Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

- Make truss thread-aware.

Approved by: kib (mentor)
MFC after: 2 weeks

- Fix detaching under some circumstances.

When truss is detaching from very active process it is possible to
hang on waitpid(2) in restore_proc() forever, because
ptrace(PT_SYSCALL) must be called before detaching, to allow the
debugging process to continue execution. Also when truss called with
'-c' argument, it does not print anything after detach, because it
immediately exits from restore_proc().

To fix these two problems make detaching deferred, but then it is
impossible to detach from a process which does not do any system call.
To fix this issue use sigaction(2) instead of signal(3) to disable
SA_RESTART flag for waitpid(2) that makes it non-restartable. Remove
global variable child_pid, because now detaching is handled in context
where child's pid is known.

Reported by: mjg
Tested by: mjg, swills
Approved by: kib (mentor)
MFC after: 2 weeks

- Remove unused variables.
- Remove redundant return after err(3) call.

Approved by: kib (mentor)

- Style(9) cleanup.

Approved by: kib (mentor)

- Use pid_t type instead of just int.

Approved by: kib (mentor)

Use explicit information from the kernel to detect the traps due to
syscall entry and leave.

Based on submision by: Dan Nelson <dnelson allantgroup com>
MFC after: 1 month

Properly check for errors from waitpid().

Submitted by: gcooper
MFC after: 1 week

Remove setpgid() call before executing child process.

Using a separate process group here is bad, since (for example) job
control in the TTY layer prevents interaction with the TTY, causing the
child process to hang.

Mentioned on: current@
MFC after: 2 weeks

Fix copyright spelling.

PR: 139825
Submitted by: Ruslan Mahmatkhanov

Revert most part of 200420 as requested, as more review and polish is
needed.

Remove unneeded header includes from usr.bin/ except contributed code.

Tested with: make universe

Correct a bug where pr_data should have been assigned.

MFp4: Bugfixes for truss(1):

- Fix logic handling execve(). We will not be able to
obtain information otherwise.
- truss coredump [1].
- truss does not work against itself [2].

PR: bin/58970 [1], bin/45193 [2]
Submitted by: Howard Su
Approved by: re (kensmith)

Make use of ptrace(2) instead of procfs in truss(1), eliminating
yet another need of an available /proc/ mount.

Tested with: make universe
Submitted by: howardsu
Reviewed by: alfred

- Add decoding of kse_release, kevent, sigprocmask, unmount, socket, getrusage,
rename, __getcwd, shutdown, getrlimit, setrlimit, _umtx_lock, _umtx_unlock,
pathconf, truncate, ftruncate, kill

- Decode more arguments of open, mprot, *stat, and fcntl.

- Convert all constant-macro and bitfield decoding to lookup tables; much
cleaner than previous code.

- Print the timestamp of process exit and signal reception when -d or -D are in
use

- Try six times with 1/2 second delay to debug the child

PR: bin/52190 (updated)
Submitted by: Dan Nelson <dnelson@allantgroup.com>
Approved by: alfred

When doing the initial open of the proc via procfs, complain if we are
unable to open the /proc/pid/mem file. Otherwise doing a truss on
a nonexistant pid makes us return success even though no such process
exists.

I've been working on this somewhat so I'm moving the
parts I'm touching to be as style(9) compliant as I can.

Move declarations of Procfd to a header file.

Add FBSDID. Do not \n terminate warnx() argument. fprint() -> warnx().

- Use time.h not sys/time.h.
- Fix printf format errors.

Submitted by: bde

Include <sys/time.h> for the declaration of struct timeval. Do not
depend on namespace pollution in <signal.h>. (truss shouldn't be
using timevals anyway, since it was implemented long after timevals
were obsoleted by timespecs.)

Allow tracking fork()ed children.

PR: bin/25587 (in part)
MFC after: 3 weeks

Parameterize globals.

PR: bin/25587 (in part)
MFC after: 3 weeks

Partial WARNS=1 fizes with NO_WERROR set to prevent world breakage.
Use __FBSDID().

Back out part of previous commit: remove #include <sys/proc.h>.

#include <sys/proc.h> where needed (for the stop event definitions) and
reorder includes everywhere to conform to style(9).

Handle the case where we truss an SUGID program -- in particular, we need
to wake up any processes waiting via PIOCWAIT on process exit, and truss
needs to be more aware that a process may actually disappear while it's
waiting.

Reviewed by: Paul Saab <ps@yahoo-inc.com>

$Id$ -> $FreeBSD$

Calls one or more of malloc(), warn(), err(), syslog(), execlp() or
execvp() in the child branch of a vfork(). Changed to use fork()
instead.

Some of these (mv, find, apply, xargs) might benefit greatly from
being rewritten to use vfork() properly.

PR: Loosely related to bin/8252
Approved by: jkh and bde

Sort Xrefs. Use err(3). Remove uneeded #include.
Correct usage: one of {-p pid, command} is required.
Open output file when command line is fully analyzed: incorrect `truss -o f'
command does not create an empty file anymore.

Add some copyright and license terms, at Jordan's request. Note that
syscall.h just refers to another file for the copyright notice.

Change the ioctls for procfs around a bit; in particular, whever possible,
change from

ioctl(fd, PIOC<foo>, &i);

to

ioctl(fd, PIOC<foo>, i);

This is going from the _IOW to _IO ioctl macro. The kernel, procctl, and
truss must be in synch for it all to work (not doing so will get errors about
inappropriate ioctl's, fortunately). Hopefully I didn't forget anything :).

Use the new PF_LINGER flag -- when this is set in a process' proc structure,
said process will not have its event mask cleared (and be restarted) on
the last close of a procfs/mem file for that pid. This reduces the chance
that a truss-monitored process will be left hanging with these bits set
and nobody looking for it.

This is the least-tested change of all of these, I'm afraid.

err(3) already includes strerror(errno) and a trailing \n

Set the close-on-exec flag in the child; otherwise, it eats up a
file descriptor that it shouldn't.

Truss program. Requires procfs.