Decode kevent structures logged via ktrace(2) in kdump.

- Add a new KTR_STRUCT_ARRAY ktrace record type which dumps an array of
  structures.

  The structure name in the record payload is preceded by a size_t
  containing the size of the individual structures.  Use this to
  replace the previous code that dumped the kevent arrays dumped for
  kevent().  kdump is now able to decode the kevent structures rather
  than dumping their contents via a hexdump.

  One change from before is that the 'changes' and 'events' arrays are
  not marked with separate 'read' and 'write' annotations in kdump
  output.  Instead, the first array is the 'changes' array, and the
  second array (only present if kevent doesn't fail with an error) is
  the 'events' array.  For kevent(), empty arrays are denoted by an
  entry with an array containing zero entries rather than no record.

- Move kevent decoding tables from truss to libsysdecode.

  This adds three new functions to decode members of struct kevent:
  sysdecode_kevent_filter, sysdecode_kevent_flags, and
  sysdecode_kevent_fflags.

  kdump uses these helper functions to pretty-print kevent fields.

- Move structure definitions for freebsd11 and freebsd32 kevent
  structures to <sys/event.h> so that they can be shared with userland.
  The 32-bit structures are only exposed if _WANT_KEVENT32 is defined.
  The freebsd11 structures are only exposed if _WANT_FREEBSD11_KEVENT is
  defined.  The 32-bit freebsd11 structure requires both.

- Decode freebsd11 kevent structures in truss for the compat11.kevent()
  system call.

- Log 32-bit kevent structures via ktrace for 32-bit compat kevent()
  system calls.

- While here, constify the 'void *data' argument to ktrstruct().

Reviewed by:	kib (earlier version)
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D12470

6 files changed, 249 insertions, 1 deletions

diff --git a/lib/libsysdecode/Makefile b/lib/libsysdecode/Makefile
index b87fd979a987..a4c58e42a583 100644
--- a/lib/libsysdecode/Makefile
+++ b/lib/libsysdecode/Makefile
@@ -17,6 +17,7 @@ MAN=	sysdecode.3 \
 	sysdecode_cap_rights.3 \
 	sysdecode_enum.3 \
 	sysdecode_fcntl_arg.3 \
+	sysdecode_kevent.3 \
 	sysdecode_ioctlname.3 \
 	sysdecode_mask.3 \
 	sysdecode_quotactl_cmd.3 \
@@ -69,6 +70,9 @@ MLINKS+=sysdecode_enum.3 sysdecode_acltype.3 \
 	sysdecode_enum.3 sysdecode_vmresult.3 \
 	sysdecode_enum.3 sysdecode_whence.3
 MLINKS+=sysdecode_fcntl_arg.3 sysdecode_fcntl_arg_p.3
+MLINKS+=sysdecode_kevent.3 sysdecode_kevent_fflags.3 \
+	sysdecode_kevent.3 sysdecode_kevent_filter.3 \
+	sysdecode_kevent.3 sysdecode_kevent_flags.3
 MLINKS+=sysdecode_mask.3 sysdecode_accessmode.3 \
 	sysdecode_mask.3 sysdecode_atflags.3 \
 	sysdecode_mask.3 sysdecode_capfcntlrights.3 \
diff --git a/lib/libsysdecode/flags.c b/lib/libsysdecode/flags.c
index b2fc375513c2..d6b8f2874f6b 100644
--- a/lib/libsysdecode/flags.c
+++ b/lib/libsysdecode/flags.c
@@ -31,6 +31,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/types.h>
 #include <sys/acl.h>
 #include <sys/capsicum.h>
+#include <sys/event.h>
 #include <sys/extattr.h>
 #include <sys/linker.h>
 #include <sys/mman.h>
@@ -501,6 +502,116 @@ sysdecode_getrusage_who(int who)
 	return (lookup_value(rusage, who));
 }
 
+static struct name_table kevent_user_ffctrl[] = {
+	X(NOTE_FFNOP) X(NOTE_FFAND) X(NOTE_FFOR) X(NOTE_FFCOPY)
+	XEND
+};
+
+static struct name_table kevent_rdwr_fflags[] = {
+	X(NOTE_LOWAT) X(NOTE_FILE_POLL) XEND
+};
+
+static struct name_table kevent_vnode_fflags[] = {
+	X(NOTE_DELETE) X(NOTE_WRITE) X(NOTE_EXTEND) X(NOTE_ATTRIB)
+	X(NOTE_LINK) X(NOTE_RENAME) X(NOTE_REVOKE) X(NOTE_OPEN) X(NOTE_CLOSE)
+	X(NOTE_CLOSE_WRITE) X(NOTE_READ) XEND
+};
+
+static struct name_table kevent_proc_fflags[] = {
+	X(NOTE_EXIT) X(NOTE_FORK) X(NOTE_EXEC) X(NOTE_TRACK) X(NOTE_TRACKERR)
+	X(NOTE_CHILD) XEND
+};
+
+static struct name_table kevent_timer_fflags[] = {
+	X(NOTE_SECONDS) X(NOTE_MSECONDS) X(NOTE_USECONDS) X(NOTE_NSECONDS)
+	X(NOTE_ABSTIME) XEND
+};
+
+void
+sysdecode_kevent_fflags(FILE *fp, short filter, int fflags, int base)
+{
+	int rem;
+
+	if (fflags == 0) {
+		fputs("0", fp);
+		return;
+	}
+
+	switch (filter) {
+	case EVFILT_READ:
+	case EVFILT_WRITE:
+		if (!print_mask_int(fp, kevent_rdwr_fflags, fflags, &rem))
+			fprintf(fp, "%#x", rem);
+		else if (rem != 0)
+			fprintf(fp, "|%#x", rem);
+		break;
+	case EVFILT_VNODE:
+		if (!print_mask_int(fp, kevent_vnode_fflags, fflags, &rem))
+			fprintf(fp, "%#x", rem);
+		else if (rem != 0)
+			fprintf(fp, "|%#x", rem);
+		break;
+	case EVFILT_PROC:
+	case EVFILT_PROCDESC:
+		if (!print_mask_int(fp, kevent_proc_fflags, fflags, &rem))
+			fprintf(fp, "%#x", rem);
+		else if (rem != 0)
+			fprintf(fp, "|%#x", rem);
+		break;
+	case EVFILT_TIMER:
+		if (!print_mask_int(fp, kevent_timer_fflags, fflags, &rem))
+			fprintf(fp, "%#x", rem);
+		else if (rem != 0)
+			fprintf(fp, "|%#x", rem);
+		break;
+	case EVFILT_USER: {
+		unsigned int ctrl, data;
+
+		ctrl = fflags & NOTE_FFCTRLMASK;
+		data = fflags & NOTE_FFLAGSMASK;
+
+		if (fflags & NOTE_TRIGGER) {
+			fputs("NOTE_TRIGGER", fp);
+			if (fflags == NOTE_TRIGGER)
+				return;
+			fputc('|', fp);
+		}
+
+		/*
+		 * An event with 'ctrl' == NOTE_FFNOP is either a reported
+		 * (output) event for which only 'data' should be output
+		 * or a pointless input event.  Assume that pointless
+		 * input events don't occur in practice.  An event with
+		 * NOTE_TRIGGER is always an input event.
+		 */
+		if (ctrl != NOTE_FFNOP || fflags & NOTE_TRIGGER) {
+			fprintf(fp, "%s|%#x",
+			    lookup_value(kevent_user_ffctrl, ctrl), data);
+		} else {
+			print_integer(fp, data, base);
+		}
+		break;
+	}
+	default:
+		print_integer(fp, fflags, base);
+		break;
+	}
+}
+
+bool
+sysdecode_kevent_flags(FILE *fp, int flags, int *rem)
+{
+
+	return (print_mask_int(fp, keventflags, flags, rem));
+}
+
+const char *
+sysdecode_kevent_filter(int filter)
+{
+
+	return (lookup_value(keventfilters, filter));
+}
+
 const char *
 sysdecode_kldsym_cmd(int cmd)
 {
diff --git a/lib/libsysdecode/mktables b/lib/libsysdecode/mktables
index c43bcab1e90f..7353262e70fa 100644
--- a/lib/libsysdecode/mktables
+++ b/lib/libsysdecode/mktables
@@ -107,6 +107,8 @@ gen_table "mmapprot"        "PROT_[A-Z]+[[:space:]]+0x[0-9A-Fa-f]+"        "sys/
 gen_table "ngbtsolevel"     "SOL_[A-Z0-9]+[[:space:]]+0x[0-9A-Fa-f]+"      "netgraph/bluetooth/include/ng_btsocket.h"
 gen_table "fileflags"       "[SU]F_[A-Z]+[[:space:]]+0x[0-9A-Fa-f]+"       "sys/stat.h"		"UF_COMPRESSED|UF_TRACKED|UF_SETTABLE|SF_SETTABLE"
 gen_table "filemode"        "S_[A-Z]+[[:space:]]+[0-6]{7}"                 "sys/stat.h"
+gen_table "keventflags"     "EV_[A-Z]+[[:space:]]+0x[0-9]+"                "sys/event.h"        "EV_SYSFLAGS|EV_DROP|EV_FLAG[12]"
+gen_table "keventfilters"   "EVFILT_[A-Z]+[[:space:]]+\(-[0-9]+\)"         "sys/event.h"
 gen_table "mountflags"      "MNT_[A-Z]+[[:space:]]+0x[0-9]+"               "sys/mount.h"
 gen_table "msyncflags"      "MS_[A-Z]+[[:space:]]+0x[0-9]+"                "sys/mman.h"
 gen_table "nfssvcflags"     "NFSSVC_[A-Z0-9]+[[:space:]]+0x[0-9]+"         "nfs/nfssvc.h"
diff --git a/lib/libsysdecode/sysdecode.3 b/lib/libsysdecode/sysdecode.3
index 7158b0a0fd65..e84681f2e7ff 100644
--- a/lib/libsysdecode/sysdecode.3
+++ b/lib/libsysdecode/sysdecode.3
@@ -25,7 +25,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd June 3, 2017
+.Dd November 24, 2017
 .Dt SYSDECODE 3
 .Os
 .Sh NAME
@@ -73,6 +73,7 @@ A placeholder for use when the ABI is not known.
 .Xr sysdecode_enum 3 ,
 .Xr sysdecode_fcntl_arg 3 ,
 .Xr sysdecode_ioctlname 3 ,
+.Xr sysdecode_kevent 3 ,
 .Xr sysdecode_mask 3 ,
 .Xr sysdecode_quotactl_cmd 3 ,
 .Xr sysdecode_sigcode 3 ,
diff --git a/lib/libsysdecode/sysdecode.h b/lib/libsysdecode/sysdecode.h
index ea6cd341349d..f766f0c149d9 100644
--- a/lib/libsysdecode/sysdecode.h
+++ b/lib/libsysdecode/sysdecode.h
@@ -60,6 +60,10 @@ const char *sysdecode_getrusage_who(int _who);
 const char *sysdecode_idtype(int _idtype);
 const char *sysdecode_ioctlname(unsigned long _val);
 const char *sysdecode_ipproto(int _protocol);
+void	sysdecode_kevent_fflags(FILE *_fp, short _filter, int _fflags,
+	    int _base);
+const char *sysdecode_kevent_filter(int _filter);
+bool	sysdecode_kevent_flags(FILE *_fp, int _flags, int *_rem);
 const char *sysdecode_kldsym_cmd(int _cmd);
 const char *sysdecode_kldunload_flags(int _flags);
 const char *sysdecode_lio_listio_mode(int _mode);
diff --git a/lib/libsysdecode/sysdecode_kevent.3 b/lib/libsysdecode/sysdecode_kevent.3
new file mode 100644
index 000000000000..18dfbc5fea1c
--- /dev/null
+++ b/lib/libsysdecode/sysdecode_kevent.3
@@ -0,0 +1,126 @@
+.\"
+.\" Copyright (c) 2017 John Baldwin <jhb@FreeBSD.org>
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd November 24, 2017
+.Dt sysdecode_kevent 3
+.Os
+.Sh NAME
+.Nm sysdecode_kevent ,
+.Nm sysdecode_kevent_fflags ,
+.Nm sysdecode_kevent_filter ,
+.Nm sysdecode_kevent_flags
+.Nd output description of kevent structure fields
+.Sh LIBRARY
+.Lb libsysdecode
+.Sh SYNOPSIS
+.In sys/types.h
+.In stdbool.h
+.In stdio.h
+.In sysdecode.h
+.Ft void
+.Fn sysdecode_kevent_fflags "FILE *fp" "short filter" "int fflags" "int base"
+.Ft bool
+.Fn sysdecode_kevent_flags "FILE *fp" "int flags" "int *rem"
+.Ft const char *
+.Fn sysdecode_kevent_filter "int filter"
+.Sh DESCRIPTION
+These functions provide text descriptions of
+.Vt struct kevent
+fields.
+.Pp
+The
+.Fn sysdecode_kevent_fflags
+function outputs a text description of the
+.Fa fflags
+member of a
+.Vt struct kevent
+to the stream
+.Fa fp .
+For the
+.Dv EVFILT_READ ,
+.Dv EVFILT_WRITE ,
+.Dv EVFILT_VNODE ,
+.Dv EVFILT_PROC ,
+.Dv EVFILT_PROCDESC ,
+.Dv EVFILT_TIMER ,
+and
+.Dv EVFILT_USER
+filters,
+.Fn sysdecode_kevent_fflags
+outputs a bitmask of filter-specific
+.Dv NOTE_*
+flags as documented in
+.Xr kevent 2 .
+For other values of
+.Fa filter ,
+the value of
+.Fa fflags
+is output in the indicated
+.Fa base
+.Pq one of 8, 10, or 16 .
+.Pp
+The
+.Fn sysdecode_kevent_filter
+function returns a text description of the
+.Fa filter
+member of a
+.Vt struct kevent .
+.Dv NULL
+is returned if the
+.Fa filter
+value is unknown.
+.Pp
+The
+.Fn sysdecode_kevent_flags
+function outputs a text description of the
+.Fa flags
+member of a
+.Vt struct kevent
+to the stream
+.Fa fp .
+This function uses the same calling convention and formatting as the other
+functions described in
+.Xr sysdecode_mask 3 .
+.Sh RETURN VALUES
+The
+.Nm sysdecode_kevent_filter
+function returns the name of a filter or
+.Dv NULL if the filter value is unknown.
+.Pp
+The
+.Nm sysdecode_kevent_flags
+function returns
+.Dv true
+if any flags in the
+.Fa flags
+field were decoded and
+.Dv false
+if no flags were decoded.
+.Sh SEE ALSO
+.Xr sysdecode 3 ,
+.Xr sysdecode_enum 3 ,
+.Xr sysdecode_mask 3