2 * SPDX-License-Identifier: BSD-2-Clause
4 * Copyright (c) 2002 Jake Burkholder
5 * Copyright (c) 2004 Robert Watson
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 #include <sys/cdefs.h>
31 #include <sys/types.h>
32 #include <sys/capsicum.h>
37 #include <capsicum_helpers.h>
52 "usage: ktrdump [-cflqrtH] [-i ktrfile] [-M core] [-N system] [-o outfile]\n"
54 static void usage(void) __dead2;
56 static struct nlist nl[] = {
57 { .n_name = "_ktr_version" },
58 { .n_name = "_ktr_entries" },
59 { .n_name = "_ktr_idx" },
60 { .n_name = "_ktr_buf" },
75 static char corefile[PATH_MAX];
76 static char execfile[PATH_MAX];
77 static char outfile[PATH_MAX] = "stdout";
79 static char desc[SBUFLEN];
80 static char errbuf[_POSIX2_LINE_MAX];
81 static char fbuf[PATH_MAX];
82 static char obuf[PATH_MAX];
83 static char sbuf[KTR_PARMS][SBUFLEN];
86 * Reads the ktr trace buffer from kernel memory and prints the trace entries.
89 main(int ac, char **av)
91 u_long parms[KTR_PARMS];
92 struct ktr_entry *buf;
93 uintmax_t tlast, tnow;
110 * Parse commandline arguments.
113 while ((c = getopt(ac, av, "cflqrtHe:i:m:M:N:o:")) != -1)
120 if (strlcpy(execfile, optarg, sizeof(execfile))
122 errx(1, "%s: File name too long", optarg);
130 if ((in = open(optarg, O_RDONLY)) == -1)
131 err(1, "%s", optarg);
132 cap_rights_init(&rights, CAP_FSTAT, CAP_MMAP_R);
133 if (caph_rights_limit(in, &rights) < 0)
134 err(1, "unable to limit rights for %s",
142 if (strlcpy(corefile, optarg, sizeof(corefile))
144 errx(1, "%s: File name too long", optarg);
148 if ((out = fopen(optarg, "w")) == NULL)
149 err(1, "%s", optarg);
150 strlcpy(outfile, optarg, sizeof(outfile));
173 if (caph_limit_stream(fileno(out), CAPH_WRITE) < 0)
174 err(1, "unable to limit rights for %s", outfile);
175 if (caph_limit_stderr() < 0)
176 err(1, "unable to limit rights for stderr");
179 * Open our execfile and corefile, resolve needed symbols and read in
182 if ((kd = kvm_openfiles(Nflag ? execfile : NULL,
183 Mflag ? corefile : NULL, NULL, O_RDONLY, errbuf)) == NULL)
184 errx(1, "%s", errbuf);
187 * Cache NLS data, for strerror, for err(3), before entering capability
190 caph_cache_catpages();
192 count = kvm_nlist(kd, nl);
194 errx(1, "%s", kvm_geterr(kd));
196 errx(1, "failed to resolve ktr symbols");
197 if (kvm_read(kd, nl[0].n_value, &version, sizeof(version)) == -1)
198 errx(1, "%s", kvm_geterr(kd));
199 if (version != KTR_VERSION)
200 errx(1, "ktr version mismatch");
203 * Enter Capsicum sandbox.
205 * kvm_nlist() above uses kldsym(2) for native kernels, and that isn't
206 * allowed in the sandbox.
208 if (caph_enter() < 0)
209 err(1, "unable to enter capability mode");
212 if (fstat(in, &sb) == -1)
214 entries = sb.st_size / sizeof(*buf);
216 buf = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, in, 0);
217 if (buf == MAP_FAILED)
220 if (kvm_read(kd, nl[1].n_value, &entries, sizeof(entries))
222 errx(1, "%s", kvm_geterr(kd));
223 if ((buf = malloc(sizeof(*buf) * entries)) == NULL)
225 if (kvm_read(kd, nl[2].n_value, &index, sizeof(index)) == -1 ||
226 kvm_read(kd, nl[3].n_value, &bufptr,
227 sizeof(bufptr)) == -1 ||
228 kvm_read(kd, bufptr, buf, sizeof(*buf) * entries) == -1 ||
229 kvm_read(kd, nl[2].n_value, &index2, sizeof(index2)) == -1)
230 errx(1, "%s", kvm_geterr(kd));
234 * Print a nice header.
237 fprintf(out, "%-6s ", "index");
239 fprintf(out, "%-3s ", "cpu");
241 fprintf(out, "%-16s ", "timestamp");
243 fprintf(out, "%-40s ", "file and line");
245 fprintf(out, "%-18s ", "tid");
246 fprintf(out, "%s", "trace");
249 fprintf(out, "------ ");
251 fprintf(out, "--- ");
253 fprintf(out, "---------------- ");
256 "---------------------------------------- ");
258 fprintf(out, "------------------ ");
259 fprintf(out, "----- ");
265 * Now tear through the trace buffer.
267 * In "live" mode, find the oldest entry (first non-NULL entry
268 * after index2) and walk forward. Otherwise, start with the
269 * most recent entry and walk backwards.
273 i = index2 + 1 % entries;
274 while (buf[i].ktr_desc == NULL && i != index) {
287 if (buf[i].ktr_desc == NULL)
289 if (kvm_read(kd, (u_long)buf[i].ktr_desc, desc,
291 errx(1, "%s", kvm_geterr(kd));
292 desc[sizeof(desc) - 1] = '\0';
294 for (p = desc; (c = *p++) != '\0';) {
297 next: if ((c = *p++) == '\0')
301 if (parm == KTR_PARMS)
302 errx(1, "too many parameters in \"%s\"", desc);
304 case '0': case '1': case '2': case '3': case '4':
305 case '5': case '6': case '7': case '8': case '9':
306 case '#': case '-': case ' ': case '+': case '\'':
307 case 'h': case 'l': case 'j': case 't': case 'z':
308 case 'q': case 'L': case '.':
311 if (kvm_read(kd, (u_long)buf[i].ktr_parms[parm],
312 sbuf[parm], sizeof(sbuf[parm])) == -1)
313 strcpy(sbuf[parm], "(null)");
314 sbuf[parm][sizeof(sbuf[0]) - 1] = '\0';
315 parms[parm] = (u_long)sbuf[parm];
319 parms[parm] = buf[i].ktr_parms[parm];
324 fprintf(out, "%6d ", i);
326 fprintf(out, "%3d ", buf[i].ktr_cpu);
328 tnow = (uintmax_t)buf[i].ktr_timestamp;
330 if (tlast == UINTPTR_MAX)
332 fprintf(out, "%16ju ", !iflag ? tlast - tnow :
336 fprintf(out, "%16ju ", tnow);
339 if (kvm_read(kd, (u_long)buf[i].ktr_file, fbuf,
341 strcpy(fbuf, "(null)");
342 snprintf(obuf, sizeof(obuf), "%s:%d", fbuf,
344 fprintf(out, "%-40s ", obuf);
347 fprintf(out, "%p ", buf[i].ktr_thread);
348 fprintf(out, desc, parms[0], parms[1], parms[2], parms[3],
353 * 'index' and 'index2' are the values of 'ktr_idx'
354 * before and after the KTR buffer was copied into
355 * 'buf'. Since the KTR entries between 'index' and
356 * 'index2' were in flux while the KTR buffer was
357 * being copied to userspace we don't dump them.
377 * In "live" mode, poll 'ktr_idx' periodically and dump any
378 * new entries since our last pass through the ring.
380 if (lflag && !iflag) {
381 while (index == index2) {
383 if (kvm_read(kd, nl[2].n_value, &index2,
384 sizeof(index2)) == -1)
385 errx(1, "%s", kvm_geterr(kd));
389 if (kvm_read(kd, bufptr, buf, sizeof(*buf) * entries) == -1 ||
390 kvm_read(kd, nl[2].n_value, &index2, sizeof(index2)) == -1)
391 errx(1, "%s", kvm_geterr(kd));
402 fprintf(stderr, USAGE);