]> granicus.if.org Git - strace/blobdiff - syscall.c
mem: decode hugetlb page size in mmap flags
[strace] / syscall.c
index 1f621f5d30c70a190f4f3ef9248aa7f34da89e12..b1047feb67f0ec2cb43180f1e59b00f963b03ddf 100644 (file)
--- a/syscall.c
+++ b/syscall.c
@@ -6,6 +6,7 @@
  * Copyright (c) 1999 IBM Deutschland Entwicklung GmbH, IBM Corporation
  *                     Linux for s390 port by D.J. Barrow
  *                    <barrow_dj@mail.yahoo.com,djbarrow@de.ibm.com>
+ * Copyright (c) 1999-2017 The strace developers.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
 
 #include "defs.h"
 #include "native_defs.h"
+#include "nsig.h"
+#include "number_set.h"
 #include <sys/param.h>
-#include <signal.h>
 
 /* for struct iovec */
 #include <sys/uio.h>
 
+/* for __X32_SYSCALL_BIT */
+#include <asm/unistd.h>
+
 #include "regs.h"
 #include "ptrace.h"
 
 # define NT_PRSTATUS 1
 #endif
 
-#ifndef NSIG
-# warning: NSIG is not defined, using 32
-# define NSIG 32
-#endif
-
 #include "syscall.h"
 
 /* Define these shorthand notations to simplify the syscallent files. */
-#define TD TRACE_DESC
-#define TF TRACE_FILE
-#define TI TRACE_IPC
-#define TN TRACE_NETWORK
-#define TP TRACE_PROCESS
-#define TS TRACE_SIGNAL
-#define TM TRACE_MEMORY
-#define NF SYSCALL_NEVER_FAILS
-#define MA MAX_ARGS
-#define SI STACKTRACE_INVALIDATE_CACHE
-#define SE STACKTRACE_CAPTURE_ON_ENTER
+#include "sysent_shorthand_defs.h"
 
 #define SEN(syscall_name) SEN_ ## syscall_name, SYS_FUNC_NAME(sys_ ## syscall_name)
 
@@ -104,18 +94,7 @@ static const struct_sysent sysent2[] = {
 #endif
 
 /* Now undef them since short defines cause wicked namespace pollution. */
-#undef SEN
-#undef TD
-#undef TF
-#undef TI
-#undef TN
-#undef TP
-#undef TS
-#undef TM
-#undef NF
-#undef MA
-#undef SI
-#undef SE
+#include "sysent_shorthand_undefs.h"
 
 /*
  * `ioctlent[012].h' files are automatically generated by the auxiliary
@@ -224,10 +203,7 @@ unsigned nerrnos = nerrnos0;
 unsigned nsignals = nsignals0;
 unsigned nioctlents = nioctlents0;
 
-unsigned num_quals;
-qualbits_t *qual_vec[SUPPORTED_PERSONALITIES];
-
-static const unsigned nsyscall_vec[SUPPORTED_PERSONALITIES] = {
+const unsigned int nsyscall_vec[SUPPORTED_PERSONALITIES] = {
        nsyscalls0,
 #if SUPPORTED_PERSONALITIES > 1
        nsyscalls1,
@@ -236,7 +212,7 @@ static const unsigned nsyscall_vec[SUPPORTED_PERSONALITIES] = {
        nsyscalls2,
 #endif
 };
-static const struct_sysent *const sysent_vec[SUPPORTED_PERSONALITIES] = {
+const struct_sysent *const sysent_vec[SUPPORTED_PERSONALITIES] = {
        sysent0,
 #if SUPPORTED_PERSONALITIES > 1
        sysent1,
@@ -246,26 +222,6 @@ static const struct_sysent *const sysent_vec[SUPPORTED_PERSONALITIES] = {
 #endif
 };
 
-enum {
-       MAX_NSYSCALLS1 = (nsyscalls0
-#if SUPPORTED_PERSONALITIES > 1
-                       > nsyscalls1 ? nsyscalls0 : nsyscalls1
-#endif
-                       ),
-       MAX_NSYSCALLS2 = (MAX_NSYSCALLS1
-#if SUPPORTED_PERSONALITIES > 2
-                       > nsyscalls2 ? MAX_NSYSCALLS1 : nsyscalls2
-#endif
-                       ),
-       MAX_NSYSCALLS = MAX_NSYSCALLS2,
-       /* We are ready for arches with up to 255 signals,
-        * even though the largest known signo is on MIPS and it is 128.
-        * The number of existing syscalls on all arches is
-        * larger that 255 anyway, so it is just a pedantic matter.
-        */
-       MIN_QUALS = MAX_NSYSCALLS > 255 ? MAX_NSYSCALLS : 255
-};
-
 #if SUPPORTED_PERSONALITIES > 1
 unsigned current_personality;
 
@@ -280,6 +236,17 @@ static const int personality_wordsize[SUPPORTED_PERSONALITIES] = {
 };
 # endif
 
+# ifndef current_klongsize
+unsigned current_klongsize;
+static const int personality_klongsize[SUPPORTED_PERSONALITIES] = {
+       PERSONALITY0_KLONGSIZE,
+       PERSONALITY1_KLONGSIZE,
+#  if SUPPORTED_PERSONALITIES > 2
+       PERSONALITY2_KLONGSIZE,
+#  endif
+};
+# endif
+
 void
 set_personality(int personality)
 {
@@ -324,6 +291,9 @@ set_personality(int personality)
 # ifndef current_wordsize
        current_wordsize = personality_wordsize[personality];
 # endif
+# ifndef current_klongsize
+       current_klongsize = personality_klongsize[personality];
+# endif
 }
 
 static void
@@ -338,16 +308,12 @@ update_personality(struct tcb *tcp, unsigned int personality)
        tcp->currpers = personality;
 
 # undef PERSONALITY_NAMES
-# if defined POWERPC64
-#  define PERSONALITY_NAMES {"64 bit", "32 bit"}
-# elif defined X86_64
+# if defined X86_64
 #  define PERSONALITY_NAMES {"64 bit", "32 bit", "x32"}
 # elif defined X32
 #  define PERSONALITY_NAMES {"x32", "32 bit"}
-# elif defined AARCH64
+# elif SUPPORTED_PERSONALITIES == 2
 #  define PERSONALITY_NAMES {"64 bit", "32 bit"}
-# elif defined TILE
-#  define PERSONALITY_NAMES {"64-bit", "32-bit"}
 # endif
 # ifdef PERSONALITY_NAMES
        if (!qflag) {
@@ -359,221 +325,6 @@ update_personality(struct tcb *tcp, unsigned int personality)
 }
 #endif
 
-static int qual_desc(const char *, unsigned int, int);
-static int qual_signal(const char *, unsigned int, int);
-static int qual_syscall(const char *, unsigned int, int);
-
-static const struct qual_options {
-       unsigned int bitflag;
-       const char *option_name;
-       int (*qualify)(const char *, unsigned int, int);
-       const char *argument_name;
-} qual_options[] = {
-       { QUAL_TRACE,   "trace",        qual_syscall,   "system call"   },
-       { QUAL_TRACE,   "t",            qual_syscall,   "system call"   },
-       { QUAL_ABBREV,  "abbrev",       qual_syscall,   "system call"   },
-       { QUAL_ABBREV,  "a",            qual_syscall,   "system call"   },
-       { QUAL_VERBOSE, "verbose",      qual_syscall,   "system call"   },
-       { QUAL_VERBOSE, "v",            qual_syscall,   "system call"   },
-       { QUAL_RAW,     "raw",          qual_syscall,   "system call"   },
-       { QUAL_RAW,     "x",            qual_syscall,   "system call"   },
-       { QUAL_SIGNAL,  "signal",       qual_signal,    "signal"        },
-       { QUAL_SIGNAL,  "signals",      qual_signal,    "signal"        },
-       { QUAL_SIGNAL,  "s",            qual_signal,    "signal"        },
-       { QUAL_READ,    "read",         qual_desc,      "descriptor"    },
-       { QUAL_READ,    "reads",        qual_desc,      "descriptor"    },
-       { QUAL_READ,    "r",            qual_desc,      "descriptor"    },
-       { QUAL_WRITE,   "write",        qual_desc,      "descriptor"    },
-       { QUAL_WRITE,   "writes",       qual_desc,      "descriptor"    },
-       { QUAL_WRITE,   "w",            qual_desc,      "descriptor"    },
-       { 0,            NULL,           NULL,           NULL            },
-};
-
-static void
-reallocate_vec(void **vec, unsigned int old_nmemb,
-              size_t size, unsigned int new_nmemb)
-{
-       unsigned int p;
-
-       for (p = 0; p < SUPPORTED_PERSONALITIES; ++p) {
-               vec[p] = xreallocarray(vec[p], new_nmemb, size);
-               memset(vec[p] + size * old_nmemb, 0,
-                      (new_nmemb - old_nmemb) * size);
-       }
-}
-
-static void
-reallocate_qual(const unsigned int n)
-{
-       reallocate_vec((void **) qual_vec, num_quals, sizeof(qualbits_t), n);
-       num_quals = n;
-}
-
-static void
-qualify_one(const unsigned int n, unsigned int bitflag, const int not, const int pers)
-{
-       int p;
-
-       if (num_quals <= n)
-               reallocate_qual(n + 1);
-
-       for (p = 0; p < SUPPORTED_PERSONALITIES; p++) {
-               if (pers == p || pers < 0) {
-                       if (not)
-                               qual_vec[p][n] &= ~bitflag;
-                       else
-                               qual_vec[p][n] |= bitflag;
-               }
-       }
-}
-
-static int
-lookup_class(const char *s)
-{
-       if (strcmp(s, "file") == 0)
-               return TRACE_FILE;
-       if (strcmp(s, "ipc") == 0)
-               return TRACE_IPC;
-       if (strcmp(s, "network") == 0)
-               return TRACE_NETWORK;
-       if (strcmp(s, "process") == 0)
-               return TRACE_PROCESS;
-       if (strcmp(s, "signal") == 0)
-               return TRACE_SIGNAL;
-       if (strcmp(s, "desc") == 0)
-               return TRACE_DESC;
-       if (strcmp(s, "memory") == 0)
-               return TRACE_MEMORY;
-       return -1;
-}
-
-static int
-qual_syscall(const char *s, const unsigned int bitflag, const int not)
-{
-       unsigned int p;
-       unsigned int i;
-       int n;
-       int rc = -1;
-
-       if ((n = lookup_class(s)) >= 0) {
-               for (p = 0; p < SUPPORTED_PERSONALITIES; ++p) {
-                       for (i = 0; i < nsyscall_vec[p]; ++i) {
-                               if ((sysent_vec[p][i].sys_flags & n) == n) {
-                                       qualify_one(i, bitflag, not, p);
-                               }
-                       }
-               }
-               return 0;
-       }
-
-       if (*s >= '0' && *s <= '9') {
-               i = string_to_uint(s);
-               if (i >= MAX_NSYSCALLS)
-                       return -1;
-               qualify_one(i, bitflag, not, -1);
-               return 0;
-       }
-
-       for (p = 0; p < SUPPORTED_PERSONALITIES; p++) {
-               for (i = 0; i < nsyscall_vec[p]; i++) {
-                       if (sysent_vec[p][i].sys_name
-                        && strcmp(s, sysent_vec[p][i].sys_name) == 0
-                       ) {
-                               qualify_one(i, bitflag, not, p);
-                               rc = 0;
-                       }
-               }
-       }
-
-       return rc;
-}
-
-static int
-qual_signal(const char *s, const unsigned int bitflag, const int not)
-{
-       unsigned int i;
-
-       if (*s >= '0' && *s <= '9') {
-               int signo = string_to_uint(s);
-               if (signo < 0 || signo > 255)
-                       return -1;
-               qualify_one(signo, bitflag, not, -1);
-               return 0;
-       }
-       if (strncasecmp(s, "SIG", 3) == 0)
-               s += 3;
-       for (i = 0; i <= NSIG; i++) {
-               if (strcasecmp(s, signame(i) + 3) == 0) {
-                       qualify_one(i, bitflag, not, -1);
-                       return 0;
-               }
-       }
-       return -1;
-}
-
-static int
-qual_desc(const char *s, const unsigned int bitflag, const int not)
-{
-       if (*s >= '0' && *s <= '9') {
-               int desc = string_to_uint(s);
-               if (desc < 0 || desc > 0x7fff) /* paranoia */
-                       return -1;
-               qualify_one(desc, bitflag, not, -1);
-               return 0;
-       }
-       return -1;
-}
-
-void
-qualify(const char *s)
-{
-       const struct qual_options *opt;
-       char *copy;
-       const char *p;
-       int not;
-       unsigned int i;
-
-       if (num_quals == 0)
-               reallocate_qual(MIN_QUALS);
-
-       opt = &qual_options[0];
-       for (i = 0; (p = qual_options[i].option_name); i++) {
-               unsigned int len = strlen(p);
-               if (strncmp(s, p, len) == 0 && s[len] == '=') {
-                       opt = &qual_options[i];
-                       s += len + 1;
-                       break;
-               }
-       }
-       not = 0;
-       if (*s == '!') {
-               not = 1;
-               s++;
-       }
-       if (strcmp(s, "none") == 0) {
-               not = 1 - not;
-               s = "all";
-       }
-       if (strcmp(s, "all") == 0) {
-               for (i = 0; i < num_quals; i++) {
-                       qualify_one(i, opt->bitflag, not, -1);
-               }
-               return;
-       }
-       for (i = 0; i < num_quals; i++) {
-               qualify_one(i, opt->bitflag, !not, -1);
-       }
-       copy = xstrdup(s);
-       for (p = strtok(copy, ","); p; p = strtok(NULL, ",")) {
-               if (opt->qualify(p, opt->bitflag, not)) {
-                       error_msg_and_die("invalid %s '%s'",
-                               opt->argument_name, p);
-               }
-       }
-       free(copy);
-       return;
-}
-
 #ifdef SYS_socket_subcall
 static void
 decode_socket_subcall(struct tcb *tcp)
@@ -583,7 +334,7 @@ decode_socket_subcall(struct tcb *tcp)
        if (call < 1 || call >= SYS_socket_nsubcalls)
                return;
 
-       const unsigned long scno = SYS_socket_subcall + call;
+       const kernel_ulong_t scno = SYS_socket_subcall + call;
        const unsigned int nargs = sysent[scno].nargs;
        uint64_t buf[nargs];
 
@@ -591,7 +342,7 @@ decode_socket_subcall(struct tcb *tcp)
                return;
 
        tcp->scno = scno;
-       tcp->qual_flg = qual_flags[scno];
+       tcp->qual_flg = qual_flags(scno);
        tcp->s_ent = &sysent[scno];
 
        unsigned int i;
@@ -631,7 +382,7 @@ decode_ipc_subcall(struct tcb *tcp)
        }
 
        tcp->scno = SYS_ipc_subcall + call;
-       tcp->qual_flg = qual_flags[tcp->scno];
+       tcp->qual_flg = qual_flags(tcp->scno);
        tcp->s_ent = &sysent[tcp->scno];
 
        const unsigned int n = tcp->s_ent->nargs;
@@ -645,10 +396,10 @@ decode_ipc_subcall(struct tcb *tcp)
 static void
 decode_mips_subcall(struct tcb *tcp)
 {
-       if (!SCNO_IS_VALID(tcp->u_arg[0]))
+       if (!scno_is_valid(tcp->u_arg[0]))
                return;
        tcp->scno = tcp->u_arg[0];
-       tcp->qual_flg = qual_flags[tcp->scno];
+       tcp->qual_flg = qual_flags(tcp->scno);
        tcp->s_ent = &sysent[tcp->scno];
        memmove(&tcp->u_arg[0], &tcp->u_arg[1],
                sizeof(tcp->u_arg) - sizeof(tcp->u_arg[0]));
@@ -670,17 +421,15 @@ decode_mips_subcall(struct tcb *tcp)
 static void
 dumpio(struct tcb *tcp)
 {
-       int sen;
-
        if (syserror(tcp))
                return;
-       if ((unsigned long) tcp->u_arg[0] >= num_quals)
-               return;
-       sen = tcp->s_ent->sen;
-       if (SEN_printargs == sen)
+
+       int fd = tcp->u_arg[0];
+       if (fd < 0)
                return;
-       if (qual_flags[tcp->u_arg[0]] & QUAL_READ) {
-               switch (sen) {
+
+       if (is_number_in_set(fd, read_set)) {
+               switch (tcp->s_ent->sen) {
                case SEN_read:
                case SEN_pread:
                case SEN_recv:
@@ -702,8 +451,8 @@ dumpio(struct tcb *tcp)
                        return;
                }
        }
-       if (qual_flags[tcp->u_arg[0]] & QUAL_WRITE) {
-               switch (sen) {
+       if (is_number_in_set(fd, write_set)) {
+               switch (tcp->s_ent->sen) {
                case SEN_write:
                case SEN_pwrite:
                case SEN_send:
@@ -715,11 +464,10 @@ dumpio(struct tcb *tcp)
                case SEN_pwritev:
                case SEN_pwritev2:
                case SEN_vmsplice:
-                       dumpiov(tcp, tcp->u_arg[2], tcp->u_arg[1]);
+                       dumpiov_upto(tcp, tcp->u_arg[2], tcp->u_arg[1], -1);
                        break;
                case SEN_sendmsg:
-                       dumpiov_in_msghdr(tcp, tcp->u_arg[1],
-                                         (unsigned long) -1L);
+                       dumpiov_in_msghdr(tcp, tcp->u_arg[1], -1);
                        break;
                case SEN_sendmmsg:
                        dumpiov_in_mmsghdr(tcp, tcp->u_arg[1]);
@@ -732,10 +480,10 @@ dumpio(struct tcb *tcp)
  * Shuffle syscall numbers so that we don't have huge gaps in syscall table.
  * The shuffling should be an involution: shuffle_scno(shuffle_scno(n)) == n.
  */
-#if defined(ARM) || defined(AARCH64) /* So far only 32-bit ARM needs this */
-static long
-shuffle_scno(unsigned long scno)
+static kernel_ulong_t
+shuffle_scno(kernel_ulong_t scno)
 {
+#if defined(ARM) || defined(AARCH64) /* So far only 32-bit ARM needs this */
        if (scno < ARM_FIRST_SHUFFLED_SYSCALL)
                return scno;
 
@@ -745,7 +493,7 @@ shuffle_scno(unsigned long scno)
        if (scno == 0x000ffff0)
                return ARM_FIRST_SHUFFLED_SYSCALL;
 
-#define ARM_SECOND_SHUFFLED_SYSCALL (ARM_FIRST_SHUFFLED_SYSCALL + 1)
+# define ARM_SECOND_SHUFFLED_SYSCALL (ARM_FIRST_SHUFFLED_SYSCALL + 1)
        /*
         * Is it ARM specific syscall?
         * Swap [0x000f0000, 0x000f0000 + LAST_SPECIAL] range
@@ -758,25 +506,10 @@ shuffle_scno(unsigned long scno)
        if (scno <= ARM_SECOND_SHUFFLED_SYSCALL + ARM_LAST_SPECIAL_SYSCALL) {
                return scno + 0x000f0000 - ARM_SECOND_SHUFFLED_SYSCALL;
        }
+#endif /* ARM || AARCH64 */
 
        return scno;
 }
-#else
-# define shuffle_scno(scno) ((long)(scno))
-#endif
-
-const char *
-syscall_name(long scno)
-{
-       static char buf[sizeof("syscall_%lu") + sizeof(long)*3];
-
-       if (SCNO_IS_VALID(scno))
-               return sysent[scno].sys_name;
-       else {
-               sprintf(buf, "syscall_%lu", scno);
-               return buf;
-       }
-}
 
 const char *
 err_name(unsigned long err)
@@ -795,33 +528,112 @@ clear_regs(void)
        get_regs_error = -1;
 }
 
+static void get_regs(pid_t pid);
 static int get_syscall_args(struct tcb *);
 static int get_syscall_result(struct tcb *);
 static int arch_get_scno(struct tcb *tcp);
+static int arch_set_scno(struct tcb *, kernel_ulong_t);
 static void get_error(struct tcb *, const bool);
-#if defined X86_64 || defined POWERPC
-static int getregs_old(pid_t);
-#endif
+static int arch_set_error(struct tcb *);
+static int arch_set_success(struct tcb *);
 
-static int
-trace_syscall_entering(struct tcb *tcp)
+struct inject_opts *inject_vec[SUPPORTED_PERSONALITIES];
+
+static struct inject_opts *
+tcb_inject_opts(struct tcb *tcp)
+{
+       return (scno_in_range(tcp->scno) && tcp->inject_vec[current_personality])
+              ? &tcp->inject_vec[current_personality][tcp->scno] : NULL;
+}
+
+
+static long
+tamper_with_syscall_entering(struct tcb *tcp, unsigned int *signo)
 {
-       int res, scno_good;
+       if (!tcp->inject_vec[current_personality]) {
+               tcp->inject_vec[current_personality] =
+                       xcalloc(nsyscalls, sizeof(**inject_vec));
+               memcpy(tcp->inject_vec[current_personality],
+                      inject_vec[current_personality],
+                      nsyscalls * sizeof(**inject_vec));
+       }
+
+       struct inject_opts *opts = tcb_inject_opts(tcp);
+
+       if (!opts || opts->first == 0)
+               return 0;
+
+       --opts->first;
+
+       if (opts->first != 0)
+               return 0;
+
+       opts->first = opts->step;
+
+       if (opts->data.flags & INJECT_F_SIGNAL)
+               *signo = opts->data.signo;
+       if (opts->data.flags & INJECT_F_RETVAL && !arch_set_scno(tcp, -1))
+               tcp->flags |= TCB_TAMPERED;
+
+       return 0;
+}
+
+static long
+tamper_with_syscall_exiting(struct tcb *tcp)
+{
+       struct inject_opts *opts = tcb_inject_opts(tcp);
+
+       if (!opts)
+               return 0;
+
+       if (opts->data.rval >= 0) {
+               kernel_long_t u_rval = tcp->u_rval;
+
+               tcp->u_rval = opts->data.rval;
+               if (arch_set_success(tcp)) {
+                       tcp->u_rval = u_rval;
+               } else {
+                       tcp->u_error = 0;
+               }
+       } else {
+               unsigned long new_error = -opts->data.rval;
+
+               if (new_error != tcp->u_error && new_error <= MAX_ERRNO_VALUE) {
+                       unsigned long u_error = tcp->u_error;
+
+                       tcp->u_error = new_error;
+                       if (arch_set_error(tcp)) {
+                               tcp->u_error = u_error;
+                       }
+               }
+       }
+
+       return 0;
+}
 
-       scno_good = res = get_scno(tcp);
+/*
+ * Returns:
+ * 0: "ignore this ptrace stop", bail out silently.
+ * 1: ok, decoded; call
+ *    syscall_entering_finish(tcp, syscall_entering_trace(tcp, ...)).
+ * other: error; call syscall_entering_finish(tcp, res), where res is the value
+ *    returned.
+ */
+int
+syscall_entering_decode(struct tcb *tcp)
+{
+       int res = get_scno(tcp);
        if (res == 0)
                return res;
-       if (res == 1)
-               res = get_syscall_args(tcp);
-
-       if (res != 1) {
+       int scno_good = res;
+       if (res != 1 || (res = get_syscall_args(tcp)) != 1) {
                printleader(tcp);
                tprintf("%s(", scno_good == 1 ? tcp->s_ent->sys_name : "????");
                /*
                 * " <unavailable>" will be added later by the code which
                 * detects ptrace errors.
                 */
-               goto ret;
+               return res;
        }
 
 #ifdef LINUX_MIPSO32
@@ -829,14 +641,6 @@ trace_syscall_entering(struct tcb *tcp)
                decode_mips_subcall(tcp);
 #endif
 
-       if (   SEN_execve == tcp->s_ent->sen
-# if defined(SPARC) || defined(SPARC64)
-           || SEN_execv == tcp->s_ent->sen
-# endif
-          ) {
-               hide_log_until_execve = 0;
-       }
-
 #if defined(SYS_socket_subcall) || defined(SYS_ipc_subcall)
        switch (tcp->s_ent->sen) {
 # ifdef SYS_socket_subcall
@@ -852,19 +656,43 @@ trace_syscall_entering(struct tcb *tcp)
        }
 #endif
 
-       if (!(tcp->qual_flg & QUAL_TRACE)
-        || (tracing_paths && !pathtrace_match(tcp))
-       ) {
-               tcp->flags |= TCB_INSYSCALL | TCB_FILTERED;
-               tcp->sys_func_rval = 0;
+       return 1;
+}
+
+int
+syscall_entering_trace(struct tcb *tcp, unsigned int *sig)
+{
+       /* Restrain from fault injection while the trace executes strace code. */
+       if (hide_log(tcp)) {
+               tcp->qual_flg &= ~QUAL_INJECT;
+       }
+
+       switch (tcp->s_ent->sen) {
+               case SEN_execve:
+               case SEN_execveat:
+#if defined SPARC || defined SPARC64
+               case SEN_execv:
+#endif
+                       tcp->flags &= ~TCB_HIDE_LOG;
+                       break;
+       }
+
+       if (!traced(tcp) || (tracing_paths && !pathtrace_match(tcp))) {
+               tcp->flags |= TCB_FILTERED;
                return 0;
        }
 
        tcp->flags &= ~TCB_FILTERED;
 
-       if (cflag == CFLAG_ONLY_STATS || hide_log_until_execve) {
-               res = 0;
-               goto ret;
+       if (hide_log(tcp)) {
+               return 0;
+       }
+
+       if (inject(tcp))
+               tamper_with_syscall_entering(tcp, sig);
+
+       if (cflag == CFLAG_ONLY_STATS) {
+               return 0;
        }
 
 #ifdef USE_LIBUNWIND
@@ -876,33 +704,41 @@ trace_syscall_entering(struct tcb *tcp)
 
        printleader(tcp);
        tprintf("%s(", tcp->s_ent->sys_name);
-       if ((tcp->qual_flg & QUAL_RAW) && SEN_exit != tcp->s_ent->sen)
-               res = printargs(tcp);
-       else
-               res = tcp->s_ent->sys_func(tcp);
-
+       int res = raw(tcp) ? printargs(tcp) : tcp->s_ent->sys_func(tcp);
        fflush(tcp->outf);
- ret:
+       return res;
+}
+
+void
+syscall_entering_finish(struct tcb *tcp, int res)
+{
        tcp->flags |= TCB_INSYSCALL;
        tcp->sys_func_rval = res;
        /* Measure the entrance time as late as possible to avoid errors. */
-       if (Tflag || cflag)
+       if ((Tflag || cflag) && !filtered(tcp))
                gettimeofday(&tcp->etime, NULL);
-       return res;
 }
 
-static int
-trace_syscall_exiting(struct tcb *tcp)
+static bool
+syscall_tampered(struct tcb *tcp)
 {
-       int sys_res;
-       struct timeval tv;
-       int res;
-       unsigned long u_error;
-       const char *u_error_str;
+       return tcp->flags & TCB_TAMPERED;
+}
 
+/* Returns:
+ * 0: "bail out".
+ * 1: ok.
+ * -1: error in one of ptrace ops.
+ *
+ * If not 0, call syscall_exiting_trace(tcp, res), where res is the return
+ *    value. Anyway, call syscall_exiting_finish(tcp) then.
+ */
+int
+syscall_exiting_decode(struct tcb *tcp, struct timeval *ptv)
+{
        /* Measure the exit time as early as possible to avoid errors. */
-       if (Tflag || cflag)
-               gettimeofday(&tv, NULL);
+       if ((Tflag || cflag) && !(filtered(tcp) || hide_log(tcp)))
+               gettimeofday(ptv, NULL);
 
 #ifdef USE_LIBUNWIND
        if (stack_trace_enabled) {
@@ -911,17 +747,26 @@ trace_syscall_exiting(struct tcb *tcp)
        }
 #endif
 
+       if (filtered(tcp) || hide_log(tcp))
+               return 0;
+
+       get_regs(tcp->pid);
 #if SUPPORTED_PERSONALITIES > 1
        update_personality(tcp, tcp->currpers);
 #endif
-       res = (get_regs_error ? -1 : get_syscall_result(tcp));
-       if (filtered(tcp) || hide_log_until_execve)
-               goto ret;
+       return get_regs_error ? -1 : get_syscall_result(tcp);
+}
+
+int
+syscall_exiting_trace(struct tcb *tcp, struct timeval tv, int res)
+{
+       if (syserror(tcp) && syscall_tampered(tcp))
+               tamper_with_syscall_exiting(tcp);
 
        if (cflag) {
                count_syscall(tcp, &tv);
                if (cflag == CFLAG_ONLY_STATS) {
-                       goto ret;
+                       return 0;
                }
        }
 
@@ -948,27 +793,24 @@ trace_syscall_exiting(struct tcb *tcp)
                tabto();
                tprints("= ? <unavailable>\n");
                line_ended();
-               tcp->flags &= ~TCB_INSYSCALL;
-               tcp->sys_func_rval = 0;
-               free_tcb_priv_data(tcp);
                return res;
        }
        tcp->s_prev_ent = tcp->s_ent;
 
-       sys_res = 0;
-       if (tcp->qual_flg & QUAL_RAW) {
+       int sys_res = 0;
+       if (raw(tcp)) {
                /* sys_res = printargs(tcp); - but it's nop on sysexit */
        } else {
        /* FIXME: not_failing_only (IOW, option -z) is broken:
         * failure of syscall is known only after syscall return.
         * Thus we end up with something like this on, say, ENOENT:
-        *     open("doesnt_exist", O_RDONLY <unfinished ...>
+        *     open("does_not_exist", O_RDONLY <unfinished ...>
         *     {next syscall decode}
         * whereas the intended result is that open(...) line
         * is not shown at all.
         */
                if (not_failing_only && tcp->u_error)
-                       goto ret;       /* ignore failed syscalls */
+                       return 0;       /* ignore failed syscalls */
                if (tcp->sys_func_rval & RVAL_DECODED)
                        sys_res = tcp->sys_func_rval;
                else
@@ -977,14 +819,19 @@ trace_syscall_exiting(struct tcb *tcp)
 
        tprints(") ");
        tabto();
-       u_error = tcp->u_error;
-       if (tcp->qual_flg & QUAL_RAW) {
-               if (u_error)
+       unsigned long u_error = tcp->u_error;
+
+       if (raw(tcp)) {
+               if (u_error) {
                        tprintf("= -1 (errno %lu)", u_error);
-               else
-                       tprintf("= %#lx", tcp->u_rval);
-       }
-       else if (!(sys_res & RVAL_NONE) && u_error) {
+               } else {
+                       tprintf("= %#" PRI_klx, tcp->u_rval);
+               }
+               if (syscall_tampered(tcp))
+                       tprints(" (INJECTED)");
+       } else if (!(sys_res & RVAL_NONE) && u_error) {
+               const char *u_error_str;
+
                switch (u_error) {
                /* Blocked signals do not interrupt any syscalls.
                 * In this case syscalls don't return ERESTARTfoo codes.
@@ -1049,65 +896,51 @@ trace_syscall_exiting(struct tcb *tcp)
                                        u_error, strerror(u_error));
                        break;
                }
+               if (syscall_tampered(tcp))
+                       tprints(" (INJECTED)");
                if ((sys_res & RVAL_STR) && tcp->auxstr)
                        tprintf(" (%s)", tcp->auxstr);
-       }
-       else {
+       } else {
                if (sys_res & RVAL_NONE)
                        tprints("= ?");
                else {
                        switch (sys_res & RVAL_MASK) {
                        case RVAL_HEX:
-#if SUPPORTED_PERSONALITIES > 1
-                               if (current_wordsize < sizeof(long))
+#if ANY_WORDSIZE_LESS_THAN_KERNEL_LONG
+                               if (current_wordsize < sizeof(tcp->u_rval)) {
                                        tprintf("= %#x",
                                                (unsigned int) tcp->u_rval);
-                               else
+                               else
 #endif
-                                       tprintf("= %#lx", tcp->u_rval);
+                               {
+                                       tprintf("= %#" PRI_klx, tcp->u_rval);
+                               }
                                break;
                        case RVAL_OCTAL:
                                tprints("= ");
                                print_numeric_long_umask(tcp->u_rval);
                                break;
                        case RVAL_UDECIMAL:
-#if SUPPORTED_PERSONALITIES > 1
-                               if (current_wordsize < sizeof(long))
+#if ANY_WORDSIZE_LESS_THAN_KERNEL_LONG
+                               if (current_wordsize < sizeof(tcp->u_rval)) {
                                        tprintf("= %u",
                                                (unsigned int) tcp->u_rval);
-                               else
+                               else
 #endif
-                                       tprintf("= %lu", tcp->u_rval);
+                               {
+                                       tprintf("= %" PRI_klu, tcp->u_rval);
+                               }
                                break;
                        case RVAL_DECIMAL:
-                               tprintf("= %ld", tcp->u_rval);
+                               tprintf("= %" PRI_kld, tcp->u_rval);
                                break;
                        case RVAL_FD:
                                if (show_fd_path) {
                                        tprints("= ");
                                        printfd(tcp, tcp->u_rval);
-                               }
-                               else
-                                       tprintf("= %ld", tcp->u_rval);
-                               break;
-#if HAVE_STRUCT_TCB_EXT_ARG
-                       /*
-                       case RVAL_LHEX:
-                               tprintf("= %#llx", tcp->u_lrval);
-                               break;
-                       case RVAL_LOCTAL:
-                               tprintf("= %#llo", tcp->u_lrval);
-                               break;
-                       */
-                       case RVAL_LUDECIMAL:
-                               tprintf("= %llu", tcp->u_lrval);
+                               } else
+                                       tprintf("= %" PRI_kld, tcp->u_rval);
                                break;
-                       /*
-                       case RVAL_LDECIMAL:
-                               tprintf("= %lld", tcp->u_lrval);
-                               break;
-                       */
-#endif /* HAVE_STRUCT_TCB_EXT_ARG */
                        default:
                                error_msg("invalid rval format");
                                break;
@@ -1115,6 +948,8 @@ trace_syscall_exiting(struct tcb *tcp)
                }
                if ((sys_res & RVAL_STR) && tcp->auxstr)
                        tprintf(" (%s)", tcp->auxstr);
+               if (syscall_tampered(tcp))
+                       tprints(" (INJECTED)");
        }
        if (Tflag) {
                tv_sub(&tv, &tv, &tcp->etime);
@@ -1129,19 +964,15 @@ trace_syscall_exiting(struct tcb *tcp)
        if (stack_trace_enabled)
                unwind_print_stacktrace(tcp);
 #endif
-
- ret:
-       tcp->flags &= ~TCB_INSYSCALL;
-       tcp->sys_func_rval = 0;
-       free_tcb_priv_data(tcp);
        return 0;
 }
 
-int
-trace_syscall(struct tcb *tcp)
+void
+syscall_exiting_finish(struct tcb *tcp)
 {
-       return exiting(tcp) ?
-               trace_syscall_exiting(tcp) : trace_syscall_entering(tcp);
+       tcp->flags &= ~(TCB_INSYSCALL | TCB_TAMPERED);
+       tcp->sys_func_rval = 0;
+       free_tcb_priv_data(tcp);
 }
 
 bool
@@ -1173,38 +1004,6 @@ restore_cleared_syserror(struct tcb *tcp)
        tcp->u_error = saved_u_error;
 }
 
-#include "kernel_types.h"
-
-/*
- * Check the syscall return value register value for whether it is
- * a negated errno code indicating an error, or a success return value.
- */
-static inline bool
-is_negated_errno(kernel_ulong_t val)
-{
-       /* Linux kernel defines MAX_ERRNO to 4095. */
-       kernel_ulong_t max = -(kernel_long_t) 4095;
-
-#if defined X86_64 || defined X32
-       /*
-        * current_wordsize is 4 for x32 personality
-        * but truncation _must not_ be done in it, so
-        * check current_personality instead.
-        */
-       if (current_personality == 1) {
-               val = (uint32_t) val;
-               max = (uint32_t) max;
-       }
-#elif SUPPORTED_PERSONALITIES > 1 && SIZEOF_LONG > 4
-       if (current_wordsize < sizeof(val)) {
-               val = (uint32_t) val;
-               max = (uint32_t) max;
-       }
-#endif
-
-       return val >= max;
-}
-
 #include "arch_regs.c"
 
 #ifdef HAVE_GETRVAL2
@@ -1217,23 +1016,31 @@ print_pc(struct tcb *tcp)
 #if defined ARCH_PC_REG
 # define ARCH_GET_PC 0
 #elif defined ARCH_PC_PEEK_ADDR
-       long pc;
+       kernel_ulong_t pc;
 # define ARCH_PC_REG pc
 # define ARCH_GET_PC upeek(tcp->pid, ARCH_PC_PEEK_ADDR, &pc)
 #else
 # error Neither ARCH_PC_REG nor ARCH_PC_PEEK_ADDR is defined
 #endif
+       get_regs(tcp->pid);
        if (get_regs_error || ARCH_GET_PC)
                tprints(current_wordsize == 4 ? "[????????] "
                                              : "[????????????????] ");
        else
-               tprintf(current_wordsize == 4 ? "[%08lx] " : "[%016lx] ",
-                       (unsigned long) ARCH_PC_REG);
+               tprintf(current_wordsize == 4
+                       ? "[%08" PRI_klx "] " : "[%016" PRI_klx "] ",
+                       (kernel_ulong_t) ARCH_PC_REG);
 }
 
-#if defined ARCH_REGS_FOR_GETREGSET
+#include "getregs_old.h"
+
+#undef ptrace_getregset_or_getregs
+#undef ptrace_setregset_or_setregs
+#ifdef ARCH_REGS_FOR_GETREGSET
+
+# define ptrace_getregset_or_getregs ptrace_getregset
 static long
-get_regset(pid_t pid)
+ptrace_getregset(pid_t pid)
 {
 # ifdef ARCH_IOVEC_FOR_GETREGSET
        /* variable iovec */
@@ -1250,65 +1057,112 @@ get_regset(pid_t pid)
 
 # endif
 }
-#endif /* ARCH_REGS_FOR_GETREGSET */
 
-void
+# ifndef HAVE_GETREGS_OLD
+#  define ptrace_setregset_or_setregs ptrace_setregset
+static int
+ptrace_setregset(pid_t pid)
+{
+#  ifdef ARCH_IOVEC_FOR_GETREGSET
+       /* variable iovec */
+       return ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS,
+                     &ARCH_IOVEC_FOR_GETREGSET);
+#  else
+       /* constant iovec */
+       static struct iovec io = {
+               .iov_base = &ARCH_REGS_FOR_GETREGSET,
+               .iov_len = sizeof(ARCH_REGS_FOR_GETREGSET)
+       };
+       return ptrace(PTRACE_SETREGSET, pid, NT_PRSTATUS, &io);
+#  endif
+}
+# endif /* !HAVE_GETREGS_OLD */
+
+#elif defined ARCH_REGS_FOR_GETREGS
+
+# define ptrace_getregset_or_getregs ptrace_getregs
+static long
+ptrace_getregs(pid_t pid)
+{
+# if defined SPARC || defined SPARC64
+       /* SPARC systems have the meaning of data and addr reversed */
+       return ptrace(PTRACE_GETREGS, pid, (void *) &ARCH_REGS_FOR_GETREGS, 0);
+# else
+       return ptrace(PTRACE_GETREGS, pid, NULL, &ARCH_REGS_FOR_GETREGS);
+# endif
+}
+
+# ifndef HAVE_GETREGS_OLD
+#  define ptrace_setregset_or_setregs ptrace_setregs
+static int
+ptrace_setregs(pid_t pid)
+{
+#  if defined SPARC || defined SPARC64
+       /* SPARC systems have the meaning of data and addr reversed */
+       return ptrace(PTRACE_SETREGS, pid, (void *) &ARCH_REGS_FOR_GETREGS, 0);
+#  else
+       return ptrace(PTRACE_SETREGS, pid, NULL, &ARCH_REGS_FOR_GETREGS);
+#  endif
+}
+# endif /* !HAVE_GETREGS_OLD */
+
+#endif /* ARCH_REGS_FOR_GETREGSET || ARCH_REGS_FOR_GETREGS */
+
+static void
 get_regs(pid_t pid)
 {
 #undef USE_GET_SYSCALL_RESULT_REGS
-#ifdef ARCH_REGS_FOR_GETREGSET
-# ifdef X86_64
-       /* Try PTRACE_GETREGSET first, fallback to PTRACE_GETREGS. */
-       static int getregset_support;
+#ifdef ptrace_getregset_or_getregs
 
-       if (getregset_support >= 0) {
-               get_regs_error = get_regset(pid);
-               if (getregset_support > 0)
-                       return;
+       if (get_regs_error != -1)
+               return;
+
+# ifdef HAVE_GETREGS_OLD
+       /*
+        * Try PTRACE_GETREGSET/PTRACE_GETREGS first,
+        * fallback to getregs_old.
+        */
+       static int use_getregs_old;
+       if (use_getregs_old < 0) {
+               get_regs_error = ptrace_getregset_or_getregs(pid);
+               return;
+       } else if (use_getregs_old == 0) {
+               get_regs_error = ptrace_getregset_or_getregs(pid);
                if (get_regs_error >= 0) {
-                       getregset_support = 1;
+                       use_getregs_old = -1;
                        return;
                }
                if (errno == EPERM || errno == ESRCH)
                        return;
-               getregset_support = -1;
+               use_getregs_old = 1;
        }
        get_regs_error = getregs_old(pid);
-# else /* !X86_64 */
-       /* Assume that PTRACE_GETREGSET works. */
-       get_regs_error = get_regset(pid);
-# endif
-#elif defined ARCH_REGS_FOR_GETREGS
-# if defined SPARC || defined SPARC64
-       /* SPARC systems have the meaning of data and addr reversed */
-       get_regs_error =
-               ptrace(PTRACE_GETREGS, pid, (void *) &ARCH_REGS_FOR_GETREGS, 0);
-# elif defined POWERPC
-       static bool old_kernel = 0;
-       if (old_kernel)
-               goto old;
-       get_regs_error = ptrace(PTRACE_GETREGS, pid, NULL, &ARCH_REGS_FOR_GETREGS);
-       if (get_regs_error && errno == EIO) {
-               old_kernel = 1;
- old:
-               get_regs_error = getregs_old(pid);
-       }
-# else
-       /* Assume that PTRACE_GETREGS works. */
-       get_regs_error = ptrace(PTRACE_GETREGS, pid, NULL, &ARCH_REGS_FOR_GETREGS);
-# endif
+# else /* !HAVE_GETREGS_OLD */
+       /* Assume that PTRACE_GETREGSET/PTRACE_GETREGS works. */
+       get_regs_error = ptrace_getregset_or_getregs(pid);
+# endif /* !HAVE_GETREGS_OLD */
+
+#else /* !ptrace_getregset_or_getregs */
 
-#else /* !ARCH_REGS_FOR_GETREGSET && !ARCH_REGS_FOR_GETREGS */
 # define USE_GET_SYSCALL_RESULT_REGS 1
 # warning get_regs is not implemented for this architecture yet
        get_regs_error = 0;
-#endif
+
+#endif /* !ptrace_getregset_or_getregs */
+}
+
+#ifdef ptrace_setregset_or_setregs
+static int
+set_regs(pid_t pid)
+{
+       return ptrace_setregset_or_setregs(pid);
 }
+#endif /* ptrace_setregset_or_setregs */
 
 struct sysent_buf {
        struct tcb *tcp;
        struct_sysent ent;
-       char buf[sizeof("syscall_%lu") + sizeof(long) * 3];
+       char buf[sizeof("syscall_%lu") + sizeof(kernel_ulong_t) * 3];
 };
 
 static void
@@ -1321,14 +1175,17 @@ free_sysent_buf(void *ptr)
 
 /*
  * Returns:
- * 0: "ignore this ptrace stop", bail out of trace_syscall_entering() silently.
- * 1: ok, continue in trace_syscall_entering().
- * other: error, trace_syscall_entering() should print error indicator
- *    ("????" etc) and bail out.
+ * 0: "ignore this ptrace stop", syscall_entering_decode() should return a "bail
+ *    out silently" code.
+ * 1: ok, continue in syscall_entering_decode().
+ * other: error, syscall_entering_decode() should print error indicator
+ *    ("????" etc) and return an appropriate code.
  */
 int
 get_scno(struct tcb *tcp)
 {
+       get_regs(tcp->pid);
+
        if (get_regs_error)
                return -1;
 
@@ -1336,9 +1193,9 @@ get_scno(struct tcb *tcp)
        if (rc != 1)
                return rc;
 
-       if (SCNO_IS_VALID(tcp->scno)) {
+       if (scno_is_valid(tcp->scno)) {
                tcp->s_ent = &sysent[tcp->scno];
-               tcp->qual_flg = qual_flags[tcp->scno];
+               tcp->qual_flg = qual_flags(tcp->scno);
        } else {
                struct sysent_buf *s = xcalloc(1, sizeof(*s));
 
@@ -1347,7 +1204,7 @@ get_scno(struct tcb *tcp)
                s->ent.sen = SEN_printargs;
                s->ent.sys_func = printargs;
                s->ent.sys_name = s->buf;
-               sprintf(s->buf, "syscall_%lu", shuffle_scno(tcp->scno));
+               sprintf(s->buf, "syscall_%" PRI_klu, shuffle_scno(tcp->scno));
 
                tcp->s_ent = &s->ent;
                tcp->qual_flg = QUAL_RAW | DEFAULT_QUAL_FLAGS;
@@ -1355,7 +1212,8 @@ get_scno(struct tcb *tcp)
                set_tcb_priv_data(tcp, s, free_sysent_buf);
 
                if (debug_flag)
-                       error_msg("pid %d invalid syscall %ld", tcp->pid, tcp->scno);
+                       error_msg("pid %d invalid syscall %" PRI_kld,
+                                 tcp->pid, tcp->scno);
        }
        return 1;
 }
@@ -1365,8 +1223,8 @@ static int get_syscall_result_regs(struct tcb *);
 #endif
 
 /* Returns:
- * 1: ok, continue in trace_syscall_exiting().
- * -1: error, trace_syscall_exiting() should print error indicator
+ * 1: ok, continue in syscall_exiting_trace().
+ * -1: error, syscall_exiting_trace() should print error indicator
  *    ("????" etc) and bail out.
  */
 static int
@@ -1383,11 +1241,23 @@ get_syscall_result(struct tcb *tcp)
 }
 
 #include "get_scno.c"
+#include "set_scno.c"
 #include "get_syscall_args.c"
 #ifdef USE_GET_SYSCALL_RESULT_REGS
 # include "get_syscall_result.c"
 #endif
 #include "get_error.c"
-#if defined X86_64 || defined POWERPC
+#include "set_error.c"
+#ifdef HAVE_GETREGS_OLD
 # include "getregs_old.c"
 #endif
+
+const char *
+syscall_name(kernel_ulong_t scno)
+{
+#if defined X32_PERSONALITY_NUMBER && defined __X32_SYSCALL_BIT
+       if (current_personality == X32_PERSONALITY_NUMBER)
+               scno &= ~__X32_SYSCALL_BIT;
+#endif
+       return scno_is_valid(scno) ? sysent[scno].sys_name : NULL;
+}