2026-06-15  Dmitry V. Levin  <ldv@strace.io>

	strace: use fopen_stream instead of fopen for /proc files.
	* src/strace.c (proc_pid_tracer, has_cap_sys_ptrace, hint_yama): Use
	fopen_stream instead of fopen.

	Fixes: v7.0-79-g0e0d8682c "strace -p: diagnose EPERM by checking for existing tracer"
	Fixes: v7.0-81-g59d284ac4 "strace -p EPERM: diagnose insufficient signal permissions"
	Fixes: v7.0-83-ge769c6b98 "strace -p EPERM: also give a hint about YAMA"

2026-06-15  Dmitry V. Levin  <ldv@strace.io>

	Update .mailmap.
	* .mailmap: Add email addresses of Cursor AI and Stanislav Brabec
	to avoid duplication in CREDITS file.

	Prepare for 7.1 release.
	* NEWS: Update for 7.1 release.

2026-06-15  Dmitry V. Levin  <ldv@strace.io>

	strace.spec.in: add Recommends: yama-ptrace-enable for FESCo Change #3569
	* strace.spec.in [0%{?fedora} >= 45 || 0%{?rhel} >= 11]:
	Add "Recommends: yama-ptrace-enable".

	Resolves: https://bugzilla.redhat.com/2461721

2026-06-15  Dmitry V. Levin  <ldv@strace.io>

	Update copyright headers.
	Headers updated automatically using maint/update_copyright_years.sh
	script.

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	tests: check strace -p EPERM diagnostics for YAMA restriction.
	* src/disable_ptrace.c: New file.
	* src/disable_ptrace_request.c: Add DISABLE_PTRACE_ERRNO knob and
	support disabling all ptrace calls when DISABLE_PTRACE_REQUEST is
	not defined.
	* src/Makefile.am (noinst_PROGRAMS): Add disable_ptrace.
	(disable_ptrace_LDADD): New variable.
	* src/.gitignore: Add /disable_ptrace.
	* tests/attach-p-eperm-yama.test: New file.
	* tests/Makefile.am (MISC_TESTS): Add attach-p-eperm-yama.test.

	Assisted-by: Claude:claude-sonnet-4-6

2026-06-14  Stanislav Brabec  <sbrabec@suse.com>
	    Dmitry V. Levin  <ldv@strace.io>

	strace -p EPERM: also give a hint about YAMA.
	Extend diagnose_attach_eperm to call hint_yama if neither an existing
	tracer nor uid mismatch explains the EPERM.

	hint_yama reads /proc/sys/kernel/yama/ptrace_scope.  Scope 0 means
	YAMA is disabled; no hint is shown.  Scopes 1 and 2 only restrict
	processes that lack CAP_SYS_PTRACE, so if strace holds that capability
	the hint is suppressed for those scopes.  Scope 3 disables all ptrace
	unconditionally, so the hint is always appropriate there.

	* src/strace.c (hint_yama): New function.
	(diagnose_attach_eperm): Call hint_yama as last resort.

	Assisted-by: Claude:claude-sonnet-4-6

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	tests: check strace -p EPERM signal permission diagnostics.
	* tests/attach-p-eperm-signal.test: New file.
	* tests/Makefile.am (MISC_TESTS): Add attach-p-eperm-signal.test.

	Assisted-by: Claude:claude-sonnet-4-6

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	strace -p EPERM: diagnose insufficient signal permissions.
	Extend diagnose_attach_eperm to check signal permissions when strace
	lacks CAP_SYS_PTRACE.

	has_cap_sys_ptrace reads CapEff from /proc/self/status and tests bit 19
	(CAP_SYS_PTRACE); it caches its result.  tkill is used to probe signal
	permission: YAMA restricts ptrace but not signals, so if tkill fails
	with EPERM the caller cannot signal the process, meaning uid mismatch
	is likely the cause.

	The check is skipped when strace holds CAP_SYS_PTRACE,
	since that capability bypasses uid-based ptrace restrictions.

	* src/strace.c (has_cap_sys_ptrace): New function.
	(diagnose_attach_eperm): Check signal permissions when strace lacks
	CAP_SYS_PTRACE.

	Assisted-by: Claude:claude-sonnet-4-6

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	tests: check strace -p EPERM diagnostics for already traced process.
	* tests/attach-p-eperm-already-traced.test: New file.
	* tests/Makefile.am (MISC_TESTS): Add attach-p-eperm-already-traced.test.

	Assisted-by: Claude:claude-sonnet-4-6

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	strace -p: diagnose EPERM by checking for existing tracer.
	If strace -p fails on EPERM, call diagnose_attach_eperm to identify
	the likely cause.  Save errno before calling perror_msg, whose
	internal fflush/fprintf calls may change it.

	The initial implementation of diagnose_attach_eperm checks TracerPid
	in /proc/<pid>/status: if the process is already being traced, report
	that directly.

	* src/strace.c (proc_pid_tracer, diagnose_attach_eperm): New functions.
	(attach_tcb): Save errno before perror_msg.  On EPERM, call
	diagnose_attach_eperm.

	Assisted-by: Claude:claude-sonnet-4-6

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	doc: replace "Co-authored Commits" with "AI Coding Assistants" section.
	* doc/COMMIT-MESSAGES.md: Replace the "Co-authored Commits" subsection
	with "AI Coding Assistants" subsection that documents the Assisted-by
	tag format for attributing AI tool contributions.

2026-06-14  dependabot[bot]  <49699333+dependabot[bot]@users.noreply.github.com>

	build(deps): bump codecov/codecov-action from 6.0.1 to 7.0.0.
	Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.1 to 7.0.0.
	- [Release notes](https://github.com/codecov/codecov-action/releases)
	- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
	- [Commits](https://github.com/codecov/codecov-action/compare/e79a6962e0d4c0c17b229090214935d2e33f8354...fb8b3582c8e4def4969c97caa2f19720cb33a72f)

	---
	updated-dependencies:
	- dependency-name: codecov/codecov-action
	  dependency-version: 7.0.0
	  dependency-type: direct:production
	  update-type: version-update:semver-major
	...

2026-06-14  Dmitry V. Levin  <ldv@strace.io>

	.github/workflows/ci.yml: switch Codecov upload to OIDC authentication.
	Switches Codecov test coverage uploads from a token-based approach
	to OpenID Connect (OIDC).

	This resolves an issue where workflows triggered by pull requests (such
	as those from forks or Dependabot) failed with a "Token required because
	branch is protected" error due to GitHub secrets being restricted in
	those contexts.

	* .github/workflows/ci.yml (coverage): Add `id-token: write` permission,
	Replace `token' parameter with `use_oidc'.

2026-06-14  dependabot[bot]  <49699333+dependabot[bot]@users.noreply.github.com>

	build(deps): bump actions/checkout from 6.0.2 to 6.0.3.
	Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
	- [Release notes](https://github.com/actions/checkout/releases)
	- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
	- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)

	---
	updated-dependencies:
	- dependency-name: actions/checkout
	  dependency-version: 6.0.3
	  dependency-type: direct:production
	  update-type: version-update:semver-patch
	...

2026-06-08  Gleb Fotengauer-Malinovskiy  <glebfm@altlinux.org>

	Update ioctl entries from linux v7.1.
	* src/linux/32/ioctls_inc_align16.h: Update from linux v7.1-rc7 using
	ioctls_gen.sh.
	* src/linux/32/ioctls_inc_align32.h: Likewise.
	* src/linux/32/ioctls_inc_align64.h: Likewise.
	* src/linux/64/ioctls_inc.h: Likewise.
	* src/linux/x32/ioctls_inc0.h: Likewise.
	* NEWS: Mention this change.

2026-06-08  Dmitry V. Levin  <ldv@strace.io>

	io_uring: update decoding of struct io_uring_buf_reg.
	* src/io_uring.c (print_io_uring_buf_reg): Decode
	struct io_uring_buf_reg.min_left introduced by Linux kernel commit
	v7.1-rc2~14^2~2.
	* tests/io_uring_register.c (main): Check it.

	bundled: update linux UAPI headers to v7.1-rc7.
	* bundled/linux/include/uapi/linux/io_uring.h: Update to
	headers_install'ed Linux kernel v7.1-rc7.
	* bundled/linux/include/uapi/linux/rseq.h: Likewise.
	* bundled/linux/include/uapi/linux/tee.h: Likewise.

2026-06-08  Gabi Falk  <gabifalk@gmx.com>

	mips: fix fetching the seventh syscall argument on o32.
	The seventh o32 syscall argument lives on the user stack and was fetched
	at an offset from mips_REG_SP, which is left zeroed on the
	PTRACE_GET_SYSCALL_INFO code path because get_regs() is not called there.
	Use get_stack_pointer(), which works on both code paths.

	* src/linux/mips/get_syscall_args.c [LINUX_MIPSO32]
	(arch_get_syscall_args_extra): Use get_stack_pointer() instead of
	mips_REG_SP.

	Fixes: v5.0~58 "mips o32: fix 7th syscall argument with PTRACE_GET_SYSCALL_INFO API"

2026-06-03  Gabi Falk  <gabifalk@gmx.com>

	tests: use SIGILL in ioctl_pidfd_get_info coredump_signal check.
	coredump_signal is decoded with printsignal(), which uses the
	per-architecture signal name table.  Signal 6 is SIGABRT on most
	architectures but SIGIOT on MIPS, so the test failed on mips64el.
	Use SIGILL (4), which has the same name everywhere.

	* tests/ioctl_pidfd_get_info.c (injected_pidfd_get_info_decode_checks):
	Inject SIGILL and expect "SIGILL" instead of SIGABRT.

2026-06-03  Gabi Falk  <gabifalk@gmx.com>

	mips: do not mistake a syscall return value for a syscall number.
	On MIPS the syscall number is passed in v0, which holds the syscall
	return value on exit.  When strace attaches to a tracee stopped
	mid-syscall, PTRACE_GET_SYSCALL_INFO reports PTRACE_SYSCALL_INFO_NONE, so
	arch_get_scno() reads v0 and mistakes the return value for a syscall
	number.  Skip reading v0 in that case; older kernels without
	PTRACE_GET_SYSCALL_INFO are unaffected.

	* src/linux/mips/get_scno.c (arch_get_scno): Return 0 when
	PTRACE_GET_SYSCALL_INFO is supported but does not report a syscall entry.
	* tests/restart_syscall-p.test: Generate the expected output, using the
	proper syscall name per architecture.
	* tests/restart_syscall-p.expected: Remove.
	* tests/Makefile.am (check_DATA): Remove restart_syscall-p.expected.

2026-06-02  Gabi Falk  <gabifalk@gmx.com>

	tests: avoid an mmap hint address inside the sparc64 VA hole.
	tests/mmap.c passes a fixed hint address of 0xfacefeed000 (~15.6 TiB) to
	mmap(2).  On sparc64 the upper part of the 64-bit address space is an
	architecturally unmappable "VA hole", and the kernel rejects an mmap whose
	address lands in it with EINVAL -- even when MAP_FIXED is not set.  Unlike
	most architectures, which treat the address as a hint and silently relocate
	an unusable one, sparc64 validates it up front via the arch_mmap_check hook
	(sparc_mmap_check() -> invalid_64bit_range() in
	arch/sparc/kernel/sys_sparc_64.c), called before get_unmapped_area().

	On sun4u/UltraSPARC (and the QEMU sun4u default) the hole starts at 2^43
	(8 TiB), so 0xfacefeed000 is rejected and the test's own mmap() fails with

	    mmap.c: mmap: Invalid argument

	before strace decoding is even exercised.  Because the mmap binaries are
	listed in pure_executables.list, this also makes the ~13 test_trace_expr
	based tests fail intermittently whenever they sample mmap-Xraw.

	The address is only ever passed as a non-MAP_FIXED hint, and the expected
	output is built from the address mmap(2) actually returns, so the precise
	value does not matter as long as it is a valid hint everywhere.  Use
	0x5afefeed000 (~5.7 TiB), comfortably below the hole on all sparc64 (it
	only moves to higher addresses on wider-VA sun4v/Niagara CPUs), for every
	architecture rather than special-casing sparc.

2026-06-02  Gabi Falk  <gabifalk@gmx.com>

	tests: limit restart_syscall-p to restart_syscall and exit_group.
	restart_syscall-p.test attaches to a sleeping process and traces every
	syscall it makes until it exits.  On architectures without a dedicated
	thread-pointer register, notably m68k, libc reads the thread pointer
	with a get_thread_area syscall (on m68k __m68k_read_tp() issues
	get_thread_area(2)), and it is reached from ordinary libc code, e.g. the
	exit path that runs once the interrupted nanosleep has resumed.  strace
	dutifully decodes these syscalls, so the trace gains a series of

	    get_thread_area() = 0x...

	lines between restart_syscall and exit_group, and the test fails with

	    restart_syscall-p.test: failed test: \
	        ../../src/strace -qq -a14 -p PID output mismatch

	The sibling attach tests already restrict the traced set for exactly
	this reason: attach-p-cmd and attach-f-p use -echdir, and strace-ff uses
	-eexit_group.  Do the same here and trace only restart_syscall and
	exit_group, which is all this test verifies.  The expected output is
	unchanged, and architectures that issue no extra libc syscalls in this
	window are unaffected.

	* tests/restart_syscall-p.test: Add -e trace=restart_syscall,exit_group.

2026-06-02  Gabi Falk  <gabifalk@gmx.com>

	tests: fix AF_AX25 raw sa_data length in net-sockaddr on m68k.
	struct sockaddr_ax25 ends with an int sax25_ndigis following a 7-byte
	ax25_address, so its size depends on the alignment of int: 16 bytes
	where int is 4-byte aligned, but 14 bytes on ABIs that align int to 2,
	notably m68k.

	check_ax25() connects with an address length of
	sizeof(struct sockaddr_ax25) - 1, one byte short of a full
	sockaddr_ax25, so strace prints the raw sa_data of
	addrlen - sizeof(sa_family) bytes.  That length is therefore
	sizeof(struct sockaddr_ax25) - 3: 13 on most architectures, but 11 on
	m68k.  The test hardcoded the 13-byte form, so on m68k it failed with

	    net-sockaddr.gen.test: failed test: \
	        ../../src/strace -a24 -e trace=connect ../net-sockaddr \
	        output mismatch

	Emit the two trailing sa_data bytes only when struct sockaddr_ax25 is
	large enough to contain them.

	* tests/net-sockaddr.c (check_ax25): Adjust the expected raw sa_data
	to the size of struct sockaddr_ax25.

2026-06-02  Gabi Falk  <gabifalk@gmx.com>

	tests: allow get_thread_area in seccomp-filter-v and prctl-seccomp-filter-v
	On architectures without a dedicated thread-pointer register, notably
	m68k, libc reads the thread pointer with a get_thread_area syscall.
	On m68k __m68k_read_tp() issues get_thread_area(2), and it is reached
	from ordinary libc code, e.g. whenever errno is accessed.

	The seccomp filter installed by these tests allows only close, exit and
	exit_group, with a default action of SECCOMP_RET_KILL_THREAD.  After
	the filter is installed the test calls close(2), and the libc wrapper
	touches errno, which on m68k performs a get_thread_area syscall that
	the filter does not permit.  The process is therefore killed by SIGSYS
	before it can exit, and the test fails with

	    seccomp-filter-v.gen.test: failed test: \
	        ../seccomp-filter-v failed with code 159

	Allow get_thread_area in the filter (and emit it in the expected
	decoding) on architectures that define __NR_get_thread_area, so the
	post-filter libc syscalls are not killed.  Architectures that do not
	define the syscall are unaffected.

	* tests/seccomp-filter-v.c (filter_c): Allow get_thread_area if
	__NR_get_thread_area is defined.
	(main): Print the corresponding expected line.
	* tests/prctl-seccomp-filter-v.c (filter): Likewise.
	(main): Likewise.

2026-06-01  dependabot[bot]  <49699333+dependabot[bot]@users.noreply.github.com>

	build(deps): bump codecov/codecov-action from 6.0.0 to 6.0.1.
	Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 6.0.0 to 6.0.1.
	- [Release notes](https://github.com/codecov/codecov-action/releases)
	- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
	- [Commits](https://github.com/codecov/codecov-action/compare/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2...e79a6962e0d4c0c17b229090214935d2e33f8354)

	---
	updated-dependencies:
	- dependency-name: codecov/codecov-action
	  dependency-version: 6.0.1
	  dependency-type: direct:production
	  update-type: version-update:semver-patch
	...

2026-06-01  Gabi Falk  <gabifalk@gmx.com>
	    Dmitry V. Levin  <ldv@strace.io>

	ci: add native aarch64 build jobs.
	GitHub now provides free aarch64 Linux runners for public repositories,
	so the aarch64 target support already present in the ci/ scripts can be
	exercised on real hardware.

	* .github/workflows/ci.yml (build-check): Add aarch64 jobs to the matrix.

2026-06-01  Dmitry V. Levin  <ldv@strace.io>

	.github/workflows/ci.yml: use include syntax in the matrix strategy.
	* .github/workflows/ci.yml (build-check): Rewrite from "exclude"
	to "include" syntax for clarity.

2026-05-31  Dmitry V. Levin  <ldv@strace.io>

	build: remove generated header scno.h from BUILT_SOURCES.
	BUILT_SOURCES forces this header to be generated during all phases
	of the build cycle, including 'make distcheck', even in configurations
	where it is not needed or cannot be built.

	Fix this by moving the dependency hook directly into the Makefile
	rebuilding phase, forcing scno.h to be generated before any compilation
	target phase begins.

	This fixes build failures during 'distcheck' in certain configurations.

	* src/Makefile.am (EXTRA_DIST): Add scno_hook.mk.
	($(strace_OBJECTS)): Remove rule.
	* src/scno.am (BUILT_SOURCES): Do not add scno.h.
	(_hide_from_automake): Evaluate scno_hook.mk.
	* src/scno_hook.mk: New file.
	* tests/Makefile.am (objects): Remove.
	($(objects)): Remove rule.

2026-05-31  Dmitry V. Levin  <ldv@strace.io>

	build: remove generated header ksysent.h from BUILT_SOURCES.
	BUILT_SOURCES forces this header to be generated during all phases
	of the build cycle, including 'make distcheck', even in configurations
	where it is not needed or cannot be built.

	* tests/Makefile.am (BUILT_SOURCES): Do not add ksysent.h.
	(ksysent.$(OBJEXT)): Rename to $(ksysent_OBJECTS).

2026-05-31  Gabi Falk  <gabifalk@gmx.com>

	ci: fix armhf cross-compiler package names for aarch64.
	The aarch64 dependency list still used the Travis-era
	gcc-multilib-arm-linux-gnueabihf naming, which does not exist on
	current Ubuntu runners.  Use the gcc-arm-linux-gnueabihf cross
	packages available on ubuntu-24.04-arm.

	* ci/install-dependencies.sh: Drop the -multilib- infix from the
	armhf cross-compiler package names.

2026-05-31  Gabi Falk  <gabifalk@gmx.com>

	sigreturn: avoid unused-function warning with clang.
	print_sigmask_addr_size is referenced only via the tprintsigmask_addr
	macro, which is expanded by architecture-specific arch_sigreturn.c
	files.  On architectures whose arch_sigreturn.c does not print a signal
	mask, e.g. aarch64, the function is unused.  The inline qualifier
	suppresses -Wunused-function with gcc but not with clang, so the
	-Werror build fails:

	    sigreturn.c:20:1: error: unused function 'print_sigmask_addr_size'
	    [-Werror,-Wunused-function]

	* src/gcc_compat.h (ATTRIBUTE_UNUSED): New macro.
	* src/sigreturn.c (print_sigmask_addr_size): Mark with ATTRIBUTE_UNUSED
	instead of relying on the inline qualifier.

2026-05-30  Gabi Falk  <gabifalk@gmx.com>

	ci: fix Codecov source paths.
	Coverage is uploaded with working-directory: src, so gcov reports paths
	relative to src/ (e.g. pidns.c).  Codecov then fails to locate the
	sources in the repository, where they live under src/, and cannot show
	line-by-line coverage.  Add a path fix prepending src/.

	* .codecov.yml: New file.

2026-05-29  Dmitry V. Levin  <ldv@strace.io>

	.github: add gcc-15 jobs.
	* .github/workflows/ci.yml: Add gcc-15 jobs on ubuntu-22.04.

2026-05-29  Dmitry V. Levin  <ldv@strace.io>

	tests: robustify strace -k tests.
	Allow __GI_ prefix for chdir and kill functions.

	* tests/strace-k.expected: Add optional __GI_ prefix to chdir and kill.
	* tests/strace-k-demangle.expected: Likewise.
	* tests/strace-k-p.expected: Likewise.
	* tests/strace-k-with-depth-limit.expected: Likewise.

2026-05-29  Gabi Falk  <gabifalk@gmx.com>

	unwind: always capture stack trace on syscall entering.
	Previously the stack trace was captured lazily, at the syscall exiting
	stage, for all syscalls except those marked with STACKTRACE_CAPTURE_ON_ENTER
	(execve, execveat, execv, exit, and exit_group), which were captured at the
	entering stage because their stack is no longer available on exiting.

	Capture the stack trace unconditionally on syscall entering instead, store
	it in the tcb, and print it at the same points as before.  This makes the
	recorded trace reflect the state at syscall entry, which is the point where
	the syscall was actually invoked; in particular, it no longer races with
	memory mapping changes performed by the syscall itself.  As a side effect,
	the STACKTRACE_CAPTURE_ON_ENTER flag is no longer needed.

	Capturing on entering for every syscall is safe only because the preceding
	change releases the captured stack trace when the syscall output is
	suppressed; otherwise the next capture would abort on the unprinted entries
	left in the queue.

	The live walk in unwind_tcb_print is retained for the cases where no trace
	was captured on entering: signal delivery stops and attaching to a tracee
	that is already inside a syscall.

	* src/syscall.c (syscall_entering_trace): Capture the stack trace
	unconditionally on entering, dropping the STACKTRACE_CAPTURE_ON_ENTER check.
	* src/sysent.h (STACKTRACE_CAPTURE_ON_ENTER): Remove.
	(TRACE_INDIRECT_SUBCALL, COMPAT_SYSCALL_TYPES, TRACE_STAT, TRACE_LSTAT,
	TRACE_STATFS, TRACE_FSTATFS, TRACE_STATFS_LIKE, TRACE_FSTAT, TRACE_STAT_LIKE,
	TRACE_PURE, TRACE_SECCOMP_DEFAULT, TRACE_CREDS, TRACE_CLOCK, COMM_CHANGE):
	Renumber to close the freed gap.
	* src/sysent_shorthand_defs.h (SE): Remove.
	* src/sysent_shorthand_undefs.h (SE): Likewise.
	* src/linux/32/syscallent.h: Remove the SE flag from execve, execveat,
	exit, and exit_group entries.
	* src/linux/64/syscallent.h: Likewise.
	* src/linux/alpha/syscallent.h: Likewise.
	* src/linux/arm/syscallent.h: Likewise.
	* src/linux/avr32/syscallent.h: Likewise.
	* src/linux/bfin/syscallent.h: Likewise.
	* src/linux/hppa/syscallent.h: Likewise.
	* src/linux/i386/syscallent.h: Likewise.
	* src/linux/ia64/syscallent.h: Likewise.
	* src/linux/m68k/syscallent.h: Likewise.
	* src/linux/microblaze/syscallent.h: Likewise.
	* src/linux/mips/syscallent-n32.h: Likewise.
	* src/linux/mips/syscallent-n64.h: Likewise.
	* src/linux/mips/syscallent-o32.h: Likewise.
	* src/linux/powerpc/syscallent.h: Likewise.
	* src/linux/powerpc64/syscallent.h: Likewise.
	* src/linux/s390/syscallent.h: Likewise.
	* src/linux/s390x/syscallent.h: Likewise.
	* src/linux/sh/syscallent.h: Likewise.
	* src/linux/sh64/syscallent.h: Likewise.
	* src/linux/x32/syscallent.h: Likewise.
	* src/linux/x86_64/syscallent.h: Likewise.
	* src/linux/xtensa/syscallent.h: Likewise.
	* src/linux/sparc/syscallent.h: Remove the SE flag from execv, execve,
	execveat, exit, and exit_group entries.
	* src/linux/sparc64/syscallent.h: Likewise.

2026-05-29  Gabi Falk  <gabifalk@gmx.com>

	tests: check stack traces combined with syscall status filtering.
	Add a regression test for the preceding commit "unwind: release captured
	stack trace when syscall output is suppressed".  Check that strace does
	not abort with "bug: unprinted entries in queue" when the stack trace
	captured on entering a syscall, e.g. a failing execve, has to be released
	because the syscall output is filtered out by status qualification at the
	exiting stage.

	* tests/strace-k-z.c: New file.
	* tests/strace-k-z.test: New test.
	* tests/.gitignore: Add strace-k-z.
	* tests/Makefile.am (check_PROGRAMS): Likewise.
	(STACKTRACE_TESTS, check_SCRIPTS): Add strace-k-z.test.

2026-05-29  Gabi Falk  <gabifalk@gmx.com>

	unwind: release captured stack trace when syscall output is suppressed.
	For certain syscalls (execve, execveat, execv, exit, and exit_group),
	the stack trace captured on the syscall entering stage is stored in the
	unwind queue and drained by unwind_tcb_print at the exiting stage.
	However, if the syscall output is not produced, either because it is
	filtered out by status qualification (-z, -Z, -e status=...) or because
	the syscall result is unavailable after a prior ptrace operation failed,
	syscall_exiting_trace returns early, before reaching the
	unwind_tcb_print call.  The captured trace is then left in the queue,
	and the next syscall's unwind_tcb_capture aborts strace with
	error_msg_and_die("bug: unprinted entries in queue").

	Discard the captured trace, without printing it, instead of leaving it in
	the queue.

	* src/unwind.c (queue_print): Rename to queue_drain, adding a parameter
	that controls whether the entries are printed.
	(unwind_tcb_fin, unwind_tcb_print): Update accordingly.
	(unwind_tcb_discard): New function.
	* src/defs.h (unwind_tcb_discard): Declare.
	* src/syscall.c (syscall_exiting_trace): Discard the stack trace captured
	on entering when the syscall output is not printed.

2026-05-27  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	tests: add coverage for out-of-range syscalls -c summary.
	* tests/count_unknown.c: New file.
	* tests/count_unknown_many.c: Likewise.
	* tests/count_unknown_mixed.c: Likewise.
	* tests/count_unknown.test: New test.
	* tests/count_unknown-S.test: Likewise.
	* tests/count_unknown-wall.test: Likewise.
	* tests/count_unknown_many.test: Likewise.
	* tests/count_unknown_mixed.test: Likewise.
	* tests/nsyscalls.h: New file, factored out from nsyscalls.c.
	* tests/nsyscalls.c: Use it.
	* tests/.gitignore: Add count_unknown, count_unknown_many,
	and count_unknown_mixed.
	* tests/Makefile.am (check_PROGRAMS): Likewise.
	(MISC_TESTS): Add count_unknown.test, count_unknown-S.test,
	count_unknown-wall.test, count_unknown_many.test,
	and count_unknown_mixed.test.
	(EXTRA_DIST): Add nsyscalls.h.

2026-05-27  Vadym Hvas  <hvassrim@gmail.com>
	    Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	count: include out-of-range syscalls in -c summary.
	With -c/--summary, strace previously ignored syscalls whose numbers are
	outside the decoder table, so their time and call counts never appeared
	in the summary report.

	* src/count.c (struct unknown_call_counts, struct unknown_call_bucket):
	New structures for unknown syscalls.
	(unknown_init_slot, unknown_init, unknown_insert, get_unknown_by_scno,
	 get_unknown_by_idx, count_unknown, get_unknown_bucket_size): New
	functions implementing per-personality growable bucket of unknown
	syscalls.
	(get_syscall_cc, get_syscall_name): New helpers dispatching between
	known and unknown syscalls.
	(count_syscall): Track unknown syscalls via count_unknown.
	(Comparators and call_summary_pers): Use helpers so sorting and printing
	include unknown entries.
	(calc_summary_stats, struct summary_stats): Extract per-syscall stats
	aggregation.
	* NEWS: Mention this change.

2026-05-26  Dmitry V. Levin  <ldv@strace.io>

	tests: fix potential race condition in strace--syscall-limit* tests.
	* tests/strace--syscall-limit.c (write_status): Move fflush(stdout) ...
	(main): ... here.

	Fixes: v6.3~41 "tests: check -l/--syscall-limit options"

2026-05-26  Gabi Falk  <gabifalk@gmx.com>

	pidfd_ioctl: print PIDFD_GET_INFO input mask on entering.
	The PIDFD_GET_INFO decoder deferred all output to the exit side and
	relied on umoven_or_printaddr() to print the raw address when the
	syscall failed (so the kernel hadn't filled the buffer).  That left
	two gaps: error returns showed only the address with no decoding,
	and unfinished syscalls showed `argp <unfinished ...>` with no
	struct content at all.

	Open the struct on the entering side and print the requested mask
	field there, leaving the struct open across entry/exit.  The exit
	side closes the struct, optionally appending `=> NEW` for the mask
	and the kernel-filled output fields when the buffer is readable
	(tfetch_mem returns false on syscall error, in which case the
	output stays as just `{mask=REQ}`).

	This is the same convention used by several other decoders that
	print input fields on entering so unfinished/error syscalls still
	show the input struct rather than a raw address, e.g. UFFDIO_API in
	src/userfaultfd.c and io_uring_setup in src/io_uring.c.

	* src/pidfd_ioctl.c (pidfd_ioctl_print_pidfd_get_info): Remove,
	inline into the caller.
	(pidfd_ioctl): Print the input mask on entering; close the struct
	on exiting.
	* tests/ioctl_pidfd_get_info.c (main): Update expected output.

2026-05-26  Gabi Falk  <gabifalk@gmx.com>

	sendfile: render offset as [OLD => NEW] in a single set of brackets.
	The sendfile(2)/sendfile64(2) offset arg was rendered as
	`[OLD] => [NEW]` -- two indirect-bracket pairs joined by `=>`.  This
	suggested two distinct pointer values, but in fact the pointer doesn't
	change: only the integer it points to is updated by the kernel.

	Render it as `[OLD => NEW]` instead (one set of brackets, `=>` inside),
	matching the convention used by addrlen in getsockname/accept/etc.

	This requires splitting the indirect brackets across the entry and exit
	sides of the decoder: entry opens `[` and prints OLD; exit optionally
	appends ` => NEW` (when the syscall succeeded with a non-zero return)
	and always closes `]`.  On exit-read failure the bracket closes silently
	as `[OLD]`.

	* src/sendfile.c (SYS_FUNC(sendfile64), SYS_FUNC(sendfile)): Split
	the indirect brackets across entry and exit.
	* tests/sendfile.c (main): Update expected output.
	* tests/poke-sendfile.c (main): Likewise.
	* tests/sendfile64.c (main): Likewise.

2026-05-26  Gabi Falk  <gabifalk@gmx.com>

	util: add tfetch_to_uint64 helper.
	Factor out the silent core of umoven_to_uint64_or_printaddr64 so
	that the callers can handle the failure case themselves.

	Follows the established two-function convention used by the other
	memory access helpers in defs.h: an extern *_64 core taking uint64_t
	addr, and a static inline kernel_ulong_t wrapper.

	* src/util.c (tfetch_to_uint64_64): New silent core, returns bool.
	(umoven_to_uint64_or_printaddr64): Reimplement as a thin wrapper that
	calls the silent core and prints the address on failure.
	* src/defs.h (tfetch_to_uint64_64, tfetch_to_uint64): Declare.

2026-05-26  Gabi Falk  <gabifalk@gmx.com>

	sendfile64: skip exit-side offset decoding when count is 0.
	When count is 0, the kernel returns immediately without touching the
	offset pointer, so there is nothing to decode on syscall exit.  The
	sister SYS_FUNC(sendfile) has carried this fast path since two-phase
	decoding was introduced, but SYS_FUNC(sendfile64) has not.  Mirror it
	to remove the asymmetry.

	* src/sendfile.c (SYS_FUNC(sendfile64)): Return RVAL_DECODED on
	entering when tcp->u_arg[3] is 0.

	Complements: v4.11~267 ("sendfile: decode file offset both on entering and exiting syscall")

2026-05-26  Gabi Falk  <gabifalk@gmx.com>

	sendfile: omit redundant offset name on exit under -N.
	The exit path re-emitted the "offset" argument name after the value
	changed marker, producing duplicated names under -N (--syscall-names).

	* src/sendfile.c (SYS_FUNC(sendfile64), SYS_FUNC(sendfile)): Do not
	re-emit the "offset" argument name on exit.

2026-05-24  Gabi Falk  <gabifalk@gmx.com>

	rt_sigreturn: emit argument name for sigmask under -N.
	The rt_sigreturn(2) decoder printed the synthesized sigmask value via
	print_sigset_addr() without a leading "sigmask=", so -N/--arg-names
	output lacked the label other syscalls have.

	* src/rt_sigreturn.c (SYS_FUNC(rt_sigreturn)): Add
	tprints_arg_name("sigmask") before print_sigset_addr().

2026-05-24  Gabi Falk  <gabifalk@gmx.com>

	print_time: emit argument name for time syscall under -N.
	The time(2) decoder skipped tprints_arg_name(), so -N/--arg-names
	printed "(0x7ff...)" instead of "(tloc=0x7ff...)" for the syscall's
	sole argument.

	* src/print_time.c (SYS_FUNC(time)): Add tprints_arg_name("tloc")
	before decoding the argument.

2026-05-24  Gabi Falk  <gabifalk@gmx.com>

	sg_io_v3: omit redundant field name in dxferp value-changed output.
	After printing "dxferp=..." on syscall entry, the value-changed
	indicator was followed by "dxferp=..." again, producing
	"dxferp=... => dxferp=...".  Print the field name explicitly only in
	the initial output and call print_sg_io_buffer directly for the
	changed value so the "=> " indicator is followed by the buffer alone.

	* src/sg_io_v3.c (decode_response): Emit "dxferp" via tprints_field_name
	in the SG_DXFER_FROM_DEV branch; bypass PRINT_FIELD_SG_IO_BUFFER for
	the value-changed buffer and invoke print_sg_io_buffer directly.
	* tests/ioctl_sg_io_v3.c (main): Update expected output to drop the
	redundant "dxferp=" after " => ".

2026-05-24  Gabi Falk  <gabifalk@gmx.com>

	kd: suppress spurious value-changed output for unchanged fields.
	The keycode and entry_ct fields of KDGETKEYCODE and GIO_UNIMAP were
	always printed with the "=> value" value-changed notation on syscall
	exit, even when the kernel did not modify them.  Save the input value
	on entering syscall and only print the change indicator when the value
	differs.

	* src/kd_ioctl.c (kd_keycode): Save val.keycode using set_tcb_priv_ulong
	on entering syscall for the get case; on exit, emit tprint_value_changed
	only when the returned keycode differs.
	* src/kd_mpers_ioctl.c (kd_unimap): Likewise for val.entry_ct.
	* tests/ioctl_kd.c (check_xetkeycode, check_unimap): Update expected
	output accordingly.

2026-05-24  Gabi Falk  <gabifalk@gmx.com>

	v4l2: suppress spurious value-changed output for unchanged fields.
	The reqbufs.count and v4l2_control.value fields were always printed
	with the "=> value" value-changed notation on syscall exit, even when
	the kernel did not modify them.  Save the input value on entering
	syscall and only print the change indicator when the value differs.

	* src/v4l2.c (print_v4l2_requestbuffers): Save reqbufs.count using
	set_tcb_priv_ulong on entering syscall; on exit, emit
	tprint_value_changed only when the returned count differs.
	(print_v4l2_control): Likewise for c.value in set ioctls.
	* tests/ioctl_v4l2-success.c (main): Update expected output for
	VIDIOC_REQBUFS and VIDIOC_S_CTRL accordingly.

2026-05-19  Dmitry V. Levin  <ldv@strace.io>

	tests: terminate delay test diagnostics with newline.
	* tests/delay.c (run_checks): Add trailing newlines to pid exit
	and wait status messages printed on stderr.

	Fixes: v7.0-29-g56662c444 "tests: robustify delay test"

2026-05-19  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	tests: compare strace timing against program-measured delay.
	Sleep/nanosleep timing checks assumed the syscall completes within
	~0.9–1.1s of the requested interval.  On over-provisioned systems
	the sleep can take much longer while strace still reports a consistent
	duration; compare the trace output with CLOCK_MONOTONIC measurements
	from a dedicated test helper instead.

	* tests/sleep-timing.c: New file.
	* tests/Makefile.am (check_PROGRAMS): Add sleep-timing.
	(MISC_TESTS): Remove count.test, add strace-c.test and strace-cw.test.
	* tests/.gitignore: Add sleep-timing.
	* tests/init-once.sh: Add timing comparison helpers.
	* tests/count.test: Remove.
	* tests/strace-c.test: New test.
	* tests/strace-cw.test: Likewise.
	* tests/strace-c-wall-col.test: Likewise.
	* tests/strace-T_upper.test: Use sleep-timing helper and
	check_strace_syscall_time().
	* tests/strace-r.test: Use sleep-timing helper and
	check_strace_relative_exit_time(), trace chdir instead of execve.
	* tests/strace-T_upper.expected: Relax fixed duration bands.
	* tests/strace--syscall-times*.expected: Likewise.
	* tests/strace-r.expected: Match chdir markers instead of execve
	and "exited" lines.
	* tests/strace--relative-timestamps*.expected: Likewise.

	Resolves: https://github.com/strace/strace/issues/182

2026-05-19  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	count: accumulate wall stats only when wall-* columns are used.
	Wall-clock durations were always accumulated for -c even when no wall-*
	column was selected or used for sorting, and -w duplicated the wall-clock
	arithmetic already performed for polymorphic time columns.

	* src/count.c (summary_needs_wall, column_is_wall): New helpers.
	(summary_wall_columns, summary_sortby_wall): Track whether wall-* data
	is required.
	(set_count_summary_columns): Set summary_wall_columns from -U.
	(set_sortby): Set summary_sortby_wall when sorting by wall-*.
	(count_syscall): Accumulate wall_* fields only when needed; reuse
	polymorphic duration when -w is set.
	(call_summary_pers): Aggregate wall totals only when needed.

2026-05-19  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	doc: polish wall-* summary column documentation.
	* doc/strace.1.in (\-\-summary-syscall-overhead): Note that overhead
	is subtracted from wall-* columns as well as polymorphic time columns.
	* doc/strace.1.in (\-\-summary-sort-by): Add wall-* column names
	to the list of valid sort criteria.
	* doc/strace.1.in (\-\-summary-columns): State that min/max duration
	columns are in seconds, and that average wall-clock call duration is
	in microseconds.

2026-05-19  Dmitry V. Levin  <ldv@strace.io>

	tests: accept wall-* names in options-syntax summary column checks.
	* tests/options-syntax.test: Extend -S and -U syntax checks with wall-*
	column aliases and combined layouts.

2026-05-19  Alex Vassilevski  <alexander@vassilevski.com>

	count: add wall-* column aliases for -c summary report.
	The -c/--summary-only report currently shows either system CPU time or
	wall-clock time per system call, controlled by the -w flag.  Analysing
	where time is spent often requires both values (CPU time identifies
	kernel work, wall time identifies time spent waiting), which today means
	running strace twice with results that may differ because the workload's
	timing is non-deterministic.

	Introduce four new column aliases that always read wall-clock data
	regardless of -w: wall-total, wall-min, wall-max, and wall-avg (with
	equivalent total-wall, min-wall, max-wall, avg-wall aliases).  These
	combine with the existing time-total/time-min/time-max/time-avg columns
	via -U to render both timings side by side in a single run.

	The unprefixed time-* columns keep their existing polymorphic behaviour
	relative to -w to preserve backward compatibility.

	* src/count.c (struct call_counts): Add wall_time, wall_time_min,
	wall_time_max, and wall_time_avg fields.
	(enum count_summary_columns): Add CSC_TIME_WALL_TOTAL,
	CSC_TIME_WALL_MIN, CSC_TIME_WALL_MAX, and CSC_TIME_WALL_AVG.
	(column_aliases): Add wall-total/total-wall, wall-min/min-wall,
	wall-max/max-wall, and wall-avg/avg-wall variants.
	(count_syscall): Always accumulate the wall-clock duration into
	wall_time, wall_time_min, and wall_time_max in addition to the existing
	polymorphic time fields, and initialise wall_time_min to max_ts on
	first allocation.
	(wall_time_cmp, wall_min_time_cmp, wall_max_time_cmp,
	wall_avg_time_cmp): New comparators.
	(set_sortby): Map the new wall_* enum values to the new comparators.
	(call_summary_pers): Track tv_wall_cum, tv_wall_min, tv_wall_min_max,
	tv_wall_max, tv_wall_avg_max, and float_tv_wall_cum locals; compute
	wall_time_avg per syscall; extend cdesc, cwidths, FC_, PC_, and the
	totals loop for the new columns.
	* tests/count.test (WALL_COL, WALL_AFTER_CPU): New expected patterns.
	Check -Utime-total,wall-total,calls,name, -Uwall-total,calls,name,
	-Uwall-min,..., -Uwall-max,..., and -Swall-total invocations.
	* doc/strace.1.in: Document the new wall-* aliases.
	* NEWS: Mention this change.

	Closes: https://github.com/strace/strace/issues/327

2026-05-17  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	ioctl: decode FS_IOC_SHUTDOWN argument.
	FS_IOC_SHUTDOWN was introduced by Linux kernel commit v7.1-rc1~95^2~44.

	* src/xlat/fs_shutdown_flags.in: New file.
	* src/fs_x_ioctl.c (decode_fs_shutdown): New function.
	(fs_x_ioctl): Use it to handle FS_IOC_SHUTDOWN.
	* tests/ioctl_fs_x.c (main): Check FS_IOC_SHUTDOWN decoding.
	* NEWS: Mention this change.

2026-05-17  Dmitry V. Levin  <ldv@strace.io>

	tests/ioctl_fs_x: use struct strval32 instead of open-coding it.
	* tests/ioctl_fs_x.c (main): Define null_arg_cmds[] as an array
	of struct strval32.

	tests: intorduce get_prefix_value()
	* tests/init-once.sh (get_prefix_value): New function.
	* tests/strace-D.test (get_parent_pid, get_tracer_pid): Use it.
	* tests/strace-DD.test (get_tracer_pid): Likewise.

2026-05-12  Dmitry V. Levin  <ldv@strace.io>

	tests: robustify delay test.
	* tests/delay.c: Refactor the test to take into account that some delays
	are longer than expected dur to high load.  If the measured delay
	exceeds expectations, do not abort the test but give it another try
	instead.

2026-05-11  Dmitry V. Levin  <ldv@strace.io>

	tests: robustify status-detached.test.
	* tests/env-i.c: New file.
	* tests/.gitignore: Add env-i.
	* tests/Makefile.am (check_PROGRAMS): Likewise.
	* tests/status-detached.test: Rewrite using -bexecve and match_diff.
	* tests/status-detached.expected: Update expected output.

2026-05-11  Dmitry V. Levin  <ldv@strace.io>

	tests: fix build of ioctl_pidfd_get_info test on ppc64le.
	* tests/ioctl_pidfd_get_info.c (injected_pidfd_get_info_decode_checks):
	Consistently cast struct pidfd_info.cgroupid to unsigned long long.

	Resolves: https://github.com/strace/strace/issues/395
	Fixes: v7.0-21-gb2535111a "ioctl: implement decoding of PIDFD_GET_INFO command"

2026-05-10  Dmitry V. Levin  <ldv@strace.io>

	tests: robustify enjoy_time.
	* tests/time_enjoyment.h (enjoy_time): Adjust the measurement
	of consumed cpu time.

	tests: robustify strace-DD.test.
	* tests/strace-DD.test (test_D): Wait for the tracer to log something
	before terminating the tracee.

2026-05-07  Dmitry V. Levin  <ldv@strace.io>

	tests: fix nlattr_ifla_linkinfo test on big-endian architectures.
	* tests/nlattr_ifla_linkinfo.c (main): Fix stp_mode_xlat array
	on big-endian architectures.

	Resolves: https://github.com/strace/strace/issues/393
	Fixes: v7.0-12-g36f123751 "xlat: update IFLA_* constants"

2026-05-06  Dmitry V. Levin  <ldv@strace.io>

	tests: fix PIDFD_GET_INFO test.
	* tests/ioctl_pidfd_get_info.c (print_pidfd_info): New function.
	(main): Use it.

2026-05-05  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	ioctl: implement decoding of PIDFD_GET_*_NAMESPACE commands.
	* src/pidfd_ioctl.c (pidfd_ioctl_is_namespace_fd): New function.
	(pidfd_ioctl): Handle namespace ioctls before PIDFD_GET_INFO.
	* tests/ioctl_pidfd_namespace.c: New file.
	* tests/pure_executables.list: Add ioctl_pidfd_namespace.
	* tests/.gitignore: Likewise.
	* tests/gen_tests.in (ioctl_pidfd_namespace): New test.
	* NEWS: Mention this change.

2026-05-04  Dmitry V. Levin  <ldv@strace.io>
	    Cursor AI  <auto@cursor.ai>

	ioctl: implement decoding of PIDFD_GET_INFO command.
	* src/pidfd_ioctl.c: New file.
	* src/Makefile.am (libstrace_a_SOURCES): Add pidfd_ioctl.c.
	* src/defs.h (DECL_IOCTL): Add pidfd.
	* src/ioctl.c (ioctl_decode): Dispatch ioctl type 0xff to pidfd_ioctl.
	* src/print_fields.h (PRINT_FIELD_TID): New macro.
	* src/xlat/pidfd_info_mask.in: New file.
	* src/xlat/pidfd_coredump_mask.in: Likewise.
	* tests/ioctl_pidfd_get_info.c: New file.
	* tests/ioctl_pidfd_get_info-success.c: Likewise.
	* tests/ioctl_pidfd_get_info-success-Xabbrev.c: Likewise.
	* tests/ioctl_pidfd_get_info-success-Xraw.c: Likewise.
	* tests/ioctl_pidfd_get_info-success-Xverbose.c: Likewise.
	* tests/Makefile.am (check_PROGRAMS): Add ioctl_pidfd_get_info-success,
	ioctl_pidfd_get_info-success-Xabbrev, ioctl_pidfd_get_info-success-Xraw,
	and ioctl_pidfd_get_info-success-Xverbose.
	* tests/gen_tests.in (ioctl_pidfd_get_info,
