xref: /netbsd-src/sys/kern/kern_ktrace.c (revision cd22f25e6f6d1cc1f197fe8c5468a80f51d1c4e1)
1 /*	$NetBSD: kern_ktrace.c,v 1.144 2008/04/29 15:55:24 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006, 2007, 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Copyright (c) 1989, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  *
36  * Redistribution and use in source and binary forms, with or without
37  * modification, are permitted provided that the following conditions
38  * are met:
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. Neither the name of the University nor the names of its contributors
45  *    may be used to endorse or promote products derived from this software
46  *    without specific prior written permission.
47  *
48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58  * SUCH DAMAGE.
59  *
60  *	@(#)kern_ktrace.c	8.5 (Berkeley) 5/14/95
61  */
62 
63 #include <sys/cdefs.h>
64 __KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.144 2008/04/29 15:55:24 ad Exp $");
65 
66 #include <sys/param.h>
67 #include <sys/systm.h>
68 #include <sys/proc.h>
69 #include <sys/file.h>
70 #include <sys/namei.h>
71 #include <sys/vnode.h>
72 #include <sys/kernel.h>
73 #include <sys/kthread.h>
74 #include <sys/ktrace.h>
75 #include <sys/kmem.h>
76 #include <sys/syslog.h>
77 #include <sys/filedesc.h>
78 #include <sys/ioctl.h>
79 #include <sys/callout.h>
80 #include <sys/kauth.h>
81 
82 #include <sys/mount.h>
83 #include <sys/syscallargs.h>
84 
85 /*
86  * TODO:
87  *	- need better error reporting?
88  *	- userland utility to sort ktrace.out by timestamp.
89  *	- keep minimum information in ktrace_entry when rest of alloc failed.
90  *	- per trace control of configurable parameters.
91  */
92 
93 struct ktrace_entry {
94 	TAILQ_ENTRY(ktrace_entry) kte_list;
95 	struct	ktr_header kte_kth;
96 	void	*kte_buf;
97 	size_t	kte_bufsz;
98 #define	KTE_SPACE		32
99 	uint8_t kte_space[KTE_SPACE];
100 };
101 
102 struct ktr_desc {
103 	TAILQ_ENTRY(ktr_desc) ktd_list;
104 	int ktd_flags;
105 #define	KTDF_WAIT		0x0001
106 #define	KTDF_DONE		0x0002
107 #define	KTDF_BLOCKING		0x0004
108 #define	KTDF_INTERACTIVE	0x0008
109 	int ktd_error;
110 #define	KTDE_ENOMEM		0x0001
111 #define	KTDE_ENOSPC		0x0002
112 	int ktd_errcnt;
113 	int ktd_ref;			/* # of reference */
114 	int ktd_qcount;			/* # of entry in the queue */
115 
116 	/*
117 	 * Params to control behaviour.
118 	 */
119 	int ktd_delayqcnt;		/* # of entry allowed to delay */
120 	int ktd_wakedelay;		/* delay of wakeup in *tick* */
121 	int ktd_intrwakdl;		/* ditto, but when interactive */
122 
123 	file_t *ktd_fp;			/* trace output file */
124 	lwp_t *ktd_lwp;			/* our kernel thread */
125 	TAILQ_HEAD(, ktrace_entry) ktd_queue;
126 	callout_t ktd_wakch;		/* delayed wakeup */
127 	kcondvar_t ktd_sync_cv;
128 	kcondvar_t ktd_cv;
129 };
130 
131 static int	ktealloc(struct ktrace_entry **, void **, lwp_t *, int,
132 			 size_t);
133 static void	ktrwrite(struct ktr_desc *, struct ktrace_entry *);
134 static int	ktrace_common(lwp_t *, int, int, int, file_t *);
135 static int	ktrops(lwp_t *, struct proc *, int, int,
136 		    struct ktr_desc *);
137 static int	ktrsetchildren(lwp_t *, struct proc *, int, int,
138 		    struct ktr_desc *);
139 static int	ktrcanset(lwp_t *, struct proc *);
140 static int	ktrsamefile(file_t *, file_t *);
141 static void	ktr_kmem(lwp_t *, int, const void *, size_t);
142 static void	ktr_io(lwp_t *, int, enum uio_rw, struct iovec *, size_t);
143 
144 static struct ktr_desc *
145 		ktd_lookup(file_t *);
146 static void	ktdrel(struct ktr_desc *);
147 static void	ktdref(struct ktr_desc *);
148 static void	ktraddentry(lwp_t *, struct ktrace_entry *, int);
149 /* Flags for ktraddentry (3rd arg) */
150 #define	KTA_NOWAIT		0x0000
151 #define	KTA_WAITOK		0x0001
152 #define	KTA_LARGE		0x0002
153 static void	ktefree(struct ktrace_entry *);
154 static void	ktd_logerrl(struct ktr_desc *, int);
155 static void	ktrace_thread(void *);
156 static int	ktrderefall(struct ktr_desc *, int);
157 
158 /*
159  * Default vaules.
160  */
161 #define	KTD_MAXENTRY		1000	/* XXX: tune */
162 #define	KTD_TIMEOUT		5	/* XXX: tune */
163 #define	KTD_DELAYQCNT		100	/* XXX: tune */
164 #define	KTD_WAKEDELAY		5000	/* XXX: tune */
165 #define	KTD_INTRWAKDL		100	/* XXX: tune */
166 
167 /*
168  * Patchable variables.
169  */
170 int ktd_maxentry = KTD_MAXENTRY;	/* max # of entry in the queue */
171 int ktd_timeout = KTD_TIMEOUT;		/* timeout in seconds */
172 int ktd_delayqcnt = KTD_DELAYQCNT;	/* # of entry allowed to delay */
173 int ktd_wakedelay = KTD_WAKEDELAY;	/* delay of wakeup in *ms* */
174 int ktd_intrwakdl = KTD_INTRWAKDL;	/* ditto, but when interactive */
175 
176 kmutex_t ktrace_lock;
177 int ktrace_on;
178 static TAILQ_HEAD(, ktr_desc) ktdq = TAILQ_HEAD_INITIALIZER(ktdq);
179 
180 MALLOC_DEFINE(M_KTRACE, "ktrace", "ktrace data buffer");
181 POOL_INIT(kte_pool, sizeof(struct ktrace_entry), 0, 0, 0,
182     "ktepl", &pool_allocator_nointr, IPL_NONE);
183 
184 static void
185 ktd_wakeup(struct ktr_desc *ktd)
186 {
187 
188 	callout_stop(&ktd->ktd_wakch);
189 	cv_signal(&ktd->ktd_cv);
190 }
191 
192 static void
193 ktd_callout(void *arg)
194 {
195 
196 	mutex_enter(&ktrace_lock);
197 	ktd_wakeup(arg);
198 	mutex_exit(&ktrace_lock);
199 }
200 
201 static void
202 ktd_logerrl(struct ktr_desc *ktd, int error)
203 {
204 
205 	ktd->ktd_error |= error;
206 	ktd->ktd_errcnt++;
207 }
208 
209 #if 0
210 static void
211 ktd_logerr(struct proc *p, int error)
212 {
213 	struct ktr_desc *ktd;
214 
215 	KASSERT(mutex_owned(&ktrace_lock));
216 
217 	ktd = p->p_tracep;
218 	if (ktd == NULL)
219 		return;
220 
221 	ktd_logerrl(ktd, error);
222 }
223 #endif
224 
225 static inline int
226 ktrenter(lwp_t *l)
227 {
228 
229 	if ((l->l_pflag & LP_KTRACTIVE) != 0)
230 		return 1;
231 	l->l_pflag |= LP_KTRACTIVE;
232 	return 0;
233 }
234 
235 static inline void
236 ktrexit(lwp_t *l)
237 {
238 
239 	l->l_pflag &= ~LP_KTRACTIVE;
240 }
241 
242 /*
243  * Initialise the ktrace system.
244  */
245 void
246 ktrinit(void)
247 {
248 
249 	mutex_init(&ktrace_lock, MUTEX_DEFAULT, IPL_NONE);
250 }
251 
252 /*
253  * Release a reference.  Called with ktrace_lock held.
254  */
255 void
256 ktdrel(struct ktr_desc *ktd)
257 {
258 
259 	KASSERT(mutex_owned(&ktrace_lock));
260 
261 	KDASSERT(ktd->ktd_ref != 0);
262 	KASSERT(ktd->ktd_ref > 0);
263 	KASSERT(ktrace_on > 0);
264 	ktrace_on--;
265 	if (--ktd->ktd_ref <= 0) {
266 		ktd->ktd_flags |= KTDF_DONE;
267 		cv_signal(&ktd->ktd_cv);
268 	}
269 }
270 
271 void
272 ktdref(struct ktr_desc *ktd)
273 {
274 
275 	KASSERT(mutex_owned(&ktrace_lock));
276 
277 	ktd->ktd_ref++;
278 	ktrace_on++;
279 }
280 
281 struct ktr_desc *
282 ktd_lookup(file_t *fp)
283 {
284 	struct ktr_desc *ktd;
285 
286 	KASSERT(mutex_owned(&ktrace_lock));
287 
288 	for (ktd = TAILQ_FIRST(&ktdq); ktd != NULL;
289 	    ktd = TAILQ_NEXT(ktd, ktd_list)) {
290 		if (ktrsamefile(ktd->ktd_fp, fp)) {
291 			ktdref(ktd);
292 			break;
293 		}
294 	}
295 
296 	return (ktd);
297 }
298 
299 void
300 ktraddentry(lwp_t *l, struct ktrace_entry *kte, int flags)
301 {
302 	struct proc *p = l->l_proc;
303 	struct ktr_desc *ktd;
304 #ifdef DEBUG
305 	struct timeval t1, t2;
306 #endif
307 
308 	mutex_enter(&ktrace_lock);
309 
310 	if (p->p_traceflag & KTRFAC_TRC_EMUL) {
311 		/* Add emulation trace before first entry for this process */
312 		p->p_traceflag &= ~KTRFAC_TRC_EMUL;
313 		mutex_exit(&ktrace_lock);
314 		ktrexit(l);
315 		ktremul();
316 		(void)ktrenter(l);
317 		mutex_enter(&ktrace_lock);
318 	}
319 
320 	/* Tracing may have been cancelled. */
321 	ktd = p->p_tracep;
322 	if (ktd == NULL)
323 		goto freekte;
324 
325 	/*
326 	 * Bump reference count so that the object will remain while
327 	 * we are here.  Note that the trace is controlled by other
328 	 * process.
329 	 */
330 	ktdref(ktd);
331 
332 	if (ktd->ktd_flags & KTDF_DONE)
333 		goto relktd;
334 
335 	if (ktd->ktd_qcount > ktd_maxentry) {
336 		ktd_logerrl(ktd, KTDE_ENOSPC);
337 		goto relktd;
338 	}
339 	TAILQ_INSERT_TAIL(&ktd->ktd_queue, kte, kte_list);
340 	ktd->ktd_qcount++;
341 	if (ktd->ktd_flags & KTDF_BLOCKING)
342 		goto skip_sync;
343 
344 	if (flags & KTA_WAITOK &&
345 	    (/* flags & KTA_LARGE */0 || ktd->ktd_flags & KTDF_WAIT ||
346 	    ktd->ktd_qcount > ktd_maxentry >> 1))
347 		/*
348 		 * Sync with writer thread since we're requesting rather
349 		 * big one or many requests are pending.
350 		 */
351 		do {
352 			ktd->ktd_flags |= KTDF_WAIT;
353 			ktd_wakeup(ktd);
354 #ifdef DEBUG
355 			getmicrouptime(&t1);
356 #endif
357 			if (cv_timedwait(&ktd->ktd_sync_cv, &ktrace_lock,
358 			    ktd_timeout * hz) != 0) {
359 				ktd->ktd_flags |= KTDF_BLOCKING;
360 				/*
361 				 * Maybe the writer thread is blocking
362 				 * completely for some reason, but
363 				 * don't stop target process forever.
364 				 */
365 				log(LOG_NOTICE, "ktrace timeout\n");
366 				break;
367 			}
368 #ifdef DEBUG
369 			getmicrouptime(&t2);
370 			timersub(&t2, &t1, &t2);
371 			if (t2.tv_sec > 0)
372 				log(LOG_NOTICE,
373 				    "ktrace long wait: %ld.%06ld\n",
374 				    t2.tv_sec, t2.tv_usec);
375 #endif
376 		} while (p->p_tracep == ktd &&
377 		    (ktd->ktd_flags & (KTDF_WAIT | KTDF_DONE)) == KTDF_WAIT);
378 	else {
379 		/* Schedule delayed wakeup */
380 		if (ktd->ktd_qcount > ktd->ktd_delayqcnt)
381 			ktd_wakeup(ktd);	/* Wakeup now */
382 		else if (!callout_pending(&ktd->ktd_wakch))
383 			callout_reset(&ktd->ktd_wakch,
384 			    ktd->ktd_flags & KTDF_INTERACTIVE ?
385 			    ktd->ktd_intrwakdl : ktd->ktd_wakedelay,
386 			    ktd_callout, ktd);
387 	}
388 
389 skip_sync:
390 	ktdrel(ktd);
391 	mutex_exit(&ktrace_lock);
392 	ktrexit(l);
393 	return;
394 
395 relktd:
396 	ktdrel(ktd);
397 
398 freekte:
399 	mutex_exit(&ktrace_lock);
400 	ktefree(kte);
401 	ktrexit(l);
402 }
403 
404 void
405 ktefree(struct ktrace_entry *kte)
406 {
407 
408 	if (kte->kte_buf != kte->kte_space)
409 		kmem_free(kte->kte_buf, kte->kte_bufsz);
410 	pool_put(&kte_pool, kte);
411 }
412 
413 /*
414  * "deep" compare of two files for the purposes of clearing a trace.
415  * Returns true if they're the same open file, or if they point at the
416  * same underlying vnode/socket.
417  */
418 
419 int
420 ktrsamefile(file_t *f1, file_t *f2)
421 {
422 
423 	return ((f1 == f2) ||
424 	    ((f1 != NULL) && (f2 != NULL) &&
425 		(f1->f_type == f2->f_type) &&
426 		(f1->f_data == f2->f_data)));
427 }
428 
429 void
430 ktrderef(struct proc *p)
431 {
432 	struct ktr_desc *ktd = p->p_tracep;
433 
434 	KASSERT(mutex_owned(&ktrace_lock));
435 
436 	p->p_traceflag = 0;
437 	if (ktd == NULL)
438 		return;
439 	p->p_tracep = NULL;
440 
441 	cv_broadcast(&ktd->ktd_sync_cv);
442 	ktdrel(ktd);
443 }
444 
445 void
446 ktradref(struct proc *p)
447 {
448 	struct ktr_desc *ktd = p->p_tracep;
449 
450 	KASSERT(mutex_owned(&ktrace_lock));
451 
452 	ktdref(ktd);
453 }
454 
455 int
456 ktrderefall(struct ktr_desc *ktd, int auth)
457 {
458 	lwp_t *curl = curlwp;
459 	struct proc *p;
460 	int error = 0;
461 
462 	mutex_enter(proc_lock);
463 	PROCLIST_FOREACH(p, &allproc) {
464 		if ((p->p_flag & PK_MARKER) != 0 || p->p_tracep != ktd)
465 			continue;
466 		mutex_enter(p->p_lock);
467 		mutex_enter(&ktrace_lock);
468 		if (p->p_tracep == ktd) {
469 			if (!auth || ktrcanset(curl, p))
470 				ktrderef(p);
471 			else
472 				error = EPERM;
473 		}
474 		mutex_exit(&ktrace_lock);
475 		mutex_exit(p->p_lock);
476 	}
477 	mutex_exit(proc_lock);
478 
479 	return error;
480 }
481 
482 int
483 ktealloc(struct ktrace_entry **ktep, void **bufp, lwp_t *l, int type,
484 	 size_t sz)
485 {
486 	struct proc *p = l->l_proc;
487 	struct ktrace_entry *kte;
488 	struct ktr_header *kth;
489 	void *buf;
490 
491 	if (ktrenter(l))
492 		return EAGAIN;
493 
494 	kte = pool_get(&kte_pool, PR_WAITOK);
495 	if (sz > sizeof(kte->kte_space)) {
496 		if ((buf = kmem_alloc(sz, KM_SLEEP)) == NULL) {
497 			pool_put(&kte_pool, kte);
498 			ktrexit(l);
499 			return ENOMEM;
500 		}
501 	} else
502 		buf = kte->kte_space;
503 
504 	kte->kte_bufsz = sz;
505 	kte->kte_buf = buf;
506 
507 	kth = &kte->kte_kth;
508 	(void)memset(kth, 0, sizeof(*kth));
509 	kth->ktr_len = sz;
510 	kth->ktr_type = type;
511 	kth->ktr_pid = p->p_pid;
512 	memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN);
513 	kth->ktr_version = KTRFAC_VERSION(p->p_traceflag);
514 
515 	switch (KTRFAC_VERSION(p->p_traceflag)) {
516 	case 0:
517 		/* This is the original format */
518 		microtime(&kth->ktr_tv);
519 		break;
520 	case 1:
521 		kth->ktr_lid = l->l_lid;
522 		nanotime(&kth->ktr_time);
523 		break;
524 	default:
525 		break;
526 	}
527 
528 	*ktep = kte;
529 	*bufp = buf;
530 
531 	return 0;
532 }
533 
534 void
535 ktr_syscall(register_t code, const register_t args[], int narg)
536 {
537 	lwp_t *l = curlwp;
538 	struct proc *p = l->l_proc;
539 	struct ktrace_entry *kte;
540 	struct ktr_syscall *ktp;
541 	register_t *argp;
542 	size_t len;
543 	u_int i;
544 
545 	if (!KTRPOINT(p, KTR_SYSCALL))
546 		return;
547 
548 	len = sizeof(struct ktr_syscall) + narg * sizeof argp[0];
549 
550 	if (ktealloc(&kte, (void *)&ktp, l, KTR_SYSCALL, len))
551 		return;
552 
553 	ktp->ktr_code = code;
554 	ktp->ktr_argsize = narg * sizeof argp[0];
555 	argp = (register_t *)(ktp + 1);
556 	for (i = 0; i < narg; i++)
557 		*argp++ = args[i];
558 
559 	ktraddentry(l, kte, KTA_WAITOK);
560 }
561 
562 void
563 ktr_sysret(register_t code, int error, register_t *retval)
564 {
565 	lwp_t *l = curlwp;
566 	struct ktrace_entry *kte;
567 	struct ktr_sysret *ktp;
568 
569 	if (!KTRPOINT(l->l_proc, KTR_SYSRET))
570 		return;
571 
572 	if (ktealloc(&kte, (void *)&ktp, l, KTR_SYSRET,
573 	    sizeof(struct ktr_sysret)))
574 		return;
575 
576 	ktp->ktr_code = code;
577 	ktp->ktr_eosys = 0;			/* XXX unused */
578 	ktp->ktr_error = error;
579 	ktp->ktr_retval = retval ? retval[0] : 0;
580 	ktp->ktr_retval_1 = retval ? retval[1] : 0;
581 
582 	ktraddentry(l, kte, KTA_WAITOK);
583 }
584 
585 void
586 ktr_namei(const char *path, size_t pathlen)
587 {
588 	lwp_t *l = curlwp;
589 
590 	if (!KTRPOINT(l->l_proc, KTR_NAMEI))
591 		return;
592 
593 	ktr_kmem(l, KTR_NAMEI, path, pathlen);
594 }
595 
596 void
597 ktr_namei2(const char *eroot, size_t erootlen,
598 	  const char *path, size_t pathlen)
599 {
600 	lwp_t *l = curlwp;
601 	struct ktrace_entry *kte;
602 	void *buf;
603 
604 	if (!KTRPOINT(l->l_proc, KTR_NAMEI))
605 		return;
606 
607 	if (ktealloc(&kte, &buf, l, KTR_NAMEI, erootlen + pathlen))
608 		return;
609 	memcpy(buf, eroot, erootlen);
610 	buf = (char *)buf + erootlen;
611 	memcpy(buf, path, pathlen);
612 	ktraddentry(l, kte, KTA_WAITOK);
613 }
614 
615 void
616 ktr_emul(void)
617 {
618 	lwp_t *l = curlwp;
619 	const char *emul = l->l_proc->p_emul->e_name;
620 
621 	if (!KTRPOINT(l->l_proc, KTR_EMUL))
622 		return;
623 
624 	ktr_kmem(l, KTR_EMUL, emul, strlen(emul));
625 }
626 
627 void
628 ktr_execarg(const void *bf, size_t len)
629 {
630 	lwp_t *l = curlwp;
631 
632 	if (!KTRPOINT(l->l_proc, KTR_EXEC_ARG))
633 		return;
634 
635 	ktr_kmem(l, KTR_EXEC_ARG, bf, len);
636 }
637 
638 void
639 ktr_execenv(const void *bf, size_t len)
640 {
641 	lwp_t *l = curlwp;
642 
643 	if (!KTRPOINT(l->l_proc, KTR_EXEC_ENV))
644 		return;
645 
646 	ktr_kmem(l, KTR_EXEC_ENV, bf, len);
647 }
648 
649 static void
650 ktr_kmem(lwp_t *l, int type, const void *bf, size_t len)
651 {
652 	struct ktrace_entry *kte;
653 	void *buf;
654 
655 	if (ktealloc(&kte, &buf, l, type, len))
656 		return;
657 	memcpy(buf, bf, len);
658 	ktraddentry(l, kte, KTA_WAITOK);
659 }
660 
661 static void
662 ktr_io(lwp_t *l, int fd, enum uio_rw rw, struct iovec *iov, size_t len)
663 {
664 	struct ktrace_entry *kte;
665 	struct ktr_genio *ktp;
666 	size_t resid = len, cnt, buflen;
667 	void *cp;
668 
669  next:
670 	buflen = min(PAGE_SIZE, resid + sizeof(struct ktr_genio));
671 
672 	if (ktealloc(&kte, (void *)&ktp, l, KTR_GENIO, buflen))
673 		return;
674 
675 	ktp->ktr_fd = fd;
676 	ktp->ktr_rw = rw;
677 
678 	cp = (void *)(ktp + 1);
679 	buflen -= sizeof(struct ktr_genio);
680 	kte->kte_kth.ktr_len = sizeof(struct ktr_genio);
681 
682 	while (buflen > 0) {
683 		cnt = min(iov->iov_len, buflen);
684 		if (copyin(iov->iov_base, cp, cnt) != 0)
685 			goto out;
686 		kte->kte_kth.ktr_len += cnt;
687 		buflen -= cnt;
688 		resid -= cnt;
689 		iov->iov_len -= cnt;
690 		if (iov->iov_len == 0)
691 			iov++;
692 		else
693 			iov->iov_base = (char *)iov->iov_base + cnt;
694 	}
695 
696 	/*
697 	 * Don't push so many entry at once.  It will cause kmem map
698 	 * shortage.
699 	 */
700 	ktraddentry(l, kte, KTA_WAITOK | KTA_LARGE);
701 	if (resid > 0) {
702 		if (curcpu()->ci_schedstate.spc_flags & SPCF_SHOULDYIELD) {
703 			(void)ktrenter(l);
704 			preempt();
705 			ktrexit(l);
706 		}
707 
708 		goto next;
709 	}
710 
711 	return;
712 
713 out:
714 	ktefree(kte);
715 	ktrexit(l);
716 }
717 
718 void
719 ktr_genio(int fd, enum uio_rw rw, const void *addr, size_t len, int error)
720 {
721 	lwp_t *l = curlwp;
722 	struct iovec iov;
723 
724 	if (!KTRPOINT(l->l_proc, KTR_GENIO) || error != 0)
725 		return;
726 	iov.iov_base = __UNCONST(addr);
727 	iov.iov_len = len;
728 	ktr_io(l, fd, rw, &iov, len);
729 }
730 
731 void
732 ktr_geniov(int fd, enum uio_rw rw, struct iovec *iov, size_t len, int error)
733 {
734 	lwp_t *l = curlwp;
735 
736 	if (!KTRPOINT(l->l_proc, KTR_GENIO) || error != 0)
737 		return;
738 	ktr_io(l, fd, rw, iov, len);
739 }
740 
741 void
742 ktr_mibio(int fd, enum uio_rw rw, const void *addr, size_t len, int error)
743 {
744 	lwp_t *l = curlwp;
745 	struct iovec iov;
746 
747 	if (!KTRPOINT(l->l_proc, KTR_MIB) || error != 0)
748 		return;
749 	iov.iov_base = __UNCONST(addr);
750 	iov.iov_len = len;
751 	ktr_io(l, fd, rw, &iov, len);
752 }
753 
754 void
755 ktr_psig(int sig, sig_t action, const sigset_t *mask,
756 	 const ksiginfo_t *ksi)
757 {
758 	struct ktrace_entry *kte;
759 	lwp_t *l = curlwp;
760 	struct {
761 		struct ktr_psig	kp;
762 		siginfo_t	si;
763 	} *kbuf;
764 
765 	if (!KTRPOINT(l->l_proc, KTR_PSIG))
766 		return;
767 
768 	if (ktealloc(&kte, (void *)&kbuf, l, KTR_PSIG, sizeof(*kbuf)))
769 		return;
770 
771 	kbuf->kp.signo = (char)sig;
772 	kbuf->kp.action = action;
773 	kbuf->kp.mask = *mask;
774 
775 	if (ksi) {
776 		kbuf->kp.code = KSI_TRAPCODE(ksi);
777 		(void)memset(&kbuf->si, 0, sizeof(kbuf->si));
778 		kbuf->si._info = ksi->ksi_info;
779 		kte->kte_kth.ktr_len = sizeof(*kbuf);
780 	} else {
781 		kbuf->kp.code = 0;
782 		kte->kte_kth.ktr_len = sizeof(struct ktr_psig);
783 	}
784 
785 	ktraddentry(l, kte, KTA_WAITOK);
786 }
787 
788 void
789 ktr_csw(int out, int user)
790 {
791 	lwp_t *l = curlwp;
792 	struct proc *p = l->l_proc;
793 	struct ktrace_entry *kte;
794 	struct ktr_csw *kc;
795 
796 	if (!KTRPOINT(p, KTR_CSW))
797 		return;
798 
799 	/*
800 	 * Don't record context switches resulting from blocking on
801 	 * locks; it's too easy to get duff results.
802 	 */
803 	if (l->l_syncobj == &mutex_syncobj || l->l_syncobj == &rw_syncobj)
804 		return;
805 
806 	/*
807 	 * We can't sleep if we're already going to sleep (if original
808 	 * condition is met during sleep, we hang up).
809 	 *
810 	 * XXX This is not ideal: it would be better to maintain a pool
811 	 * of ktes and actually push this to the kthread when context
812 	 * switch happens, however given the points where we are called
813 	 * from that is difficult to do.
814 	 */
815 	if (out) {
816 		if (ktrenter(l))
817 			return;
818 
819 		switch (KTRFAC_VERSION(p->p_traceflag)) {
820 		case 0:
821 			/* This is the original format */
822 			microtime(&l->l_ktrcsw.tv);
823 			l->l_pflag |= LP_KTRCSW;
824 			break;
825 		case 1:
826 			nanotime(&l->l_ktrcsw.ts);
827 			l->l_pflag |= LP_KTRCSW;
828 			break;
829 		default:
830 			break;
831 		}
832 
833 		if (user)
834 			l->l_pflag |= LP_KTRCSWUSER;
835 		else
836 			l->l_pflag &= ~LP_KTRCSWUSER;
837 
838 		ktrexit(l);
839 		return;
840 	}
841 
842 	/*
843 	 * On the way back in, we need to record twice: once for entry, and
844 	 * once for exit.
845 	 */
846 	if ((l->l_pflag & LP_KTRCSW) != 0) {
847 		l->l_pflag &= ~LP_KTRCSW;
848 
849 		if (ktealloc(&kte, (void *)&kc, l, KTR_CSW, sizeof(*kc)))
850 			return;
851 
852 		kc->out = 1;
853 		kc->user = ((l->l_pflag & LP_KTRCSWUSER) != 0);
854 
855 		switch (KTRFAC_VERSION(p->p_traceflag)) {
856 		case 0:
857 			/* This is the original format */
858 			memcpy(&kte->kte_kth.ktr_tv, &l->l_ktrcsw.tv,
859 			    sizeof(kte->kte_kth.ktr_tv));
860 			break;
861 		case 1:
862 			memcpy(&kte->kte_kth.ktr_time, &l->l_ktrcsw.ts,
863 			    sizeof(kte->kte_kth.ktr_time));
864 			break;
865 		default:
866 			break;
867 		}
868 
869 		ktraddentry(l, kte, KTA_WAITOK);
870 	}
871 
872 	if (ktealloc(&kte, (void *)&kc, l, KTR_CSW, sizeof(*kc)))
873 		return;
874 
875 	kc->out = 0;
876 	kc->user = user;
877 
878 	ktraddentry(l, kte, KTA_WAITOK);
879 }
880 
881 bool
882 ktr_point(int fac_bit)
883 {
884 	return curlwp->l_proc->p_traceflag & fac_bit;
885 }
886 
887 int
888 ktruser(const char *id, void *addr, size_t len, int ustr)
889 {
890 	struct ktrace_entry *kte;
891 	struct ktr_user *ktp;
892 	lwp_t *l = curlwp;
893 	void *user_dta;
894 	int error;
895 
896 	if (!KTRPOINT(l->l_proc, KTR_USER))
897 		return 0;
898 
899 	if (len > KTR_USER_MAXLEN)
900 		return ENOSPC;
901 
902 	error = ktealloc(&kte, (void *)&ktp, l, KTR_USER, sizeof(*ktp) + len);
903 	if (error != 0)
904 		return error;
905 
906 	if (ustr) {
907 		if (copyinstr(id, ktp->ktr_id, KTR_USER_MAXIDLEN, NULL) != 0)
908 			ktp->ktr_id[0] = '\0';
909 	} else
910 		strncpy(ktp->ktr_id, id, KTR_USER_MAXIDLEN);
911 	ktp->ktr_id[KTR_USER_MAXIDLEN-1] = '\0';
912 
913 	user_dta = (void *)(ktp + 1);
914 	if ((error = copyin(addr, (void *)user_dta, len)) != 0)
915 		len = 0;
916 
917 	ktraddentry(l, kte, KTA_WAITOK);
918 	return error;
919 }
920 
921 void
922 ktr_kuser(const char *id, void *addr, size_t len)
923 {
924 	struct ktrace_entry *kte;
925 	struct ktr_user *ktp;
926 	lwp_t *l = curlwp;
927 	int error;
928 
929 	if (!KTRPOINT(l->l_proc, KTR_USER))
930 		return;
931 
932 	if (len > KTR_USER_MAXLEN)
933 		return;
934 
935 	error = ktealloc(&kte, (void *)&ktp, l, KTR_USER, sizeof(*ktp) + len);
936 	if (error != 0)
937 		return;
938 
939 	strlcpy(ktp->ktr_id, id, KTR_USER_MAXIDLEN);
940 
941 	memcpy(ktp + 1, addr, len);
942 
943 	ktraddentry(l, kte, KTA_WAITOK);
944 }
945 
946 void
947 ktr_mmsg(const void *msgh, size_t size)
948 {
949 	lwp_t *l = curlwp;
950 
951 	if (!KTRPOINT(l->l_proc, KTR_MMSG))
952 		return;
953 
954 	ktr_kmem(l, KTR_MMSG, msgh, size);
955 }
956 
957 void
958 ktr_mool(const void *kaddr, size_t size, const void *uaddr)
959 {
960 	struct ktrace_entry *kte;
961 	struct ktr_mool *kp;
962 	struct ktr_mool *bf;
963 	lwp_t *l = curlwp;
964 
965 	if (!KTRPOINT(l->l_proc, KTR_MOOL))
966 		return;
967 
968 	if (ktealloc(&kte, (void *)&kp, l, KTR_MOOL, size + sizeof(*kp)))
969 		return;
970 
971 	kp->uaddr = uaddr;
972 	kp->size = size;
973 	bf = kp + 1; /* Skip uaddr and size */
974 	(void)memcpy(bf, kaddr, size);
975 
976 	ktraddentry(l, kte, KTA_WAITOK);
977 }
978 
979 void
980 ktr_mib(const int *name, u_int namelen)
981 {
982 	struct ktrace_entry *kte;
983 	int *namep;
984 	size_t size;
985 	lwp_t *l = curlwp;
986 
987 	if (!KTRPOINT(l->l_proc, KTR_MIB))
988 		return;
989 
990 	size = namelen * sizeof(*name);
991 
992 	if (ktealloc(&kte, (void *)&namep, l, KTR_MIB, size))
993 		return;
994 
995 	(void)memcpy(namep, name, namelen * sizeof(*name));
996 
997 	ktraddentry(l, kte, KTA_WAITOK);
998 }
999 
1000 /* Interface and common routines */
1001 
1002 int
1003 ktrace_common(lwp_t *curl, int ops, int facs, int pid, file_t *fp)
1004 {
1005 	struct proc *curp;
1006 	struct proc *p;
1007 	struct pgrp *pg;
1008 	struct ktr_desc *ktd = NULL;
1009 	int ret = 0;
1010 	int error = 0;
1011 	int descend;
1012 
1013 	curp = curl->l_proc;
1014 	descend = ops & KTRFLAG_DESCEND;
1015 	facs = facs & ~((unsigned) KTRFAC_PERSISTENT);
1016 
1017 	(void)ktrenter(curl);
1018 
1019 	switch (KTROP(ops)) {
1020 
1021 	case KTROP_CLEARFILE:
1022 		/*
1023 		 * Clear all uses of the tracefile
1024 		 */
1025 		mutex_enter(&ktrace_lock);
1026 		ktd = ktd_lookup(fp);
1027 		mutex_exit(&ktrace_lock);
1028 		if (ktd == NULL)
1029 			goto done;
1030 		error = ktrderefall(ktd, 1);
1031 		goto done;
1032 
1033 	case KTROP_SET:
1034 		mutex_enter(&ktrace_lock);
1035 		ktd = ktd_lookup(fp);
1036 		mutex_exit(&ktrace_lock);
1037 		if (ktd == NULL) {
1038 			ktd = kmem_alloc(sizeof(*ktd), KM_SLEEP);
1039 			TAILQ_INIT(&ktd->ktd_queue);
1040 			callout_init(&ktd->ktd_wakch, CALLOUT_MPSAFE);
1041 			cv_init(&ktd->ktd_cv, "ktrwait");
1042 			cv_init(&ktd->ktd_sync_cv, "ktrsync");
1043 			ktd->ktd_flags = 0;
1044 			ktd->ktd_qcount = 0;
1045 			ktd->ktd_error = 0;
1046 			ktd->ktd_errcnt = 0;
1047 			ktd->ktd_delayqcnt = ktd_delayqcnt;
1048 			ktd->ktd_wakedelay = mstohz(ktd_wakedelay);
1049 			ktd->ktd_intrwakdl = mstohz(ktd_intrwakdl);
1050 			ktd->ktd_ref = 0;
1051 			ktd->ktd_fp = fp;
1052 			mutex_enter(&ktrace_lock);
1053 			ktdref(ktd);
1054 			mutex_exit(&ktrace_lock);
1055 
1056 			/*
1057 			 * XXX: not correct.  needs an way to detect
1058 			 * whether ktruss or ktrace.
1059 			 */
1060 			if (fp->f_type == DTYPE_PIPE)
1061 				ktd->ktd_flags |= KTDF_INTERACTIVE;
1062 
1063 			mutex_enter(&fp->f_lock);
1064 			fp->f_count++;
1065 			mutex_exit(&fp->f_lock);
1066 			error = kthread_create(PRI_NONE, KTHREAD_MPSAFE, NULL,
1067 			    ktrace_thread, ktd, &ktd->ktd_lwp, "ktrace");
1068 			if (error != 0) {
1069 				kmem_free(ktd, sizeof(*ktd));
1070 				mutex_enter(&fp->f_lock);
1071 				fp->f_count--;
1072 				mutex_exit(&fp->f_lock);
1073 				goto done;
1074 			}
1075 
1076 			mutex_enter(&ktrace_lock);
1077 			if (ktd_lookup(fp) != NULL) {
1078 				ktdrel(ktd);
1079 				ktd = NULL;
1080 			} else
1081 				TAILQ_INSERT_TAIL(&ktdq, ktd, ktd_list);
1082 			if (ktd == NULL)
1083 				cv_wait(&lbolt, &ktrace_lock);
1084 			mutex_exit(&ktrace_lock);
1085 			if (ktd == NULL)
1086 				goto done;
1087 		}
1088 		break;
1089 
1090 	case KTROP_CLEAR:
1091 		break;
1092 	}
1093 
1094 	/*
1095 	 * need something to (un)trace (XXX - why is this here?)
1096 	 */
1097 	if (!facs) {
1098 		error = EINVAL;
1099 		goto done;
1100 	}
1101 
1102 	/*
1103 	 * do it
1104 	 */
1105 	mutex_enter(proc_lock);
1106 	if (pid < 0) {
1107 		/*
1108 		 * by process group
1109 		 */
1110 		pg = pg_find(-pid, PFIND_LOCKED);
1111 		if (pg == NULL)
1112 			error = ESRCH;
1113 		else {
1114 			LIST_FOREACH(p, &pg->pg_members, p_pglist) {
1115 				if (descend)
1116 					ret |= ktrsetchildren(curl, p, ops,
1117 					    facs, ktd);
1118 				else
1119 					ret |= ktrops(curl, p, ops, facs,
1120 					    ktd);
1121 			}
1122 		}
1123 
1124 	} else {
1125 		/*
1126 		 * by pid
1127 		 */
1128 		p = p_find(pid, PFIND_LOCKED);
1129 		if (p == NULL)
1130 			error = ESRCH;
1131 		else if (descend)
1132 			ret |= ktrsetchildren(curl, p, ops, facs, ktd);
1133 		else
1134 			ret |= ktrops(curl, p, ops, facs, ktd);
1135 	}
1136 	mutex_exit(proc_lock);
1137 	if (error == 0 && !ret)
1138 		error = EPERM;
1139 done:
1140 	if (ktd != NULL) {
1141 		mutex_enter(&ktrace_lock);
1142 		if (error != 0) {
1143 			/*
1144 			 * Wakeup the thread so that it can be die if we
1145 			 * can't trace any process.
1146 			 */
1147 			ktd_wakeup(ktd);
1148 		}
1149 		if (KTROP(ops) == KTROP_SET || KTROP(ops) == KTROP_CLEARFILE)
1150 			ktdrel(ktd);
1151 		mutex_exit(&ktrace_lock);
1152 	}
1153 	ktrexit(curl);
1154 	return (error);
1155 }
1156 
1157 /*
1158  * fktrace system call
1159  */
1160 /* ARGSUSED */
1161 int
1162 sys_fktrace(struct lwp *l, const struct sys_fktrace_args *uap, register_t *retval)
1163 {
1164 	/* {
1165 		syscallarg(int) fd;
1166 		syscallarg(int) ops;
1167 		syscallarg(int) facs;
1168 		syscallarg(int) pid;
1169 	} */
1170 	file_t *fp;
1171 	int error, fd;
1172 
1173 	fd = SCARG(uap, fd);
1174 	if ((fp = fd_getfile(fd)) == NULL)
1175 		return (EBADF);
1176 	if ((fp->f_flag & FWRITE) == 0)
1177 		error = EBADF;
1178 	else
1179 		error = ktrace_common(l, SCARG(uap, ops),
1180 		    SCARG(uap, facs), SCARG(uap, pid), fp);
1181 	fd_putfile(fd);
1182 	return error;
1183 }
1184 
1185 /*
1186  * ktrace system call
1187  */
1188 /* ARGSUSED */
1189 int
1190 sys_ktrace(struct lwp *l, const struct sys_ktrace_args *uap, register_t *retval)
1191 {
1192 	/* {
1193 		syscallarg(const char *) fname;
1194 		syscallarg(int) ops;
1195 		syscallarg(int) facs;
1196 		syscallarg(int) pid;
1197 	} */
1198 	struct vnode *vp = NULL;
1199 	file_t *fp = NULL;
1200 	struct nameidata nd;
1201 	int error = 0;
1202 	int fd;
1203 
1204 	if (ktrenter(l))
1205 		return EAGAIN;
1206 
1207 	if (KTROP(SCARG(uap, ops)) != KTROP_CLEAR) {
1208 		/*
1209 		 * an operation which requires a file argument.
1210 		 */
1211 		NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, fname));
1212 		if ((error = vn_open(&nd, FREAD|FWRITE, 0)) != 0) {
1213 			ktrexit(l);
1214 			return (error);
1215 		}
1216 		vp = nd.ni_vp;
1217 		VOP_UNLOCK(vp, 0);
1218 		if (vp->v_type != VREG) {
1219 			vn_close(vp, FREAD|FWRITE, l->l_cred);
1220 			ktrexit(l);
1221 			return (EACCES);
1222 		}
1223 		/*
1224 		 * This uses up a file descriptor slot in the
1225 		 * tracing process for the duration of this syscall.
1226 		 * This is not expected to be a problem.
1227 		 */
1228 		if ((error = fd_allocfile(&fp, &fd)) != 0) {
1229 			vn_close(vp, FWRITE, l->l_cred);
1230 			ktrexit(l);
1231 			return error;
1232 		}
1233 		fp->f_flag = FWRITE;
1234 		fp->f_type = DTYPE_VNODE;
1235 		fp->f_ops = &vnops;
1236 		fp->f_data = (void *)vp;
1237 		vp = NULL;
1238 	}
1239 	error = ktrace_common(l, SCARG(uap, ops), SCARG(uap, facs),
1240 	    SCARG(uap, pid), fp);
1241 	if (fp != NULL) {
1242 		if (error != 0) {
1243 			/* File unused. */
1244 			fd_abort(curproc, fp, fd);
1245 		} else {
1246 			/* File was used. */
1247 			fd_abort(curproc, NULL, fd);
1248 		}
1249 	}
1250 	return (error);
1251 }
1252 
1253 int
1254 ktrops(lwp_t *curl, struct proc *p, int ops, int facs,
1255     struct ktr_desc *ktd)
1256 {
1257 	int vers = ops & KTRFAC_VER_MASK;
1258 	int error = 0;
1259 
1260 	mutex_enter(p->p_lock);
1261 	mutex_enter(&ktrace_lock);
1262 
1263 	if (!ktrcanset(curl, p))
1264 		goto out;
1265 
1266 	switch (vers) {
1267 	case KTRFACv0:
1268 	case KTRFACv1:
1269 		break;
1270 	default:
1271 		error = EINVAL;
1272 		goto out;
1273 	}
1274 
1275 	if (KTROP(ops) == KTROP_SET) {
1276 		if (p->p_tracep != ktd) {
1277 			/*
1278 			 * if trace file already in use, relinquish
1279 			 */
1280 			ktrderef(p);
1281 			p->p_tracep = ktd;
1282 			ktradref(p);
1283 		}
1284 		p->p_traceflag |= facs;
1285 		if (kauth_authorize_process(curl->l_cred, KAUTH_PROCESS_KTRACE,
1286 		    p, KAUTH_ARG(KAUTH_REQ_PROCESS_KTRACE_PERSISTENT), NULL,
1287 		    NULL) == 0)
1288 			p->p_traceflag |= KTRFAC_PERSISTENT;
1289 	} else {
1290 		/* KTROP_CLEAR */
1291 		if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) {
1292 			/* no more tracing */
1293 			ktrderef(p);
1294 		}
1295 	}
1296 
1297 	if (p->p_traceflag)
1298 		p->p_traceflag |= vers;
1299 	/*
1300 	 * Emit an emulation record, every time there is a ktrace
1301 	 * change/attach request.
1302 	 */
1303 	if (KTRPOINT(p, KTR_EMUL))
1304 		p->p_traceflag |= KTRFAC_TRC_EMUL;
1305 
1306 	p->p_trace_enabled = trace_is_enabled(p);
1307 #ifdef __HAVE_SYSCALL_INTERN
1308 	(*p->p_emul->e_syscall_intern)(p);
1309 #endif
1310 
1311  out:
1312  	mutex_exit(&ktrace_lock);
1313  	mutex_exit(p->p_lock);
1314 
1315 	return (1);
1316 }
1317 
1318 int
1319 ktrsetchildren(lwp_t *curl, struct proc *top, int ops, int facs,
1320     struct ktr_desc *ktd)
1321 {
1322 	struct proc *p;
1323 	int ret = 0;
1324 
1325 	KASSERT(mutex_owned(proc_lock));
1326 
1327 	p = top;
1328 	for (;;) {
1329 		ret |= ktrops(curl, p, ops, facs, ktd);
1330 		/*
1331 		 * If this process has children, descend to them next,
1332 		 * otherwise do any siblings, and if done with this level,
1333 		 * follow back up the tree (but not past top).
1334 		 */
1335 		if (LIST_FIRST(&p->p_children) != NULL) {
1336 			p = LIST_FIRST(&p->p_children);
1337 			continue;
1338 		}
1339 		for (;;) {
1340 			if (p == top)
1341 				return (ret);
1342 			if (LIST_NEXT(p, p_sibling) != NULL) {
1343 				p = LIST_NEXT(p, p_sibling);
1344 				break;
1345 			}
1346 			p = p->p_pptr;
1347 		}
1348 	}
1349 	/*NOTREACHED*/
1350 }
1351 
1352 void
1353 ktrwrite(struct ktr_desc *ktd, struct ktrace_entry *kte)
1354 {
1355 	struct uio auio;
1356 	struct iovec aiov[64], *iov;
1357 	struct ktrace_entry *top = kte;
1358 	struct ktr_header *kth;
1359 	file_t *fp = ktd->ktd_fp;
1360 	int error;
1361 next:
1362 	auio.uio_iov = iov = &aiov[0];
1363 	auio.uio_offset = 0;
1364 	auio.uio_rw = UIO_WRITE;
1365 	auio.uio_resid = 0;
1366 	auio.uio_iovcnt = 0;
1367 	UIO_SETUP_SYSSPACE(&auio);
1368 	do {
1369 		kth = &kte->kte_kth;
1370 
1371 		if (kth->ktr_version == 0) {
1372 			/*
1373 			 * Convert back to the old format fields
1374 			 */
1375 			TIMESPEC_TO_TIMEVAL(&kth->ktr_tv, &kth->ktr_time);
1376 			kth->ktr_unused = NULL;
1377 		}
1378 		iov->iov_base = (void *)kth;
1379 		iov++->iov_len = sizeof(struct ktr_header);
1380 		auio.uio_resid += sizeof(struct ktr_header);
1381 		auio.uio_iovcnt++;
1382 		if (kth->ktr_len > 0) {
1383 			iov->iov_base = kte->kte_buf;
1384 			iov++->iov_len = kth->ktr_len;
1385 			auio.uio_resid += kth->ktr_len;
1386 			auio.uio_iovcnt++;
1387 		}
1388 	} while ((kte = TAILQ_NEXT(kte, kte_list)) != NULL &&
1389 	    auio.uio_iovcnt < sizeof(aiov) / sizeof(aiov[0]) - 1);
1390 
1391 again:
1392 	error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio,
1393 	    fp->f_cred, FOF_UPDATE_OFFSET);
1394 	switch (error) {
1395 
1396 	case 0:
1397 		if (auio.uio_resid > 0)
1398 			goto again;
1399 		if (kte != NULL)
1400 			goto next;
1401 		break;
1402 
1403 	case EWOULDBLOCK:
1404 		kpause("ktrzzz", false, 1, NULL);
1405 		goto again;
1406 
1407 	default:
1408 		/*
1409 		 * If error encountered, give up tracing on this
1410 		 * vnode.  Don't report EPIPE as this can easily
1411 		 * happen with fktrace()/ktruss.
1412 		 */
1413 #ifndef DEBUG
1414 		if (error != EPIPE)
1415 #endif
1416 			log(LOG_NOTICE,
1417 			    "ktrace write failed, errno %d, tracing stopped\n",
1418 			    error);
1419 		(void)ktrderefall(ktd, 0);
1420 	}
1421 
1422 	while ((kte = top) != NULL) {
1423 		top = TAILQ_NEXT(top, kte_list);
1424 		ktefree(kte);
1425 	}
1426 }
1427 
1428 void
1429 ktrace_thread(void *arg)
1430 {
1431 	struct ktr_desc *ktd = arg;
1432 	file_t *fp = ktd->ktd_fp;
1433 	struct ktrace_entry *kte;
1434 	int ktrerr, errcnt;
1435 
1436 	mutex_enter(&ktrace_lock);
1437 	for (;;) {
1438 		kte = TAILQ_FIRST(&ktd->ktd_queue);
1439 		if (kte == NULL) {
1440 			if (ktd->ktd_flags & KTDF_WAIT) {
1441 				ktd->ktd_flags &= ~(KTDF_WAIT | KTDF_BLOCKING);
1442 				cv_broadcast(&ktd->ktd_sync_cv);
1443 			}
1444 			if (ktd->ktd_ref == 0)
1445 				break;
1446 			cv_wait(&ktd->ktd_cv, &ktrace_lock);
1447 			continue;
1448 		}
1449 		TAILQ_INIT(&ktd->ktd_queue);
1450 		ktd->ktd_qcount = 0;
1451 		ktrerr = ktd->ktd_error;
1452 		errcnt = ktd->ktd_errcnt;
1453 		ktd->ktd_error = ktd->ktd_errcnt = 0;
1454 		mutex_exit(&ktrace_lock);
1455 
1456 		if (ktrerr) {
1457 			log(LOG_NOTICE,
1458 			    "ktrace failed, fp %p, error 0x%x, total %d\n",
1459 			    fp, ktrerr, errcnt);
1460 		}
1461 		ktrwrite(ktd, kte);
1462 		mutex_enter(&ktrace_lock);
1463 	}
1464 
1465 	TAILQ_REMOVE(&ktdq, ktd, ktd_list);
1466 	mutex_exit(&ktrace_lock);
1467 
1468 	/*
1469 	 * ktrace file descriptor can't be watched (are not visible to
1470 	 * userspace), so no kqueue stuff here
1471 	 * XXX: The above comment is wrong, because the fktrace file
1472 	 * descriptor is available in userland.
1473 	 */
1474 	closef(fp);
1475 
1476 	callout_stop(&ktd->ktd_wakch);
1477 	callout_destroy(&ktd->ktd_wakch);
1478 	kmem_free(ktd, sizeof(*ktd));
1479 
1480 	kthread_exit(0);
1481 }
1482 
1483 /*
1484  * Return true if caller has permission to set the ktracing state
1485  * of target.  Essentially, the target can't possess any
1486  * more permissions than the caller.  KTRFAC_PERSISTENT signifies that
1487  * the tracing will persist on sugid processes during exec; it is only
1488  * settable by a process with appropriate credentials.
1489  *
1490  * TODO: check groups.  use caller effective gid.
1491  */
1492 int
1493 ktrcanset(lwp_t *calll, struct proc *targetp)
1494 {
1495 	KASSERT(mutex_owned(targetp->p_lock));
1496 	KASSERT(mutex_owned(&ktrace_lock));
1497 
1498 	if (kauth_authorize_process(calll->l_cred, KAUTH_PROCESS_KTRACE,
1499 	    targetp, NULL, NULL, NULL) == 0)
1500 		return (1);
1501 
1502 	return (0);
1503 }
1504 
1505 /*
1506  * Put user defined entry to ktrace records.
1507  */
1508 int
1509 sys_utrace(struct lwp *l, const struct sys_utrace_args *uap, register_t *retval)
1510 {
1511 	/* {
1512 		syscallarg(const char *) label;
1513 		syscallarg(void *) addr;
1514 		syscallarg(size_t) len;
1515 	} */
1516 
1517 	return ktruser(SCARG(uap, label), SCARG(uap, addr),
1518 	    SCARG(uap, len), 1);
1519 }
1520