1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2002 Jake Burkholder 5 * Copyright (c) 2004 Robert Watson 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 27 * SUCH DAMAGE. 28 */ 29 30 #include <sys/types.h> 31 #include <sys/capsicum.h> 32 #include <sys/ktr.h> 33 #include <sys/mman.h> 34 #include <sys/stat.h> 35 36 #include <capsicum_helpers.h> 37 #include <err.h> 38 #include <errno.h> 39 #include <fcntl.h> 40 #include <kvm.h> 41 #include <limits.h> 42 #include <nlist.h> 43 #include <stdint.h> 44 #include <stdio.h> 45 #include <stdlib.h> 46 #include <string.h> 47 #include <unistd.h> 48 49 #define SBUFLEN 128 50 #define USAGE \ 51 "usage: ktrdump [-cflqrtH] [-i ktrfile] [-M core] [-N system] [-o outfile]\n" 52 53 static void usage(void) __dead2; 54 55 static struct nlist nl[] = { 56 { .n_name = "_ktr_version" }, 57 { .n_name = "_ktr_entries" }, 58 { .n_name = "_ktr_idx" }, 59 { .n_name = "_ktr_buf" }, 60 { .n_name = NULL } 61 }; 62 63 static int cflag; 64 static int fflag; 65 static int lflag; 66 static int Mflag; 67 static int Nflag; 68 static int qflag; 69 static int rflag; 70 static int tflag; 71 static int iflag; 72 static int hflag; 73 74 static char corefile[PATH_MAX]; 75 static char execfile[PATH_MAX]; 76 static char outfile[PATH_MAX] = "stdout"; 77 78 static char desc[SBUFLEN]; 79 static char errbuf[_POSIX2_LINE_MAX]; 80 static char fbuf[PATH_MAX]; 81 static char obuf[PATH_MAX]; 82 static char sbuf[KTR_PARMS][SBUFLEN]; 83 84 /* 85 * Reads the ktr trace buffer from kernel memory and prints the trace entries. 86 */ 87 int 88 main(int ac, char **av) 89 { 90 u_long parms[KTR_PARMS]; 91 struct ktr_entry *buf; 92 uintmax_t tlast, tnow; 93 unsigned long bufptr; 94 cap_rights_t rights; 95 struct stat sb; 96 kvm_t *kd; 97 FILE *out; 98 char *p; 99 int version; 100 int entries; 101 int count; 102 int index, index2; 103 int parm; 104 int in; 105 int c; 106 int i = 0; 107 108 /* 109 * Parse commandline arguments. 110 */ 111 out = stdout; 112 while ((c = getopt(ac, av, "cflqrtHe:i:m:M:N:o:")) != -1) 113 switch (c) { 114 case 'c': 115 cflag = 1; 116 break; 117 case 'N': 118 case 'e': 119 if (strlcpy(execfile, optarg, sizeof(execfile)) 120 >= sizeof(execfile)) 121 errx(1, "%s: File name too long", optarg); 122 Nflag = 1; 123 break; 124 case 'f': 125 fflag = 1; 126 break; 127 case 'i': 128 iflag = 1; 129 if ((in = open(optarg, O_RDONLY)) == -1) 130 err(1, "%s", optarg); 131 cap_rights_init(&rights, CAP_FSTAT, CAP_MMAP_R); 132 if (caph_rights_limit(in, &rights) < 0) 133 err(1, "unable to limit rights for %s", 134 optarg); 135 break; 136 case 'l': 137 lflag = 1; 138 break; 139 case 'M': 140 case 'm': 141 if (strlcpy(corefile, optarg, sizeof(corefile)) 142 >= sizeof(corefile)) 143 errx(1, "%s: File name too long", optarg); 144 Mflag = 1; 145 break; 146 case 'o': 147 if ((out = fopen(optarg, "w")) == NULL) 148 err(1, "%s", optarg); 149 strlcpy(outfile, optarg, sizeof(outfile)); 150 break; 151 case 'q': 152 qflag++; 153 break; 154 case 'r': 155 rflag = 1; 156 break; 157 case 't': 158 tflag = 1; 159 break; 160 case 'H': 161 hflag = 1; 162 break; 163 case '?': 164 default: 165 usage(); 166 } 167 ac -= optind; 168 av += optind; 169 if (ac != 0) 170 usage(); 171 172 if (caph_limit_stream(fileno(out), CAPH_WRITE) < 0) 173 err(1, "unable to limit rights for %s", outfile); 174 if (caph_limit_stderr() < 0) 175 err(1, "unable to limit rights for stderr"); 176 177 /* 178 * Open our execfile and corefile, resolve needed symbols and read in 179 * the trace buffer. 180 */ 181 if ((kd = kvm_openfiles(Nflag ? execfile : NULL, 182 Mflag ? corefile : NULL, NULL, O_RDONLY, errbuf)) == NULL) 183 errx(1, "%s", errbuf); 184 185 /* 186 * Cache NLS data, for strerror, for err(3), before entering capability 187 * mode. 188 */ 189 caph_cache_catpages(); 190 191 count = kvm_nlist(kd, nl); 192 if (count == -1) 193 errx(1, "%s", kvm_geterr(kd)); 194 if (count > 0) 195 errx(1, "failed to resolve ktr symbols"); 196 if (kvm_read(kd, nl[0].n_value, &version, sizeof(version)) == -1) 197 errx(1, "%s", kvm_geterr(kd)); 198 if (version != KTR_VERSION) 199 errx(1, "ktr version mismatch"); 200 201 /* 202 * Enter Capsicum sandbox. 203 * 204 * kvm_nlist() above uses kldsym(2) for native kernels, and that isn't 205 * allowed in the sandbox. 206 */ 207 if (caph_enter() < 0) 208 err(1, "unable to enter capability mode"); 209 210 if (iflag) { 211 if (fstat(in, &sb) == -1) 212 errx(1, "stat"); 213 entries = sb.st_size / sizeof(*buf); 214 index = 0; 215 buf = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, in, 0); 216 if (buf == MAP_FAILED) 217 errx(1, "mmap"); 218 } else { 219 if (kvm_read(kd, nl[1].n_value, &entries, sizeof(entries)) 220 == -1) 221 errx(1, "%s", kvm_geterr(kd)); 222 if ((buf = malloc(sizeof(*buf) * entries)) == NULL) 223 err(1, NULL); 224 if (kvm_read(kd, nl[2].n_value, &index, sizeof(index)) == -1 || 225 kvm_read(kd, nl[3].n_value, &bufptr, 226 sizeof(bufptr)) == -1 || 227 kvm_read(kd, bufptr, buf, sizeof(*buf) * entries) == -1 || 228 kvm_read(kd, nl[2].n_value, &index2, sizeof(index2)) == -1) 229 errx(1, "%s", kvm_geterr(kd)); 230 } 231 232 /* 233 * Print a nice header. 234 */ 235 if (!qflag) { 236 fprintf(out, "%-6s ", "index"); 237 if (cflag) 238 fprintf(out, "%-3s ", "cpu"); 239 if (tflag) 240 fprintf(out, "%-16s ", "timestamp"); 241 if (fflag) 242 fprintf(out, "%-40s ", "file and line"); 243 if (hflag) 244 fprintf(out, "%-18s ", "tid"); 245 fprintf(out, "%s", "trace"); 246 fprintf(out, "\n"); 247 248 fprintf(out, "------ "); 249 if (cflag) 250 fprintf(out, "--- "); 251 if (tflag) 252 fprintf(out, "---------------- "); 253 if (fflag) 254 fprintf(out, 255 "---------------------------------------- "); 256 if (hflag) 257 fprintf(out, "------------------ "); 258 fprintf(out, "----- "); 259 fprintf(out, "\n"); 260 } 261 262 tlast = UINTPTR_MAX; 263 /* 264 * Now tear through the trace buffer. 265 * 266 * In "live" mode, find the oldest entry (first non-NULL entry 267 * after index2) and walk forward. Otherwise, start with the 268 * most recent entry and walk backwards. 269 */ 270 if (!iflag) { 271 if (lflag) { 272 i = index2 + 1 % entries; 273 while (buf[i].ktr_desc == NULL && i != index) { 274 i++; 275 if (i == entries) 276 i = 0; 277 } 278 } else { 279 i = index - 1; 280 if (i < 0) 281 i = entries - 1; 282 } 283 } 284 dump_entries: 285 for (;;) { 286 if (buf[i].ktr_desc == NULL) 287 break; 288 if (kvm_read(kd, (u_long)buf[i].ktr_desc, desc, 289 sizeof(desc)) == -1) 290 errx(1, "%s", kvm_geterr(kd)); 291 desc[sizeof(desc) - 1] = '\0'; 292 parm = 0; 293 for (p = desc; (c = *p++) != '\0';) { 294 if (c != '%') 295 continue; 296 next: if ((c = *p++) == '\0') 297 break; 298 if (c == '%') 299 continue; 300 if (parm == KTR_PARMS) 301 errx(1, "too many parameters in \"%s\"", desc); 302 switch (c) { 303 case '0': case '1': case '2': case '3': case '4': 304 case '5': case '6': case '7': case '8': case '9': 305 case '#': case '-': case ' ': case '+': case '\'': 306 case 'h': case 'l': case 'j': case 't': case 'z': 307 case 'q': case 'L': case '.': 308 goto next; 309 case 's': 310 if (kvm_read(kd, (u_long)buf[i].ktr_parms[parm], 311 sbuf[parm], sizeof(sbuf[parm])) == -1) 312 strcpy(sbuf[parm], "(null)"); 313 sbuf[parm][sizeof(sbuf[0]) - 1] = '\0'; 314 parms[parm] = (u_long)sbuf[parm]; 315 parm++; 316 break; 317 default: 318 parms[parm] = buf[i].ktr_parms[parm]; 319 parm++; 320 break; 321 } 322 } 323 fprintf(out, "%6d ", i); 324 if (cflag) 325 fprintf(out, "%3d ", buf[i].ktr_cpu); 326 if (tflag) { 327 tnow = (uintmax_t)buf[i].ktr_timestamp; 328 if (rflag) { 329 if (tlast == UINTPTR_MAX) 330 tlast = tnow; 331 fprintf(out, "%16ju ", !iflag ? tlast - tnow : 332 tnow - tlast); 333 tlast = tnow; 334 } else 335 fprintf(out, "%16ju ", tnow); 336 } 337 if (fflag) { 338 if (kvm_read(kd, (u_long)buf[i].ktr_file, fbuf, 339 sizeof(fbuf)) == -1) 340 strcpy(fbuf, "(null)"); 341 snprintf(obuf, sizeof(obuf), "%s:%d", fbuf, 342 buf[i].ktr_line); 343 fprintf(out, "%-40s ", obuf); 344 } 345 if (hflag) 346 fprintf(out, "%p ", buf[i].ktr_thread); 347 fprintf(out, desc, parms[0], parms[1], parms[2], parms[3], 348 parms[4], parms[5]); 349 fprintf(out, "\n"); 350 if (!iflag) { 351 /* 352 * 'index' and 'index2' are the values of 'ktr_idx' 353 * before and after the KTR buffer was copied into 354 * 'buf'. Since the KTR entries between 'index' and 355 * 'index2' were in flux while the KTR buffer was 356 * being copied to userspace we don't dump them. 357 */ 358 if (lflag) { 359 if (++i == entries) 360 i = 0; 361 if (i == index) 362 break; 363 } else { 364 if (i == index2) 365 break; 366 if (--i < 0) 367 i = entries - 1; 368 } 369 } else { 370 if (++i == entries) 371 break; 372 } 373 } 374 375 /* 376 * In "live" mode, poll 'ktr_idx' periodically and dump any 377 * new entries since our last pass through the ring. 378 */ 379 if (lflag && !iflag) { 380 while (index == index2) { 381 usleep(50 * 1000); 382 if (kvm_read(kd, nl[2].n_value, &index2, 383 sizeof(index2)) == -1) 384 errx(1, "%s", kvm_geterr(kd)); 385 } 386 i = index; 387 index = index2; 388 if (kvm_read(kd, bufptr, buf, sizeof(*buf) * entries) == -1 || 389 kvm_read(kd, nl[2].n_value, &index2, sizeof(index2)) == -1) 390 errx(1, "%s", kvm_geterr(kd)); 391 goto dump_entries; 392 } 393 394 return (0); 395 } 396 397 static void 398 usage(void) 399 { 400 401 fprintf(stderr, USAGE); 402 exit(1); 403 } 404