2 * SPDX-License-Identifier: BSD-3-Clause
4 * Copyright (c) 1988, 1993
5 * The Regents of the University of California. All rights reserved.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the University nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * @(#)ktrace.h 8.1 (Berkeley) 6/2/93
35 #ifndef _SYS_KTRACE_H_
36 #define _SYS_KTRACE_H_
38 #include <sys/caprights.h>
41 * operations to ktrace system call (KTROP(op))
43 #define KTROP_SET 0 /* set trace points */
44 #define KTROP_CLEAR 1 /* clear trace points */
45 #define KTROP_CLEARFILE 2 /* stop all tracing to file */
46 #define KTROP(o) ((o)&3) /* macro to extract operation */
48 * flags (ORed in with operation)
50 #define KTRFLAG_DESCEND 4 /* perform op on all children too */
53 * ktrace record header
55 struct ktr_header_v0 {
56 int ktr_len; /* length of buf */
57 short ktr_type; /* trace record type */
58 pid_t ktr_pid; /* process id */
59 char ktr_comm[MAXCOMLEN + 1];/* command name */
60 struct timeval ktr_time; /* timestamp */
61 long ktr_tid; /* thread id */
65 int ktr_len; /* length of buf */
66 short ktr_type; /* trace record type */
67 short ktr_version; /* ktr_header version */
68 pid_t ktr_pid; /* process id */
69 char ktr_comm[MAXCOMLEN + 1];/* command name */
70 struct timespec ktr_time; /* timestamp */
71 /* XXX: make ktr_tid an lwpid_t on next ABI break */
72 long ktr_tid; /* thread id */
73 int ktr_cpu; /* cpu id */
76 #define KTR_VERSION0 0
77 #define KTR_VERSION1 1
78 #define KTR_OFFSET_V0 sizeof(struct ktr_header_v0) - \
79 sizeof(struct ktr_header)
81 * Test for kernel trace point (MP SAFE).
83 * KTRCHECK() just checks that the type is enabled and is only for
84 * internal use in the ktrace subsystem. KTRPOINT() checks against
85 * ktrace recursion as well as checking that the type is enabled and
86 * is the public interface.
88 #define KTRCHECK(td, type) ((td)->td_proc->p_traceflag & (1 << type))
89 #define KTRPOINT(td, type) (__predict_false(KTRCHECK((td), (type))))
90 #define KTRCHECKDRAIN(td) (!(STAILQ_EMPTY(&(td)->td_proc->p_ktr)))
91 #define KTRUSERRET(td) do { \
92 if (__predict_false(KTRCHECKDRAIN(td))) \
101 * KTR_SYSCALL - system call record
103 #define KTR_SYSCALL 1
105 short ktr_code; /* syscall number */
106 short ktr_narg; /* number of arguments */
108 * followed by ktr_narg register_t
110 register_t ktr_args[1];
114 * KTR_SYSRET - return from system call record
121 register_t ktr_retval;
125 * KTR_NAMEI - namei record
128 /* record contains pathname */
131 * KTR_GENIO - trace generic process i/o
138 * followed by data successfully read/written
143 * KTR_PSIG - trace processed signal
154 * KTR_CSW - trace context switches
158 int out; /* 1 if switch out, 0 if switch in */
159 int user; /* 1 if usermode (ivcsw), 0 if kernel (vcsw) */
163 int out; /* 1 if switch out, 0 if switch in */
164 int user; /* 1 if usermode (ivcsw), 0 if kernel (vcsw) */
169 * KTR_USER - data coming from userland
171 #define KTR_USER_MAXLEN 2048 /* maximum length of passed data */
175 * KTR_STRUCT - misc. structs
179 * record contains null-terminated struct name followed by
187 * KTR_SYSCTL - name of a sysctl MIB
190 /* record contains null-terminated MIB name */
193 * KTR_PROCCTOR - trace process creation (multiple ABI support)
195 #define KTR_PROCCTOR 10
196 struct ktr_proc_ctor {
197 u_int sv_flags; /* struct sysentvec sv_flags copy */
201 * KTR_PROCDTOR - trace process destruction (multiple ABI support)
203 #define KTR_PROCDTOR 11
206 * KTR_CAPFAIL - trace capability check failures
208 #define KTR_CAPFAIL 12
209 enum ktr_cap_fail_type {
210 CAPFAIL_NOTCAPABLE, /* insufficient capabilities in cap_check() */
211 CAPFAIL_INCREASE, /* attempt to increase capabilities */
212 CAPFAIL_SYSCALL, /* disallowed system call */
213 CAPFAIL_LOOKUP, /* disallowed VFS lookup */
215 struct ktr_cap_fail {
216 enum ktr_cap_fail_type cap_type;
217 cap_rights_t cap_needed;
218 cap_rights_t cap_held;
222 * KTR_FAULT - page fault record
231 * KTR_FAULTEND - end of page fault record
233 #define KTR_FAULTEND 14
234 struct ktr_faultend {
239 * KTR_STRUCT_ARRAY - array of misc. structs
241 #define KTR_STRUCT_ARRAY 15
242 struct ktr_struct_array {
245 * Followed by null-terminated structure name and then payload
251 * KTR_DROP - If this bit is set in ktr_type, then at least one event
252 * between the previous record and this record was dropped.
254 #define KTR_DROP 0x8000
256 * KTR_VERSIONED - If this bit is set in ktr_type, then the kernel
257 * exposes the new struct ktr_header (versioned), otherwise the old
258 * struct ktr_header_v0 is exposed.
260 #define KTR_VERSIONED 0x4000
261 #define KTR_TYPE (KTR_DROP | KTR_VERSIONED)
264 * kernel trace points (in p_traceflag)
266 #define KTRFAC_MASK 0x00ffffff
267 #define KTRFAC_SYSCALL (1<<KTR_SYSCALL)
268 #define KTRFAC_SYSRET (1<<KTR_SYSRET)
269 #define KTRFAC_NAMEI (1<<KTR_NAMEI)
270 #define KTRFAC_GENIO (1<<KTR_GENIO)
271 #define KTRFAC_PSIG (1<<KTR_PSIG)
272 #define KTRFAC_CSW (1<<KTR_CSW)
273 #define KTRFAC_USER (1<<KTR_USER)
274 #define KTRFAC_STRUCT (1<<KTR_STRUCT)
275 #define KTRFAC_SYSCTL (1<<KTR_SYSCTL)
276 #define KTRFAC_PROCCTOR (1<<KTR_PROCCTOR)
277 #define KTRFAC_PROCDTOR (1<<KTR_PROCDTOR)
278 #define KTRFAC_CAPFAIL (1<<KTR_CAPFAIL)
279 #define KTRFAC_FAULT (1<<KTR_FAULT)
280 #define KTRFAC_FAULTEND (1<<KTR_FAULTEND)
281 #define KTRFAC_STRUCT_ARRAY (1<<KTR_STRUCT_ARRAY)
284 * trace flags (also in p_traceflags)
286 #define KTRFAC_ROOT 0x80000000 /* root set this trace */
287 #define KTRFAC_INHERIT 0x40000000 /* pass trace flags to children */
288 #define KTRFAC_DROP 0x20000000 /* last event was dropped */
291 struct ktr_io_params;
294 struct vnode *ktr_get_tracevp(struct proc *, bool);
296 static inline struct vnode *
297 ktr_get_tracevp(struct proc *p, bool ref)
303 void ktr_io_params_free(struct ktr_io_params *);
304 void ktrnamei(const char *);
305 void ktrcsw(int, int, const char *);
306 void ktrpsig(int, sig_t, sigset_t *, int);
307 void ktrfault(vm_offset_t, int);
308 void ktrfaultend(int);
309 void ktrgenio(int, enum uio_rw, struct uio *, int);
310 void ktrsyscall(int, int narg, syscallarg_t args[]);
311 void ktrsysctl(int *name, u_int namelen);
312 void ktrsysret(int, int, register_t);
313 void ktrprocctor(struct proc *);
314 struct ktr_io_params *ktrprocexec(struct proc *);
315 void ktrprocexit(struct thread *);
316 void ktrprocfork(struct proc *, struct proc *);
317 void ktruserret(struct thread *);
318 void ktrstruct(const char *, const void *, size_t);
319 void ktrstruct_error(const char *, const void *, size_t, int);
320 void ktrstructarray(const char *, enum uio_seg, const void *, int, size_t);
321 void ktrcapfail(enum ktr_cap_fail_type, const cap_rights_t *,
322 const cap_rights_t *);
323 #define ktrcaprights(s) \
324 ktrstruct("caprights", (s), sizeof(cap_rights_t))
325 #define ktritimerval(s) \
326 ktrstruct("itimerval", (s), sizeof(struct itimerval))
327 #define ktrsockaddr(s) \
328 ktrstruct("sockaddr", (s), ((struct sockaddr *)(s))->sa_len)
330 ktrstruct("stat", (s), sizeof(struct stat))
331 #define ktrstat_error(s, error) \
332 ktrstruct_error("stat", (s), sizeof(struct stat), error)
333 #define ktrcpuset(s, l) \
334 ktrstruct("cpuset_t", (s), l)
335 extern u_int ktr_geniosize;
337 extern int ktr_filesize_limit_signal;
339 #define ktr_filesize_limit_signal 0
343 #include <sys/cdefs.h>
346 int ktrace(const char *, int, int, pid_t);
347 int utrace(const void *, size_t);