
 269                 if (err_no)
 270                         fprintf(stderr, "%s: %s: %s\n", progname, msg, strerror(err_no));
 271                 else
 272                         fprintf(stderr, "%s: %s\n", progname, msg);
 273                 free(msg);
 274         } else {
 275                 /* malloc in vasprintf failed, try it without malloc */
 276                 fprintf(stderr, "%s: ", progname);
 277                 vfprintf(stderr, fmt, p);
 278                 if (err_no)
 279                         fprintf(stderr, ": %s\n", strerror(err_no));
 280                 else
 281                         putc('\n', stderr);
 282         }
 283         /* We don't switch stderr to buffered, thus fprintf(stderr)
 284          * always flushes its output and this is not necessary: */
 285         /* fflush(stderr); */
 286 }
 287
 288 void error_msg(const char *fmt, ...)
 289 {
 290         va_list p;
 291         va_start(p, fmt);
 292         verror_msg(0, fmt, p);
 293         va_end(p);
 294 }
 295
 296 void error_msg_and_die(const char *fmt, ...)
 297 {
 298         va_list p;
 299         va_start(p, fmt);
 300         verror_msg(0, fmt, p);
 301         die();
 302 }
 303
 304 void perror_msg(const char *fmt, ...)
 305 {
 306         va_list p;
 307         va_start(p, fmt);
 308         verror_msg(errno, fmt, p);
 309         va_end(p);
 310 }
 311
 312 void perror_msg_and_die(const char *fmt, ...)
 313 {
 314         va_list p;
 315         va_start(p, fmt);
 316         verror_msg(errno, fmt, p);
 317         die();
 318 }
 319
 320 void die_out_of_memory(void)
 321 {
 322         static bool recursed = 0;
 323         if (recursed)
 324                 exit(1);
 325         recursed = 1;
 326         error_msg_and_die("Out of memory");
 327 }
 328
 329 #ifdef SVR4
 330 #ifdef MIPS
 331 void
 332 foobar()
 333 {
 334 }
 335 #endif /* MIPS */
 336 #endif /* SVR4 */
 337
 338 /* Glue for systems without a MMU that cannot provide fork() */
 339 #ifdef HAVE_FORK
 340 # define strace_vforked 0
 341 #else
 342 # define strace_vforked 1
 343 # define fork()         vfork()
 344 #endif
 345
 346 #ifdef USE_SEIZE
 347 static int
 348 ptrace_attach_or_seize(int pid)
 349 {
 350         int r;
 351         if (!use_seize)
 352                 return ptrace(PTRACE_ATTACH, pid, 0, 0);
 353         r = ptrace(PTRACE_SEIZE, pid, 0, PTRACE_SEIZE_DEVEL);
 354         if (r)
 355                 return r;
 356         r = ptrace(PTRACE_INTERRUPT, pid, 0, 0);
 357         return r;
 358 }
 359 #else
 360 # define ptrace_attach_or_seize(pid) ptrace(PTRACE_ATTACH, (pid), 0, 0)
 361 #endif
 362
 363 static void
 364 set_cloexec_flag(int fd)
 365 {
 366         int flags, newflags;
 367
 368         flags = fcntl(fd, F_GETFD);
 369         if (flags < 0) {
 370                 /* Can happen only if fd is bad.
 371                  * Should never happen: if it does, we have a bug
 372                  * in the caller. Therefore we just abort
 373                  * instead of propagating the error.
 374                  */
 375                 perror_msg_and_die("fcntl(%d, F_GETFD)", fd);
 376         }
 377
 378         newflags = flags | FD_CLOEXEC;
 379         if (flags == newflags)
 380                 return;
 381
 382         fcntl(fd, F_SETFD, newflags); /* never fails */
 383 }
 384
 385 /*
 386  * When strace is setuid executable, we have to swap uids
 387  * before and after filesystem and process management operations.
 388  */
 389 static void
 390 swap_uid(void)
 391 {
 392 #ifndef SVR4
 393         int euid = geteuid(), uid = getuid();
 394
 395         if (euid != uid && setreuid(euid, uid) < 0) {
 396                 perror_msg_and_die("setreuid");
 397         }
 398 #endif
 399 }
 400
 401 #if _LFS64_LARGEFILE
 402 # define fopen_for_output fopen64
 403 #else
 404 # define fopen_for_output fopen
 405 #endif
 406
 407 static FILE *
 408 strace_fopen(const char *path)
 409 {
 410         FILE *fp;
 411
 412         swap_uid();
 413         fp = fopen_for_output(path, "w");
 414         if (!fp)
 415                 perror_msg_and_die("Can't fopen '%s'", path);
 416         swap_uid();
 417         set_cloexec_flag(fileno(fp));
 418         return fp;
 419 }
 420
 421 static int popen_pid = 0;
 422
 423 #ifndef _PATH_BSHELL
 424 # define _PATH_BSHELL "/bin/sh"
 425 #endif
 426
 427 /*
 428  * We cannot use standard popen(3) here because we have to distinguish
 429  * popen child process from other processes we trace, and standard popen(3)
 430  * does not export its child's pid.
 431  */
 432 static FILE *
 433 strace_popen(const char *command)
 434 {
 435         FILE *fp;
 436         int fds[2];
 437
 438         swap_uid();
 439         if (pipe(fds) < 0)
 440                 perror_msg_and_die("pipe");
 441
 442         set_cloexec_flag(fds[1]); /* never fails */
 443
 444         popen_pid = vfork();
 445         if (popen_pid == -1)
 446                 perror_msg_and_die("vfork");
 447
 448         if (popen_pid == 0) {
 449                 /* child */
 450                 close(fds[1]);
 451                 if (fds[0] != 0) {
 452                         if (dup2(fds[0], 0))
 453                                 perror_msg_and_die("dup2");
 454                         close(fds[0]);
 455                 }
 456                 execl(_PATH_BSHELL, "sh", "-c", command, NULL);
 457                 perror_msg_and_die("Can't execute '%s'", _PATH_BSHELL);
 458         }
 459
 460         /* parent */
 461         close(fds[0]);
 462         swap_uid();
 463         fp = fdopen(fds[1], "w");
 464         if (!fp)
 465                 die_out_of_memory();
 466         return fp;
 467 }
 468
 469 static void
 470 newoutf(struct tcb *tcp)
 471 {
 472         if (outfname && followfork > 1) {
 473                 char name[520 + sizeof(int) * 3];
 474                 sprintf(name, "%.512s.%u", outfname, tcp->pid);
 475                 tcp->outf = strace_fopen(name);
 476         }
 477 }
 478
 479 static void
 480 startup_attach(void)
 481 {
 482         int tcbi;
 483         struct tcb *tcp;
 484
 485         /*
 486          * Block user interruptions as we would leave the traced
 487          * process stopped (process state T) if we would terminate in
 488          * between PTRACE_ATTACH and wait4() on SIGSTOP.
 489          * We rely on cleanup() from this point on.
 490          */
 491         if (interactive)
 492                 sigprocmask(SIG_BLOCK, &blocked_set, NULL);
 493
 494         if (daemonized_tracer) {
 495                 pid_t pid = fork();
 496                 if (pid < 0) {
 497                         perror_msg_and_die("fork");
 498                 }
 499                 if (pid) { /* parent */
 500                         /*
 501                          * Wait for grandchild to attach to straced process
 502                          * (grandparent). Grandchild SIGKILLs us after it attached.
 503                          * Grandparent's wait() is unblocked by our death,
 504                          * it proceeds to exec the straced program.
 505                          */
 506                         pause();
 507                         _exit(0); /* paranoia */
 508                 }
 509                 /* grandchild */
 510                 /* We will be the tracer process. Remember our new pid: */
 511                 strace_tracer_pid = getpid();
 512         }
 513
 514         for (tcbi = 0; tcbi < tcbtabsize; tcbi++) {
 515                 tcp = tcbtab[tcbi];
 516
 517                 /* Is this a process we should attach to, but not yet attached? */
 518                 if ((tcp->flags & (TCB_ATTACHED | TCB_STARTUP)) != TCB_ATTACHED)
 519                         continue; /* no */
 520
 521                 /* Reinitialize the output since it may have changed */
 522                 tcp->outf = outf;
 523                 newoutf(tcp);
 524
 525 #ifdef USE_PROCFS
 526                 if (proc_open(tcp, 1) < 0) {
 527                         fprintf(stderr, "trouble opening proc file\n");
 528                         droptcb(tcp);
 529                         continue;
 530                 }
 531 #else /* !USE_PROCFS */
 532 # ifdef LINUX
 533                 if (followfork && !daemonized_tracer) {
 534                         char procdir[sizeof("/proc/%d/task") + sizeof(int) * 3];
 535                         DIR *dir;
 536
 537                         sprintf(procdir, "/proc/%d/task", tcp->pid);
 538                         dir = opendir(procdir);
 539                         if (dir != NULL) {
 540                                 unsigned int ntid = 0, nerr = 0;
 541                                 struct dirent *de;
 542
 543                                 while ((de = readdir(dir)) != NULL) {
 544                                         struct tcb *cur_tcp;
 545                                         int tid;
 546
 547                                         if (de->d_fileno == 0)
 548                                                 continue;
 549                                         tid = atoi(de->d_name);
 550                                         if (tid <= 0)
 551                                                 continue;
 552                                         ++ntid;
 553                                         if (ptrace_attach_or_seize(tid) < 0) {
 554                                                 ++nerr;
 555                                                 if (debug)
 556                                                         fprintf(stderr, "attach to pid %d failed\n", tid);
 557                                                 continue;
 558                                         }
 559                                         if (debug)
 560                                                 fprintf(stderr, "attach to pid %d succeeded\n", tid);
 561                                         cur_tcp = tcp;
 562                                         if (tid != tcp->pid)
 563                                                 cur_tcp = alloctcb(tid);
 564                                         cur_tcp->flags |= TCB_ATTACHED | TCB_STARTUP | post_attach_sigstop;
 565                                 }
 566                                 closedir(dir);
 567                                 if (interactive) {
 568                                         sigprocmask(SIG_SETMASK, &empty_set, NULL);
 569                                         if (interrupted)
 570                                                 goto ret;
 571                                         sigprocmask(SIG_BLOCK, &blocked_set, NULL);
 572                                 }
 573                                 ntid -= nerr;
 574                                 if (ntid == 0) {
 575                                         perror("attach: ptrace(PTRACE_ATTACH, ...)");
 576                                         droptcb(tcp);
 577                                         continue;
 578                                 }
 579                                 if (!qflag) {
 580                                         fprintf(stderr, ntid > 1
 581 ? "Process %u attached with %u threads - interrupt to quit\n"
 582 : "Process %u attached - interrupt to quit\n",
 583                                                 tcp->pid, ntid);
 584                                 }
 585                                 if (!(tcp->flags & TCB_STARTUP)) {
 586                                         /* -p PID, we failed to attach to PID itself
 587                                          * but did attach to some of its sibling threads.
 588                                          * Drop PID's tcp.
 589                                          */
 590                                         droptcb(tcp);
 591                                 }
 592                                 continue;
 593                         } /* if (opendir worked) */
 594                 } /* if (-f) */
 595 # endif /* LINUX */
 596                 if (ptrace_attach_or_seize(tcp->pid) < 0) {
 597                         perror("attach: ptrace(PTRACE_ATTACH, ...)");
 598                         droptcb(tcp);
 599                         continue;
 600                 }
 601                 tcp->flags |= TCB_STARTUP | post_attach_sigstop;
 602                 if (debug)
 603                         fprintf(stderr, "attach to pid %d (main) succeeded\n", tcp->pid);
 604
 605                 if (daemonized_tracer) {
 606                         /*
 607                          * It is our grandparent we trace, not a -p PID.
 608                          * Don't want to just detach on exit, so...
 609                          */
 610                         tcp->flags &= ~TCB_ATTACHED;
 611                         /*
 612                          * Make parent go away.
 613                          * Also makes grandparent's wait() unblock.
 614                          */
 615                         kill(getppid(), SIGKILL);
 616                 }
 617
 618 #endif /* !USE_PROCFS */
 619                 if (!qflag)
 620                         fprintf(stderr,
 621                                 "Process %u attached - interrupt to quit\n",
 622                                 tcp->pid);
 623         } /* for each tcbtab[] */
 624
 625  ret:
 626         if (interactive)
 627                 sigprocmask(SIG_SETMASK, &empty_set, NULL);
 628 }
 629
 630 static void
 631 startup_child(char **argv)
 632 {
 633         struct stat statbuf;
 634         const char *filename;
 635         char pathname[MAXPATHLEN];
 636         int pid = 0;
 637         struct tcb *tcp;
 638
 639         filename = argv[0];
 640         if (strchr(filename, '/')) {
 641                 if (strlen(filename) > sizeof pathname - 1) {
 642                         errno = ENAMETOOLONG;
 643                         perror_msg_and_die("exec");
 644                 }
 645                 strcpy(pathname, filename);
 646         }
 647 #ifdef USE_DEBUGGING_EXEC
 648         /*
 649          * Debuggers customarily check the current directory
 650          * first regardless of the path but doing that gives
 651          * security geeks a panic attack.
 652          */
 653         else if (stat(filename, &statbuf) == 0)
 654                 strcpy(pathname, filename);
 655 #endif /* USE_DEBUGGING_EXEC */
 656         else {
 657                 const char *path;
 658                 int m, n, len;
 659
 660                 for (path = getenv("PATH"); path && *path; path += m) {
 661                         const char *colon = strchr(path, ':');
 662                         if (colon) {
 663                                 n = colon - path;
 664                                 m = n + 1;
 665                         }
 666                         else
 667                                 m = n = strlen(path);
 668                         if (n == 0) {
 669                                 if (!getcwd(pathname, MAXPATHLEN))
 670                                         continue;
 671                                 len = strlen(pathname);
 672                         }
 673                         else if (n > sizeof pathname - 1)
 674                                 continue;
 675                         else {
 676                                 strncpy(pathname, path, n);
 677                                 len = n;
 678                         }
 679                         if (len && pathname[len - 1] != '/')
 680                                 pathname[len++] = '/';
 681                         strcpy(pathname + len, filename);
 682                         if (stat(pathname, &statbuf) == 0 &&
 683                             /* Accept only regular files
 684                                with some execute bits set.
 685                                XXX not perfect, might still fail */
 686                             S_ISREG(statbuf.st_mode) &&
 687                             (statbuf.st_mode & 0111))
 688                                 break;
 689                 }
 690         }
 691         if (stat(pathname, &statbuf) < 0) {
 692                 perror_msg_and_die("Can't stat '%s'", filename);
 693         }
 694         strace_child = pid = fork();
 695         if (pid < 0) {
 696                 perror_msg_and_die("fork");
 697         }
 698         if ((pid != 0 && daemonized_tracer) /* -D: parent to become a traced process */
 699          || (pid == 0 && !daemonized_tracer) /* not -D: child to become a traced process */
 700         ) {
 701                 pid = getpid();
 702                 if (outf != stderr)
 703                         close(fileno(outf));
 704 #ifdef USE_PROCFS
 705 # ifdef MIPS
 706                 /* Kludge for SGI, see proc_open for details. */
 707                 sa.sa_handler = foobar;
 708                 sa.sa_flags = 0;
 709                 sigemptyset(&sa.sa_mask);
 710                 sigaction(SIGINT, &sa, NULL);
 711 # endif
 712 # ifndef FREEBSD
 713                 pause();
 714 # else
 715                 kill(pid, SIGSTOP);
 716 # endif
 717 #else /* !USE_PROCFS */
 718                 if (!daemonized_tracer && !use_seize) {
 719                         if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) < 0) {
 720                                 perror_msg_and_die("ptrace(PTRACE_TRACEME, ...)");
 721                         }
 722                 }
 723
 724                 if (username != NULL) {
 725                         uid_t run_euid = run_uid;
 726                         gid_t run_egid = run_gid;
 727
 728                         if (statbuf.st_mode & S_ISUID)
 729                                 run_euid = statbuf.st_uid;
 730                         if (statbuf.st_mode & S_ISGID)
 731                                 run_egid = statbuf.st_gid;
 732                         /*
 733                          * It is important to set groups before we
 734                          * lose privileges on setuid.
 735                          */
 736                         if (initgroups(username, run_gid) < 0) {
 737                                 perror_msg_and_die("initgroups");
 738                         }
 739                         if (setregid(run_gid, run_egid) < 0) {
 740                                 perror_msg_and_die("setregid");
 741                         }
 742                         if (setreuid(run_uid, run_euid) < 0) {
 743                                 perror_msg_and_die("setreuid");
 744                         }
 745                 }
 746                 else if (geteuid() != 0)
 747                         setreuid(run_uid, run_uid);
 748
 749                 if (!daemonized_tracer) {
 750                         /*
 751                          * Induce a ptrace stop. Tracer (our parent)
 752                          * will resume us with PTRACE_SYSCALL and display
 753                          * the immediately following execve syscall.
 754                          * Can't do this on NOMMU systems, we are after
 755                          * vfork: parent is blocked, stopping would deadlock.
 756                          */
 757                         if (!strace_vforked)
 758                                 kill(pid, SIGSTOP);
 759                 } else {
 760                         struct sigaction sv_sigchld;
 761                         sigaction(SIGCHLD, NULL, &sv_sigchld);
 762                         /*
 763                          * Make sure it is not SIG_IGN, otherwise wait
 764                          * will not block.
 765                          */
 766                         signal(SIGCHLD, SIG_DFL);
 767                         /*
 768                          * Wait for grandchild to attach to us.
 769                          * It kills child after that, and wait() unblocks.
 770                          */
 771                         alarm(3);
 772                         wait(NULL);
 773                         alarm(0);
 774                         sigaction(SIGCHLD, &sv_sigchld, NULL);
 775                 }
 776 #endif /* !USE_PROCFS */
 777
 778                 execv(pathname, argv);
 779                 perror_msg_and_die("exec");
 780         }
 781
 782         /* We are the tracer */
 783
 784         if (!daemonized_tracer) {
 785                 if (!use_seize) {
 786                         /* child did PTRACE_TRACEME, nothing to do in parent */
 787                 } else {
 788                         if (!strace_vforked) {
 789                                 /* Wait until child stopped itself */
 790                                 int status;
 791                                 while (waitpid(pid, &status, WSTOPPED) < 0) {
 792                                         if (errno == EINTR)
 793                                                 continue;
 794                                         perror_msg_and_die("waitpid");
 795                                 }
 796                                 if (!WIFSTOPPED(status) || WSTOPSIG(status) != SIGSTOP) {
 797                                         kill(pid, SIGKILL);
 798                                         perror_msg_and_die("Unexpected wait status %x", status);
 799                                 }
 800                         }
 801                         /* Else: vforked case, we have no way to sync.
 802                          * Just attach to it as soon as possible.
 803                          * This means that we may miss a few first syscalls...
 804                          */
 805
 806                         if (ptrace_attach_or_seize(pid)) {
 807                                 kill(pid, SIGKILL);
 808                                 perror_msg_and_die("Can't attach to %d", pid);
 809                         }
 810                         if (!strace_vforked)
 811                                 kill(pid, SIGCONT);
 812                 }
 813                 tcp = alloctcb(pid);
 814                 if (!strace_vforked)
 815                         tcp->flags |= TCB_STARTUP | post_attach_sigstop;
 816                 else
 817                         tcp->flags |= TCB_STARTUP;
 818         }
 819         else {
 820                 /* With -D, *we* are child here, IOW: different pid. Fetch it: */
 821                 strace_tracer_pid = getpid();
 822                 /* The tracee is our parent: */
 823                 pid = getppid();
 824                 tcp = alloctcb(pid);
 825                 /* We want subsequent startup_attach() to attach to it: */
 826                 tcp->flags |= TCB_ATTACHED;
 827         }
 828 #ifdef USE_PROCFS
 829         if (proc_open(tcp, 0) < 0) {
 830                 perror_msg_and_die("trouble opening proc file");
 831         }
 832 #endif
 833 }
 834
 835 #ifdef LINUX
 836 static void kill_save_errno(pid_t pid, int sig)
 837 {
 838         int saved_errno = errno;
 839
 840         (void) kill(pid, sig);
 841         errno = saved_errno;
 842 }
 843
 844 /*
 845  * Test whether the kernel support PTRACE_O_TRACECLONE et al options.
 846  * First fork a new child, call ptrace with PTRACE_SETOPTIONS on it,
 847  * and then see which options are supported by the kernel.
 848  */
 849 static void
 850 test_ptrace_setoptions_followfork(void)
 851 {
 852         int pid, expected_grandchild = 0, found_grandchild = 0;
 853         const unsigned int test_options = PTRACE_O_TRACECLONE |
 854                                           PTRACE_O_TRACEFORK |
 855                                           PTRACE_O_TRACEVFORK;
 856
 857         pid = fork();
 858         if (pid < 0)
 859                 perror_msg_and_die("fork");
 860         if (pid == 0) {
 861                 pid = getpid();
 862                 if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) < 0)
 863                         perror_msg_and_die("%s: PTRACE_TRACEME doesn't work",
 864                                            __func__);
 865                 kill(pid, SIGSTOP);
 866                 if (fork() < 0)
 867                         perror_msg_and_die("fork");
 868                 _exit(0);
 869         }
 870
 871         while (1) {
 872                 int status, tracee_pid;
 873
 874                 errno = 0;
 875                 tracee_pid = wait(&status);
 876                 if (tracee_pid <= 0) {
 877                         if (errno == EINTR)
 878                                 continue;
 879                         else if (errno == ECHILD)
 880                                 break;
 881                         kill_save_errno(pid, SIGKILL);
 882                         perror_msg_and_die("%s: unexpected wait result %d",
 883                                            __func__, tracee_pid);
 884                 }
 885                 if (WIFEXITED(status)) {
 886                         if (WEXITSTATUS(status)) {
 887                                 if (tracee_pid != pid)
 888                                         kill_save_errno(pid, SIGKILL);
 889                                 error_msg_and_die("%s: unexpected exit status %u",
 890                                                   __func__, WEXITSTATUS(status));
 891                         }
 892                         continue;
 893                 }
 894                 if (WIFSIGNALED(status)) {
 895                         if (tracee_pid != pid)
 896                                 kill_save_errno(pid, SIGKILL);
 897                         error_msg_and_die("%s: unexpected signal %u",
 898                                           __func__, WTERMSIG(status));
 899                 }
 900                 if (!WIFSTOPPED(status)) {
 901                         if (tracee_pid != pid)
 902                                 kill_save_errno(tracee_pid, SIGKILL);
 903                         kill(pid, SIGKILL);
 904                         error_msg_and_die("%s: unexpected wait status %x",
 905                                           __func__, status);
 906                 }
 907                 if (tracee_pid != pid) {
 908                         found_grandchild = tracee_pid;
 909                         if (ptrace(PTRACE_CONT, tracee_pid, 0, 0) < 0) {
 910                                 kill_save_errno(tracee_pid, SIGKILL);
 911                                 kill_save_errno(pid, SIGKILL);
 912                                 perror_msg_and_die("PTRACE_CONT doesn't work");
 913                         }
 914                         continue;
 915                 }
 916                 switch (WSTOPSIG(status)) {
 917                 case SIGSTOP:
 918                         if (ptrace(PTRACE_SETOPTIONS, pid, 0, test_options) < 0
 919                             && errno != EINVAL && errno != EIO)
 920                                 perror_msg("PTRACE_SETOPTIONS");
 921                         break;
 922                 case SIGTRAP:
 923                         if (status >> 16 == PTRACE_EVENT_FORK) {
 924                                 long msg = 0;
 925
 926                                 if (ptrace(PTRACE_GETEVENTMSG, pid,
 927                                            NULL, (long) &msg) == 0)
 928                                         expected_grandchild = msg;
 929                         }
 930                         break;
 931                 }
 932                 if (ptrace(PTRACE_SYSCALL, pid, 0, 0) < 0) {
 933                         kill_save_errno(pid, SIGKILL);
 934                         perror_msg_and_die("PTRACE_SYSCALL doesn't work");
 935                 }
 936         }
 937         if (expected_grandchild && expected_grandchild == found_grandchild) {
 938                 ptrace_setoptions |= test_options;
 939                 if (debug)
 940                         fprintf(stderr, "ptrace_setoptions = %#x\n",
 941                                 ptrace_setoptions);
 942                 return;
 943         }
 944         error_msg("Test for PTRACE_O_TRACECLONE failed, "
 945                   "giving up using this feature.");
 946 }
 947
 948 /*
 949  * Test whether the kernel support PTRACE_O_TRACESYSGOOD.
 950  * First fork a new child, call ptrace(PTRACE_SETOPTIONS) on it,
 951  * and then see whether it will stop with (SIGTRAP | 0x80).
 952  *
 953  * Use of this option enables correct handling of user-generated SIGTRAPs,
 954  * and SIGTRAPs generated by special instructions such as int3 on x86:
 955  * _start:      .globl  _start
 956  *              int3
 957  *              movl    $42, %ebx
 958  *              movl    $1, %eax
 959  *              int     $0x80
 960  * (compile with: "gcc -nostartfiles -nostdlib -o int3 int3.S")
 961  */
 962 static void
 963 test_ptrace_setoptions_for_all(void)
 964 {
 965         const unsigned int test_options = PTRACE_O_TRACESYSGOOD |
 966                                           PTRACE_O_TRACEEXEC;
 967         int pid;
 968         int it_worked = 0;
 969
 970         pid = fork();
 971         if (pid < 0)
 972                 perror_msg_and_die("fork");
 973
 974         if (pid == 0) {
 975                 pid = getpid();
 976                 if (ptrace(PTRACE_TRACEME, 0L, 0L, 0L) < 0)
 977                         /* Note: exits with exitcode 1 */
 978                         perror_msg_and_die("%s: PTRACE_TRACEME doesn't work",
 979                                            __func__);
 980                 kill(pid, SIGSTOP);
 981                 _exit(0); /* parent should see entry into this syscall */
 982         }
 983
 984         while (1) {
 985                 int status, tracee_pid;
 986
 987                 errno = 0;
 988                 tracee_pid = wait(&status);
 989                 if (tracee_pid <= 0) {
 990                         if (errno == EINTR)
 991                                 continue;
 992                         kill_save_errno(pid, SIGKILL);
 993                         perror_msg_and_die("%s: unexpected wait result %d",
 994                                            __func__, tracee_pid);
 995                 }
 996                 if (WIFEXITED(status)) {
 997                         if (WEXITSTATUS(status) == 0)
 998                                 break;
 999                         error_msg_and_die("%s: unexpected exit status %u",
1000                                           __func__, WEXITSTATUS(status));
1001                 }
1002                 if (WIFSIGNALED(status)) {
1003                         error_msg_and_die("%s: unexpected signal %u",
1004                                           __func__, WTERMSIG(status));
1005                 }
1006                 if (!WIFSTOPPED(status)) {
1007                         kill(pid, SIGKILL);
1008                         error_msg_and_die("%s: unexpected wait status %x",
1009                                           __func__, status);
1010                 }
1011                 if (WSTOPSIG(status) == SIGSTOP) {
1012                         /*
1013                          * We don't check "options aren't accepted" error.
1014                          * If it happens, we'll never get (SIGTRAP | 0x80),
1015                          * and thus will decide to not use the option.
1016                          * IOW: the outcome of the test will be correct.
1017                          */
1018                         if (ptrace(PTRACE_SETOPTIONS, pid, 0L, test_options) < 0
1019                             && errno != EINVAL && errno != EIO)
1020                                 perror_msg("PTRACE_SETOPTIONS");
1021                 }
1022                 if (WSTOPSIG(status) == (SIGTRAP | 0x80)) {
1023                         it_worked = 1;
1024                 }
1025                 if (ptrace(PTRACE_SYSCALL, pid, 0L, 0L) < 0) {
1026                         kill_save_errno(pid, SIGKILL);
1027                         perror_msg_and_die("PTRACE_SYSCALL doesn't work");
1028                 }
1029         }
1030
1031         if (it_worked) {
1032                 syscall_trap_sig = (SIGTRAP | 0x80);
1033                 ptrace_setoptions |= test_options;
1034                 if (debug)
1035                         fprintf(stderr, "ptrace_setoptions = %#x\n",
1036                                 ptrace_setoptions);
1037                 return;
1038         }
1039
1040         error_msg("Test for PTRACE_O_TRACESYSGOOD failed, "
1041                   "giving up using this feature.");
1042 }
1043
1044 # ifdef USE_SEIZE
1045 static void
1046 test_ptrace_seize(void)
1047 {
1048         int pid;
1049
1050         pid = fork();
1051         if (pid < 0)
1052                 perror_msg_and_die("fork");
1053
1054         if (pid == 0) {
1055                 pause();
1056                 _exit(0);
1057         }
1058
1059         /* PTRACE_SEIZE, unlike ATTACH, doesn't force tracee to trap.  After
1060          * attaching tracee continues to run unless a trap condition occurs.
1061          * PTRACE_SEIZE doesn't affect signal or group stop state.
1062          */
1063         if (ptrace(PTRACE_SEIZE, pid, 0, PTRACE_SEIZE_DEVEL) == 0) {
1064                 post_attach_sigstop = 0; /* this sets use_seize to 1 */
1065         } else if (debug) {
1066                 fprintf(stderr, "PTRACE_SEIZE doesn't work\n");
1067         }
1068
1069         kill(pid, SIGKILL);
1070
1071         while (1) {
1072                 int status, tracee_pid;
1073
1074                 errno = 0;
1075                 tracee_pid = waitpid(pid, &status, 0);
1076                 if (tracee_pid <= 0) {
1077                         if (errno == EINTR)
1078                                 continue;
1079                         perror_msg_and_die("%s: unexpected wait result %d",
1080                                          __func__, tracee_pid);
1081                 }
1082                 if (WIFSIGNALED(status)) {
1083                         return;
1084                 }
1085                 error_msg_and_die("%s: unexpected wait status %x",
1086                                 __func__, status);
1087         }
1088 }
1089 # else /* !USE_SEIZE */
1090 #  define test_ptrace_seize() ((void)0)
1091 # endif
1092
1093 #endif
1094
1095 /* Noinline: don't want main to have struct utsname permanently on stack */
1096 static void __attribute__ ((noinline))
1097 get_os_release(void)
1098 {
1099         struct utsname u;
1100         if (uname(&u) < 0)
1101                 perror_msg_and_die("uname");
1102         os_release = strdup(u.release);
1103         if (!os_release)
1104                 die_out_of_memory();
1105 }
1106
1107 int
1108 main(int argc, char *argv[])
1109 {
1110         struct tcb *tcp;
1111         int c, pid = 0;
1112         int optF = 0;
1113         struct sigaction sa;
1114
1115         progname = argv[0] ? argv[0] : "strace";
1116
1117         strace_tracer_pid = getpid();
1118
1119         get_os_release();
1120
1121         /* Allocate the initial tcbtab.  */
1122         tcbtabsize = argc;      /* Surely enough for all -p args.  */
1123         tcbtab = calloc(tcbtabsize, sizeof(tcbtab[0]));
1124         if (!tcbtab)
1125                 die_out_of_memory();
1126         tcp = calloc(tcbtabsize, sizeof(*tcp));
1127         if (!tcp)
1128                 die_out_of_memory();
1129         for (c = 0; c < tcbtabsize; c++)
1130                 tcbtab[c] = tcp++;
1131
1132         outf = stderr;
1133         set_sortby(DEFAULT_SORTBY);
1134         set_personality(DEFAULT_PERSONALITY);
1135         qualify("trace=all");
1136         qualify("abbrev=all");
1137         qualify("verbose=all");
1138         qualify("signal=all");
1139         while ((c = getopt(argc, argv,
1140                 "+cCdfFhiqrtTvVxyz"
1141 #ifndef USE_PROCFS
1142                 "D"
1143 #endif
1144                 "a:e:o:O:p:s:S:u:E:P:I:")) != EOF) {
1145                 switch (c) {
1146                 case 'c':
1147                         if (cflag == CFLAG_BOTH) {
1148                                 error_msg_and_die("-c and -C are mutually exclusive options");
1149                         }
1150                         cflag = CFLAG_ONLY_STATS;
1151                         break;
1152                 case 'C':
1153                         if (cflag == CFLAG_ONLY_STATS) {
1154                                 error_msg_and_die("-c and -C are mutually exclusive options");
1155                         }
1156                         cflag = CFLAG_BOTH;
1157                         break;
1158                 case 'd':
1159                         debug++;
1160                         break;
1161 #ifndef USE_PROCFS
1162                 case 'D':
1163                         daemonized_tracer = 1;
1164                         break;
1165 #endif
1166                 case 'F':
1167                         optF = 1;
1168                         break;
1169                 case 'f':
1170                         followfork++;
1171                         break;
1172                 case 'h':
1173                         usage(stdout, 0);
1174                         break;
1175                 case 'i':
1176                         iflag++;
1177                         break;
1178                 case 'q':
1179                         qflag++;
1180                         break;
1181                 case 'r':
1182                         rflag++;
1183                         tflag++;
1184                         break;
1185                 case 't':
1186                         tflag++;
1187                         break;
1188                 case 'T':
1189                         dtime++;
1190                         break;
1191                 case 'x':
1192                         xflag++;
1193                         break;
1194                 case 'y':
1195                         show_fd_path = 1;
1196                         break;
1197                 case 'v':
1198                         qualify("abbrev=none");
1199                         break;
1200                 case 'V':
1201                         printf("%s -- version %s\n", PACKAGE_NAME, VERSION);
1202                         exit(0);
1203                         break;
1204                 case 'z':
1205                         not_failing_only = 1;
1206                         break;
1207                 case 'a':
1208                         acolumn = atoi(optarg);
1209                         if (acolumn < 0)
1210                                 error_msg_and_die("Bad column width '%s'", optarg);
1211                         break;
1212                 case 'e':
1213                         qualify(optarg);
1214                         break;
1215                 case 'o':
1216                         outfname = strdup(optarg);
1217                         break;
1218                 case 'O':
1219                         set_overhead(atoi(optarg));
1220                         break;
1221                 case 'p':
1222                         pid = atoi(optarg);
1223                         if (pid <= 0) {
1224                                 error_msg("Invalid process id: '%s'", optarg);
1225                                 break;
1226                         }
1227                         if (pid == strace_tracer_pid) {
1228                                 error_msg("I'm sorry, I can't let you do that, Dave.");
1229                                 break;
1230                         }
1231                         tcp = alloc_tcb(pid, 0);
1232                         tcp->flags |= TCB_ATTACHED;
1233                         pflag_seen++;
1234                         break;
1235                 case 'P':
1236                         tracing_paths = 1;
1237                         if (pathtrace_select(optarg)) {
1238                                 error_msg_and_die("Failed to select path '%s'", optarg);
1239                         }
1240                         break;
1241                 case 's':
1242                         max_strlen = atoi(optarg);
1243                         if (max_strlen < 0) {
1244                                 error_msg_and_die("Invalid -%c argument: '%s'", c, optarg);
1245                         }
1246                         break;
1247                 case 'S':
1248                         set_sortby(optarg);
1249                         break;
1250                 case 'u':
1251                         username = strdup(optarg);
1252                         break;
1253                 case 'E':
1254                         if (putenv(optarg) < 0)
1255                                 die_out_of_memory();
1256                         break;
1257                 case 'I':
1258                         opt_intr = atoi(optarg);
1259                         if (opt_intr <= 0 || opt_intr >= NUM_INTR_OPTS) {
1260                                 error_msg_and_die("Invalid -%c argument: '%s'", c, optarg);
1261                         }
1262                         break;
1263                 default:
1264                         usage(stderr, 1);
1265                         break;
1266                 }
1267         }
1268         argv += optind;
1269         /* argc -= optind; - no need, argc is not used below */
1270
1271         acolumn_spaces = malloc(acolumn + 1);
1272         if (!acolumn_spaces)
1273                 die_out_of_memory();
1274         memset(acolumn_spaces, ' ', acolumn);
1275         acolumn_spaces[acolumn] = '\0';
1276
1277         /* Must have PROG [ARGS], or -p PID. Not both. */
1278         if (!argv[0] == !pflag_seen)
1279                 usage(stderr, 1);
1280
1281         if (pflag_seen && daemonized_tracer) {
1282                 error_msg_and_die("-D and -p are mutually exclusive options");
1283         }
1284
1285         if (!followfork)
1286                 followfork = optF;
1287
1288         if (followfork > 1 && cflag) {
1289                 error_msg_and_die("(-c or -C) and -ff are mutually exclusive options");
1290         }
1291
1292         /* See if they want to run as another user. */
1293         if (username != NULL) {
1294                 struct passwd *pent;
1295
1296                 if (getuid() != 0 || geteuid() != 0) {
1297                         error_msg_and_die("You must be root to use the -u option");
1298                 }
1299                 pent = getpwnam(username);
1300                 if (pent == NULL) {
1301                         error_msg_and_die("Cannot find user '%s'", username);
1302                 }
1303                 run_uid = pent->pw_uid;
1304                 run_gid = pent->pw_gid;
1305         }
1306         else {
1307                 run_uid = getuid();
1308                 run_gid = getgid();
1309         }
1310
1311 #ifdef LINUX
1312         if (followfork)
1313                 test_ptrace_setoptions_followfork();
1314         test_ptrace_setoptions_for_all();
1315         test_ptrace_seize();
1316 #endif
1317
1318         /* Check if they want to redirect the output. */
1319         if (outfname) {
1320                 /* See if they want to pipe the output. */
1321                 if (outfname[0] == '|' || outfname[0] == '!') {
1322                         /*
1323                          * We can't do the <outfname>.PID funny business
1324                          * when using popen, so prohibit it.
1325                          */
1326                         if (followfork > 1)
1327                                 error_msg_and_die("Piping the output and -ff are mutually exclusive");
1328                         outf = strace_popen(outfname + 1);
1329                 }
1330                 else if (followfork <= 1)
1331                         outf = strace_fopen(outfname);
1332         }
1333
1334         if (!outfname || outfname[0] == '|' || outfname[0] == '!') {
1335                 char *buf = malloc(BUFSIZ);
1336                 if (!buf)
1337                         die_out_of_memory();
1338                 setvbuf(outf, buf, _IOLBF, BUFSIZ);
1339         }
1340         if (outfname && argv[0]) {
1341                 if (!opt_intr)
1342                         opt_intr = INTR_NEVER;
1343                 qflag = 1;
1344         }
1345         if (!opt_intr)
1346                 opt_intr = INTR_WHILE_WAIT;
1347
1348         /* argv[0]      -pPID   -oFILE  Default interactive setting
1349          * yes          0       0       INTR_WHILE_WAIT
1350          * no           1       0       INTR_WHILE_WAIT
1351          * yes          0       1       INTR_NEVER
1352          * no           1       1       INTR_WHILE_WAIT
1353          */
1354
1355         /* STARTUP_CHILD must be called before the signal handlers get
1356            installed below as they are inherited into the spawned process.
1357            Also we do not need to be protected by them as during interruption
1358            in the STARTUP_CHILD mode we kill the spawned process anyway.  */
1359         if (argv[0])
1360                 startup_child(argv);
1361
1362         sigemptyset(&empty_set);
1363         sigemptyset(&blocked_set);
1364         sa.sa_handler = SIG_IGN;
1365         sigemptyset(&sa.sa_mask);
1366         sa.sa_flags = 0;
1367         sigaction(SIGTTOU, &sa, NULL); /* SIG_IGN */
1368         sigaction(SIGTTIN, &sa, NULL); /* SIG_IGN */
1369         if (opt_intr != INTR_ANYWHERE) {
1370                 if (opt_intr == INTR_BLOCK_TSTP_TOO)
1371                         sigaction(SIGTSTP, &sa, NULL); /* SIG_IGN */
1372                 /*
1373                  * In interactive mode (if no -o OUTFILE, or -p PID is used),
1374                  * fatal signals are blocked while syscall stop is processed,
1375                  * and acted on in between, when waiting for new syscall stops.
1376                  * In non-interactive mode, signals are ignored.
1377                  */
1378                 if (opt_intr == INTR_WHILE_WAIT) {
1379                         sigaddset(&blocked_set, SIGHUP);
1380                         sigaddset(&blocked_set, SIGINT);
1381                         sigaddset(&blocked_set, SIGQUIT);
1382                         sigaddset(&blocked_set, SIGPIPE);
1383                         sigaddset(&blocked_set, SIGTERM);
1384                         sa.sa_handler = interrupt;
1385 #ifdef SUNOS4
1386                         /* POSIX signals on sunos4.1 are a little broken. */
1387                         sa.sa_flags = SA_INTERRUPT;
1388 #endif
1389                 }
1390                 /* SIG_IGN, or set handler for these */
1391                 sigaction(SIGHUP, &sa, NULL);
1392                 sigaction(SIGINT, &sa, NULL);
1393                 sigaction(SIGQUIT, &sa, NULL);
1394                 sigaction(SIGPIPE, &sa, NULL);
1395                 sigaction(SIGTERM, &sa, NULL);
1396         }
1397 #ifdef USE_PROCFS
1398         sa.sa_handler = reaper;
1399         sigaction(SIGCHLD, &sa, NULL);
1400 #else
1401         /* Make sure SIGCHLD has the default action so that waitpid
1402            definitely works without losing track of children.  The user
1403            should not have given us a bogus state to inherit, but he might
1404            have.  Arguably we should detect SIG_IGN here and pass it on
1405            to children, but probably noone really needs that.  */
1406         sa.sa_handler = SIG_DFL;
1407         sigaction(SIGCHLD, &sa, NULL);
1408 #endif /* USE_PROCFS */
1409
1410         if (pflag_seen || daemonized_tracer)
1411                 startup_attach();
1412
1413         if (trace() < 0)
1414                 exit(1);
1415
1416         cleanup();
1417         fflush(NULL);
1418         if (exit_code > 0xff) {
1419                 /* Avoid potential core file clobbering.  */
1420                 struct rlimit rlim = {0, 0};
1421                 setrlimit(RLIMIT_CORE, &rlim);
1422
1423                 /* Child was killed by a signal, mimic that.  */
1424                 exit_code &= 0xff;
1425                 signal(exit_code, SIG_DFL);
1426                 raise(exit_code);
1427                 /* Paranoia - what if this signal is not fatal?
1428                    Exit with 128 + signo then.  */
1429                 exit_code += 128;
1430         }
1431         exit(exit_code);
1432 }
1433
1434 static void
1435 expand_tcbtab(void)
1436 {
1437         /* Allocate some more TCBs and expand the table.
1438            We don't want to relocate the TCBs because our
1439            callers have pointers and it would be a pain.
1440            So tcbtab is a table of pointers.  Since we never
1441            free the TCBs, we allocate a single chunk of many.  */
1442         int i = tcbtabsize;
1443         struct tcb *newtcbs = calloc(tcbtabsize, sizeof(newtcbs[0]));
1444         struct tcb **newtab = realloc(tcbtab, tcbtabsize * 2 * sizeof(tcbtab[0]));
1445         if (!newtab || !newtcbs)
1446                 die_out_of_memory();
1447         tcbtabsize *= 2;
1448         tcbtab = newtab;
1449         while (i < tcbtabsize)
1450                 tcbtab[i++] = newtcbs++;
1451 }
1452
1453 struct tcb *
1454 alloc_tcb(int pid, int command_options_parsed)
1455 {
1456         int i;
1457         struct tcb *tcp;
1458
1459         if (nprocs == tcbtabsize)
1460                 expand_tcbtab();
1461
1462         for (i = 0; i < tcbtabsize; i++) {
1463                 tcp = tcbtab[i];
1464                 if ((tcp->flags & TCB_INUSE) == 0) {
1465                         memset(tcp, 0, sizeof(*tcp));
1466                         tcp->pid = pid;
1467                         tcp->flags = TCB_INUSE;
1468                         tcp->outf = outf; /* Initialise to current out file */
1469 #if SUPPORTED_PERSONALITIES > 1
1470                         tcp->currpers = current_personality;
1471 #endif
1472 #ifdef USE_PROCFS
1473                         tcp->pfd = -1;
1474 #endif
1475                         nprocs++;
1476                         if (debug)
1477                                 fprintf(stderr, "new tcb for pid %d, active tcbs:%d\n", tcp->pid, nprocs);
1478                         if (command_options_parsed)
1479                                 newoutf(tcp);
1480                         return tcp;
1481                 }
1482         }
1483         error_msg_and_die("bug in alloc_tcb");
1484 }
1485
1486 #ifdef USE_PROCFS
1487 int
1488 proc_open(struct tcb *tcp, int attaching)
1489 {
1490         char proc[32];
1491         long arg;
1492 #ifdef SVR4
1493         int i;
1494         sysset_t syscalls;
1495         sigset_t signals;
1496         fltset_t faults;
1497 #endif
1498 #ifndef HAVE_POLLABLE_PROCFS
1499         static int last_pfd;
1500 #endif
1501
1502 #ifdef HAVE_MP_PROCFS
1503         /* Open the process pseudo-files in /proc. */
1504         sprintf(proc, "/proc/%d/ctl", tcp->pid);
1505         tcp->pfd = open(proc, O_WRONLY|O_EXCL);
1506         if (tcp->pfd < 0) {
1507                 perror("strace: open(\"/proc/...\", ...)");
1508                 return -1;
1509         }
1510         set_cloexec_flag(tcp->pfd);
1511         sprintf(proc, "/proc/%d/status", tcp->pid);
1512         tcp->pfd_stat = open(proc, O_RDONLY|O_EXCL);
1513         if (tcp->pfd_stat < 0) {
1514                 perror("strace: open(\"/proc/...\", ...)");
1515                 return -1;
1516         }
1517         set_cloexec_flag(tcp->pfd_stat);
1518         sprintf(proc, "/proc/%d/as", tcp->pid);
1519         tcp->pfd_as = open(proc, O_RDONLY|O_EXCL);
1520         if (tcp->pfd_as < 0) {
1521                 perror("strace: open(\"/proc/...\", ...)");
1522                 return -1;
1523         }
1524         set_cloexec_flag(tcp->pfd_as);
1525 #else
1526         /* Open the process pseudo-file in /proc. */
1527 # ifndef FREEBSD
1528         sprintf(proc, "/proc/%d", tcp->pid);
1529         tcp->pfd = open(proc, O_RDWR|O_EXCL);
1530 # else
1531         sprintf(proc, "/proc/%d/mem", tcp->pid);
1532         tcp->pfd = open(proc, O_RDWR);
1533 # endif
1534         if (tcp->pfd < 0) {
1535                 perror("strace: open(\"/proc/...\", ...)");
1536                 return -1;
1537         }
1538         set_cloexec_flag(tcp->pfd);
1539 #endif
1540 #ifdef FREEBSD
1541         sprintf(proc, "/proc/%d/regs", tcp->pid);
1542         tcp->pfd_reg = open(proc, O_RDONLY);
1543         if (tcp->pfd_reg < 0) {
1544                 perror("strace: open(\"/proc/.../regs\", ...)");
1545                 return -1;
1546         }
1547         if (cflag) {
1548                 sprintf(proc, "/proc/%d/status", tcp->pid);
1549                 tcp->pfd_status = open(proc, O_RDONLY);
1550                 if (tcp->pfd_status < 0) {
1551                         perror("strace: open(\"/proc/.../status\", ...)");
1552                         return -1;
1553                 }
1554         } else
1555                 tcp->pfd_status = -1;
1556 #endif /* FREEBSD */
1557         rebuild_pollv();
1558         if (!attaching) {
1559                 /*
1560                  * Wait for the child to pause.  Because of a race
1561                  * condition we have to poll for the event.
1562                  */
1563                 for (;;) {
1564                         if (IOCTL_STATUS(tcp) < 0) {
1565                                 perror("strace: PIOCSTATUS");
1566                                 return -1;
1567                         }
1568                         if (tcp->status.PR_FLAGS & PR_ASLEEP)
1569                                 break;
1570                 }
1571         }
1572 #ifndef FREEBSD
1573         /* Stop the process so that we own the stop. */
1574         if (IOCTL(tcp->pfd, PIOCSTOP, (char *)NULL) < 0) {
1575                 perror("strace: PIOCSTOP");
1576                 return -1;
1577         }
1578 #endif
1579 #ifdef PIOCSET
1580         /* Set Run-on-Last-Close. */
1581         arg = PR_RLC;
1582         if (IOCTL(tcp->pfd, PIOCSET, &arg) < 0) {
1583                 perror("PIOCSET PR_RLC");
1584                 return -1;
1585         }
1586         /* Set or Reset Inherit-on-Fork. */
1587         arg = PR_FORK;
1588         if (IOCTL(tcp->pfd, followfork ? PIOCSET : PIOCRESET, &arg) < 0) {
1589                 perror("PIOC{SET,RESET} PR_FORK");
1590                 return -1;
1591         }
1592 #else  /* !PIOCSET */
1593 #ifndef FREEBSD
1594         if (ioctl(tcp->pfd, PIOCSRLC) < 0) {
1595                 perror("PIOCSRLC");
1596                 return -1;
1597         }
1598         if (ioctl(tcp->pfd, followfork ? PIOCSFORK : PIOCRFORK) < 0) {
1599                 perror("PIOC{S,R}FORK");
1600                 return -1;
1601         }
1602 #else /* FREEBSD */
1603         /* just unset the PF_LINGER flag for the Run-on-Last-Close. */
1604         if (ioctl(tcp->pfd, PIOCGFL, &arg) < 0) {
1605                 perror("PIOCGFL");
1606                 return -1;
1607         }
1608         arg &= ~PF_LINGER;
1609         if (ioctl(tcp->pfd, PIOCSFL, arg) < 0) {
1610                 perror("PIOCSFL");
1611                 return -1;
1612         }
1613 #endif /* FREEBSD */
1614 #endif /* !PIOCSET */
1615 #ifndef FREEBSD
1616         /* Enable all syscall entries we care about. */
1617         premptyset(&syscalls);
1618         for (i = 1; i < MAX_QUALS; ++i) {
1619                 if (i > (sizeof syscalls) * CHAR_BIT) break;
1620                 if (qual_flags[i] & QUAL_TRACE) praddset(&syscalls, i);
1621         }
1622         praddset(&syscalls, SYS_execve);
1623         if (followfork) {
1624                 praddset(&syscalls, SYS_fork);
1625 #ifdef SYS_forkall
1626                 praddset(&syscalls, SYS_forkall);
1627 #endif
1628 #ifdef SYS_fork1
1629                 praddset(&syscalls, SYS_fork1);
1630 #endif
1631 #ifdef SYS_rfork1
1632                 praddset(&syscalls, SYS_rfork1);
1633 #endif
1634 #ifdef SYS_rforkall
1635                 praddset(&syscalls, SYS_rforkall);
1636 #endif
1637         }
1638         if (IOCTL(tcp->pfd, PIOCSENTRY, &syscalls) < 0) {
1639                 perror("PIOCSENTRY");
1640                 return -1;
1641         }
1642         /* Enable the syscall exits. */
1643         if (IOCTL(tcp->pfd, PIOCSEXIT, &syscalls) < 0) {
1644                 perror("PIOSEXIT");
1645                 return -1;
1646         }
1647         /* Enable signals we care about. */
1648         premptyset(&signals);
1649         for (i = 1; i < MAX_QUALS; ++i) {
1650                 if (i > (sizeof signals) * CHAR_BIT) break;
1651                 if (qual_flags[i] & QUAL_SIGNAL) praddset(&signals, i);
1652         }
1653         if (IOCTL(tcp->pfd, PIOCSTRACE, &signals) < 0) {
1654                 perror("PIOCSTRACE");
1655                 return -1;
1656         }
1657         /* Enable faults we care about */
1658         premptyset(&faults);
1659         for (i = 1; i < MAX_QUALS; ++i) {
1660                 if (i > (sizeof faults) * CHAR_BIT) break;
1661                 if (qual_flags[i] & QUAL_FAULT) praddset(&faults, i);
1662         }
1663         if (IOCTL(tcp->pfd, PIOCSFAULT, &faults) < 0) {
1664                 perror("PIOCSFAULT");
1665                 return -1;
1666         }
1667 #else /* FREEBSD */
1668         /* set events flags. */
1669         arg = S_SIG | S_SCE | S_SCX;
1670         if (ioctl(tcp->pfd, PIOCBIS, arg) < 0) {
1671                 perror("PIOCBIS");
1672                 return -1;
1673         }
1674 #endif /* FREEBSD */
1675         if (!attaching) {
1676 #ifdef MIPS
1677                 /*
1678                  * The SGI PRSABORT doesn't work for pause() so
1679                  * we send it a caught signal to wake it up.
1680                  */
1681                 kill(tcp->pid, SIGINT);
1682 #else /* !MIPS */
1683 #ifdef PRSABORT
1684                 /* The child is in a pause(), abort it. */
1685                 arg = PRSABORT;
1686                 if (IOCTL(tcp->pfd, PIOCRUN, &arg) < 0) {
1687                         perror("PIOCRUN");
1688                         return -1;
1689                 }
1690 #endif
1691 #endif /* !MIPS*/
1692 #ifdef FREEBSD
1693                 /* wake up the child if it received the SIGSTOP */
1694                 kill(tcp->pid, SIGCONT);
1695 #endif
1696                 for (;;) {
1697                         /* Wait for the child to do something. */
1698                         if (IOCTL_WSTOP(tcp) < 0) {
1699                                 perror("PIOCWSTOP");
1700                                 return -1;
1701                         }
1702                         if (tcp->status.PR_WHY == PR_SYSENTRY) {
1703                                 tcp->flags &= ~TCB_INSYSCALL;
1704                                 get_scno(tcp);
1705                                 if (SCNO_IN_RANGE(tcp->scno) &&
1706                                     sysent[tcp->scno].sys_func == sys_execve)
1707                                         break;
1708                         }
1709                         /* Set it running: maybe execve will be next. */
1710 #ifndef FREEBSD
1711                         arg = 0;
1712                         if (IOCTL(tcp->pfd, PIOCRUN, &arg) < 0)
1713 #else
1714                         if (IOCTL(tcp->pfd, PIOCRUN, 0) < 0)
1715 #endif
1716                         {
1717                                 perror("PIOCRUN");
1718                                 return -1;
1719                         }
1720 #ifdef FREEBSD
1721                         /* handle the case where we "opened" the child before
1722                            it did the kill -STOP */
1723                         if (tcp->status.PR_WHY == PR_SIGNALLED &&
1724                             tcp->status.PR_WHAT == SIGSTOP)
1725                                 kill(tcp->pid, SIGCONT);
1726 #endif
1727                 }
1728         }
1729 #ifdef FREEBSD
1730         else {
1731                 if (attaching < 2) {
1732                         /* We are attaching to an already running process.
1733                          * Try to figure out the state of the process in syscalls,
1734                          * to handle the first event well.
1735                          * This is done by having a look at the "wchan" property of the
1736                          * process, which tells where it is stopped (if it is). */
1737                         FILE * status;
1738                         char wchan[20]; /* should be enough */
1739
1740                         sprintf(proc, "/proc/%d/status", tcp->pid);
1741                         status = fopen(proc, "r");
1742                         if (status &&
1743                             (fscanf(status, "%*s %*d %*d %*d %*d %*d,%*d %*s %*d,%*d"
1744                                     "%*d,%*d %*d,%*d %19s", wchan) == 1) &&
1745                             strcmp(wchan, "nochan") && strcmp(wchan, "spread") &&
1746                             strcmp(wchan, "stopevent")) {
1747                                 /* The process is asleep in the middle of a syscall.
1748                                    Fake the syscall entry event */
1749                                 tcp->flags &= ~(TCB_INSYSCALL|TCB_STARTUP);
1750                                 tcp->status.PR_WHY = PR_SYSENTRY;
1751                                 trace_syscall(tcp);
1752                         }
1753                         if (status)
1754                                 fclose(status);
1755                 } /* otherwise it's a fork being followed */
1756         }
1757 #endif /* FREEBSD */
1758 #ifndef HAVE_POLLABLE_PROCFS
1759         if (proc_poll_pipe[0] != -1)
1760                 proc_poller(tcp->pfd);
1761         else if (nprocs > 1) {
1762                 proc_poll_open();
1763                 proc_poller(last_pfd);
1764                 proc_poller(tcp->pfd);
1765         }
1766         last_pfd = tcp->pfd;
1767 #endif /* !HAVE_POLLABLE_PROCFS */
1768         return 0;
1769 }
1770
1771 #endif /* USE_PROCFS */
1772
1773 static struct tcb *
1774 pid2tcb(int pid)
1775 {
1776         int i;
1777
1778         if (pid <= 0)
1779                 return NULL;
1780
1781         for (i = 0; i < tcbtabsize; i++) {
1782                 struct tcb *tcp = tcbtab[i];
1783                 if (tcp->pid == pid && (tcp->flags & TCB_INUSE))
1784                         return tcp;
1785         }
1786
1787         return NULL;
1788 }
1789
1790 #ifdef USE_PROCFS
1791
1792 static struct tcb *
1793 first_used_tcb(void)
1794 {
1795         int i;
1796         struct tcb *tcp;
1797         for (i = 0; i < tcbtabsize; i++) {
1798                 tcp = tcbtab[i];
1799                 if (tcp->flags & TCB_INUSE)
1800                         return tcp;
1801         }
1802         return NULL;
1803 }
1804
1805 static struct tcb *
1806 pfd2tcb(int pfd)
1807 {
1808         int i;
1809
1810         for (i = 0; i < tcbtabsize; i++) {
1811                 struct tcb *tcp = tcbtab[i];
1812                 if (tcp->pfd != pfd)
1813                         continue;
1814                 if (tcp->flags & TCB_INUSE)
1815                         return tcp;
1816         }
1817         return NULL;
1818 }
1819
1820 #endif /* USE_PROCFS */
1821
1822 void
1823 droptcb(struct tcb *tcp)
1824 {
1825         if (tcp->pid == 0)
1826                 return;
1827
1828         nprocs--;
1829         if (debug)
1830                 fprintf(stderr, "dropped tcb for pid %d, %d remain\n", tcp->pid, nprocs);
1831
1832 #ifdef USE_PROCFS
1833         if (tcp->pfd != -1) {
1834                 close(tcp->pfd);
1835                 tcp->pfd = -1;
1836 # ifdef FREEBSD
1837                 if (tcp->pfd_reg != -1) {
1838                         close(tcp->pfd_reg);
1839                         tcp->pfd_reg = -1;
1840                 }
1841                 if (tcp->pfd_status != -1) {
1842                         close(tcp->pfd_status);
1843                         tcp->pfd_status = -1;
1844                 }
1845 # endif
1846                 tcp->flags = 0; /* rebuild_pollv needs it */
1847                 rebuild_pollv();
1848         }
1849 #endif
1850
1851         if (outfname && followfork > 1 && tcp->outf)
1852                 fclose(tcp->outf);
1853
1854         memset(tcp, 0, sizeof(*tcp));
1855 }
1856
1857 /* detach traced process; continue with sig
1858    Never call DETACH twice on the same process as both unattached and
1859    attached-unstopped processes give the same ESRCH.  For unattached process we
1860    would SIGSTOP it and wait for its SIGSTOP notification forever.  */
1861
1862 static int
1863 detach(struct tcb *tcp)
1864 {
1865         int error = 0;
1866 #ifdef LINUX
1867         int status, catch_sigstop;
1868 #endif
1869
1870         if (tcp->flags & TCB_BPTSET)
1871                 clearbpt(tcp);
1872
1873 #ifdef LINUX
1874         /*
1875          * Linux wrongly insists the child be stopped
1876          * before detaching.  Arghh.  We go through hoops
1877          * to make a clean break of things.
1878          */
1879 #if defined(SPARC)
1880 #undef PTRACE_DETACH
1881 #define PTRACE_DETACH PTRACE_SUNDETACH
1882 #endif
1883         /*
1884          * We attached but possibly didn't see the expected SIGSTOP.
1885          * We must catch exactly one as otherwise the detached process
1886          * would be left stopped (process state T).
1887          */
1888         catch_sigstop = (tcp->flags & TCB_IGNORE_ONE_SIGSTOP);
1889         error = ptrace(PTRACE_DETACH, tcp->pid, (char *) 1, 0);
1890         if (error == 0) {
1891                 /* On a clear day, you can see forever. */
1892         }
1893         else if (errno != ESRCH) {
1894                 /* Shouldn't happen. */
1895                 perror("detach: ptrace(PTRACE_DETACH, ...)");
1896         }
1897         else if (my_tkill(tcp->pid, 0) < 0) {
1898                 if (errno != ESRCH)
1899                         perror("detach: checking sanity");
1900         }
1901         else if (!catch_sigstop && my_tkill(tcp->pid, SIGSTOP) < 0) {
1902                 if (errno != ESRCH)
1903                         perror("detach: stopping child");
1904         }
1905         else
1906                 catch_sigstop = 1;
1907         if (catch_sigstop) {
1908                 for (;;) {
1909 #ifdef __WALL
1910                         if (wait4(tcp->pid, &status, __WALL, NULL) < 0) {
1911                                 if (errno == ECHILD) /* Already gone.  */
1912                                         break;
1913                                 if (errno != EINVAL) {
1914                                         perror("detach: waiting");
1915                                         break;
1916                                 }
1917 #endif /* __WALL */
1918                                 /* No __WALL here.  */
1919                                 if (waitpid(tcp->pid, &status, 0) < 0) {
1920                                         if (errno != ECHILD) {
1921                                                 perror("detach: waiting");
1922                                                 break;
1923                                         }
1924 #ifdef __WCLONE
1925                                         /* If no processes, try clones.  */
1926                                         if (wait4(tcp->pid, &status, __WCLONE,
1927                                                   NULL) < 0) {
1928                                                 if (errno != ECHILD)
1929                                                         perror("detach: waiting");
1930                                                 break;
1931                                         }
1932 #endif /* __WCLONE */
1933                                 }
1934 #ifdef __WALL
1935                         }
1936 #endif
1937                         if (!WIFSTOPPED(status)) {
1938                                 /* Au revoir, mon ami. */
1939                                 break;
1940                         }
1941                         if (WSTOPSIG(status) == SIGSTOP) {
1942                                 ptrace_restart(PTRACE_DETACH, tcp, 0);
1943                                 break;
1944                         }
1945                         error = ptrace_restart(PTRACE_CONT, tcp,
1946                                         WSTOPSIG(status) == syscall_trap_sig ? 0
1947                                         : WSTOPSIG(status));
1948                         if (error < 0)
1949                                 break;
1950                 }
1951         }
1952 #endif /* LINUX */
1953
1954 #if defined(SUNOS4)
1955         /* PTRACE_DETACH won't respect `sig' argument, so we post it here. */
1956         error = ptrace_restart(PTRACE_DETACH, tcp, 0);
1957 #endif /* SUNOS4 */
1958
1959         if (!qflag)
1960                 fprintf(stderr, "Process %u detached\n", tcp->pid);
1961
1962         droptcb(tcp);
1963
1964         return error;
1965 }
1966
1967 #ifdef USE_PROCFS
1968
1969 static void reaper(int sig)
1970 {
1971         int pid;
1972         int status;
1973
1974         while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
1975         }
1976 }
1977
1978 #endif /* USE_PROCFS */
1979
1980 static void
1981 cleanup(void)
1982 {
1983         int i;
1984         struct tcb *tcp;
1985         int fatal_sig;
1986
1987         /* 'interrupted' is a volatile object, fetch it only once */
1988         fatal_sig = interrupted;
1989         if (!fatal_sig)
1990                 fatal_sig = SIGTERM;
1991
1992         for (i = 0; i < tcbtabsize; i++) {
1993                 tcp = tcbtab[i];
1994                 if (!(tcp->flags & TCB_INUSE))
1995                         continue;
1996                 if (debug)
1997                         fprintf(stderr,
1998                                 "cleanup: looking at pid %u\n", tcp->pid);
1999                 if (printing_tcp &&
2000                     (!outfname || followfork < 2 || printing_tcp == tcp)) {
2001                         tprints(" <unfinished ...>\n");
2002                         printing_tcp = NULL;
2003                 }
2004                 if (tcp->flags & TCB_ATTACHED)
2005                         detach(tcp);
2006                 else {
2007                         kill(tcp->pid, SIGCONT);
2008                         kill(tcp->pid, fatal_sig);
2009                 }
2010         }
2011         if (cflag)
2012                 call_summary(outf);
2013 }
2014
2015 static void
2016 interrupt(int sig)
2017 {
2018         interrupted = sig;
2019 }
2020
2021 #ifndef HAVE_STRERROR
2022
2023 #if !HAVE_DECL_SYS_ERRLIST
2024 extern int sys_nerr;
2025 extern char *sys_errlist[];
2026 #endif /* HAVE_DECL_SYS_ERRLIST */
2027
2028 const char *
2029 strerror(int err_no)
2030 {
2031         static char buf[64];
2032
2033         if (err_no < 1 || err_no >= sys_nerr) {
2034                 sprintf(buf, "Unknown error %d", err_no);
2035                 return buf;
2036         }
2037         return sys_errlist[err_no];
2038 }
2039
2040 #endif /* HAVE_STERRROR */
2041
2042 #ifndef HAVE_STRSIGNAL
2043
2044 #if defined HAVE_SYS_SIGLIST && !defined HAVE_DECL_SYS_SIGLIST
2045 extern char *sys_siglist[];
2046 #endif
2047 #if defined HAVE_SYS__SIGLIST && !defined HAVE_DECL__SYS_SIGLIST
2048 extern char *_sys_siglist[];
2049 #endif
2050
2051 const char *
2052 strsignal(int sig)
2053 {
2054         static char buf[64];
2055
2056         if (sig < 1 || sig >= NSIG) {
2057                 sprintf(buf, "Unknown signal %d", sig);
2058                 return buf;
2059         }
2060 #ifdef HAVE__SYS_SIGLIST
2061         return _sys_siglist[sig];
2062 #else
2063         return sys_siglist[sig];
2064 #endif
2065 }
2066
2067 #endif /* HAVE_STRSIGNAL */
2068
2069 #ifdef USE_PROCFS
2070
2071 static void
2072 rebuild_pollv(void)
2073 {
2074         int i, j;
2075
2076         free(pollv);
2077         pollv = malloc(nprocs * sizeof(pollv[0]));
2078         if (!pollv)
2079                 die_out_of_memory();
2080
2081         for (i = j = 0; i < tcbtabsize; i++) {
2082                 struct tcb *tcp = tcbtab[i];
2083                 if (!(tcp->flags & TCB_INUSE))
2084                         continue;
2085                 pollv[j].fd = tcp->pfd;
2086                 pollv[j].events = POLLWANT;
2087                 j++;
2088         }
2089         if (j != nprocs) {
2090                 error_msg_and_die("proc miscount");
2091         }
2092 }
2093
2094 #ifndef HAVE_POLLABLE_PROCFS
2095
2096 static void
2097 proc_poll_open(void)
2098 {
2099         int i;
2100
2101         if (pipe(proc_poll_pipe) < 0) {
2102                 perror_msg_and_die("pipe");
2103         }
2104         for (i = 0; i < 2; i++) {
2105                 set_cloexec_flag(proc_poll_pipe[i]);
2106         }
2107 }
2108
2109 static int
2110 proc_poll(struct pollfd *pollv, int nfds, int timeout)
2111 {
2112         int i;
2113         int n;
2114         struct proc_pollfd pollinfo;
2115
2116         n = read(proc_poll_pipe[0], &pollinfo, sizeof(pollinfo));
2117         if (n < 0)
2118                 return n;
2119         if (n != sizeof(struct proc_pollfd)) {
2120                 error_msg_and_die("panic: short read: %d", n);
2121         }
2122         for (i = 0; i < nprocs; i++) {
2123                 if (pollv[i].fd == pollinfo.fd)
2124                         pollv[i].revents = pollinfo.revents;
2125                 else
2126                         pollv[i].revents = 0;
2127         }
2128         poller_pid = pollinfo.pid;
2129         return 1;
2130 }
2131
2132 static void
2133 wakeup_handler(int sig)
2134 {
2135 }
2136
2137 static void
2138 proc_poller(int pfd)
2139 {
2140         struct proc_pollfd pollinfo;
2141         struct sigaction sa;
2142         sigset_t blocked_set, empty_set;
2143         int i;
2144         int n;
2145         struct rlimit rl;
2146 #ifdef FREEBSD
2147         struct procfs_status pfs;
2148 #endif /* FREEBSD */
2149
2150         switch (fork()) {
2151         case -1:
2152                 perror_msg_and_die("fork");
2153         case 0:
2154                 break;
2155         default:
2156                 return;
2157         }
2158
2159         sa.sa_handler = interactive ? SIG_DFL : SIG_IGN;
2160         sa.sa_flags = 0;
2161         sigemptyset(&sa.sa_mask);
2162         sigaction(SIGHUP, &sa, NULL);
2163         sigaction(SIGINT, &sa, NULL);
2164         sigaction(SIGQUIT, &sa, NULL);
2165         sigaction(SIGPIPE, &sa, NULL);
2166         sigaction(SIGTERM, &sa, NULL);
2167         sa.sa_handler = wakeup_handler;
2168         sigaction(SIGUSR1, &sa, NULL);
2169         sigemptyset(&blocked_set);
2170         sigaddset(&blocked_set, SIGUSR1);
2171         sigprocmask(SIG_BLOCK, &blocked_set, NULL);
2172         sigemptyset(&empty_set);
2173
2174         if (getrlimit(RLIMIT_NOFILE, &rl) < 0) {
2175                 perror_msg_and_die("getrlimit(RLIMIT_NOFILE, ...)");
2176         }
2177         n = rl.rlim_cur;
2178         for (i = 0; i < n; i++) {
2179                 if (i != pfd && i != proc_poll_pipe[1])
2180                         close(i);
2181         }
2182
2183         pollinfo.fd = pfd;
2184         pollinfo.pid = getpid();
2185         for (;;) {
2186 #ifndef FREEBSD
2187                 if (ioctl(pfd, PIOCWSTOP, NULL) < 0)
2188 #else
2189                 if (ioctl(pfd, PIOCWSTOP, &pfs) < 0)
2190 #endif
2191                 {
2192                         switch (errno) {
2193                         case EINTR:
2194                                 continue;
2195                         case EBADF:
2196                                 pollinfo.revents = POLLERR;
2197                                 break;
2198                         case ENOENT:
2199                                 pollinfo.revents = POLLHUP;
2200                                 break;
2201                         default:
2202                                 perror("proc_poller: PIOCWSTOP");
2203                         }
2204                         write(proc_poll_pipe[1], &pollinfo, sizeof(pollinfo));
2205                         _exit(0);
2206                 }
2207                 pollinfo.revents = POLLWANT;
2208                 write(proc_poll_pipe[1], &pollinfo, sizeof(pollinfo));
2209                 sigsuspend(&empty_set);
2210         }
2211 }
2212
2213 #endif /* !HAVE_POLLABLE_PROCFS */
2214
2215 static int
2216 choose_pfd()
2217 {
2218         int i, j;
2219         struct tcb *tcp;
2220
2221         static int last;
2222
2223         if (followfork < 2 &&
2224             last < nprocs && (pollv[last].revents & POLLWANT)) {
2225                 /*
2226                  * The previous process is ready to run again.  We'll
2227                  * let it do so if it is currently in a syscall.  This
2228                  * heuristic improves the readability of the trace.
2229                  */
2230                 tcp = pfd2tcb(pollv[last].fd);
2231                 if (tcp && exiting(tcp))
2232                         return pollv[last].fd;
2233         }
2234
2235         for (i = 0; i < nprocs; i++) {
2236                 /* Let competing children run round robin. */
2237                 j = (i + last + 1) % nprocs;
2238                 if (pollv[j].revents & (POLLHUP | POLLERR)) {
2239                         tcp = pfd2tcb(pollv[j].fd);
2240                         if (!tcp) {
2241                                 error_msg_and_die("lost proc");
2242                         }
2243                         droptcb(tcp);
2244                         return -1;
2245                 }
2246                 if (pollv[j].revents & POLLWANT) {
2247                         last = j;
2248                         return pollv[j].fd;
2249                 }
2250         }
2251         error_msg_and_die("nothing ready");
2252 }
2253
2254 static int
2255 trace(void)
2256 {
2257 #ifdef POLL_HACK
2258         struct tcb *in_syscall = NULL;
2259 #endif
2260         struct tcb *tcp;
2261         int pfd;
2262         int what;
2263         int ioctl_result = 0, ioctl_errno = 0;
2264         long arg;
2265
2266         for (;;) {
2267                 if (interactive)
2268                         sigprocmask(SIG_SETMASK, &empty_set, NULL);
2269
2270                 if (nprocs == 0)
2271                         break;
2272
2273                 switch (nprocs) {
2274                 case 1:
2275 #ifndef HAVE_POLLABLE_PROCFS
2276                         if (proc_poll_pipe[0] == -1) {
2277 #endif
2278                                 tcp = first_used_tcb();
2279                                 if (!tcp)
2280                                         continue;
2281                                 pfd = tcp->pfd;
2282                                 if (pfd == -1)
2283                                         continue;
2284                                 break;
2285 #ifndef HAVE_POLLABLE_PROCFS
2286                         }
2287                         /* fall through ... */
2288 #endif /* !HAVE_POLLABLE_PROCFS */
2289                 default:
2290 #ifdef HAVE_POLLABLE_PROCFS
2291 #ifdef POLL_HACK
2292                         /* On some systems (e.g. UnixWare) we get too much ugly
2293                            "unfinished..." stuff when multiple proceses are in
2294                            syscalls.  Here's a nasty hack */
2295
2296                         if (in_syscall) {
2297                                 struct pollfd pv;
2298                                 tcp = in_syscall;
2299                                 in_syscall = NULL;
2300                                 pv.fd = tcp->pfd;
2301                                 pv.events = POLLWANT;
2302                                 what = poll(&pv, 1, 1);
2303                                 if (what < 0) {
2304                                         if (interrupted)
2305                                                 return 0;
2306                                         continue;
2307                                 }
2308                                 else if (what == 1 && pv.revents & POLLWANT) {
2309                                         goto FOUND;
2310                                 }
2311                         }
2312 #endif
2313
2314                         if (poll(pollv, nprocs, INFTIM) < 0) {
2315                                 if (interrupted)
2316                                         return 0;
2317                                 continue;
2318                         }
2319 #else /* !HAVE_POLLABLE_PROCFS */
2320                         if (proc_poll(pollv, nprocs, INFTIM) < 0) {
2321                                 if (interrupted)
2322                                         return 0;
2323                                 continue;
2324                         }
2325 #endif /* !HAVE_POLLABLE_PROCFS */
2326                         pfd = choose_pfd();
2327                         if (pfd == -1)
2328                                 continue;
2329                         break;
2330                 }
2331
2332                 /* Look up `pfd' in our table. */
2333                 tcp = pfd2tcb(pfd);
2334                 if (tcp == NULL) {
2335                         error_msg_and_die("unknown pfd: %u", pfd);
2336                 }
2337 #ifdef POLL_HACK
2338         FOUND:
2339 #endif
2340                 /* Get the status of the process. */
2341                 if (!interrupted) {
2342 #ifndef FREEBSD
2343                         ioctl_result = IOCTL_WSTOP(tcp);
2344 #else /* FREEBSD */
2345                         /* Thanks to some scheduling mystery, the first poller
2346                            sometimes waits for the already processed end of fork
2347                            event. Doing a non blocking poll here solves the problem. */
2348                         if (proc_poll_pipe[0] != -1)
2349                                 ioctl_result = IOCTL_STATUS(tcp);
2350                         else
2351                                 ioctl_result = IOCTL_WSTOP(tcp);
2352 #endif /* FREEBSD */
2353                         ioctl_errno = errno;
2354 #ifndef HAVE_POLLABLE_PROCFS
2355                         if (proc_poll_pipe[0] != -1) {
2356                                 if (ioctl_result < 0)
2357                                         kill(poller_pid, SIGKILL);
2358                                 else
2359                                         kill(poller_pid, SIGUSR1);
2360                         }
2361 #endif /* !HAVE_POLLABLE_PROCFS */
2362                 }
2363                 if (interrupted)
2364                         return 0;
2365
2366                 if (interactive)
2367                         sigprocmask(SIG_BLOCK, &blocked_set, NULL);
2368
2369                 if (ioctl_result < 0) {
2370                         /* Find out what happened if it failed. */
2371                         switch (ioctl_errno) {
2372                         case EINTR:
2373                         case EBADF:
2374                                 continue;
2375 #ifdef FREEBSD
2376                         case ENOTTY:
2377 #endif
2378                         case ENOENT:
2379                                 droptcb(tcp);
2380                                 continue;
2381                         default:
2382                                 perror_msg_and_die("PIOCWSTOP");
2383                         }
2384                 }
2385
2386 #ifdef FREEBSD
2387                 if ((tcp->flags & TCB_STARTUP) && (tcp->status.PR_WHY == PR_SYSEXIT)) {
2388                         /* discard first event for a syscall we never entered */
2389                         IOCTL(tcp->pfd, PIOCRUN, 0);
2390                         continue;
2391                 }
2392 #endif
2393
2394                 /* clear the just started flag */
2395                 tcp->flags &= ~TCB_STARTUP;
2396
2397                 /* set current output file */
2398                 outf = tcp->outf;
2399                 curcol = tcp->curcol;
2400
2401                 if (cflag) {
2402                         struct timeval stime;
2403 #ifdef FREEBSD
2404                         char buf[1024];
2405                         int len;
2406
2407                         len = pread(tcp->pfd_status, buf, sizeof(buf) - 1, 0);
2408                         if (len > 0) {
2409                                 buf[len] = '\0';
2410                                 sscanf(buf,
2411                                        "%*s %*d %*d %*d %*d %*d,%*d %*s %*d,%*d %*d,%*d %ld,%ld",
2412                                        &stime.tv_sec, &stime.tv_usec);
2413                         } else
2414                                 stime.tv_sec = stime.tv_usec = 0;
2415 #else /* !FREEBSD */
2416                         stime.tv_sec = tcp->status.pr_stime.tv_sec;
2417                         stime.tv_usec = tcp->status.pr_stime.tv_nsec/1000;
2418 #endif /* !FREEBSD */
2419                         tv_sub(&tcp->dtime, &stime, &tcp->stime);
2420                         tcp->stime = stime;
2421                 }
2422                 what = tcp->status.PR_WHAT;
2423                 switch (tcp->status.PR_WHY) {
2424 #ifndef FREEBSD
2425                 case PR_REQUESTED:
2426                         if (tcp->status.PR_FLAGS & PR_ASLEEP) {
2427                                 tcp->status.PR_WHY = PR_SYSENTRY;
2428                                 if (trace_syscall(tcp) < 0) {
2429                                         error_msg_and_die("syscall trouble");
2430                                 }
2431                         }
2432                         break;
2433 #endif /* !FREEBSD */
2434                 case PR_SYSENTRY:
2435 #ifdef POLL_HACK
2436                         in_syscall = tcp;
2437 #endif
2438                 case PR_SYSEXIT:
2439                         if (trace_syscall(tcp) < 0) {
2440                                 error_msg_and_die("syscall trouble");
2441                         }
2442                         break;
2443                 case PR_SIGNALLED:
2444                         if (cflag != CFLAG_ONLY_STATS
2445                             && (qual_flags[what] & QUAL_SIGNAL)) {
2446                                 printleader(tcp);
2447                                 tprintf("--- %s (%s) ---\n",
2448                                         signame(what), strsignal(what));
2449                                 printing_tcp = NULL;
2450 #ifdef PR_INFO
2451                                 if (tcp->status.PR_INFO.si_signo == what) {
2452                                         printleader(tcp);
2453                                         tprints("    siginfo=");
2454                                         printsiginfo(&tcp->status.PR_INFO, 1);
2455                                         tprints("\n");
2456                                         printing_tcp = NULL;
2457                                 }
2458 #endif
2459                         }
2460                         break;
2461                 case PR_FAULTED:
2462                         if (cflag != CFLAGS_ONLY_STATS
2463                             && (qual_flags[what] & QUAL_FAULT)) {
2464                                 printleader(tcp);
2465                                 tprintf("=== FAULT %d ===\n", what);
2466                                 printing_tcp = NULL;
2467                         }
2468                         break;
2469 #ifdef FREEBSD
2470                 case 0: /* handle case we polled for nothing */
2471                         continue;
2472 #endif
2473                 default:
2474                         error_msg_and_die("odd stop %d", tcp->status.PR_WHY);
2475                         break;
2476                 }
2477                 /* Remember current print column before continuing. */
2478                 tcp->curcol = curcol;
2479                 arg = 0;
2480 #ifndef FREEBSD
2481                 if (IOCTL(tcp->pfd, PIOCRUN, &arg) < 0)
2482 #else
2483                 if (IOCTL(tcp->pfd, PIOCRUN, 0) < 0)
2484 #endif
2485                 {
2486                         perror_msg_and_die("PIOCRUN");
2487                 }
2488         }
2489         return 0;
2490 }
2491
2492 #else /* !USE_PROCFS */
2493
2494 static int
2495 trace(void)
2496 {
2497 #ifdef LINUX
2498         struct rusage ru;
2499         struct rusage *rup = cflag ? &ru : NULL;
2500 # ifdef __WALL
2501         static int wait4_options = __WALL;
2502 # endif
2503 #endif /* LINUX */
2504
2505         while (nprocs != 0) {
2506                 int pid;
2507                 int wait_errno;
2508                 int status, sig;
2509                 int stopped;
2510                 struct tcb *tcp;
2511                 unsigned event;
2512
2513                 if (interrupted)
2514                         return 0;
2515                 if (interactive)
2516                         sigprocmask(SIG_SETMASK, &empty_set, NULL);
2517 #ifdef LINUX
2518 # ifdef __WALL
2519                 pid = wait4(-1, &status, wait4_options, rup);
2520                 if (pid < 0 && (wait4_options & __WALL) && errno == EINVAL) {
2521                         /* this kernel does not support __WALL */
2522                         wait4_options &= ~__WALL;
2523                         pid = wait4(-1, &status, wait4_options, rup);
2524                 }
2525                 if (pid < 0 && !(wait4_options & __WALL) && errno == ECHILD) {
2526                         /* most likely a "cloned" process */
2527                         pid = wait4(-1, &status, __WCLONE, rup);
2528                         if (pid < 0) {
2529                                 perror_msg("wait4(__WCLONE) failed");
2530                         }
2531                 }
2532 # else
2533                 pid = wait4(-1, &status, 0, rup);
2534 # endif /* __WALL */
2535 #endif /* LINUX */
2536 #ifdef SUNOS4
2537                 pid = wait(&status);
2538 #endif
2539                 wait_errno = errno;
2540                 if (interactive)
2541                         sigprocmask(SIG_BLOCK, &blocked_set, NULL);
2542
2543                 if (pid < 0) {
2544                         switch (wait_errno) {
2545                         case EINTR:
2546                                 continue;
2547                         case ECHILD:
2548                                 /*
2549                                  * We would like to verify this case
2550                                  * but sometimes a race in Solbourne's
2551                                  * version of SunOS sometimes reports
2552                                  * ECHILD before sending us SIGCHILD.
2553                                  */
2554                                 return 0;
2555                         default:
2556                                 errno = wait_errno;
2557                                 perror("strace: wait");
2558                                 return -1;
2559                         }
2560                 }
2561                 if (pid == popen_pid) {
2562                         if (WIFEXITED(status) || WIFSIGNALED(status))
2563                                 popen_pid = 0;
2564                         continue;
2565                 }
2566
2567                 event = ((unsigned)status >> 16);
2568                 if (debug) {
2569                         char buf[sizeof("WIFEXITED,exitcode=%u") + sizeof(int)*3 /*paranoia:*/ + 16];
2570 #ifdef LINUX
2571                         if (event != 0) {
2572                                 static const char *const event_names[] = {
2573                                         [PTRACE_EVENT_CLONE] = "CLONE",
2574                                         [PTRACE_EVENT_FORK]  = "FORK",
2575                                         [PTRACE_EVENT_VFORK] = "VFORK",
2576                                         [PTRACE_EVENT_VFORK_DONE] = "VFORK_DONE",
2577                                         [PTRACE_EVENT_EXEC]  = "EXEC",
2578                                         [PTRACE_EVENT_EXIT]  = "EXIT",
2579                                 };
2580                                 const char *e;
2581                                 if (event < ARRAY_SIZE(event_names))
2582                                         e = event_names[event];
2583                                 else {
2584                                         sprintf(buf, "?? (%u)", event);
2585                                         e = buf;
2586                                 }
2587                                 fprintf(stderr, " PTRACE_EVENT_%s", e);
2588                         }
2589 #endif
2590                         strcpy(buf, "???");
2591                         if (WIFSIGNALED(status))
2592 #ifdef WCOREDUMP
2593                                 sprintf(buf, "WIFSIGNALED,%ssig=%s",
2594                                                 WCOREDUMP(status) ? "core," : "",
2595                                                 signame(WTERMSIG(status)));
2596 #else
2597                                 sprintf(buf, "WIFSIGNALED,sig=%s",
2598                                                 signame(WTERMSIG(status)));
2599 #endif
2600                         if (WIFEXITED(status))
2601                                 sprintf(buf, "WIFEXITED,exitcode=%u", WEXITSTATUS(status));
2602                         if (WIFSTOPPED(status))
2603                                 sprintf(buf, "WIFSTOPPED,sig=%s", signame(WSTOPSIG(status)));
2604 #ifdef WIFCONTINUED
2605                         if (WIFCONTINUED(status))
2606                                 strcpy(buf, "WIFCONTINUED");
2607 #endif
2608                         fprintf(stderr, " [wait(0x%04x) = %u] %s\n", status, pid, buf);
2609                 }
2610
2611                 /* Look up 'pid' in our table. */
2612                 tcp = pid2tcb(pid);
2613
2614 #ifdef LINUX
2615                 /* Under Linux, execve changes pid to thread leader's pid,
2616                  * and we see this changed pid on EVENT_EXEC and later,
2617                  * execve sysexit. Leader "disappears" without exit
2618                  * notification. Let user know that, drop leader's tcb,
2619                  * and fix up pid in execve thread's tcb.
2620                  * Effectively, execve thread's tcb replaces leader's tcb.
2621                  *
2622                  * BTW, leader is 'stuck undead' (doesn't report WIFEXITED
2623                  * on exit syscall) in multithreaded programs exactly
2624                  * in order to handle this case.
2625                  *
2626                  * PTRACE_GETEVENTMSG returns old pid starting from Linux 3.0.
2627                  * On 2.6 and earlier, it can return garbage.
2628                  */
2629                 if (event == PTRACE_EVENT_EXEC && os_release[0] >= '3') {
2630                         long old_pid = 0;
2631                         if (ptrace(PTRACE_GETEVENTMSG, pid, NULL, (long) &old_pid) >= 0
2632                          && old_pid > 0
2633                          && old_pid != pid
2634                         ) {
2635                                 struct tcb *execve_thread = pid2tcb(old_pid);
2636                                 if (tcp) {
2637                                         outf = tcp->outf;
2638                                         curcol = tcp->curcol;
2639                                         if (!cflag) {
2640                                                 if (printing_tcp)
2641                                                         tprints(" <unfinished ...>\n");
2642                                                 printleader(tcp);
2643                                                 tprintf("+++ superseded by execve in pid %lu +++\n", old_pid);
2644                                                 printing_tcp = NULL;
2645                                                 fflush(outf);
2646                                         }
2647                                         if (execve_thread) {
2648                                                 /* swap output FILEs (needed for -ff) */
2649                                                 tcp->outf = execve_thread->outf;
2650                                                 execve_thread->outf = outf;
2651                                         }
2652                                         droptcb(tcp);
2653                                 }
2654                                 tcp = execve_thread;
2655                                 if (tcp) {
2656                                         tcp->pid = pid;
2657                                         tcp->flags |= TCB_REPRINT;
2658                                 }
2659                         }
2660                 }
2661 #endif
2662
2663                 if (tcp == NULL) {
2664 #ifdef LINUX
2665                         if (followfork) {
2666                                 /* This is needed to go with the CLONE_PTRACE
2667                                    changes in process.c/util.c: we might see
2668                                    the child's initial trap before we see the
2669                                    parent return from the clone syscall.
2670                                    Leave the child suspended until the parent
2671                                    returns from its system call.  Only then
2672                                    will we have the association of parent and
2673                                    child so that we know how to do clearbpt
2674                                    in the child.  */
2675                                 tcp = alloctcb(pid);
2676                                 tcp->flags |= TCB_ATTACHED | TCB_STARTUP | post_attach_sigstop;
2677                                 if (!qflag)
2678                                         fprintf(stderr, "Process %d attached\n",
2679                                                 pid);
2680                         }
2681                         else
2682                                 /* This can happen if a clone call used
2683                                    CLONE_PTRACE itself.  */
2684 #endif
2685                         {
2686                                 if (WIFSTOPPED(status))
2687                                         ptrace(PTRACE_CONT, pid, (char *) 1, 0);
2688                                 error_msg_and_die("Unknown pid: %u", pid);
2689                         }
2690                 }
2691                 /* set current output file */
2692                 outf = tcp->outf;
2693                 curcol = tcp->curcol;
2694 #ifdef LINUX
2695                 if (cflag) {
2696                         tv_sub(&tcp->dtime, &ru.ru_stime, &tcp->stime);
2697                         tcp->stime = ru.ru_stime;
2698                 }
2699 #endif
2700
2701                 if (WIFSIGNALED(status)) {
2702                         if (pid == strace_child)
2703                                 exit_code = 0x100 | WTERMSIG(status);
2704                         if (cflag != CFLAG_ONLY_STATS
2705                             && (qual_flags[WTERMSIG(status)] & QUAL_SIGNAL)) {
2706                                 printleader(tcp);
2707 #ifdef WCOREDUMP
2708                                 tprintf("+++ killed by %s %s+++\n",
2709                                         signame(WTERMSIG(status)),
2710                                         WCOREDUMP(status) ? "(core dumped) " : "");
2711 #else
2712                                 tprintf("+++ killed by %s +++\n",
2713                                         signame(WTERMSIG(status)));
2714 #endif
2715                                 printing_tcp = NULL;
2716                         }
2717                         fflush(tcp->outf);
2718                         droptcb(tcp);
2719                         continue;
2720                 }
2721                 if (WIFEXITED(status)) {
2722                         if (pid == strace_child)
2723                                 exit_code = WEXITSTATUS(status);
2724                         if (tcp == printing_tcp) {
2725                                 tprints(" <unfinished ...>\n");
2726                                 printing_tcp = NULL;
2727                         }
2728                         if (!cflag /* && (qual_flags[WTERMSIG(status)] & QUAL_SIGNAL) */ ) {
2729                                 printleader(tcp);
2730                                 tprintf("+++ exited with %d +++\n", WEXITSTATUS(status));
2731                                 printing_tcp = NULL;
2732                         }
2733                         fflush(tcp->outf);
2734                         droptcb(tcp);
2735                         continue;
2736                 }
2737                 if (!WIFSTOPPED(status)) {
2738                         fprintf(stderr, "PANIC: pid %u not stopped\n", pid);
2739                         droptcb(tcp);
2740                         continue;
2741                 }
2742
2743                 /* Is this the very first time we see this tracee stopped? */
2744                 if (tcp->flags & TCB_STARTUP) {
2745                         if (debug)
2746                                 fprintf(stderr, "pid %d has TCB_STARTUP, initializing it\n", tcp->pid);
2747                         tcp->flags &= ~TCB_STARTUP;
2748                         if (tcp->flags & TCB_BPTSET) {
2749                                 /*
2750                                  * One example is a breakpoint inherited from
2751                                  * parent through fork().
2752                                  */
2753                                 if (clearbpt(tcp) < 0) {
2754                                         /* Pretty fatal */
2755                                         droptcb(tcp);
2756                                         cleanup();
2757                                         return -1;
2758                                 }
2759                         }
2760 #ifdef LINUX
2761                         if (ptrace_setoptions) {
2762                                 if (debug)
2763                                         fprintf(stderr, "setting opts %x on pid %d\n", ptrace_setoptions, tcp->pid);
2764                                 if (ptrace(PTRACE_SETOPTIONS, tcp->pid, NULL, ptrace_setoptions) < 0) {
2765                                         if (errno != ESRCH) {
2766                                                 /* Should never happen, really */
2767                                                 perror_msg_and_die("PTRACE_SETOPTIONS");
2768                                         }
2769                                 }
2770                         }
2771 #endif
2772                 }
2773
2774                 sig = WSTOPSIG(status);
2775
2776                 if (event != 0) {
2777                         /* Ptrace event */
2778 #ifdef USE_SEIZE
2779                         if (event == PTRACE_EVENT_STOP || event == PTRACE_EVENT_STOP1) {
2780                                 /*
2781                                  * PTRACE_INTERRUPT-stop or group-stop.
2782                                  * PTRACE_INTERRUPT-stop has sig == SIGTRAP here.
2783                                  */
2784                                 if (sig == SIGSTOP
2785                                  || sig == SIGTSTP
2786                                  || sig == SIGTTIN
2787                                  || sig == SIGTTOU
2788                                 ) {
2789                                         stopped = 1;
2790                                         goto show_stopsig;
2791                                 }
2792                         }
2793 #endif
2794                         goto restart_tracee_with_sig_0;
2795                 }
2796
2797                 /* Is this post-attach SIGSTOP?
2798                  * Interestingly, the process may stop
2799                  * with STOPSIG equal to some other signal
2800                  * than SIGSTOP if we happend to attach
2801                  * just before the process takes a signal.
2802                  */
2803                 if (sig == SIGSTOP && (tcp->flags & TCB_IGNORE_ONE_SIGSTOP)) {
2804                         if (debug)
2805                                 fprintf(stderr, "ignored SIGSTOP on pid %d\n", tcp->pid);
2806                         tcp->flags &= ~TCB_IGNORE_ONE_SIGSTOP;
2807                         goto restart_tracee_with_sig_0;
2808                 }
2809
2810                 if (sig != syscall_trap_sig) {
2811                         siginfo_t si;
2812
2813                         /* Nonzero (true) if tracee is stopped by signal
2814                          * (as opposed to "tracee received signal").
2815                          */
2816                         stopped = (ptrace(PTRACE_GETSIGINFO, pid, 0, (long) &si) < 0);
2817 #ifdef USE_SEIZE
2818  show_stopsig:
2819 #endif
2820                         if (cflag != CFLAG_ONLY_STATS
2821                             && (qual_flags[sig] & QUAL_SIGNAL)) {
2822 #if defined(PT_CR_IPSR) && defined(PT_CR_IIP)
2823                                 long pc = 0;
2824                                 long psr = 0;
2825
2826                                 upeek(tcp, PT_CR_IPSR, &psr);
2827                                 upeek(tcp, PT_CR_IIP, &pc);
2828
2829 # define PSR_RI 41
2830                                 pc += (psr >> PSR_RI) & 0x3;
2831 # define PC_FORMAT_STR  " @ %lx"
2832 # define PC_FORMAT_ARG  , pc
2833 #else
2834 # define PC_FORMAT_STR  ""
2835 # define PC_FORMAT_ARG  /* nothing */
2836 #endif
2837                                 printleader(tcp);
2838                                 if (!stopped) {
2839                                         tprints("--- ");
2840                                         printsiginfo(&si, verbose(tcp));
2841                                         tprintf(" (%s)" PC_FORMAT_STR " ---\n",
2842                                                 strsignal(sig)
2843                                                 PC_FORMAT_ARG);
2844                                 } else
2845                                         tprintf("--- %s by %s" PC_FORMAT_STR " ---\n",
2846                                                 strsignal(sig),
2847                                                 signame(sig)
2848                                                 PC_FORMAT_ARG);
2849                                 printing_tcp = NULL;
2850                                 fflush(tcp->outf);
2851                         }
2852
2853                         if (!stopped)
2854                                 /* It's signal-delivery-stop. Inject the signal */
2855                                 goto restart_tracee;
2856
2857                         /* It's group-stop */
2858 #ifdef USE_SEIZE
2859                         if (use_seize) {
2860                                 /*
2861                                  * This ends ptrace-stop, but does *not* end group-stop.
2862                                  * This makes stopping signals work properly on straced process
2863                                  * (that is, process really stops. It used to continue to run).
2864                                  */
2865                                 if (ptrace_restart(PTRACE_LISTEN, tcp, 0) < 0) {
2866                                         cleanup();
2867                                         return -1;
2868                                 }
2869                                 continue;
2870                         }
2871                         /* We don't have PTRACE_LISTEN support... */
2872 #endif
2873                         goto restart_tracee;
2874                 }
2875
2876                 /* We handled quick cases, we are permitted to interrupt now. */
2877                 if (interrupted)
2878                         return 0;
2879
2880                 /* This should be syscall entry or exit.
2881                  * (Or it still can be that pesky post-execve SIGTRAP!)
2882                  * Handle it.
2883                  */
2884                 if (trace_syscall(tcp) < 0 && !tcp->ptrace_errno) {
2885                         /* ptrace() failed in trace_syscall() with ESRCH.
2886                          * Likely a result of process disappearing mid-flight.
2887                          * Observed case: exit_group() terminating
2888                          * all processes in thread group.
2889                          */
2890                         if (tcp->flags & TCB_ATTACHED) {
2891                                 if (printing_tcp) {
2892                                         /* Do we have dangling line "syscall(param, param"?
2893                                          * Finish the line then.
2894                                          */
2895                                         printing_tcp->flags |= TCB_REPRINT;
2896                                         tprints(" <unfinished ...>\n");
2897                                         printing_tcp = NULL;
2898                                         fflush(tcp->outf);
2899                                 }
2900                                 /* We assume that ptrace error was caused by process death.
2901                                  * We used to detach(tcp) here, but since we no longer
2902                                  * implement "detach before death" policy/hack,
2903                                  * we can let this process to report its death to us
2904                                  * normally, via WIFEXITED or WIFSIGNALED wait status.
2905                                  */
2906                         } else {
2907                                 /* It's our real child (and we also trace it) */
2908                                 /* my_tkill(pid, SIGKILL); - why? */
2909                                 /* droptcb(tcp); - why? */
2910                         }
2911                         continue;
2912                 }
2913  restart_tracee_with_sig_0:
2914                 sig = 0;
2915  restart_tracee:
2916                 /* Remember current print column before continuing. */
2917                 tcp->curcol = curcol;
2918                 if (ptrace_restart(PTRACE_SYSCALL, tcp, sig) < 0) {
2919                         cleanup();
2920                         return -1;
2921                 }
2922         }
2923         return 0;
2924 }
2925
2926 #endif /* !USE_PROCFS */
2927
2928 void
2929 tprintf(const char *fmt, ...)
2930 {
2931         va_list args;
2932
2933         va_start(args, fmt);
2934         if (outf) {
2935                 int n = vfprintf(outf, fmt, args);
2936                 if (n < 0) {
2937                         if (outf != stderr)
2938                                 perror(outfname == NULL
2939                                        ? "<writing to pipe>" : outfname);
2940                 } else
2941                         curcol += n;
2942         }
2943         va_end(args);
2944 }
2945
2946 void
2947 tprints(const char *str)
2948 {
2949         if (outf) {
2950                 int n = fputs(str, outf);
2951                 if (n >= 0) {
2952                         curcol += strlen(str);
2953                         return;
2954                 }
2955                 if (outf != stderr)
2956                         perror(outfname == NULL
2957                                ? "<writing to pipe>" : outfname);
2958         }
2959 }
2960
2961 void
2962 printleader(struct tcb *tcp)
2963 {
2964         if (printing_tcp) {
2965                 if (printing_tcp->ptrace_errno) {
2966                         if (printing_tcp->flags & TCB_INSYSCALL) {
2967                                 tprints(" <unavailable>) ");
2968                                 tabto();
2969                         }
2970                         tprints("= ? <unavailable>\n");
2971                         printing_tcp->ptrace_errno = 0;
2972                 } else if (!outfname || followfork < 2 || printing_tcp == tcp) {
2973                         printing_tcp->flags |= TCB_REPRINT;
2974                         tprints(" <unfinished ...>\n");
2975                 }
2976         }
2977
2978         printing_tcp = tcp;
2979         curcol = 0;
2980         if ((followfork == 1 || pflag_seen > 1) && outfname)
2981                 tprintf("%-5d ", tcp->pid);
2982         else if (nprocs > 1 && !outfname)
2983                 tprintf("[pid %5u] ", tcp->pid);
2984         if (tflag) {
2985                 char str[sizeof("HH:MM:SS")];
2986                 struct timeval tv, dtv;
2987                 static struct timeval otv;
2988
2989                 gettimeofday(&tv, NULL);
2990                 if (rflag) {
2991                         if (otv.tv_sec == 0)
2992                                 otv = tv;
2993                         tv_sub(&dtv, &tv, &otv);
2994                         tprintf("%6ld.%06ld ",
2995                                 (long) dtv.tv_sec, (long) dtv.tv_usec);
2996                         otv = tv;
2997                 }
2998                 else if (tflag > 2) {
2999                         tprintf("%ld.%06ld ",
3000                                 (long) tv.tv_sec, (long) tv.tv_usec);
3001                 }
3002                 else {
3003                         time_t local = tv.tv_sec;
3004                         strftime(str, sizeof(str), "%T", localtime(&local));
3005                         if (tflag > 1)
3006                                 tprintf("%s.%06ld ", str, (long) tv.tv_usec);
3007                         else
3008                                 tprintf("%s ", str);
3009                 }
3010         }
3011         if (iflag)
3012                 printcall(tcp);
3013 }
3014
3015 void
3016 tabto(void)
3017 {
3018         if (curcol < acolumn)
3019                 tprints(acolumn_spaces + curcol);
3020 }
3021
3022 #ifdef HAVE_MP_PROCFS
3023
3024 int
3025 mp_ioctl(int fd, int cmd, void *arg, int size)
3026 {
3027         struct iovec iov[2];
3028         int n = 1;
3029
3030         iov[0].iov_base = &cmd;
3031         iov[0].iov_len = sizeof cmd;
3032         if (arg) {
3033                 ++n;
3034                 iov[1].iov_base = arg;
3035                 iov[1].iov_len = size;
3036         }
3037
3038         return writev(fd, iov, n);
3039 }
3040
3041 #endif