xref: /netbsd-src/sys/kern/sys_ptrace_common.c (revision d3d2abdc28a790079ac0d9b337b15bd97b65d751)
1 /*	$NetBSD: sys_ptrace_common.c,v 1.58 2019/07/18 20:10:46 kamil Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Andrew Doran.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*-
33  * Copyright (c) 1982, 1986, 1989, 1993
34  *	The Regents of the University of California.  All rights reserved.
35  * (c) UNIX System Laboratories, Inc.
36  * All or some portions of this file are derived from material licensed
37  * to the University of California by American Telephone and Telegraph
38  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
39  * the permission of UNIX System Laboratories, Inc.
40  *
41  * This code is derived from software contributed to Berkeley by
42  * Jan-Simon Pendry.
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. Neither the name of the University nor the names of its contributors
53  *    may be used to endorse or promote products derived from this software
54  *    without specific prior written permission.
55  *
56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66  * SUCH DAMAGE.
67  *
68  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
69  */
70 
71 /*-
72  * Copyright (c) 1993 Jan-Simon Pendry.
73  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
74  *
75  * This code is derived from software contributed to Berkeley by
76  * Jan-Simon Pendry.
77  *
78  * Redistribution and use in source and binary forms, with or without
79  * modification, are permitted provided that the following conditions
80  * are met:
81  * 1. Redistributions of source code must retain the above copyright
82  *    notice, this list of conditions and the following disclaimer.
83  * 2. Redistributions in binary form must reproduce the above copyright
84  *    notice, this list of conditions and the following disclaimer in the
85  *    documentation and/or other materials provided with the distribution.
86  * 3. All advertising materials mentioning features or use of this software
87  *    must display the following acknowledgement:
88  *	This product includes software developed by the University of
89  *	California, Berkeley and its contributors.
90  * 4. Neither the name of the University nor the names of its contributors
91  *    may be used to endorse or promote products derived from this software
92  *    without specific prior written permission.
93  *
94  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
95  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
96  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
97  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
98  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
99  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
100  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
101  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
102  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
103  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
104  * SUCH DAMAGE.
105  *
106  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
107  */
108 
109 /*
110  * References:
111  *	(1) Bach's "The Design of the UNIX Operating System",
112  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
113  *	(3) the "4.4BSD Programmer's Reference Manual" published
114  *		by USENIX and O'Reilly & Associates.
115  * The 4.4BSD PRM does a reasonably good job of documenting what the various
116  * ptrace() requests should actually do, and its text is quoted several times
117  * in this file.
118  */
119 
120 #include <sys/cdefs.h>
121 __KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.58 2019/07/18 20:10:46 kamil Exp $");
122 
123 #ifdef _KERNEL_OPT
124 #include "opt_ptrace.h"
125 #include "opt_ktrace.h"
126 #include "opt_pax.h"
127 #include "opt_compat_netbsd32.h"
128 #endif
129 
130 #if defined(__HAVE_COMPAT_NETBSD32) && !defined(COMPAT_NETBSD32) \
131     && !defined(_RUMPKERNEL)
132 #define COMPAT_NETBSD32
133 #endif
134 
135 #include <sys/param.h>
136 #include <sys/systm.h>
137 #include <sys/proc.h>
138 #include <sys/errno.h>
139 #include <sys/exec.h>
140 #include <sys/pax.h>
141 #include <sys/ptrace.h>
142 #include <sys/uio.h>
143 #include <sys/ras.h>
144 #include <sys/kmem.h>
145 #include <sys/kauth.h>
146 #include <sys/mount.h>
147 #include <sys/syscallargs.h>
148 #include <sys/module.h>
149 #include <sys/condvar.h>
150 #include <sys/mutex.h>
151 
152 #include <uvm/uvm_extern.h>
153 
154 #include <machine/reg.h>
155 
156 #ifdef PTRACE
157 # ifdef PTRACE_DEBUG
158 #  define DPRINTF(a) uprintf a
159 # else
160 #  define DPRINTF(a)
161 # endif
162 
163 static kauth_listener_t ptrace_listener;
164 static int process_auxv_offset(struct proc *, struct uio *);
165 
166 extern int user_va0_disable;
167 
168 #if 0
169 static int ptrace_cbref;
170 static kmutex_t ptrace_mtx;
171 static kcondvar_t ptrace_cv;
172 #endif
173 
174 #ifdef PT_GETREGS
175 # define case_PT_GETREGS	case PT_GETREGS:
176 #else
177 # define case_PT_GETREGS
178 #endif
179 
180 #ifdef PT_SETREGS
181 # define case_PT_SETREGS	case PT_SETREGS:
182 #else
183 # define case_PT_SETREGS
184 #endif
185 
186 #ifdef PT_GETFPREGS
187 # define case_PT_GETFPREGS	case PT_GETFPREGS:
188 #else
189 # define case_PT_GETFPREGS
190 #endif
191 
192 #ifdef PT_SETFPREGS
193 # define case_PT_SETFPREGS	case PT_SETFPREGS:
194 #else
195 # define case_PT_SETFPREGS
196 #endif
197 
198 #ifdef PT_GETDBREGS
199 # define case_PT_GETDBREGS	case PT_GETDBREGS:
200 #else
201 # define case_PT_GETDBREGS
202 #endif
203 
204 #ifdef PT_SETDBREGS
205 # define case_PT_SETDBREGS	case PT_SETDBREGS:
206 #else
207 # define case_PT_SETDBREGS
208 #endif
209 
210 #if defined(PT_SETREGS) || defined(PT_GETREGS) || \
211     defined(PT_SETFPREGS) || defined(PT_GETFPREGS) || \
212     defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
213 # define PT_REGISTERS
214 #endif
215 
216 static int
217 ptrace_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
218     void *arg0, void *arg1, void *arg2, void *arg3)
219 {
220 	struct proc *p;
221 	int result;
222 #ifdef PT_SETDBREGS
223 	extern int user_set_dbregs;
224 #endif
225 
226 	result = KAUTH_RESULT_DEFER;
227 	p = arg0;
228 
229 #if 0
230 	mutex_enter(&ptrace_mtx);
231 	ptrace_cbref++;
232 	mutex_exit(&ptrace_mtx);
233 #endif
234 	if (action != KAUTH_PROCESS_PTRACE)
235 		goto out;
236 
237 	switch ((u_long)arg1) {
238 #ifdef PT_SETDBREGS
239 	case_PT_SETDBREGS
240 		if (kauth_cred_getuid(cred) != 0 && user_set_dbregs == 0) {
241 			result = KAUTH_RESULT_DENY;
242 			break;
243 		}
244 #endif
245 		/* FALLTHROUGH */
246 	case PT_TRACE_ME:
247 	case PT_ATTACH:
248 	case PT_WRITE_I:
249 	case PT_WRITE_D:
250 	case PT_READ_I:
251 	case PT_READ_D:
252 	case PT_IO:
253 	case_PT_GETREGS
254 	case_PT_SETREGS
255 	case_PT_GETFPREGS
256 	case_PT_SETFPREGS
257 	case_PT_GETDBREGS
258 	case PT_SET_EVENT_MASK:
259 	case PT_GET_EVENT_MASK:
260 	case PT_GET_PROCESS_STATE:
261 	case PT_SET_SIGINFO:
262 	case PT_GET_SIGINFO:
263 #ifdef __HAVE_PTRACE_MACHDEP
264 	PTRACE_MACHDEP_REQUEST_CASES
265 #endif
266 		if (kauth_cred_getuid(cred) != kauth_cred_getuid(p->p_cred) ||
267 		    ISSET(p->p_flag, PK_SUGID)) {
268 			break;
269 		}
270 
271 		result = KAUTH_RESULT_ALLOW;
272 
273 	break;
274 
275 #ifdef PT_STEP
276 	case PT_STEP:
277 	case PT_SETSTEP:
278 	case PT_CLEARSTEP:
279 #endif
280 	case PT_CONTINUE:
281 	case PT_KILL:
282 	case PT_DETACH:
283 	case PT_LWPINFO:
284 	case PT_SYSCALL:
285 	case PT_SYSCALLEMU:
286 	case PT_DUMPCORE:
287 	case PT_RESUME:
288 	case PT_SUSPEND:
289 		result = KAUTH_RESULT_ALLOW;
290 		break;
291 
292 	default:
293 		break;
294 	}
295 
296  out:
297 #if 0
298 	mutex_enter(&ptrace_mtx);
299 	if (--ptrace_cbref == 0)
300 		cv_broadcast(&ptrace_cv);
301 	mutex_exit(&ptrace_mtx);
302 #endif
303 
304 	return result;
305 }
306 
307 int
308 ptrace_init(void)
309 {
310 
311 #if 0
312 	mutex_init(&ptrace_mtx, MUTEX_DEFAULT, IPL_NONE);
313 	cv_init(&ptrace_cv, "ptracecb");
314 	ptrace_cbref = 0;
315 #endif
316 	ptrace_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
317 	    ptrace_listener_cb, NULL);
318 	return 0;
319 }
320 
321 int
322 ptrace_fini(void)
323 {
324 
325 	kauth_unlisten_scope(ptrace_listener);
326 
327 #if 0
328 	/* Make sure no-one is executing our kauth listener */
329 
330 	mutex_enter(&ptrace_mtx);
331 	while (ptrace_cbref != 0)
332 		cv_wait(&ptrace_cv, &ptrace_mtx);
333 	mutex_exit(&ptrace_mtx);
334 	mutex_destroy(&ptrace_mtx);
335 	cv_destroy(&ptrace_cv);
336 #endif
337 
338 	return 0;
339 }
340 
341 static struct proc *
342 ptrace_find(struct lwp *l, int req, pid_t pid)
343 {
344 	struct proc *t;
345 
346 	/* "A foolish consistency..." XXX */
347 	if (req == PT_TRACE_ME) {
348 		t = l->l_proc;
349 		mutex_enter(t->p_lock);
350 		return t;
351 	}
352 
353 	/* Find the process we're supposed to be operating on. */
354 	t = proc_find(pid);
355 	if (t == NULL)
356 		return NULL;
357 
358 	/* XXX-elad */
359 	mutex_enter(t->p_lock);
360 	int error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE,
361 	    t, KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
362 	if (error) {
363 		mutex_exit(t->p_lock);
364 		return NULL;
365 	}
366 	return t;
367 }
368 
369 static int
370 ptrace_allowed(struct lwp *l, int req, struct proc *t, struct proc *p,
371     bool *locked)
372 {
373 	*locked = false;
374 
375 	/*
376 	 * Grab a reference on the process to prevent it from execing or
377 	 * exiting.
378 	 */
379 	if (!rw_tryenter(&t->p_reflock, RW_READER))
380 		return EBUSY;
381 
382 	*locked = true;
383 
384 	/* Make sure we can operate on it. */
385 	switch (req) {
386 	case PT_TRACE_ME:
387 		/*
388 		 * You can't say to the parent of a process to start tracing if:
389 		 *	(1) the parent is initproc,
390 		 */
391 		if (p->p_pptr == initproc)
392 			return EPERM;
393 
394 		/*
395 		 *	(2) the process is initproc, or
396 		 */
397 		if (p == initproc)
398 			return EPERM;
399 
400 		/*
401 		 *	(3) the child is already traced.
402 		 */
403 		if (ISSET(p->p_slflag, PSL_TRACED))
404 			return EBUSY;
405 
406 		return 0;
407 
408 	case PT_ATTACH:
409 		/*
410 		 * You can't attach to a process if:
411 		 *	(1) it's the process that's doing the attaching,
412 		 */
413 		if (t == p)
414 			return EINVAL;
415 
416 		/*
417 		 *	(2) it's a system process,
418 		 */
419 		if (t->p_flag & PK_SYSTEM)
420 			return EPERM;
421 
422 		/*
423 		 *	(3) the tracer is initproc,
424 		 */
425 		if (p == initproc)
426 			return EPERM;
427 
428 		/*
429 		 *	(4) it's already being traced,
430 		 */
431 		if (ISSET(t->p_slflag, PSL_TRACED))
432 			return EBUSY;
433 
434 		/*
435 		 *	(5) it's a vfork(2)ed parent of the current process, or
436 		 */
437 		if (ISSET(p->p_lflag, PL_PPWAIT) && p->p_pptr == t)
438 			return EPERM;
439 
440 		/*
441 		 * 	(6) the tracer is chrooted, and its root directory is
442 		 * 	    not at or above the root directory of the tracee
443 		 */
444 		mutex_exit(t->p_lock);	/* XXXSMP */
445 		int tmp = proc_isunder(t, l);
446 		mutex_enter(t->p_lock);	/* XXXSMP */
447 		if (!tmp)
448 			return EPERM;
449 		return 0;
450 
451 	case PT_READ_I:
452 	case PT_READ_D:
453 	case PT_WRITE_I:
454 	case PT_WRITE_D:
455 	case PT_IO:
456 	case PT_SET_SIGINFO:
457 	case PT_GET_SIGINFO:
458 	case_PT_GETREGS
459 	case_PT_SETREGS
460 	case_PT_GETFPREGS
461 	case_PT_SETFPREGS
462 	case_PT_GETDBREGS
463 	case_PT_SETDBREGS
464 #ifdef __HAVE_PTRACE_MACHDEP
465 	PTRACE_MACHDEP_REQUEST_CASES
466 #endif
467 		/*
468 		 * You can't read/write the memory or registers of a process
469 		 * if the tracer is chrooted, and its root directory is not at
470 		 * or above the root directory of the tracee.
471 		 */
472 		mutex_exit(t->p_lock);	/* XXXSMP */
473 		tmp = proc_isunder(t, l);
474 		mutex_enter(t->p_lock);	/* XXXSMP */
475 		if (!tmp)
476 			return EPERM;
477 		/*FALLTHROUGH*/
478 
479 	case PT_CONTINUE:
480 	case PT_KILL:
481 	case PT_DETACH:
482 	case PT_LWPINFO:
483 	case PT_SYSCALL:
484 	case PT_SYSCALLEMU:
485 	case PT_DUMPCORE:
486 #ifdef PT_STEP
487 	case PT_STEP:
488 	case PT_SETSTEP:
489 	case PT_CLEARSTEP:
490 #endif
491 	case PT_SET_EVENT_MASK:
492 	case PT_GET_EVENT_MASK:
493 	case PT_GET_PROCESS_STATE:
494 	case PT_RESUME:
495 	case PT_SUSPEND:
496 		/*
497 		 * You can't do what you want to the process if:
498 		 *	(1) It's not being traced at all,
499 		 */
500 		if (!ISSET(t->p_slflag, PSL_TRACED))
501 			return EPERM;
502 
503 		/*
504 		 *	(2) it's not being traced by _you_, or
505 		 */
506 		if (t->p_pptr != p) {
507 			DPRINTF(("parent %d != %d\n", t->p_pptr->p_pid,
508 			    p->p_pid));
509 			return EBUSY;
510 		}
511 
512 		/*
513 		 *	(3) it's not currently stopped.
514 		 */
515 		if (t->p_stat != SSTOP || !t->p_waited /* XXXSMP */) {
516 			DPRINTF(("stat %d flag %d\n", t->p_stat,
517 			    !t->p_waited));
518 			return EBUSY;
519 		}
520 		return 0;
521 
522 	default:			/* It was not a legal request. */
523 		return EINVAL;
524 	}
525 }
526 
527 static int
528 ptrace_needs_hold(int req)
529 {
530 	switch (req) {
531 #ifdef PT_STEP
532 	case PT_STEP:
533 #endif
534 	case PT_CONTINUE:
535 	case PT_DETACH:
536 	case PT_KILL:
537 	case PT_SYSCALL:
538 	case PT_SYSCALLEMU:
539 	case PT_ATTACH:
540 	case PT_TRACE_ME:
541 	case PT_GET_SIGINFO:
542 	case PT_SET_SIGINFO:
543 		return 1;
544 	default:
545 		return 0;
546 	}
547 }
548 
549 static int
550 ptrace_update_lwp(struct proc *t, struct lwp **lt, lwpid_t lid)
551 {
552 	if (lid == 0 || lid == (*lt)->l_lid || t->p_nlwps == 1)
553 		return 0;
554 
555 	mutex_enter(t->p_lock);
556 	lwp_delref2(*lt);
557 
558 	*lt = lwp_find(t, lid);
559 	if (*lt == NULL) {
560 		mutex_exit(t->p_lock);
561 		return ESRCH;
562 	}
563 
564 	if ((*lt)->l_flag & LW_SYSTEM) {
565 		mutex_exit(t->p_lock);
566 		*lt = NULL;
567 		return EINVAL;
568 	}
569 
570 	lwp_addref(*lt);
571 	mutex_exit(t->p_lock);
572 
573 	return 0;
574 }
575 
576 static int
577 ptrace_get_siginfo(struct proc *t, struct ptrace_methods *ptm, void *addr,
578     size_t data)
579 {
580 	struct ptrace_siginfo psi;
581 
582 	memset(&psi, 0, sizeof(psi));
583 	psi.psi_siginfo._info = t->p_sigctx.ps_info;
584 	psi.psi_lwpid = t->p_sigctx.ps_lwp;
585 	DPRINTF(("%s: lwp=%d signal=%d\n", __func__, psi.psi_lwpid,
586 	    psi.psi_siginfo.si_signo));
587 
588 	return ptm->ptm_copyout_siginfo(&psi, addr, data);
589 }
590 
591 static int
592 ptrace_set_siginfo(struct proc *t, struct lwp **lt, struct ptrace_methods *ptm,
593     void *addr, size_t data)
594 {
595 	struct ptrace_siginfo psi;
596 
597 	int error = ptm->ptm_copyin_siginfo(&psi, addr, data);
598 	if (error)
599 		return error;
600 
601 	/* Check that the data is a valid signal number or zero. */
602 	if (psi.psi_siginfo.si_signo < 0 || psi.psi_siginfo.si_signo >= NSIG)
603 		return EINVAL;
604 
605 	t->p_sigctx.ps_faked = true;
606 	t->p_sigctx.ps_info = psi.psi_siginfo._info;
607 	t->p_sigctx.ps_lwp = psi.psi_lwpid;
608 	DPRINTF(("%s: lwp=%d signal=%d\n", __func__, psi.psi_lwpid,
609 	    psi.psi_siginfo.si_signo));
610 	return 0;
611 }
612 
613 static int
614 ptrace_get_event_mask(struct proc *t, void *addr, size_t data)
615 {
616 	struct ptrace_event pe;
617 
618 	if (data != sizeof(pe)) {
619 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(pe)));
620 		return EINVAL;
621 	}
622 	memset(&pe, 0, sizeof(pe));
623 	pe.pe_set_event = ISSET(t->p_slflag, PSL_TRACEFORK) ?
624 	    PTRACE_FORK : 0;
625 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK) ?
626 	    PTRACE_VFORK : 0;
627 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK_DONE) ?
628 	    PTRACE_VFORK_DONE : 0;
629 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_CREATE) ?
630 	    PTRACE_LWP_CREATE : 0;
631 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_EXIT) ?
632 	    PTRACE_LWP_EXIT : 0;
633 	pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEPOSIX_SPAWN) ?
634 	    PTRACE_POSIX_SPAWN : 0;
635 	DPRINTF(("%s: lwp=%d event=%#x\n", __func__,
636 	    t->p_sigctx.ps_lwp, pe.pe_set_event));
637 	return copyout(&pe, addr, sizeof(pe));
638 }
639 
640 static int
641 ptrace_set_event_mask(struct proc *t, void *addr, size_t data)
642 {
643 	struct ptrace_event pe;
644 	int error;
645 
646 	if (data != sizeof(pe)) {
647 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(pe)));
648 		return EINVAL;
649 	}
650 	if ((error = copyin(addr, &pe, sizeof(pe))) != 0)
651 		return error;
652 
653 	DPRINTF(("%s: lwp=%d event=%#x\n", __func__,
654 	    t->p_sigctx.ps_lwp, pe.pe_set_event));
655 	if (pe.pe_set_event & PTRACE_FORK)
656 		SET(t->p_slflag, PSL_TRACEFORK);
657 	else
658 		CLR(t->p_slflag, PSL_TRACEFORK);
659 
660 	if (pe.pe_set_event & PTRACE_VFORK)
661 		SET(t->p_slflag, PSL_TRACEVFORK);
662 	else
663 		CLR(t->p_slflag, PSL_TRACEVFORK);
664 
665 	if (pe.pe_set_event & PTRACE_VFORK_DONE)
666 		SET(t->p_slflag, PSL_TRACEVFORK_DONE);
667 	else
668 		CLR(t->p_slflag, PSL_TRACEVFORK_DONE);
669 
670 	if (pe.pe_set_event & PTRACE_LWP_CREATE)
671 		SET(t->p_slflag, PSL_TRACELWP_CREATE);
672 	else
673 		CLR(t->p_slflag, PSL_TRACELWP_CREATE);
674 
675 	if (pe.pe_set_event & PTRACE_LWP_EXIT)
676 		SET(t->p_slflag, PSL_TRACELWP_EXIT);
677 	else
678 		CLR(t->p_slflag, PSL_TRACELWP_EXIT);
679 
680 	if (pe.pe_set_event & PTRACE_POSIX_SPAWN)
681 		SET(t->p_slflag, PSL_TRACEPOSIX_SPAWN);
682 	else
683 		CLR(t->p_slflag, PSL_TRACEPOSIX_SPAWN);
684 
685 	return 0;
686 }
687 
688 static int
689 ptrace_get_process_state(struct proc *t, void *addr, size_t data)
690 {
691 	struct ptrace_state ps;
692 
693 	if (data != sizeof(ps)) {
694 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(ps)));
695 		return EINVAL;
696 	}
697 	memset(&ps, 0, sizeof(ps));
698 
699 	if (t->p_fpid) {
700 		ps.pe_report_event = PTRACE_FORK;
701 		ps.pe_other_pid = t->p_fpid;
702 	} else if (t->p_vfpid) {
703 		ps.pe_report_event = PTRACE_VFORK;
704 		ps.pe_other_pid = t->p_vfpid;
705 	} else if (t->p_vfpid_done) {
706 		ps.pe_report_event = PTRACE_VFORK_DONE;
707 		ps.pe_other_pid = t->p_vfpid_done;
708 	} else if (t->p_lwp_created) {
709 		ps.pe_report_event = PTRACE_LWP_CREATE;
710 		ps.pe_lwp = t->p_lwp_created;
711 	} else if (t->p_lwp_exited) {
712 		ps.pe_report_event = PTRACE_LWP_EXIT;
713 		ps.pe_lwp = t->p_lwp_exited;
714 	} else if (t->p_pspid) {
715 		ps.pe_report_event = PTRACE_POSIX_SPAWN;
716 		ps.pe_other_pid = t->p_pspid;
717 	}
718 	DPRINTF(("%s: lwp=%d event=%#x pid=%d lwp=%d\n", __func__,
719 	    t->p_sigctx.ps_lwp, ps.pe_report_event,
720 	    ps.pe_other_pid, ps.pe_lwp));
721 	return copyout(&ps, addr, sizeof(ps));
722 }
723 
724 static int
725 ptrace_lwpinfo(struct proc *t, struct lwp **lt, void *addr, size_t data)
726 {
727 	struct ptrace_lwpinfo pl;
728 
729 	if (data != sizeof(pl)) {
730 		DPRINTF(("%s: %zu != %zu\n", __func__, data, sizeof(pl)));
731 		return EINVAL;
732 	}
733 	int error = copyin(addr, &pl, sizeof(pl));
734 	if (error)
735 		return error;
736 
737 	lwpid_t tmp = pl.pl_lwpid;
738 	lwp_delref(*lt);
739 	mutex_enter(t->p_lock);
740 	if (tmp == 0)
741 		*lt = lwp_find_first(t);
742 	else {
743 		*lt = lwp_find(t, tmp);
744 		if (*lt == NULL) {
745 			mutex_exit(t->p_lock);
746 			return ESRCH;
747 		}
748 		*lt = LIST_NEXT(*lt, l_sibling);
749 	}
750 
751 	while (*lt != NULL && !lwp_alive(*lt))
752 		*lt = LIST_NEXT(*lt, l_sibling);
753 
754 	pl.pl_lwpid = 0;
755 	pl.pl_event = 0;
756 	if (*lt) {
757 		lwp_addref(*lt);
758 		pl.pl_lwpid = (*lt)->l_lid;
759 
760 		if ((*lt)->l_flag & LW_WSUSPEND)
761 			pl.pl_event = PL_EVENT_SUSPENDED;
762 		/*
763 		 * If we match the lwp, or it was sent to every lwp,
764 		 * we set PL_EVENT_SIGNAL.
765 		 * XXX: ps_lwp == 0 means everyone and noone, so
766 		 * check ps_signo too.
767 		 */
768 		else if ((*lt)->l_lid == t->p_sigctx.ps_lwp
769 			 || (t->p_sigctx.ps_lwp == 0 &&
770 			     t->p_sigctx.ps_info._signo)) {
771 			DPRINTF(("%s: lwp=%d siglwp=%d signo %d\n", __func__,
772 			    pl.pl_lwpid, t->p_sigctx.ps_lwp,
773 			    t->p_sigctx.ps_info._signo));
774 			pl.pl_event = PL_EVENT_SIGNAL;
775 		}
776 	}
777 	mutex_exit(t->p_lock);
778 	DPRINTF(("%s: lwp=%d event=%#x\n", __func__,
779 	    pl.pl_lwpid, pl.pl_event));
780 
781 	return copyout(&pl, addr, sizeof(pl));
782 }
783 
784 static int
785 ptrace_startstop(struct proc *t, struct lwp **lt, int rq, void *addr,
786     size_t data)
787 {
788 	int error;
789 
790 	if ((error = ptrace_update_lwp(t, lt, data)) != 0)
791 		return error;
792 
793 	DPRINTF(("%s: lwp=%d request=%d\n", __func__, (*lt)->l_lid, rq));
794 	lwp_lock(*lt);
795 	if (rq == PT_SUSPEND)
796 		(*lt)->l_flag |= LW_WSUSPEND;
797 	else
798 		(*lt)->l_flag &= ~LW_WSUSPEND;
799 	lwp_unlock(*lt);
800 	return 0;
801 }
802 
803 #ifdef PT_REGISTERS
804 static int
805 ptrace_uio_dir(int req)
806 {
807 	switch (req) {
808 	case_PT_GETREGS
809 	case_PT_GETFPREGS
810 	case_PT_GETDBREGS
811 		return UIO_READ;
812 	case_PT_SETREGS
813 	case_PT_SETFPREGS
814 	case_PT_SETDBREGS
815 		return UIO_WRITE;
816 	default:
817 		return -1;
818 	}
819 }
820 
821 static int
822 ptrace_regs(struct lwp *l, struct lwp **lt, int rq, struct ptrace_methods *ptm,
823     void *addr, size_t data)
824 {
825 	int error;
826 	struct proc *t = (*lt)->l_proc;
827 	struct vmspace *vm;
828 
829 	if ((error = ptrace_update_lwp(t, lt, data)) != 0)
830 		return error;
831 
832 	int dir = ptrace_uio_dir(rq);
833 	size_t size;
834 	int (*func)(struct lwp *, struct lwp *, struct uio *);
835 
836 	DPRINTF(("%s: lwp=%d request=%d\n", __func__, l->l_lid, rq));
837 
838 	switch (rq) {
839 #if defined(PT_SETREGS) || defined(PT_GETREGS)
840 	case_PT_GETREGS
841 	case_PT_SETREGS
842 		if (!process_validregs(*lt))
843 			return EINVAL;
844 		size = PROC_REGSZ(t);
845 		func = ptm->ptm_doregs;
846 		break;
847 #endif
848 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
849 	case_PT_GETFPREGS
850 	case_PT_SETFPREGS
851 		if (!process_validfpregs(*lt))
852 			return EINVAL;
853 		size = PROC_FPREGSZ(t);
854 		func = ptm->ptm_dofpregs;
855 		break;
856 #endif
857 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
858 	case_PT_GETDBREGS
859 	case_PT_SETDBREGS
860 		if (!process_validdbregs(*lt))
861 			return EINVAL;
862 		size = PROC_DBREGSZ(t);
863 		func = ptm->ptm_dodbregs;
864 		break;
865 #endif
866 	default:
867 		return EINVAL;
868 	}
869 
870 	error = proc_vmspace_getref(l->l_proc, &vm);
871 	if (error)
872 		return error;
873 
874 	struct uio uio;
875 	struct iovec iov;
876 
877 	iov.iov_base = addr;
878 	iov.iov_len = size;
879 	uio.uio_iov = &iov;
880 	uio.uio_iovcnt = 1;
881 	uio.uio_offset = 0;
882 	uio.uio_resid = iov.iov_len;
883 	uio.uio_rw = dir;
884 	uio.uio_vmspace = vm;
885 
886 	error = (*func)(l, *lt, &uio);
887 	uvmspace_free(vm);
888 	return error;
889 }
890 #endif
891 
892 static int
893 ptrace_sendsig(struct proc *t, struct lwp *lt, int signo, int resume_all)
894 {
895 	ksiginfo_t ksi;
896 
897 	t->p_fpid = 0;
898 	t->p_vfpid = 0;
899 	t->p_vfpid_done = 0;
900 	t->p_lwp_created = 0;
901 	t->p_lwp_exited = 0;
902 	t->p_pspid = 0;
903 
904 	/* Finally, deliver the requested signal (or none). */
905 	if (t->p_stat == SSTOP) {
906 		/*
907 		 * Unstop the process.  If it needs to take a
908 		 * signal, make all efforts to ensure that at
909 		 * an LWP runs to see it.
910 		 */
911 		t->p_xsig = signo;
912 
913 		/*
914 		 * signo > 0 check prevents a potential panic, as
915 		 * sigismember(&...,0) is invalid check and signo
916 		 * can be equal to 0 as a special case of no-signal.
917 		 */
918 		if (signo > 0 && sigismember(&stopsigmask, signo)) {
919 			t->p_waited = 0;
920 			child_psignal(t, 0);
921 		} else if (resume_all)
922 			proc_unstop(t);
923 		else
924 			lwp_unstop(lt);
925 		return 0;
926 	}
927 
928 	KSI_INIT_EMPTY(&ksi);
929 	if (t->p_sigctx.ps_faked) {
930 		if (signo != t->p_sigctx.ps_info._signo)
931 			return EINVAL;
932 		t->p_sigctx.ps_faked = false;
933 		ksi.ksi_info = t->p_sigctx.ps_info;
934 		ksi.ksi_lid = t->p_sigctx.ps_lwp;
935 	} else if (signo == 0) {
936 		return 0;
937 	} else {
938 		ksi.ksi_signo = signo;
939 	}
940 	DPRINTF(("%s: pid=%d.%d signal=%d resume_all=%d\n", __func__, t->p_pid,
941 	    t->p_sigctx.ps_lwp, signo, resume_all));
942 
943 	kpsignal2(t, &ksi);
944 	return 0;
945 }
946 
947 static int
948 ptrace_dumpcore(struct lwp *lt, char *path, size_t len)
949 {
950 	int error;
951 	if (path != NULL) {
952 
953 		if (len >= MAXPATHLEN)
954 			return EINVAL;
955 
956 		char *src = path;
957 		path = kmem_alloc(len + 1, KM_SLEEP);
958 		error = copyin(src, path, len);
959 		if (error)
960 			goto out;
961 		path[len] = '\0';
962 	}
963 	DPRINTF(("%s: lwp=%d\n", __func__, lt->l_lid));
964 	error = (*coredump_vec)(lt, path);
965 out:
966 	if (path)
967 		kmem_free(path, len + 1);
968 	return error;
969 }
970 
971 static int
972 ptrace_doio(struct lwp *l, struct proc *t, struct lwp *lt,
973     struct ptrace_io_desc *piod, void *addr, bool sysspace)
974 {
975 	struct uio uio;
976 	struct iovec iov;
977 	int error, tmp;
978 
979 	error = 0;
980 	iov.iov_base = piod->piod_addr;
981 	iov.iov_len = piod->piod_len;
982 	uio.uio_iov = &iov;
983 	uio.uio_iovcnt = 1;
984 	uio.uio_offset = (off_t)(unsigned long)piod->piod_offs;
985 	uio.uio_resid = piod->piod_len;
986 
987 	DPRINTF(("%s: lwp=%d request=%d\n", __func__, l->l_lid, piod->piod_op));
988 
989 	switch (piod->piod_op) {
990 	case PIOD_READ_D:
991 	case PIOD_READ_I:
992 		uio.uio_rw = UIO_READ;
993 		break;
994 	case PIOD_WRITE_D:
995 	case PIOD_WRITE_I:
996 		/*
997 		 * Can't write to a RAS
998 		 */
999 		if (ras_lookup(t, addr) != (void *)-1) {
1000 			return EACCES;
1001 		}
1002 		uio.uio_rw = UIO_WRITE;
1003 		break;
1004 	case PIOD_READ_AUXV:
1005 		uio.uio_rw = UIO_READ;
1006 		tmp = t->p_execsw->es_arglen;
1007 		if (uio.uio_offset > tmp)
1008 			return EIO;
1009 		if (uio.uio_resid > tmp - uio.uio_offset)
1010 			uio.uio_resid = tmp - uio.uio_offset;
1011 		piod->piod_len = iov.iov_len = uio.uio_resid;
1012 		error = process_auxv_offset(t, &uio);
1013 		break;
1014 	default:
1015 		error = EINVAL;
1016 		break;
1017 	}
1018 
1019 	if (error)
1020 		return error;
1021 
1022 	if (sysspace) {
1023 		uio.uio_vmspace = vmspace_kernel();
1024 	} else {
1025 		error = proc_vmspace_getref(l->l_proc, &uio.uio_vmspace);
1026 		if (error)
1027 			return error;
1028 	}
1029 
1030 	error = process_domem(l, lt, &uio);
1031 	if (!sysspace)
1032 		uvmspace_free(uio.uio_vmspace);
1033 	if (error)
1034 		return error;
1035 	piod->piod_len -= uio.uio_resid;
1036 	return 0;
1037 }
1038 
1039 int
1040 do_ptrace(struct ptrace_methods *ptm, struct lwp *l, int req, pid_t pid,
1041     void *addr, int data, register_t *retval)
1042 {
1043 	struct proc *p = l->l_proc;
1044 	struct lwp *lt = NULL;
1045 	struct lwp *lt2;
1046 	struct proc *t;				/* target process */
1047 	struct ptrace_io_desc piod;
1048 	int error, write, tmp, pheld;
1049 	int signo = 0;
1050 	int resume_all;
1051 	bool locked;
1052 	error = 0;
1053 
1054 	/*
1055 	 * If attaching or detaching, we need to get a write hold on the
1056 	 * proclist lock so that we can re-parent the target process.
1057 	 */
1058 	mutex_enter(proc_lock);
1059 
1060 	t = ptrace_find(l, req, pid);
1061 	if (t == NULL) {
1062 		mutex_exit(proc_lock);
1063 		return ESRCH;
1064 	}
1065 
1066 	pheld = 1;
1067 	if ((error = ptrace_allowed(l, req, t, p, &locked)) != 0)
1068 		goto out;
1069 
1070 	if ((error = kauth_authorize_process(l->l_cred,
1071 	    KAUTH_PROCESS_PTRACE, t, KAUTH_ARG(req), NULL, NULL)) != 0)
1072 		goto out;
1073 
1074 	if ((lt = lwp_find_first(t)) == NULL) {
1075 	    error = ESRCH;
1076 	    goto out;
1077 	}
1078 
1079 	/* Do single-step fixup if needed. */
1080 	FIX_SSTEP(t);
1081 	KASSERT(lt != NULL);
1082 	lwp_addref(lt);
1083 
1084 	/*
1085 	 * Which locks do we need held? XXX Ugly.
1086 	 */
1087 	if ((pheld = ptrace_needs_hold(req)) == 0) {
1088 		mutex_exit(t->p_lock);
1089 		mutex_exit(proc_lock);
1090 	}
1091 
1092 	/* Now do the operation. */
1093 	write = 0;
1094 	*retval = 0;
1095 	tmp = 0;
1096 	resume_all = 1;
1097 
1098 	switch (req) {
1099 	case PT_TRACE_ME:
1100 		/* Just set the trace flag. */
1101 		SET(t->p_slflag, PSL_TRACED);
1102 		t->p_opptr = t->p_pptr;
1103 		break;
1104 
1105 	/*
1106 	 * The I and D separate address space has been inherited from PDP-11.
1107 	 * The 16-bit UNIX started with a single address space per program,
1108 	 * but was extended to two 16-bit (2 x 64kb) address spaces.
1109 	 *
1110 	 * We no longer maintain this feature in maintained architectures, but
1111 	 * we keep the API for backward compatiblity. Currently the I and D
1112 	 * operations are exactly the same and not distinguished in debuggers.
1113 	 */
1114 	case PT_WRITE_I:
1115 	case PT_WRITE_D:
1116 		write = 1;
1117 		tmp = data;
1118 		/* FALLTHROUGH */
1119 	case PT_READ_I:
1120 	case PT_READ_D:
1121 		piod.piod_addr = &tmp;
1122 		piod.piod_len = sizeof(tmp);
1123 		piod.piod_offs = addr;
1124 		piod.piod_op = write ? PIOD_WRITE_D : PIOD_READ_D;
1125 		if ((error = ptrace_doio(l, t, lt, &piod, addr, true)) != 0)
1126 			break;
1127 		/*
1128 		 * For legacy reasons we treat here two results as success:
1129 		 *  - incomplete transfer  piod.piod_len < sizeof(tmp)
1130 		 *  - no transfer          piod.piod_len == 0
1131 		 *
1132 		 * This means that there is no way to determine whether
1133 		 * transfer operation was performed in PT_WRITE and PT_READ
1134 		 * calls.
1135 		 */
1136 		if (!write)
1137 			*retval = tmp;
1138 		break;
1139 
1140 	case PT_IO:
1141 		if ((error = ptm->ptm_copyin_piod(&piod, addr, data)) != 0)
1142 			break;
1143 		if (piod.piod_len < 1) {
1144 			error = EINVAL;
1145 			break;
1146 		}
1147 		if ((error = ptrace_doio(l, t, lt, &piod, addr, false)) != 0)
1148 			break;
1149 		/*
1150 		 * For legacy reasons we treat here two results as success:
1151 		 *  - incomplete transfer  piod.piod_len < sizeof(tmp)
1152 		 *  - no transfer          piod.piod_len == 0
1153 		 */
1154 		error = ptm->ptm_copyout_piod(&piod, addr, data);
1155 		break;
1156 
1157 	case PT_DUMPCORE:
1158 		error = ptrace_dumpcore(lt, addr, data);
1159 		break;
1160 
1161 #ifdef PT_STEP
1162 	case PT_STEP:
1163 		/*
1164 		 * From the 4.4BSD PRM:
1165 		 * "Execution continues as in request PT_CONTINUE; however
1166 		 * as soon as possible after execution of at least one
1167 		 * instruction, execution stops again. [ ... ]"
1168 		 */
1169 #endif
1170 	case PT_CONTINUE:
1171 	case PT_SYSCALL:
1172 	case PT_DETACH:
1173 		if (req == PT_SYSCALL) {
1174 			if (!ISSET(t->p_slflag, PSL_SYSCALL)) {
1175 				SET(t->p_slflag, PSL_SYSCALL);
1176 #ifdef __HAVE_SYSCALL_INTERN
1177 				(*t->p_emul->e_syscall_intern)(t);
1178 #endif
1179 			}
1180 		} else {
1181 			if (ISSET(t->p_slflag, PSL_SYSCALL)) {
1182 				CLR(t->p_slflag, PSL_SYSCALL);
1183 #ifdef __HAVE_SYSCALL_INTERN
1184 				(*t->p_emul->e_syscall_intern)(t);
1185 #endif
1186 			}
1187 		}
1188 		t->p_trace_enabled = trace_is_enabled(t);
1189 
1190 		/*
1191 		 * Pick up the LWPID, if supplied.  There are two cases:
1192 		 * data < 0 : step or continue single thread, lwp = -data
1193 		 * data > 0 in PT_STEP : step this thread, continue others
1194 		 * For operations other than PT_STEP, data > 0 means
1195 		 * data is the signo to deliver to the process.
1196 		 */
1197 		tmp = data;
1198 		if (tmp >= 0) {
1199 #ifdef PT_STEP
1200 			if (req == PT_STEP)
1201 				signo = 0;
1202 			else
1203 #endif
1204 			{
1205 				signo = tmp;
1206 				tmp = 0;	/* don't search for LWP */
1207 			}
1208 		} else
1209 			tmp = -tmp;
1210 
1211 		if (tmp > 0) {
1212 			if (req == PT_DETACH) {
1213 				error = EINVAL;
1214 				break;
1215 			}
1216 			lwp_delref2 (lt);
1217 			lt = lwp_find(t, tmp);
1218 			if (lt == NULL) {
1219 				error = ESRCH;
1220 				break;
1221 			}
1222 			lwp_addref(lt);
1223 			resume_all = 0;
1224 			signo = 0;
1225 		}
1226 
1227 		/*
1228 		 * From the 4.4BSD PRM:
1229 		 * "The data argument is taken as a signal number and the
1230 		 * child's execution continues at location addr as if it
1231 		 * incurred that signal.  Normally the signal number will
1232 		 * be either 0 to indicate that the signal that caused the
1233 		 * stop should be ignored, or that value fetched out of
1234 		 * the process's image indicating which signal caused
1235 		 * the stop.  If addr is (int *)1 then execution continues
1236 		 * from where it stopped."
1237 		 */
1238 
1239 		/* Check that the data is a valid signal number or zero. */
1240 		if (signo < 0 || signo >= NSIG) {
1241 			error = EINVAL;
1242 			break;
1243 		}
1244 
1245 		/* Prevent process deadlock */
1246 		if (resume_all) {
1247 #ifdef PT_STEP
1248 			if (req == PT_STEP) {
1249 				if (lt->l_flag & LW_WSUSPEND) {
1250 					error = EDEADLK;
1251 					break;
1252 				}
1253 			} else
1254 #endif
1255 			{
1256 				error = EDEADLK;
1257 				LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
1258 					if ((lt2->l_flag & LW_WSUSPEND) == 0) {
1259 						error = 0;
1260 						break;
1261 					}
1262 				}
1263 				if (error != 0)
1264 					break;
1265 			}
1266 		} else {
1267 			if (lt->l_flag & LW_WSUSPEND) {
1268 				error = EDEADLK;
1269 				break;
1270 			}
1271 		}
1272 
1273 		/*
1274 		 * Reject setting program cunter to 0x0 if VA0 is disabled.
1275 		 *
1276 		 * Not all kernels implement this feature to set Program
1277 		 * Counter in one go in PT_CONTINUE and similar operations.
1278 		 * This causes portability issues as passing address 0x0
1279 		 * on these kernels is no-operation, but can cause failure
1280 		 * in most cases on NetBSD.
1281 		 */
1282 		if (user_va0_disable && addr == 0) {
1283 			error = EINVAL;
1284 			break;
1285 		}
1286 
1287 		/* If the address parameter is not (int *)1, set the pc. */
1288 		if ((int *)addr != (int *)1) {
1289 			error = process_set_pc(lt, addr);
1290 			if (error != 0)
1291 				break;
1292 		}
1293 #ifdef PT_STEP
1294 		/*
1295 		 * Arrange for a single-step, if that's requested and possible.
1296 		 * More precisely, set the single step status as requested for
1297 		 * the requested thread, and clear it for other threads.
1298 		 */
1299 		LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
1300 			if (ISSET(lt2->l_pflag, LP_SINGLESTEP)) {
1301 				lwp_lock(lt2);
1302 				process_sstep(lt2, 1);
1303 				lwp_unlock(lt2);
1304 			} else if (lt != lt2) {
1305 				lwp_lock(lt2);
1306 				process_sstep(lt2, 0);
1307 				lwp_unlock(lt2);
1308 			}
1309 		}
1310 		error = process_sstep(lt,
1311 		    ISSET(lt->l_pflag, LP_SINGLESTEP) || req == PT_STEP);
1312 		if (error)
1313 			break;
1314 #endif
1315 		if (req == PT_DETACH) {
1316 			CLR(t->p_slflag, PSL_TRACED|PSL_SYSCALL);
1317 
1318 			/* give process back to original parent or init */
1319 			if (t->p_opptr != t->p_pptr) {
1320 				struct proc *pp = t->p_opptr;
1321 				proc_reparent(t, pp ? pp : initproc);
1322 			}
1323 
1324 			/* not being traced any more */
1325 			t->p_opptr = NULL;
1326 
1327 			/* clear single step */
1328 			LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
1329 				CLR(lt2->l_pflag, LP_SINGLESTEP);
1330 			}
1331 			CLR(lt->l_pflag, LP_SINGLESTEP);
1332 		}
1333 	sendsig:
1334 		error = ptrace_sendsig(t, lt, signo, resume_all);
1335 		break;
1336 
1337 	case PT_SYSCALLEMU:
1338 		if (!ISSET(t->p_slflag, PSL_SYSCALL) || t->p_stat != SSTOP) {
1339 			error = EINVAL;
1340 			break;
1341 		}
1342 		SET(t->p_slflag, PSL_SYSCALLEMU);
1343 		break;
1344 
1345 #ifdef PT_STEP
1346 	case PT_SETSTEP:
1347 		write = 1;
1348 
1349 		/* FALLTHROUGH */
1350 	case PT_CLEARSTEP:
1351 		/* write = 0 done above. */
1352 		if ((error = ptrace_update_lwp(t, &lt, data)) != 0)
1353 			break;
1354 
1355 		if (write)
1356 			SET(lt->l_pflag, LP_SINGLESTEP);
1357 		else
1358 			CLR(lt->l_pflag, LP_SINGLESTEP);
1359 		break;
1360 #endif
1361 
1362 	case PT_KILL:
1363 		/* just send the process a KILL signal. */
1364 		signo = SIGKILL;
1365 		goto sendsig;	/* in PT_CONTINUE, above. */
1366 
1367 	case PT_ATTACH:
1368 		/*
1369 		 * Go ahead and set the trace flag.
1370 		 * Save the old parent (it's reset in
1371 		 *   _DETACH, and also in kern_exit.c:wait4()
1372 		 * Reparent the process so that the tracing
1373 		 *   proc gets to see all the action.
1374 		 * Stop the target.
1375 		 */
1376 		proc_changeparent(t, p);
1377 		signo = SIGSTOP;
1378 		goto sendsig;
1379 
1380 	case PT_GET_EVENT_MASK:
1381 		error = ptrace_get_event_mask(t, addr, data);
1382 		break;
1383 
1384 	case PT_SET_EVENT_MASK:
1385 		error = ptrace_set_event_mask(t, addr, data);
1386 		break;
1387 
1388 	case PT_GET_PROCESS_STATE:
1389 		error = ptrace_get_process_state(t, addr, data);
1390 		break;
1391 
1392 	case PT_LWPINFO:
1393 		error = ptrace_lwpinfo(t, &lt, addr, data);
1394 		break;
1395 
1396 	case PT_SET_SIGINFO:
1397 		error = ptrace_set_siginfo(t, &lt, ptm, addr, data);
1398 		break;
1399 
1400 	case PT_GET_SIGINFO:
1401 		error = ptrace_get_siginfo(t, ptm, addr, data);
1402 		break;
1403 
1404 	case PT_RESUME:
1405 	case PT_SUSPEND:
1406 		error = ptrace_startstop(t, &lt, req, addr, data);
1407 		break;
1408 
1409 #ifdef PT_REGISTERS
1410 	case_PT_SETREGS
1411 	case_PT_GETREGS
1412 	case_PT_SETFPREGS
1413 	case_PT_GETFPREGS
1414 	case_PT_SETDBREGS
1415 	case_PT_GETDBREGS
1416 		error = ptrace_regs(l, &lt, req, ptm, addr, data);
1417 		break;
1418 #endif
1419 
1420 #ifdef __HAVE_PTRACE_MACHDEP
1421 	PTRACE_MACHDEP_REQUEST_CASES
1422 		error = ptrace_machdep_dorequest(l, lt, req, addr, data);
1423 		break;
1424 #endif
1425 	}
1426 
1427 out:
1428 	if (pheld) {
1429 		mutex_exit(t->p_lock);
1430 		mutex_exit(proc_lock);
1431 	}
1432 	if (lt != NULL)
1433 		lwp_delref(lt);
1434 	if (locked)
1435 		rw_exit(&t->p_reflock);
1436 
1437 	return error;
1438 }
1439 
1440 typedef int (*regrfunc_t)(struct lwp *, void *, size_t *);
1441 typedef int (*regwfunc_t)(struct lwp *, void *, size_t);
1442 
1443 #ifdef PT_REGISTERS
1444 static int
1445 proc_regio(struct lwp *l, struct uio *uio, size_t ks, regrfunc_t r,
1446     regwfunc_t w)
1447 {
1448 	char buf[1024];
1449 	int error;
1450 	char *kv;
1451 	size_t kl;
1452 
1453 	if (ks > sizeof(buf))
1454 		return E2BIG;
1455 
1456 	if (uio->uio_offset < 0 || uio->uio_offset > (off_t)ks)
1457 		return EINVAL;
1458 
1459 	kv = buf + uio->uio_offset;
1460 	kl = ks - uio->uio_offset;
1461 
1462 	if (kl > uio->uio_resid)
1463 		kl = uio->uio_resid;
1464 
1465 	error = (*r)(l, buf, &ks);
1466 	if (error == 0)
1467 		error = uiomove(kv, kl, uio);
1468 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
1469 		if (l->l_stat != LSSTOP)
1470 			error = EBUSY;
1471 		else
1472 			error = (*w)(l, buf, ks);
1473 	}
1474 
1475 	uio->uio_offset = 0;
1476 	return error;
1477 }
1478 #endif
1479 
1480 int
1481 process_doregs(struct lwp *curl /*tracer*/,
1482     struct lwp *l /*traced*/,
1483     struct uio *uio)
1484 {
1485 #if defined(PT_GETREGS) || defined(PT_SETREGS)
1486 	size_t s;
1487 	regrfunc_t r;
1488 	regwfunc_t w;
1489 
1490 #ifdef COMPAT_NETBSD32
1491 	const bool pk32 = (curl->l_proc->p_flag & PK_32) != 0;
1492 
1493 	if (__predict_false(pk32)) {
1494 		if ((l->l_proc->p_flag & PK_32) == 0) {
1495 			// 32 bit tracer can't trace 64 bit process
1496 			return EINVAL;
1497 		}
1498 		s = sizeof(process_reg32);
1499 		r = (regrfunc_t)process_read_regs32;
1500 		w = (regwfunc_t)process_write_regs32;
1501 	} else
1502 #endif
1503 	{
1504 		s = sizeof(struct reg);
1505 		r = (regrfunc_t)process_read_regs;
1506 		w = (regwfunc_t)process_write_regs;
1507 	}
1508 	return proc_regio(l, uio, s, r, w);
1509 #else
1510 	return EINVAL;
1511 #endif
1512 }
1513 
1514 int
1515 process_validregs(struct lwp *l)
1516 {
1517 
1518 #if defined(PT_SETREGS) || defined(PT_GETREGS)
1519 	return (l->l_flag & LW_SYSTEM) == 0;
1520 #else
1521 	return 0;
1522 #endif
1523 }
1524 
1525 int
1526 process_dofpregs(struct lwp *curl /*tracer*/,
1527     struct lwp *l /*traced*/,
1528     struct uio *uio)
1529 {
1530 #if defined(PT_GETFPREGS) || defined(PT_SETFPREGS)
1531 	size_t s;
1532 	regrfunc_t r;
1533 	regwfunc_t w;
1534 
1535 #ifdef COMPAT_NETBSD32
1536 	const bool pk32 = (curl->l_proc->p_flag & PK_32) != 0;
1537 
1538 	if (__predict_false(pk32)) {
1539 		if ((l->l_proc->p_flag & PK_32) == 0) {
1540 			// 32 bit tracer can't trace 64 bit process
1541 			return EINVAL;
1542 		}
1543 		s = sizeof(process_fpreg32);
1544 		r = (regrfunc_t)process_read_fpregs32;
1545 		w = (regwfunc_t)process_write_fpregs32;
1546 	} else
1547 #endif
1548 	{
1549 		s = sizeof(struct fpreg);
1550 		r = (regrfunc_t)process_read_fpregs;
1551 		w = (regwfunc_t)process_write_fpregs;
1552 	}
1553 	return proc_regio(l, uio, s, r, w);
1554 #else
1555 	return EINVAL;
1556 #endif
1557 }
1558 
1559 int
1560 process_validfpregs(struct lwp *l)
1561 {
1562 
1563 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
1564 	return (l->l_flag & LW_SYSTEM) == 0;
1565 #else
1566 	return 0;
1567 #endif
1568 }
1569 
1570 int
1571 process_dodbregs(struct lwp *curl /*tracer*/,
1572     struct lwp *l /*traced*/,
1573     struct uio *uio)
1574 {
1575 #if defined(PT_GETDBREGS) || defined(PT_SETDBREGS)
1576 	size_t s;
1577 	regrfunc_t r;
1578 	regwfunc_t w;
1579 
1580 #ifdef COMPAT_NETBSD32
1581 	const bool pk32 = (curl->l_proc->p_flag & PK_32) != 0;
1582 
1583 	if (__predict_false(pk32)) {
1584 		if ((l->l_proc->p_flag & PK_32) == 0) {
1585 			// 32 bit tracer can't trace 64 bit process
1586 			return EINVAL;
1587 		}
1588 		s = sizeof(process_dbreg32);
1589 		r = (regrfunc_t)process_read_dbregs32;
1590 		w = (regwfunc_t)process_write_dbregs32;
1591 	} else
1592 #endif
1593 	{
1594 		s = sizeof(struct dbreg);
1595 		r = (regrfunc_t)process_read_dbregs;
1596 		w = (regwfunc_t)process_write_dbregs;
1597 	}
1598 	return proc_regio(l, uio, s, r, w);
1599 #else
1600 	return EINVAL;
1601 #endif
1602 }
1603 
1604 int
1605 process_validdbregs(struct lwp *l)
1606 {
1607 
1608 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
1609 	return (l->l_flag & LW_SYSTEM) == 0;
1610 #else
1611 	return 0;
1612 #endif
1613 }
1614 
1615 static int
1616 process_auxv_offset(struct proc *p, struct uio *uio)
1617 {
1618 	struct ps_strings pss;
1619 	int error;
1620 	off_t off = (off_t)p->p_psstrp;
1621 
1622 	if ((error = copyin_psstrings(p, &pss)) != 0)
1623 		return error;
1624 
1625 	if (pss.ps_envstr == NULL)
1626 		return EIO;
1627 
1628 	uio->uio_offset += (off_t)(vaddr_t)(pss.ps_envstr + pss.ps_nenvstr + 1);
1629 #ifdef __MACHINE_STACK_GROWS_UP
1630 	if (uio->uio_offset < off)
1631 		return EIO;
1632 #else
1633 	if (uio->uio_offset > off)
1634 		return EIO;
1635 	if ((uio->uio_offset + uio->uio_resid) > off)
1636 		uio->uio_resid = off - uio->uio_offset;
1637 #endif
1638 	return 0;
1639 }
1640 #endif /* PTRACE */
1641 
1642 MODULE(MODULE_CLASS_EXEC, ptrace_common, NULL);
1643 
1644 static int
1645 ptrace_common_modcmd(modcmd_t cmd, void *arg)
1646 {
1647         int error;
1648 
1649         switch (cmd) {
1650         case MODULE_CMD_INIT:
1651                 error = ptrace_init();
1652                 break;
1653         case MODULE_CMD_FINI:
1654                 error = ptrace_fini();
1655                 break;
1656         default:
1657 		ptrace_hooks();
1658                 error = ENOTTY;
1659                 break;
1660         }
1661         return error;
1662 }
1663