xref: /netbsd-src/sys/kern/sys_process.c (revision 8ac07aec990b9d2e483062509d0a9fa5b4f57cf2)
1 /*	$NetBSD: sys_process.c,v 1.138 2008/04/24 18:39:24 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by the NetBSD
18  *	Foundation, Inc. and its contributors.
19  * 4. Neither the name of The NetBSD Foundation nor the names of its
20  *    contributors may be used to endorse or promote products derived
21  *    from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
27  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
33  * POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /*-
37  * Copyright (c) 1982, 1986, 1989, 1993
38  *	The Regents of the University of California.  All rights reserved.
39  * (c) UNIX System Laboratories, Inc.
40  * All or some portions of this file are derived from material licensed
41  * to the University of California by American Telephone and Telegraph
42  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
43  * the permission of UNIX System Laboratories, Inc.
44  *
45  * This code is derived from software contributed to Berkeley by
46  * Jan-Simon Pendry.
47  *
48  * Redistribution and use in source and binary forms, with or without
49  * modification, are permitted provided that the following conditions
50  * are met:
51  * 1. Redistributions of source code must retain the above copyright
52  *    notice, this list of conditions and the following disclaimer.
53  * 2. Redistributions in binary form must reproduce the above copyright
54  *    notice, this list of conditions and the following disclaimer in the
55  *    documentation and/or other materials provided with the distribution.
56  * 3. Neither the name of the University nor the names of its contributors
57  *    may be used to endorse or promote products derived from this software
58  *    without specific prior written permission.
59  *
60  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
61  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
62  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
63  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
64  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
65  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
66  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
67  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
68  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
69  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
70  * SUCH DAMAGE.
71  *
72  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
73  */
74 
75 /*-
76  * Copyright (c) 1993 Jan-Simon Pendry.
77  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
78  *
79  * This code is derived from software contributed to Berkeley by
80  * Jan-Simon Pendry.
81  *
82  * Redistribution and use in source and binary forms, with or without
83  * modification, are permitted provided that the following conditions
84  * are met:
85  * 1. Redistributions of source code must retain the above copyright
86  *    notice, this list of conditions and the following disclaimer.
87  * 2. Redistributions in binary form must reproduce the above copyright
88  *    notice, this list of conditions and the following disclaimer in the
89  *    documentation and/or other materials provided with the distribution.
90  * 3. All advertising materials mentioning features or use of this software
91  *    must display the following acknowledgement:
92  *	This product includes software developed by the University of
93  *	California, Berkeley and its contributors.
94  * 4. Neither the name of the University nor the names of its contributors
95  *    may be used to endorse or promote products derived from this software
96  *    without specific prior written permission.
97  *
98  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
99  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
100  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
101  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
102  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
103  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
104  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
105  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
106  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
107  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
108  * SUCH DAMAGE.
109  *
110  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
111  */
112 
113 /*
114  * References:
115  *	(1) Bach's "The Design of the UNIX Operating System",
116  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
117  *	(3) the "4.4BSD Programmer's Reference Manual" published
118  *		by USENIX and O'Reilly & Associates.
119  * The 4.4BSD PRM does a reasonably good job of documenting what the various
120  * ptrace() requests should actually do, and its text is quoted several times
121  * in this file.
122  */
123 
124 #include <sys/cdefs.h>
125 __KERNEL_RCSID(0, "$NetBSD: sys_process.c,v 1.138 2008/04/24 18:39:24 ad Exp $");
126 
127 #include "opt_coredump.h"
128 #include "opt_ptrace.h"
129 #include "opt_ktrace.h"
130 
131 #include <sys/param.h>
132 #include <sys/systm.h>
133 #include <sys/proc.h>
134 #include <sys/errno.h>
135 #include <sys/ptrace.h>
136 #include <sys/uio.h>
137 #include <sys/user.h>
138 #include <sys/ras.h>
139 #include <sys/malloc.h>
140 #include <sys/kauth.h>
141 #include <sys/mount.h>
142 #include <sys/syscallargs.h>
143 
144 #include <uvm/uvm_extern.h>
145 
146 #include <machine/reg.h>
147 
148 #ifdef PTRACE
149 /*
150  * Process debugging system call.
151  */
152 int
153 sys_ptrace(struct lwp *l, const struct sys_ptrace_args *uap, register_t *retval)
154 {
155 	/* {
156 		syscallarg(int) req;
157 		syscallarg(pid_t) pid;
158 		syscallarg(void *) addr;
159 		syscallarg(int) data;
160 	} */
161 	struct proc *p = l->l_proc;
162 	struct lwp *lt;
163 	struct proc *t;				/* target process */
164 	struct uio uio;
165 	struct iovec iov;
166 	struct ptrace_io_desc piod;
167 	struct ptrace_lwpinfo pl;
168 	struct vmspace *vm;
169 	int error, write, tmp, req, pheld;
170 	int signo;
171 	ksiginfo_t ksi;
172 #ifdef COREDUMP
173 	char *path;
174 #endif
175 
176 	error = 0;
177 	req = SCARG(uap, req);
178 
179 	/*
180 	 * If attaching or detaching, we need to get a write hold on the
181 	 * proclist lock so that we can re-parent the target process.
182 	 */
183 	mutex_enter(proc_lock);
184 
185 	/* "A foolish consistency..." XXX */
186 	if (req == PT_TRACE_ME) {
187 		t = p;
188 		mutex_enter(t->p_lock);
189 	} else {
190 		/* Find the process we're supposed to be operating on. */
191 		if ((t = p_find(SCARG(uap, pid), PFIND_LOCKED)) == NULL) {
192 			mutex_exit(proc_lock);
193 			return (ESRCH);
194 		}
195 
196 		/* XXX-elad */
197 		mutex_enter(t->p_lock);
198 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE,
199 		    t, KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
200 		if (error) {
201 			mutex_exit(proc_lock);
202 			mutex_exit(t->p_lock);
203 			return (ESRCH);
204 		}
205 	}
206 
207 	/*
208 	 * Grab a reference on the process to prevent it from execing or
209 	 * exiting.
210 	 */
211 	if (!rw_tryenter(&t->p_reflock, RW_READER)) {
212 		mutex_exit(proc_lock);
213 		mutex_exit(t->p_lock);
214 		return EBUSY;
215 	}
216 
217 	/* Make sure we can operate on it. */
218 	switch (req) {
219 	case  PT_TRACE_ME:
220 		/* Saying that you're being traced is always legal. */
221 		break;
222 
223 	case  PT_ATTACH:
224 		/*
225 		 * You can't attach to a process if:
226 		 *	(1) it's the process that's doing the attaching,
227 		 */
228 		if (t->p_pid == p->p_pid) {
229 			error = EINVAL;
230 			break;
231 		}
232 
233 		/*
234 		 *  (2) it's a system process
235 		 */
236 		if (t->p_flag & PK_SYSTEM) {
237 			error = EPERM;
238 			break;
239 		}
240 
241 		/*
242 		 *	(3) it's already being traced, or
243 		 */
244 		if (ISSET(t->p_slflag, PSL_TRACED)) {
245 			error = EBUSY;
246 			break;
247 		}
248 
249 		/*
250 		 * 	(4) the tracer is chrooted, and its root directory is
251 		 * 	    not at or above the root directory of the tracee
252 		 */
253 		mutex_exit(t->p_lock);	/* XXXSMP */
254 		tmp = proc_isunder(t, l);
255 		mutex_enter(t->p_lock);	/* XXXSMP */
256 		if (!tmp) {
257 			error = EPERM;
258 			break;
259 		}
260 		break;
261 
262 	case  PT_READ_I:
263 	case  PT_READ_D:
264 	case  PT_WRITE_I:
265 	case  PT_WRITE_D:
266 	case  PT_IO:
267 #ifdef PT_GETREGS
268 	case  PT_GETREGS:
269 #endif
270 #ifdef PT_SETREGS
271 	case  PT_SETREGS:
272 #endif
273 #ifdef PT_GETFPREGS
274 	case  PT_GETFPREGS:
275 #endif
276 #ifdef PT_SETFPREGS
277 	case  PT_SETFPREGS:
278 #endif
279 #ifdef __HAVE_PTRACE_MACHDEP
280 	PTRACE_MACHDEP_REQUEST_CASES
281 #endif
282 		/*
283 		 * You can't read/write the memory or registers of a process
284 		 * if the tracer is chrooted, and its root directory is not at
285 		 * or above the root directory of the tracee.
286 		 */
287 		mutex_exit(t->p_lock);	/* XXXSMP */
288 		tmp = proc_isunder(t, l);
289 		mutex_enter(t->p_lock);	/* XXXSMP */
290 		if (!tmp) {
291 			error = EPERM;
292 			break;
293 		}
294 		/*FALLTHROUGH*/
295 
296 	case  PT_CONTINUE:
297 	case  PT_KILL:
298 	case  PT_DETACH:
299 	case  PT_LWPINFO:
300 	case  PT_SYSCALL:
301 #ifdef COREDUMP
302 	case  PT_DUMPCORE:
303 #endif
304 #ifdef PT_STEP
305 	case  PT_STEP:
306 #endif
307 		/*
308 		 * You can't do what you want to the process if:
309 		 *	(1) It's not being traced at all,
310 		 */
311 		if (!ISSET(t->p_slflag, PSL_TRACED)) {
312 			error = EPERM;
313 			break;
314 		}
315 
316 		/*
317 		 *	(2) it's being traced by procfs (which has
318 		 *	    different signal delivery semantics),
319 		 */
320 		if (ISSET(t->p_slflag, PSL_FSTRACE)) {
321 			uprintf("file system traced\n");
322 			error = EBUSY;
323 			break;
324 		}
325 
326 		/*
327 		 *	(3) it's not being traced by _you_, or
328 		 */
329 		if (t->p_pptr != p) {
330 			uprintf("parent %d != %d\n", t->p_pptr->p_pid, p->p_pid);
331 			error = EBUSY;
332 			break;
333 		}
334 
335 		/*
336 		 *	(4) it's not currently stopped.
337 		 */
338 		if (t->p_stat != SSTOP || !t->p_waited /* XXXSMP */) {
339 			uprintf("stat %d flag %d\n", t->p_stat,
340 			    !t->p_waited);
341 			error = EBUSY;
342 			break;
343 		}
344 		break;
345 
346 	default:			/* It was not a legal request. */
347 		error = EINVAL;
348 		break;
349 	}
350 
351 	if (error == 0)
352 		error = kauth_authorize_process(l->l_cred,
353 		    KAUTH_PROCESS_PTRACE, t, KAUTH_ARG(req),
354 		    NULL, NULL);
355 
356 	if (error != 0) {
357 		mutex_exit(proc_lock);
358 		mutex_exit(t->p_lock);
359 		rw_exit(&t->p_reflock);
360 		return error;
361 	}
362 
363 	/* Do single-step fixup if needed. */
364 	FIX_SSTEP(t);
365 
366 	/*
367 	 * XXX NJWLWP
368 	 *
369 	 * The entire ptrace interface needs work to be useful to a
370 	 * process with multiple LWPs. For the moment, we'll kluge
371 	 * this; memory access will be fine, but register access will
372 	 * be weird.
373 	 */
374 	lt = proc_representative_lwp(t, NULL, 1);
375 	lwp_addref(lt);
376 
377 	/*
378 	 * Which locks do we need held? XXX Ugly.
379 	 */
380 	switch (req) {
381 #ifdef PT_STEP
382 	case PT_STEP:
383 #endif
384 	case PT_CONTINUE:
385 	case PT_DETACH:
386 	case PT_KILL:
387 	case PT_SYSCALL:
388 	case PT_ATTACH:
389 	case PT_TRACE_ME:
390 		pheld = 1;
391 		break;
392 	default:
393 		mutex_exit(proc_lock);
394 		mutex_exit(t->p_lock);
395 		pheld = 0;
396 		break;
397 	}
398 
399 	/* Now do the operation. */
400 	write = 0;
401 	*retval = 0;
402 	tmp = 0;
403 
404 	switch (req) {
405 	case  PT_TRACE_ME:
406 		/* Just set the trace flag. */
407 		SET(t->p_slflag, PSL_TRACED);
408 		t->p_opptr = t->p_pptr;
409 		break;
410 
411 	case  PT_WRITE_I:		/* XXX no separate I and D spaces */
412 	case  PT_WRITE_D:
413 #if defined(__HAVE_RAS)
414 		/*
415 		 * Can't write to a RAS
416 		 */
417 		if (ras_lookup(t, SCARG(uap, addr)) != (void *)-1) {
418 			error = EACCES;
419 			break;
420 		}
421 #endif
422 		write = 1;
423 		tmp = SCARG(uap, data);
424 		/* FALLTHROUGH */
425 
426 	case  PT_READ_I:		/* XXX no separate I and D spaces */
427 	case  PT_READ_D:
428 		/* write = 0 done above. */
429 		iov.iov_base = (void *)&tmp;
430 		iov.iov_len = sizeof(tmp);
431 		uio.uio_iov = &iov;
432 		uio.uio_iovcnt = 1;
433 		uio.uio_offset = (off_t)(unsigned long)SCARG(uap, addr);
434 		uio.uio_resid = sizeof(tmp);
435 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
436 		UIO_SETUP_SYSSPACE(&uio);
437 
438 		error = process_domem(l, lt, &uio);
439 		if (!write)
440 			*retval = tmp;
441 		break;
442 
443 	case  PT_IO:
444 		error = copyin(SCARG(uap, addr), &piod, sizeof(piod));
445 		if (error)
446 			break;
447 		switch (piod.piod_op) {
448 		case PIOD_READ_D:
449 		case PIOD_READ_I:
450 			uio.uio_rw = UIO_READ;
451 			break;
452 		case PIOD_WRITE_D:
453 		case PIOD_WRITE_I:
454 			/*
455 			 * Can't write to a RAS
456 			 */
457 			if (ras_lookup(t, SCARG(uap, addr)) != (void *)-1) {
458 				return (EACCES);
459 			}
460 			uio.uio_rw = UIO_WRITE;
461 			break;
462 		default:
463 			error = EINVAL;
464 			break;
465 		}
466 		if (error)
467 			break;
468 		error = proc_vmspace_getref(l->l_proc, &vm);
469 		if (error)
470 			break;
471 		iov.iov_base = piod.piod_addr;
472 		iov.iov_len = piod.piod_len;
473 		uio.uio_iov = &iov;
474 		uio.uio_iovcnt = 1;
475 		uio.uio_offset = (off_t)(unsigned long)piod.piod_offs;
476 		uio.uio_resid = piod.piod_len;
477 		uio.uio_vmspace = vm;
478 
479 		error = process_domem(l, lt, &uio);
480 		piod.piod_len -= uio.uio_resid;
481 		(void) copyout(&piod, SCARG(uap, addr), sizeof(piod));
482 		uvmspace_free(vm);
483 		break;
484 
485 #ifdef COREDUMP
486 	case  PT_DUMPCORE:
487 		if ((path = SCARG(uap, addr)) != NULL) {
488 			char *dst;
489 			int len = SCARG(uap, data);
490 			if (len < 0 || len >= MAXPATHLEN) {
491 				error = EINVAL;
492 				break;
493 			}
494 			dst = malloc(len + 1, M_TEMP, M_WAITOK);
495 			if ((error = copyin(path, dst, len)) != 0) {
496 				free(dst, M_TEMP);
497 				break;
498 			}
499 			path = dst;
500 			path[len] = '\0';
501 		}
502 		error = coredump(lt, path);
503 		if (path)
504 			free(path, M_TEMP);
505 		break;
506 #endif
507 
508 #ifdef PT_STEP
509 	case  PT_STEP:
510 		/*
511 		 * From the 4.4BSD PRM:
512 		 * "Execution continues as in request PT_CONTINUE; however
513 		 * as soon as possible after execution of at least one
514 		 * instruction, execution stops again. [ ... ]"
515 		 */
516 #endif
517 	case  PT_CONTINUE:
518 	case  PT_SYSCALL:
519 	case  PT_DETACH:
520 		if (req == PT_SYSCALL) {
521 			if (!ISSET(t->p_slflag, PSL_SYSCALL)) {
522 				SET(t->p_slflag, PSL_SYSCALL);
523 #ifdef __HAVE_SYSCALL_INTERN
524 				(*t->p_emul->e_syscall_intern)(t);
525 #endif
526 			}
527 		} else {
528 			if (ISSET(t->p_slflag, PSL_SYSCALL)) {
529 				CLR(t->p_slflag, PSL_SYSCALL);
530 #ifdef __HAVE_SYSCALL_INTERN
531 				(*t->p_emul->e_syscall_intern)(t);
532 #endif
533 			}
534 		}
535 		p->p_trace_enabled = trace_is_enabled(p);
536 
537 		/*
538 		 * From the 4.4BSD PRM:
539 		 * "The data argument is taken as a signal number and the
540 		 * child's execution continues at location addr as if it
541 		 * incurred that signal.  Normally the signal number will
542 		 * be either 0 to indicate that the signal that caused the
543 		 * stop should be ignored, or that value fetched out of
544 		 * the process's image indicating which signal caused
545 		 * the stop.  If addr is (int *)1 then execution continues
546 		 * from where it stopped."
547 		 */
548 
549 		/* Check that the data is a valid signal number or zero. */
550 		if (SCARG(uap, data) < 0 || SCARG(uap, data) >= NSIG) {
551 			error = EINVAL;
552 			break;
553 		}
554 
555 		uvm_lwp_hold(lt);
556 
557 		/* If the address parameter is not (int *)1, set the pc. */
558 		if ((int *)SCARG(uap, addr) != (int *)1)
559 			if ((error = process_set_pc(lt, SCARG(uap, addr))) != 0) {
560 				uvm_lwp_rele(lt);
561 				break;
562 			}
563 
564 #ifdef PT_STEP
565 		/*
566 		 * Arrange for a single-step, if that's requested and possible.
567 		 */
568 		error = process_sstep(lt, req == PT_STEP);
569 		if (error) {
570 			uvm_lwp_rele(lt);
571 			break;
572 		}
573 #endif
574 
575 		uvm_lwp_rele(lt);
576 
577 		if (req == PT_DETACH) {
578 			CLR(t->p_slflag, PSL_TRACED|PSL_FSTRACE|PSL_SYSCALL);
579 
580 			/* give process back to original parent or init */
581 			if (t->p_opptr != t->p_pptr) {
582 				struct proc *pp = t->p_opptr;
583 				proc_reparent(t, pp ? pp : initproc);
584 			}
585 
586 			/* not being traced any more */
587 			t->p_opptr = NULL;
588 		}
589 
590 		signo = SCARG(uap, data);
591 	sendsig:
592 		/* Finally, deliver the requested signal (or none). */
593 		if (t->p_stat == SSTOP) {
594 			/*
595 			 * Unstop the process.  If it needs to take a
596 			 * signal, make all efforts to ensure that at
597 			 * an LWP runs to see it.
598 			 */
599 			t->p_xstat = signo;
600 			proc_unstop(t);
601 		} else if (signo != 0) {
602 			KSI_INIT_EMPTY(&ksi);
603 			ksi.ksi_signo = signo;
604 			kpsignal2(t, &ksi);
605 		}
606 		break;
607 
608 	case  PT_KILL:
609 		/* just send the process a KILL signal. */
610 		signo = SIGKILL;
611 		goto sendsig;	/* in PT_CONTINUE, above. */
612 
613 	case  PT_ATTACH:
614 		/*
615 		 * Go ahead and set the trace flag.
616 		 * Save the old parent (it's reset in
617 		 *   _DETACH, and also in kern_exit.c:wait4()
618 		 * Reparent the process so that the tracing
619 		 *   proc gets to see all the action.
620 		 * Stop the target.
621 		 */
622 		t->p_opptr = t->p_pptr;
623 		if (t->p_pptr != p) {
624 			if (t->p_pptr->p_lock < t->p_lock) {
625 				if (!mutex_tryenter(t->p_pptr->p_lock)) {
626 					mutex_exit(t->p_lock);
627 					mutex_enter(t->p_pptr->p_lock);
628 				}
629 			} else if (t->p_pptr->p_lock > t->p_lock) {
630 				mutex_enter(t->p_pptr->p_lock);
631 			}
632 			t->p_pptr->p_slflag |= PSL_CHTRACED;
633 			proc_reparent(t, p);
634 			if (t->p_pptr->p_lock != t->p_lock)
635 				mutex_exit(t->p_pptr->p_lock);
636 		}
637 		SET(t->p_slflag, PSL_TRACED);
638 		signo = SIGSTOP;
639 		goto sendsig;
640 
641 	case PT_LWPINFO:
642 		if (SCARG(uap, data) != sizeof(pl)) {
643 			error = EINVAL;
644 			break;
645 		}
646 		error = copyin(SCARG(uap, addr), &pl, sizeof(pl));
647 		if (error)
648 			break;
649 		tmp = pl.pl_lwpid;
650 		lwp_delref(lt);
651 		mutex_enter(t->p_lock);
652 		if (tmp == 0)
653 			lt = LIST_FIRST(&t->p_lwps);
654 		else {
655 			lt = lwp_find(p, tmp);
656 			if (lt == NULL) {
657 				mutex_exit(t->p_lock);
658 				error = ESRCH;
659 				break;
660 			}
661 			lt = LIST_NEXT(lt, l_sibling);
662 		}
663 		while (lt != NULL && lt->l_stat == LSZOMB)
664 			lt = LIST_NEXT(lt, l_sibling);
665 		pl.pl_lwpid = 0;
666 		pl.pl_event = 0;
667 		if (lt) {
668 			lwp_addref(lt);
669 			pl.pl_lwpid = lt->l_lid;
670 			if (lt->l_lid == t->p_sigctx.ps_lwp)
671 				pl.pl_event = PL_EVENT_SIGNAL;
672 		}
673 		mutex_exit(t->p_lock);
674 
675 		error = copyout(&pl, SCARG(uap, addr), sizeof(pl));
676 		break;
677 
678 #ifdef PT_SETREGS
679 	case  PT_SETREGS:
680 		write = 1;
681 #endif
682 #ifdef PT_GETREGS
683 	case  PT_GETREGS:
684 		/* write = 0 done above. */
685 #endif
686 #if defined(PT_SETREGS) || defined(PT_GETREGS)
687 		tmp = SCARG(uap, data);
688 		if (tmp != 0 && t->p_nlwps > 1) {
689 			lwp_delref(lt);
690 			mutex_enter(t->p_lock);
691 			lt = lwp_find(t, tmp);
692 			if (lt == NULL) {
693 				mutex_exit(t->p_lock);
694 				error = ESRCH;
695 				break;
696 			}
697 			lwp_addref(lt);
698 			mutex_exit(t->p_lock);
699 		}
700 		if (!process_validregs(lt))
701 			error = EINVAL;
702 		else {
703 			error = proc_vmspace_getref(l->l_proc, &vm);
704 			if (error)
705 				break;
706 			iov.iov_base = SCARG(uap, addr);
707 			iov.iov_len = sizeof(struct reg);
708 			uio.uio_iov = &iov;
709 			uio.uio_iovcnt = 1;
710 			uio.uio_offset = 0;
711 			uio.uio_resid = sizeof(struct reg);
712 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
713 			uio.uio_vmspace = vm;
714 
715 			error = process_doregs(l, lt, &uio);
716 			uvmspace_free(vm);
717 		}
718 		break;
719 #endif
720 
721 #ifdef PT_SETFPREGS
722 	case  PT_SETFPREGS:
723 		write = 1;
724 #endif
725 #ifdef PT_GETFPREGS
726 	case  PT_GETFPREGS:
727 		/* write = 0 done above. */
728 #endif
729 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
730 		tmp = SCARG(uap, data);
731 		if (tmp != 0 && t->p_nlwps > 1) {
732 			lwp_delref(lt);
733 			mutex_enter(t->p_lock);
734 			lt = lwp_find(t, tmp);
735 			if (lt == NULL) {
736 				mutex_exit(t->p_lock);
737 				error = ESRCH;
738 				break;
739 			}
740 			lwp_addref(lt);
741 			mutex_exit(t->p_lock);
742 		}
743 		if (!process_validfpregs(lt))
744 			error = EINVAL;
745 		else {
746 			error = proc_vmspace_getref(l->l_proc, &vm);
747 			if (error)
748 				break;
749 			iov.iov_base = SCARG(uap, addr);
750 			iov.iov_len = sizeof(struct fpreg);
751 			uio.uio_iov = &iov;
752 			uio.uio_iovcnt = 1;
753 			uio.uio_offset = 0;
754 			uio.uio_resid = sizeof(struct fpreg);
755 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
756 			uio.uio_vmspace = vm;
757 
758 			error = process_dofpregs(l, lt, &uio);
759 			uvmspace_free(vm);
760 		}
761 		break;
762 #endif
763 
764 #ifdef __HAVE_PTRACE_MACHDEP
765 	PTRACE_MACHDEP_REQUEST_CASES
766 		error = ptrace_machdep_dorequest(l, lt,
767 		    req, SCARG(uap, addr), SCARG(uap, data));
768 		break;
769 #endif
770 	}
771 
772 	if (pheld) {
773 		mutex_exit(t->p_lock);
774 		mutex_exit(proc_lock);
775 	}
776 	if (lt != NULL)
777 		lwp_delref(lt);
778 	rw_exit(&t->p_reflock);
779 
780 	return error;
781 }
782 
783 int
784 process_doregs(struct lwp *curl /*tracer*/,
785     struct lwp *l /*traced*/,
786     struct uio *uio)
787 {
788 #if defined(PT_GETREGS) || defined(PT_SETREGS)
789 	int error;
790 	struct reg r;
791 	char *kv;
792 	int kl;
793 
794 	if (uio->uio_offset < 0 || uio->uio_offset > (off_t)sizeof(r))
795 		return EINVAL;
796 
797 	kl = sizeof(r);
798 	kv = (char *)&r;
799 
800 	kv += uio->uio_offset;
801 	kl -= uio->uio_offset;
802 	if ((size_t)kl > uio->uio_resid)
803 		kl = uio->uio_resid;
804 
805 	uvm_lwp_hold(l);
806 
807 	error = process_read_regs(l, &r);
808 	if (error == 0)
809 		error = uiomove(kv, kl, uio);
810 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
811 		if (l->l_stat != LSSTOP)
812 			error = EBUSY;
813 		else
814 			error = process_write_regs(l, &r);
815 	}
816 
817 	uvm_lwp_rele(l);
818 
819 	uio->uio_offset = 0;
820 	return (error);
821 #else
822 	return (EINVAL);
823 #endif
824 }
825 
826 int
827 process_validregs(struct lwp *l)
828 {
829 
830 #if defined(PT_SETREGS) || defined(PT_GETREGS)
831 	return ((l->l_flag & LW_SYSTEM) == 0);
832 #else
833 	return (0);
834 #endif
835 }
836 
837 int
838 process_dofpregs(struct lwp *curl /*tracer*/,
839     struct lwp *l /*traced*/,
840     struct uio *uio)
841 {
842 #if defined(PT_GETFPREGS) || defined(PT_SETFPREGS)
843 	int error;
844 	struct fpreg r;
845 	char *kv;
846 	int kl;
847 
848 	if (uio->uio_offset < 0 || uio->uio_offset > (off_t)sizeof(r))
849 		return EINVAL;
850 
851 	kl = sizeof(r);
852 	kv = (char *)&r;
853 
854 	kv += uio->uio_offset;
855 	kl -= uio->uio_offset;
856 	if ((size_t)kl > uio->uio_resid)
857 		kl = uio->uio_resid;
858 
859 	uvm_lwp_hold(l);
860 
861 	error = process_read_fpregs(l, &r);
862 	if (error == 0)
863 		error = uiomove(kv, kl, uio);
864 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
865 		if (l->l_stat != LSSTOP)
866 			error = EBUSY;
867 		else
868 			error = process_write_fpregs(l, &r);
869 	}
870 
871 	uvm_lwp_rele(l);
872 
873 	uio->uio_offset = 0;
874 	return (error);
875 #else
876 	return (EINVAL);
877 #endif
878 }
879 
880 int
881 process_validfpregs(struct lwp *l)
882 {
883 
884 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
885 	return ((l->l_flag & LW_SYSTEM) == 0);
886 #else
887 	return (0);
888 #endif
889 }
890 #endif /* PTRACE */
891 
892 #if defined(KTRACE) || defined(PTRACE)
893 int
894 process_domem(struct lwp *curl /*tracer*/,
895     struct lwp *l /*traced*/,
896     struct uio *uio)
897 {
898 	struct proc *p = l->l_proc;	/* traced */
899 	struct vmspace *vm;
900 	int error;
901 
902 	size_t len;
903 #ifdef PMAP_NEED_PROCWR
904 	vaddr_t	addr;
905 #endif
906 
907 	error = 0;
908 	len = uio->uio_resid;
909 
910 	if (len == 0)
911 		return (0);
912 
913 #ifdef PMAP_NEED_PROCWR
914 	addr = uio->uio_offset;
915 #endif
916 
917 	vm = p->p_vmspace;
918 
919 	mutex_enter(&vm->vm_map.misc_lock);
920 	if ((l->l_flag & LW_WEXIT) || vm->vm_refcnt < 1)
921 		error = EFAULT;
922 	if (error == 0)
923 		p->p_vmspace->vm_refcnt++;  /* XXX */
924 	mutex_exit(&vm->vm_map.misc_lock);
925 	if (error != 0)
926 		return (error);
927 	error = uvm_io(&vm->vm_map, uio);
928 	uvmspace_free(vm);
929 
930 #ifdef PMAP_NEED_PROCWR
931 	if (error == 0 && uio->uio_rw == UIO_WRITE)
932 		pmap_procwr(p, addr, len);
933 #endif
934 	return (error);
935 }
936 #endif /* KTRACE || PTRACE */
937 
938 #if defined(KTRACE) || defined(PTRACE)
939 void
940 process_stoptrace(void)
941 {
942 	struct lwp *l = curlwp;
943 	struct proc *p = l->l_proc, *pp;
944 
945 	mutex_enter(proc_lock);
946 	mutex_enter(p->p_lock);
947 	pp = p->p_pptr;
948 	if (pp->p_pid == 1) {
949 		CLR(p->p_slflag, PSL_SYSCALL);	/* XXXSMP */
950 		mutex_exit(p->p_lock);
951 		mutex_exit(proc_lock);
952 		return;
953 	}
954 
955 	p->p_xstat = SIGTRAP;
956 	proc_stop(p, 1, SIGSTOP);
957 	mutex_exit(proc_lock);
958 
959 	/*
960 	 * Call issignal() once only, to have it take care of the
961 	 * pending stop.  Signal processing will take place as usual
962 	 * from userret().
963 	 */
964 	KERNEL_UNLOCK_ALL(l, &l->l_biglocks);
965 	(void)issignal(l);
966 	mutex_exit(p->p_lock);
967 	KERNEL_LOCK(l->l_biglocks - 1, l);
968 }
969 #endif	/* KTRACE || PTRACE */
970