(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tracing)
          op: assign_op.Equal
          rhs: {(/sys/kernel/debug/tracing)}
          spids: [166]
        )
      ]
    )
    (command.CommandList
      children: [
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:flock)
                  op: assign_op.Equal
                  rhs: {(/var/tmp/.ftrace-lock)}
                  spids: [169]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:171)
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:wroteflock)
              op: assign_op.Equal
              rhs: {(0)}
              spids: [173]
            )
          ]
        )
      ]
    )
    (command.CommandList
      children: [
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:opt_duration)
                  op: assign_op.Equal
                  rhs: {(0)}
                  spids: [176]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:178)
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:duration)
                  op: assign_op.Equal
                  rhs: (word.Empty)
                  spids: [180]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:181)
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:opt_name)
                  op: assign_op.Equal
                  rhs: {(0)}
                  spids: [183]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:185)
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:name)
                  op: assign_op.Equal
                  rhs: (word.Empty)
                  spids: [187]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:188)
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:opt_time)
                  op: assign_op.Equal
                  rhs: {(0)}
                  spids: [190]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:192)
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:opt_reexec)
              op: assign_op.Equal
              rhs: {(0)}
              spids: [194]
            )
          ]
        )
      ]
    )
    (command.CommandList
      children: [
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:opt_argc)
                  op: assign_op.Equal
                  rhs: {(0)}
                  spids: [197]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:199)
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:argc)
                  op: assign_op.Equal
                  rhs: {(8)}
                  spids: [201]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:203)
        )
        (command.Sentence
          child: 
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:max_argc)
                  op: assign_op.Equal
                  rhs: {(16)}
                  spids: [205]
                )
              ]
            )
          terminator: (Token id:Id.Op_Semi val:';' span_id:207)
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:ftext)
              op: assign_op.Equal
              rhs: (word.Empty)
              spids: [209]
            )
          ]
        )
      ]
    )
    (C {(trap)} {(SQ (Token id:Id.Lit_Chars val:':' span_id:214))} {(INT)} {(QUIT)} {(TERM)} {(PIPE)} 
      {(HUP)}
    )
    (command.ShFunction
      name: usage
      body: 
        (command.BraceGroup
          children: [
            (command.Simple
              words: [{(cat)}]
              redirects: [
                (redir.HereDoc
                  op: (Token id:Id.Redir_DLessDash val:'<<-' span_id:240)
                  fd: -1
                  here_begin: {(END)}
                  here_end_span_id: 267
                  stdin_parts: [
                    ('USAGE: execsnoop [-hrt] [-a argc] [-d secs] [name]\n')
                    ('                 -d seconds      # trace duration, and use buffers\n')
                    ('                 -a argc         # max args to show (default 8)\n')
                    ('                 -r              # include re-execs\n')
                    ('                 -t              # include time (seconds)\n')
                    ('                 -h              # this usage message\n')
                    ('                 name            # process name to match (REs allowed)\n')
                    ('  eg,\n')
                    ('       execsnoop                 # watch exec()s live (unbuffered)\n')
                    ('       execsnoop -d 1            # trace 1 sec (buffered)\n')
                    ('       execsnoop grep            # trace process names containing grep\n')
                    ("       execsnoop 'log")
                    (Id.Lit_Other '$')
                    ("'          # filenames ending in ")
                    (Id.Right_DoubleQuote '"')
                    (log)
                    (Id.Right_DoubleQuote '"')
                    ('\n')
                    ('\n')
                    ('See the man page and example file for more info.\n')
                  ]
                )
                (redir.Redir
                  op: (Token id:Id.Redir_GreatAnd val:'>&' span_id:243)
                  fd: -1
                  arg_word: {(2)}
                )
              ]
            )
            (command.ControlFlow
              token: (Token id:Id.ControlFlow_Exit val:exit span_id:269)
            )
          ]
        )
    )
    (command.ShFunction
      name: warn
      body: 
        (command.BraceGroup
          children: [
            (command.If
              arms: [
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (command.Pipeline
                          children: [(C {(eval)} {(DQ ($ Id.VSub_At '$@'))})]
                          negated: T
                        )
                      terminator: (Token id:Id.Op_Semi val:';' span_id:290)
                    )
                  ]
                  action: [
                    (command.Simple
                      words: [
                        {(echo)}
                        {
                          (DQ ('WARNING: command failed ') 
                            (word_part.EscapedLiteral
                              token: (Token id:Id.Lit_EscapedChar val:'\\"' span_id:302)
                            ) ($ Id.VSub_At '$@') 
                            (word_part.EscapedLiteral
                              token: (Token id:Id.Lit_EscapedChar val:'\\"' span_id:304)
                            )
                          )
                        }
                      ]
                      redirects: [
                        (redir.Redir
                          op: (Token id:Id.Redir_GreatAnd val:'>&' span_id:297)
                          fd: -1
                          arg_word: {(2)}
                        )
                      ]
                    )
                  ]
                  spids: [281 292]
                )
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: end
      body: 
        (command.BraceGroup
          children: [
            (command.Simple
              words: [{(echo)}]
              redirects: [
                (redir.Redir
                  op: (Token id:Id.Redir_Great val:'2>' span_id:326)
                  fd: 2
                  arg_word: {(/dev/null)}
                )
              ]
            )
            (command.Simple
              words: [{(echo)} {(DQ ('Ending tracing...'))}]
              redirects: [
                (redir.Redir
                  op: (Token id:Id.Redir_Great val:'2>' span_id:336)
                  fd: 2
                  arg_word: {(/dev/null)}
                )
              ]
            )
            (C {(cd)} {($ Id.VSub_DollarName '$tracing')})
            (C {(warn)} {(DQ ('echo 0 > events/kprobes/') ($ Id.VSub_DollarName '$kname') (/enable))})
            (C {(warn)} {(DQ ('echo 0 > events/sched/sched_process_fork/enable'))})
            (C {(warn)} {(DQ ('echo -:') ($ Id.VSub_DollarName '$kname') (' >> kprobe_events'))})
            (C {(warn)} {(DQ ('echo > trace'))})
            (command.AndOr
              ops: [Id.Op_DAmp]
              children: [
                (command.DParen
                  child: 
                    (arith_expr.VarRef
                      token: (Token id:Id.Lit_ArithVarLike val:wroteflock span_id:379)
                    )
                )
                (C {(warn)} {(DQ ('rm ') ($ Id.VSub_DollarName '$flock'))})
              ]
            )
          ]
        )
    )
    (command.ShFunction
      name: die
      body: 
        (command.BraceGroup
          children: [
            (command.Simple
              words: [{(echo)} {(DQ ($ Id.VSub_At '$@'))}]
              redirects: [
                (redir.Redir
                  op: (Token id:Id.Redir_GreatAnd val:'>&' span_id:405)
                  fd: -1
                  arg_word: {(2)}
                )
              ]
            )
            (command.ControlFlow
              token: (Token id:Id.ControlFlow_Exit val:exit span_id:413)
              arg_word: {(1)}
            )
          ]
        )
    )
    (command.ShFunction
      name: edie
      body: 
        (command.BraceGroup
          children: [
            (command.Simple
              words: [{(echo)} {(DQ ($ Id.VSub_At '$@'))}]
              redirects: [
                (redir.Redir
                  op: (Token id:Id.Redir_GreatAnd val:'>&' span_id:433)
                  fd: -1
                  arg_word: {(2)}
                )
              ]
            )
            (command.Simple
              words: [{(exec)}]
              redirects: [
                (redir.Redir
                  op: (Token id:Id.Redir_Great val:'>' span_id:443)
                  fd: -1
                  arg_word: {(/dev/null)}
                )
                (redir.Redir
                  op: (Token id:Id.Redir_GreatAnd val:'2>&' span_id:446)
                  fd: 2
                  arg_word: {(1)}
                )
              ]
            )
            (C {(end)})
            (command.ControlFlow
              token: (Token id:Id.ControlFlow_Exit val:exit span_id:453)
              arg_word: {(1)}
            )
          ]
        )
    )
    (command.WhileUntil
      keyword: (Token id:Id.KW_While val:while span_id:463)
      cond: [(C {(getopts)} {(a) (Id.Lit_Other ':') (d) (Id.Lit_Other ':') (hrt)} {(opt)})]
      body: 
        (command.DoGroup
          children: [
            (command.Case
              to_match: {($ Id.VSub_DollarName '$opt')}
              arms: [
                (case_arm
                  pat_list: [{(a)}]
                  action: [
                    (command.Sentence
                      child: 
                        (command.ShAssignment
                          pairs: [
                            (assign_pair
                              lhs: (sh_lhs_expr.Name name:opt_argc)
                              op: assign_op.Equal
                              rhs: {(1)}
                              spids: [488]
                            )
                          ]
                        )
                      terminator: (Token id:Id.Op_Semi val:';' span_id:490)
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:argc)
                          op: assign_op.Equal
                          rhs: {($ Id.VSub_DollarName '$OPTARG')}
                          spids: [492]
                        )
                      ]
                    )
                  ]
                  spids: [485 486 495 -1]
                )
                (case_arm
                  pat_list: [{(d)}]
                  action: [
                    (command.Sentence
                      child: 
                        (command.ShAssignment
                          pairs: [
                            (assign_pair
                              lhs: (sh_lhs_expr.Name name:opt_duration)
                              op: assign_op.Equal
                              rhs: {(1)}
                              spids: [501]
                            )
                          ]
                        )
                      terminator: (Token id:Id.Op_Semi val:';' span_id:503)
                    )
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:duration)
                          op: assign_op.Equal
                          rhs: {($ Id.VSub_DollarName '$OPTARG')}
                          spids: [505]
                        )
                      ]
                    )
                  ]
                  spids: [498 499 508 -1]
                )
                (case_arm
                  pat_list: [{(r)}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:opt_reexec)
                          op: assign_op.Equal
                          rhs: {(1)}
                          spids: [514]
                        )
                      ]
                    )
                  ]
                  spids: [511 512 517 -1]
                )
                (case_arm
                  pat_list: [{(t)}]
                  action: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:opt_time)
                          op: assign_op.Equal
                          rhs: {(1)}
                          spids: [523]
                        )
                      ]
                    )
                  ]
                  spids: [520 521 526 -1]
                )
                (case_arm
                  pat_list: [{(h)} {(Id.Lit_QMark '?')}]
                  action: [(C {(usage)})]
                  spids: [529 532 536 -1]
                )
              ]
            )
          ]
        )
    )
    (C {(shift)} 
      {
        (word_part.ArithSub
          anode: 
            (arith_expr.Binary
              op_id: Id.Arith_Minus
              left: (arith_expr.ArithWord w:{($ Id.VSub_DollarName '$OPTIND')})
              right: (arith_expr.ArithWord w:{(Id.Lit_Digits 1)})
            )
        )
      }
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: (command.DParen child:(arith_expr.ArithWord w:{($ Id.VSub_Pound '$#')}))
              terminator: (Token id:Id.Op_Semi val:';' span_id:564)
            )
          ]
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:opt_name)
                  op: assign_op.Equal
                  rhs: {(1)}
                  spids: [569]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:name)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [573]
                )
              ]
            )
            (C {(shift)})
          ]
          spids: [556 566]
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [(command.DParen child:(arith_expr.ArithWord w:{($ Id.VSub_Pound '$#')})) (C {(usage)})]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: 
            (arith_expr.Binary
              op_id: Id.Arith_DAmp
              left: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_pid span_id:598))
              right: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_name span_id:602))
            )
        )
        (C {(die)} {(DQ ('ERROR: use either -p or -n.'))})
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_pid span_id:617))
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:ftext)
              op: assign_op.Equal
              rhs: {(DQ (' issued by PID ') ($ Id.VSub_DollarName '$pid'))}
              spids: [624]
            )
          ]
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_name span_id:632))
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:ftext)
              op: assign_op.Equal
              rhs: 
                {
                  (DQ (' issued by process name ') 
                    (word_part.EscapedLiteral
                      token: (Token id:Id.Lit_EscapedChar val:'\\"' span_id:642)
                    ) ($ Id.VSub_DollarName '$name') 
                    (word_part.EscapedLiteral
                      token: (Token id:Id.Lit_EscapedChar val:'\\"' span_id:644)
                    )
                  )
                }
              spids: [639]
            )
          ]
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_file span_id:649))
        )
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:ftext)
              op: assign_op.Equal
              rhs: 
                {
                  (DQ ($ Id.VSub_DollarName '$ftext') (' for filenames containing ') 
                    (word_part.EscapedLiteral
                      token: (Token id:Id.Lit_EscapedChar val:'\\"' span_id:660)
                    ) ($ Id.VSub_DollarName '$file') 
                    (word_part.EscapedLiteral
                      token: (Token id:Id.Lit_EscapedChar val:'\\"' span_id:662)
                    )
                  )
                }
              spids: [656]
            )
          ]
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: 
            (arith_expr.Binary
              op_id: Id.Arith_DAmp
              left: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_argc span_id:667))
              right: 
                (arith_expr.Binary
                  op_id: Id.Arith_Great
                  left: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:argc span_id:671))
                  right: 
                    (arith_expr.VarRef
                      token: (Token id:Id.Lit_ArithVarLike val:max_argc span_id:675)
                    )
                )
            )
        )
        (C {(die)} {(DQ ('ERROR: max -a argc is ') ($ Id.VSub_DollarName '$max_argc') (.))})
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (command.DParen
                  child: 
                    (arith_expr.VarRef
                      token: (Token id:Id.Lit_ArithVarLike val:opt_duration span_id:694)
                    )
                )
              terminator: (Token id:Id.Op_Semi val:';' span_id:698)
            )
          ]
          action: [
            (C {(echo)} 
              {
                (DQ ('Tracing exec()s') ($ Id.VSub_DollarName '$ftext') (' for ') 
                  ($ Id.VSub_DollarName '$duration') (' seconds (buffered)...')
                )
              }
            )
          ]
          spids: [690 700]
        )
      ]
      else_action: [
        (C {(echo)} {(DQ ('Tracing exec()s') ($ Id.VSub_DollarName '$ftext') ('. Ctrl-C to end.'))})
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (command.DParen
                  child: 
                    (arith_expr.VarRef
                      token: (Token id:Id.Lit_ArithVarLike val:opt_duration span_id:734)
                    )
                )
              terminator: (Token id:Id.Op_Semi val:';' span_id:738)
            )
          ]
          action: [
            (command.AndOr
              ops: [Id.Op_DAmp Id.Op_DPipe]
              children: [
                (command.DBracket
                  expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{(/usr/bin/mawk)})
                )
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:awk)
                      op: assign_op.Equal
                      rhs: {(mawk)}
                      spids: [753]
                    )
                  ]
                )
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:awk)
                      op: assign_op.Equal
                      rhs: {(awk)}
                      spids: [758]
                    )
                  ]
                )
              ]
            )
          ]
          spids: [730 740]
        )
      ]
      else_action: [
        (command.If
          arms: [
            (if_arm
              cond: [
                (command.Sentence
                  child: 
                    (command.DBracket
                      expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{(/usr/bin/gawk)})
                    )
                  terminator: (Token id:Id.Op_Semi val:';' span_id:777)
                )
              ]
              action: [
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:awk)
                      op: assign_op.Equal
                      rhs: {(gawk)}
                      spids: [782]
                    )
                  ]
                )
              ]
              spids: [768 779]
            )
            (if_arm
              cond: [
                (command.Sentence
                  child: 
                    (command.DBracket
                      expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{(/usr/bin/mawk)})
                    )
                  terminator: (Token id:Id.Op_Semi val:';' span_id:795)
                )
              ]
              action: [
                (command.ShAssignment
                  pairs: [
                    (assign_pair
                      lhs: (sh_lhs_expr.Name name:awk)
                      op: assign_op.Equal
                      rhs: {(DQ ('mawk -W interactive'))}
                      spids: [800]
                    )
                  ]
                )
              ]
              spids: [786 797]
            )
          ]
          else_action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:awk)
                  op: assign_op.Equal
                  rhs: {(awk)}
                  spids: [809]
                )
              ]
            )
          ]
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (C {(cd)} {($ Id.VSub_DollarName '$tracing')})
        (C {(die)} 
          {
            (DQ ('ERROR: accessing tracing. Root user? Kernel has FTRACE?\n') 
              ('    debugfs mounted? (mount -t debugfs debugfs /sys/kernel/debug)')
            )
          }
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DBracket
          expr: (bool_expr.Unary op_id:Id.BoolUnary_e child:{($ Id.VSub_DollarName '$flock')})
        )
        (C {(die)} 
          {
            (DQ ('ERROR: ftrace may be in use by PID ') 
              (command_sub
                left_token: (Token id:Id.Left_DollarParen val:'$(' span_id:852)
                command_list: 
                  (command.CommandList
                    children: [(C {(cat)} {($ Id.VSub_DollarName '$flock')})]
                  )
              ) (' ') ($ Id.VSub_DollarName '$flock')
            )
          }
        )
      ]
    )
    (command.AndOr
      ops: [Id.Op_DPipe]
      children: [
        (command.Simple
          words: [{(echo)} {($ Id.VSub_Dollar '$$')}]
          redirects: [
            (redir.Redir
              op: (Token id:Id.Redir_Great val:'>' span_id:865)
              fd: -1
              arg_word: {($ Id.VSub_DollarName '$flock')}
            )
          ]
        )
        (C {(die)} {(DQ ('ERROR: unable to write ') ($ Id.VSub_DollarName '$flock') (.))})
      ]
    )
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:wroteflock)
          op: assign_op.Equal
          rhs: {(1)}
          spids: [879]
        )
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (command.DBracket
                  expr: (bool_expr.Unary op_id:Id.BoolUnary_x child:{(/usr/bin/getconf)})
                )
              terminator: (Token id:Id.Op_Semi val:';' span_id:895)
            )
          ]
          action: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:bits)
                  op: assign_op.Equal
                  rhs: 
                    {
                      (command_sub
                        left_token: (Token id:Id.Left_DollarParen val:'$(' span_id:901)
                        command_list: (command.CommandList children:[(C {(getconf)} {(LONG_BIT)})])
                      )
                    }
                  spids: [900]
                )
              ]
            )
          ]
          spids: [886 897]
        )
      ]
      else_action: [
        (command.ShAssignment
          pairs: [
            (assign_pair
              lhs: (sh_lhs_expr.Name name:bits)
              op: assign_op.Equal
              rhs: {(64)}
              spids: [910]
            )
          ]
        )
        (command.AndOr
          ops: [Id.Op_DAmp]
          children: [
            (command.DBracket
              expr: 
                (bool_expr.Binary
                  op_id: Id.BoolBinary_GlobDEqual
                  left: 
                    {
                      (command_sub
                        left_token: (Token id:Id.Left_DollarParen val:'$(' span_id:916)
                        command_list: (command.CommandList children:[(C {(uname)} {(-m)})])
                      )
                    }
                  right: {(i) (Id.Lit_Other '*')}
                )
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:bits)
                  op: assign_op.Equal
                  rhs: {(32)}
                  spids: [931]
                )
              ]
            )
          ]
        )
      ]
    )
    (command.DParen
      child: 
        (arith_expr.BinaryAssign
          op_id: Id.Arith_Equal
          left: (sh_lhs_expr.Name name:offset)
          right: 
            (arith_expr.Binary
              op_id: Id.Arith_Slash
              left: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:bits span_id:942))
              right: (arith_expr.ArithWord w:{(Id.Lit_Digits 8)})
            )
        )
    )
    (command.ShFunction
      name: makeprobe
      body: 
        (command.BraceGroup
          children: [
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:func)
                  op: assign_op.Equal
                  rhs: {($ Id.VSub_Number '$1')}
                  spids: [958]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:kname)
                  op: assign_op.Equal
                  rhs: {(execsnoop_) ($ Id.VSub_DollarName '$func')}
                  spids: [962]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:kprobe)
                  op: assign_op.Equal
                  rhs: 
                    {(DQ ('p:') ($ Id.VSub_DollarName '$kname') (' ') ($ Id.VSub_DollarName '$func'))}
                  spids: [967]
                )
              ]
            )
            (command.ShAssignment
              pairs: [
                (assign_pair
                  lhs: (sh_lhs_expr.Name name:i)
                  op: assign_op.Equal
                  rhs: {(0)}
                  spids: [976]
                )
              ]
            )
            (command.WhileUntil
              keyword: (Token id:Id.KW_While val:while span_id:980)
              cond: [
                (command.Sentence
                  child: 
                    (command.DParen
                      child: 
                        (arith_expr.Binary
                          op_id: Id.Arith_Less
                          left: 
                            (arith_expr.VarRef
                              token: (Token id:Id.Lit_ArithVarLike val:i span_id:984)
                            )
                          right: 
                            (arith_expr.Binary
                              op_id: Id.Arith_Plus
                              left: 
                                (arith_expr.VarRef
                                  token: (Token id:Id.Lit_ArithVarLike val:argc span_id:988)
                                )
                              right: (arith_expr.ArithWord w:{(Id.Lit_Digits 1)})
                            )
                        )
                    )
                  terminator: (Token id:Id.Op_Semi val:';' span_id:996)
                )
              ]
              body: 
                (command.DoGroup
                  children: [
                    (command.ShAssignment
                      pairs: [
                        (assign_pair
                          lhs: (sh_lhs_expr.Name name:kprobe)
                          op: assign_op.Equal
                          rhs: 
                            {
                              (DQ ($ Id.VSub_DollarName '$kprobe') (' +0(+') 
                                (word_part.ArithSub
                                  anode: 
                                    (arith_expr.Binary
                                      op_id: Id.Arith_Star
                                      left: 
                                        (arith_expr.VarRef
                                          token: (Token id:Id.Lit_ArithVarLike val:i span_id:1011)
                                        )
                                      right: 
                                        (arith_expr.VarRef
                                          token: 
                                            (Token
                                              id: Id.Lit_ArithVarLike
                                              val: offset
                                              span_id: 1015
                                            )
                                        )
                                    )
                                ) ('(%si)):string')
                              )
                            }
                          spids: [1005]
                        )
                      ]
                    )
                    (command.DParen
                      child: 
                        (arith_expr.UnaryAssign
                          op_id: Id.Node_PostDPlus
                          child: (sh_lhs_expr.Name name:i)
                        )
                    )
                  ]
                )
            )
          ]
        )
    )
    (C {(makeprobe)} {(sys_execve)})
    (command.Simple
      words: [{(echo)} {(nop)}]
      redirects: [
        (redir.Redir
          op: (Token id:Id.Redir_Great val:'>' span_id:1051)
          fd: -1
          arg_word: {(current_tracer)}
        )
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (command.Pipeline
                  children: [
                    (command.Simple
                      words: [{(echo)} {($ Id.VSub_DollarName '$kprobe')}]
                      redirects: [
                        (redir.Redir
                          op: (Token id:Id.Redir_DGreat val:'>>' span_id:1063)
                          fd: -1
                          arg_word: {(kprobe_events)}
                        )
                        (redir.Redir
                          op: (Token id:Id.Redir_Great val:'2>' span_id:1067)
                          fd: 2
                          arg_word: {(/dev/null)}
                        )
                      ]
                    )
                  ]
                  negated: T
                )
              terminator: (Token id:Id.Op_Semi val:';' span_id:1069)
            )
          ]
          action: [
            (C {(makeprobe)} {(stub_execve)})
            (command.If
              arms: [
                (if_arm
                  cond: [
                    (command.Sentence
                      child: 
                        (command.Pipeline
                          children: [
                            (command.Simple
                              words: [{(echo)} {($ Id.VSub_DollarName '$kprobe')}]
                              redirects: [
                                (redir.Redir
                                  op: (Token id:Id.Redir_DGreat val:'>>' span_id:1087)
                                  fd: -1
                                  arg_word: {(kprobe_events)}
                                )
                                (redir.Redir
                                  op: (Token id:Id.Redir_Great val:'2>' span_id:1091)
                                  fd: 2
                                  arg_word: {(/dev/null)}
                                )
                              ]
                            )
                          ]
                          negated: T
                        )
                      terminator: (Token id:Id.Op_Semi val:';' span_id:1093)
                    )
                  ]
                  action: [
                    (C {(makeprobe)} {(do_execve)})
                    (command.If
                      arms: [
                        (if_arm
                          cond: [
                            (command.Sentence
                              child: 
                                (command.Pipeline
                                  children: [
                                    (command.Simple
                                      words: [{(echo)} {($ Id.VSub_DollarName '$kprobe')}]
                                      redirects: [
                                        (redir.Redir
                                          op: (Token id:Id.Redir_DGreat val:'>>' span_id:1111)
                                          fd: -1
                                          arg_word: {(kprobe_events)}
                                        )
                                        (redir.Redir
                                          op: (Token id:Id.Redir_Great val:'2>' span_id:1115)
                                          fd: 2
                                          arg_word: {(/dev/null)}
                                        )
                                      ]
                                    )
                                  ]
                                  negated: T
                                )
                              terminator: (Token id:Id.Op_Semi val:';' span_id:1117)
                            )
                          ]
                          action: [(C {(edie)} {(DQ ('ERROR: adding a kprobe for execve. Exiting.'))})]
                          spids: [1103 1119]
                        )
                      ]
                    )
                  ]
                  spids: [1079 1095]
                )
              ]
            )
          ]
          spids: [1055 1071]
        )
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (command.Pipeline
                  children: [
                    (command.Simple
                      words: [{(echo)} {(1)}]
                      redirects: [
                        (redir.Redir
                          op: (Token id:Id.Redir_Great val:'>' span_id:1144)
                          fd: -1
                          arg_word: {(events/kprobes/) ($ Id.VSub_DollarName '$kname') (/enable)}
                        )
                      ]
                    )
                  ]
                  negated: T
                )
              terminator: (Token id:Id.Op_Semi val:';' span_id:1149)
            )
          ]
          action: [(C {(edie)} {(DQ ('ERROR: enabling kprobe for execve. Exiting.'))})]
          spids: [1136 1151]
        )
      ]
    )
    (command.If
      arms: [
        (if_arm
          cond: [
            (command.Sentence
              child: 
                (command.Pipeline
                  children: [
                    (command.Simple
                      words: [{(echo)} {(1)}]
                      redirects: [
                        (redir.Redir
                          op: (Token id:Id.Redir_Great val:'>' span_id:1170)
                          fd: -1
                          arg_word: {(events/sched/sched_process_fork/enable)}
                        )
                      ]
                    )
                  ]
                  negated: T
                )
              terminator: (Token id:Id.Op_Semi val:';' span_id:1173)
            )
          ]
          action: [(C {(edie)} {(DQ ('ERROR: enabling sched:sched_process_fork tracepoint. Exiting.'))})]
          spids: [1162 1175]
        )
      ]
    )
    (C {(echo)} {(DQ ('Instrumenting ') ($ Id.VSub_DollarName '$func'))})
    (command.AndOr
      ops: [Id.Op_DAmp]
      children: [
        (command.DParen
          child: (arith_expr.VarRef token:(Token id:Id.Lit_ArithVarLike val:opt_time span_id:1195))
        )
        (C {(printf)} {(DQ ('%-16s '))} {(DQ (TIMEs))})
      ]
    )
    (C {(printf)} {(DQ ('%6s %6s %s') (Id.Lit_Other '\\') (n))} {(DQ (PID))} {(DQ (PPID))} {(DQ (ARGS))})
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:offset)
          op: assign_op.Equal
          rhs: 
            {
              (command_sub
                left_token: (Token id:Id.Left_DollarParen val:'$(' span_id:1255)
                command_list: 
                  (command.CommandList
                    children: [
                      (C {($ Id.VSub_DollarName '$awk')} 
                        {
                          (SQ (Token id:Id.Lit_Chars val:'BEGIN { o = 0; }\n' span_id:1259) 
                            (Token
                              id: Id.Lit_Chars
                              val: '\t$1 == "#" && $2 ~ /TASK/ && NF == 6 { o = 1; }\n'
                              span_id: 1260
                            ) (Token id:Id.Lit_Chars val:'\t$2 ~ /TASK/ { print o; exit }' span_id:1261)
                          )
                        } {(trace)}
                      )
                    ]
                  )
              )
            }
          spids: [1254]
        )
      ]
    )
    (C {(warn)} {(DQ ('echo > trace'))})
    (command.Pipeline
      children: [
        (command.Subshell
          command_list: 
            (command.CommandList
              children: [
                (command.If
                  arms: [
                    (if_arm
                      cond: [
                        (command.Sentence
                          child: 
                            (command.DParen
                              child: 
                                (arith_expr.VarRef
                                  token: (Token id:Id.Lit_ArithVarLike val:opt_duration span_id:1283)
                                )
                            )
                          terminator: (Token id:Id.Op_Semi val:';' span_id:1287)
                        )
                      ]
                      action: [
                        (C {(sleep)} {($ Id.VSub_DollarName '$duration')})
                        (C {(cat)} {(-v)} {(trace)})
                      ]
                      spids: [1279 1289]
                    )
                  ]
                  else_action: [(C {(cat)} {(-v)} {(trace_pipe)})]
                )
              ]
            )
        )
        (C {($ Id.VSub_DollarName '$awk')} {(-v)} 
          {(Id.Lit_VarLike 'o=') ($ Id.VSub_DollarName '$offset')} {(-v)} {(Id.Lit_VarLike 'opt_name=') ($ Id.VSub_DollarName '$opt_name')} {(-v)} 
          {(Id.Lit_VarLike 'name=') ($ Id.VSub_DollarName '$name')} {(-v)} {(Id.Lit_VarLike 'opt_duration=') ($ Id.VSub_DollarName '$opt_duration')} {(-v)} 
          {(Id.Lit_VarLike 'opt_time=') ($ Id.VSub_DollarName '$opt_time')} {(-v)} {(Id.Lit_VarLike 'kname=') ($ Id.VSub_DollarName '$kname')} {(-v)} 
          {(Id.Lit_VarLike 'opt_reexec=') ($ Id.VSub_DollarName '$opt_reexec')} 
          {
            (SQ (Token id:Id.Lit_Chars val:'\n' span_id:1368) 
              (Token id:Id.Lit_Chars val:'\t# common fields\n' span_id:1369) (Token id:Id.Lit_Chars val:'\t$1 != "#" {\n' span_id:1370) 
              (Token
                id: Id.Lit_Chars
                val: '\t\t# task name can contain dashes\n'
                span_id: 1371
              ) (Token id:Id.Lit_Chars val:'\t\tcomm = pid = $1\n' span_id:1372) 
              (Token
                id: Id.Lit_Chars
                val: '\t\tsub(/-[0-9][0-9]*/, "", comm)\n'
                span_id: 1373
              ) (Token id:Id.Lit_Chars val:'\t\tsub(/.*-/, "", pid)\n' span_id:1374) 
              (Token id:Id.Lit_Chars val:'\t}\n' span_id:1375) (Token id:Id.Lit_Chars val:'\n' span_id:1376) 
              (Token
                id: Id.Lit_Chars
                val: '\t$1 != "#" && $(4+o) ~ /sched_process_fork/ {\n'
                span_id: 1377
              ) (Token id:Id.Lit_Chars val:'\t\tcpid=$0\n' span_id:1378) 
              (Token
                id: Id.Lit_Chars
                val: '\t\tsub(/.* child_pid=/, "", cpid)\n'
                span_id: 1379
              ) (Token id:Id.Lit_Chars val:'\t\tsub(/ .*/, "", cpid)\n' span_id:1380) 
              (Token id:Id.Lit_Chars val:'\t\tgetppid[cpid] = pid\n' span_id:1381) (Token id:Id.Lit_Chars val:'\t\tdelete seen[pid]\n' span_id:1382) 
              (Token id:Id.Lit_Chars val:'\t}\n' span_id:1383) (Token id:Id.Lit_Chars val:'\n' span_id:1384) 
              (Token
                id: Id.Lit_Chars
                val: '\t$1 != "#" && $(4+o) ~ kname {\n'
                span_id: 1385
              ) (Token id:Id.Lit_Chars val:'\t\tif (seen[pid])\n' span_id:1386) 
              (Token id:Id.Lit_Chars val:'\t\t\tnext\n' span_id:1387) (Token id:Id.Lit_Chars val:'\t\tif (opt_name && comm !~ name)\n' span_id:1388) 
              (Token id:Id.Lit_Chars val:'\t\t\tnext\n' span_id:1389) (Token id:Id.Lit_Chars val:'\n' span_id:1390) (Token id:Id.Lit_Chars val:'\t\t#\n' span_id:1391) 
              (Token id:Id.Lit_Chars val:'\t\t# examples:\n' span_id:1392) 
              (Token
                id: Id.Lit_Chars
                val: '\t\t# ... arg1="/bin/echo" arg2="1" arg3="2" arg4="3" ...\n'
                span_id: 1393
              ) (Token id:Id.Lit_Chars val:'\t\t# ... arg1="sleep" arg2="2" arg3=(fault) arg4="" ...\n' span_id:1394) 
              (Token
                id: Id.Lit_Chars
                val: '\t\t# ... arg1="" arg2=(fault) arg3="" arg4="" ...\n'
                span_id: 1395
              ) (Token id:Id.Lit_Chars val:'\t\t# the last example is uncommon, and may be a race.\n' span_id:1396) 
              (Token id:Id.Lit_Chars val:'\t\t#\n' span_id:1397) (Token id:Id.Lit_Chars val:'\t\tif ($0 ~ /arg1=""/) {\n' span_id:1398) 
              (Token id:Id.Lit_Chars val:'\t\t\targs = comm " [?]"\n' span_id:1399) (Token id:Id.Lit_Chars val:'\t\t} else {\n' span_id:1400) 
              (Token id:Id.Lit_Chars val:'\t\t\targs=$0\n' span_id:1401) (Token id:Id.Lit_Chars val:'\t\t\tsub(/ arg[0-9]*=\\(fault\\).*/, "", args)\n' span_id:1402) 
              (Token
                id: Id.Lit_Chars
                val: '\t\t\tsub(/.*arg1="/, "", args)\n'
                span_id: 1403
              ) (Token id:Id.Lit_Chars val:'\t\t\tgsub(/" arg[0-9]*="/, " ", args)\n' span_id:1404) 
              (Token id:Id.Lit_Chars val:'\t\t\tsub(/"$/, "", args)\n' span_id:1405) (Token id:Id.Lit_Chars val:'\t\t\tif ($0 !~ /\\(fault\\)/)\n' span_id:1406) 
              (Token id:Id.Lit_Chars val:'\t\t\t\targs = args " [...]"\n' span_id:1407) (Token id:Id.Lit_Chars val:'\t\t}\n' span_id:1408) (Token id:Id.Lit_Chars val:'\n' span_id:1409) 
              (Token id:Id.Lit_Chars val:'\t\tif (opt_time) {\n' span_id:1410) (Token id:Id.Lit_Chars val:'\t\t\ttime = $(3+o); sub(":", "", time)\n' span_id:1411) 
              (Token id:Id.Lit_Chars val:'\t\t\tprintf "%-16s ", time\n' span_id:1412) (Token id:Id.Lit_Chars val:'\t\t}\n' span_id:1413) 
              (Token
                id: Id.Lit_Chars
                val: '\t\tprintf "%6s %6d %s\\n", pid, getppid[pid], args\n'
                span_id: 1414
              ) (Token id:Id.Lit_Chars val:'\t\tif (!opt_duration)\n' span_id:1415) 
              (Token id:Id.Lit_Chars val:'\t\t\tfflush()\n' span_id:1416) (Token id:Id.Lit_Chars val:'\t\tif (!opt_reexec) {\n' span_id:1417) 
              (Token id:Id.Lit_Chars val:'\t\t\tseen[pid] = 1\n' span_id:1418) (Token id:Id.Lit_Chars val:'\t\t\tdelete getppid[pid]\n' span_id:1419) 
              (Token id:Id.Lit_Chars val:'\t\t}\n' span_id:1420) (Token id:Id.Lit_Chars val:'\t}\n' span_id:1421) (Token id:Id.Lit_Chars val:'\n' span_id:1422) 
              (Token
                id: Id.Lit_Chars
                val: '\t$0 ~ /LOST.*EVENT[S]/ { print "WARNING: " $0 > "/dev/stderr" }\n'
                span_id: 1423
              )
            )
          }
        )
      ]
      negated: F
    )
    (C {(end)})
  ]
)