/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
 * Copyright (c) 2013, Joyent, Inc. All rights reserved.
 * Copyright 2024 Oxide Computer Co.
 */

#include <alloca.h>
#include <unistd.h>
#include <limits.h>
#include <strings.h>
#include <stdlib.h>
#include <stdarg.h>
#include <stdio.h>
#include <errno.h>
#include <time.h>
#include <ctype.h>
#include <regex.h>
#include <dirent.h>
#include <pthread.h>

#include <fmdump.h>

#define FMDUMP_EXIT_SUCCESS     0
#define FMDUMP_EXIT_FATAL       1
#define FMDUMP_EXIT_USAGE       2
#define FMDUMP_EXIT_ERROR       3

const char *g_pname;
ulong_t g_errs;
ulong_t g_recs;
char *g_root;

struct topo_hdl *g_thp;
fmd_msg_hdl_t *g_msg;

/*PRINTFLIKE2*/
void
fmdump_printf(FILE *fp, const char *format, ...)
{
        va_list ap;

        va_start(ap, format);

        if (vfprintf(fp, format, ap) < 0) {
                (void) fprintf(stderr, "%s: failed to print record: %s\n",
                    g_pname, strerror(errno));
                g_errs++;
        }

        va_end(ap);
}

void
fmdump_vwarn(const char *format, va_list ap)
{
        int err = errno;

        (void) fprintf(stderr, "%s: warning: ", g_pname);
        (void) vfprintf(stderr, format, ap);

        if (strchr(format, '\n') == NULL)
                (void) fprintf(stderr, ": %s\n", strerror(err));

        g_errs++;
}

/*PRINTFLIKE1*/
void
fmdump_warn(const char *format, ...)
{
        va_list ap;

        va_start(ap, format);
        fmdump_vwarn(format, ap);
        va_end(ap);
}

static void
fmdump_exit(int err, int exitcode, const char *format, va_list ap)
{
        (void) fprintf(stderr, "%s: ", g_pname);

        (void) vfprintf(stderr, format, ap);

        if (strchr(format, '\n') == NULL)
                (void) fprintf(stderr, ": %s\n", strerror(err));

        exit(exitcode);
}

/*PRINTFLIKE1*/
static void
fmdump_fatal(const char *format, ...)
{
        int err = errno;

        va_list ap;

        va_start(ap, format);
        fmdump_exit(err, FMDUMP_EXIT_FATAL, format, ap);
        va_end(ap);
}

/*PRINTFLIKE1*/
static void
fmdump_usage(const char *format, ...)
{

        int err = errno;

        va_list ap;

        va_start(ap, format);
        fmdump_exit(err, FMDUMP_EXIT_USAGE, format, ap);
        va_end(ap);
}

char *
fmdump_date(char *buf, size_t len, const fmd_log_record_t *rp)
{
        if (rp->rec_sec > LONG_MAX) {
                fmdump_warn("record time is too large for 32-bit utility\n");
                (void) snprintf(buf, len, "0x%llx", rp->rec_sec);
        } else {
                time_t tod = (time_t)rp->rec_sec;
                time_t now = time(NULL);
                if (tod > now+60 ||
                    tod < now - 6L*30L*24L*60L*60L) { /* 6 months ago */
                        (void) strftime(buf, len, "%b %d %Y %T",
                            localtime(&tod));
                } else {
                        size_t sz;
                        sz = strftime(buf, len, "%b %d %T", localtime(&tod));
                        (void) snprintf(buf + sz, len - sz, ".%4.4llu",
                            rp->rec_nsec / (NANOSEC / 10000));
                }
        }

        return (buf);
}

char *
fmdump_year(char *buf, size_t len, const fmd_log_record_t *rp)
{
#ifdef _ILP32
        if (rp->rec_sec > LONG_MAX) {
                fmdump_warn("record time is too large for 32-bit utility\n");
                (void) snprintf(buf, len, "0x%llx", rp->rec_sec);
        } else {
#endif
                time_t tod = (time_t)rp->rec_sec;
                (void) strftime(buf, len, "%b %d %Y %T", localtime(&tod));
#ifdef _ILP32
        }
#endif
        return (buf);
}

/* BEGIN CSTYLED */
static const char *synopsis =
"Usage: %s [[-e | -i | -I | -u] | -A ] [-f] [-aHmvVp] [-c class] [-R root]\n"
        "\t      [-t time] [-T time] [-u uuid] [-n name[.name]*[=value]]\n"
        "\t      [-N name[.name]*[=value][;name[.name]*[=value]]*] "
                                                        "[file]...\n    "
    "Log selection: [-e | -i | -I] or one [file]; default is the fault log\n"
        "\t-e  display error log content\n"
        "\t-i  display infolog content\n"
        "\t-I  display the high-value-infolog content\n"
        "\t-R  set root directory for pathname expansions\n    "
    "Command behaviour:\n"
        "\t-A  Aggregate specified [file]s or, if no [file], all known logs\n"
        "\t-H  display the log's header attributes instead of contents\n"
        "\t-f  follow growth of log file by waiting for additional data\n    "
    "Output options:\n"
        "\t-j  Used with -V: emit JSON-formatted output\n"
        "\t-m  display human-readable messages (only for fault logs)\n"
        "\t-p  Used with -V: apply some output prettification\n"
        "\t-v  set verbose mode: display additional event detail\n"
        "\t-V  set very verbose mode: display complete event contents\n    "
    "Selection filters:\n"
        "\t-a  select all events, including normally silent events\n"
        "\t-c  select events that match the specified class\n"
        "\t-n  select events containing named nvpair (with matching value)\n"
        "\t-N  select events matching multiple property names (or nvpairs)\n"
        "\t-t  select events that occurred after the specified time\n"
        "\t-T  select events that occurred before the specified time\n"
        "\t-u  select events that match the specified diagnosis uuid\n";
/* END CSTYLED */

static int
usage(FILE *fp)
{
        (void) fprintf(fp, synopsis, g_pname);
        return (FMDUMP_EXIT_USAGE);
}

/*ARGSUSED*/
static int
error(fmd_log_t *lp, void *private)
{
        fmdump_warn("skipping record: %s\n",
            fmd_log_errmsg(lp, fmd_log_errno(lp)));
        return (0);
}

/*
 * Yet another disgusting argument parsing function (TM).  We attempt to parse
 * a time argument in a variety of strptime(3C) formats, in which case it is
 * interpreted as a local time and is converted to a timeval using mktime(3C).
 * If those formats fail, we look to see if the time is a decimal integer
 * followed by one of our magic suffixes, in which case the time is interpreted
 * as a time delta *before* the current time-of-day (i.e. "1h" = "1 hour ago").
 */
static struct timeval *
gettimeopt(const char *arg)
{
        const struct {
                const char *name;
                hrtime_t mul;
        } suffix[] = {
                { "ns",         NANOSEC / NANOSEC },
                { "nsec",       NANOSEC / NANOSEC },
                { "us",         NANOSEC / MICROSEC },
                { "usec",       NANOSEC / MICROSEC },
                { "ms",         NANOSEC / MILLISEC },
                { "msec",       NANOSEC / MILLISEC },
                { "s",          NANOSEC / SEC },
                { "sec",        NANOSEC / SEC },
                { "m",          NANOSEC * (hrtime_t)60 },
                { "min",        NANOSEC * (hrtime_t)60 },
                { "h",          NANOSEC * (hrtime_t)(60 * 60) },
                { "hour",       NANOSEC * (hrtime_t)(60 * 60) },
                { "d",          NANOSEC * (hrtime_t)(24 * 60 * 60) },
                { "day",        NANOSEC * (hrtime_t)(24 * 60 * 60) },
                { NULL }
        };

        struct timeval *tvp = malloc(sizeof (struct timeval));
        struct timeval tod;
        struct tm tm;
        char *p;

        if (tvp == NULL)
                fmdump_fatal("failed to allocate memory");

        if (gettimeofday(&tod, NULL) != 0)
                fmdump_fatal("failed to get tod");

        /*
         * First try a variety of strptime() calls.  If these all fail, we'll
         * try parsing an integer followed by one of our suffix[] strings.
         */
        if ((p = strptime(arg, "%m/%d/%Y %H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%m/%d/%y %H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%m/%d/%Y %H:%M", &tm)) == NULL &&
            (p = strptime(arg, "%m/%d/%y %H:%M", &tm)) == NULL &&
            (p = strptime(arg, "%m/%d/%Y", &tm)) == NULL &&
            (p = strptime(arg, "%m/%d/%y", &tm)) == NULL &&
            (p = strptime(arg, "%Y-%m-%dT%H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%y-%m-%dT%H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%Y-%m-%dT%H:%M", &tm)) == NULL &&
            (p = strptime(arg, "%y-%m-%dT%H:%M", &tm)) == NULL &&
            (p = strptime(arg, "%Y-%m-%d", &tm)) == NULL &&
            (p = strptime(arg, "%y-%m-%d", &tm)) == NULL &&
            (p = strptime(arg, "%d%b%Y %H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%d%b%y %H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%d%b%Y %H:%M", &tm)) == NULL &&
            (p = strptime(arg, "%d%b%y %H:%M", &tm)) == NULL &&
            (p = strptime(arg, "%d%b%Y", &tm)) == NULL &&
            (p = strptime(arg, "%d%b%y", &tm)) == NULL &&
            (p = strptime(arg, "%b %d %H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%b %d %H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%H:%M:%S", &tm)) == NULL &&
            (p = strptime(arg, "%H:%M", &tm)) == NULL) {

                hrtime_t nsec;
                int i;

                errno = 0;
                nsec = strtol(arg, (char **)&p, 10);

                if (errno != 0 || nsec == 0 || p == arg || *p == '\0')
                        fmdump_usage("illegal time format -- %s\n", arg);

                for (i = 0; suffix[i].name != NULL; i++) {
                        if (strcasecmp(suffix[i].name, p) == 0) {
                                nsec *= suffix[i].mul;
                                break;
                        }
                }

                if (suffix[i].name == NULL)
                        fmdump_usage("illegal time format -- %s\n", arg);

                tvp->tv_sec = nsec / NANOSEC;
                tvp->tv_usec = (nsec % NANOSEC) / (NANOSEC / MICROSEC);

                if (tvp->tv_sec > tod.tv_sec)
                        fmdump_usage("time delta precedes UTC time origin "
                            "-- %s\n", arg);

                tvp->tv_sec = tod.tv_sec - tvp->tv_sec;

        } else if (*p == '\0' || *p == '.') {
                /*
                 * If tm_year is zero, we matched [%b %d] %H:%M[:%S]; use
                 * the result of localtime(&tod.tv_sec) to fill in the rest.
                 */
                if (tm.tm_year == 0) {
                        int h = tm.tm_hour;
                        int m = tm.tm_min;
                        int s = tm.tm_sec;
                        int b = tm.tm_mon;
                        int d = tm.tm_mday;

                        bcopy(localtime(&tod.tv_sec), &tm, sizeof (tm));
                        tm.tm_isdst = 0; /* see strptime(3C) and below */

                        if (d > 0) {
                                tm.tm_mon = b;
                                tm.tm_mday = d;
                        }

                        tm.tm_hour = h;
                        tm.tm_min = m;
                        tm.tm_sec = s;
                }

                errno = 0;
                tvp->tv_sec = mktime(&tm);
                tvp->tv_usec = 0;

                if (tvp->tv_sec == -1L && errno != 0)
                        fmdump_fatal("failed to compose time %s", arg);

                /*
                 * If our mktime() set tm_isdst, adjust the result for DST by
                 * subtracting the offset between the main and alternate zones.
                 */
                if (tm.tm_isdst)
                        tvp->tv_sec -= timezone - altzone;

                if (p[0] == '.') {
                        arg = p;
                        errno = 0;
                        tvp->tv_usec =
                            (suseconds_t)(strtod(arg, &p) * (double)MICROSEC);

                        if (errno != 0 || p == arg || *p != '\0')
                                fmdump_usage("illegal time suffix -- .%s\n",
                                    arg);
                }

        } else {
                fmdump_usage("unexpected suffix after time %s -- %s\n", arg, p);
        }

        return (tvp);
}

/*
 * If the -u option is specified in combination with the -e option, we iterate
 * over each record in the fault log with a matching UUID finding xrefs to the
 * error log, and then use this function to iterate over every xref'd record.
 */
int
xref_iter(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
{
        const fmd_log_record_t *xrp = rp->rec_xrefs;
        fmdump_arg_t *dap = arg;
        int i, rv = 0;

        for (i = 0; rv == 0 && i < rp->rec_nrefs; i++, xrp++) {
                if (fmd_log_filter(lp, dap->da_fc, dap->da_fv, xrp))
                        rv = dap->da_fmt->do_func(lp, xrp, dap->da_fp);
        }

        return (rv);
}

int
xoff_iter(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
{
        fmdump_lyr_t *dyp = arg;

        fmdump_printf(dyp->dy_fp, "%16llx ", (u_longlong_t)rp->rec_off);
        return (dyp->dy_func(lp, rp, dyp->dy_arg));
}

/*
 * Initialize fmd_log_filter_nvarg_t from -n name=value argument string.
 */
static fmd_log_filter_nvarg_t *
setupnamevalue(char *namevalue)
{
        fmd_log_filter_nvarg_t  *argt;
        char                    *value;
        regex_t                 *value_regex = NULL;
        char                    errstr[128];
        int                     rv;

        if ((value = strchr(namevalue, '=')) == NULL) {
                value_regex = NULL;
        } else {
                *value++ = '\0';        /* separate name and value string */

                /*
                 * Skip white space before value to facilitate direct
                 * cut/paste from previous fmdump output.
                 */
                while (isspace(*value))
                        value++;

                if ((value_regex = malloc(sizeof (regex_t))) == NULL)
                        fmdump_fatal("failed to allocate memory");

                /* compile regular expression for possible string match */
                if ((rv = regcomp(value_regex, value,
                    REG_NOSUB|REG_NEWLINE)) != 0) {
                        (void) regerror(rv, value_regex, errstr,
                            sizeof (errstr));
                        free(value_regex);
                        fmdump_usage("unexpected regular expression in "
                            "%s: %s\n", value, errstr);
                }
        }

        if ((argt = calloc(1, sizeof (fmd_log_filter_nvarg_t))) == NULL)
                fmdump_fatal("failed to allocate memory");

        argt->nvarg_name = namevalue;           /* now just name */
        argt->nvarg_value = value;
        argt->nvarg_value_regex = value_regex;
        return (argt);
}

/*
 * As for setupnamevalue() above, create our chain of filter arguments for -N
 * [name[=value][;name[=value]]*.  This would be simple except for the problems
 * of escaping something in a string.  To accommodate the use of the ; within
 * the chain, we allow it to be escaped.  One might imagine that the backslash
 * character should be used to escape it, but that opens Pandora's box because
 * the value portion of each entry (if present) is allowed to be a regex.  The
 * treatment of backslashes within regexes is not something we want to replicate
 * here, which would be necessary if we wanted to allow escaping the ; with a
 * backslash.  Specifically, consider how we treat the sequence of characters
 * '\\;x' (two backslash characters followed by a semicolon and then some other
 * character x).  In the name portion of the entry, this would be a backslash
 * followed by an escaped semicolon, so that we would treat this as '\;' and
 * include x and subsequent characters in this entry.  In the value portion (if
 * present), we would have to treat it as a pair of backslashes followed by the
 * terminating ; and the next entry would begin with 'x'...  except that we
 * might be inside [] where the backslash is not special, and so on.
 *
 * Let's not do that.  Instead, we allow the user to 'escape' the ; by repeating
 * it, and we interpret that before any regex interpretation is done.  Therefore
 * *every* pair of consecutive semicolons, regardless of where it appears, is
 * replaced by a literal semicolon.  This allows the semicolon to appear any
 * number of times in either the name or, if present, the value, including as
 * part of a regex (see regexp(7)), simply by doubling it.  A non-doubled
 * semicolon always terminates the entry.  This now creates one more problem:
 * whether to treat ';;;' as a literal semicolon followed by the entry
 * terminator, or the entry terminator followed by a literal semicolon to start
 * the next entry.  Here we have to cheat a little: it's clear from the FMD PRM
 * (especially chapter 10 as well as the schema for module properties, buffers,
 * statistics, and other entities) that the event member namespace is intended
 * to exclude both the semicolon and whitespace.  A value, or a regex intended
 * to match values, might well include anything.  Therefore, a semicolon at the
 * beginning of an entry is unlikely to be useful, while one at the end of an
 * entry may well be intentional.  We'll allow either or both when unambiguous,
 * but a sequence containing an odd number of consecutive ';' characters will be
 * interpreted as half that number of literal semicolons (rounded down) followed
 * by the terminator.  If the user wishes to begin an event property name with a
 * semicolon, it needs to be the first property in the chain.  Chains with
 * multiple properties whose names begin with a literal semicolon are not
 * supported.  Again, this almost certainly can never matter as no event should
 * ever have a property whose name contains a semicolon.
 *
 * We choose the semicolon because the comma is very likely to be present in
 * some property values on which the user may want to filter, especially the
 * name of device paths.  The semicolon may itself appear in values, especially
 * if the property is a URI, though it is likely much less common.  We have to
 * pick something.  If this proves unwieldy or insufficiently expressive, it
 * will need to be replaced by a full-on logical expression parser with
 * first-class support for internal quoting, escaping, and regexes.  One might
 * be better off dumping JSON and importing it into a SQL database if that level
 * of complexity is required.
 */

static fmd_log_filter_nvarg_t *
setupnamevalue_multi(char *chainstr)
{
        fmd_log_filter_nvarg_t *argchain = NULL;
        size_t rem = strlen(chainstr) + 1;
        fmd_log_filter_nvarg_t *argt;

        /*
         * Here, rem holds the number of characters remaining that we are
         * permitted to examine, including the terminating NUL.  If the first
         * entry begins with a single semicolon, it is considered empty and
         * ignored.  Similarly, a trailing semicolon is optional and ignored if
         * present.  We won't create empty filter entries for any input.
         */
        for (char *nv = chainstr; rem > 0; ++chainstr, --rem) {
                switch (*chainstr) {
                case ';':
                        ASSERT(rem > 1);

                        /*
                         * Check for double-semicolon.  If found,
                         * de-duplicate it and advance past, then continue the
                         * loop: we can't be done yet.
                         */
                        if (chainstr[1] == ';') {
                                ASSERT(rem > 2);
                                --rem;
                                (void) memmove(chainstr, chainstr + 1, rem);
                                break;
                        }

                        *chainstr = '\0';

                        /*FALLTHROUGH*/
                case '\0':
                        if (chainstr != nv) {
                                argt = setupnamevalue(nv);
                                argt->nvarg_next = argchain;
                                argchain = argt;
                        }
                        nv = chainstr + 1;

                        /*FALLTHROUGH*/
                default:
                        ASSERT(rem > 0);
                }
        }

        return (argchain);
}

/*
 * If the -a option is not present, filter out fault records that correspond
 * to events that the producer requested not be messaged for administrators.
 */
/*ARGSUSED*/
int
log_filter_silent(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
{
        int opt_A = (arg != NULL);
        boolean_t msg;
        char *class;

        /*
         * If -A was used then apply this filter only to events of list class
         */
        if (opt_A) {
                if (nvlist_lookup_string(rp->rec_nvl, FM_CLASS, &class) != 0 ||
                    strncmp(class, FM_LIST_EVENT ".",
                    sizeof (FM_LIST_EVENT)) != 0)
                        return (1);
        }

        return (nvlist_lookup_boolean_value(rp->rec_nvl,
            FM_SUSPECT_MESSAGE, &msg) != 0 || msg != 0);
}

struct loglink {
        char            *path;
        long            suffix;
        struct loglink  *next;
};

static void
addlink(struct loglink **llp, char *dirname, char *logname, long suffix)
{
        struct loglink *newp;
        size_t len;
        char *str;

        newp = malloc(sizeof (struct loglink));
        len = strlen(dirname) + strlen(logname) + 2;
        str = malloc(len);
        if (newp == NULL || str == NULL)
                fmdump_fatal("failed to allocate memory");

        (void) snprintf(str, len, "%s/%s", dirname, logname);
        newp->path = str;
        newp->suffix = suffix;

        while (*llp != NULL && suffix < (*llp)->suffix)
                llp = &(*llp)->next;

        newp->next = *llp;
        *llp = newp;
}

/*
 * Find and return all the rotated logs.
 */
static struct loglink *
get_rotated_logs(char *logpath)
{
        char dirname[PATH_MAX], *logname, *endptr;
        DIR *dirp;
        struct dirent *dp;
        long len, suffix;
        struct loglink *head = NULL;

        (void) strlcpy(dirname, logpath, sizeof (dirname));
        logname = strrchr(dirname, '/');
        *logname++ = '\0';
        len = strlen(logname);

        if ((dirp = opendir(dirname)) == NULL) {
                fmdump_warn("failed to opendir `%s'", dirname);
                g_errs++;
                return (NULL);
        }

        while ((dp = readdir(dirp)) != NULL) {
                /*
                 * Search the log directory for logs named "<logname>.0",
                 * "<logname>.1", etc and add to the link in the
                 * reverse numeric order.
                 */
                if (strlen(dp->d_name) < len + 2 ||
                    strncmp(dp->d_name, logname, len) != 0 ||
                    dp->d_name[len] != '.')
                        continue;

                /*
                 * "*.0-" file normally should not be seen.  It may
                 * exist when user manually run 'fmadm rotate'.
                 * In such case, we put it at the end of the list so
                 * it'll be dumped after all the rotated logs, before
                 * the current one.
                 */
                if (strcmp(dp->d_name + len + 1, "0-") == 0)
                        addlink(&head, dirname, dp->d_name, -1);
                else if ((suffix = strtol(dp->d_name + len + 1,
                    &endptr, 10)) >= 0 && *endptr == '\0')
                        addlink(&head, dirname, dp->d_name, suffix);
        }

        (void) closedir(dirp);

        return (head);
}

/*
 * Aggregate log files.  If ifiles is not NULL then one or more files
 * were listed on the command line, and we will merge just those files.
 * Otherwise we will merge all known log file types, and include the
 * rotated logs for each type (you can suppress the inclusion of
 * some logtypes through use of FMDUMP_AGGREGATE_IGNORE in the process
 * environment, setting it to a comma-separated list of log labels and/or
 * log filenames to ignore).
 *
 * We will not attempt to perform a chronological sort across all log records
 * of all files.  Indeed, we won't even sort individual log files -
 * we will not re-order events differently to how they appeared in their
 * original log file.  This is because log files are already inherently
 * ordered by the order in which fmd receives and processes events.
 * So we determine the output order by comparing the "next" record
 * off the top of each log file.
 *
 * We will construct a number of log record source "pipelines".  As above,
 * the next record to render in the overall output is that from the
 * pipeline with the oldest event.
 *
 * For the case that input logfiles were listed on the command line, each
 * pipeline will process exactly one of those logfiles.  Distinct pipelines
 * may process logfiles of the same "type" - eg if two "error" logs and
 * one "fault" logs are specified then there'll be two pipelines producing
 * events from "error" logs.
 *
 * If we are merging all known log types then we will construct exactly
 * one pipeline for each known log type - one for error, one for fault, etc.
 * Each pipeline will process first the rotated logs of that type and then
 * move on to the current log of that type.
 *
 * The output from all pipelines flows into a serializer which selects
 * the next record once all pipelines have asserted their output state.
 * The output state of a pipeline is one of:
 *
 *      - record available: the next record from this pipeline is available
 *        for comparison and consumption
 *
 *      - done: this pipeline will produce no more records
 *
 *      - polling: this pipeline is polling for new records and will
 *        make them available as output if/when any are observed
 *
 *      - processing: output state will be updated shortly
 *
 * A pipeline iterates over each file queued to it using fmd_log_xiter.
 * We do this in a separate thread for each pipeline.  The callback on
 * each iteration must update the serializer to let it know that
 * a new record is available.  In the serializer thread we decide whether
 * we have all records expected have arrived and it is time to choose
 * the next output record.
 */

/*
 * A pipeline descriptor.  The pl_cv condition variable is used together
 * with pl_lock for initial synchronisation, and thereafter with the
 * lock for the serializer for pausing and continuing this pipeline.
 */
struct fmdump_pipeline {
        pthread_mutex_t pl_lock;        /* used only in pipeline startup */
        int pl_started;                 /* sync with main thread on startup */
        pthread_t pl_thr;               /* our processing thread */
        pthread_cond_t pl_cv;           /* see above */
        struct loglink *pl_rotated;     /* rotated logs to process first */
        char *pl_logpath;               /* target path to process */
        char *pl_processing;            /* path currently being processed */
        struct fmdump_srlzer *pl_srlzer;        /* link to serializer */
        int pl_srlzeridx;               /* serializer index for this pipeline */
        const fmdump_ops_t *pl_ops;     /* ops for the log type we're given */
        int pl_fmt;                     /* FMDUMP_{SHORT,VERB1,VERB2,PRETTY} */
        boolean_t pl_follow;            /* go into poll mode at log end */
        fmdump_arg_t pl_arg;            /* arguments */
};

enum fmdump_pipestate {
        FMDUMP_PIPE_PROCESSING = 0x1000,
        FMDUMP_PIPE_RECORDAVAIL,
        FMDUMP_PIPE_POLLING,
        FMDUMP_PIPE_DONE
};

/*
 * Each pipeline has an associated output slot in the serializer.  This
 * must be updated with the serializer locked.  After update evaluate
 * whether there are enough slots decided that we should select a
 * record to output.
 */
struct fmdump_srlzer_slot {
        enum fmdump_pipestate ss_state;
        uint64_t ss_sec;
        uint64_t ss_nsec;
};

/*
 * All pipelines are linked to a single serializer.  The serializer
 * structure must be updated under the ds_lock; this mutex is also
 * paired with the pl_cv of individual pipelines (one mutex, many condvars)
 * in pausing and continuing individual pipelines.
 */
struct fmdump_srlzer {
        struct fmdump_pipeline *ds_pipearr;     /* pipeline array */
        pthread_mutex_t ds_lock;                /* see above */
        uint32_t ds_pipecnt;                    /* number of pipelines */
        uint32_t ds_pollcnt;                    /* pipelines in poll mode */
        uint32_t ds_nrecordavail;               /* pipelines with a record */
        uint32_t ds_ndone;                      /* completed pipelines */
        struct fmdump_srlzer_slot *ds_slot;     /* slot array */
};

/*
 * All known log types.  When aggregation is requested an no file list
 * is provided we will process the logs identified here (if lt_enabled
 * is true and not over-ridden by environment settings).  We also
 * use this in determining the appropriate ops structure for each distinct
 * label.
 */
static struct fmdump_logtype {
        const char *lt_label;           /* label from log header */
        boolean_t lt_enabled;           /* include in merge? */
        const char *lt_logname;         /* var/fm/fmd/%s */
        const fmdump_ops_t *lt_ops;
} logtypes[] = {
        {
                "error",
                B_TRUE,
                "errlog",
                &fmdump_err_ops
        },
        {
                "fault",
                B_TRUE,
                "fltlog",
                &fmdump_flt_ops
        },
        {
                "info",
                B_TRUE,
                "infolog",
                &fmdump_info_ops
        },
        {
                "info",
                B_TRUE,
                "infolog_hival",
                &fmdump_info_ops
        },
        {
                "asru",
                B_FALSE,                /* not included unless in file list */
                NULL,
                &fmdump_asru_ops        /* but we need ops when it is */
        }
};

/*
 * Disable logtypes per environment setting.  Does not apply when a list
 * of logs is provided on the command line.
 */
static void
do_disables(void)
{
        char *env = getenv("FMDUMP_AGGREGATE_IGNORE");
        char *dup, *start, *tofree;
        int i;

        if (env == NULL)
                return;

        tofree = dup = strdup(env);

        while (dup != NULL) {
                start = strsep(&dup, ",");
                for (i = 0; i < sizeof (logtypes) / sizeof (logtypes[0]); i++) {
                        if (logtypes[i].lt_logname == NULL)
                                continue;

                        if (strcmp(start, logtypes[i].lt_label) == 0 ||
                            strcmp(start, logtypes[i].lt_logname) == 0) {
                                logtypes[i].lt_enabled = B_FALSE;
                        }
                }
        }

        free(tofree);
}

static void
srlzer_enter(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;

        (void) pthread_mutex_lock(&srlzer->ds_lock);
}

static void
srlzer_exit(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;

        ASSERT(MUTEX_HELD(&srlzer->ds_lock));
        (void) pthread_mutex_unlock(&srlzer->ds_lock);
}

static struct fmdump_pipeline *
srlzer_choose(struct fmdump_srlzer *srlzer)
{
        struct fmdump_srlzer_slot *slot, *oldest;
        int oldestidx = -1;
        int first = 1;
        int i;

        ASSERT(MUTEX_HELD(&srlzer->ds_lock));

        for (i = 0, slot = &srlzer->ds_slot[0]; i < srlzer->ds_pipecnt;
            i++, slot++) {
                if (slot->ss_state != FMDUMP_PIPE_RECORDAVAIL)
                        continue;

                if (first) {
                        oldest = slot;
                        oldestidx = i;
                        first = 0;
                        continue;
                }

                if (slot->ss_sec < oldest->ss_sec ||
                    slot->ss_sec == oldest->ss_sec &&
                    slot->ss_nsec < oldest->ss_nsec) {
                        oldest = slot;
                        oldestidx = i;
                }
        }

        return (oldestidx >= 0 ? &srlzer->ds_pipearr[oldestidx] : NULL);
}

static void
pipeline_stall(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;

        ASSERT(MUTEX_HELD(&srlzer->ds_lock));
        (void) pthread_cond_wait(&pl->pl_cv, &srlzer->ds_lock);
}

static void
pipeline_continue(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;

        ASSERT(MUTEX_HELD(&srlzer->ds_lock));
        (void) pthread_cond_signal(&srlzer->ds_pipearr[pl->pl_srlzeridx].pl_cv);
}

/*
 * Called on each pipeline record iteration to make a new record
 * available for input to the serializer.  Returns 0 to indicate that
 * the caller must stall the pipeline, or 1 to indicate that the
 * caller should go ahead and render their record.  If this record
 * addition fills the serializer then choose a pipeline that must
 * render output.
 */
static int
pipeline_output(struct fmdump_pipeline *pl, const fmd_log_record_t *rp)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;
        struct fmdump_srlzer_slot *slot;
        struct fmdump_pipeline *wpl;
        int thisidx = pl->pl_srlzeridx;

        ASSERT(MUTEX_HELD(&srlzer->ds_lock));

        slot = &srlzer->ds_slot[thisidx];
        slot->ss_state = FMDUMP_PIPE_RECORDAVAIL;
        slot->ss_sec = rp->rec_sec;
        slot->ss_nsec = rp->rec_nsec;
        srlzer->ds_nrecordavail++;

        /*
         * Once all pipelines are polling we just render in arrival order.
         */
        if (srlzer->ds_pollcnt == srlzer->ds_pipecnt)
                return (1);

        /*
         * If not all pipelines have asserted an output yet then the
         * caller must block.
         */
        if (srlzer->ds_nrecordavail + srlzer->ds_ndone +
            srlzer->ds_pollcnt < srlzer->ds_pipecnt)
                return (0);

        /*
         * Right so it's time to turn the crank by choosing which of the
         * filled line of slots should produce output.  If it is the slot
         * for our caller then return their index to them, otherwise return
         * -1 to the caller to make them block and cv_signal the winner.
         */
        wpl = srlzer_choose(srlzer);
        ASSERT(wpl != NULL);

        if (wpl == pl)
                return (1);

        /* Wake the oldest, and return 0 to put the caller to sleep */
        pipeline_continue(wpl);

        return (0);
}

static void
pipeline_mark_consumed(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;

        ASSERT(MUTEX_HELD(&srlzer->ds_lock));
        srlzer->ds_slot[pl->pl_srlzeridx].ss_state = FMDUMP_PIPE_PROCESSING;
        srlzer->ds_nrecordavail--;
}

static void
pipeline_done(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;
        struct fmdump_pipeline *wpl;

        srlzer_enter(pl);

        srlzer->ds_slot[pl->pl_srlzeridx].ss_state = FMDUMP_PIPE_DONE;
        srlzer->ds_ndone++;
        wpl = srlzer_choose(srlzer);
        if (wpl != NULL)
                pipeline_continue(wpl);

        srlzer_exit(pl);
}

static void
pipeline_pollmode(struct fmdump_pipeline *pl)
{
        struct fmdump_srlzer *srlzer = pl->pl_srlzer;
        struct fmdump_pipeline *wpl;

        if (srlzer->ds_slot[pl->pl_srlzeridx].ss_state == FMDUMP_PIPE_POLLING)
                return;

        srlzer_enter(pl);

        srlzer->ds_slot[pl->pl_srlzeridx].ss_state = FMDUMP_PIPE_POLLING;
        if (++srlzer->ds_pollcnt + srlzer->ds_nrecordavail ==
            srlzer->ds_pipecnt && (wpl = srlzer_choose(srlzer)) != NULL)
                pipeline_continue(wpl);

        srlzer_exit(pl);
}

static int
pipeline_err(fmd_log_t *lp, void *arg)
{
        struct fmdump_pipeline *pl = (struct fmdump_pipeline *)arg;

        fmdump_warn("skipping record in %s: %s\n", pl->pl_processing,
            fmd_log_errmsg(lp, fmd_log_errno(lp)));
        g_errs++;

        return (0);
}

static int
pipeline_cb(fmd_log_t *lp, const fmd_log_record_t *rp, void *arg)
{
        struct fmdump_pipeline *pl = (struct fmdump_pipeline *)arg;
        int rc;

        fmd_log_rec_f *func = pl->pl_arg.da_fmt->do_func;

        srlzer_enter(pl);

        if (!pipeline_output(pl, rp))
                pipeline_stall(pl);

        rc = func(lp, rp, pl->pl_arg.da_fp);
        pipeline_mark_consumed(pl);

        srlzer_exit(pl);

        return (rc);
}

static void
pipeline_process(struct fmdump_pipeline *pl, char *logpath, boolean_t follow)
{
        fmd_log_header_t log;
        fmd_log_t *lp;
        int err;
        int i;

        pl->pl_processing = logpath;

        if ((lp = fmd_log_open(FMD_LOG_VERSION, logpath, &err)) == NULL) {
                fmdump_warn("failed to open %s: %s\n",
                    logpath, fmd_log_errmsg(NULL, err));
                g_errs++;
                return;
        }

        fmd_log_header(lp, &log);
        for (i = 0; i < sizeof (logtypes) / sizeof (logtypes[0]); i++) {
                if (strcmp(log.log_label, logtypes[i].lt_label) == 0) {
                        pl->pl_ops = logtypes[i].lt_ops;
                        pl->pl_arg.da_fmt =
                            &pl->pl_ops->do_formats[pl->pl_fmt];
                        break;
                }
        }

        if (pl->pl_ops == NULL) {
                fmdump_warn("unknown log type %s for %s\n",
                    log.log_label, logpath);
                g_errs++;
                return;
        }

        do {
                if (fmd_log_xiter(lp, FMD_LOG_XITER_REFS, pl->pl_arg.da_fc,
                    pl->pl_arg.da_fv, pipeline_cb, pipeline_err, (void *)pl,
                    NULL) != 0) {
                        fmdump_warn("failed to dump %s: %s\n",
                            logpath, fmd_log_errmsg(lp, fmd_log_errno(lp)));
                        g_errs++;
                        fmd_log_close(lp);
                        return;
                }

                if (follow) {
                        pipeline_pollmode(pl);
                        (void) sleep(1);
                }

        } while (follow);

        fmd_log_close(lp);
}

static void *
pipeline_thr(void *arg)
{
        struct fmdump_pipeline *pl = (struct fmdump_pipeline *)arg;
        struct loglink *ll;

        (void) pthread_mutex_lock(&pl->pl_lock);
        pl->pl_started = 1;
        (void) pthread_mutex_unlock(&pl->pl_lock);
        (void) pthread_cond_signal(&pl->pl_cv);

        for (ll = pl->pl_rotated; ll != NULL; ll = ll->next)
                pipeline_process(pl, ll->path, B_FALSE);

        pipeline_process(pl, pl->pl_logpath, pl->pl_follow);
        pipeline_done(pl);

        return (NULL);
}


static int
aggregate(char **ifiles, int n_ifiles, int opt_f,
    fmd_log_filter_t *fv, uint_t fc,
    int opt_v, int opt_V, int opt_p, int opt_j)
{
        struct fmdump_pipeline *pipeline, *pl;
        struct fmdump_srlzer srlzer;
        uint32_t npipe;
        int fmt;
        int i;

        if (ifiles != NULL) {
                npipe = n_ifiles;
                pipeline = calloc(npipe, sizeof (struct fmdump_pipeline));
                if (!pipeline)
                        fmdump_fatal("failed to allocate memory");

                for (i = 0; i < n_ifiles; i++)
                        pipeline[i].pl_logpath = ifiles[i];
        } else {
                pipeline = calloc(sizeof (logtypes) / sizeof (logtypes[0]),
                    sizeof (struct fmdump_pipeline));
                if (!pipeline)
                        fmdump_fatal("failed to allocate memory");

                do_disables();

                npipe = 0;
                for (i = 0; i < sizeof (logtypes) / sizeof (logtypes[0]); i++) {
                        struct fmdump_logtype *ltp = &logtypes[i];
                        char *logpath;

                        if (ltp->lt_enabled == B_FALSE)
                                continue;

                        if ((logpath = malloc(PATH_MAX)) == NULL)
                                fmdump_fatal("failed to allocate memory");

                        (void) snprintf(logpath, PATH_MAX,
                            "%s/var/fm/fmd/%s",
                            g_root ? g_root : "", ltp->lt_logname);

                        pipeline[npipe].pl_rotated =
                            get_rotated_logs(logpath);

                        pipeline[npipe++].pl_logpath = logpath;
                }
        }

        if (opt_V)
                fmt = opt_p ? FMDUMP_PRETTY : opt_j ? FMDUMP_JSON :
                    FMDUMP_VERB2;
        else if (opt_v)
                fmt = FMDUMP_VERB1;
        else
                fmt = FMDUMP_SHORT;

        bzero(&srlzer, sizeof (srlzer));
        srlzer.ds_pipearr = pipeline;
        srlzer.ds_pipecnt = npipe;
        srlzer.ds_slot = calloc(npipe, sizeof (struct fmdump_srlzer_slot));
        if (!srlzer.ds_slot)
                fmdump_fatal("failed to allocate memory");
        (void) pthread_mutex_init(&srlzer.ds_lock, NULL);

        for (i = 0, pl = &pipeline[0]; i < npipe; i++, pl++) {
                (void) pthread_mutex_init(&pl->pl_lock, NULL);
                (void) pthread_cond_init(&pl->pl_cv, NULL);
                srlzer.ds_slot[i].ss_state = FMDUMP_PIPE_PROCESSING;
                pl->pl_srlzer = &srlzer;
                pl->pl_srlzeridx = i;
                pl->pl_follow = opt_f ? B_TRUE : B_FALSE;
                pl->pl_fmt = fmt;
                pl->pl_arg.da_fv = fv;
                pl->pl_arg.da_fc = fc;
                pl->pl_arg.da_fp = stdout;

                (void) pthread_mutex_lock(&pl->pl_lock);

                if (pthread_create(&pl->pl_thr, NULL,
                    pipeline_thr, (void *)pl) != 0)
                        fmdump_fatal("pthread_create for pipeline %d failed",
                            i);
        }

        for (i = 0, pl = &pipeline[0]; i < npipe; i++, pl++) {
                while (!pl->pl_started)
                        (void) pthread_cond_wait(&pl->pl_cv, &pl->pl_lock);

                (void) pthread_mutex_unlock(&pl->pl_lock);
        }

        for (i = 0, pl = &pipeline[0]; i < npipe; i++, pl++)
                (void) pthread_join(pl->pl_thr, NULL);

        if (ifiles == NULL) {
                for (i = 0; i < npipe; i++)
                        free(pipeline[i].pl_logpath);
        }

        free(srlzer.ds_slot);

        free(pipeline);

        return (FMDUMP_EXIT_SUCCESS);
}

static void
cleanup(char **ifiles, int n_ifiles)
{
        int i;

        if (ifiles == NULL)
                return;

        for (i = 0; i < n_ifiles; i++) {
                if (ifiles[i] != NULL) {
                        free(ifiles[i]);
                        ifiles[i] = NULL;
                }
        }

        free(ifiles);
}

int
main(int argc, char *argv[])
{
        int opt_a = 0, opt_e = 0, opt_f = 0, opt_H = 0, opt_m = 0, opt_p = 0;
        int opt_u = 0, opt_v = 0, opt_V = 0, opt_j = 0;
        int opt_i = 0, opt_I = 0;
        int opt_A = 0;
        char **ifiles = NULL;
        char *ifile = NULL;
        int n_ifiles;
        int ifileidx = 0;
        int iflags = 0;

        fmdump_arg_t arg;
        fmdump_lyr_t lyr;
        const fmdump_ops_t *ops;
        fmd_log_filter_t *filtv;
        uint_t filtc;

        fmd_log_filter_t *errfv, *fltfv, *allfv;
        uint_t errfc = 0, fltfc = 0, allfc = 0;

        fmd_log_header_t log;
        fmd_log_rec_f *func;
        void *farg;
        fmd_log_t *lp;
        int c, err;
        off64_t off = 0;
        ulong_t recs;
        struct loglink *rotated_logs = NULL, *llp;

        g_pname = argv[0];

        errfv = alloca(sizeof (fmd_log_filter_t) * argc);
        fltfv = alloca(sizeof (fmd_log_filter_t) * argc);
        allfv = alloca(sizeof (fmd_log_filter_t) * argc);

        while (optind < argc) {
                while ((c = getopt(argc, argv,
                    "Aac:efHiIjmN:n:O:pR:t:T:u:vV")) != EOF) {
                        switch (c) {
                        case 'A':
                                opt_A++;
                                break;
                        case 'a':
                                opt_a++;
                                break;
                        case 'c':
                                errfv[errfc].filt_func = fmd_log_filter_class;
                                errfv[errfc].filt_arg = optarg;
                                allfv[allfc++] = errfv[errfc++];
                                break;
                        case 'e':
                                if (opt_i)
                                        return (usage(stderr));
                                opt_e++;
                                break;
                        case 'f':
                                opt_f++;
                                break;
                        case 'H':
                                opt_H++;
                                break;
                        case 'i':
                                if (opt_e || opt_I)
                                        return (usage(stderr));
                                opt_i++;
                                break;
                        case 'I':
                                if (opt_e || opt_i)
                                        return (usage(stderr));
                                opt_I++;
                                break;
                        case 'j':
                                if (opt_p)
                                        return (usage(stderr));
                                opt_j++;
                                break;
                        case 'm':
                                opt_m++;
                                break;
                        case 'N':
                                fltfv[fltfc].filt_func =
                                    fmd_log_filter_nv_multi;
                                fltfv[fltfc].filt_arg =
                                    setupnamevalue_multi(optarg);
                                allfv[allfc++] = fltfv[fltfc++];
                                break;
                        case 'n':
                                fltfv[fltfc].filt_func = fmd_log_filter_nv;
                                fltfv[fltfc].filt_arg = setupnamevalue(optarg);
                                allfv[allfc++] = fltfv[fltfc++];
                                break;
                        case 'O': {
                                char *p;

                                errno = 0;
                                off = strtoull(optarg, &p, 16);

                                if (errno != 0 || p == optarg || *p != '\0') {
                                        fmdump_usage(
                                            "illegal offset format -- %s\n",
                                            optarg);
                                }
                                iflags |= FMD_LOG_XITER_OFFS;
                                break;
                        }
                        case 'p':
                                if (opt_j)
                                        return (usage(stderr));
                                opt_p++;
                                break;
                        case 'R':
                                g_root = optarg;
                                break;
                        case 't':
                                errfv[errfc].filt_func = fmd_log_filter_after;
                                errfv[errfc].filt_arg = gettimeopt(optarg);
                                allfv[allfc++] = errfv[errfc++];
                                break;
                        case 'T':
                                errfv[errfc].filt_func = fmd_log_filter_before;
                                errfv[errfc].filt_arg = gettimeopt(optarg);
                                allfv[allfc++] = errfv[errfc++];
                                break;
                        case 'u':
                                fltfv[fltfc].filt_func = fmd_log_filter_uuid;
                                fltfv[fltfc].filt_arg = optarg;
                                allfv[allfc++] = fltfv[fltfc++];
                                opt_u++;
                                opt_a++; /* -u implies -a */
                                break;
                        case 'v':
                                opt_v++;
                                break;
                        case 'V':
                                opt_V++;
                                break;
                        default:
                                return (usage(stderr));
                        }
                }

                if (opt_A && (opt_e || opt_i || opt_I || opt_m || opt_u))
                        fmdump_usage("-A excludes all of "
                            "-e, -i, -I, -m and -u\n");

                if (optind < argc) {
                        char *dest;

                        if (ifiles == NULL) {
                                n_ifiles = argc - optind;
                                ifiles = calloc(n_ifiles, sizeof (char *));
                                if (ifiles == NULL) {
                                        fmdump_fatal(
                                            "failed to allocate memory for "
                                            "%d input file%s", n_ifiles,
                                            n_ifiles > 1 ? "s" : "");
                                }
                        }

                        if (ifileidx > 0 && !opt_A)
                                fmdump_usage("illegal argument -- %s\n",
                                    argv[optind]);

                        ASSERT(ifileidx < n_ifiles);

                        if ((dest = malloc(PATH_MAX)) == NULL)
                                fmdump_fatal("failed to allocate memory");

                        (void) strlcpy(dest, argv[optind++], PATH_MAX);
                        ifiles[ifileidx++] = dest;
                }
        }

        /*
         * It's possible that file arguments were interleaved with options and
         * option arguments, in which case we allocated space for more file
         * arguments that we actually got.  Adjust as required so that we don't
         * reference invalid entries.
         */
        n_ifiles = ifileidx;

        if (opt_A) {
                int rc;

                if (!opt_a) {
                        fltfv[fltfc].filt_func = log_filter_silent;
                        fltfv[fltfc].filt_arg = (void *)1;
                        allfv[allfc++] = fltfv[fltfc++];
                }

                rc = aggregate(ifiles, n_ifiles, opt_f,
                    allfv, allfc,
                    opt_v, opt_V, opt_p, opt_j);

                cleanup(ifiles, n_ifiles);
                return (rc);
        } else {
                if (ifiles == NULL) {
                        if ((ifile = calloc(1, PATH_MAX)) == NULL)
                                fmdump_fatal("failed to allocate memory");
                } else {
                        ifile = ifiles[0];
                }
        }


        if (*ifile == '\0') {
                const char *pfx, *sfx;

                if (opt_u || (!opt_e && !opt_i && !opt_I)) {
                        pfx = "flt";
                        sfx = "";
                } else {
                        if (opt_e) {
                                pfx = "err";
                                sfx = "";
                        } else {
                                pfx = "info";
                                sfx = opt_I ? "_hival" : "";
                        }
                }

                (void) snprintf(ifile, PATH_MAX, "%s/var/fm/fmd/%slog%s",
                    g_root ? g_root : "", pfx, sfx);
                /*
                 * logadm may rotate the logs.  When no input file is specified,
                 * we try to dump all the rotated logs as well in the right
                 * order.
                 */
                if (!opt_H && off == 0)
                        rotated_logs = get_rotated_logs(ifile);
        } else if (g_root != NULL) {
                fmdump_usage("-R option is not appropriate "
                    "when file operand is present\n");
        }

        if ((g_msg = fmd_msg_init(g_root, FMD_MSG_VERSION)) == NULL)
                fmdump_fatal("failed to initialize libfmd_msg");

        if ((lp = fmd_log_open(FMD_LOG_VERSION, ifile, &err)) == NULL) {
                fmdump_fatal("failed to open %s: %s\n", ifile,
                    fmd_log_errmsg(NULL, err));
        }

        if (opt_H) {
                fmd_log_header(lp, &log);

                (void) printf("EXD_CREATOR = %s\n", log.log_creator);
                (void) printf("EXD_HOSTNAME = %s\n", log.log_hostname);
                (void) printf("EXD_FMA_LABEL = %s\n", log.log_label);
                (void) printf("EXD_FMA_VERSION = %s\n", log.log_version);
                (void) printf("EXD_FMA_OSREL = %s\n", log.log_osrelease);
                (void) printf("EXD_FMA_OSVER = %s\n", log.log_osversion);
                (void) printf("EXD_FMA_PLAT = %s\n", log.log_platform);
                (void) printf("EXD_FMA_UUID = %s\n", log.log_uuid);

                return (FMDUMP_EXIT_SUCCESS);
        }

        if (off != 0 && fmd_log_seek(lp, off) != 0) {
                fmdump_fatal("failed to seek %s: %s\n", ifile,
                    fmd_log_errmsg(lp, fmd_log_errno(lp)));
        }

        if (opt_e && opt_u)
                ops = &fmdump_err_ops;
        else if (strcmp(fmd_log_label(lp), fmdump_flt_ops.do_label) == 0)
                ops = &fmdump_flt_ops;
        else if (strcmp(fmd_log_label(lp), fmdump_asru_ops.do_label) == 0)
                ops = &fmdump_asru_ops;
        else if (strcmp(fmd_log_label(lp), fmdump_info_ops.do_label) == 0)
                ops = &fmdump_info_ops;
        else
                ops = &fmdump_err_ops;

        if (!opt_a && ops == &fmdump_flt_ops) {
                fltfv[fltfc].filt_func = log_filter_silent;
                fltfv[fltfc].filt_arg = NULL;
                allfv[allfc++] = fltfv[fltfc++];
        }

        if (opt_V) {
                arg.da_fmt =
                    &ops->do_formats[opt_p ? FMDUMP_PRETTY :
                    opt_j ? FMDUMP_JSON : FMDUMP_VERB2];
                iflags |= FMD_LOG_XITER_REFS;
        } else if (opt_v) {
                arg.da_fmt = &ops->do_formats[FMDUMP_VERB1];
        } else if (opt_m) {
                arg.da_fmt = &ops->do_formats[FMDUMP_MSG];
        } else
                arg.da_fmt = &ops->do_formats[FMDUMP_SHORT];

        if (opt_m && arg.da_fmt->do_func == NULL) {
                fmdump_usage("-m mode is not supported for "
                    "log of type %s: %s\n", fmd_log_label(lp), ifile);
        }

        arg.da_fv = errfv;
        arg.da_fc = errfc;
        arg.da_fp = stdout;

        if (iflags & FMD_LOG_XITER_OFFS)
                fmdump_printf(arg.da_fp, "%16s ", "OFFSET");

        if (arg.da_fmt->do_hdr && !(opt_V && ops == &fmdump_flt_ops))
                fmdump_printf(arg.da_fp, "%s\n", arg.da_fmt->do_hdr);

        if (opt_e && opt_u) {
                iflags |= FMD_LOG_XITER_REFS;
                func = xref_iter;
                farg = &arg;
                filtc = fltfc;
                filtv = fltfv;
        } else {
                func = arg.da_fmt->do_func;
                farg = arg.da_fp;
                filtc = allfc;
                filtv = allfv;
        }

        if (iflags & FMD_LOG_XITER_OFFS) {
                lyr.dy_func = func;
                lyr.dy_arg = farg;
                lyr.dy_fp = arg.da_fp;
                func = xoff_iter;
                farg = &lyr;
        }

        for (llp = rotated_logs; llp != NULL; llp = llp->next) {
                fmd_log_t *rlp;

                if ((rlp = fmd_log_open(FMD_LOG_VERSION, llp->path, &err))
                    == NULL) {
                        fmdump_warn("failed to open %s: %s\n",
                            llp->path, fmd_log_errmsg(NULL, err));
                        g_errs++;
                        continue;
                }

                recs = 0;
                if (fmd_log_xiter(rlp, iflags, filtc, filtv,
                    func, error, farg, &recs) != 0) {
                        fmdump_warn("failed to dump %s: %s\n", llp->path,
                            fmd_log_errmsg(rlp, fmd_log_errno(rlp)));
                        g_errs++;
                }
                g_recs += recs;

                fmd_log_close(rlp);
        }

        do {
                recs = 0;
                if (fmd_log_xiter(lp, iflags, filtc, filtv,
                    func, error, farg, &recs) != 0) {
                        fmdump_warn("failed to dump %s: %s\n", ifile,
                            fmd_log_errmsg(lp, fmd_log_errno(lp)));
                        g_errs++;
                }
                g_recs += recs;

                if (opt_f)
                        (void) sleep(1);

        } while (opt_f);

        if (!opt_f && g_recs == 0 && isatty(STDOUT_FILENO))
                fmdump_warn("%s is empty\n", ifile);

        if (g_thp != NULL)
                topo_close(g_thp);

        fmd_log_close(lp);
        fmd_msg_fini(g_msg);

        if (ifiles == NULL)
                free(ifile);
        else
                cleanup(ifiles, n_ifiles);

        return (g_errs ? FMDUMP_EXIT_ERROR : FMDUMP_EXIT_SUCCESS);
}