we spent far too long debugging a weird go library problem (incorrect

arguments to mmap) because it was using syscall(2) and that callpath
is invisible in ktrace.  make it visible, it will now show "(via syscall)"
and such.
ok guenther

16 files changed, 91 insertions, 58 deletions

diff --git a/sys/arch/alpha/alpha/trap.c b/sys/arch/alpha/alpha/trap.c
index a0379b92e52..e5bfa7b7313 100644
--- a/sys/arch/alpha/alpha/trap.c
+++ b/sys/arch/alpha/alpha/trap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: trap.c,v 1.104 2022/11/02 07:20:07 guenther Exp $ */
+/* $OpenBSD: trap.c,v 1.105 2023/01/16 05:32:04 deraadt Exp $ */
 /* $NetBSD: trap.c,v 1.52 2000/05/24 16:48:33 thorpej Exp $ */
 
 /*-
@@ -504,7 +504,7 @@ syscall(code, framep)
 {
 	const struct sysent *callp;
 	struct proc *p;
-	int error;
+	int error, indirect = -1;
 	u_int64_t opc;
 	u_long rval[2];
 	u_long args[10];					/* XXX */
@@ -523,6 +523,7 @@ syscall(code, framep)
 		 * syscall() and __syscall() are handled the same on
 		 * the alpha, as everything is 64-bit aligned, anyway.
 		 */
+		indirect = code;
 		code = framep->tf_regs[FRAME_A0];
 		hidden = 1;
 		break;
@@ -564,7 +565,7 @@ syscall(code, framep)
 	rval[0] = 0;
 	rval[1] = 0;
 
-	error = mi_syscall(p, code, callp, args + hidden, rval);
+	error = mi_syscall(p, code, indirect, callp, args + hidden, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/amd64/amd64/trap.c b/sys/arch/amd64/amd64/trap.c
index 61f150321da..27573bb7e20 100644
--- a/sys/arch/amd64/amd64/trap.c
+++ b/sys/arch/amd64/amd64/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.93 2022/11/07 01:41:57 guenther Exp $	*/
+/*	$OpenBSD: trap.c,v 1.94 2023/01/16 05:32:04 deraadt Exp $	*/
 /*	$NetBSD: trap.c,v 1.2 2003/05/04 23:51:56 fvdl Exp $	*/
 
 /*-
@@ -534,7 +534,7 @@ syscall(struct trapframe *frame)
 	caddr_t params;
 	const struct sysent *callp;
 	struct proc *p;
-	int error;
+	int error, indirect = -1;
 	size_t argsize, argoff;
 	register_t code, args[9], rval[2], *argp;
 
@@ -552,6 +552,7 @@ syscall(struct trapframe *frame)
 		/*
 		 * Code is first argument, followed by actual args.
 		 */
+		indirect = code;
 		code = frame->tf_rdi;
 		argp = &args[1];
 		argoff = 1;
@@ -596,7 +597,7 @@ syscall(struct trapframe *frame)
 	rval[0] = 0;
 	rval[1] = 0;
 
-	error = mi_syscall(p, code, callp, argp, rval);
+	error = mi_syscall(p, code, indirect, callp, argp, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/arm/arm/syscall.c b/sys/arch/arm/arm/syscall.c
index d8f97b18104..eabf879dead 100644
--- a/sys/arch/arm/arm/syscall.c
+++ b/sys/arch/arm/arm/syscall.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syscall.c,v 1.24 2021/12/09 00:26:11 guenther Exp $	*/
+/*	$OpenBSD: syscall.c,v 1.25 2023/01/16 05:32:04 deraadt Exp $	*/
 /*	$NetBSD: syscall.c,v 1.24 2003/11/14 19:03:17 scw Exp $	*/
 
 /*-
@@ -94,7 +94,7 @@ swi_handler(trapframe_t *frame)
 {
 	struct proc *p = curproc;
 	const struct sysent *callp;
-	int code, error;
+	int code, error, indirect = -1;
 	u_int nap = 4, nargs;
 	register_t *ap, *args, copyargs[MAXARGS], rval[2];
 
@@ -118,10 +118,12 @@ swi_handler(trapframe_t *frame)
 
 	switch (code) {	
 	case SYS_syscall:
+		indirect = code;
 		code = *ap++;
 		nap--;
 		break;
         case SYS___syscall:
+		indirect = code;
 		code = ap[_QUAD_LOWWORD];
 		ap += 2;
 		nap -= 2;
@@ -149,7 +151,7 @@ swi_handler(trapframe_t *frame)
 	rval[0] = 0;
 	rval[1] = frame->tf_r1;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/arm64/arm64/syscall.c b/sys/arch/arm64/arm64/syscall.c
index 84653fe0f58..343231259df 100644
--- a/sys/arch/arm64/arm64/syscall.c
+++ b/sys/arch/arm64/arm64/syscall.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: syscall.c,v 1.11 2022/11/02 07:20:08 guenther Exp $ */
+/* $OpenBSD: syscall.c,v 1.12 2023/01/16 05:32:05 deraadt Exp $ */
 /*
  * Copyright (c) 2015 Dale Rahn <drahn@dalerahn.com>
  *
@@ -35,7 +35,7 @@ svc_handler(trapframe_t *frame)
 {
 	struct proc *p = curproc;
 	const struct sysent *callp;
-	int code, error;
+	int code, error, indirect = -1;
 	u_int nap = 8, nargs;
 	register_t *ap, *args, copyargs[MAXARGS], rval[2];
 
@@ -54,10 +54,8 @@ svc_handler(trapframe_t *frame)
 
 	switch (code) {	
 	case SYS_syscall:
-		code = *ap++;
-		nap--;
-		break;
         case SYS___syscall:
+		indirect = code;
 		code = *ap++;
 		nap--;
 		break;
@@ -84,7 +82,7 @@ svc_handler(trapframe_t *frame)
 	rval[0] = 0;
 	rval[1] = 0;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/hppa/hppa/trap.c b/sys/arch/hppa/hppa/trap.c
index da735f48308..d8600482f1a 100644
--- a/sys/arch/hppa/hppa/trap.c
+++ b/sys/arch/hppa/hppa/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.159 2022/11/02 07:20:07 guenther Exp $	*/
+/*	$OpenBSD: trap.c,v 1.160 2023/01/16 05:32:05 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1998-2004 Michael Shalayeff
@@ -765,7 +765,7 @@ syscall(struct trapframe *frame)
 {
 	struct proc *p = curproc;
 	const struct sysent *callp;
-	int retq, code, argsize, argoff, error;
+	int retq, code, argsize, argoff, error, indirect = -1;
 	register_t args[8], rval[2];
 #ifdef DIAGNOSTIC
 	int oldcpl = curcpu()->ci_cpl;
@@ -781,6 +781,7 @@ syscall(struct trapframe *frame)
 	argoff = 4; retq = 0;
 	switch (code = frame->tf_t1) {
 	case SYS_syscall:
+		indirect = code;
 		code = frame->tf_arg0;
 		args[0] = frame->tf_arg1;
 		args[1] = frame->tf_arg2;
@@ -793,6 +794,7 @@ syscall(struct trapframe *frame)
 		 * due to the args being laid backwards on the stack
 		 * and then copied in words
 		 */
+		indirect = code;
 		code = frame->tf_arg0;
 		args[0] = frame->tf_arg2;
 		args[1] = frame->tf_arg3;
@@ -862,7 +864,7 @@ syscall(struct trapframe *frame)
 	rval[0] = 0;
 	rval[1] = frame->tf_ret1;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/i386/i386/trap.c b/sys/arch/i386/i386/trap.c
index 8af32449dbd..61394579b62 100644
--- a/sys/arch/i386/i386/trap.c
+++ b/sys/arch/i386/i386/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.156 2021/12/09 00:26:11 guenther Exp $	*/
+/*	$OpenBSD: trap.c,v 1.157 2023/01/16 05:32:05 deraadt Exp $	*/
 /*	$NetBSD: trap.c,v 1.95 1996/05/05 06:50:02 mycroft Exp $	*/
 
 /*-
@@ -519,7 +519,7 @@ syscall(struct trapframe *frame)
 	caddr_t params;
 	const struct sysent *callp;
 	struct proc *p;
-	int error;
+	int error, indirect = -1;
 	register_t code, args[8], rval[2];
 #ifdef DIAGNOSTIC
 	int ocpl = lapic_tpr;
@@ -552,6 +552,7 @@ syscall(struct trapframe *frame)
 		/*
 		 * Code is first argument, followed by actual args.
 		 */
+		indirect = code;
 		copyin(params, &code, sizeof(int));
 		params += sizeof(int);
 		break;
@@ -560,6 +561,7 @@ syscall(struct trapframe *frame)
 		 * Like syscall, but code is a quad, so as to maintain
 		 * quad alignment for the rest of the arguments.
 		 */
+		indirect = code;
 		copyin(params + _QUAD_LOWWORD * sizeof(int), &code, sizeof(int));
 		params += sizeof(quad_t);
 		break;
@@ -579,7 +581,7 @@ syscall(struct trapframe *frame)
 	rval[0] = 0;
 	rval[1] = frame->tf_edx;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/m88k/m88k/trap.c b/sys/arch/m88k/m88k/trap.c
index e899d907916..fcd512d3d83 100644
--- a/sys/arch/m88k/m88k/trap.c
+++ b/sys/arch/m88k/m88k/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.124 2023/01/09 11:18:44 miod Exp $	*/
+/*	$OpenBSD: trap.c,v 1.125 2023/01/16 05:32:05 deraadt Exp $	*/
 /*
  * Copyright (c) 2004, Miodrag Vallat.
  * Copyright (c) 1998 Steve Murphree, Jr.
@@ -1155,7 +1155,7 @@ m88100_syscall(register_t code, struct trapframe *tf)
 	int i, nap;
 	const struct sysent *callp;
 	struct proc *p = curproc;
-	int error;
+	int error, indirect = -1;
 	register_t args[8] __aligned(8);
 	register_t rval[2] __aligned(8);
 	register_t *ap;
@@ -1176,10 +1176,12 @@ m88100_syscall(register_t code, struct trapframe *tf)
 
 	switch (code) {
 	case SYS_syscall:
+		indirect = code;
 		code = *ap++;
 		nap--;
 		break;
 	case SYS___syscall:
+		indirect = code;
 		code = ap[_QUAD_LOWWORD];
 		ap += 2;
 		nap -= 2;
@@ -1206,7 +1208,7 @@ m88100_syscall(register_t code, struct trapframe *tf)
 	rval[0] = 0;
 	rval[1] = tf->tf_r[3];
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	/*
 	 * system call will look like:
diff --git a/sys/arch/mips64/mips64/trap.c b/sys/arch/mips64/mips64/trap.c
index 784d791d1a7..79f3558dcb1 100644
--- a/sys/arch/mips64/mips64/trap.c
+++ b/sys/arch/mips64/mips64/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.164 2023/01/11 03:19:52 visa Exp $	*/
+/*	$OpenBSD: trap.c,v 1.165 2023/01/16 05:32:05 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1988 University of Utah.
@@ -397,7 +397,7 @@ fault_common_no_miss:
 	    {
 		struct trapframe *locr0 = p->p_md.md_regs;
 		const struct sysent *callp;
-		unsigned int code;
+		unsigned int code, indirect = -1;
 		register_t tpc;
 		uint32_t branch = 0;
 		int error, numarg;
@@ -433,6 +433,7 @@ fault_common_no_miss:
 			 * proper alignment of 64-bit arguments on 32-bit
 			 * platforms, which doesn't change anything here.
 			 */
+			indirect = code;
 			code = locr0->a0;
 			if (code >= SYS_MAXSYSCALL)
 				callp += SYS_syscall;
@@ -480,7 +481,7 @@ fault_common_no_miss:
 		    TRAPSIZE : trppos[ci->ci_cpuid]) - 1].code = code;
 #endif
 
-		error = mi_syscall(p, code, callp, args.i, rval);
+		error = mi_syscall(p, code, indirect, callp, args.i, rval);
 
 		switch (error) {
 		case 0:
diff --git a/sys/arch/powerpc/powerpc/trap.c b/sys/arch/powerpc/powerpc/trap.c
index f22dad433aa..f79a2c03be5 100644
--- a/sys/arch/powerpc/powerpc/trap.c
+++ b/sys/arch/powerpc/powerpc/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.128 2023/01/04 22:13:43 kettenis Exp $	*/
+/*	$OpenBSD: trap.c,v 1.129 2023/01/16 05:32:05 deraadt Exp $	*/
 /*	$NetBSD: trap.c,v 1.3 1996/10/13 03:31:37 christos Exp $	*/
 
 /*
@@ -243,7 +243,7 @@ trap(struct trapframe *frame)
 	size_t argsize;
 	register_t code, error;
 	register_t *params, rval[2], args[10];
-	int n;
+	int n, indirect = -1;
 
 	if (frame->srr1 & PSL_PR) {
 		type |= EXC_USER;
@@ -369,6 +369,7 @@ trap(struct trapframe *frame)
 			 * code is first argument,
 			 * followed by actual args.
 			 */
+			indirect = code;
 			code = *params++;
 			break;
 		case SYS___syscall:
@@ -378,6 +379,7 @@ trap(struct trapframe *frame)
 			 * for the rest of the args.
 			 */
 			params++;
+			indirect = code;
 			code = *params++;
 			break;
 		default:
@@ -403,7 +405,7 @@ trap(struct trapframe *frame)
 		rval[0] = 0;
 		rval[1] = frame->fixreg[FIRSTARG + 1];
 
-		error = mi_syscall(p, code, callp, params, rval);
+		error = mi_syscall(p, code, indirect, callp, params, rval);
 
 		switch (error) {
 		case 0:
diff --git a/sys/arch/powerpc64/powerpc64/syscall.c b/sys/arch/powerpc64/powerpc64/syscall.c
index d47076d1824..87b2da61fd8 100644
--- a/sys/arch/powerpc64/powerpc64/syscall.c
+++ b/sys/arch/powerpc64/powerpc64/syscall.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syscall.c,v 1.9 2022/11/02 07:20:08 guenther Exp $	*/
+/*	$OpenBSD: syscall.c,v 1.10 2023/01/16 05:32:05 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2015 Dale Rahn <drahn@dalerahn.com>
@@ -31,7 +31,7 @@ syscall(struct trapframe *frame)
 {
 	struct proc *p = curproc;
 	const struct sysent *callp;
-	int code, error;
+	int code, error, indirect = -1;
 	int nap = 8, nargs;
 	register_t *ap, *args, copyargs[MAXARGS], rval[2];
 
@@ -41,6 +41,7 @@ syscall(struct trapframe *frame)
 	switch (code) {
 	case SYS_syscall:
 	case SYS___syscall:
+		indirect = code;
 		code = *ap++;
 		nap--;
 		break;
@@ -66,7 +67,7 @@ syscall(struct trapframe *frame)
 	rval[0] = 0;
 	rval[1] = 0;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/riscv64/riscv64/syscall.c b/sys/arch/riscv64/riscv64/syscall.c
index 1e1b2ce6ed5..77944c44d19 100644
--- a/sys/arch/riscv64/riscv64/syscall.c
+++ b/sys/arch/riscv64/riscv64/syscall.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syscall.c,v 1.13 2022/11/02 07:20:08 guenther Exp $	*/
+/*	$OpenBSD: syscall.c,v 1.14 2023/01/16 05:32:05 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2020 Brian Bamsch <bbamsch@google.com>
@@ -42,7 +42,7 @@ svc_handler(trapframe_t *frame)
 {
 	struct proc *p = curproc;
 	const struct sysent *callp;
-	int code, error;
+	int code, error, indirect = -1;
 	u_int nap = 8, nargs;
 	register_t *ap, *args, copyargs[MAXARGS], rval[2];
 
@@ -57,10 +57,8 @@ svc_handler(trapframe_t *frame)
 
 	switch (code) {
 	case SYS_syscall:
-		code = *ap++;
-		nap--;
-		break;
 	case SYS___syscall:
+		indirect = code;
 		code = *ap++;
 		nap--;
 		break;
@@ -86,7 +84,7 @@ svc_handler(trapframe_t *frame)
 	rval[0] = 0;
 	rval[1] = 0;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/sh/sh/trap.c b/sys/arch/sh/sh/trap.c
index e623d4e62f4..491a239bd21 100644
--- a/sys/arch/sh/sh/trap.c
+++ b/sys/arch/sh/sh/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.52 2023/01/09 06:04:14 miod Exp $	*/
+/*	$OpenBSD: trap.c,v 1.53 2023/01/16 05:32:05 deraadt Exp $	*/
 /*	$NetBSD: exception.c,v 1.32 2006/09/04 23:57:52 uwe Exp $	*/
 /*	$NetBSD: syscall.c,v 1.6 2006/03/07 07:21:50 thorpej Exp $	*/
 
@@ -516,7 +516,7 @@ syscall(struct proc *p, struct trapframe *tf)
 {
 	caddr_t params;
 	const struct sysent *callp;
-	int error, opc;
+	int error, opc, indirect = -1;
 	int argoff, argsize;
 	register_t code, args[8], rval[2];
 
@@ -532,6 +532,7 @@ syscall(struct proc *p, struct trapframe *tf)
 		/*
 		 * Code is first argument, followed by actual args.
 		 */
+		indirect = code;
 	        code = tf->tf_r4;
 		argoff = 1;
 		break;
@@ -540,6 +541,7 @@ syscall(struct proc *p, struct trapframe *tf)
 		 * Like syscall, but code is a quad, so as to maintain
 		 * quad alignment for the rest of the arguments.
 		 */
+		indirect = code;
 #if _BYTE_ORDER == BIG_ENDIAN
 		code = tf->tf_r5;
 #else
@@ -605,7 +607,7 @@ syscall(struct proc *p, struct trapframe *tf)
 	rval[0] = 0;
 	rval[1] = tf->tf_r1;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 	case 0:
diff --git a/sys/arch/sparc64/sparc64/trap.c b/sys/arch/sparc64/sparc64/trap.c
index 8682eefb4be..f697b7208dd 100644
--- a/sys/arch/sparc64/sparc64/trap.c
+++ b/sys/arch/sparc64/sparc64/trap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: trap.c,v 1.112 2022/11/02 07:20:08 guenther Exp $	*/
+/*	$OpenBSD: trap.c,v 1.113 2023/01/16 05:32:05 deraadt Exp $	*/
 /*	$NetBSD: trap.c,v 1.73 2001/08/09 01:03:01 eeh Exp $ */
 
 /*
@@ -1106,7 +1106,7 @@ syscall(struct trapframe *tf, register_t code, register_t pc)
 	int64_t *ap;
 	const struct sysent *callp;
 	struct proc *p = curproc;
-	int error, new;
+	int error, new, indirect = -1;
 	register_t args[8];
 	register_t rval[2];
 
@@ -1143,6 +1143,7 @@ syscall(struct trapframe *tf, register_t code, register_t pc)
 	switch (code) {
 	case SYS_syscall:
 	case SYS___syscall:
+		indirect = code;
 		code = *ap++;
 		nap--;
 		break;
@@ -1177,7 +1178,7 @@ syscall(struct trapframe *tf, register_t code, register_t pc)
 	rval[0] = 0;
 	rval[1] = 0;
 
-	error = mi_syscall(p, code, callp, args, rval);
+	error = mi_syscall(p, code, indirect, callp, args, rval);
 
 	switch (error) {
 		vaddr_t dest;
diff --git a/sys/sys/ktrace.h b/sys/sys/ktrace.h
index 2c590b22078..d784bb0fa90 100644
--- a/sys/sys/ktrace.h
+++ b/sys/sys/ktrace.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ktrace.h,v 1.43 2022/12/29 01:36:36 guenther Exp $	*/
+/*	$OpenBSD: ktrace.h,v 1.44 2023/01/16 05:32:05 deraadt Exp $	*/
 /*	$NetBSD: ktrace.h,v 1.12 1996/02/04 02:12:29 christos Exp $	*/
 
 /*
@@ -74,6 +74,9 @@ struct ktr_header {
 #define KTR_SYSCALL	1
 struct ktr_syscall {
 	int	ktr_code;		/* syscall number */
+#define KTRC_CODE_MASK			0x0000ffff
+#define KTRC_CODE_SYSCALL		0x20000000
+#define KTRC_CODE__SYSCALL		0x40000000
 	int	ktr_argsize;		/* size of arguments */
 	/*
 	 * followed by ktr_argsize/sizeof(register_t) "register_t"s
diff --git a/sys/sys/syscall_mi.h b/sys/sys/syscall_mi.h
index b535c0386f7..07c2c9bab9f 100644
--- a/sys/sys/syscall_mi.h
+++ b/sys/sys/syscall_mi.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: syscall_mi.h,v 1.26 2022/06/29 12:06:11 jca Exp $	*/
+/*	$OpenBSD: syscall_mi.h,v 1.27 2023/01/16 05:32:05 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1989, 1993
@@ -34,6 +34,7 @@
 #include <sys/param.h>
 #include <sys/pledge.h>
 #include <sys/tracepoint.h>
+#include <sys/syscall.h>
 #include <uvm/uvm_extern.h>
 
 #ifdef KTRACE
@@ -50,8 +51,8 @@
  * The MD setup for a system call has been done; here's the MI part.
  */
 static inline int
-mi_syscall(struct proc *p, register_t code, const struct sysent *callp,
-    register_t *argp, register_t retval[2])
+mi_syscall(struct proc *p, register_t code, int indirect,
+    const struct sysent *callp, register_t *argp, register_t retval[2])
 {
 	uint64_t tval;
 	int lock = !(callp->sy_flags & SY_NOLOCK);
@@ -71,8 +72,19 @@ mi_syscall(struct proc *p, register_t code, const struct sysent *callp,
 #endif
 #ifdef KTRACE
 	if (KTRPOINT(p, KTR_SYSCALL)) {
+		/* convert to mask, then include with code */
+		switch (indirect) {
+		case SYS_syscall:
+			indirect = KTRC_CODE_SYSCALL;
+			break;
+		case SYS___syscall:
+			indirect = KTRC_CODE__SYSCALL;
+			break;
+		default:
+			indirect = 0;
+		}
 		KERNEL_LOCK();
-		ktrsyscall(p, code, callp->sy_argsize, argp);
+		ktrsyscall(p, code | indirect, callp->sy_argsize, argp);
 		KERNEL_UNLOCK();
 	}
 #endif
diff --git a/usr.bin/kdump/kdump.c b/usr.bin/kdump/kdump.c
index f334d643a78..3f5ce0c4780 100644
--- a/usr.bin/kdump/kdump.c
+++ b/usr.bin/kdump/kdump.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kdump.c,v 1.154 2023/01/07 05:26:40 guenther Exp $	*/
+/*	$OpenBSD: kdump.c,v 1.155 2023/01/16 05:32:05 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 1988, 1993
@@ -908,7 +908,7 @@ static void
 ktrsyscall(struct ktr_syscall *ktr, size_t ktrlen)
 {
 	register_t *ap;
-	int narg;
+	int narg, code;
 	char sep;
 
 	if (ktr->ktr_argsize > ktrlen)
@@ -918,14 +918,19 @@ ktrsyscall(struct ktr_syscall *ktr, size_t ktrlen)
 	narg = ktr->ktr_argsize / sizeof(register_t);
 	sep = '\0';
 
-	if (ktr->ktr_code >= SYS_MAXSYSCALL || ktr->ktr_code < 0)
-		(void)printf("[%d]", ktr->ktr_code);
+	if (ktr->ktr_code & KTRC_CODE_SYSCALL)
+		(void)printf("(via syscall) ");
+	else if (ktr->ktr_code & KTRC_CODE__SYSCALL)
+		(void)printf("(via __syscall) ");
+	code = ktr->ktr_code & KTRC_CODE_MASK;
+	if (code >= SYS_MAXSYSCALL || code < 0)
+		(void)printf("[%d]", code);
 	else
-		(void)printf("%s", syscallnames[ktr->ktr_code]);
+		(void)printf("%s", syscallnames[code]);
 	ap = (register_t *)((char *)ktr + sizeof(struct ktr_syscall));
 	(void)putchar('(');
 
-	if (ktr->ktr_code == SYS_sysctl && fancy) {
+	if (code == SYS_sysctl && fancy) {
 		const char *s;
 		int n, i, *top;
 
@@ -954,8 +959,8 @@ ktrsyscall(struct ktr_syscall *ktr, size_t ktrlen)
 		sep = ',';
 		ap += 2;
 		narg -= 2;
-	} else if (ktr->ktr_code < nitems(scargs)) {
-		const formatter *fmts = scargs[ktr->ktr_code];
+	} else if (code < nitems(scargs)) {
+		const formatter *fmts = scargs[code];
 		int fmt;
 		int arg = 0;