xref: /netbsd-src/sys/kern/sys_ptrace_common.c (revision 114ca20a4a7aa68e9c04e01636b83f9c6daf73e8)
1 /*	$NetBSD: sys_ptrace_common.c,v 1.43 2018/05/29 23:34:18 kamil Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*-
33  * Copyright (c) 1982, 1986, 1989, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  * (c) UNIX System Laboratories, Inc.
36  * All or some portions of this file are derived from material licensed
37  * to the University of California by American Telephone and Telegraph
38  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
39  * the permission of UNIX System Laboratories, Inc.
40  *
41  * This code is derived from software contributed to Berkeley by
42  * Jan-Simon Pendry.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. Neither the name of the University nor the names of its contributors
53  *    may be used to endorse or promote products derived from this software
54  *    without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66  * SUCH DAMAGE.
67  *
68  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
69  */
70 
71 /*-
72  * Copyright (c) 1993 Jan-Simon Pendry.
73  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
74  *
75  * This code is derived from software contributed to Berkeley by
76  * Jan-Simon Pendry.
77  *
78  * Redistribution and use in source and binary forms, with or without
79  * modification, are permitted provided that the following conditions
80  * are met:
81  * 1. Redistributions of source code must retain the above copyright
82  *    notice, this list of conditions and the following disclaimer.
83  * 2. Redistributions in binary form must reproduce the above copyright
84  *    notice, this list of conditions and the following disclaimer in the
85  *    documentation and/or other materials provided with the distribution.
86  * 3. All advertising materials mentioning features or use of this software
87  *    must display the following acknowledgement:
88  *	This product includes software developed by the University of
89  *	California, Berkeley and its contributors.
90  * 4. Neither the name of the University nor the names of its contributors
91  *    may be used to endorse or promote products derived from this software
92  *    without specific prior written permission.
93  *
94  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
95  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
96  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
97  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
98  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
99  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
100  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
101  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
102  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
103  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
104  * SUCH DAMAGE.
105  *
106  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
107  */
108 
109 /*
110  * References:
111  *	(1) Bach's "The Design of the UNIX Operating System",
112  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
113  *	(3) the "4.4BSD Programmer's Reference Manual" published
114  *		by USENIX and O'Reilly & Associates.
115  * The 4.4BSD PRM does a reasonably good job of documenting what the various
116  * ptrace() requests should actually do, and its text is quoted several times
117  * in this file.
118  */
119 
120 #include <sys/cdefs.h>
121 __KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.43 2018/05/29 23:34:18 kamil Exp $");
122 
123 #ifdef _KERNEL_OPT
124 #include "opt_ptrace.h"
125 #include "opt_ktrace.h"
126 #include "opt_pax.h"
127 #include "opt_compat_netbsd32.h"
128 #endif
129 
130 #if defined(__HAVE_COMPAT_NETBSD32) && !defined(COMPAT_NETBSD32) \
131     && !defined(_RUMPKERNEL)
132 #define COMPAT_NETBSD32
133 #endif
134 
135 #include <sys/param.h>
136 #include <sys/systm.h>
137 #include <sys/proc.h>
138 #include <sys/errno.h>
139 #include <sys/exec.h>
140 #include <sys/pax.h>
141 #include <sys/ptrace.h>
142 #include <sys/uio.h>
143 #include <sys/ras.h>
144 #include <sys/kmem.h>
145 #include <sys/kauth.h>
146 #include <sys/mount.h>
147 #include <sys/syscallargs.h>
148 #include <sys/module.h>
149 #include <sys/condvar.h>
150 #include <sys/mutex.h>
151 
152 #include <uvm/uvm_extern.h>
153 
154 #include <machine/reg.h>
155 
156 #ifdef PTRACE
157 
158 # ifdef DEBUG
159 #  define DPRINTF(a) uprintf a
160 # else
161 #  define DPRINTF(a)
162 # endif
163 
164 static kauth_listener_t ptrace_listener;
165 static int process_auxv_offset(struct proc *, struct uio *);
166 
167 #if 0
168 static int ptrace_cbref;
169 static kmutex_t ptrace_mtx;
170 static kcondvar_t ptrace_cv;
171 #endif
172 
173 #ifdef PT_GETREGS
174 # define case_PT_GETREGS	case PT_GETREGS:
175 #else
176 # define case_PT_GETREGS
177 #endif
178 
179 #ifdef PT_SETREGS
180 # define case_PT_SETREGS	case PT_SETREGS:
181 #else
182 # define case_PT_SETREGS
183 #endif
184 
185 #ifdef PT_GETFPREGS
186 # define case_PT_GETFPREGS	case PT_GETFPREGS:
187 #else
188 # define case_PT_GETFPREGS
189 #endif
190 
191 #ifdef PT_SETFPREGS
192 # define case_PT_SETFPREGS	case PT_SETFPREGS:
193 #else
194 # define case_PT_SETFPREGS
195 #endif
196 
197 #ifdef PT_GETDBREGS
198 # define case_PT_GETDBREGS	case PT_GETDBREGS:
199 #else
200 # define case_PT_GETDBREGS
201 #endif
202 
203 #ifdef PT_SETDBREGS
204 # define case_PT_SETDBREGS	case PT_SETDBREGS:
205 #else
206 # define case_PT_SETDBREGS
207 #endif
208 
209 #if defined(PT_SETREGS) || defined(PT_GETREGS) || \
210     defined(PT_SETFPREGS) || defined(PT_GETFOREGS) || \
211     defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
212 # define PT_REGISTERS
213 #endif
214 
215 static int
216 ptrace_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
217     void *arg0, void *arg1, void *arg2, void *arg3)
218 {
219 	struct proc *p;
220 	int result;
221 #ifdef PT_SETDBREGS
222 	extern int user_set_dbregs;
223 #endif
224 
225 	result = KAUTH_RESULT_DEFER;
226 	p = arg0;
227 
228 #if 0
229 	mutex_enter(&ptrace_mtx);
230 	ptrace_cbref++;
231 	mutex_exit(&ptrace_mtx);
232 #endif
233 	if (action != KAUTH_PROCESS_PTRACE)
234 		goto out;
235 
236 	switch ((u_long)arg1) {
237 #ifdef PT_SETDBREGS
238 	case_PT_SETDBREGS
239 		if (kauth_cred_getuid(cred) != 0 && user_set_dbregs == 0) {
240 			result = KAUTH_RESULT_DENY;
241 			break;
242 		}
243 #endif
244 	case PT_TRACE_ME:
245 	case PT_ATTACH:
246 	case PT_WRITE_I:
247 	case PT_WRITE_D:
248 	case PT_READ_I:
249 	case PT_READ_D:
250 	case PT_IO:
251 	case_PT_GETREGS
252 	case_PT_SETREGS
253 	case_PT_GETFPREGS
254 	case_PT_SETFPREGS
255 	case_PT_GETDBREGS
256 	case PT_SET_EVENT_MASK:
257 	case PT_GET_EVENT_MASK:
258 	case PT_GET_PROCESS_STATE:
259 	case PT_SET_SIGINFO:
260 	case PT_GET_SIGINFO:
261 #ifdef __HAVE_PTRACE_MACHDEP
262 	PTRACE_MACHDEP_REQUEST_CASES
263 #endif
264 		if (kauth_cred_getuid(cred) != kauth_cred_getuid(p->p_cred) ||
265 		    ISSET(p->p_flag, PK_SUGID)) {
266 			break;
267 		}
268 
269 		result = KAUTH_RESULT_ALLOW;
270 
271 	break;
272 
273 #ifdef PT_STEP
274 	case PT_STEP:
275 	case PT_SETSTEP:
276 	case PT_CLEARSTEP:
277 #endif
278 	case PT_CONTINUE:
279 	case PT_KILL:
280 	case PT_DETACH:
281 	case PT_LWPINFO:
282 	case PT_SYSCALL:
283 	case PT_SYSCALLEMU:
284 	case PT_DUMPCORE:
285 	case PT_RESUME:
286 	case PT_SUSPEND:
287 		result = KAUTH_RESULT_ALLOW;
288 		break;
289 
290 	default:
291 		break;
292 	}
293 
294  out:
295 #if 0
296 	mutex_enter(&ptrace_mtx);
297 	if (--ptrace_cbref == 0)
298 		cv_broadcast(&ptrace_cv);
299 	mutex_exit(&ptrace_mtx);
300 #endif
301 
302 	return result;
303 }
304 
305 int
306 ptrace_init(void)
307 {
308 
309 #if 0
310 	mutex_init(&ptrace_mtx, MUTEX_DEFAULT, IPL_NONE);
311 	cv_init(&ptrace_cv, "ptracecb");
312 	ptrace_cbref = 0;
313 #endif
314 	ptrace_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
315 	    ptrace_listener_cb, NULL);
316 	return 0;
317 }
318 
319 int
320 ptrace_fini(void)
321 {
322 
323 	kauth_unlisten_scope(ptrace_listener);
324 
325 #if 0
326 	/* Make sure no-one is executing our kauth listener */
327 
328 	mutex_enter(&ptrace_mtx);
329 	while (ptrace_cbref != 0)
330 		cv_wait(&ptrace_cv, &ptrace_mtx);
331 	mutex_exit(&ptrace_mtx);
332 	mutex_destroy(&ptrace_mtx);
333 	cv_destroy(&ptrace_cv);
334 #endif
335 
336 	return 0;
337 }
338 
339 static struct proc *
340 ptrace_find(struct lwp *l, int req, pid_t pid)
341 {
342 	struct proc *t;
343 
344 	/* "A foolish consistency..." XXX */
345 	if (req == PT_TRACE_ME) {
346 		t = l->l_proc;
347 		mutex_enter(t->p_lock);
348 		return t;
349 	}
350 
351 	/* Find the process we're supposed to be operating on. */
352 	t = proc_find(pid);
353 	if (t == NULL)
354 		return NULL;
355 
356 	/* XXX-elad */
357 	mutex_enter(t->p_lock);
358 	int error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE,
359 	    t, KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
360 	if (error) {
361 		mutex_exit(t->p_lock);
362 		return NULL;
363 	}
364 	return t;
365 }
366 
367 static int
368 ptrace_allowed(struct lwp *l, int req, struct proc *t, struct proc *p)
369 {
370 	/*
371 	 * Grab a reference on the process to prevent it from execing or
372 	 * exiting.
373 	 */
374 	if (!rw_tryenter(&t->p_reflock, RW_READER))
375 		return EBUSY;
376 
377 	/* Make sure we can operate on it. */
378 	switch (req) {
379 	case PT_TRACE_ME:
380 		/*
381 		 * You can't say to the parent of a process to start tracing if:
382 		 *	(1) the parent is initproc,
383 		 */
384 		if (p->p_pptr == initproc)
385 			return EPERM;
386 
387 		/*
388 		 *	(2) the process is initproc, or
389 		 */
390 		if (p == initproc)
391 			return EPERM;
392 
393 		/*
394 		 *	(3) the child is already traced.
395 		 */
396 		if (ISSET(p->p_slflag, PSL_TRACED))
397 			return EBUSY;
398 
399 		return 0;
400 
401 	case PT_ATTACH:
402 		/*
403 		 * You can't attach to a process if:
404 		 *	(1) it's the process that's doing the attaching,
405 		 */
406 		if (t->p_pid == p->p_pid)
407 			return EINVAL;
408 
409 		/*
410 		 *	(2) it's a system process,
411 		 */
412 		if (t->p_flag & PK_SYSTEM)
413 			return EPERM;
414 
415 		/*
416 		 *	(3) the tracer is initproc,
417 		 */
418 		if (p == initproc)
419 			return EPERM;
420 
421 		/*
422 		 *	(4) it's already being traced,
423 		 */
424 		if (ISSET(t->p_slflag, PSL_TRACED))
425 			return EBUSY;
426 
427 		/*
428 		 *	(5) it's a vfork(2)ed parent of the current process, or
429 		 */
430 		if (ISSET(p->p_lflag, PL_PPWAIT) && p->p_pptr == t)
431 			return EPERM;
432 
433 		/*
434 		 * 	(6) the tracer is chrooted, and its root directory is
435 		 * 	    not at or above the root directory of the tracee
436 		 */
437 		mutex_exit(t->p_lock);	/* XXXSMP */
438 		int tmp = proc_isunder(t, l);
439 		mutex_enter(t->p_lock);	/* XXXSMP */
440 		if (!tmp)
441 			return EPERM;
442 		return 0;
443 
444 	case PT_READ_I:
445 	case PT_READ_D:
446 	case PT_WRITE_I:
447 	case PT_WRITE_D:
448 	case PT_IO:
449 	case PT_SET_SIGINFO:
450 	case PT_GET_SIGINFO:
451 	case_PT_GETREGS
452 	case_PT_SETREGS
453 	case_PT_GETFPREGS
454 	case_PT_SETFPREGS
455 	case_PT_GETDBREGS
456 	case_PT_SETDBREGS
457 #ifdef __HAVE_PTRACE_MACHDEP
458 	PTRACE_MACHDEP_REQUEST_CASES
459 #endif
460 		/*
461 		 * You can't read/write the memory or registers of a process
462 		 * if the tracer is chrooted, and its root directory is not at
463 		 * or above the root directory of the tracee.
464 		 */
465 		mutex_exit(t->p_lock);	/* XXXSMP */
466 		tmp = proc_isunder(t, l);
467 		mutex_enter(t->p_lock);	/* XXXSMP */
468 		if (!tmp)
469 			return EPERM;
470 		/*FALLTHROUGH*/
471 
472 	case PT_CONTINUE:
473 	case PT_KILL:
474 	case PT_DETACH:
475 	case PT_LWPINFO:
476 	case PT_SYSCALL:
477 	case PT_SYSCALLEMU:
478 	case PT_DUMPCORE:
479 #ifdef PT_STEP
480 	case PT_STEP:
481 	case PT_SETSTEP:
482 	case PT_CLEARSTEP:
483 #endif
484 	case PT_SET_EVENT_MASK:
485 	case PT_GET_EVENT_MASK:
486 	case PT_GET_PROCESS_STATE:
487 	case PT_RESUME:
488 	case PT_SUSPEND:
489 		/*
490 		 * You can't do what you want to the process if:
491 		 *	(1) It's not being traced at all,
492 		 */
493 		if (!ISSET(t->p_slflag, PSL_TRACED))
494 			return EPERM;
495 
496 		/*
497 		 *	(2) it's not being traced by _you_, or
498 		 */
499 		if (t->p_pptr != p) {
500 			DPRINTF(("parent %d != %d\n", t->p_pptr->p_pid,
501 			    p->p_pid));
502 			return EBUSY;
503 		}
504 
505 		/*
506 		 *	(3) it's not currently stopped.
507 		 */
508 		if (t->p_stat != SSTOP || !t->p_waited /* XXXSMP */) {
509 			DPRINTF(("stat %d flag %d\n", t->p_stat,
510 			    !t->p_waited));
511 			return EBUSY;
512 		}
513 		return 0;
514 
515 	default:			/* It was not a legal request. */
516 		return EINVAL;
517 	}
518 }
519 
520 static int
521 ptrace_needs_hold(int req)
522 {
523 	switch (req) {
524 #ifdef PT_STEP
525 	case PT_STEP:
526 #endif
527 	case PT_CONTINUE:
528 	case PT_DETACH:
529 	case PT_KILL:
530 	case PT_SYSCALL:
531 	case PT_SYSCALLEMU:
532 	case PT_ATTACH:
533 	case PT_TRACE_ME:
534 	case PT_GET_SIGINFO:
535 	case PT_SET_SIGINFO:
536 		return 1;
537 	default:
538 		return 0;
539 	}
540 }
541 
542 static int
543 ptrace_update_lwp(struct proc *t, struct lwp **lt, lwpid_t lid)
544 {
545 	if (lid == 0 || lid == (*lt)->l_lid || t->p_nlwps == 1)
546 		return 0;
547 
548 	lwp_delref(*lt);
549 
550 	mutex_enter(t->p_lock);
551 	*lt = lwp_find(t, lid);
552 	if (*lt == NULL) {
553 		mutex_exit(t->p_lock);
554 		return ESRCH;
555 	}
556 
557 	if ((*lt)->l_flag & LW_SYSTEM) {
558 		*lt = NULL;
559 		return EINVAL;
560 	}
561 
562 	lwp_addref(*lt);
563 	mutex_exit(t->p_lock);
564 
565 	return 0;
566 }
567 
568 static int
569 ptrace_get_siginfo(struct proc *t, struct ptrace_methods *ptm, void *addr,
570     size_t data)
571 {
572 	struct ptrace_siginfo psi;
573 
574 	psi.psi_siginfo._info = t->p_sigctx.ps_info;
575 	psi.psi_lwpid = t->p_sigctx.ps_lwp;
576 
577 	return ptm->ptm_copyout_siginfo(&psi, addr, data);
578 }
579 
580 static int
581 ptrace_set_siginfo(struct proc *t, struct lwp **lt, struct ptrace_methods *ptm,
582     void *addr, size_t data)
583 {
584 	struct ptrace_siginfo psi;
585 
586 	int error = ptm->ptm_copyin_siginfo(&psi, addr, data);
587 	if (error)
588 		return error;
589 
590 	/* Check that the data is a valid signal number or zero. */
591 	if (psi.psi_siginfo.si_signo < 0 || psi.psi_siginfo.si_signo >= NSIG)
592 		return EINVAL;
593 
594 	if ((error = ptrace_update_lwp(t, lt, psi.psi_lwpid)) != 0)
595 		return error;
596 
597 	t->p_sigctx.ps_faked = true;
598 	t->p_sigctx.ps_info = psi.psi_siginfo._info;
599 	t->p_sigctx.ps_lwp = psi.psi_lwpid;
600 	return 0;
601 }
602 
603 static int
604 ptrace_get_event_mask(struct proc *t, void *addr, size_t data)
605 {
606 	struct ptrace_event pe;
607 
608 	if (data != sizeof(pe)) {
609 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(pe)));
610 		return EINVAL;
611 	}
612 	memset(&pe, 0, sizeof(pe));
613 	pe.pe_set_event = ISSET(t->p_slflag, PSL_TRACEFORK) ?
614 	    PTRACE_FORK : 0;
615 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK) ?
616 	    PTRACE_VFORK : 0;
617 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK_DONE) ?
618 	    PTRACE_VFORK_DONE : 0;
619 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_CREATE) ?
620 	    PTRACE_LWP_CREATE : 0;
621 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_EXIT) ?
622 	    PTRACE_LWP_EXIT : 0;
623 	return copyout(&pe, addr, sizeof(pe));
624 }
625 
626 static int
627 ptrace_set_event_mask(struct proc *t, void *addr, size_t data)
628 {
629 	struct ptrace_event pe;
630 	int error;
631 
632 	if (data != sizeof(pe)) {
633 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(pe)));
634 		return EINVAL;
635 	}
636 	if ((error = copyin(addr, &pe, sizeof(pe))) != 0)
637 		return error;
638 
639 	if (pe.pe_set_event & PTRACE_FORK)
640 		SET(t->p_slflag, PSL_TRACEFORK);
641 	else
642 		CLR(t->p_slflag, PSL_TRACEFORK);
643 
644 	if (pe.pe_set_event & PTRACE_VFORK)
645 		SET(t->p_slflag, PSL_TRACEVFORK);
646 	else
647 		CLR(t->p_slflag, PSL_TRACEVFORK);
648 
649 	if (pe.pe_set_event & PTRACE_VFORK_DONE)
650 		SET(t->p_slflag, PSL_TRACEVFORK_DONE);
651 	else
652 		CLR(t->p_slflag, PSL_TRACEVFORK_DONE);
653 
654 	if (pe.pe_set_event & PTRACE_LWP_CREATE)
655 		SET(t->p_slflag, PSL_TRACELWP_CREATE);
656 	else
657 		CLR(t->p_slflag, PSL_TRACELWP_CREATE);
658 
659 	if (pe.pe_set_event & PTRACE_LWP_EXIT)
660 		SET(t->p_slflag, PSL_TRACELWP_EXIT);
661 	else
662 		CLR(t->p_slflag, PSL_TRACELWP_EXIT);
663 	return 0;
664 }
665 
666 static int
667 ptrace_get_process_state(struct proc *t, void *addr, size_t data)
668 {
669 	struct ptrace_state ps;
670 
671 	if (data != sizeof(ps)) {
672 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(ps)));
673 		return EINVAL;
674 	}
675 	memset(&ps, 0, sizeof(ps));
676 
677 	if (t->p_fpid) {
678 		ps.pe_report_event = PTRACE_FORK;
679 		ps.pe_other_pid = t->p_fpid;
680 	} else if (t->p_vfpid) {
681 		ps.pe_report_event = PTRACE_VFORK;
682 		ps.pe_other_pid = t->p_vfpid;
683 	} else if (t->p_vfpid_done) {
684 		ps.pe_report_event = PTRACE_VFORK_DONE;
685 		ps.pe_other_pid = t->p_vfpid_done;
686 	} else if (t->p_lwp_created) {
687 		ps.pe_report_event = PTRACE_LWP_CREATE;
688 		ps.pe_lwp = t->p_lwp_created;
689 	} else if (t->p_lwp_exited) {
690 		ps.pe_report_event = PTRACE_LWP_EXIT;
691 		ps.pe_lwp = t->p_lwp_exited;
692 	}
693 	return copyout(&ps, addr, sizeof(ps));
694 }
695 
696 static int
697 ptrace_lwpinfo(struct proc *t, struct lwp **lt, void *addr, size_t data)
698 {
699 	struct ptrace_lwpinfo pl;
700 
701 	if (data != sizeof(pl)) {
702 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(pl)));
703 		return EINVAL;
704 	}
705 	int error = copyin(addr, &pl, sizeof(pl));
706 	if (error)
707 		return error;
708 
709 	lwpid_t tmp = pl.pl_lwpid;
710 	lwp_delref(*lt);
711 	mutex_enter(t->p_lock);
712 	if (tmp == 0)
713 		*lt = lwp_find_first(t);
714 	else {
715 		*lt = lwp_find(t, tmp);
716 		if (*lt == NULL) {
717 			mutex_exit(t->p_lock);
718 			return ESRCH;
719 		}
720 		*lt = LIST_NEXT(*lt, l_sibling);
721 	}
722 
723 	while (*lt != NULL && !lwp_alive(*lt))
724 		*lt = LIST_NEXT(*lt, l_sibling);
725 
726 	pl.pl_lwpid = 0;
727 	pl.pl_event = 0;
728 	if (*lt) {
729 		lwp_addref(*lt);
730 		pl.pl_lwpid = (*lt)->l_lid;
731 
732 		if ((*lt)->l_flag & LW_WSUSPEND)
733 			pl.pl_event = PL_EVENT_SUSPENDED;
734 		/*
735 		 * If we match the lwp, or it was sent to every lwp,
736 		 * we set PL_EVENT_SIGNAL.
737 		 * XXX: ps_lwp == 0 means everyone and noone, so
738 		 * check ps_signo too.
739 		 */
740 		else if ((*lt)->l_lid == t->p_sigctx.ps_lwp
741 			 || (t->p_sigctx.ps_lwp == 0 &&
742 			     t->p_sigctx.ps_info._signo))
743 			pl.pl_event = PL_EVENT_SIGNAL;
744 	}
745 	mutex_exit(t->p_lock);
746 
747 	return copyout(&pl, addr, sizeof(pl));
748 }
749 
750 static int
751 ptrace_startstop(struct proc *t, struct lwp **lt, int rq, void *addr,
752     size_t data)
753 {
754 	int error;
755 
756 	if ((error = ptrace_update_lwp(t, lt, data)) != 0)
757 		return error;
758 
759 	lwp_lock(*lt);
760 	if (rq == PT_SUSPEND)
761 		(*lt)->l_flag |= LW_WSUSPEND;
762 	else
763 		(*lt)->l_flag &= ~LW_WSUSPEND;
764 	lwp_unlock(*lt);
765 	return 0;
766 }
767 
768 #ifdef PT_REGISTERS
769 static int
770 ptrace_uio_dir(int req)
771 {
772 	switch (req) {
773 	case_PT_GETREGS
774 	case_PT_GETFPREGS
775 	case_PT_GETDBREGS
776 		return UIO_READ;
777 	case_PT_SETREGS
778 	case_PT_SETFPREGS
779 	case_PT_SETDBREGS
780 		return UIO_WRITE;
781 	default:
782 		return -1;
783 	}
784 }
785 
786 static int
787 ptrace_regs(struct lwp *l, struct lwp **lt, int rq, struct ptrace_methods *ptm,
788     void *addr, size_t data)
789 {
790 	int error;
791 	struct proc *t = (*lt)->l_proc;
792 	struct vmspace *vm;
793 
794 	if ((error = ptrace_update_lwp(t, lt, data)) != 0)
795 		return error;
796 
797 	int dir = ptrace_uio_dir(rq);
798 	size_t size;
799 	int (*func)(struct lwp *, struct lwp *, struct uio *);
800 
801 	switch (rq) {
802 #if defined(PT_SETREGS) || defined(PT_GETREGS)
803 	case_PT_GETREGS
804 	case_PT_SETREGS
805 		if (!process_validregs(*lt))
806 			return EINVAL;
807 		size = PROC_REGSZ(t);
808 		func = ptm->ptm_doregs;
809 		break;
810 #endif
811 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
812 	case_PT_GETFPREGS
813 	case_PT_SETFPREGS
814 		if (!process_validfpregs(*lt))
815 			return EINVAL;
816 		size = PROC_FPREGSZ(t);
817 		func = ptm->ptm_dofpregs;
818 		break;
819 #endif
820 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
821 	case_PT_GETDBREGS
822 	case_PT_SETDBREGS
823 		if (!process_validdbregs(*lt))
824 			return EINVAL;
825 		size = PROC_DBREGSZ(t);
826 		func = ptm->ptm_dodbregs;
827 		break;
828 #endif
829 	default:
830 		return EINVAL;
831 	}
832 
833 	error = proc_vmspace_getref(l->l_proc, &vm);
834 	if (error)
835 		return error;
836 
837 	struct uio uio;
838 	struct iovec iov;
839 
840 	iov.iov_base = addr;
841 	iov.iov_len = size;
842 	uio.uio_iov = &iov;
843 	uio.uio_iovcnt = 1;
844 	uio.uio_offset = 0;
845 	uio.uio_resid = iov.iov_len;
846 	uio.uio_rw = dir;
847 	uio.uio_vmspace = vm;
848 
849 	error = (*func)(l, *lt, &uio);
850 	uvmspace_free(vm);
851 	return error;
852 }
853 #endif
854 
855 static int
856 ptrace_sendsig(struct proc *t, struct lwp *lt, int signo, int resume_all)
857 {
858 	ksiginfo_t ksi;
859 
860 	t->p_fpid = 0;
861 	t->p_vfpid = 0;
862 	t->p_vfpid_done = 0;
863 	t->p_lwp_created = 0;
864 	t->p_lwp_exited = 0;
865 
866 	/* Finally, deliver the requested signal (or none). */
867 	if (t->p_stat == SSTOP) {
868 		/*
869 		 * Unstop the process.  If it needs to take a
870 		 * signal, make all efforts to ensure that at
871 		 * an LWP runs to see it.
872 		 */
873 		t->p_xsig = signo;
874 
875 		/*
876 		 * signo > 0 check prevents a potential panic, as
877 		 * sigismember(&...,0) is invalid check and signo
878 		 * can be equal to 0 as a special case of no-signal.
879 		 */
880 		if (signo > 0 && sigismember(&stopsigmask, signo)) {
881 			t->p_waited = 0;
882 			child_psignal(t, 0);
883 		} else if (resume_all)
884 			proc_unstop(t);
885 		else
886 			lwp_unstop(lt);
887 		return 0;
888 	}
889 
890 	KSI_INIT_EMPTY(&ksi);
891 	if (t->p_sigctx.ps_faked) {
892 		if (signo != t->p_sigctx.ps_info._signo)
893 			return EINVAL;
894 		t->p_sigctx.ps_faked = false;
895 		ksi.ksi_info = t->p_sigctx.ps_info;
896 		ksi.ksi_lid = t->p_sigctx.ps_lwp;
897 	} else if (signo == 0) {
898 		return 0;
899 	} else {
900 		ksi.ksi_signo = signo;
901 	}
902 
903 	kpsignal2(t, &ksi);
904 	return 0;
905 }
906 
907 static int
908 ptrace_dumpcore(struct lwp *lt, char *path, size_t len)
909 {
910 	int error;
911 	if (path != NULL) {
912 
913 		if (len >= MAXPATHLEN)
914 			return EINVAL;
915 
916 		char *src = path;
917 		path = kmem_alloc(len + 1, KM_SLEEP);
918 		error = copyin(src, path, len);
919 		if (error)
920 			goto out;
921 		path[len] = '\0';
922 	}
923 	error = (*coredump_vec)(lt, path);
924 out:
925 	if (path)
926 		kmem_free(path, len + 1);
927 	return error;
928 }
929 
930 static int
931 ptrace_doio(struct lwp *l, struct proc *t, struct lwp *lt,
932     struct ptrace_io_desc *piod, void *addr, bool sysspace)
933 {
934 	struct uio uio;
935 	struct iovec iov;
936 	int error, tmp;
937 
938 	error = 0;
939 	iov.iov_base = piod->piod_addr;
940 	iov.iov_len = piod->piod_len;
941 	uio.uio_iov = &iov;
942 	uio.uio_iovcnt = 1;
943 	uio.uio_offset = (off_t)(unsigned long)piod->piod_offs;
944 	uio.uio_resid = piod->piod_len;
945 
946 	switch (piod->piod_op) {
947 	case PIOD_READ_D:
948 	case PIOD_READ_I:
949 		uio.uio_rw = UIO_READ;
950 		break;
951 	case PIOD_WRITE_D:
952 	case PIOD_WRITE_I:
953 		/*
954 		 * Can't write to a RAS
955 		 */
956 		if (ras_lookup(t, addr) != (void *)-1) {
957 			return EACCES;
958 		}
959 		uio.uio_rw = UIO_WRITE;
960 		break;
961 	case PIOD_READ_AUXV:
962 		uio.uio_rw = UIO_READ;
963 		tmp = t->p_execsw->es_arglen;
964 		if (uio.uio_offset > tmp)
965 			return EIO;
966 		if (uio.uio_resid > tmp - uio.uio_offset)
967 			uio.uio_resid = tmp - uio.uio_offset;
968 		piod->piod_len = iov.iov_len = uio.uio_resid;
969 		error = process_auxv_offset(t, &uio);
970 		break;
971 	default:
972 		error = EINVAL;
973 		break;
974 	}
975 
976 	if (error)
977 		return error;
978 
979 	if (sysspace) {
980 		uio.uio_vmspace = vmspace_kernel();
981 	} else {
982 		error = proc_vmspace_getref(l->l_proc, &uio.uio_vmspace);
983 		if (error)
984 			return error;
985 	}
986 
987 	error = process_domem(l, lt, &uio);
988 	if (!sysspace)
989 		uvmspace_free(uio.uio_vmspace);
990 	if (error)
991 		return error;
992 	piod->piod_len -= uio.uio_resid;
993 	return 0;
994 }
995 
996 int
997 do_ptrace(struct ptrace_methods *ptm, struct lwp *l, int req, pid_t pid,
998     void *addr, int data, register_t *retval)
999 {
1000 	struct proc *p = l->l_proc;
1001 	struct lwp *lt = NULL;
1002 	struct lwp *lt2;
1003 	struct proc *t;				/* target process */
1004 	struct ptrace_io_desc piod;
1005 	int error, write, tmp, pheld;
1006 	int signo = 0;
1007 	int resume_all;
1008 	error = 0;
1009 
1010 	/*
1011 	 * If attaching or detaching, we need to get a write hold on the
1012 	 * proclist lock so that we can re-parent the target process.
1013 	 */
1014 	mutex_enter(proc_lock);
1015 
1016 	t = ptrace_find(l, req, pid);
1017 	if (t == NULL) {
1018 		mutex_exit(proc_lock);
1019 		return ESRCH;
1020 	}
1021 
1022 	pheld = 1;
1023 	if ((error = ptrace_allowed(l, req, t, p)) != 0)
1024 		goto out;
1025 
1026 	if ((error = kauth_authorize_process(l->l_cred,
1027 	    KAUTH_PROCESS_PTRACE, t, KAUTH_ARG(req), NULL, NULL)) != 0)
1028 		goto out;
1029 
1030 	if ((lt = lwp_find_first(t)) == NULL) {
1031 	    error = ESRCH;
1032 	    goto out;
1033 	}
1034 
1035 	/* Do single-step fixup if needed. */
1036 	FIX_SSTEP(t);
1037 	KASSERT(lt != NULL);
1038 	lwp_addref(lt);
1039 
1040 	/*
1041 	 * Which locks do we need held? XXX Ugly.
1042 	 */
1043 	if ((pheld = ptrace_needs_hold(req)) == 0) {
1044 		mutex_exit(t->p_lock);
1045 		mutex_exit(proc_lock);
1046 	}
1047 
1048 	/* Now do the operation. */
1049 	write = 0;
1050 	*retval = 0;
1051 	tmp = 0;
1052 	resume_all = 1;
1053 
1054 	switch (req) {
1055 	case PT_TRACE_ME:
1056 		/* Just set the trace flag. */
1057 		SET(t->p_slflag, PSL_TRACED);
1058 		t->p_opptr = t->p_pptr;
1059 		break;
1060 
1061 	/*
1062 	 * The I and D separate address space has been inherited from PDP-11.
1063 	 * The 16-bit UNIX started with a single address space per program,
1064 	 * but was extended to two 16-bit (2 x 64kb) address spaces.
1065 	 *
1066 	 * We no longer maintain this feature in maintained architectures, but
1067 	 * we keep the API for backward compatiblity. Currently the I and D
1068 	 * operations are exactly the same and not distinguished in debuggers.
1069 	 */
1070 	case PT_WRITE_I:
1071 	case PT_WRITE_D:
1072 		write = 1;
1073 		tmp = data;
1074 		/* FALLTHROUGH */
1075 	case PT_READ_I:
1076 	case PT_READ_D:
1077 		piod.piod_addr = &tmp;
1078 		piod.piod_len = sizeof(tmp);
1079 		piod.piod_offs = addr;
1080 		piod.piod_op = write ? PIOD_WRITE_D : PIOD_READ_D;
1081 		if ((error = ptrace_doio(l, t, lt, &piod, addr, true)) != 0)
1082 			break;
1083 		if (!write)
1084 			*retval = tmp;
1085 		break;
1086 
1087 	case PT_IO:
1088 		if ((error = ptm->ptm_copyin_piod(&piod, addr, data)) != 0)
1089 			break;
1090 		if ((error = ptrace_doio(l, t, lt, &piod, addr, false)) != 0)
1091 			break;
1092 		error = ptm->ptm_copyout_piod(&piod, addr, data);
1093 		break;
1094 
1095 	case PT_DUMPCORE:
1096 		error = ptrace_dumpcore(lt, addr, data);
1097 		break;
1098 
1099 #ifdef PT_STEP
1100 	case PT_STEP:
1101 		/*
1102 		 * From the 4.4BSD PRM:
1103 		 * "Execution continues as in request PT_CONTINUE; however
1104 		 * as soon as possible after execution of at least one
1105 		 * instruction, execution stops again. [ ... ]"
1106 		 */
1107 #endif
1108 	case PT_CONTINUE:
1109 	case PT_SYSCALL:
1110 	case PT_DETACH:
1111 		if (req == PT_SYSCALL) {
1112 			if (!ISSET(t->p_slflag, PSL_SYSCALL)) {
1113 				SET(t->p_slflag, PSL_SYSCALL);
1114 #ifdef __HAVE_SYSCALL_INTERN
1115 				(*t->p_emul->e_syscall_intern)(t);
1116 #endif
1117 			}
1118 		} else {
1119 			if (ISSET(t->p_slflag, PSL_SYSCALL)) {
1120 				CLR(t->p_slflag, PSL_SYSCALL);
1121 #ifdef __HAVE_SYSCALL_INTERN
1122 				(*t->p_emul->e_syscall_intern)(t);
1123 #endif
1124 			}
1125 		}
1126 		t->p_trace_enabled = trace_is_enabled(t);
1127 
1128 		/*
1129 		 * Pick up the LWPID, if supplied.  There are two cases:
1130 		 * data < 0 : step or continue single thread, lwp = -data
1131 		 * data > 0 in PT_STEP : step this thread, continue others
1132 		 * For operations other than PT_STEP, data > 0 means
1133 		 * data is the signo to deliver to the process.
1134 		 */
1135 		tmp = data;
1136 		if (tmp >= 0) {
1137 #ifdef PT_STEP
1138 			if (req == PT_STEP)
1139 				signo = 0;
1140 			else
1141 #endif
1142 			{
1143 				signo = tmp;
1144 				tmp = 0;	/* don't search for LWP */
1145 			}
1146 		} else
1147 			tmp = -tmp;
1148 
1149 		if (tmp > 0) {
1150 			if (req == PT_DETACH) {
1151 				error = EINVAL;
1152 				break;
1153 			}
1154 			lwp_delref2 (lt);
1155 			lt = lwp_find(t, tmp);
1156 			if (lt == NULL) {
1157 				error = ESRCH;
1158 				break;
1159 			}
1160 			lwp_addref(lt);
1161 			resume_all = 0;
1162 			signo = 0;
1163 		}
1164 
1165 		/*
1166 		 * From the 4.4BSD PRM:
1167 		 * "The data argument is taken as a signal number and the
1168 		 * child's execution continues at location addr as if it
1169 		 * incurred that signal.  Normally the signal number will
1170 		 * be either 0 to indicate that the signal that caused the
1171 		 * stop should be ignored, or that value fetched out of
1172 		 * the process's image indicating which signal caused
1173 		 * the stop.  If addr is (int *)1 then execution continues
1174 		 * from where it stopped."
1175 		 */
1176 
1177 		/* Check that the data is a valid signal number or zero. */
1178 		if (signo < 0 || signo >= NSIG) {
1179 			error = EINVAL;
1180 			break;
1181 		}
1182 
1183 		/* Prevent process deadlock */
1184 		if (resume_all) {
1185 #ifdef PT_STEP
1186 			if (req == PT_STEP) {
1187 				if (lt->l_flag & LW_WSUSPEND) {
1188 					error = EDEADLK;
1189 					break;
1190 				}
1191 			} else
1192 #endif
1193 			{
1194 				error = EDEADLK;
1195 				LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
1196 					if ((lt2->l_flag & LW_WSUSPEND) == 0) {
1197 						error = 0;
1198 						break;
1199 					}
1200 				}
1201 				if (error != 0)
1202 					break;
1203 			}
1204 		} else {
1205 			if (lt->l_flag & LW_WSUSPEND) {
1206 				error = EDEADLK;
1207 				break;
1208 			}
1209 		}
1210 
1211 		/* If the address parameter is not (int *)1, set the pc. */
1212 		if ((int *)addr != (int *)1) {
1213 			error = process_set_pc(lt, addr);
1214 			if (error != 0)
1215 				break;
1216 		}
1217 #ifdef PT_STEP
1218 		/*
1219 		 * Arrange for a single-step, if that's requested and possible.
1220 		 * More precisely, set the single step status as requested for
1221 		 * the requested thread, and clear it for other threads.
1222 		 */
1223 		LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
1224 			if (ISSET(lt2->l_pflag, LP_SINGLESTEP)) {
1225 				lwp_lock(lt2);
1226 				process_sstep(lt2, 1);
1227 				lwp_unlock(lt2);
1228 			} else if (lt != lt2) {
1229 				lwp_lock(lt2);
1230 				process_sstep(lt2, 0);
1231 				lwp_unlock(lt2);
1232 			}
1233 		}
1234 		error = process_sstep(lt,
1235 		    ISSET(lt->l_pflag, LP_SINGLESTEP) || req == PT_STEP);
1236 		if (error)
1237 			break;
1238 #endif
1239 		if (req == PT_DETACH) {
1240 			CLR(t->p_slflag, PSL_TRACED|PSL_SYSCALL);
1241 
1242 			/* give process back to original parent or init */
1243 			if (t->p_opptr != t->p_pptr) {
1244 				struct proc *pp = t->p_opptr;
1245 				proc_reparent(t, pp ? pp : initproc);
1246 			}
1247 
1248 			/* not being traced any more */
1249 			t->p_opptr = NULL;
1250 
1251 			/* clear single step */
1252 			LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
1253 				CLR(lt2->l_pflag, LP_SINGLESTEP);
1254 			}
1255 			CLR(lt->l_pflag, LP_SINGLESTEP);
1256 		}
1257 	sendsig:
1258 		error = ptrace_sendsig(t, lt, signo, resume_all);
1259 		break;
1260 
1261 	case PT_SYSCALLEMU:
1262 		if (!ISSET(t->p_slflag, PSL_SYSCALL) || t->p_stat != SSTOP) {
1263 			error = EINVAL;
1264 			break;
1265 		}
1266 		SET(t->p_slflag, PSL_SYSCALLEMU);
1267 		break;
1268 
1269 #ifdef PT_STEP
1270 	case PT_SETSTEP:
1271 		write = 1;
1272 
1273 	case PT_CLEARSTEP:
1274 		/* write = 0 done above. */
1275 		if ((error = ptrace_update_lwp(t, &lt, data)) != 0)
1276 			break;
1277 
1278 		if (write)
1279 			SET(lt->l_pflag, LP_SINGLESTEP);
1280 		else
1281 			CLR(lt->l_pflag, LP_SINGLESTEP);
1282 		break;
1283 #endif
1284 
1285 	case PT_KILL:
1286 		/* just send the process a KILL signal. */
1287 		signo = SIGKILL;
1288 		goto sendsig;	/* in PT_CONTINUE, above. */
1289 
1290 	case PT_ATTACH:
1291 		/*
1292 		 * Go ahead and set the trace flag.
1293 		 * Save the old parent (it's reset in
1294 		 *   _DETACH, and also in kern_exit.c:wait4()
1295 		 * Reparent the process so that the tracing
1296 		 *   proc gets to see all the action.
1297 		 * Stop the target.
1298 		 */
1299 		proc_changeparent(t, p);
1300 		signo = SIGSTOP;
1301 		goto sendsig;
1302 
1303 	case PT_GET_EVENT_MASK:
1304 		error = ptrace_get_event_mask(t, addr, data);
1305 		break;
1306 
1307 	case PT_SET_EVENT_MASK:
1308 		error = ptrace_set_event_mask(t, addr, data);
1309 		break;
1310 
1311 	case PT_GET_PROCESS_STATE:
1312 		error = ptrace_get_process_state(t, addr, data);
1313 		break;
1314 
1315 	case PT_LWPINFO:
1316 		error = ptrace_lwpinfo(t, &lt, addr, data);
1317 		break;
1318 
1319 	case PT_SET_SIGINFO:
1320 		error = ptrace_set_siginfo(t, &lt, ptm, addr, data);
1321 		break;
1322 
1323 	case PT_GET_SIGINFO:
1324 		error = ptrace_get_siginfo(t, ptm, addr, data);
1325 		break;
1326 
1327 	case PT_RESUME:
1328 	case PT_SUSPEND:
1329 		error = ptrace_startstop(t, &lt, req, addr, data);
1330 		break;
1331 
1332 #ifdef PT_REGISTERS
1333 	case_PT_SETREGS
1334 	case_PT_GETREGS
1335 	case_PT_SETFPREGS
1336 	case_PT_GETFPREGS
1337 	case_PT_SETDBREGS
1338 	case_PT_GETDBREGS
1339 		error = ptrace_regs(l, &lt, req, ptm, addr, data);
1340 		break;
1341 #endif
1342 
1343 #ifdef __HAVE_PTRACE_MACHDEP
1344 	PTRACE_MACHDEP_REQUEST_CASES
1345 		error = ptrace_machdep_dorequest(l, lt, req, addr, data);
1346 		break;
1347 #endif
1348 	}
1349 
1350 out:
1351 	if (pheld) {
1352 		mutex_exit(t->p_lock);
1353 		mutex_exit(proc_lock);
1354 	}
1355 	if (lt != NULL)
1356 		lwp_delref(lt);
1357 	rw_exit(&t->p_reflock);
1358 
1359 	return error;
1360 }
1361 
1362 typedef int (*regrfunc_t)(struct lwp *, void *, size_t *);
1363 typedef int (*regwfunc_t)(struct lwp *, void *, size_t);
1364 
1365 #ifdef PT_REGISTERS
1366 static int
1367 proc_regio(struct lwp *l, struct uio *uio, size_t ks, regrfunc_t r,
1368     regwfunc_t w)
1369 {
1370 	char buf[1024];
1371 	int error;
1372 	char *kv;
1373 	size_t kl;
1374 
1375 	if (ks > sizeof(buf))
1376 		return E2BIG;
1377 
1378 	if (uio->uio_offset < 0 || uio->uio_offset > (off_t)ks)
1379 		return EINVAL;
1380 
1381 	kv = buf + uio->uio_offset;
1382 	kl = ks - uio->uio_offset;
1383 
1384 	if (kl > uio->uio_resid)
1385 		kl = uio->uio_resid;
1386 
1387 	error = (*r)(l, buf, &ks);
1388 	if (error == 0)
1389 		error = uiomove(kv, kl, uio);
1390 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
1391 		if (l->l_stat != LSSTOP)
1392 			error = EBUSY;
1393 		else
1394 			error = (*w)(l, buf, ks);
1395 	}
1396 
1397 	uio->uio_offset = 0;
1398 	return error;
1399 }
1400 #endif
1401 
1402 int
1403 process_doregs(struct lwp *curl /*tracer*/,
1404     struct lwp *l /*traced*/,
1405     struct uio *uio)
1406 {
1407 #if defined(PT_GETREGS) || defined(PT_SETREGS)
1408 	size_t s;
1409 	regrfunc_t r;
1410 	regwfunc_t w;
1411 
1412 #ifdef COMPAT_NETBSD32
1413 	const bool pk32 = (l->l_proc->p_flag & PK_32) != 0;
1414 
1415 	if (__predict_false(pk32)) {
1416 		s = sizeof(process_reg32);
1417 		r = (regrfunc_t)process_read_regs32;
1418 		w = (regwfunc_t)process_write_regs32;
1419 	} else
1420 #endif
1421 	{
1422 		s = sizeof(struct reg);
1423 		r = (regrfunc_t)process_read_regs;
1424 		w = (regwfunc_t)process_write_regs;
1425 	}
1426 	return proc_regio(l, uio, s, r, w);
1427 #else
1428 	return EINVAL;
1429 #endif
1430 }
1431 
1432 int
1433 process_validregs(struct lwp *l)
1434 {
1435 
1436 #if defined(PT_SETREGS) || defined(PT_GETREGS)
1437 	return (l->l_flag & LW_SYSTEM) == 0;
1438 #else
1439 	return 0;
1440 #endif
1441 }
1442 
1443 int
1444 process_dofpregs(struct lwp *curl /*tracer*/,
1445     struct lwp *l /*traced*/,
1446     struct uio *uio)
1447 {
1448 #if defined(PT_GETFPREGS) || defined(PT_SETFPREGS)
1449 	size_t s;
1450 	regrfunc_t r;
1451 	regwfunc_t w;
1452 
1453 #ifdef COMPAT_NETBSD32
1454 	const bool pk32 = (l->l_proc->p_flag & PK_32) != 0;
1455 
1456 	if (__predict_false(pk32)) {
1457 		s = sizeof(process_fpreg32);
1458 		r = (regrfunc_t)process_read_fpregs32;
1459 		w = (regwfunc_t)process_write_fpregs32;
1460 	} else
1461 #endif
1462 	{
1463 		s = sizeof(struct fpreg);
1464 		r = (regrfunc_t)process_read_fpregs;
1465 		w = (regwfunc_t)process_write_fpregs;
1466 	}
1467 	return proc_regio(l, uio, s, r, w);
1468 #else
1469 	return EINVAL;
1470 #endif
1471 }
1472 
1473 int
1474 process_validfpregs(struct lwp *l)
1475 {
1476 
1477 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
1478 	return (l->l_flag & LW_SYSTEM) == 0;
1479 #else
1480 	return 0;
1481 #endif
1482 }
1483 
1484 int
1485 process_dodbregs(struct lwp *curl /*tracer*/,
1486     struct lwp *l /*traced*/,
1487     struct uio *uio)
1488 {
1489 #if defined(PT_GETDBREGS) || defined(PT_SETDBREGS)
1490 	size_t s;
1491 	regrfunc_t r;
1492 	regwfunc_t w;
1493 
1494 #ifdef COMPAT_NETBSD32
1495 	const bool pk32 = (l->l_proc->p_flag & PK_32) != 0;
1496 
1497 	if (__predict_false(pk32)) {
1498 		s = sizeof(process_dbreg32);
1499 		r = (regrfunc_t)process_read_dbregs32;
1500 		w = (regwfunc_t)process_write_dbregs32;
1501 	} else
1502 #endif
1503 	{
1504 		s = sizeof(struct dbreg);
1505 		r = (regrfunc_t)process_read_dbregs;
1506 		w = (regwfunc_t)process_write_dbregs;
1507 	}
1508 	return proc_regio(l, uio, s, r, w);
1509 #else
1510 	return EINVAL;
1511 #endif
1512 }
1513 
1514 int
1515 process_validdbregs(struct lwp *l)
1516 {
1517 
1518 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
1519 	return (l->l_flag & LW_SYSTEM) == 0;
1520 #else
1521 	return 0;
1522 #endif
1523 }
1524 
1525 static int
1526 process_auxv_offset(struct proc *p, struct uio *uio)
1527 {
1528 	struct ps_strings pss;
1529 	int error;
1530 	off_t off = (off_t)p->p_psstrp;
1531 
1532 	if ((error = copyin_psstrings(p, &pss)) != 0)
1533 		return error;
1534 
1535 	if (pss.ps_envstr == NULL)
1536 		return EIO;
1537 
1538 	uio->uio_offset += (off_t)(vaddr_t)(pss.ps_envstr + pss.ps_nenvstr + 1);
1539 #ifdef __MACHINE_STACK_GROWS_UP
1540 	if (uio->uio_offset < off)
1541 		return EIO;
1542 #else
1543 	if (uio->uio_offset > off)
1544 		return EIO;
1545 	if ((uio->uio_offset + uio->uio_resid) > off)
1546 		uio->uio_resid = off - uio->uio_offset;
1547 #endif
1548 	return 0;
1549 }
1550 #endif /* PTRACE */
1551 
1552 MODULE(MODULE_CLASS_EXEC, ptrace_common, "");
1553 
1554 static int
1555 ptrace_common_modcmd(modcmd_t cmd, void *arg)
1556 {
1557         int error;
1558 
1559         switch (cmd) {
1560         case MODULE_CMD_INIT:
1561                 error = ptrace_init();
1562                 break;
1563         case MODULE_CMD_FINI:
1564                 error = ptrace_fini();
1565                 break;
1566         default:
1567 		ptrace_hooks();
1568                 error = ENOTTY;
1569                 break;
1570         }
1571         return error;
1572 }
1573