1 /*- 2 * Copyright (c) 1988, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 4. Neither the name of the University nor the names of its contributors 14 * may be used to endorse or promote products derived from this software 15 * without specific prior written permission. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #ifndef lint 31 static const char copyright[] = 32 "@(#) Copyright (c) 1988, 1993\n\ 33 The Regents of the University of California. All rights reserved.\n"; 34 #endif /* not lint */ 35 36 #ifndef lint 37 #if 0 38 static char sccsid[] = "@(#)kdump.c 8.1 (Berkeley) 6/6/93"; 39 #endif 40 #endif /* not lint */ 41 #include <sys/cdefs.h> 42 __FBSDID("$FreeBSD$"); 43 44 #define _KERNEL 45 extern int errno; 46 #include <sys/errno.h> 47 #undef _KERNEL 48 #include <sys/param.h> 49 #include <sys/capability.h> 50 #include <sys/errno.h> 51 #define _KERNEL 52 #include <sys/time.h> 53 #undef _KERNEL 54 #include <sys/uio.h> 55 #include <sys/ktrace.h> 56 #include <sys/ioctl.h> 57 #include <sys/socket.h> 58 #include <sys/stat.h> 59 #include <sys/sysent.h> 60 #include <sys/un.h> 61 #include <sys/queue.h> 62 #include <sys/wait.h> 63 #ifdef NETATALK 64 #include <netatalk/at.h> 65 #endif 66 #include <arpa/inet.h> 67 #include <netinet/in.h> 68 #include <ctype.h> 69 #include <dlfcn.h> 70 #include <err.h> 71 #include <grp.h> 72 #include <inttypes.h> 73 #ifdef HAVE_LIBCAPSICUM 74 #include <libcapsicum.h> 75 #include <libcapsicum_grp.h> 76 #include <libcapsicum_pwd.h> 77 #include <libcapsicum_service.h> 78 #endif 79 #include <locale.h> 80 #include <netdb.h> 81 #include <nl_types.h> 82 #ifdef HAVE_LIBCAPSICUM 83 #include <nv.h> 84 #endif 85 #include <pwd.h> 86 #include <stdio.h> 87 #include <stdlib.h> 88 #include <string.h> 89 #include <termios.h> 90 #include <time.h> 91 #include <unistd.h> 92 #include <vis.h> 93 #include "ktrace.h" 94 #include "kdump_subr.h" 95 96 u_int abidump(struct ktr_header *); 97 int fetchprocinfo(struct ktr_header *, u_int *); 98 int fread_tail(void *, int, int); 99 void dumpheader(struct ktr_header *); 100 void ktrsyscall(struct ktr_syscall *, u_int); 101 void ktrsysret(struct ktr_sysret *, u_int); 102 void ktrnamei(char *, int); 103 void hexdump(char *, int, int); 104 void visdump(char *, int, int); 105 void ktrgenio(struct ktr_genio *, int); 106 void ktrpsig(struct ktr_psig *); 107 void ktrcsw(struct ktr_csw *); 108 void ktrcsw_old(struct ktr_csw_old *); 109 void ktruser_malloc(unsigned char *); 110 void ktruser_rtld(int, unsigned char *); 111 void ktruser(int, unsigned char *); 112 void ktrcaprights(cap_rights_t *); 113 void ktrsockaddr(struct sockaddr *); 114 void ktrstat(struct stat *); 115 void ktrstruct(char *, size_t); 116 void ktrcapfail(struct ktr_cap_fail *); 117 void ktrfault(struct ktr_fault *); 118 void ktrfaultend(struct ktr_faultend *); 119 void limitfd(int fd); 120 void usage(void); 121 void ioctlname(unsigned long, int); 122 123 int timestamp, decimal, fancy = 1, suppressdata, tail, threads, maxdata, 124 resolv = 0, abiflag = 0; 125 const char *tracefile = DEF_TRACEFILE; 126 struct ktr_header ktr_header; 127 128 #define TIME_FORMAT "%b %e %T %Y" 129 #define eqs(s1, s2) (strcmp((s1), (s2)) == 0) 130 131 #define print_number(i,n,c) do { \ 132 if (decimal) \ 133 printf("%c%jd", c, (intmax_t)*i); \ 134 else \ 135 printf("%c%#jx", c, (uintmax_t)(u_register_t)*i); \ 136 i++; \ 137 n--; \ 138 c = ','; \ 139 } while (0) 140 141 #if defined(__amd64__) || defined(__i386__) 142 143 void linux_ktrsyscall(struct ktr_syscall *); 144 void linux_ktrsysret(struct ktr_sysret *); 145 extern char *linux_syscallnames[]; 146 extern int nlinux_syscalls; 147 148 /* 149 * from linux.h 150 * Linux syscalls return negative errno's, we do positive and map them 151 */ 152 static int bsd_to_linux_errno[ELAST + 1] = { 153 -0, -1, -2, -3, -4, -5, -6, -7, -8, -9, 154 -10, -35, -12, -13, -14, -15, -16, -17, -18, -19, 155 -20, -21, -22, -23, -24, -25, -26, -27, -28, -29, 156 -30, -31, -32, -33, -34, -11,-115,-114, -88, -89, 157 -90, -91, -92, -93, -94, -95, -96, -97, -98, -99, 158 -100,-101,-102,-103,-104,-105,-106,-107,-108,-109, 159 -110,-111, -40, -36,-112,-113, -39, -11, -87,-122, 160 -116, -66, -6, -6, -6, -6, -6, -37, -38, -9, 161 -6, -6, -43, -42, -75,-125, -84, -95, -16, -74, 162 -72, -67, -71 163 }; 164 #endif 165 166 struct proc_info 167 { 168 TAILQ_ENTRY(proc_info) info; 169 u_int sv_flags; 170 pid_t pid; 171 }; 172 173 TAILQ_HEAD(trace_procs, proc_info) trace_procs; 174 175 #ifdef HAVE_LIBCAPSICUM 176 static cap_channel_t *cappwd, *capgrp; 177 #endif 178 179 static void 180 strerror_init(void) 181 { 182 183 /* 184 * Cache NLS data before entering capability mode. 185 * XXXPJD: There should be strerror_init() and strsignal_init() in libc. 186 */ 187 (void)catopen("libc", NL_CAT_LOCALE); 188 } 189 190 static void 191 localtime_init(void) 192 { 193 time_t ltime; 194 195 /* 196 * Allow localtime(3) to cache /etc/localtime content before entering 197 * capability mode. 198 * XXXPJD: There should be localtime_init() in libc. 199 */ 200 (void)time(<ime); 201 (void)localtime(<ime); 202 } 203 204 #ifdef HAVE_LIBCAPSICUM 205 static int 206 cappwdgrp_setup(cap_channel_t **cappwdp, cap_channel_t **capgrpp) 207 { 208 cap_channel_t *capcas, *cappwdloc, *capgrploc; 209 const char *cmds[1], *fields[1]; 210 211 capcas = cap_init(); 212 if (capcas == NULL) { 213 warn("unable to contact casperd"); 214 return (-1); 215 } 216 cappwdloc = cap_service_open(capcas, "system.pwd"); 217 capgrploc = cap_service_open(capcas, "system.grp"); 218 /* Casper capability no longer needed. */ 219 cap_close(capcas); 220 if (cappwdloc == NULL || capgrploc == NULL) { 221 if (cappwdloc == NULL) 222 warn("unable to open system.pwd service"); 223 if (capgrploc == NULL) 224 warn("unable to open system.grp service"); 225 exit(1); 226 } 227 /* Limit system.pwd to only getpwuid() function and pw_name field. */ 228 cmds[0] = "getpwuid"; 229 if (cap_pwd_limit_cmds(cappwdloc, cmds, 1) < 0) 230 err(1, "unable to limit system.pwd service"); 231 fields[0] = "pw_name"; 232 if (cap_pwd_limit_fields(cappwdloc, fields, 1) < 0) 233 err(1, "unable to limit system.pwd service"); 234 /* Limit system.grp to only getgrgid() function and gr_name field. */ 235 cmds[0] = "getgrgid"; 236 if (cap_grp_limit_cmds(capgrploc, cmds, 1) < 0) 237 err(1, "unable to limit system.grp service"); 238 fields[0] = "gr_name"; 239 if (cap_grp_limit_fields(capgrploc, fields, 1) < 0) 240 err(1, "unable to limit system.grp service"); 241 242 *cappwdp = cappwdloc; 243 *capgrpp = capgrploc; 244 return (0); 245 } 246 #endif /* HAVE_LIBCAPSICUM */ 247 248 int 249 main(int argc, char *argv[]) 250 { 251 int ch, ktrlen, size; 252 void *m; 253 int trpoints = ALL_POINTS; 254 int drop_logged; 255 pid_t pid = 0; 256 u_int sv_flags; 257 258 setlocale(LC_CTYPE, ""); 259 260 while ((ch = getopt(argc,argv,"f:dElm:np:AHRrsTt:")) != -1) 261 switch (ch) { 262 case 'A': 263 abiflag = 1; 264 break; 265 case 'f': 266 tracefile = optarg; 267 break; 268 case 'd': 269 decimal = 1; 270 break; 271 case 'l': 272 tail = 1; 273 break; 274 case 'm': 275 maxdata = atoi(optarg); 276 break; 277 case 'n': 278 fancy = 0; 279 break; 280 case 'p': 281 pid = atoi(optarg); 282 break; 283 case 'r': 284 resolv = 1; 285 break; 286 case 's': 287 suppressdata = 1; 288 break; 289 case 'E': 290 timestamp = 3; /* elapsed timestamp */ 291 break; 292 case 'H': 293 threads = 1; 294 break; 295 case 'R': 296 timestamp = 2; /* relative timestamp */ 297 break; 298 case 'T': 299 timestamp = 1; 300 break; 301 case 't': 302 trpoints = getpoints(optarg); 303 if (trpoints < 0) 304 errx(1, "unknown trace point in %s", optarg); 305 break; 306 default: 307 usage(); 308 } 309 310 if (argc > optind) 311 usage(); 312 313 m = malloc(size = 1025); 314 if (m == NULL) 315 errx(1, "%s", strerror(ENOMEM)); 316 if (!freopen(tracefile, "r", stdin)) 317 err(1, "%s", tracefile); 318 319 strerror_init(); 320 localtime_init(); 321 #ifdef HAVE_LIBCAPSICUM 322 if (resolv != 0) { 323 if (cappwdgrp_setup(&cappwd, &capgrp) < 0) { 324 cappwd = NULL; 325 capgrp = NULL; 326 } 327 } 328 if (resolv == 0 || (cappwd != NULL && capgrp != NULL)) { 329 if (cap_enter() < 0 && errno != ENOSYS) 330 err(1, "unable to enter capability mode"); 331 } 332 #else 333 if (resolv == 0) { 334 if (cap_enter() < 0 && errno != ENOSYS) 335 err(1, "unable to enter capability mode"); 336 } 337 #endif 338 limitfd(STDIN_FILENO); 339 limitfd(STDOUT_FILENO); 340 limitfd(STDERR_FILENO); 341 if (cap_sandboxed()) 342 fprintf(stderr, "capability mode sandbox enabled\n"); 343 344 TAILQ_INIT(&trace_procs); 345 drop_logged = 0; 346 while (fread_tail(&ktr_header, sizeof(struct ktr_header), 1)) { 347 if (ktr_header.ktr_type & KTR_DROP) { 348 ktr_header.ktr_type &= ~KTR_DROP; 349 if (!drop_logged && threads) { 350 printf( 351 "%6jd %6jd %-8.*s Events dropped.\n", 352 (intmax_t)ktr_header.ktr_pid, 353 ktr_header.ktr_tid > 0 ? 354 (intmax_t)ktr_header.ktr_tid : 0, 355 MAXCOMLEN, ktr_header.ktr_comm); 356 drop_logged = 1; 357 } else if (!drop_logged) { 358 printf("%6jd %-8.*s Events dropped.\n", 359 (intmax_t)ktr_header.ktr_pid, MAXCOMLEN, 360 ktr_header.ktr_comm); 361 drop_logged = 1; 362 } 363 } 364 if (trpoints & (1<<ktr_header.ktr_type)) 365 if (pid == 0 || ktr_header.ktr_pid == pid || 366 ktr_header.ktr_tid == pid) 367 dumpheader(&ktr_header); 368 if ((ktrlen = ktr_header.ktr_len) < 0) 369 errx(1, "bogus length 0x%x", ktrlen); 370 if (ktrlen > size) { 371 m = realloc(m, ktrlen+1); 372 if (m == NULL) 373 errx(1, "%s", strerror(ENOMEM)); 374 size = ktrlen; 375 } 376 if (ktrlen && fread_tail(m, ktrlen, 1) == 0) 377 errx(1, "data too short"); 378 if (fetchprocinfo(&ktr_header, (u_int *)m) != 0) 379 continue; 380 sv_flags = abidump(&ktr_header); 381 if (pid && ktr_header.ktr_pid != pid && 382 ktr_header.ktr_tid != pid) 383 continue; 384 if ((trpoints & (1<<ktr_header.ktr_type)) == 0) 385 continue; 386 drop_logged = 0; 387 switch (ktr_header.ktr_type) { 388 case KTR_SYSCALL: 389 #if defined(__amd64__) || defined(__i386__) 390 if ((sv_flags & SV_ABI_MASK) == SV_ABI_LINUX) 391 linux_ktrsyscall((struct ktr_syscall *)m); 392 else 393 #endif 394 ktrsyscall((struct ktr_syscall *)m, sv_flags); 395 break; 396 case KTR_SYSRET: 397 #if defined(__amd64__) || defined(__i386__) 398 if ((sv_flags & SV_ABI_MASK) == SV_ABI_LINUX) 399 linux_ktrsysret((struct ktr_sysret *)m); 400 else 401 #endif 402 ktrsysret((struct ktr_sysret *)m, sv_flags); 403 break; 404 case KTR_NAMEI: 405 case KTR_SYSCTL: 406 ktrnamei(m, ktrlen); 407 break; 408 case KTR_GENIO: 409 ktrgenio((struct ktr_genio *)m, ktrlen); 410 break; 411 case KTR_PSIG: 412 ktrpsig((struct ktr_psig *)m); 413 break; 414 case KTR_CSW: 415 if (ktrlen == sizeof(struct ktr_csw_old)) 416 ktrcsw_old((struct ktr_csw_old *)m); 417 else 418 ktrcsw((struct ktr_csw *)m); 419 break; 420 case KTR_USER: 421 ktruser(ktrlen, m); 422 break; 423 case KTR_STRUCT: 424 ktrstruct(m, ktrlen); 425 break; 426 case KTR_CAPFAIL: 427 ktrcapfail((struct ktr_cap_fail *)m); 428 break; 429 case KTR_FAULT: 430 ktrfault((struct ktr_fault *)m); 431 break; 432 case KTR_FAULTEND: 433 ktrfaultend((struct ktr_faultend *)m); 434 break; 435 default: 436 printf("\n"); 437 break; 438 } 439 if (tail) 440 fflush(stdout); 441 } 442 return 0; 443 } 444 445 void 446 limitfd(int fd) 447 { 448 cap_rights_t rights; 449 unsigned long cmd; 450 451 cap_rights_init(&rights, CAP_FSTAT); 452 cmd = -1; 453 454 switch (fd) { 455 case STDIN_FILENO: 456 cap_rights_set(&rights, CAP_READ); 457 break; 458 case STDOUT_FILENO: 459 cap_rights_set(&rights, CAP_IOCTL, CAP_WRITE); 460 cmd = TIOCGETA; /* required by isatty(3) in printf(3) */ 461 break; 462 case STDERR_FILENO: 463 cap_rights_set(&rights, CAP_WRITE); 464 if (!suppressdata) { 465 cap_rights_set(&rights, CAP_IOCTL); 466 cmd = TIOCGWINSZ; 467 } 468 break; 469 default: 470 abort(); 471 } 472 473 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) 474 err(1, "unable to limit rights for descriptor %d", fd); 475 if (cmd != -1 && cap_ioctls_limit(fd, &cmd, 1) < 0 && errno != ENOSYS) 476 err(1, "unable to limit ioctls for descriptor %d", fd); 477 } 478 479 int 480 fread_tail(void *buf, int size, int num) 481 { 482 int i; 483 484 while ((i = fread(buf, size, num, stdin)) == 0 && tail) { 485 sleep(1); 486 clearerr(stdin); 487 } 488 return (i); 489 } 490 491 int 492 fetchprocinfo(struct ktr_header *kth, u_int *flags) 493 { 494 struct proc_info *pi; 495 496 switch (kth->ktr_type) { 497 case KTR_PROCCTOR: 498 TAILQ_FOREACH(pi, &trace_procs, info) { 499 if (pi->pid == kth->ktr_pid) { 500 TAILQ_REMOVE(&trace_procs, pi, info); 501 break; 502 } 503 } 504 pi = malloc(sizeof(struct proc_info)); 505 if (pi == NULL) 506 errx(1, "%s", strerror(ENOMEM)); 507 pi->sv_flags = *flags; 508 pi->pid = kth->ktr_pid; 509 TAILQ_INSERT_TAIL(&trace_procs, pi, info); 510 return (1); 511 512 case KTR_PROCDTOR: 513 TAILQ_FOREACH(pi, &trace_procs, info) { 514 if (pi->pid == kth->ktr_pid) { 515 TAILQ_REMOVE(&trace_procs, pi, info); 516 free(pi); 517 break; 518 } 519 } 520 return (1); 521 } 522 523 return (0); 524 } 525 526 u_int 527 abidump(struct ktr_header *kth) 528 { 529 struct proc_info *pi; 530 const char *abi; 531 const char *arch; 532 u_int flags = 0; 533 534 TAILQ_FOREACH(pi, &trace_procs, info) { 535 if (pi->pid == kth->ktr_pid) { 536 flags = pi->sv_flags; 537 break; 538 } 539 } 540 541 if (abiflag == 0) 542 return (flags); 543 544 switch (flags & SV_ABI_MASK) { 545 case SV_ABI_LINUX: 546 abi = "L"; 547 break; 548 case SV_ABI_FREEBSD: 549 abi = "F"; 550 break; 551 default: 552 abi = "U"; 553 break; 554 } 555 556 if (flags != 0) { 557 if (flags & SV_LP64) 558 arch = "64"; 559 else 560 arch = "32"; 561 } else 562 arch = "00"; 563 564 printf("%s%s ", abi, arch); 565 566 return (flags); 567 } 568 569 void 570 dumpheader(struct ktr_header *kth) 571 { 572 static char unknown[64]; 573 static struct timeval prevtime, temp; 574 const char *type; 575 576 switch (kth->ktr_type) { 577 case KTR_SYSCALL: 578 type = "CALL"; 579 break; 580 case KTR_SYSRET: 581 type = "RET "; 582 break; 583 case KTR_NAMEI: 584 type = "NAMI"; 585 break; 586 case KTR_GENIO: 587 type = "GIO "; 588 break; 589 case KTR_PSIG: 590 type = "PSIG"; 591 break; 592 case KTR_CSW: 593 type = "CSW "; 594 break; 595 case KTR_USER: 596 type = "USER"; 597 break; 598 case KTR_STRUCT: 599 type = "STRU"; 600 break; 601 case KTR_SYSCTL: 602 type = "SCTL"; 603 break; 604 case KTR_PROCCTOR: 605 /* FALLTHROUGH */ 606 case KTR_PROCDTOR: 607 return; 608 case KTR_CAPFAIL: 609 type = "CAP "; 610 break; 611 case KTR_FAULT: 612 type = "PFLT"; 613 break; 614 case KTR_FAULTEND: 615 type = "PRET"; 616 break; 617 default: 618 sprintf(unknown, "UNKNOWN(%d)", kth->ktr_type); 619 type = unknown; 620 } 621 622 /* 623 * The ktr_tid field was previously the ktr_buffer field, which held 624 * the kernel pointer value for the buffer associated with data 625 * following the record header. It now holds a threadid, but only 626 * for trace files after the change. Older trace files still contain 627 * kernel pointers. Detect this and suppress the results by printing 628 * negative tid's as 0. 629 */ 630 if (threads) 631 printf("%6jd %6jd %-8.*s ", (intmax_t)kth->ktr_pid, 632 kth->ktr_tid > 0 ? (intmax_t)kth->ktr_tid : 0, 633 MAXCOMLEN, kth->ktr_comm); 634 else 635 printf("%6jd %-8.*s ", (intmax_t)kth->ktr_pid, MAXCOMLEN, 636 kth->ktr_comm); 637 if (timestamp) { 638 if (timestamp == 3) { 639 if (prevtime.tv_sec == 0) 640 prevtime = kth->ktr_time; 641 timevalsub(&kth->ktr_time, &prevtime); 642 } 643 if (timestamp == 2) { 644 temp = kth->ktr_time; 645 timevalsub(&kth->ktr_time, &prevtime); 646 prevtime = temp; 647 } 648 printf("%jd.%06ld ", (intmax_t)kth->ktr_time.tv_sec, 649 kth->ktr_time.tv_usec); 650 } 651 printf("%s ", type); 652 } 653 654 #include <sys/syscall.h> 655 #define KTRACE 656 #include <sys/kern/syscalls.c> 657 #undef KTRACE 658 int nsyscalls = sizeof (syscallnames) / sizeof (syscallnames[0]); 659 660 void 661 ktrsyscall(struct ktr_syscall *ktr, u_int flags) 662 { 663 int narg = ktr->ktr_narg; 664 register_t *ip; 665 intmax_t arg; 666 667 if ((flags != 0 && ((flags & SV_ABI_MASK) != SV_ABI_FREEBSD)) || 668 (ktr->ktr_code >= nsyscalls || ktr->ktr_code < 0)) 669 printf("[%d]", ktr->ktr_code); 670 else 671 printf("%s", syscallnames[ktr->ktr_code]); 672 ip = &ktr->ktr_args[0]; 673 if (narg) { 674 char c = '('; 675 if (fancy && 676 (flags == 0 || (flags & SV_ABI_MASK) == SV_ABI_FREEBSD)) { 677 switch (ktr->ktr_code) { 678 case SYS_bindat: 679 case SYS_connectat: 680 case SYS_faccessat: 681 case SYS_fchmodat: 682 case SYS_fchownat: 683 case SYS_fstatat: 684 case SYS_futimesat: 685 case SYS_linkat: 686 case SYS_mkdirat: 687 case SYS_mkfifoat: 688 case SYS_mknodat: 689 case SYS_openat: 690 case SYS_readlinkat: 691 case SYS_renameat: 692 case SYS_unlinkat: 693 putchar('('); 694 atfdname(*ip, decimal); 695 c = ','; 696 ip++; 697 narg--; 698 break; 699 } 700 switch (ktr->ktr_code) { 701 case SYS_ioctl: { 702 print_number(ip, narg, c); 703 putchar(c); 704 ioctlname(*ip, decimal); 705 c = ','; 706 ip++; 707 narg--; 708 break; 709 } 710 case SYS_ptrace: 711 putchar('('); 712 ptraceopname(*ip); 713 c = ','; 714 ip++; 715 narg--; 716 break; 717 case SYS_access: 718 case SYS_eaccess: 719 case SYS_faccessat: 720 print_number(ip, narg, c); 721 putchar(','); 722 accessmodename(*ip); 723 ip++; 724 narg--; 725 break; 726 case SYS_open: 727 case SYS_openat: 728 print_number(ip, narg, c); 729 putchar(','); 730 flagsandmodename(ip[0], ip[1], decimal); 731 ip += 2; 732 narg -= 2; 733 break; 734 case SYS_wait4: 735 print_number(ip, narg, c); 736 print_number(ip, narg, c); 737 /* 738 * A flags value of zero is valid for 739 * wait4() but not for wait6(), so 740 * handle zero special here. 741 */ 742 if (*ip == 0) { 743 print_number(ip, narg, c); 744 } else { 745 putchar(','); 746 wait6optname(*ip); 747 ip++; 748 narg--; 749 } 750 break; 751 case SYS_wait6: 752 putchar('('); 753 idtypename(*ip, decimal); 754 c = ','; 755 ip++; 756 narg--; 757 print_number(ip, narg, c); 758 print_number(ip, narg, c); 759 putchar(','); 760 wait6optname(*ip); 761 ip++; 762 narg--; 763 break; 764 case SYS_chmod: 765 case SYS_fchmod: 766 case SYS_lchmod: 767 print_number(ip, narg, c); 768 putchar(','); 769 modename(*ip); 770 ip++; 771 narg--; 772 break; 773 case SYS_mknod: 774 case SYS_mknodat: 775 print_number(ip, narg, c); 776 putchar(','); 777 modename(*ip); 778 ip++; 779 narg--; 780 break; 781 case SYS_getfsstat: 782 print_number(ip, narg, c); 783 print_number(ip, narg, c); 784 putchar(','); 785 getfsstatflagsname(*ip); 786 ip++; 787 narg--; 788 break; 789 case SYS_mount: 790 print_number(ip, narg, c); 791 print_number(ip, narg, c); 792 putchar(','); 793 mountflagsname(*ip); 794 ip++; 795 narg--; 796 break; 797 case SYS_unmount: 798 print_number(ip, narg, c); 799 putchar(','); 800 mountflagsname(*ip); 801 ip++; 802 narg--; 803 break; 804 case SYS_recvmsg: 805 case SYS_sendmsg: 806 print_number(ip, narg, c); 807 print_number(ip, narg, c); 808 putchar(','); 809 sendrecvflagsname(*ip); 810 ip++; 811 narg--; 812 break; 813 case SYS_recvfrom: 814 case SYS_sendto: 815 print_number(ip, narg, c); 816 print_number(ip, narg, c); 817 print_number(ip, narg, c); 818 putchar(','); 819 sendrecvflagsname(*ip); 820 ip++; 821 narg--; 822 break; 823 case SYS_chflags: 824 case SYS_fchflags: 825 case SYS_lchflags: 826 print_number(ip, narg, c); 827 putchar(','); 828 modename(*ip); 829 ip++; 830 narg--; 831 break; 832 case SYS_kill: 833 print_number(ip, narg, c); 834 putchar(','); 835 signame(*ip); 836 ip++; 837 narg--; 838 break; 839 case SYS_reboot: 840 putchar('('); 841 rebootoptname(*ip); 842 ip++; 843 narg--; 844 break; 845 case SYS_umask: 846 putchar('('); 847 modename(*ip); 848 ip++; 849 narg--; 850 break; 851 case SYS_msync: 852 print_number(ip, narg, c); 853 print_number(ip, narg, c); 854 putchar(','); 855 msyncflagsname(*ip); 856 ip++; 857 narg--; 858 break; 859 #ifdef SYS_freebsd6_mmap 860 case SYS_freebsd6_mmap: 861 print_number(ip, narg, c); 862 print_number(ip, narg, c); 863 putchar(','); 864 mmapprotname(*ip); 865 putchar(','); 866 ip++; 867 narg--; 868 mmapflagsname(*ip); 869 ip++; 870 narg--; 871 break; 872 #endif 873 case SYS_mmap: 874 print_number(ip, narg, c); 875 print_number(ip, narg, c); 876 putchar(','); 877 mmapprotname(*ip); 878 putchar(','); 879 ip++; 880 narg--; 881 mmapflagsname(*ip); 882 ip++; 883 narg--; 884 break; 885 case SYS_mprotect: 886 print_number(ip, narg, c); 887 print_number(ip, narg, c); 888 putchar(','); 889 mmapprotname(*ip); 890 ip++; 891 narg--; 892 break; 893 case SYS_madvise: 894 print_number(ip, narg, c); 895 print_number(ip, narg, c); 896 putchar(','); 897 madvisebehavname(*ip); 898 ip++; 899 narg--; 900 break; 901 case SYS_setpriority: 902 print_number(ip, narg, c); 903 print_number(ip, narg, c); 904 putchar(','); 905 prioname(*ip); 906 ip++; 907 narg--; 908 break; 909 case SYS_fcntl: 910 print_number(ip, narg, c); 911 putchar(','); 912 fcntlcmdname(ip[0], ip[1], decimal); 913 ip += 2; 914 narg -= 2; 915 break; 916 case SYS_socket: { 917 int sockdomain; 918 putchar('('); 919 sockdomain = *ip; 920 sockdomainname(sockdomain); 921 ip++; 922 narg--; 923 putchar(','); 924 socktypenamewithflags(*ip); 925 ip++; 926 narg--; 927 if (sockdomain == PF_INET || 928 sockdomain == PF_INET6) { 929 putchar(','); 930 sockipprotoname(*ip); 931 ip++; 932 narg--; 933 } 934 c = ','; 935 break; 936 } 937 case SYS_setsockopt: 938 case SYS_getsockopt: 939 print_number(ip, narg, c); 940 putchar(','); 941 sockoptlevelname(*ip, decimal); 942 if (*ip == SOL_SOCKET) { 943 ip++; 944 narg--; 945 putchar(','); 946 sockoptname(*ip); 947 } 948 ip++; 949 narg--; 950 break; 951 #ifdef SYS_freebsd6_lseek 952 case SYS_freebsd6_lseek: 953 print_number(ip, narg, c); 954 /* Hidden 'pad' argument, not in lseek(2) */ 955 print_number(ip, narg, c); 956 print_number(ip, narg, c); 957 putchar(','); 958 whencename(*ip); 959 ip++; 960 narg--; 961 break; 962 #endif 963 case SYS_lseek: 964 print_number(ip, narg, c); 965 /* Hidden 'pad' argument, not in lseek(2) */ 966 print_number(ip, narg, c); 967 putchar(','); 968 whencename(*ip); 969 ip++; 970 narg--; 971 break; 972 case SYS_flock: 973 print_number(ip, narg, c); 974 putchar(','); 975 flockname(*ip); 976 ip++; 977 narg--; 978 break; 979 case SYS_mkfifo: 980 case SYS_mkfifoat: 981 case SYS_mkdir: 982 case SYS_mkdirat: 983 print_number(ip, narg, c); 984 putchar(','); 985 modename(*ip); 986 ip++; 987 narg--; 988 break; 989 case SYS_shutdown: 990 print_number(ip, narg, c); 991 putchar(','); 992 shutdownhowname(*ip); 993 ip++; 994 narg--; 995 break; 996 case SYS_socketpair: 997 putchar('('); 998 sockdomainname(*ip); 999 ip++; 1000 narg--; 1001 putchar(','); 1002 socktypenamewithflags(*ip); 1003 ip++; 1004 narg--; 1005 c = ','; 1006 break; 1007 case SYS_getrlimit: 1008 case SYS_setrlimit: 1009 putchar('('); 1010 rlimitname(*ip); 1011 ip++; 1012 narg--; 1013 c = ','; 1014 break; 1015 case SYS_quotactl: 1016 print_number(ip, narg, c); 1017 putchar(','); 1018 quotactlname(*ip); 1019 ip++; 1020 narg--; 1021 c = ','; 1022 break; 1023 case SYS_nfssvc: 1024 putchar('('); 1025 nfssvcname(*ip); 1026 ip++; 1027 narg--; 1028 c = ','; 1029 break; 1030 case SYS_rtprio: 1031 putchar('('); 1032 rtprioname(*ip); 1033 ip++; 1034 narg--; 1035 c = ','; 1036 break; 1037 case SYS___semctl: 1038 print_number(ip, narg, c); 1039 print_number(ip, narg, c); 1040 putchar(','); 1041 semctlname(*ip); 1042 ip++; 1043 narg--; 1044 break; 1045 case SYS_semget: 1046 print_number(ip, narg, c); 1047 print_number(ip, narg, c); 1048 putchar(','); 1049 semgetname(*ip); 1050 ip++; 1051 narg--; 1052 break; 1053 case SYS_msgctl: 1054 print_number(ip, narg, c); 1055 putchar(','); 1056 shmctlname(*ip); 1057 ip++; 1058 narg--; 1059 break; 1060 case SYS_shmat: 1061 print_number(ip, narg, c); 1062 print_number(ip, narg, c); 1063 putchar(','); 1064 shmatname(*ip); 1065 ip++; 1066 narg--; 1067 break; 1068 case SYS_shmctl: 1069 print_number(ip, narg, c); 1070 putchar(','); 1071 shmctlname(*ip); 1072 ip++; 1073 narg--; 1074 break; 1075 case SYS_minherit: 1076 print_number(ip, narg, c); 1077 print_number(ip, narg, c); 1078 putchar(','); 1079 minheritname(*ip); 1080 ip++; 1081 narg--; 1082 break; 1083 case SYS_rfork: 1084 putchar('('); 1085 rforkname(*ip); 1086 ip++; 1087 narg--; 1088 c = ','; 1089 break; 1090 case SYS_lio_listio: 1091 putchar('('); 1092 lio_listioname(*ip); 1093 ip++; 1094 narg--; 1095 c = ','; 1096 break; 1097 case SYS_mlockall: 1098 putchar('('); 1099 mlockallname(*ip); 1100 ip++; 1101 narg--; 1102 break; 1103 case SYS_sched_setscheduler: 1104 print_number(ip, narg, c); 1105 putchar(','); 1106 schedpolicyname(*ip); 1107 ip++; 1108 narg--; 1109 break; 1110 case SYS_sched_get_priority_max: 1111 case SYS_sched_get_priority_min: 1112 putchar('('); 1113 schedpolicyname(*ip); 1114 ip++; 1115 narg--; 1116 break; 1117 case SYS_sendfile: 1118 print_number(ip, narg, c); 1119 print_number(ip, narg, c); 1120 print_number(ip, narg, c); 1121 print_number(ip, narg, c); 1122 print_number(ip, narg, c); 1123 print_number(ip, narg, c); 1124 putchar(','); 1125 sendfileflagsname(*ip); 1126 ip++; 1127 narg--; 1128 break; 1129 case SYS_kldsym: 1130 print_number(ip, narg, c); 1131 putchar(','); 1132 kldsymcmdname(*ip); 1133 ip++; 1134 narg--; 1135 break; 1136 case SYS_sigprocmask: 1137 putchar('('); 1138 sigprocmaskhowname(*ip); 1139 ip++; 1140 narg--; 1141 c = ','; 1142 break; 1143 case SYS___acl_get_file: 1144 case SYS___acl_set_file: 1145 case SYS___acl_get_fd: 1146 case SYS___acl_set_fd: 1147 case SYS___acl_delete_file: 1148 case SYS___acl_delete_fd: 1149 case SYS___acl_aclcheck_file: 1150 case SYS___acl_aclcheck_fd: 1151 case SYS___acl_get_link: 1152 case SYS___acl_set_link: 1153 case SYS___acl_delete_link: 1154 case SYS___acl_aclcheck_link: 1155 print_number(ip, narg, c); 1156 putchar(','); 1157 acltypename(*ip); 1158 ip++; 1159 narg--; 1160 break; 1161 case SYS_sigaction: 1162 putchar('('); 1163 signame(*ip); 1164 ip++; 1165 narg--; 1166 c = ','; 1167 break; 1168 case SYS_extattrctl: 1169 print_number(ip, narg, c); 1170 putchar(','); 1171 extattrctlname(*ip); 1172 ip++; 1173 narg--; 1174 break; 1175 case SYS_nmount: 1176 print_number(ip, narg, c); 1177 print_number(ip, narg, c); 1178 putchar(','); 1179 mountflagsname(*ip); 1180 ip++; 1181 narg--; 1182 break; 1183 case SYS_thr_create: 1184 print_number(ip, narg, c); 1185 print_number(ip, narg, c); 1186 putchar(','); 1187 thrcreateflagsname(*ip); 1188 ip++; 1189 narg--; 1190 break; 1191 case SYS_thr_kill: 1192 print_number(ip, narg, c); 1193 putchar(','); 1194 signame(*ip); 1195 ip++; 1196 narg--; 1197 break; 1198 case SYS_kldunloadf: 1199 print_number(ip, narg, c); 1200 putchar(','); 1201 kldunloadfflagsname(*ip); 1202 ip++; 1203 narg--; 1204 break; 1205 case SYS_linkat: 1206 case SYS_renameat: 1207 case SYS_symlinkat: 1208 print_number(ip, narg, c); 1209 putchar(','); 1210 atfdname(*ip, decimal); 1211 ip++; 1212 narg--; 1213 break; 1214 case SYS_cap_fcntls_limit: 1215 print_number(ip, narg, c); 1216 putchar(','); 1217 arg = *ip; 1218 ip++; 1219 narg--; 1220 capfcntlname(arg); 1221 break; 1222 case SYS_posix_fadvise: 1223 print_number(ip, narg, c); 1224 print_number(ip, narg, c); 1225 print_number(ip, narg, c); 1226 (void)putchar(','); 1227 fadvisebehavname((int)*ip); 1228 ip++; 1229 narg--; 1230 break; 1231 case SYS_procctl: 1232 putchar('('); 1233 idtypename(*ip, decimal); 1234 c = ','; 1235 ip++; 1236 narg--; 1237 print_number(ip, narg, c); 1238 putchar(','); 1239 procctlcmdname(*ip); 1240 ip++; 1241 narg--; 1242 break; 1243 } 1244 } 1245 while (narg > 0) { 1246 print_number(ip, narg, c); 1247 } 1248 putchar(')'); 1249 } 1250 putchar('\n'); 1251 } 1252 1253 void 1254 ktrsysret(struct ktr_sysret *ktr, u_int flags) 1255 { 1256 register_t ret = ktr->ktr_retval; 1257 int error = ktr->ktr_error; 1258 int code = ktr->ktr_code; 1259 1260 if ((flags != 0 && ((flags & SV_ABI_MASK) != SV_ABI_FREEBSD)) || 1261 (code >= nsyscalls || code < 0)) 1262 printf("[%d] ", code); 1263 else 1264 printf("%s ", syscallnames[code]); 1265 1266 if (error == 0) { 1267 if (fancy) { 1268 printf("%ld", (long)ret); 1269 if (ret < 0 || ret > 9) 1270 printf("/%#lx", (unsigned long)ret); 1271 } else { 1272 if (decimal) 1273 printf("%ld", (long)ret); 1274 else 1275 printf("%#lx", (unsigned long)ret); 1276 } 1277 } else if (error == ERESTART) 1278 printf("RESTART"); 1279 else if (error == EJUSTRETURN) 1280 printf("JUSTRETURN"); 1281 else { 1282 printf("-1 errno %d", ktr->ktr_error); 1283 if (fancy) 1284 printf(" %s", strerror(ktr->ktr_error)); 1285 } 1286 putchar('\n'); 1287 } 1288 1289 void 1290 ktrnamei(char *cp, int len) 1291 { 1292 printf("\"%.*s\"\n", len, cp); 1293 } 1294 1295 void 1296 hexdump(char *p, int len, int screenwidth) 1297 { 1298 int n, i; 1299 int width; 1300 1301 width = 0; 1302 do { 1303 width += 2; 1304 i = 13; /* base offset */ 1305 i += (width / 2) + 1; /* spaces every second byte */ 1306 i += (width * 2); /* width of bytes */ 1307 i += 3; /* " |" */ 1308 i += width; /* each byte */ 1309 i += 1; /* "|" */ 1310 } while (i < screenwidth); 1311 width -= 2; 1312 1313 for (n = 0; n < len; n += width) { 1314 for (i = n; i < n + width; i++) { 1315 if ((i % width) == 0) { /* beginning of line */ 1316 printf(" 0x%04x", i); 1317 } 1318 if ((i % 2) == 0) { 1319 printf(" "); 1320 } 1321 if (i < len) 1322 printf("%02x", p[i] & 0xff); 1323 else 1324 printf(" "); 1325 } 1326 printf(" |"); 1327 for (i = n; i < n + width; i++) { 1328 if (i >= len) 1329 break; 1330 if (p[i] >= ' ' && p[i] <= '~') 1331 printf("%c", p[i]); 1332 else 1333 printf("."); 1334 } 1335 printf("|\n"); 1336 } 1337 if ((i % width) != 0) 1338 printf("\n"); 1339 } 1340 1341 void 1342 visdump(char *dp, int datalen, int screenwidth) 1343 { 1344 int col = 0; 1345 char *cp; 1346 int width; 1347 char visbuf[5]; 1348 1349 printf(" \""); 1350 col = 8; 1351 for (;datalen > 0; datalen--, dp++) { 1352 vis(visbuf, *dp, VIS_CSTYLE, *(dp+1)); 1353 cp = visbuf; 1354 /* 1355 * Keep track of printables and 1356 * space chars (like fold(1)). 1357 */ 1358 if (col == 0) { 1359 putchar('\t'); 1360 col = 8; 1361 } 1362 switch(*cp) { 1363 case '\n': 1364 col = 0; 1365 putchar('\n'); 1366 continue; 1367 case '\t': 1368 width = 8 - (col&07); 1369 break; 1370 default: 1371 width = strlen(cp); 1372 } 1373 if (col + width > (screenwidth-2)) { 1374 printf("\\\n\t"); 1375 col = 8; 1376 } 1377 col += width; 1378 do { 1379 putchar(*cp++); 1380 } while (*cp); 1381 } 1382 if (col == 0) 1383 printf(" "); 1384 printf("\"\n"); 1385 } 1386 1387 void 1388 ktrgenio(struct ktr_genio *ktr, int len) 1389 { 1390 int datalen = len - sizeof (struct ktr_genio); 1391 char *dp = (char *)ktr + sizeof (struct ktr_genio); 1392 static int screenwidth = 0; 1393 int i, binary; 1394 1395 printf("fd %d %s %d byte%s\n", ktr->ktr_fd, 1396 ktr->ktr_rw == UIO_READ ? "read" : "wrote", datalen, 1397 datalen == 1 ? "" : "s"); 1398 if (suppressdata) 1399 return; 1400 if (screenwidth == 0) { 1401 struct winsize ws; 1402 1403 if (fancy && ioctl(fileno(stderr), TIOCGWINSZ, &ws) != -1 && 1404 ws.ws_col > 8) 1405 screenwidth = ws.ws_col; 1406 else 1407 screenwidth = 80; 1408 } 1409 if (maxdata && datalen > maxdata) 1410 datalen = maxdata; 1411 1412 for (i = 0, binary = 0; i < datalen && binary == 0; i++) { 1413 if (dp[i] >= 32 && dp[i] < 127) 1414 continue; 1415 if (dp[i] == 10 || dp[i] == 13 || dp[i] == 0 || dp[i] == 9) 1416 continue; 1417 binary = 1; 1418 } 1419 if (binary) 1420 hexdump(dp, datalen, screenwidth); 1421 else 1422 visdump(dp, datalen, screenwidth); 1423 } 1424 1425 const char *signames[] = { 1426 "NULL", "HUP", "INT", "QUIT", "ILL", "TRAP", "IOT", /* 1 - 6 */ 1427 "EMT", "FPE", "KILL", "BUS", "SEGV", "SYS", /* 7 - 12 */ 1428 "PIPE", "ALRM", "TERM", "URG", "STOP", "TSTP", /* 13 - 18 */ 1429 "CONT", "CHLD", "TTIN", "TTOU", "IO", "XCPU", /* 19 - 24 */ 1430 "XFSZ", "VTALRM", "PROF", "WINCH", "29", "USR1", /* 25 - 30 */ 1431 "USR2", NULL, /* 31 - 32 */ 1432 }; 1433 1434 void 1435 ktrpsig(struct ktr_psig *psig) 1436 { 1437 if (psig->signo > 0 && psig->signo < NSIG) 1438 printf("SIG%s ", signames[psig->signo]); 1439 else 1440 printf("SIG %d ", psig->signo); 1441 if (psig->action == SIG_DFL) { 1442 printf("SIG_DFL code="); 1443 sigcodename(psig->signo, psig->code); 1444 putchar('\n'); 1445 } else { 1446 printf("caught handler=0x%lx mask=0x%x code=", 1447 (u_long)psig->action, psig->mask.__bits[0]); 1448 sigcodename(psig->signo, psig->code); 1449 putchar('\n'); 1450 } 1451 } 1452 1453 void 1454 ktrcsw_old(struct ktr_csw_old *cs) 1455 { 1456 printf("%s %s\n", cs->out ? "stop" : "resume", 1457 cs->user ? "user" : "kernel"); 1458 } 1459 1460 void 1461 ktrcsw(struct ktr_csw *cs) 1462 { 1463 printf("%s %s \"%s\"\n", cs->out ? "stop" : "resume", 1464 cs->user ? "user" : "kernel", cs->wmesg); 1465 } 1466 1467 #define UTRACE_DLOPEN_START 1 1468 #define UTRACE_DLOPEN_STOP 2 1469 #define UTRACE_DLCLOSE_START 3 1470 #define UTRACE_DLCLOSE_STOP 4 1471 #define UTRACE_LOAD_OBJECT 5 1472 #define UTRACE_UNLOAD_OBJECT 6 1473 #define UTRACE_ADD_RUNDEP 7 1474 #define UTRACE_PRELOAD_FINISHED 8 1475 #define UTRACE_INIT_CALL 9 1476 #define UTRACE_FINI_CALL 10 1477 1478 struct utrace_rtld { 1479 char sig[4]; /* 'RTLD' */ 1480 int event; 1481 void *handle; 1482 void *mapbase; 1483 size_t mapsize; 1484 int refcnt; 1485 char name[MAXPATHLEN]; 1486 }; 1487 1488 void 1489 ktruser_rtld(int len, unsigned char *p) 1490 { 1491 struct utrace_rtld *ut = (struct utrace_rtld *)p; 1492 void *parent; 1493 int mode; 1494 1495 switch (ut->event) { 1496 case UTRACE_DLOPEN_START: 1497 mode = ut->refcnt; 1498 printf("dlopen(%s, ", ut->name); 1499 switch (mode & RTLD_MODEMASK) { 1500 case RTLD_NOW: 1501 printf("RTLD_NOW"); 1502 break; 1503 case RTLD_LAZY: 1504 printf("RTLD_LAZY"); 1505 break; 1506 default: 1507 printf("%#x", mode & RTLD_MODEMASK); 1508 } 1509 if (mode & RTLD_GLOBAL) 1510 printf(" | RTLD_GLOBAL"); 1511 if (mode & RTLD_TRACE) 1512 printf(" | RTLD_TRACE"); 1513 if (mode & ~(RTLD_MODEMASK | RTLD_GLOBAL | RTLD_TRACE)) 1514 printf(" | %#x", mode & 1515 ~(RTLD_MODEMASK | RTLD_GLOBAL | RTLD_TRACE)); 1516 printf(")\n"); 1517 break; 1518 case UTRACE_DLOPEN_STOP: 1519 printf("%p = dlopen(%s) ref %d\n", ut->handle, ut->name, 1520 ut->refcnt); 1521 break; 1522 case UTRACE_DLCLOSE_START: 1523 printf("dlclose(%p) (%s, %d)\n", ut->handle, ut->name, 1524 ut->refcnt); 1525 break; 1526 case UTRACE_DLCLOSE_STOP: 1527 printf("dlclose(%p) finished\n", ut->handle); 1528 break; 1529 case UTRACE_LOAD_OBJECT: 1530 printf("RTLD: loaded %p @ %p - %p (%s)\n", ut->handle, 1531 ut->mapbase, (char *)ut->mapbase + ut->mapsize - 1, 1532 ut->name); 1533 break; 1534 case UTRACE_UNLOAD_OBJECT: 1535 printf("RTLD: unloaded %p @ %p - %p (%s)\n", ut->handle, 1536 ut->mapbase, (char *)ut->mapbase + ut->mapsize - 1, 1537 ut->name); 1538 break; 1539 case UTRACE_ADD_RUNDEP: 1540 parent = ut->mapbase; 1541 printf("RTLD: %p now depends on %p (%s, %d)\n", parent, 1542 ut->handle, ut->name, ut->refcnt); 1543 break; 1544 case UTRACE_PRELOAD_FINISHED: 1545 printf("RTLD: LD_PRELOAD finished\n"); 1546 break; 1547 case UTRACE_INIT_CALL: 1548 printf("RTLD: init %p for %p (%s)\n", ut->mapbase, ut->handle, 1549 ut->name); 1550 break; 1551 case UTRACE_FINI_CALL: 1552 printf("RTLD: fini %p for %p (%s)\n", ut->mapbase, ut->handle, 1553 ut->name); 1554 break; 1555 default: 1556 p += 4; 1557 len -= 4; 1558 printf("RTLD: %d ", len); 1559 while (len--) 1560 if (decimal) 1561 printf(" %d", *p++); 1562 else 1563 printf(" %02x", *p++); 1564 printf("\n"); 1565 } 1566 } 1567 1568 struct utrace_malloc { 1569 void *p; 1570 size_t s; 1571 void *r; 1572 }; 1573 1574 void 1575 ktruser_malloc(unsigned char *p) 1576 { 1577 struct utrace_malloc *ut = (struct utrace_malloc *)p; 1578 1579 if (ut->p == (void *)(intptr_t)(-1)) 1580 printf("malloc_init()\n"); 1581 else if (ut->s == 0) 1582 printf("free(%p)\n", ut->p); 1583 else if (ut->p == NULL) 1584 printf("%p = malloc(%zu)\n", ut->r, ut->s); 1585 else 1586 printf("%p = realloc(%p, %zu)\n", ut->r, ut->p, ut->s); 1587 } 1588 1589 void 1590 ktruser(int len, unsigned char *p) 1591 { 1592 1593 if (len >= 8 && bcmp(p, "RTLD", 4) == 0) { 1594 ktruser_rtld(len, p); 1595 return; 1596 } 1597 1598 if (len == sizeof(struct utrace_malloc)) { 1599 ktruser_malloc(p); 1600 return; 1601 } 1602 1603 printf("%d ", len); 1604 while (len--) 1605 if (decimal) 1606 printf(" %d", *p++); 1607 else 1608 printf(" %02x", *p++); 1609 printf("\n"); 1610 } 1611 1612 void 1613 ktrcaprights(cap_rights_t *rightsp) 1614 { 1615 1616 printf("cap_rights_t "); 1617 capname(rightsp); 1618 printf("\n"); 1619 } 1620 1621 void 1622 ktrsockaddr(struct sockaddr *sa) 1623 { 1624 /* 1625 TODO: Support additional address families 1626 #include <netnatm/natm.h> 1627 struct sockaddr_natm *natm; 1628 #include <netsmb/netbios.h> 1629 struct sockaddr_nb *nb; 1630 */ 1631 char addr[64]; 1632 1633 /* 1634 * note: ktrstruct() has already verified that sa points to a 1635 * buffer at least sizeof(struct sockaddr) bytes long and exactly 1636 * sa->sa_len bytes long. 1637 */ 1638 printf("struct sockaddr { "); 1639 sockfamilyname(sa->sa_family); 1640 printf(", "); 1641 1642 #define check_sockaddr_len(n) \ 1643 if (sa_##n.s##n##_len < sizeof(struct sockaddr_##n)) { \ 1644 printf("invalid"); \ 1645 break; \ 1646 } 1647 1648 switch(sa->sa_family) { 1649 case AF_INET: { 1650 struct sockaddr_in sa_in; 1651 1652 memset(&sa_in, 0, sizeof(sa_in)); 1653 memcpy(&sa_in, sa, sa->sa_len); 1654 check_sockaddr_len(in); 1655 inet_ntop(AF_INET, &sa_in.sin_addr, addr, sizeof addr); 1656 printf("%s:%u", addr, ntohs(sa_in.sin_port)); 1657 break; 1658 } 1659 #ifdef NETATALK 1660 case AF_APPLETALK: { 1661 struct sockaddr_at sa_at; 1662 struct netrange *nr; 1663 1664 memset(&sa_at, 0, sizeof(sa_at)); 1665 memcpy(&sa_at, sa, sa->sa_len); 1666 check_sockaddr_len(at); 1667 nr = &sa_at.sat_range.r_netrange; 1668 printf("%d.%d, %d-%d, %d", ntohs(sa_at.sat_addr.s_net), 1669 sa_at.sat_addr.s_node, ntohs(nr->nr_firstnet), 1670 ntohs(nr->nr_lastnet), nr->nr_phase); 1671 break; 1672 } 1673 #endif 1674 case AF_INET6: { 1675 struct sockaddr_in6 sa_in6; 1676 1677 memset(&sa_in6, 0, sizeof(sa_in6)); 1678 memcpy(&sa_in6, sa, sa->sa_len); 1679 check_sockaddr_len(in6); 1680 getnameinfo((struct sockaddr *)&sa_in6, sizeof(sa_in6), 1681 addr, sizeof(addr), NULL, 0, NI_NUMERICHOST); 1682 printf("[%s]:%u", addr, htons(sa_in6.sin6_port)); 1683 break; 1684 } 1685 case AF_UNIX: { 1686 struct sockaddr_un sa_un; 1687 1688 memset(&sa_un, 0, sizeof(sa_un)); 1689 memcpy(&sa_un, sa, sa->sa_len); 1690 printf("%.*s", (int)sizeof(sa_un.sun_path), sa_un.sun_path); 1691 break; 1692 } 1693 default: 1694 printf("unknown address family"); 1695 } 1696 printf(" }\n"); 1697 } 1698 1699 void 1700 ktrstat(struct stat *statp) 1701 { 1702 char mode[12], timestr[PATH_MAX + 4]; 1703 struct passwd *pwd; 1704 struct group *grp; 1705 struct tm *tm; 1706 1707 /* 1708 * note: ktrstruct() has already verified that statp points to a 1709 * buffer exactly sizeof(struct stat) bytes long. 1710 */ 1711 printf("struct stat {"); 1712 printf("dev=%ju, ino=%ju, ", 1713 (uintmax_t)statp->st_dev, (uintmax_t)statp->st_ino); 1714 if (resolv == 0) 1715 printf("mode=0%jo, ", (uintmax_t)statp->st_mode); 1716 else { 1717 strmode(statp->st_mode, mode); 1718 printf("mode=%s, ", mode); 1719 } 1720 printf("nlink=%ju, ", (uintmax_t)statp->st_nlink); 1721 if (resolv == 0) { 1722 pwd = NULL; 1723 } else { 1724 #ifdef HAVE_LIBCAPSICUM 1725 if (cappwd != NULL) 1726 pwd = cap_getpwuid(cappwd, statp->st_uid); 1727 else 1728 #endif 1729 pwd = getpwuid(statp->st_uid); 1730 } 1731 if (pwd == NULL) 1732 printf("uid=%ju, ", (uintmax_t)statp->st_uid); 1733 else 1734 printf("uid=\"%s\", ", pwd->pw_name); 1735 if (resolv == 0) { 1736 grp = NULL; 1737 } else { 1738 #ifdef HAVE_LIBCAPSICUM 1739 if (capgrp != NULL) 1740 grp = cap_getgrgid(capgrp, statp->st_gid); 1741 else 1742 #endif 1743 grp = getgrgid(statp->st_gid); 1744 } 1745 if (grp == NULL) 1746 printf("gid=%ju, ", (uintmax_t)statp->st_gid); 1747 else 1748 printf("gid=\"%s\", ", grp->gr_name); 1749 printf("rdev=%ju, ", (uintmax_t)statp->st_rdev); 1750 printf("atime="); 1751 if (resolv == 0) 1752 printf("%jd", (intmax_t)statp->st_atim.tv_sec); 1753 else { 1754 tm = localtime(&statp->st_atim.tv_sec); 1755 strftime(timestr, sizeof(timestr), TIME_FORMAT, tm); 1756 printf("\"%s\"", timestr); 1757 } 1758 if (statp->st_atim.tv_nsec != 0) 1759 printf(".%09ld, ", statp->st_atim.tv_nsec); 1760 else 1761 printf(", "); 1762 printf("stime="); 1763 if (resolv == 0) 1764 printf("%jd", (intmax_t)statp->st_mtim.tv_sec); 1765 else { 1766 tm = localtime(&statp->st_mtim.tv_sec); 1767 strftime(timestr, sizeof(timestr), TIME_FORMAT, tm); 1768 printf("\"%s\"", timestr); 1769 } 1770 if (statp->st_mtim.tv_nsec != 0) 1771 printf(".%09ld, ", statp->st_mtim.tv_nsec); 1772 else 1773 printf(", "); 1774 printf("ctime="); 1775 if (resolv == 0) 1776 printf("%jd", (intmax_t)statp->st_ctim.tv_sec); 1777 else { 1778 tm = localtime(&statp->st_ctim.tv_sec); 1779 strftime(timestr, sizeof(timestr), TIME_FORMAT, tm); 1780 printf("\"%s\"", timestr); 1781 } 1782 if (statp->st_ctim.tv_nsec != 0) 1783 printf(".%09ld, ", statp->st_ctim.tv_nsec); 1784 else 1785 printf(", "); 1786 printf("birthtime="); 1787 if (resolv == 0) 1788 printf("%jd", (intmax_t)statp->st_birthtim.tv_sec); 1789 else { 1790 tm = localtime(&statp->st_birthtim.tv_sec); 1791 strftime(timestr, sizeof(timestr), TIME_FORMAT, tm); 1792 printf("\"%s\"", timestr); 1793 } 1794 if (statp->st_birthtim.tv_nsec != 0) 1795 printf(".%09ld, ", statp->st_birthtim.tv_nsec); 1796 else 1797 printf(", "); 1798 printf("size=%jd, blksize=%ju, blocks=%jd, flags=0x%x", 1799 (uintmax_t)statp->st_size, (uintmax_t)statp->st_blksize, 1800 (intmax_t)statp->st_blocks, statp->st_flags); 1801 printf(" }\n"); 1802 } 1803 1804 void 1805 ktrstruct(char *buf, size_t buflen) 1806 { 1807 char *name, *data; 1808 size_t namelen, datalen; 1809 int i; 1810 cap_rights_t rights; 1811 struct stat sb; 1812 struct sockaddr_storage ss; 1813 1814 for (name = buf, namelen = 0; 1815 namelen < buflen && name[namelen] != '\0'; 1816 ++namelen) 1817 /* nothing */; 1818 if (namelen == buflen) 1819 goto invalid; 1820 if (name[namelen] != '\0') 1821 goto invalid; 1822 data = buf + namelen + 1; 1823 datalen = buflen - namelen - 1; 1824 if (datalen == 0) 1825 goto invalid; 1826 /* sanity check */ 1827 for (i = 0; i < (int)namelen; ++i) 1828 if (!isalpha(name[i])) 1829 goto invalid; 1830 if (strcmp(name, "caprights") == 0) { 1831 if (datalen != sizeof(cap_rights_t)) 1832 goto invalid; 1833 memcpy(&rights, data, datalen); 1834 ktrcaprights(&rights); 1835 } else if (strcmp(name, "stat") == 0) { 1836 if (datalen != sizeof(struct stat)) 1837 goto invalid; 1838 memcpy(&sb, data, datalen); 1839 ktrstat(&sb); 1840 } else if (strcmp(name, "sockaddr") == 0) { 1841 if (datalen > sizeof(ss)) 1842 goto invalid; 1843 memcpy(&ss, data, datalen); 1844 if (datalen != ss.ss_len) 1845 goto invalid; 1846 ktrsockaddr((struct sockaddr *)&ss); 1847 } else { 1848 printf("unknown structure\n"); 1849 } 1850 return; 1851 invalid: 1852 printf("invalid record\n"); 1853 } 1854 1855 void 1856 ktrcapfail(struct ktr_cap_fail *ktr) 1857 { 1858 switch (ktr->cap_type) { 1859 case CAPFAIL_NOTCAPABLE: 1860 /* operation on fd with insufficient capabilities */ 1861 printf("operation requires "); 1862 capname(&ktr->cap_needed); 1863 printf(", descriptor holds "); 1864 capname(&ktr->cap_held); 1865 break; 1866 case CAPFAIL_INCREASE: 1867 /* requested more capabilities than fd already has */ 1868 printf("attempt to increase capabilities from "); 1869 capname(&ktr->cap_held); 1870 printf(" to "); 1871 capname(&ktr->cap_needed); 1872 break; 1873 case CAPFAIL_SYSCALL: 1874 /* called restricted syscall */ 1875 printf("disallowed system call"); 1876 break; 1877 case CAPFAIL_LOOKUP: 1878 /* used ".." in strict-relative mode */ 1879 printf("restricted VFS lookup"); 1880 break; 1881 default: 1882 printf("unknown capability failure: "); 1883 capname(&ktr->cap_needed); 1884 printf(" "); 1885 capname(&ktr->cap_held); 1886 break; 1887 } 1888 printf("\n"); 1889 } 1890 1891 void 1892 ktrfault(struct ktr_fault *ktr) 1893 { 1894 1895 printf("0x%jx ", ktr->vaddr); 1896 vmprotname(ktr->type); 1897 printf("\n"); 1898 } 1899 1900 void 1901 ktrfaultend(struct ktr_faultend *ktr) 1902 { 1903 1904 vmresultname(ktr->result); 1905 printf("\n"); 1906 } 1907 1908 #if defined(__amd64__) || defined(__i386__) 1909 void 1910 linux_ktrsyscall(struct ktr_syscall *ktr) 1911 { 1912 int narg = ktr->ktr_narg; 1913 register_t *ip; 1914 1915 if (ktr->ktr_code >= nlinux_syscalls || ktr->ktr_code < 0) 1916 printf("[%d]", ktr->ktr_code); 1917 else 1918 printf("%s", linux_syscallnames[ktr->ktr_code]); 1919 ip = &ktr->ktr_args[0]; 1920 if (narg) { 1921 char c = '('; 1922 while (narg > 0) 1923 print_number(ip, narg, c); 1924 putchar(')'); 1925 } 1926 putchar('\n'); 1927 } 1928 1929 void 1930 linux_ktrsysret(struct ktr_sysret *ktr) 1931 { 1932 register_t ret = ktr->ktr_retval; 1933 int error = ktr->ktr_error; 1934 int code = ktr->ktr_code; 1935 1936 if (code >= nlinux_syscalls || code < 0) 1937 printf("[%d] ", code); 1938 else 1939 printf("%s ", linux_syscallnames[code]); 1940 1941 if (error == 0) { 1942 if (fancy) { 1943 printf("%ld", (long)ret); 1944 if (ret < 0 || ret > 9) 1945 printf("/%#lx", (unsigned long)ret); 1946 } else { 1947 if (decimal) 1948 printf("%ld", (long)ret); 1949 else 1950 printf("%#lx", (unsigned long)ret); 1951 } 1952 } else if (error == ERESTART) 1953 printf("RESTART"); 1954 else if (error == EJUSTRETURN) 1955 printf("JUSTRETURN"); 1956 else { 1957 if (ktr->ktr_error <= ELAST + 1) 1958 error = abs(bsd_to_linux_errno[ktr->ktr_error]); 1959 else 1960 error = 999; 1961 printf("-1 errno %d", error); 1962 if (fancy) 1963 printf(" %s", strerror(ktr->ktr_error)); 1964 } 1965 putchar('\n'); 1966 } 1967 #endif 1968 1969 void 1970 usage(void) 1971 { 1972 fprintf(stderr, "usage: kdump [-dEnlHRrsTA] [-f trfile] " 1973 "[-m maxdata] [-p pid] [-t trstr]\n"); 1974 exit(1); 1975 } 1976