xref: /freebsd/usr.bin/kdump/kdump.c (revision b79bd43f9ab3bf0dfd4744dee406782f0329134a)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1988, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 #define _WANT_KERNEL_ERRNO
33 #ifdef __LP64__
34 #define	_WANT_KEVENT32
35 #endif
36 #define	_WANT_FREEBSD11_KEVENT
37 #define	_WANT_FREEBSD_BITSET
38 #include <sys/param.h>
39 #include <sys/capsicum.h>
40 #include <sys/_bitset.h>
41 #include <sys/bitset.h>
42 #include <sys/errno.h>
43 #include <sys/time.h>
44 #include <sys/uio.h>
45 #include <sys/event.h>
46 #include <sys/ktrace.h>
47 #include <sys/mman.h>
48 #include <sys/ioctl.h>
49 #include <sys/poll.h>
50 #include <sys/socket.h>
51 #include <sys/stat.h>
52 #include <sys/sysent.h>
53 #include <sys/thr.h>
54 #include <sys/umtx.h>
55 #include <sys/un.h>
56 #include <sys/queue.h>
57 #include <sys/wait.h>
58 #ifdef WITH_CASPER
59 #include <sys/nv.h>
60 #endif
61 #include <arpa/inet.h>
62 #include <netinet/in.h>
63 #include <netlink/netlink.h>
64 #include <ctype.h>
65 #include <capsicum_helpers.h>
66 #include <err.h>
67 #include <grp.h>
68 #include <inttypes.h>
69 #include <locale.h>
70 #include <netdb.h>
71 #include <nl_types.h>
72 #include <pwd.h>
73 #include <stddef.h>
74 #include <stdio.h>
75 #include <stdlib.h>
76 #include <string.h>
77 #include <sysdecode.h>
78 #include <time.h>
79 #include <unistd.h>
80 #include <vis.h>
81 #include "ktrace.h"
82 #include "kdump.h"
83 
84 #ifdef WITH_CASPER
85 #include <libcasper.h>
86 
87 #include <casper/cap_grp.h>
88 #include <casper/cap_pwd.h>
89 #endif
90 
91 static int fetchprocinfo(struct ktr_header *, u_int *);
92 static u_int findabi(struct ktr_header *);
93 static int fread_tail(void *, int, int);
94 static void dumpheader(struct ktr_header *, u_int);
95 static void dumptimeval(struct ktr_header_v0 *kth);
96 static void dumptimespec(struct ktr_header *kth);
97 static void ktrsyscall(struct ktr_syscall *, u_int);
98 static void ktrsysret(struct ktr_sysret *, u_int);
99 static void ktrnamei(char *, int);
100 static void hexdump(char *, int, int);
101 static void visdump(char *, int, int);
102 static void ktrgenio(struct ktr_genio *, int);
103 static void ktrpsig(struct ktr_psig *);
104 static void ktrcsw(struct ktr_csw *);
105 static void ktrcsw_old(struct ktr_csw_old *);
106 static void ktruser(int, void *);
107 static void ktrcaprights(cap_rights_t *);
108 static void ktritimerval(struct itimerval *it);
109 static void ktrsockaddr(struct sockaddr *);
110 static void ktrsplice(struct splice *);
111 static void ktrstat(struct stat *);
112 static void ktrstruct(char *, size_t);
113 static void ktrthrparam(struct thr_param *);
114 static void ktrcapfail(struct ktr_cap_fail *);
115 static void ktrfault(struct ktr_fault *);
116 static void ktrfaultend(struct ktr_faultend *);
117 static void ktrkevent(struct kevent *);
118 static void ktrpollfd(struct pollfd *);
119 static void ktrstructarray(struct ktr_struct_array *, size_t);
120 static void ktrbitset(char *, struct bitset *, size_t);
121 static void ktrsyscall_freebsd(struct ktr_syscall *ktr, register_t **resip,
122     int *resnarg, char *resc, u_int sv_flags);
123 static void ktrexecve(char *, int);
124 static void ktrexterr(struct ktr_exterr *);
125 static void usage(void);
126 
127 #define	TIMESTAMP_NONE		0x0
128 #define	TIMESTAMP_ABSOLUTE	0x1
129 #define	TIMESTAMP_ELAPSED	0x2
130 #define	TIMESTAMP_RELATIVE	0x4
131 
132 bool decimal, fancy = true, resolv;
133 static bool abiflag, suppressdata, syscallno, tail, threads, cpuflag;
134 static int timestamp, maxdata;
135 static const char *tracefile = DEF_TRACEFILE;
136 static struct ktr_header ktr_header;
137 static short version;
138 
139 #define TIME_FORMAT	"%b %e %T %Y"
140 #define eqs(s1, s2)	(strcmp((s1), (s2)) == 0)
141 
142 struct proc_info
143 {
144 	TAILQ_ENTRY(proc_info)	info;
145 	u_int			sv_flags;
146 	pid_t			pid;
147 };
148 
149 static TAILQ_HEAD(trace_procs, proc_info) trace_procs;
150 
151 #ifdef WITH_CASPER
152 static cap_channel_t *cappwd, *capgrp;
153 
154 static int
155 cappwdgrp_setup(cap_channel_t **cappwdp, cap_channel_t **capgrpp)
156 {
157 	cap_channel_t *capcas, *cappwdloc, *capgrploc;
158 	const char *cmds[1], *fields[1];
159 
160 	capcas = cap_init();
161 	if (capcas == NULL) {
162 		err(1, "unable to create casper process");
163 		exit(1);
164 	}
165 	cappwdloc = cap_service_open(capcas, "system.pwd");
166 	capgrploc = cap_service_open(capcas, "system.grp");
167 	/* Casper capability no longer needed. */
168 	cap_close(capcas);
169 	if (cappwdloc == NULL || capgrploc == NULL) {
170 		if (cappwdloc == NULL)
171 			warn("unable to open system.pwd service");
172 		if (capgrploc == NULL)
173 			warn("unable to open system.grp service");
174 		exit(1);
175 	}
176 	/* Limit system.pwd to only getpwuid() function and pw_name field. */
177 	cmds[0] = "getpwuid";
178 	if (cap_pwd_limit_cmds(cappwdloc, cmds, 1) < 0)
179 		err(1, "unable to limit system.pwd service");
180 	fields[0] = "pw_name";
181 	if (cap_pwd_limit_fields(cappwdloc, fields, 1) < 0)
182 		err(1, "unable to limit system.pwd service");
183 	/* Limit system.grp to only getgrgid() function and gr_name field. */
184 	cmds[0] = "getgrgid";
185 	if (cap_grp_limit_cmds(capgrploc, cmds, 1) < 0)
186 		err(1, "unable to limit system.grp service");
187 	fields[0] = "gr_name";
188 	if (cap_grp_limit_fields(capgrploc, fields, 1) < 0)
189 		err(1, "unable to limit system.grp service");
190 
191 	*cappwdp = cappwdloc;
192 	*capgrpp = capgrploc;
193 	return (0);
194 }
195 #endif	/* WITH_CASPER */
196 
197 void
198 print_integer_arg(const char *(*decoder)(int), int value)
199 {
200 	const char *str;
201 
202 	str = decoder(value);
203 	if (str != NULL)
204 		printf("%s", str);
205 	else {
206 		if (decimal)
207 			printf("<invalid=%d>", value);
208 		else
209 			printf("<invalid=%#x>", value);
210 	}
211 }
212 
213 /* Like print_integer_arg but unknown values are treated as valid. */
214 void
215 print_integer_arg_valid(const char *(*decoder)(int), int value)
216 {
217 	const char *str;
218 
219 	str = decoder(value);
220 	if (str != NULL)
221 		printf("%s", str);
222 	else {
223 		if (decimal)
224 			printf("%d", value);
225 		else
226 			printf("%#x", value);
227 	}
228 }
229 
230 bool
231 print_mask_arg_part(bool (*decoder)(FILE *, int, int *), int value, int *rem)
232 {
233 
234 	printf("%#x<", value);
235 	return (decoder(stdout, value, rem));
236 }
237 
238 void
239 print_mask_arg(bool (*decoder)(FILE *, int, int *), int value)
240 {
241 	bool invalid;
242 	int rem;
243 
244 	invalid = !print_mask_arg_part(decoder, value, &rem);
245 	printf(">");
246 	if (invalid)
247 		printf("<invalid>%u", rem);
248 }
249 
250 void
251 print_mask_arg0(bool (*decoder)(FILE *, int, int *), int value)
252 {
253 	bool invalid;
254 	int rem;
255 
256 	if (value == 0) {
257 		printf("0");
258 		return;
259 	}
260 	printf("%#x<", value);
261 	invalid = !decoder(stdout, value, &rem);
262 	printf(">");
263 	if (invalid)
264 		printf("<invalid>%u", rem);
265 }
266 
267 static void
268 decode_fileflags(fflags_t value)
269 {
270 	bool invalid;
271 	fflags_t rem;
272 
273 	if (value == 0) {
274 		printf("0");
275 		return;
276 	}
277 	printf("%#x<", value);
278 	invalid = !sysdecode_fileflags(stdout, value, &rem);
279 	printf(">");
280 	if (invalid)
281 		printf("<invalid>%u", rem);
282 }
283 
284 void
285 decode_filemode(int value)
286 {
287 	bool invalid;
288 	int rem;
289 
290 	if (value == 0) {
291 		printf("0");
292 		return;
293 	}
294 	printf("%#o<", value);
295 	invalid = !sysdecode_filemode(stdout, value, &rem);
296 	printf(">");
297 	if (invalid)
298 		printf("<invalid>%u", rem);
299 }
300 
301 void
302 print_mask_arg32(bool (*decoder)(FILE *, uint32_t, uint32_t *), uint32_t value)
303 {
304 	bool invalid;
305 	uint32_t rem;
306 
307 	printf("%#x<", value);
308 	invalid = !decoder(stdout, value, &rem);
309 	printf(">");
310 	if (invalid)
311 		printf("<invalid>%u", rem);
312 }
313 
314 void
315 print_mask_argul(bool (*decoder)(FILE *, u_long, u_long *), u_long value)
316 {
317 	bool invalid;
318 	u_long rem;
319 
320 	if (value == 0) {
321 		printf("0");
322 		return;
323 	}
324 	printf("%#lx<", value);
325 	invalid = !decoder(stdout, value, &rem);
326 	printf(">");
327 	if (invalid)
328 		printf("<invalid>%lu", rem);
329 }
330 
331 int
332 main(int argc, char *argv[])
333 {
334 	int ch, ktrlen, size;
335 	void *m;
336 	int trpoints = ALL_POINTS;
337 	int drop_logged;
338 	pid_t pid = 0;
339 	u_int sv_flags;
340 
341 	setlocale(LC_CTYPE, "");
342 
343 	timestamp = TIMESTAMP_NONE;
344 
345 	while ((ch = getopt(argc,argv,"f:cdElm:np:AHRrSsTt:")) != -1)
346 		switch (ch) {
347 		case 'A':
348 			abiflag = true;
349 			break;
350 		case 'f':
351 			tracefile = optarg;
352 			break;
353 		case 'c':
354 			cpuflag = true;
355 			break;
356 		case 'd':
357 			decimal = true;
358 			break;
359 		case 'l':
360 			tail = true;
361 			break;
362 		case 'm':
363 			maxdata = atoi(optarg);
364 			break;
365 		case 'n':
366 			fancy = false;
367 			break;
368 		case 'p':
369 			pid = atoi(optarg);
370 			break;
371 		case 'r':
372 			resolv = true;
373 			break;
374 		case 'S':
375 			syscallno = true;
376 			break;
377 		case 's':
378 			suppressdata = true;
379 			break;
380 		case 'E':
381 			timestamp |= TIMESTAMP_ELAPSED;
382 			break;
383 		case 'H':
384 			threads = true;
385 			break;
386 		case 'R':
387 			timestamp |= TIMESTAMP_RELATIVE;
388 			break;
389 		case 'T':
390 			timestamp |= TIMESTAMP_ABSOLUTE;
391 			break;
392 		case 't':
393 			trpoints = getpoints(optarg);
394 			if (trpoints < 0)
395 				errx(1, "unknown trace point in %s", optarg);
396 			break;
397 		default:
398 			usage();
399 		}
400 
401 	if (argc > optind)
402 		usage();
403 
404 	m = malloc(size = 1025);
405 	if (m == NULL)
406 		errx(1, "%s", strerror(ENOMEM));
407 	if (strcmp(tracefile, "-") != 0)
408 		if (!freopen(tracefile, "r", stdin))
409 			err(1, "%s", tracefile);
410 
411 	caph_cache_catpages();
412 	caph_cache_tzdata();
413 
414 #ifdef WITH_CASPER
415 	if (resolv) {
416 		if (cappwdgrp_setup(&cappwd, &capgrp) < 0) {
417 			cappwd = NULL;
418 			capgrp = NULL;
419 		}
420 	}
421 	if (!resolv || (cappwd != NULL && capgrp != NULL)) {
422 		if (caph_enter() < 0)
423 			err(1, "unable to enter capability mode");
424 	}
425 #else
426 	if (!resolv) {
427 		if (caph_enter() < 0)
428 			err(1, "unable to enter capability mode");
429 	}
430 #endif
431 	if (caph_limit_stdio() == -1)
432 		err(1, "unable to limit stdio");
433 
434 	TAILQ_INIT(&trace_procs);
435 	drop_logged = 0;
436 	while (fread_tail(&ktr_header, sizeof(struct ktr_header), 1)) {
437 		if (ktr_header.ktr_type & KTR_VERSIONED) {
438 			ktr_header.ktr_type &= ~KTR_VERSIONED;
439 			version = ktr_header.ktr_version;
440 		} else
441 			version = KTR_VERSION0;
442 		if (ktr_header.ktr_type & KTR_DROP) {
443 			ktr_header.ktr_type &= ~KTR_DROP;
444 			if (!drop_logged && threads) {
445 				printf(
446 				    "%6d %6d %-8.*s Events dropped.\n",
447 				    ktr_header.ktr_pid,
448 				    ktr_header.ktr_tid > 0 ?
449 				    (lwpid_t)ktr_header.ktr_tid : 0,
450 				    MAXCOMLEN, ktr_header.ktr_comm);
451 				drop_logged = 1;
452 			} else if (!drop_logged) {
453 				printf("%6d %-8.*s Events dropped.\n",
454 				    ktr_header.ktr_pid, MAXCOMLEN,
455 				    ktr_header.ktr_comm);
456 				drop_logged = 1;
457 			}
458 		}
459 		if ((ktrlen = ktr_header.ktr_len) < 0)
460 			errx(1, "bogus length 0x%x", ktrlen);
461 		if (ktrlen > size) {
462 			m = realloc(m, ktrlen+1);
463 			if (m == NULL)
464 				errx(1, "%s", strerror(ENOMEM));
465 			size = ktrlen;
466 		}
467 		if (version == KTR_VERSION0 &&
468 		    fseek(stdin, KTR_OFFSET_V0, SEEK_CUR) < 0)
469 			errx(1, "%s", strerror(errno));
470 		if (ktrlen && fread_tail(m, ktrlen, 1) == 0)
471 			errx(1, "data too short");
472 		if (fetchprocinfo(&ktr_header, (u_int *)m) != 0)
473 			continue;
474 		if (pid && ktr_header.ktr_pid != pid &&
475 		    ktr_header.ktr_tid != pid)
476 			continue;
477 		if ((trpoints & (1<<ktr_header.ktr_type)) == 0)
478 			continue;
479 		sv_flags = findabi(&ktr_header);
480 		dumpheader(&ktr_header, sv_flags);
481 		drop_logged = 0;
482 		switch (ktr_header.ktr_type) {
483 		case KTR_SYSCALL:
484 			ktrsyscall((struct ktr_syscall *)m, sv_flags);
485 			break;
486 		case KTR_SYSRET:
487 			ktrsysret((struct ktr_sysret *)m, sv_flags);
488 			break;
489 		case KTR_NAMEI:
490 		case KTR_SYSCTL:
491 			ktrnamei(m, ktrlen);
492 			break;
493 		case KTR_GENIO:
494 			ktrgenio((struct ktr_genio *)m, ktrlen);
495 			break;
496 		case KTR_PSIG:
497 			ktrpsig((struct ktr_psig *)m);
498 			break;
499 		case KTR_CSW:
500 			if (ktrlen == sizeof(struct ktr_csw_old))
501 				ktrcsw_old((struct ktr_csw_old *)m);
502 			else
503 				ktrcsw((struct ktr_csw *)m);
504 			break;
505 		case KTR_USER:
506 			ktruser(ktrlen, m);
507 			break;
508 		case KTR_STRUCT:
509 			ktrstruct(m, ktrlen);
510 			break;
511 		case KTR_CAPFAIL:
512 			ktrcapfail((struct ktr_cap_fail *)m);
513 			break;
514 		case KTR_FAULT:
515 			ktrfault((struct ktr_fault *)m);
516 			break;
517 		case KTR_FAULTEND:
518 			ktrfaultend((struct ktr_faultend *)m);
519 			break;
520 		case KTR_STRUCT_ARRAY:
521 			ktrstructarray((struct ktr_struct_array *)m, ktrlen);
522 			break;
523 		case KTR_ARGS:
524 		case KTR_ENVS:
525 			ktrexecve(m, ktrlen);
526 			break;
527 		case KTR_EXTERR:
528 			ktrexterr((struct ktr_exterr *)m);
529 			break;
530 		default:
531 			printf("\n");
532 			break;
533 		}
534 		if (tail)
535 			fflush(stdout);
536 	}
537 	return 0;
538 }
539 
540 static int
541 fread_tail(void *buf, int size, int num)
542 {
543 	int i;
544 
545 	while ((i = fread(buf, size, num, stdin)) == 0 && tail) {
546 		sleep(1);
547 		clearerr(stdin);
548 	}
549 	return (i);
550 }
551 
552 static int
553 fetchprocinfo(struct ktr_header *kth, u_int *flags)
554 {
555 	struct proc_info *pi;
556 
557 	switch (kth->ktr_type) {
558 	case KTR_PROCCTOR:
559 		TAILQ_FOREACH(pi, &trace_procs, info) {
560 			if (pi->pid == kth->ktr_pid) {
561 				TAILQ_REMOVE(&trace_procs, pi, info);
562 				break;
563 			}
564 		}
565 		pi = malloc(sizeof(struct proc_info));
566 		if (pi == NULL)
567 			errx(1, "%s", strerror(ENOMEM));
568 		pi->sv_flags = *flags;
569 		pi->pid = kth->ktr_pid;
570 		TAILQ_INSERT_TAIL(&trace_procs, pi, info);
571 		return (1);
572 
573 	case KTR_PROCDTOR:
574 		TAILQ_FOREACH(pi, &trace_procs, info) {
575 			if (pi->pid == kth->ktr_pid) {
576 				TAILQ_REMOVE(&trace_procs, pi, info);
577 				free(pi);
578 				break;
579 			}
580 		}
581 		return (1);
582 	}
583 
584 	return (0);
585 }
586 
587 static u_int
588 findabi(struct ktr_header *kth)
589 {
590 	struct proc_info *pi;
591 
592 	TAILQ_FOREACH(pi, &trace_procs, info) {
593 		if (pi->pid == kth->ktr_pid) {
594 			return (pi->sv_flags);
595 		}
596 	}
597 	return (0);
598 }
599 
600 static void
601 dumptimeval(struct ktr_header_v0 *kth)
602 {
603 	static struct timeval prevtime, prevtime_e;
604 	struct timeval temp;
605 	const char *sign;
606 
607 	if (timestamp & TIMESTAMP_ABSOLUTE) {
608 		printf("%jd.%06ld ", (intmax_t)kth->ktr_time.tv_sec,
609 		    kth->ktr_time.tv_usec);
610 	}
611 	if (timestamp & TIMESTAMP_ELAPSED) {
612 		if (prevtime_e.tv_sec == 0)
613 			prevtime_e = kth->ktr_time;
614 		timersub(&kth->ktr_time, &prevtime_e, &temp);
615 		printf("%jd.%06ld ", (intmax_t)temp.tv_sec,
616 		    temp.tv_usec);
617 	}
618 	if (timestamp & TIMESTAMP_RELATIVE) {
619 		if (prevtime.tv_sec == 0)
620 			prevtime = kth->ktr_time;
621 		if (timercmp(&kth->ktr_time, &prevtime, <)) {
622 			timersub(&prevtime, &kth->ktr_time, &temp);
623 			sign = "-";
624 		} else {
625 			timersub(&kth->ktr_time, &prevtime, &temp);
626 			sign = "";
627 		}
628 		prevtime = kth->ktr_time;
629 		printf("%s%jd.%06ld ", sign, (intmax_t)temp.tv_sec,
630 		    temp.tv_usec);
631 	}
632 }
633 
634 static void
635 dumptimespec(struct ktr_header *kth)
636 {
637 	static struct timespec prevtime, prevtime_e;
638 	struct timespec temp;
639 	const char *sign;
640 
641 	if (timestamp & TIMESTAMP_ABSOLUTE) {
642 		printf("%jd.%09ld ", (intmax_t)kth->ktr_time.tv_sec,
643 		    kth->ktr_time.tv_nsec);
644 	}
645 	if (timestamp & TIMESTAMP_ELAPSED) {
646 		if (prevtime_e.tv_sec == 0)
647 			prevtime_e = kth->ktr_time;
648 		timespecsub(&kth->ktr_time, &prevtime_e, &temp);
649 		printf("%jd.%09ld ", (intmax_t)temp.tv_sec,
650 		    temp.tv_nsec);
651 	}
652 	if (timestamp & TIMESTAMP_RELATIVE) {
653 		if (prevtime.tv_sec == 0)
654 			prevtime = kth->ktr_time;
655 		if (timespeccmp(&kth->ktr_time, &prevtime, <)) {
656 			timespecsub(&prevtime, &kth->ktr_time, &temp);
657 			sign = "-";
658 		} else {
659 			timespecsub(&kth->ktr_time, &prevtime, &temp);
660 			sign = "";
661 		}
662 		prevtime = kth->ktr_time;
663 		printf("%s%jd.%09ld ", sign, (intmax_t)temp.tv_sec,
664 		    temp.tv_nsec);
665 	}
666 }
667 
668 static const char * const hdr_names[] = {
669 	[KTR_SYSCALL] =		"CALL",
670 	[KTR_SYSRET] =		"RET ",
671 	[KTR_NAMEI] =		"NAMI",
672 	[KTR_GENIO] =		"GIO ",
673 	[KTR_PSIG] =		"PSIG",
674 	[KTR_CSW] =		"CSW ",
675 	[KTR_USER] =		"USER",
676 	[KTR_STRUCT] =		"STRU",
677 	[KTR_STRUCT_ARRAY] =	"STRU",
678 	[KTR_SYSCTL] =		"SCTL",
679 	[KTR_CAPFAIL] =		"CAP ",
680 	[KTR_FAULT] =		"PFLT",
681 	[KTR_FAULTEND] =	"PRET",
682 	[KTR_ARGS] =		"ARGS",
683 	[KTR_ENVS] =		"ENVS",
684 	[KTR_EXTERR] =		"EERR",
685 };
686 
687 static void
688 dumpheader(struct ktr_header *kth, u_int sv_flags)
689 {
690 	static char unknown[64];
691 	const char *abi;
692 	const char *arch;
693 	const char *type;
694 
695 	if (kth->ktr_type < 0 || (size_t)kth->ktr_type >= nitems(hdr_names)) {
696 		snprintf(unknown, sizeof(unknown), "UNKNOWN(%d)",
697 		    kth->ktr_type);
698 		type = unknown;
699 	} else {
700 		type = hdr_names[kth->ktr_type];
701 	}
702 
703 	/*
704 	 * The ktr_tid field was previously the ktr_buffer field, which held
705 	 * the kernel pointer value for the buffer associated with data
706 	 * following the record header.  It now holds a threadid, but only
707 	 * for trace files after the change.  Older trace files still contain
708 	 * kernel pointers.  Detect this and suppress the results by printing
709 	 * negative tid's as 0.
710 	 */
711 	if (threads)
712 		printf("%6d %6d %-8.*s ", kth->ktr_pid,
713 		    kth->ktr_tid > 0 ? (lwpid_t)kth->ktr_tid : 0,
714 		    MAXCOMLEN, kth->ktr_comm);
715 	else
716 		printf("%6d %-8.*s ", kth->ktr_pid, MAXCOMLEN, kth->ktr_comm);
717         if (timestamp) {
718 		if (version == KTR_VERSION0)
719 			dumptimeval((struct ktr_header_v0 *)kth);
720 		else
721 			dumptimespec(kth);
722 	}
723 	if (cpuflag && version > KTR_VERSION0)
724 		printf("%3d ", kth->ktr_cpu);
725 	printf("%s  ", type);
726 	if (abiflag != 0) {
727 		switch (sv_flags & SV_ABI_MASK) {
728 		case SV_ABI_LINUX:
729 			abi = "L";
730 			break;
731 		case SV_ABI_FREEBSD:
732 			abi = "F";
733 			break;
734 		default:
735 			abi = "U";
736 			break;
737 		}
738 
739 		if ((sv_flags & SV_LP64) != 0)
740 			arch = "64";
741 		else if ((sv_flags & SV_ILP32) != 0)
742 			arch = "32";
743 		else
744 			arch = "00";
745 
746 		printf("%s%s  ", abi, arch);
747 	}
748 }
749 
750 #include <sys/syscall.h>
751 
752 static void
753 ioctlname(unsigned long val)
754 {
755 	const char *str;
756 
757 	str = sysdecode_ioctlname(val);
758 	if (str != NULL)
759 		printf("%s", str);
760 	else if (decimal)
761 		printf("%lu", val);
762 	else
763 		printf("%#lx", val);
764 }
765 
766 static enum sysdecode_abi
767 syscallabi(u_int sv_flags)
768 {
769 
770 	if (sv_flags == 0)
771 		return (SYSDECODE_ABI_FREEBSD);
772 	switch (sv_flags & SV_ABI_MASK) {
773 	case SV_ABI_FREEBSD:
774 		return (SYSDECODE_ABI_FREEBSD);
775 	case SV_ABI_LINUX:
776 #ifdef __LP64__
777 		if (sv_flags & SV_ILP32)
778 			return (SYSDECODE_ABI_LINUX32);
779 #endif
780 		return (SYSDECODE_ABI_LINUX);
781 	default:
782 		return (SYSDECODE_ABI_UNKNOWN);
783 	}
784 }
785 
786 static void
787 syscallname(u_int code, u_int sv_flags)
788 {
789 	const char *name;
790 
791 	name = sysdecode_syscallname(syscallabi(sv_flags), code);
792 	if (name == NULL)
793 		printf("[%d]", code);
794 	else {
795 		printf("%s", name);
796 		if (syscallno)
797 			printf("[%d]", code);
798 	}
799 }
800 
801 static void
802 print_signal(int signo)
803 {
804 	const char *signame;
805 
806 	signame = sysdecode_signal(signo);
807 	if (signame != NULL)
808 		printf("%s", signame);
809 	else
810 		printf("SIG %d", signo);
811 }
812 
813 static void
814 ktrsyscall(struct ktr_syscall *ktr, u_int sv_flags)
815 {
816 	int narg = ktr->ktr_narg;
817 	register_t *ip;
818 
819 	syscallname(ktr->ktr_code, sv_flags);
820 	ip = &ktr->ktr_args[0];
821 	if (narg) {
822 		char c = '(';
823 		if (fancy) {
824 			switch (sv_flags & SV_ABI_MASK) {
825 			case SV_ABI_FREEBSD:
826 				ktrsyscall_freebsd(ktr, &ip, &narg, &c,
827 				    sv_flags);
828 				break;
829 #ifdef SYSDECODE_HAVE_LINUX
830 			case SV_ABI_LINUX:
831 #ifdef __amd64__
832 				if (sv_flags & SV_ILP32)
833 					ktrsyscall_linux32(ktr, &ip,
834 					    &narg, &c);
835 				else
836 #endif
837 				ktrsyscall_linux(ktr, &ip, &narg, &c);
838 				break;
839 #endif /* SYSDECODE_HAVE_LINUX */
840 			}
841 		}
842 		while (narg > 0)
843 			print_number(ip, narg, c);
844 		putchar(')');
845 	}
846 	putchar('\n');
847 }
848 
849 static void
850 ktrsyscall_freebsd(struct ktr_syscall *ktr, register_t **resip,
851     int *resnarg, char *resc, u_int sv_flags)
852 {
853 	int narg = ktr->ktr_narg;
854 	register_t *ip, *first;
855 	intmax_t arg;
856 	int quad_align, quad_slots;
857 
858 	ip = first = &ktr->ktr_args[0];
859 	char c = *resc;
860 
861 			quad_align = 0;
862 			if (sv_flags & SV_ILP32) {
863 #ifdef __powerpc__
864 				quad_align = 1;
865 #endif
866 				quad_slots = 2;
867 			} else
868 				quad_slots = 1;
869 			switch (ktr->ktr_code) {
870 			case SYS_bindat:
871 			case SYS_chflagsat:
872 			case SYS_connectat:
873 			case SYS_faccessat:
874 			case SYS_fchmodat:
875 			case SYS_fchownat:
876 			case SYS_fstatat:
877 			case SYS_futimesat:
878 			case SYS_linkat:
879 			case SYS_mkdirat:
880 			case SYS_mkfifoat:
881 			case SYS_mknodat:
882 			case SYS_openat:
883 			case SYS_readlinkat:
884 			case SYS_renameat:
885 			case SYS_unlinkat:
886 			case SYS_utimensat:
887 				putchar('(');
888 				print_integer_arg_valid(sysdecode_atfd, *ip);
889 				c = ',';
890 				ip++;
891 				narg--;
892 				break;
893 			}
894 			switch (ktr->ktr_code) {
895 			case SYS_ioctl: {
896 				print_number(ip, narg, c);
897 				putchar(c);
898 				ioctlname(*ip);
899 				c = ',';
900 				ip++;
901 				narg--;
902 				break;
903 			}
904 			case SYS_ptrace:
905 				putchar('(');
906 				print_integer_arg(sysdecode_ptrace_request, *ip);
907 				c = ',';
908 				ip++;
909 				narg--;
910 				break;
911 			case SYS_access:
912 			case SYS_eaccess:
913 			case SYS_faccessat:
914 				print_number(ip, narg, c);
915 				putchar(',');
916 				print_mask_arg(sysdecode_access_mode, *ip);
917 				ip++;
918 				narg--;
919 				break;
920 			case SYS_close_range:
921 				print_number(ip, narg, c);
922 				print_number(ip, narg, c);
923 				putchar(',');
924 				print_mask_arg0(sysdecode_close_range_flags,
925 				    *ip);
926 				ip += 3;
927 				narg -= 3;
928 				break;
929 			case SYS_open:
930 			case SYS_openat:
931 				print_number(ip, narg, c);
932 				putchar(',');
933 				print_mask_arg(sysdecode_open_flags, ip[0]);
934 				if ((ip[0] & O_CREAT) == O_CREAT) {
935 					putchar(',');
936 					decode_filemode(ip[1]);
937 				}
938 				ip += 2;
939 				narg -= 2;
940 				break;
941 			case SYS_wait4:
942 				*ip = (pid_t)*ip;
943 				print_decimal_number(ip, narg, c);
944 				print_number(ip, narg, c);
945 				putchar(',');
946 				print_mask_arg0(sysdecode_wait4_options, *ip);
947 				ip++;
948 				narg--;
949 				break;
950 			case SYS_wait6:
951 				putchar('(');
952 				print_integer_arg(sysdecode_idtype, *ip);
953 				c = ',';
954 				ip++;
955 				narg--;
956 				print_decimal_number64(first, ip, narg, c);
957 				print_number(ip, narg, c);
958 				putchar(',');
959 				print_mask_arg(sysdecode_wait6_options, *ip);
960 				ip++;
961 				narg--;
962 				break;
963 			case SYS_chmod:
964 			case SYS_fchmod:
965 			case SYS_lchmod:
966 			case SYS_fchmodat:
967 				print_number(ip, narg, c);
968 				putchar(',');
969 				decode_filemode(*ip);
970 				ip++;
971 				narg--;
972 				break;
973 			case SYS_mknodat:
974 				print_number(ip, narg, c);
975 				putchar(',');
976 				decode_filemode(*ip);
977 				ip++;
978 				narg--;
979 				break;
980 			case SYS_getfsstat:
981 				print_number(ip, narg, c);
982 				print_number(ip, narg, c);
983 				putchar(',');
984 				print_integer_arg(sysdecode_getfsstat_mode, *ip);
985 				ip++;
986 				narg--;
987 				break;
988 			case SYS_mount:
989 				print_number(ip, narg, c);
990 				print_number(ip, narg, c);
991 				putchar(',');
992 				print_mask_arg0(sysdecode_mount_flags, *ip);
993 				ip++;
994 				narg--;
995 				break;
996 			case SYS_unmount:
997 				print_number(ip, narg, c);
998 				putchar(',');
999 				print_mask_arg0(sysdecode_mount_flags, *ip);
1000 				ip++;
1001 				narg--;
1002 				break;
1003 			case SYS_recvmsg:
1004 			case SYS_sendmsg:
1005 				print_number(ip, narg, c);
1006 				print_number(ip, narg, c);
1007 				putchar(',');
1008 				print_mask_arg0(sysdecode_msg_flags, *ip);
1009 				ip++;
1010 				narg--;
1011 				break;
1012 			case SYS_recvfrom:
1013 			case SYS_sendto:
1014 				print_number(ip, narg, c);
1015 				print_number(ip, narg, c);
1016 				print_number(ip, narg, c);
1017 				putchar(',');
1018 				print_mask_arg0(sysdecode_msg_flags, *ip);
1019 				ip++;
1020 				narg--;
1021 				break;
1022 			case SYS_chflags:
1023 			case SYS_chflagsat:
1024 			case SYS_fchflags:
1025 			case SYS_lchflags:
1026 				print_number(ip, narg, c);
1027 				putchar(',');
1028 				decode_fileflags(*ip);
1029 				ip++;
1030 				narg--;
1031 				break;
1032 			case SYS_kill:
1033 				*ip = (pid_t)*ip;
1034 				print_decimal_number(ip, narg, c);
1035 				putchar(',');
1036 				print_signal(*ip);
1037 				ip++;
1038 				narg--;
1039 				break;
1040 			case SYS_reboot:
1041 				putchar('(');
1042 				print_mask_arg(sysdecode_reboot_howto, *ip);
1043 				ip++;
1044 				narg--;
1045 				break;
1046 			case SYS_umask:
1047 				putchar('(');
1048 				decode_filemode(*ip);
1049 				ip++;
1050 				narg--;
1051 				break;
1052 			case SYS_msync:
1053 				print_number(ip, narg, c);
1054 				print_number(ip, narg, c);
1055 				putchar(',');
1056 				print_mask_arg(sysdecode_msync_flags, *ip);
1057 				ip++;
1058 				narg--;
1059 				break;
1060 #ifdef SYS_freebsd6_mmap
1061 			case SYS_freebsd6_mmap:
1062 				print_number(ip, narg, c);
1063 				print_number(ip, narg, c);
1064 				putchar(',');
1065 				print_mask_arg(sysdecode_mmap_prot, *ip);
1066 				putchar(',');
1067 				ip++;
1068 				narg--;
1069 				print_mask_arg(sysdecode_mmap_flags, *ip);
1070 				ip++;
1071 				narg--;
1072 				break;
1073 #endif
1074 			case SYS_mmap:
1075 				print_number(ip, narg, c);
1076 				print_number(ip, narg, c);
1077 				putchar(',');
1078 				print_mask_arg(sysdecode_mmap_prot, *ip);
1079 				putchar(',');
1080 				ip++;
1081 				narg--;
1082 				print_mask_arg(sysdecode_mmap_flags, *ip);
1083 				ip++;
1084 				narg--;
1085 				break;
1086 			case SYS_mprotect:
1087 				print_number(ip, narg, c);
1088 				print_number(ip, narg, c);
1089 				putchar(',');
1090 				print_mask_arg(sysdecode_mmap_prot, *ip);
1091 				ip++;
1092 				narg--;
1093 				break;
1094 			case SYS_madvise:
1095 				print_number(ip, narg, c);
1096 				print_number(ip, narg, c);
1097 				putchar(',');
1098 				print_integer_arg(sysdecode_madvice, *ip);
1099 				ip++;
1100 				narg--;
1101 				break;
1102 			case SYS_pathconf:
1103 			case SYS_lpathconf:
1104 			case SYS_fpathconf:
1105 				print_number(ip, narg, c);
1106 				putchar(',');
1107 				print_integer_arg(sysdecode_pathconf_name, *ip);
1108 				ip++;
1109 				narg--;
1110 				break;
1111 			case SYS_getpriority:
1112 			case SYS_setpriority:
1113 				putchar('(');
1114 				print_integer_arg(sysdecode_prio_which, *ip);
1115 				c = ',';
1116 				ip++;
1117 				narg--;
1118 				break;
1119 			case SYS_fcntl:
1120 				print_number(ip, narg, c);
1121 				putchar(',');
1122 				print_integer_arg(sysdecode_fcntl_cmd, ip[0]);
1123 				if (sysdecode_fcntl_arg_p(ip[0])) {
1124 					putchar(',');
1125 					if (ip[0] == F_SETFL)
1126 						print_mask_arg(
1127 						    sysdecode_fcntl_fileflags,
1128 							ip[1]);
1129 					else
1130 						sysdecode_fcntl_arg(stdout,
1131 						    ip[0], ip[1],
1132 						    decimal ? 10 : 16);
1133 				}
1134 				ip += 2;
1135 				narg -= 2;
1136 				break;
1137 			case SYS_socket: {
1138 				int sockdomain;
1139 				putchar('(');
1140 				sockdomain = *ip;
1141 				print_integer_arg(sysdecode_socketdomain,
1142 				    sockdomain);
1143 				ip++;
1144 				narg--;
1145 				putchar(',');
1146 				print_mask_arg(sysdecode_socket_type, *ip);
1147 				ip++;
1148 				narg--;
1149 				if (sockdomain == PF_INET ||
1150 				    sockdomain == PF_INET6) {
1151 					putchar(',');
1152 					print_integer_arg(sysdecode_ipproto,
1153 					    *ip);
1154 					ip++;
1155 					narg--;
1156 				}
1157 				c = ',';
1158 				break;
1159 			}
1160 			case SYS_setsockopt:
1161 			case SYS_getsockopt: {
1162 				const char *str;
1163 
1164 				print_number(ip, narg, c);
1165 				putchar(',');
1166 				print_integer_arg_valid(sysdecode_sockopt_level,
1167 				    *ip);
1168 				str = sysdecode_sockopt_name(ip[0], ip[1]);
1169 				if (str != NULL) {
1170 					printf(",%s", str);
1171 					ip++;
1172 					narg--;
1173 				}
1174 				ip++;
1175 				narg--;
1176 				break;
1177 			}
1178 #ifdef SYS_freebsd6_lseek
1179 			case SYS_freebsd6_lseek:
1180 				print_number(ip, narg, c);
1181 				/* Hidden 'pad' argument, not in lseek(2) */
1182 				print_number(ip, narg, c);
1183 				print_number64(first, ip, narg, c);
1184 				putchar(',');
1185 				print_integer_arg(sysdecode_whence, *ip);
1186 				ip++;
1187 				narg--;
1188 				break;
1189 #endif
1190 			case SYS_lseek:
1191 				print_number(ip, narg, c);
1192 				print_number64(first, ip, narg, c);
1193 				putchar(',');
1194 				print_integer_arg(sysdecode_whence, *ip);
1195 				ip++;
1196 				narg--;
1197 				break;
1198 			case SYS_flock:
1199 				print_number(ip, narg, c);
1200 				putchar(',');
1201 				print_mask_arg(sysdecode_flock_operation, *ip);
1202 				ip++;
1203 				narg--;
1204 				break;
1205 			case SYS_mkfifo:
1206 			case SYS_mkfifoat:
1207 			case SYS_mkdir:
1208 			case SYS_mkdirat:
1209 				print_number(ip, narg, c);
1210 				putchar(',');
1211 				decode_filemode(*ip);
1212 				ip++;
1213 				narg--;
1214 				break;
1215 			case SYS_shutdown:
1216 				print_number(ip, narg, c);
1217 				putchar(',');
1218 				print_integer_arg(sysdecode_shutdown_how, *ip);
1219 				ip++;
1220 				narg--;
1221 				break;
1222 			case SYS_socketpair:
1223 				putchar('(');
1224 				print_integer_arg(sysdecode_socketdomain, *ip);
1225 				ip++;
1226 				narg--;
1227 				putchar(',');
1228 				print_mask_arg(sysdecode_socket_type, *ip);
1229 				ip++;
1230 				narg--;
1231 				c = ',';
1232 				break;
1233 			case SYS_getrlimit:
1234 			case SYS_setrlimit:
1235 				putchar('(');
1236 				print_integer_arg(sysdecode_rlimit, *ip);
1237 				ip++;
1238 				narg--;
1239 				c = ',';
1240 				break;
1241 			case SYS_getrusage:
1242 				putchar('(');
1243 				print_integer_arg(sysdecode_getrusage_who, *ip);
1244 				ip++;
1245 				narg--;
1246 				c = ',';
1247 				break;
1248 			case SYS_quotactl:
1249 				print_number(ip, narg, c);
1250 				putchar(',');
1251 				if (!sysdecode_quotactl_cmd(stdout, *ip)) {
1252 					if (decimal)
1253 						printf("<invalid=%d>", (int)*ip);
1254 					else
1255 						printf("<invalid=%#x>",
1256 						    (int)*ip);
1257 				}
1258 				ip++;
1259 				narg--;
1260 				c = ',';
1261 				break;
1262 			case SYS_nfssvc:
1263 				putchar('(');
1264 				print_integer_arg(sysdecode_nfssvc_flags, *ip);
1265 				ip++;
1266 				narg--;
1267 				c = ',';
1268 				break;
1269 			case SYS_rtprio:
1270 			case SYS_rtprio_thread:
1271 				putchar('(');
1272 				print_integer_arg(sysdecode_rtprio_function,
1273 				    *ip);
1274 				ip++;
1275 				narg--;
1276 				c = ',';
1277 				break;
1278 			case SYS___semctl:
1279 				print_number(ip, narg, c);
1280 				print_number(ip, narg, c);
1281 				putchar(',');
1282 				print_integer_arg(sysdecode_semctl_cmd, *ip);
1283 				ip++;
1284 				narg--;
1285 				break;
1286 			case SYS_semget:
1287 				print_number(ip, narg, c);
1288 				print_number(ip, narg, c);
1289 				putchar(',');
1290 				print_mask_arg(sysdecode_semget_flags, *ip);
1291 				ip++;
1292 				narg--;
1293 				break;
1294 			case SYS_msgctl:
1295 				print_number(ip, narg, c);
1296 				putchar(',');
1297 				print_integer_arg(sysdecode_msgctl_cmd, *ip);
1298 				ip++;
1299 				narg--;
1300 				break;
1301 			case SYS_shmat:
1302 				print_number(ip, narg, c);
1303 				print_number(ip, narg, c);
1304 				putchar(',');
1305 				print_mask_arg(sysdecode_shmat_flags, *ip);
1306 				ip++;
1307 				narg--;
1308 				break;
1309 			case SYS_shmctl:
1310 				print_number(ip, narg, c);
1311 				putchar(',');
1312 				print_integer_arg(sysdecode_shmctl_cmd, *ip);
1313 				ip++;
1314 				narg--;
1315 				break;
1316 #ifdef SYS_freebsd12_shm_open
1317 			case SYS_freebsd12_shm_open:
1318 				if (ip[0] == (uintptr_t)SHM_ANON) {
1319 					printf("(SHM_ANON");
1320 					ip++;
1321 				} else {
1322 					print_number(ip, narg, c);
1323 				}
1324 				putchar(',');
1325 				print_mask_arg(sysdecode_open_flags, ip[0]);
1326 				putchar(',');
1327 				decode_filemode(ip[1]);
1328 				ip += 2;
1329 				narg -= 2;
1330 				break;
1331 #endif
1332 			case SYS_shm_open2:
1333 				if (ip[0] == (uintptr_t)SHM_ANON) {
1334 					printf("(SHM_ANON");
1335 					ip++;
1336 				} else {
1337 					print_number(ip, narg, c);
1338 				}
1339 				putchar(',');
1340 				print_mask_arg(sysdecode_open_flags, ip[0]);
1341 				putchar(',');
1342 				decode_filemode(ip[1]);
1343 				putchar(',');
1344 				print_mask_arg(sysdecode_shmflags, ip[2]);
1345 				ip += 3;
1346 				narg -= 3;
1347 				break;
1348 			case SYS_minherit:
1349 				print_number(ip, narg, c);
1350 				print_number(ip, narg, c);
1351 				putchar(',');
1352 				print_integer_arg(sysdecode_minherit_inherit,
1353 				    *ip);
1354 				ip++;
1355 				narg--;
1356 				break;
1357 			case SYS_rfork:
1358 				putchar('(');
1359 				print_mask_arg(sysdecode_rfork_flags, *ip);
1360 				ip++;
1361 				narg--;
1362 				c = ',';
1363 				break;
1364 			case SYS_lio_listio:
1365 				putchar('(');
1366 				print_integer_arg(sysdecode_lio_listio_mode,
1367 				    *ip);
1368 				ip++;
1369 				narg--;
1370 				c = ',';
1371 				break;
1372 			case SYS_mlockall:
1373 				putchar('(');
1374 				print_mask_arg(sysdecode_mlockall_flags, *ip);
1375 				ip++;
1376 				narg--;
1377 				break;
1378 			case SYS_sched_setscheduler:
1379 				print_number(ip, narg, c);
1380 				putchar(',');
1381 				print_integer_arg(sysdecode_scheduler_policy,
1382 				    *ip);
1383 				ip++;
1384 				narg--;
1385 				break;
1386 			case SYS_sched_get_priority_max:
1387 			case SYS_sched_get_priority_min:
1388 				putchar('(');
1389 				print_integer_arg(sysdecode_scheduler_policy,
1390 				    *ip);
1391 				ip++;
1392 				narg--;
1393 				break;
1394 			case SYS_sendfile:
1395 				print_number(ip, narg, c);
1396 				print_number(ip, narg, c);
1397 				print_number(ip, narg, c);
1398 				print_number(ip, narg, c);
1399 				print_number(ip, narg, c);
1400 				print_number(ip, narg, c);
1401 				putchar(',');
1402 				print_mask_arg(sysdecode_sendfile_flags, *ip);
1403 				ip++;
1404 				narg--;
1405 				break;
1406 			case SYS_kldsym:
1407 				print_number(ip, narg, c);
1408 				putchar(',');
1409 				print_integer_arg(sysdecode_kldsym_cmd, *ip);
1410 				ip++;
1411 				narg--;
1412 				break;
1413 			case SYS_sigprocmask:
1414 				putchar('(');
1415 				print_integer_arg(sysdecode_sigprocmask_how,
1416 				    *ip);
1417 				ip++;
1418 				narg--;
1419 				c = ',';
1420 				break;
1421 			case SYS___acl_get_file:
1422 			case SYS___acl_set_file:
1423 			case SYS___acl_get_fd:
1424 			case SYS___acl_set_fd:
1425 			case SYS___acl_delete_file:
1426 			case SYS___acl_delete_fd:
1427 			case SYS___acl_aclcheck_file:
1428 			case SYS___acl_aclcheck_fd:
1429 			case SYS___acl_get_link:
1430 			case SYS___acl_set_link:
1431 			case SYS___acl_delete_link:
1432 			case SYS___acl_aclcheck_link:
1433 				print_number(ip, narg, c);
1434 				putchar(',');
1435 				print_integer_arg(sysdecode_acltype, *ip);
1436 				ip++;
1437 				narg--;
1438 				break;
1439 			case SYS_sigaction:
1440 				putchar('(');
1441 				print_signal(*ip);
1442 				ip++;
1443 				narg--;
1444 				c = ',';
1445 				break;
1446 			case SYS_extattrctl:
1447 				print_number(ip, narg, c);
1448 				putchar(',');
1449 				print_integer_arg(sysdecode_extattrnamespace,
1450 				    *ip);
1451 				ip++;
1452 				narg--;
1453 				break;
1454 			case SYS_nmount:
1455 				print_number(ip, narg, c);
1456 				print_number(ip, narg, c);
1457 				putchar(',');
1458 				print_mask_arg0(sysdecode_mount_flags, *ip);
1459 				ip++;
1460 				narg--;
1461 				break;
1462 			case SYS_thr_create:
1463 				print_number(ip, narg, c);
1464 				print_number(ip, narg, c);
1465 				putchar(',');
1466 				print_mask_arg(sysdecode_thr_create_flags, *ip);
1467 				ip++;
1468 				narg--;
1469 				break;
1470 			case SYS_thr_kill:
1471 				print_number(ip, narg, c);
1472 				putchar(',');
1473 				print_signal(*ip);
1474 				ip++;
1475 				narg--;
1476 				break;
1477 			case SYS_kldunloadf:
1478 				print_number(ip, narg, c);
1479 				putchar(',');
1480 				print_integer_arg(sysdecode_kldunload_flags,
1481 				    *ip);
1482 				ip++;
1483 				narg--;
1484 				break;
1485 			case SYS_linkat:
1486 			case SYS_renameat:
1487 			case SYS_symlinkat:
1488 				print_number(ip, narg, c);
1489 				putchar(',');
1490 				print_integer_arg_valid(sysdecode_atfd, *ip);
1491 				ip++;
1492 				narg--;
1493 				print_number(ip, narg, c);
1494 				break;
1495 			case SYS_cap_fcntls_limit:
1496 				print_number(ip, narg, c);
1497 				putchar(',');
1498 				arg = *ip;
1499 				ip++;
1500 				narg--;
1501 				print_mask_arg32(sysdecode_cap_fcntlrights, arg);
1502 				break;
1503 			case SYS_posix_fadvise:
1504 				print_number(ip, narg, c);
1505 				print_number(ip, narg, c);
1506 				print_number(ip, narg, c);
1507 				(void)putchar(',');
1508 				print_integer_arg(sysdecode_fadvice, *ip);
1509 				ip++;
1510 				narg--;
1511 				break;
1512 			case SYS_procctl:
1513 				putchar('(');
1514 				print_integer_arg(sysdecode_idtype, *ip);
1515 				c = ',';
1516 				ip++;
1517 				narg--;
1518 				print_number64(first, ip, narg, c);
1519 				putchar(',');
1520 				print_integer_arg(sysdecode_procctl_cmd, *ip);
1521 				ip++;
1522 				narg--;
1523 				break;
1524 			case SYS__umtx_op: {
1525 				int op;
1526 
1527 				print_number(ip, narg, c);
1528 				putchar(',');
1529 				if (print_mask_arg_part(sysdecode_umtx_op_flags,
1530 				    *ip, &op))
1531 					putchar('|');
1532 				print_integer_arg(sysdecode_umtx_op, op);
1533 				putchar('>');
1534 				switch (*ip) {
1535 				case UMTX_OP_CV_WAIT:
1536 					ip++;
1537 					narg--;
1538 					putchar(',');
1539 					print_mask_argul(
1540 					    sysdecode_umtx_cvwait_flags, *ip);
1541 					break;
1542 				case UMTX_OP_RW_RDLOCK:
1543 					ip++;
1544 					narg--;
1545 					putchar(',');
1546 					print_mask_argul(
1547 					    sysdecode_umtx_rwlock_flags, *ip);
1548 					break;
1549 				}
1550 				ip++;
1551 				narg--;
1552 				break;
1553 			}
1554 			case SYS_ftruncate:
1555 			case SYS_truncate:
1556 				print_number(ip, narg, c);
1557 				print_number64(first, ip, narg, c);
1558 				break;
1559 			case SYS_fchownat:
1560 				print_number(ip, narg, c);
1561 				print_number(ip, narg, c);
1562 				print_number(ip, narg, c);
1563 				break;
1564 			case SYS_fstatat:
1565 			case SYS_utimensat:
1566 				print_number(ip, narg, c);
1567 				print_number(ip, narg, c);
1568 				break;
1569 			case SYS_unlinkat:
1570 				print_number(ip, narg, c);
1571 				break;
1572 			case SYS_sysarch:
1573 				putchar('(');
1574 				print_integer_arg(sysdecode_sysarch_number, *ip);
1575 				ip++;
1576 				narg--;
1577 				c = ',';
1578 				break;
1579 			case SYS_getitimer:
1580 			case SYS_setitimer:
1581 				putchar('(');
1582 				print_integer_arg(sysdecode_itimer, *ip);
1583 				ip++;
1584 				narg--;
1585 				c = ',';
1586 				break;
1587 			}
1588 			switch (ktr->ktr_code) {
1589 			case SYS_chflagsat:
1590 			case SYS_fchownat:
1591 			case SYS_faccessat:
1592 			case SYS_fchmodat:
1593 			case SYS_fstatat:
1594 			case SYS_linkat:
1595 			case SYS_unlinkat:
1596 			case SYS_utimensat:
1597 				putchar(',');
1598 				print_mask_arg0(sysdecode_atflags, *ip);
1599 				ip++;
1600 				narg--;
1601 				break;
1602 			}
1603 	*resc = c;
1604 	*resip = ip;
1605 	*resnarg = narg;
1606 }
1607 
1608 static void
1609 ktrsysret(struct ktr_sysret *ktr, u_int sv_flags)
1610 {
1611 	register_t ret = ktr->ktr_retval;
1612 	int error = ktr->ktr_error;
1613 
1614 	syscallname(ktr->ktr_code, sv_flags);
1615 	printf(" ");
1616 
1617 	if (error == 0) {
1618 		if (fancy) {
1619 			printf("%ld", (long)ret);
1620 			if (ret < 0 || ret > 9)
1621 				printf("/%#lx", (unsigned long)ret);
1622 		} else {
1623 			if (decimal)
1624 				printf("%ld", (long)ret);
1625 			else
1626 				printf("%#lx", (unsigned long)ret);
1627 		}
1628 	} else if (error == ERESTART)
1629 		printf("RESTART");
1630 	else if (error == EJUSTRETURN)
1631 		printf("JUSTRETURN");
1632 	else {
1633 		printf("-1 errno %d", sysdecode_freebsd_to_abi_errno(
1634 		    syscallabi(sv_flags), error));
1635 		if (fancy)
1636 			printf(" %s", strerror(ktr->ktr_error));
1637 	}
1638 	putchar('\n');
1639 }
1640 
1641 static void
1642 ktrnamei(char *cp, int len)
1643 {
1644 	printf("\"%.*s\"\n", len, cp);
1645 }
1646 
1647 static void
1648 ktrexecve(char *m, int len)
1649 {
1650 	int i = 0;
1651 
1652 	while (i < len) {
1653 		printf("\"%s\"", m + i);
1654 		i += strlen(m + i) + 1;
1655 		if (i != len) {
1656 			printf(", ");
1657 		}
1658 	}
1659 	printf("\n");
1660 }
1661 
1662 static void
1663 hexdump(char *p, int len, int screenwidth)
1664 {
1665 	int n, i;
1666 	int width;
1667 
1668 	width = 0;
1669 	do {
1670 		width += 2;
1671 		i = 13;			/* base offset */
1672 		i += (width / 2) + 1;	/* spaces every second byte */
1673 		i += (width * 2);	/* width of bytes */
1674 		i += 3;			/* "  |" */
1675 		i += width;		/* each byte */
1676 		i += 1;			/* "|" */
1677 	} while (i < screenwidth);
1678 	width -= 2;
1679 
1680 	for (n = 0; n < len; n += width) {
1681 		for (i = n; i < n + width; i++) {
1682 			if ((i % width) == 0) {	/* beginning of line */
1683 				printf("       0x%04x", i);
1684 			}
1685 			if ((i % 2) == 0) {
1686 				printf(" ");
1687 			}
1688 			if (i < len)
1689 				printf("%02x", p[i] & 0xff);
1690 			else
1691 				printf("  ");
1692 		}
1693 		printf("  |");
1694 		for (i = n; i < n + width; i++) {
1695 			if (i >= len)
1696 				break;
1697 			if (p[i] >= ' ' && p[i] <= '~')
1698 				printf("%c", p[i]);
1699 			else
1700 				printf(".");
1701 		}
1702 		printf("|\n");
1703 	}
1704 	if ((i % width) != 0)
1705 		printf("\n");
1706 }
1707 
1708 static void
1709 visdump(char *dp, int datalen, int screenwidth)
1710 {
1711 	int col = 0;
1712 	char *cp;
1713 	int width;
1714 	char visbuf[5];
1715 
1716 	printf("       \"");
1717 	col = 8;
1718 	for (;datalen > 0; datalen--, dp++) {
1719 		vis(visbuf, *dp, VIS_CSTYLE | VIS_NOLOCALE, *(dp+1));
1720 		cp = visbuf;
1721 		/*
1722 		 * Keep track of printables and
1723 		 * space chars (like fold(1)).
1724 		 */
1725 		if (col == 0) {
1726 			putchar('\t');
1727 			col = 8;
1728 		}
1729 		switch(*cp) {
1730 		case '\n':
1731 			col = 0;
1732 			putchar('\n');
1733 			continue;
1734 		case '\t':
1735 			width = 8 - (col&07);
1736 			break;
1737 		default:
1738 			width = strlen(cp);
1739 		}
1740 		if (col + width > (screenwidth-2)) {
1741 			printf("\\\n\t");
1742 			col = 8;
1743 		}
1744 		col += width;
1745 		do {
1746 			putchar(*cp++);
1747 		} while (*cp);
1748 	}
1749 	if (col == 0)
1750 		printf("       ");
1751 	printf("\"\n");
1752 }
1753 
1754 static void
1755 ktrgenio(struct ktr_genio *ktr, int len)
1756 {
1757 	int datalen = len - sizeof (struct ktr_genio);
1758 	char *dp = (char *)ktr + sizeof (struct ktr_genio);
1759 	static int screenwidth = 0;
1760 	int i, binary;
1761 
1762 	printf("fd %d %s %d byte%s\n", ktr->ktr_fd,
1763 		ktr->ktr_rw == UIO_READ ? "read" : "wrote", datalen,
1764 		datalen == 1 ? "" : "s");
1765 	if (suppressdata)
1766 		return;
1767 	if (screenwidth == 0) {
1768 		struct winsize ws;
1769 
1770 		if (fancy && ioctl(fileno(stderr), TIOCGWINSZ, &ws) != -1 &&
1771 		    ws.ws_col > 8)
1772 			screenwidth = ws.ws_col;
1773 		else
1774 			screenwidth = 80;
1775 	}
1776 	if (maxdata && datalen > maxdata)
1777 		datalen = maxdata;
1778 
1779 	for (i = 0, binary = 0; i < datalen && binary == 0; i++)  {
1780 		if (dp[i] >= 32 && dp[i] < 127)
1781 			continue;
1782 		if (dp[i] == 10 || dp[i] == 13 || dp[i] == 0 || dp[i] == 9)
1783 			continue;
1784 		binary = 1;
1785 	}
1786 	if (binary)
1787 		hexdump(dp, datalen, screenwidth);
1788 	else
1789 		visdump(dp, datalen, screenwidth);
1790 }
1791 
1792 static void
1793 ktrpsig(struct ktr_psig *psig)
1794 {
1795 	const char *str;
1796 
1797 	print_signal(psig->signo);
1798 	if (psig->action == SIG_DFL) {
1799 		printf(" SIG_DFL");
1800 	} else {
1801 		printf(" caught handler=0x%lx mask=0x%x",
1802 		    (u_long)psig->action, psig->mask.__bits[0]);
1803 	}
1804 	printf(" code=");
1805 	str = sysdecode_sigcode(psig->signo, psig->code);
1806 	if (str != NULL)
1807 		printf("%s", str);
1808 	else
1809 		printf("<invalid=%#x>", psig->code);
1810 	putchar('\n');
1811 }
1812 
1813 static void
1814 ktrcsw_old(struct ktr_csw_old *cs)
1815 {
1816 	printf("%s %s\n", cs->out ? "stop" : "resume",
1817 		cs->user ? "user" : "kernel");
1818 }
1819 
1820 static void
1821 ktrcsw(struct ktr_csw *cs)
1822 {
1823 	printf("%s %s \"%s\"\n", cs->out ? "stop" : "resume",
1824 	    cs->user ? "user" : "kernel", cs->wmesg);
1825 }
1826 
1827 static void
1828 ktruser(int len, void *p)
1829 {
1830 	unsigned char *cp;
1831 
1832 	if (sysdecode_utrace(stdout, p, len)) {
1833 		printf("\n");
1834 		return;
1835 	}
1836 
1837 	printf("%d ", len);
1838 	cp = p;
1839 	while (len--)
1840 		if (decimal)
1841 			printf(" %d", *cp++);
1842 		else
1843 			printf(" %02x", *cp++);
1844 	printf("\n");
1845 }
1846 
1847 static void
1848 ktrcaprights(cap_rights_t *rightsp)
1849 {
1850 
1851 	printf("cap_rights_t ");
1852 	sysdecode_cap_rights(stdout, rightsp);
1853 	printf("\n");
1854 }
1855 
1856 static void
1857 ktrtimeval(struct timeval *tv)
1858 {
1859 
1860 	printf("{%ld, %ld}", (long)tv->tv_sec, tv->tv_usec);
1861 }
1862 
1863 static void
1864 ktritimerval(struct itimerval *it)
1865 {
1866 
1867 	printf("itimerval { .interval = ");
1868 	ktrtimeval(&it->it_interval);
1869 	printf(", .value = ");
1870 	ktrtimeval(&it->it_value);
1871 	printf(" }\n");
1872 }
1873 
1874 static void
1875 ktrsockaddr(struct sockaddr *sa)
1876 {
1877 /*
1878  TODO: Support additional address families
1879 	#include <netsmb/netbios.h>
1880 	struct sockaddr_nb	*nb;
1881 */
1882 	const char *str;
1883 	char addr[64];
1884 
1885 	/*
1886 	 * note: ktrstruct() has already verified that sa points to a
1887 	 * buffer at least sizeof(struct sockaddr) bytes long and exactly
1888 	 * sa->sa_len bytes long.
1889 	 */
1890 	printf("struct sockaddr { ");
1891 	str = sysdecode_sockaddr_family(sa->sa_family);
1892 	if (str != NULL)
1893 		printf("%s", str);
1894 	else
1895 		printf("<invalid=%d>", sa->sa_family);
1896 	printf(", ");
1897 
1898 #define check_sockaddr_len(n)					\
1899 	if (sa_##n.s##n##_len < sizeof(struct sockaddr_##n)) {	\
1900 		printf("invalid");				\
1901 		break;						\
1902 	}
1903 
1904 	switch(sa->sa_family) {
1905 	case AF_INET: {
1906 		struct sockaddr_in sa_in;
1907 
1908 		memset(&sa_in, 0, sizeof(sa_in));
1909 		memcpy(&sa_in, sa, sa->sa_len);
1910 		check_sockaddr_len(in);
1911 		inet_ntop(AF_INET, &sa_in.sin_addr, addr, sizeof addr);
1912 		printf("%s:%u", addr, ntohs(sa_in.sin_port));
1913 		break;
1914 	}
1915 	case AF_INET6: {
1916 		struct sockaddr_in6 sa_in6;
1917 
1918 		memset(&sa_in6, 0, sizeof(sa_in6));
1919 		memcpy(&sa_in6, sa, sa->sa_len);
1920 		check_sockaddr_len(in6);
1921 		getnameinfo((struct sockaddr *)&sa_in6, sizeof(sa_in6),
1922 		    addr, sizeof(addr), NULL, 0, NI_NUMERICHOST);
1923 		printf("[%s]:%u", addr, htons(sa_in6.sin6_port));
1924 		break;
1925 	}
1926 	case AF_UNIX: {
1927 		struct sockaddr_un sa_un;
1928 
1929 		memset(&sa_un, 0, sizeof(sa_un));
1930 		memcpy(&sa_un, sa, sa->sa_len);
1931 		printf("%.*s", (int)sizeof(sa_un.sun_path), sa_un.sun_path);
1932 		break;
1933 	}
1934 	case AF_NETLINK: {
1935 		struct sockaddr_nl sa_nl;
1936 
1937 		memset(&sa_nl, 0, sizeof(sa_nl));
1938 		memcpy(&sa_nl, sa, sa->sa_len);
1939 		printf("netlink[pid=%u, groups=0x%x]",
1940 		    sa_nl.nl_pid, sa_nl.nl_groups);
1941 		break;
1942 	}
1943 	default:
1944 		printf("unknown address family");
1945 	}
1946 	printf(" }\n");
1947 }
1948 
1949 static void
1950 ktrsplice(struct splice *sp)
1951 {
1952 	printf("struct splice { fd=%d, max=%#jx, idle=%jd.%06jd }\n",
1953 	    sp->sp_fd, (uintmax_t)sp->sp_max, (intmax_t)sp->sp_idle.tv_sec,
1954 	    (intmax_t)sp->sp_idle.tv_usec);
1955 }
1956 
1957 static void
1958 ktrthrparam(struct thr_param *tp)
1959 {
1960 	printf("thr param { start=%p arg=%p stack_base=%p "
1961 	    "stack_size=%#zx tls_base=%p tls_size=%#zx child_tidp=%p "
1962 	    "parent_tidp=%p flags=",
1963 	    tp->start_func, tp->arg, tp->stack_base, tp->stack_size,
1964 	    tp->tls_base, tp->tls_size, tp->child_tid, tp->parent_tid);
1965 	print_mask_arg(sysdecode_thr_create_flags, tp->flags);
1966 	printf(" rtp=%p }\n", tp->rtp);
1967 }
1968 
1969 static void
1970 ktrstat(struct stat *statp)
1971 {
1972 	char mode[12], timestr[PATH_MAX + 4];
1973 	struct passwd *pwd;
1974 	struct group  *grp;
1975 	struct tm *tm;
1976 
1977 	/*
1978 	 * note: ktrstruct() has already verified that statp points to a
1979 	 * buffer exactly sizeof(struct stat) bytes long.
1980 	 */
1981 	printf("struct stat {");
1982 	printf("dev=%ju, ino=%ju, ",
1983 		(uintmax_t)statp->st_dev, (uintmax_t)statp->st_ino);
1984 	if (!resolv)
1985 		printf("mode=0%jo, ", (uintmax_t)statp->st_mode);
1986 	else {
1987 		strmode(statp->st_mode, mode);
1988 		printf("mode=%s, ", mode);
1989 	}
1990 	printf("nlink=%ju, ", (uintmax_t)statp->st_nlink);
1991 	if (!resolv) {
1992 		pwd = NULL;
1993 	} else {
1994 #ifdef WITH_CASPER
1995 		if (cappwd != NULL)
1996 			pwd = cap_getpwuid(cappwd, statp->st_uid);
1997 		else
1998 #endif
1999 			pwd = getpwuid(statp->st_uid);
2000 	}
2001 	if (pwd == NULL)
2002 		printf("uid=%ju, ", (uintmax_t)statp->st_uid);
2003 	else
2004 		printf("uid=\"%s\", ", pwd->pw_name);
2005 	if (!resolv) {
2006 		grp = NULL;
2007 	} else {
2008 #ifdef WITH_CASPER
2009 		if (capgrp != NULL)
2010 			grp = cap_getgrgid(capgrp, statp->st_gid);
2011 		else
2012 #endif
2013 			grp = getgrgid(statp->st_gid);
2014 	}
2015 	if (grp == NULL)
2016 		printf("gid=%ju, ", (uintmax_t)statp->st_gid);
2017 	else
2018 		printf("gid=\"%s\", ", grp->gr_name);
2019 	printf("rdev=%ju, ", (uintmax_t)statp->st_rdev);
2020 	printf("atime=");
2021 	if (!resolv)
2022 		printf("%jd", (intmax_t)statp->st_atim.tv_sec);
2023 	else {
2024 		tm = localtime(&statp->st_atim.tv_sec);
2025 		strftime(timestr, sizeof(timestr), TIME_FORMAT, tm);
2026 		printf("\"%s\"", timestr);
2027 	}
2028 	if (statp->st_atim.tv_nsec != 0)
2029 		printf(".%09ld, ", statp->st_atim.tv_nsec);
2030 	else
2031 		printf(", ");
2032 	printf("mtime=");
2033 	if (!resolv)
2034 		printf("%jd", (intmax_t)statp->st_mtim.tv_sec);
2035 	else {
2036 		tm = localtime(&statp->st_mtim.tv_sec);
2037 		strftime(timestr, sizeof(timestr), TIME_FORMAT, tm);
2038 		printf("\"%s\"", timestr);
2039 	}
2040 	if (statp->st_mtim.tv_nsec != 0)
2041 		printf(".%09ld, ", statp->st_mtim.tv_nsec);
2042 	else
2043 		printf(", ");
2044 	printf("ctime=");
2045 	if (!resolv)
2046 		printf("%jd", (intmax_t)statp->st_ctim.tv_sec);
2047 	else {
2048 		tm = localtime(&statp->st_ctim.tv_sec);
2049 		strftime(timestr, sizeof(timestr), TIME_FORMAT, tm);
2050 		printf("\"%s\"", timestr);
2051 	}
2052 	if (statp->st_ctim.tv_nsec != 0)
2053 		printf(".%09ld, ", statp->st_ctim.tv_nsec);
2054 	else
2055 		printf(", ");
2056 	printf("birthtime=");
2057 	if (!resolv)
2058 		printf("%jd", (intmax_t)statp->st_birthtim.tv_sec);
2059 	else {
2060 		tm = localtime(&statp->st_birthtim.tv_sec);
2061 		strftime(timestr, sizeof(timestr), TIME_FORMAT, tm);
2062 		printf("\"%s\"", timestr);
2063 	}
2064 	if (statp->st_birthtim.tv_nsec != 0)
2065 		printf(".%09ld, ", statp->st_birthtim.tv_nsec);
2066 	else
2067 		printf(", ");
2068 	printf("size=%jd, blksize=%ju, blocks=%jd, flags=0x%x",
2069 		(uintmax_t)statp->st_size, (uintmax_t)statp->st_blksize,
2070 		(intmax_t)statp->st_blocks, statp->st_flags);
2071 	printf(" }\n");
2072 }
2073 
2074 static void
2075 ktrbitset(char *name, struct bitset *set, size_t setlen)
2076 {
2077 	int i, maxi, c = 0;
2078 
2079 	if (setlen > INT32_MAX)
2080 		setlen = INT32_MAX;
2081 	maxi = setlen * CHAR_BIT;
2082 	printf("%s [ ", name);
2083 	for (i = 0; i < maxi; i++) {
2084 		if (!BIT_ISSET(setlen, i, set))
2085 			continue;
2086 		if (c == 0)
2087 			printf("%d", i);
2088 		else
2089 			printf(", %d", i);
2090 		c++;
2091 	}
2092 	if (c == 0)
2093 		printf(" empty ]\n");
2094 	else
2095 		printf(" ]\n");
2096 }
2097 
2098 static void
2099 ktrstruct(char *buf, size_t buflen)
2100 {
2101 	char *name, *data;
2102 	size_t namelen, datalen;
2103 	int i;
2104 	cap_rights_t rights;
2105 	struct itimerval it;
2106 	struct stat sb;
2107 	struct sockaddr_storage ss;
2108 	struct bitset *set;
2109 
2110 	for (name = buf, namelen = 0;
2111 	     namelen < buflen && name[namelen] != '\0';
2112 	     ++namelen)
2113 		/* nothing */;
2114 	if (namelen == buflen)
2115 		goto invalid;
2116 	if (name[namelen] != '\0')
2117 		goto invalid;
2118 	data = buf + namelen + 1;
2119 	datalen = buflen - namelen - 1;
2120 	if (datalen == 0)
2121 		goto invalid;
2122 	/* sanity check */
2123 	for (i = 0; i < (int)namelen; ++i)
2124 		if (!isalpha(name[i]) && name[i] != '_')
2125 			goto invalid;
2126 	if (strcmp(name, "caprights") == 0) {
2127 		if (datalen != sizeof(cap_rights_t))
2128 			goto invalid;
2129 		memcpy(&rights, data, datalen);
2130 		ktrcaprights(&rights);
2131 	} else if (strcmp(name, "itimerval") == 0) {
2132 		if (datalen != sizeof(struct itimerval))
2133 			goto invalid;
2134 		memcpy(&it, data, datalen);
2135 		ktritimerval(&it);
2136 	} else if (strcmp(name, "stat") == 0) {
2137 		if (datalen != sizeof(struct stat))
2138 			goto invalid;
2139 		memcpy(&sb, data, datalen);
2140 		ktrstat(&sb);
2141 	} else if (strcmp(name, "sockaddr") == 0) {
2142 		if (datalen > sizeof(ss))
2143 			goto invalid;
2144 		memcpy(&ss, data, datalen);
2145 		if (datalen != ss.ss_len)
2146 			goto invalid;
2147 		ktrsockaddr((struct sockaddr *)&ss);
2148 	} else if (strcmp(name, "cpuset_t") == 0) {
2149 		if (datalen < 1)
2150 			goto invalid;
2151 		set = malloc(datalen);
2152 		if (set == NULL)
2153 			errx(1, "%s", strerror(ENOMEM));
2154 		memcpy(set, data, datalen);
2155 		ktrbitset(name, set, datalen);
2156 		free(set);
2157 	} else if (strcmp(name, "splice") == 0) {
2158 		struct splice sp;
2159 
2160 		if (datalen != sizeof(sp))
2161 			goto invalid;
2162 		memcpy(&sp, data, datalen);
2163 		ktrsplice(&sp);
2164 	} else if (strcmp(name, "thrparam") == 0) {
2165 		struct thr_param tp;
2166 
2167 		if (datalen != sizeof(tp))
2168 			goto invalid;
2169 		memcpy(&tp, data, datalen);
2170 		ktrthrparam(&tp);
2171 	} else {
2172 #ifdef SYSDECODE_HAVE_LINUX
2173 		if (ktrstruct_linux(name, data, datalen) == false)
2174 #endif
2175 			printf("unknown structure\n");
2176 	}
2177 	return;
2178 invalid:
2179 	printf("invalid record\n");
2180 }
2181 
2182 static void
2183 ktrcapfail(struct ktr_cap_fail *ktr)
2184 {
2185 	union ktr_cap_data *kcd = &ktr->cap_data;
2186 
2187 	switch (ktr->cap_type) {
2188 	case CAPFAIL_NOTCAPABLE:
2189 		/* operation on fd with insufficient capabilities */
2190 		printf("operation requires ");
2191 		sysdecode_cap_rights(stdout, &kcd->cap_needed);
2192 		printf(", descriptor holds ");
2193 		sysdecode_cap_rights(stdout, &kcd->cap_held);
2194 		break;
2195 	case CAPFAIL_INCREASE:
2196 		/* requested more capabilities than fd already has */
2197 		printf("attempt to increase capabilities from ");
2198 		sysdecode_cap_rights(stdout, &kcd->cap_held);
2199 		printf(" to ");
2200 		sysdecode_cap_rights(stdout, &kcd->cap_needed);
2201 		break;
2202 	case CAPFAIL_SYSCALL:
2203 		/* called restricted syscall */
2204 		printf("system call not allowed: ");
2205 		syscallname(ktr->cap_code, ktr->cap_svflags);
2206 		if (syscallabi(ktr->cap_svflags) == SYSDECODE_ABI_FREEBSD) {
2207 			switch (ktr->cap_code) {
2208 			case SYS_sysarch:
2209 				printf(", op: ");
2210 				print_integer_arg(sysdecode_sysarch_number,
2211 				    kcd->cap_int);
2212 				break;
2213 			case SYS_fcntl:
2214 				printf(", cmd: ");
2215 				print_integer_arg(sysdecode_fcntl_cmd,
2216 				    kcd->cap_int);
2217 				break;
2218 			}
2219 		}
2220 		break;
2221 	case CAPFAIL_SIGNAL:
2222 		/* sent signal to proc other than self */
2223 		syscallname(ktr->cap_code, ktr->cap_svflags);
2224 		printf(": signal delivery not allowed: ");
2225 		print_integer_arg(sysdecode_signal, kcd->cap_int);
2226 		break;
2227 	case CAPFAIL_PROTO:
2228 		/* created socket with restricted protocol */
2229 		syscallname(ktr->cap_code, ktr->cap_svflags);
2230 		printf(": protocol not allowed: ");
2231 		print_integer_arg(sysdecode_ipproto, kcd->cap_int);
2232 		break;
2233 	case CAPFAIL_SOCKADDR:
2234 		/* unable to look up address */
2235 		syscallname(ktr->cap_code, ktr->cap_svflags);
2236 		printf(": restricted address lookup: ");
2237 		ktrsockaddr(&kcd->cap_sockaddr);
2238 		return;
2239 	case CAPFAIL_NAMEI:
2240 		/* absolute or AT_FDCWD path, ".." path, etc. */
2241 		syscallname(ktr->cap_code, ktr->cap_svflags);
2242 		printf(": restricted VFS lookup: %s\n", kcd->cap_path);
2243 		return;
2244 	case CAPFAIL_CPUSET:
2245 		/* modification of an external cpuset */
2246 		syscallname(ktr->cap_code, ktr->cap_svflags);
2247 		printf(": restricted cpuset operation\n");
2248 		return;
2249 	default:
2250 		syscallname(ktr->cap_code, ktr->cap_svflags);
2251 		printf(": unknown capability failure\n");
2252 		return;
2253 	}
2254 	printf("\n");
2255 }
2256 
2257 static void
2258 ktrfault(struct ktr_fault *ktr)
2259 {
2260 
2261 	printf("0x%jx ", (uintmax_t)ktr->vaddr);
2262 	print_mask_arg(sysdecode_vmprot, ktr->type);
2263 	printf("\n");
2264 }
2265 
2266 static void
2267 ktrfaultend(struct ktr_faultend *ktr)
2268 {
2269 	const char *str;
2270 
2271 	str = sysdecode_vmresult(ktr->result);
2272 	if (str != NULL)
2273 		printf("%s", str);
2274 	else
2275 		printf("<invalid=%d>", ktr->result);
2276 	printf("\n");
2277 }
2278 
2279 static void
2280 ktrkevent(struct kevent *kev)
2281 {
2282 
2283 	printf("{ ident=");
2284 	switch (kev->filter) {
2285 	case EVFILT_READ:
2286 	case EVFILT_WRITE:
2287 	case EVFILT_VNODE:
2288 	case EVFILT_PROC:
2289 	case EVFILT_TIMER:
2290 	case EVFILT_PROCDESC:
2291 	case EVFILT_EMPTY:
2292 		printf("%ju", (uintmax_t)kev->ident);
2293 		break;
2294 	case EVFILT_SIGNAL:
2295 		print_signal(kev->ident);
2296 		break;
2297 	default:
2298 		printf("%p", (void *)kev->ident);
2299 	}
2300 	printf(", filter=");
2301 	print_integer_arg(sysdecode_kevent_filter, kev->filter);
2302 	printf(", flags=");
2303 	print_mask_arg0(sysdecode_kevent_flags, kev->flags);
2304 	printf(", fflags=");
2305 	sysdecode_kevent_fflags(stdout, kev->filter, kev->fflags,
2306 	    decimal ? 10 : 16);
2307 	printf(", data=%#jx, udata=%p }", (uintmax_t)kev->data, kev->udata);
2308 }
2309 
2310 static void
2311 ktrpollfd(struct pollfd *pfd)
2312 {
2313 
2314 	printf("{ fd=%d", pfd->fd);
2315 	printf(", events=");
2316 	print_mask_arg0(sysdecode_pollfd_events, pfd->events);
2317 	printf(", revents=");
2318 	print_mask_arg0(sysdecode_pollfd_events, pfd->revents);
2319 	printf("}");
2320 }
2321 
2322 static void
2323 ktrstructarray(struct ktr_struct_array *ksa, size_t buflen)
2324 {
2325 	struct kevent kev;
2326 	struct pollfd pfd;
2327 	char *name, *data;
2328 	size_t namelen, datalen;
2329 	int i;
2330 	bool first;
2331 
2332 	buflen -= sizeof(*ksa);
2333 	for (name = (char *)(ksa + 1), namelen = 0;
2334 	     namelen < buflen && name[namelen] != '\0';
2335 	     ++namelen)
2336 		/* nothing */;
2337 	if (namelen == buflen)
2338 		goto invalid;
2339 	if (name[namelen] != '\0')
2340 		goto invalid;
2341 	/* sanity check */
2342 	for (i = 0; i < (int)namelen; ++i)
2343 		if (!isalnum(name[i]) && name[i] != '_')
2344 			goto invalid;
2345 	data = name + namelen + 1;
2346 	datalen = buflen - namelen - 1;
2347 	printf("struct %s[] = { ", name);
2348 	first = true;
2349 	for (; datalen >= ksa->struct_size;
2350 	    data += ksa->struct_size, datalen -= ksa->struct_size) {
2351 		if (!first)
2352 			printf("\n             ");
2353 		else
2354 			first = false;
2355 		if (strcmp(name, "kevent") == 0) {
2356 			if (ksa->struct_size != sizeof(kev))
2357 				goto bad_size;
2358 			memcpy(&kev, data, sizeof(kev));
2359 			ktrkevent(&kev);
2360 		} else if (strcmp(name, "freebsd11_kevent") == 0) {
2361 			struct freebsd11_kevent kev11;
2362 
2363 			if (ksa->struct_size != sizeof(kev11))
2364 				goto bad_size;
2365 			memcpy(&kev11, data, sizeof(kev11));
2366 			memset(&kev, 0, sizeof(kev));
2367 			kev.ident = kev11.ident;
2368 			kev.filter = kev11.filter;
2369 			kev.flags = kev11.flags;
2370 			kev.fflags = kev11.fflags;
2371 			kev.data = kev11.data;
2372 			kev.udata = kev11.udata;
2373 			ktrkevent(&kev);
2374 #ifdef _WANT_KEVENT32
2375 		} else if (strcmp(name, "kevent32") == 0) {
2376 			struct kevent32 kev32;
2377 
2378 			if (ksa->struct_size != sizeof(kev32))
2379 				goto bad_size;
2380 			memcpy(&kev32, data, sizeof(kev32));
2381 			memset(&kev, 0, sizeof(kev));
2382 			kev.ident = kev32.ident;
2383 			kev.filter = kev32.filter;
2384 			kev.flags = kev32.flags;
2385 			kev.fflags = kev32.fflags;
2386 #if BYTE_ORDER == BIG_ENDIAN
2387 			kev.data = kev32.data2 | ((int64_t)kev32.data1 << 32);
2388 #else
2389 			kev.data = kev32.data1 | ((int64_t)kev32.data2 << 32);
2390 #endif
2391 			kev.udata = (void *)(uintptr_t)kev32.udata;
2392 			ktrkevent(&kev);
2393 		} else if (strcmp(name, "freebsd11_kevent32") == 0) {
2394 			struct freebsd11_kevent32 kev32;
2395 
2396 			if (ksa->struct_size != sizeof(kev32))
2397 				goto bad_size;
2398 			memcpy(&kev32, data, sizeof(kev32));
2399 			memset(&kev, 0, sizeof(kev));
2400 			kev.ident = kev32.ident;
2401 			kev.filter = kev32.filter;
2402 			kev.flags = kev32.flags;
2403 			kev.fflags = kev32.fflags;
2404 			kev.data = kev32.data;
2405 			kev.udata = (void *)(uintptr_t)kev32.udata;
2406 			ktrkevent(&kev);
2407 #endif
2408 		} else if (strcmp(name, "pollfd") == 0) {
2409 			if (ksa->struct_size != sizeof(pfd))
2410 				goto bad_size;
2411 			memcpy(&pfd, data, sizeof(pfd));
2412 			ktrpollfd(&pfd);
2413 		} else {
2414 			printf("<unknown structure> }\n");
2415 			return;
2416 		}
2417 	}
2418 	printf(" }\n");
2419 	return;
2420 invalid:
2421 	printf("invalid record\n");
2422 	return;
2423 bad_size:
2424 	printf("<bad size> }\n");
2425 	return;
2426 }
2427 
2428 static void
2429 ktrexterr(struct ktr_exterr *ke)
2430 {
2431 	struct uexterror *ue;
2432 
2433 	ue = &ke->ue;
2434 	printf("{ errno %d category %u (src line %u) p1 %#jx p2 %#jx %s }\n",
2435 	    ue->error, ue->cat, ue->src_line,
2436 	    (uintmax_t)ue->p1, (uintmax_t)ue->p2, ue->msg);
2437 }
2438 
2439 static void
2440 usage(void)
2441 {
2442 	fprintf(stderr, "usage: kdump [-dEnlHRrSsTA] [-f trfile] "
2443 	    "[-m maxdata] [-p pid] [-t trstr]\n");
2444 	exit(1);
2445 }
2446