libsysdecode: add a decoder for pollfd events

We'll use this in another change to read pollfd arrays coming from a
successful poll(2) operation.

Reviewed by: bapt, jhb
Differential Revision: https://reviews.freebsd.org/D44159

Remove $FreeBSD$: one-line .c pattern

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

vm: Allow MAP_32BIT for all architectures

Reviewed by: alc, kib, markj
Differential revision: https://reviews.freebsd.org/D41435

libsysdecode: Decode setitimer, getitimer which argument

Reviewed by: jhb
Differential revision: https://reviews.freebsd.org/D35230
MFC after: 2 weeks

libsysdecode: For future use extract common code to a separate files

Reviewed by: jhb, emaste
Differential revision: https://reviews.freebsd.org/D35353
MFC after: 2 weeks

libsysdecode: Fix decoding of Capsicum rights

Capsicum rights are a bit tricky since some of them are subsets of
others, and one can have rights R1 and R2 such that R1 is a subset of
R2, but there is no collection of named rights whose union is R2. So,
they don't behave like most other flag sets. sysdecode_cap_rights(3)
does not handle this properly and so can emit misleading decodings.

Try to fix all of these problems:
- Include composite rights in the caprights table.
- Use a constructor to sort the caprights table such that "larger"
rights appear first and thus are matched first.
- Don't print rights that are a subset of rights already printed, so as
to minimize the length of the output.
- Print a trailing message if some of the specific rights are not
matched by the table.

PR: 263165
Reviewed by: pauamma_gundo.com (doc), jhb, emaste
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34874

fd: add close_range(..., CLOSE_RANGE_CLOEXEC)

For compatibility with Linux.

MFC after: 3 days
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D34424

libsysdecode: decode _UMTX_OP flags

Assume that UMTX_OP with a double underbar following is a flag, while any
underbar+alphanumeric combination immeiately following is an op.

This was a part of D27325.

Reviewed by: kib

libsysdecode: account for invalid protection flags

Reported by: jhb
MFC with: r368022

libsysdecode: correctly decode mmap flags

r352913 added decoding of mmap PROT_MAX()'d flags but didn’t account for the
case where different values were specified for PROT_MAX and regular flags.
Fix it.

Submitted by: sigsys_gmail.com
Reported by: sigsys_gmail.com
MFC after: 7 days
Differential Revision: https://reviews.freebsd.org/D27312

libsysdecode: grab shmflags from sys/mman.h, add decode method

Any SHM_* flag here is (and likely will continue to be) a shmflag that may
be passed to shm_open2(), with exception to SHM_ANON. This is a prereq to
adding appropriate support to truss/kdump.

Reviewed by: kaktus (slightly earlier version)
Differential Revision: https://reviews.freebsd.org/D23733

libsysdecode: decode PROT_MAX flags

Extend libsysdecode to pretty-print PROT_MAX flags and fix decoding of regular protection flags broken since r349240.

before:
truss:
mmap(0x0,40960,0x30000,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34366234624 (0x800632000)
kdump:
11439 protmax CALL mmap(0,0xa000,0x30000<><invalid>196608,0x21002<MAP_PRIVATE|MAP_ANON|MAP_NOCORE>,0xffffffff,0)

after:
truss:
mmap(0x0,40960,PROT_MAX(PROT_READ|PROT_WRITE)|PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) = 34366234624 (0x800632000)
kdump:
11439 protmax CALL mmap(0,0xa000,0x30000<PROT_MAX(PROT_READ|PROT_WRITE)|PROT_READ|PROT_WRITE>,0x21002<MAP_PRIVATE|MAP_ANON|MAP_NOCORE>,0xffffffff,0)

Reviewed by: kib (mentor)
Approved by: kib (mentor)
Differential Revision: https://reviews.freebsd.org/D21706

Add missing SCTP_EOR entry.

MFC after: 3 days

Add support for decoding the nxt_flags, rcv_flags, and snd_flags of
SCTP level cmsgs.

Add support for decoding the type of a cmsg.

Add a function is decode the sinfo_flags of struct sctp_sndrcvinfo.

Add suppor for the supported PR-SCTP policies.

Decode kevent structures logged via ktrace(2) in kdump.

- Add a new KTR_STRUCT_ARRAY ktrace record type which dumps an array of
structures.

The structure name in the record payload is preceded by a size_t
containing the size of the individual structures. Use this to
replace the previous code that dumped the kevent arrays dumped for
kevent(). kdump is now able to decode the kevent structures rather
than dumping their contents via a hexdump.

One change from before is that the 'changes' and 'events' arrays are
not marked with separate 'read' and 'write' annotations in kdump
output. Instead, the first array is the 'changes' array, and the
second array (only present if kevent doesn't fail with an error) is
the 'events' array. For kevent(), empty arrays are denoted by an
entry with an array containing zero entries rather than no record.

- Move kevent decoding tables from truss to libsysdecode.

This adds three new functions to decode members of struct kevent:
sysdecode_kevent_filter, sysdecode_kevent_flags, and
sysdecode_kevent_fflags.

kdump uses these helper functions to pretty-print kevent fields.

- Move structure definitions for freebsd11 and freebsd32 kevent
structures to <sys/event.h> so that they can be shared with userland.
The 32-bit structures are only exposed if _WANT_KEVENT32 is defined.
The freebsd11 structures are only exposed if _WANT_FREEBSD11_KEVENT is
defined. The 32-bit freebsd11 structure requires both.

- Decode freebsd11 kevent structures in truss for the compat11.kevent()
system call.

- Log 32-bit kevent structures via ktrace for 32-bit compat kevent()
system calls.

- While here, constify the 'void *data' argument to ktrstruct().

Reviewed by: kib (earlier version)
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D12470

Wrap to 80 columns. No functional change.

RB_POWERCYCLE needs to be handled like RB_POWEROFF for decoding.

Sponsored by: Netflix

libsysdecode: report invalid cap_rights_t

Previously we'd have an assertion failure in cap_rights_is_set if
sysdecode_cap_rights is called with an invalid cap_rights_t, so test for
validity first.

PR: 222258
Reviewed by: cem
MFC after: 1 month
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D12391

Decode pathconf() names, *at() flags, and sysarch() numbers in libsysdecode.

Move tables that were previously in truss over to libsysdecode. truss
output is unchanged, but kdump has been updated to decode these fields.
In addition, sysdecode_sysarch_number() should support all platforms
whereas the old table in truss only supported x86.

Improve decoding of RB_AUTOBOOT in the 'howto' argument to reboot().

The reboot() system call accepts a mode (RB_AUTOBOOT, RB_HALT, RB_POWEROFF,
or RB_REROOT) as well as zero or more optional flags in 'howto'.
However, RB_AUTOBOOT was only displayed if 'howto' was exactly 0.
Combinations like 'RB_AUTOBOOT | RB_DUMP' were decoded as 'RB_DUMP'.
Instead, imply that RB_AUTOBOOT was specified if none of the other "mode"
flags were specified.

Decode the 'who' argument passed to getrusage().

Add a new sysdecode_getrusage_who() which decodes the RUSAGE_* constant
passed as the first argument to getrusage(). Use this function in both
kdump and truss to decode the first argument to getrusage().

PR: 215448
Submitted by: Anton Yuzhaninov <citrin+pr@citrin.ru>
MFC after: 1 month

Improve the decoding of the third argument of the socket() call.

Decoding of the third argument depends on the first one. For doing this,
add a corresponding function to libsysdecode.

Thanks to jhb@ for suggesting this.

Add support for socket option names related to the level IPPROTO_UDPLITE.

Add support for socket option names related to the IPPROTO_IPV6 level.

Add support for socket option names related to the IPPROTO_SCTP level.

Fix libsysdecode vmprot flag decoding

Fix the regex used to find vmprot table entries and add the missing include.

This fixes kdumps output of PFLT arguments which would previously look like:
5202 101546 ktrace PFLT 0x5ae000 0x2<><invalid>2

They now display correctly:
5202 101546 ktrace PFLT 0x5ac000 0x2<VM_PROT_WRITE>

MFC after: 1 week

Fix sysdecode_cap_rights which currently prints bogus capability rights

PR: 217787
Reviewed by: jhb, emaste
Approved by: jhb

Update libsysdecode for getfsstat() 'flags' argument changing to 'mode'.

As a followup to r310638, update libsysdecode (and kdump) to decode the
'mode' argument to getfsstat(). sysdecode_getfsstat_flags() has been
renamed to sysdecode_getfsstat_mode() and now treats the argument as an
enumerated value rather than a mask of flags.

Use binary and (&) instead of logical to extract the mask of a capability.

CID: 1365227
Submitted by: cem

Move mksubr from kdump into libsysdecode.

Restructure this script so that it generates a header of tables instead
of a source file. The tables are included in a flags.c source file which
provides functions to decode various system call arguments.

For functions that decode an enumeration, the function returns a pointer
to a string for known values and NULL for unknown values.

For functions that do more complex decoding (typically of a bitmask), the
function accepts a pointer to a FILE object (open_memstream() can be used
as a string builder) to which decoded values are written. If the
function operates on a bitmask, the function returns true if any bits
were decoded or false if the entire value was valid. Additionally, the
third argument accepts a pointer to a value to which any undecoded bits
are stored. This pointer can be NULL if the caller doesn't care about
remaining bits.

Convert kdump over to using decoder functions from libsysdecode instead of
mksubr. truss also uses decoders from libsysdecode instead of private
lookup tables, though lookup tables for objects not decoded by kdump remain
in truss for now. Eventually most of these tables should move into
libsysdecode as the automated table generation approach from mksubr is
less stale than the static tables in truss.

Some changes have been made to truss and kdump output:
- The flags passed to open() are now properly decoded in that one of
O_RDONLY, O_RDWR, O_WRONLY, or O_EXEC is always included in a decoded
mask.
- Optional arguments to open(), openat(), and fcntl() are only printed
in kdump if they exist (e.g. the mode is only printed for open() if
O_CREAT is set in the flags).
- Print argument to F_GETLK/SETLK/SETLKW in kdump as a pointer, not int.
- Include all procctl() commands.
- Correctly decode pipe2() flags in truss by not assuming full
open()-like flags with O_RDONLY, etc.
- Decode file flags passed to *chflags() as file flags (UF_* and SF_*)
rather than as a file mode.
- Fix decoding of quotactl() commands by splitting out the two command
components instead of assuming the raw command value matches the
primary command component.

In addition, truss and kdump now build without triggering any warnings.
All of the sysdecode manpages now include the required headers in the
synopsis.

Reviewed by: kib (several older versions), wblock (manpages)
MFC after: 2 months
Differential Revision: https://reviews.freebsd.org/D7847