IF YOU WOULD LIKE TO GET AN ACCOUNT, please write an
email to Administrator. User accounts are meant only to access repo
and report issues and/or generate pull requests.
This is a purpose-specific Git hosting for
BaseALT
projects. Thank you for your understanding!
Только зарегистрированные пользователи имеют доступ к сервису!
Для получения аккаунта, обратитесь к администратору.
text data bss dec hex filename
237384 672 19044 257100 3ec4c strace.before
236448 672 19044 256164 3e8a4 strace
* defs.h: Declare new functions printargs_lu(), printargs_ld()
which simply print syscall all args as unsigned or signed longs.
* desc.c (sys_epoll_create): Call printargs_ld() instead of open-coding it.
* linux/syscall.h: Remove declarations of the following functions:
sys_alarm, sys_getresgid, sys_getsid, sys_nice, sys_setgid, sys_setpgid,
sys_setpgrp, sys_setregid, sys_setresgid.
* process.c (sys_setgid): Delete this function: now aliased to sys_setuid().
(sys_getresgid): Delete this function: now aliased to sys_getresuid().
(sys_setregid): Delete this function: now aliased to sys_setreuid().
(sys_setresgid): Delete this function: now aliased to sys_setresuid().
(sys_setpgrp): Delete this function: now aliased to printargs_lu().
(sys_getsid): Likewise.
(sys_setpgid): Likewise.
(sys_alarm): Likewise.
(sys_getpgrp): Delete this function: was unused - was already shadowed
by a define in linux/dummy.h.
(sys_setsid): Likewise.
(sys_getpgid): Likewise.
* resource.c (sys_nice): Delete this function: now aliased to printargs_ld().
* linux/dummy.h: Define new aliases (see above for the list).
* syscall.c (printargs_lu): New function.
(printargs_ld): New function.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Conditions such as defined(LINUX) are always true now,
defined(FREEBSD) etc are always false.
When if directive has them as subexpressions, it can be simplified.
Another trivial changes here are fixes for directive indentation.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This change is generated by running every source through the following command:
unifdef -DLINUX -Dlinux -USUNOS4 -USVR4 -UUNIXWARE -UFREEBSD
-USUNOS4_KERNEL_ARCH_KLUDGE -UHAVE_MP_PROCFS
-UHAVE_POLLABLE_PROCFS -UHAVE_PR_SYSCALL -UUSE_PROCFS file.c
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
All new code is predicated on "ifdef USE_SEIZE". If it is not defined,
behavior is not changed.
If USE_SEIZE is enabled and run-time check shows that PTRACE_SEIZE works, then:
- All attaching is done with PTRACE_SEIZE + PTRACE_INTERRUPT.
This means that we no longer generate (and possibly race with) SIGSTOP.
- PTRACE_EVENT_STOP will be generated if tracee is group-stopped.
When we detect it, we issue PTRACE_LISTEN instead of PTRACE_SYSCALL.
This leaves tracee stopped. This fixes the inability to SIGSTOP or ^Z
a straced process.
* defs.h: Add commented-out "define USE_SEIZE 1" and define PTRACE_SEIZE
and related constants.
* strace.c: New variable post_attach_sigstop shows whether we age going
to expect SIGSTOP on attach (IOW: are we going to use PTRACE_SEIZE).
(ptrace_attach_or_seize): New function. Uses PTRACE_ATTACH or
PTRACE_SEIZE + PTRACE_INTERRUPT to attach to given pid.
(startup_attach): Use ptrace_attach_or_seize() instead of ptrace(PTRACE_ATTACH).
(startup_child): Conditionally use alternative attach method using PTRACE_SEIZE.
(test_ptrace_setoptions_followfork): More robust parameters to PTRACE_TRACEME.
(test_ptrace_seize): New function to test whether PTRACE_SEIZE works.
(main): Call test_ptrace_seize() while initializing.
(trace): If PTRACE_EVENT_STOP is seen, restart using PTRACE_LISTEN in order
to not let tracee run.
* process.c: Decode PTRACE_SEIZE, PTRACE_INTERRUPT, PTRACE_LISTEN.
* util.c (ptrace_restart): Add "LISTEN" to a possible error message.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Currently, we use PTRACE_PEEKDATA to read things like filenames and
data passed by I/O syscalls.
PTRACE_PEEKDATA gets one word per syscall. This is VERY expensive.
For example, in order to print fstat syscall, we need to perform
more than twenty trips into kernel to fetch one struct stat!
Kernel 3.2 got a new syscall, process_vm_readv(), which can be used to
copy data blocks out of process' address space.
This change uses it in umoven() and umovestr() functions if possible,
with fallback to old method if process_vm_readv() fails.
If it returns ENOSYS, we don't try to use it anymore, eliminating
overhead of trying it on older kernels.
Result of "time strace -oLOG ls -l /usr/lib >/dev/null":
before patch: 0.372s
After patch: 0.262s
* util.c (process_vm_readv): Wrapper to call process_vm_readv syscall.
(umoven): Use process_vm_readv for block reads of tracee memory.
(umovestr): Likewise.
* linux/syscall.h: Declare new function sys_process_vm_readv.
* process.c (sys_process_vm_readv): Decoder for new syscall.
* linux/i386/syscallent.h: Add process_vm_readv, process_vm_writev syscalls.
* linux/x86_64/syscallent.h: Likewise.
* linux/powerpc/syscallent.h: Likewise.
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
* defs.h: Rename tcp_last to printing_tcp. Explain what it means.
Remove printtrailer() function.
* process.c (sys_exit): Convert printtrailer() call to "printing_tcp = NULL".
* strace.c: Add new variable printing_tcp.
(cleanup): Convert printtrailer() call to "printing_tcp = NULL".
(trace): Likewise.
(trace): Fix checks for incomplete line - it was working wrongly if last syscall was exit.
(printleader): Set printing_tcp.
(printtrailer): Remove this function.
* syscall.c: Remove tcp_last variable.
(trace_syscall_entering): Don't set printing_tcp, printleader call now does it.
(trace_syscall_exiting): Convert printtrailer() call to "printing_tcp = NULL".
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
We set ptrace options when we see post-attach SIGSTOP.
This is wrong: it's better to set them right away on the very first
stop (whichever it will be). It also will make adding SEIZE support easier,
since SEIZE has no post-attach SIGSTOP.
We do it by adding a new bit, TCB_IGNORE_ONE_SIGSTOP, and treating
TCB_STARTUP and TCB_IGNORE_ONE_SIGSTOP as two slightly different things.
* defs.h: Add a new flag bit, TCB_IGNORE_ONE_SIGSTOP.
* process.c (internal_fork): Set TCB_IGNORE_ONE_SIGSTOP on a newly added child.
* strace.c (startup_attach): Set TCB_IGNORE_ONE_SIGSTOP after attach.
Fix a case when "strace -p PID" found PID dead but sone other of its threads
still alive.
(startup_child): Set TCB_IGNORE_ONE_SIGSTOP after attach, _if needed_.
This fixes a bogus case where we can ignore a _real_ SIGSTOP on NOMMU.
(detach): Perform anti-SIGSTOP dance only if TCB_IGNORE_ONE_SIGSTOP is set,
not if TCB_STARTUP is set.
(trace): Set TCB_IGNORE_ONE_SIGSTOP after attach.
Clear TCB_STARTUP and initialize tracee on the very first tracee stop.
Clear TCB_IGNORE_ONE_SIGSTOP when SIGSTOP is seen.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
This fixes logic in detach() which thinks that TCB_STARTUP
means that we are already attached, but did not see SIGSTOP yet.
This also allows to get rid of TCB_ATTACH_DONE flag.
* process.c (internal_fork): Set TCB_STARTUP after attach.
* strace.c (startup_attach): Likewise.
(startup_child): Likewise.
(alloc_tcb): Do not set TCB_STARTUP on tcb allocation - we are
not attached yet.
(trace): Set TCB_STARTUP when we detech an auto-attached child.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
tabto is used in many lines of strace output.
On glibc, tprintf("%*s", col - curcol, "") is noticeably slow
compared to tprintf(" "). Use the latter.
Observed ~15% reduction of time spent in userspace.
* defs.h: Drop extern declaration of acolumn. Make tabto()
take no parameters.
* process.c (sys_exit): Call tabto() with no parameters.
* syscall.c (trace_syscall_exiting): Call tabto() with no parameters.
* strace.c: Make acolumn static, add static char *acolumn_spaces.
(main): Allocate acolumn_spaces as a string of spaces.
(printleader): Call tabto() with no parameters.
(tabto): Use simpler method to print lots of spaces.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
* syscall.c (internal_syscall): Call internal_exec only if
SUNOS4 || (LINUX && TCB_WAITEXECVE).
* process.c (internal_exec): Define this function only if
SUNOS4 || (LINUX && TCB_WAITEXECVE).
(printwaitn): Don't check wordsize if SUPPORTED_PERSONALITIES == 1.
* signal.c (sys_kill): Likewise.
* syscall.c (is_negated_errno): Likewise.
(trace_syscall_exiting): Fold a tprintf into tprintfs which follow it.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
tcp->parent is used for only two things:
(1) to send signal on detach via tgkill (need to know tgid).
Solution: use tkill, it needs only tid.
(2) to optimize out ptrace options setting for new tracees.
Not a big deal if we drop this optimization: "set options" op is fast,
doing it just one extra time once per each tracee is hardly measurable.
TCB_CLONE_THREAD is a misnomer. It used only to flag sibling we attached to
in startup_attach. This is used to prevent infinite recursive rescanning
of /proc/PID/task.
Despite the name, there is no guarantee it is set only on non-leader:
if one would run "strace -f -p THREAD_ID" and THREAD_ID is *not*
a thread leader, strace will happily attach to it and all siblings
and will think that THREAD_ID is the leader! Which is a bug, but
since we no longer detach when we think tracee is going to die,
this bug no longer matters, because we do not use the knowledge
about thread group leaders for anything. (We used it to delay
leader's exit).
IOW: after this patch strace has no need to know about threads, parents
and children, and so on. Therefore it does not track that information.
It treats all tracees as independent entities. Overall,
this simplifies code a lot.
* defs.h: Add TCB_ATTACH_DONE flag, remove TCB_CLONE_THREAD flag
and struct tcb::parent field.
* process.c (internal_fork): Don't set tcpchild->parent.
* strace.c (startup_attach): Use TCB_ATTACH_DONE flag instead of
TCB_CLONE_THREAD to avoid attach attempts on already-attached threads.
Unlike TCB_CLONE_THREAD, TCB_ATTACH_DONE bit is used only temporarily,
and only in this function. We clear it on every tcb before we return.
(detach): Use tkill instead of tgkill.
(trace): Set ptrace options on new tracees unconditionally,
not only when tcp->parent == NULL.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Since we no longer suspend waitpid'ing tracees, we have only one case when
we suspend tracee: when we pick up a new tracee created by clone/fork/vfork.
Background: on some other OSes, attach to child is done this way:
get fork's result (pid), loop ptrace(PTRACE_ATTACH) until you hook up
new process/thread. This is ugly and not safe, but what matters for us
is that it doesn't require suspending. Suspending is required
on Linux only, because on Linux attach to child is done differently.
On Linux, we use two methods of catching new tracee:
adding CLONE_THREAD bit to syscall (if needed, we change
[v]fork into clone before that), or using ptrace options.
In both cases, it may be so that new tracee appears before one which
created it returns from syscall. In this case, current code
suspends new tracee until its creator returns. Only then
strace can determine who is its parent (it needs child's pid for this,
which is visible in parent's [v]fork/clone result).
This is inherently racy. For example, what if SIGKILL kills
creator after it succeeded creating child, but before it returns?
Looks like we will have child suspended forever.
But after previous commit, we DO NOT NEED parent<->child link for anything.
Therefore we do not need suspending too. Bingo!
This patch removes suspending code. Now new tracees will be continued
right away. Next patch will remove tcp->parent member.
* defs.h: Remove TCB_SUSPENDED constant
* process.c (handle_new_child): Delete this function.
(internal_fork): Do not call handle_new_child on syscall exit.
* strace.c (handle_ptrace_event): Delete this function.
(trace): Do not suspend new child; remove all handling
of now impossible TCB_SUSPENDED condition.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Current code plays some ungodly tricks, trying to not detach
thread group leader until all threads exit.
Also, it detaches from a tracee when signal delivery is detected
which will cause tracee to exit.
This operation is racy (not to mention the determination
whether signal is set to SIG_DFL is a horrible hack):
after we determined that this signal is indeed fatal
but before we detach and let process die,
*other thread* may set a handler to this signal, and
we will leak the process, falsely displaying it as killed!
I need to look in the past to figure out why we even do it.
First guess is that it's a workaround for old kernel bugs:
kernel used to deliver exit notifications to the tracer,
not to real parent. These workarounds are ancient
(internal_exit is from 1995).
The patch deletes the hacks. We no longer need tcp->nclone_threads,
TCB_EXITING and TCB_GROUP_EXITING. We also lose a few rather
ugly functions.
I also added a new message: "+++ exited with EXITCODE +++"
which shows exact moment strace got exit notification.
It is analogous to existing "+++ killed by SIG +++" message.
* defs.h: Delete struct tcb::nclone_threads field,
TCB_EXITING and TCB_GROUP_EXITING constants,
declarations of sigishandled() and internal_exit().
* process.c (internal_exit): Delete this function.
(handle_new_child): Don't ++tcp->nclone_threads.
* signal.c (parse_sigset_t): Delete this function.
(sigishandled): Delete this function.
* strace.c (startup_attach): Don't tcbtab[tcbi]->nclone_threads++.
(droptcb): Don't delay dropping if tcp->nclone_threads > 0,
don't drop parent if its nclone_threads reached 0:
just drop (only) this tcb unconditionally.
(detach): don't drop parent.
(handle_group_exit): Delete this function.
(handle_ptrace_event): Instead of handle_group_exit, just drop tcb;
do not panic if we see WIFEXITED from an attached pid;
print "+++ exited with EXITCODE +++" for every WIFEXITED pid.
* syscall.c (internal_syscall): Do not treat sys_exit specially -
don't call internal_exit on it.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
process.c defines CLONE_PTRACE for Linux, so it can't be undefined.
Therefore ifndef CLONE_PTRACE code is dead (since at least 2004).
This patch removes it.
* process.c (handle_new_child): Remove ifdef CLONE_PTRACE/endif (but not
the code inside) and entire ifndef CLONE_PTRACE/endif block.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
TCB_FOLLOWFORK flag seems to be unnecessary, because we either follow
all [v]forks/clones or don't follow any, therefore global variable
followfork is an already existing indicator of what we want to do.
This patch drops all setting/clearing of TCB_FOLLOWFORK bit,
and replaces checks for this bit by checks of followfork value.
In internal_fork, check is moved to in front of if(), since
the check is needed on both "entering" and "exiting" branch.
* defs.h: Remove TCB_FOLLOWFORK define.
* process.c (internal_fork): Do not set/clear TCB_FOLLOWFORK,
test followfork instead of tcp->flags & TCB_FOLLOWFORK.
(handle_new_child): Likewise.
* strace.c (startup_attach): Likewise.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Get rid of fork_tcb() function. It used to do what the comment
above it says, but now it doesn't do much:
it only sets tcp->flags |= TCB_FOLLOWFORK and maybe calls
expand_tcbtab(). The second operation is not necessary, since
alloc_tcp() will do it itself when needed.
This patch deletes fork_tcb(), open-coding tcp->flags |= TCB_FOLLOWFORK
where it was formerly called. It also makes nprocs, tcbtabsize and
expand_tcbtab() static. (While at it, I nuked redundant
extern char **environ declaration: strace.c had *two* of them...)
* defs.h: Remove declarations of nprocs, tcbtabsize and
expand_tcbtab.
* process.c (fork_tcb): Remove this function.
(internal_fork): Open-code fork_tcb.
(handle_new_child): Likewise.
* strace.c: Remove redundant "extern char **environ". Declare
nprocs and tcbtabsize static.
(expand_tcbtab): Make it static.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
* process.c (internal_fork): Remove conditionals which make no difference
(we return 0 on both branches of these ifs).
* util.c: Fix indentation of an ifdef.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Commit 3454e4b463
introduced a bug: sometimes, TRACECLONE/TRACE[V]FORK opts were not set.
The check (tcp->parent == NULL) in old code was meant to check
"if we are not a child created by auto-attach" - in this case,
options need to be set on the child; otherwise they are inherited
and do not need to be set.
I misunderstood the check and if tcp->parent is not NULL, I was
setting only ptrace_setoptions_for_all bits.
This change fixes the problem. Since the fixed logic makes it
unnecessary to keep two sets of options in separate variables,
I merge them back into one variable, ptrace_setoptions.
* defs.h: Merge ptrace_setoptions_followfork and ptrace_setoptions_for_all
into one variable, ptrace_setoptions.
* strace.c: Likewise.
(test_ptrace_setoptions_followfork): Use ptrace_setoptions variable.
(test_ptrace_setoptions_for_all): Likewise.
(main): Likewise.
* process.c (internal_fork): Likewise.
(internal_exec): Likewise.
* strace.c (trace): Fix the bug where different options were set
depending on "tcp->parent == NULL" condition. Add a comment
which makes it more clear why this condition is checked.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
strace used to suspend waitpid until there is a child
for waitpid'ing process to collect status from.
Apparently, it was done because in some very old kernels
(circa 2002 or even earlier) there were ptrace bugs which
were making waitpid in real parent to not see children.
This kernel bug is fixed long ago. This change removes the workaround.
test/wait_must_be_interruptible.c is a test program which
illustrates why without this change strace changes
programs's behavior.
* defs.h: Delete waitpid and nclone_waiting members from from struct tcb.
Remove declaration of internal_wait().
* process.c (internal_wait): Remove this function.
* strace.c (alloc_tcb): Do not set tcp->nclone_waiting.
(resume): Remove this function.
(resume_from_tcp): Remove this function.
(detach): Do not call resume_from_tcp().
(handle_group_exit): Do not call resume_from_tcp().
* syscall.c (internal_syscall): Do not call internal_wait().
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
* defs.h (ptrace_setoptions_for_all): Expose this variable.
* strace.c (ptrace_setoptions_for_all): Remove "static".
* process.c (internal_exec): Don't set TCB_WAITEXECVE bit
if we know that post-execve SIGTRAP is not going to happen.
* defs.h (ptrace_setoptions): Variable renamed to ptrace_setoptions_followfork.
* process.c (internal_fork): Ditto.
* strace.c (ptrace_setoptions_for_all): New variable.
(SYSCALLTRAP): New variable.
(error_msg_and_die): New function.
(test_ptrace_setoptions_for_all): New function.
(main): Call test_ptrace_setoptions_for_all() at init.
(handle_ptrace_event): Handle PTRACE_EVENT_EXEC (by ignoring it).
(trace): Check events and set ptrace options without -f too.
Check WSTOPSIG(status) not for SIGTRAP, but for SYSCALLTRAP.
* defs.h (SYSCALL_NEVER_FAILS): New syscall flag.
* linux/dummy.h: Change redirection for sys_get[ug]id, sys_gete[ug]id
and setfs[ug]id.
* linux/*/syscallent.h: Set SYSCALL_NEVER_FAILS flag for get[ug]id,
gete[ug]id and setfs[ug]id syscalls.
* process.c [LINUX] (sys_getuid, sys_setfsuid): New functions.
* syscall.c (NF): New shorthand macro for use in syscallent.h files.
(get_error): Check SYSCALL_NEVER_FAILS flag.
Reported by Марк Коренберг <socketpair@gmail.com>.
If PTRACE_O_TRACECLONE et al options are supported by kernel,
use them to do followfork rather than the original setbpt
method that changes registers ourselves.
* defs.h [LINUX] (handle_new_child): New function prototype.
* process.c [LINUX] (handle_new_child): New function based on the
code from internal_fork(), with a trivial change: do reparent only
for sys_clone.
[LINUX] (internal_fork): Use handle_new_child(). Do nothing if
ptrace_setoptions is in effect.
* strace.c [LINUX] (handle_ptrace_event): New function.
[LINUX] (trace): If ptrace_setoptions is in effect, then
call the new function to handle PTRACE_EVENT_* status, and
set PTRACE_SETOPTIONS when we see the initial stop of tracee.
Signed-off-by: Wang Chao <wang.chao@cn.fujitsu.com>
If clone is called with flag CLONE_UNTRACED, to be consistent with
option PTRACE_O_TRACECLONE, we should not set CLONE_PTRACE flag on
its arguments.
* process.c [LINUX] (internal_fork): Check the syscall and arguments.
Signed-off-by: Wang Chao <wang.chao@cn.fujitsu.com>
* defs.h (struct xlat): Add const qualifier to the field of
type "char *".
(set_sortby, qualify, printnum, printnum_int): Add const qualifier to
arguments of type "char *".
* count.c (set_sortby): Add const qualifier to the argument and
automatic variable of type "char *".
* desc.c (decode_select): Add const qualifier to automatic variables of
type "char *".
* ioctlsort.c (struct ioctlent): Add const qualifier to fields of
type "char *".
(main): Add const qualifier to argv.
* process.c (printargv): Add const qualifier to the argument and
automatic variable of type "char *".
(printargc) Add const qualifier to argument of type "char *".
* signal.c (sprintsigmask, parse_sigset_t): Add const qualifier to
arguments of type "char *".
* strace.c (progname): Add const qualifier.
(detach): Add const qualifier to automatic variable of type "char *".
* stream.c (struct strbuf): Add const qualifier to the field of
type "char *".
* syscall.c (struct qual_options): Add const qualifier to fields of
type "char *".
(qual_syscall, qual_fault, qual_desc, lookup_class): Add const qualifier
to arguments of type "char *".
(qual_signal): Add const qualifier to the argument of type "char *",
avoid modification of constant argument.
(qualify): Likewise.
* util.c (printflags): Add const qualifier to automatic variable of
type "char *".
(printnum, printnum_int): Add const qualifier to arguments of
type "char *".
When we trace clone() syscall with only exit signal as clone
flags, strace would print an unnecessary OR operator.
* process.c (sys_clone): Fix this.
Signed-off-by: Wang Chao <wang.chao@cn.fujitsu.com>
Remove nclone_detached since CLONE_DETACHED flag was no-op for a very
long time in kernel.
* defs.h (struct tcb): Remove nclone_detached field.
Remove TCB_CLONE_DETACHED flag.
* process.c: Remove CLONE_DETACHED flag.
(clone_flags): Remove CLONE_DETACHED entry.
(internal_fork, internal_wait): Remove code dealing with CLONE_DETACHED
flag and nclone_detached.
* strace.c (startup_attach, alloc_tcb, droptcb, handle_group_exit):
Likewise.
Signed-off-by: Wang Chao <wang.chao@cn.fujitsu.com>
* process.c (internal_wait): Processes counted in tcp->nclone_threads
are tcp's threads, rather than tcp's children.
Signed-off-by: Wang Chao <wang.chao@cn.fujitsu.com>
