xref: /openbsd-src/sys/kern/sys_process.c (revision aa997e528a848ca5596493c2a801bdd6fb26ae61)
1 /*	$OpenBSD: sys_process.c,v 1.80 2018/02/19 09:25:13 mpi Exp $	*/
2 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
3 
4 /*-
5  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
6  * Copyright (c) 1982, 1986, 1989, 1993
7  *	The Regents of the University of California.  All rights reserved.
8  * (c) UNIX System Laboratories, Inc.
9  * All or some portions of this file are derived from material licensed
10  * to the University of California by American Telephone and Telegraph
11  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12  * the permission of UNIX System Laboratories, Inc.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
39  */
40 
41 /*
42  * References:
43  *	(1) Bach's "The Design of the UNIX Operating System",
44  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
45  *	(3) the "4.4BSD Programmer's Reference Manual" published
46  *		by USENIX and O'Reilly & Associates.
47  * The 4.4BSD PRM does a reasonably good job of documenting what the various
48  * ptrace() requests should actually do, and its text is quoted several times
49  * in this file.
50  */
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/exec.h>
55 #include <sys/proc.h>
56 #include <sys/signalvar.h>
57 #include <sys/errno.h>
58 #include <sys/malloc.h>
59 #include <sys/ptrace.h>
60 #include <sys/uio.h>
61 #include <sys/sched.h>
62 
63 #include <sys/mount.h>
64 #include <sys/syscallargs.h>
65 
66 #include <uvm/uvm_extern.h>
67 
68 #include <machine/reg.h>
69 
70 #ifdef PTRACE
71 
72 static inline int	process_checktracestate(struct process *_curpr,
73 			    struct process *_tr, struct proc *_t);
74 static inline struct process *process_tprfind(pid_t _tpid, struct proc **_tp);
75 
76 int	ptrace_ctrl(struct proc *, int, pid_t, caddr_t, int);
77 int	ptrace_ustate(struct proc *, int, pid_t, void *, int, register_t *);
78 int	ptrace_kstate(struct proc *, int, pid_t, void *);
79 int	process_auxv_offset(struct proc *, struct process *, struct uio *);
80 
81 int	global_ptrace;	/* permit tracing of not children */
82 
83 
84 /*
85  * Process debugging system call.
86  */
87 int
88 sys_ptrace(struct proc *p, void *v, register_t *retval)
89 {
90 	struct sys_ptrace_args /* {
91 		syscallarg(int) req;
92 		syscallarg(pid_t) pid;
93 		syscallarg(caddr_t) addr;
94 		syscallarg(int) data;
95 	} */ *uap = v;
96 	int req = SCARG(uap, req);
97 	pid_t pid = SCARG(uap, pid);
98 	caddr_t uaddr = SCARG(uap, addr);	/* userspace */
99 	void *kaddr = NULL;			/* kernelspace */
100 	int data = SCARG(uap, data);
101 	union {
102 		struct ptrace_thread_state u_pts;
103 		struct ptrace_io_desc u_piod;
104 		struct ptrace_event u_pe;
105 		struct ptrace_state u_ps;
106 		register_t u_wcookie;
107 	} u;
108 	int size = 0;
109 	enum { NONE, IN, IN_ALLOC, OUT, OUT_ALLOC, IN_OUT } mode;
110 	int kstate = 0;
111 	int error;
112 
113 	*retval = 0;
114 
115 	/* Figure out what sort of copyin/out operations we'll do */
116 	switch (req) {
117 	case PT_TRACE_ME:
118 	case PT_CONTINUE:
119 	case PT_KILL:
120 	case PT_ATTACH:
121 	case PT_DETACH:
122 #ifdef PT_STEP
123 	case PT_STEP:
124 #endif
125 		/* control operations do no copyin/out; dispatch directly */
126 		return ptrace_ctrl(p, req, pid, uaddr, data);
127 
128 	case PT_READ_I:
129 	case PT_READ_D:
130 	case PT_WRITE_I:
131 	case PT_WRITE_D:
132 		mode = NONE;
133 		break;
134 	case PT_IO:
135 		mode = IN_OUT;
136 		size = sizeof u.u_piod;
137 		data = size;	/* suppress the data == size check */
138 		break;
139 	case PT_GET_THREAD_FIRST:
140 		mode = OUT;
141 		size = sizeof u.u_pts;
142 		kstate = 1;
143 		break;
144 	case PT_GET_THREAD_NEXT:
145 		mode = IN_OUT;
146 		size = sizeof u.u_pts;
147 		kstate = 1;
148 		break;
149 	case PT_GET_EVENT_MASK:
150 		mode = OUT;
151 		size = sizeof u.u_pe;
152 		kstate = 1;
153 		break;
154 	case PT_SET_EVENT_MASK:
155 		mode = IN;
156 		size = sizeof u.u_pe;
157 		kstate = 1;
158 		break;
159 	case PT_GET_PROCESS_STATE:
160 		mode = OUT;
161 		size = sizeof u.u_ps;
162 		kstate = 1;
163 		break;
164 	case PT_GETREGS:
165 		mode = OUT_ALLOC;
166 		size = sizeof(struct reg);
167 		break;
168 	case PT_SETREGS:
169 		mode = IN_ALLOC;
170 		size = sizeof(struct reg);
171 		break;
172 #ifdef PT_GETFPREGS
173 	case PT_GETFPREGS:
174 		mode = OUT_ALLOC;
175 		size = sizeof(struct fpreg);
176 		break;
177 #endif
178 #ifdef PT_SETFPREGS
179 	case PT_SETFPREGS:
180 		mode = IN_ALLOC;
181 		size = sizeof(struct fpreg);
182 		break;
183 #endif
184 #ifdef PT_GETXMMREGS
185 	case PT_GETXMMREGS:
186 		mode = OUT_ALLOC;
187 		size = sizeof(struct xmmregs);
188 		break;
189 #endif
190 #ifdef PT_SETXMMREGS
191 	case PT_SETXMMREGS:
192 		mode = IN_ALLOC;
193 		size = sizeof(struct xmmregs);
194 		break;
195 #endif
196 #ifdef PT_WCOOKIE
197 	case PT_WCOOKIE:
198 		mode = OUT;
199 		size = sizeof u.u_wcookie;
200 		data = size;	/* suppress the data == size check */
201 		break;
202 #endif
203 	default:
204 		return EINVAL;
205 	}
206 
207 
208 	/* Now do any copyin()s and allocations in a consistent manner */
209 	switch (mode) {
210 	case NONE:
211 		kaddr = uaddr;
212 		break;
213 	case IN:
214 	case IN_OUT:
215 	case OUT:
216 		KASSERT(size <= sizeof u);
217 		if (data != size)
218 			return EINVAL;
219 		if (mode == OUT)
220 			memset(&u, 0, size);
221 		else { /* IN or IN_OUT */
222 			if ((error = copyin(uaddr, &u, size)))
223 				return error;
224 		}
225 		kaddr = &u;
226 		break;
227 	case IN_ALLOC:
228 		kaddr = malloc(size, M_TEMP, M_WAITOK);
229 		if ((error = copyin(uaddr, kaddr, size))) {
230 			free(kaddr, M_TEMP, size);
231 			return error;
232 		}
233 		break;
234 	case OUT_ALLOC:
235 		kaddr = malloc(size, M_TEMP, M_WAITOK | M_ZERO);
236 		break;
237 	}
238 
239 	if (kstate)
240 		error = ptrace_kstate(p, req, pid, kaddr);
241 	else
242 		error = ptrace_ustate(p, req, pid, kaddr, data, retval);
243 
244 	/* Do any copyout()s and frees */
245 	if (error == 0) {
246 		switch (mode) {
247 		case NONE:
248 		case IN:
249 		case IN_ALLOC:
250 			break;
251 		case IN_OUT:
252 		case OUT:
253 			error = copyout(&u, uaddr, size);
254 			if (req == PT_IO) {
255 				/* historically, errors here are ignored */
256 				error = 0;
257 			}
258 			break;
259 		case OUT_ALLOC:
260 			error = copyout(kaddr, uaddr, size);
261 			break;
262 		}
263 	}
264 
265 	if (mode == IN_ALLOC || mode == OUT_ALLOC)
266 		free(kaddr, M_TEMP, size);
267 	return error;
268 }
269 
270 /*
271  * ptrace control requests: attach, detach, continue, kill, single-step, etc
272  */
273 int
274 ptrace_ctrl(struct proc *p, int req, pid_t pid, caddr_t addr, int data)
275 {
276 	struct proc *t;				/* target thread */
277 	struct process *tr;			/* target process */
278 	int error = 0;
279 	int s;
280 
281 	switch (req) {
282 	case PT_TRACE_ME:
283 		/* Just set the trace flag. */
284 		tr = p->p_p;
285 		atomic_setbits_int(&tr->ps_flags, PS_TRACED);
286 		tr->ps_oppid = tr->ps_pptr->ps_pid;
287 		if (tr->ps_ptstat == NULL)
288 			tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat),
289 			    M_SUBPROC, M_WAITOK);
290 		memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat));
291 		return 0;
292 
293 	/* calls that only operate on the PID */
294 	case PT_KILL:
295 	case PT_ATTACH:
296 	case PT_DETACH:
297 		/* Find the process we're supposed to be operating on. */
298 		if ((tr = prfind(pid)) == NULL) {
299 			error = ESRCH;
300 			goto fail;
301 		}
302 		t = TAILQ_FIRST(&tr->ps_threads);
303 		break;
304 
305 	/* calls that accept a PID or a thread ID */
306 	case PT_CONTINUE:
307 #ifdef PT_STEP
308 	case PT_STEP:
309 #endif
310 		if ((tr = process_tprfind(pid, &t)) == NULL) {
311 			error = ESRCH;
312 			goto fail;
313 		}
314 		break;
315 	}
316 
317 	/* Check permissions/state */
318 	if (req != PT_ATTACH) {
319 		/* Check that the data is a valid signal number or zero. */
320 		if (req != PT_KILL && (data < 0 || data >= NSIG)) {
321 			error = EINVAL;
322 			goto fail;
323 		}
324 
325 		/* Most operations require the target to already be traced */
326 		if ((error = process_checktracestate(p->p_p, tr, t)))
327 			goto fail;
328 
329 		/* Do single-step fixup if needed. */
330 		FIX_SSTEP(t);
331 	} else {
332 		/*
333 		 * PT_ATTACH is the opposite; you can't attach to a process if:
334 		 *	(1) it's the process that's doing the attaching,
335 		 */
336 		if (tr == p->p_p) {
337 			error = EINVAL;
338 			goto fail;
339 		}
340 
341 		/*
342 		 *	(2) it's a system process
343 		 */
344 		if (ISSET(tr->ps_flags, PS_SYSTEM)) {
345 			error = EPERM;
346 			goto fail;
347 		}
348 
349 		/*
350 		 *	(3) it's already being traced, or
351 		 */
352 		if (ISSET(tr->ps_flags, PS_TRACED)) {
353 			error = EBUSY;
354 			goto fail;
355 		}
356 
357 		/*
358 		 *	(4) it's in the middle of execve(2)
359 		 */
360 		if (ISSET(tr->ps_flags, PS_INEXEC)) {
361 			error = EAGAIN;
362 			goto fail;
363 		}
364 
365 		/*
366 		 *	(5) it's not owned by you, or the last exec
367 		 *	    gave us setuid/setgid privs (unless
368 		 *	    you're root), or...
369 		 *
370 		 *      [Note: once PS_SUGID or PS_SUGIDEXEC gets set in
371 		 *	execve(), they stay set until the process does
372 		 *	another execve().  Hence this prevents a setuid
373 		 *	process which revokes its special privileges using
374 		 *	setuid() from being traced.  This is good security.]
375 		 */
376 		if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid ||
377 		    ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)) &&
378 		    (error = suser(p)) != 0)
379 			goto fail;
380 
381 		/*
382 		 * 	(5.5) it's not a child of the tracing process.
383 		 */
384 		if (global_ptrace == 0 && !inferior(tr, p->p_p) &&
385 		    (error = suser(p)) != 0)
386 			goto fail;
387 
388 		/*
389 		 *	(6) ...it's init, which controls the security level
390 		 *	    of the entire system, and the system was not
391 		 *          compiled with permanently insecure mode turned
392 		 *	    on.
393 		 */
394 		if ((tr->ps_pid == 1) && (securelevel > -1)) {
395 			error = EPERM;
396 			goto fail;
397 		}
398 
399 		/*
400 		 *	(7) it's an ancestor of the current process and
401 		 *	    not init (because that would create a loop in
402 		 *	    the process graph).
403 		 */
404 		if (tr->ps_pid != 1 && inferior(p->p_p, tr)) {
405 			error = EINVAL;
406 			goto fail;
407 		}
408 	}
409 
410 	switch (req) {
411 
412 #ifdef PT_STEP
413 	case PT_STEP:
414 		/*
415 		 * From the 4.4BSD PRM:
416 		 * "Execution continues as in request PT_CONTINUE; however
417 		 * as soon as possible after execution of at least one
418 		 * instruction, execution stops again. [ ... ]"
419 		 */
420 #endif
421 	case PT_CONTINUE:
422 		/*
423 		 * From the 4.4BSD PRM:
424 		 * "The data argument is taken as a signal number and the
425 		 * child's execution continues at location addr as if it
426 		 * incurred that signal.  Normally the signal number will
427 		 * be either 0 to indicate that the signal that caused the
428 		 * stop should be ignored, or that value fetched out of
429 		 * the process's image indicating which signal caused
430 		 * the stop.  If addr is (int *)1 then execution continues
431 		 * from where it stopped."
432 		 */
433 
434 		if (pid < THREAD_PID_OFFSET && tr->ps_single)
435 			t = tr->ps_single;
436 
437 		/* If the address parameter is not (int *)1, set the pc. */
438 		if ((int *)addr != (int *)1)
439 			if ((error = process_set_pc(t, addr)) != 0)
440 				goto fail;
441 
442 #ifdef PT_STEP
443 		/*
444 		 * Arrange for a single-step, if that's requested and possible.
445 		 */
446 		error = process_sstep(t, req == PT_STEP);
447 		if (error)
448 			goto fail;
449 #endif
450 		goto sendsig;
451 
452 	case PT_DETACH:
453 		/*
454 		 * From the 4.4BSD PRM:
455 		 * "The data argument is taken as a signal number and the
456 		 * child's execution continues at location addr as if it
457 		 * incurred that signal.  Normally the signal number will
458 		 * be either 0 to indicate that the signal that caused the
459 		 * stop should be ignored, or that value fetched out of
460 		 * the process's image indicating which signal caused
461 		 * the stop.  If addr is (int *)1 then execution continues
462 		 * from where it stopped."
463 		 */
464 
465 		if (pid < THREAD_PID_OFFSET && tr->ps_single)
466 			t = tr->ps_single;
467 
468 #ifdef PT_STEP
469 		/*
470 		 * Stop single stepping.
471 		 */
472 		error = process_sstep(t, 0);
473 		if (error)
474 			goto fail;
475 #endif
476 
477 		/* give process back to original parent or init */
478 		if (tr->ps_oppid != tr->ps_pptr->ps_pid) {
479 			struct process *ppr;
480 
481 			ppr = prfind(tr->ps_oppid);
482 			proc_reparent(tr, ppr ? ppr : initprocess);
483 		}
484 
485 		/* not being traced any more */
486 		tr->ps_oppid = 0;
487 		atomic_clearbits_int(&tr->ps_flags, PS_TRACED|PS_WAITED);
488 
489 	sendsig:
490 		memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat));
491 
492 		/* Finally, deliver the requested signal (or none). */
493 		if (t->p_stat == SSTOP) {
494 			t->p_xstat = data;
495 			SCHED_LOCK(s);
496 			setrunnable(t);
497 			SCHED_UNLOCK(s);
498 		} else {
499 			if (data != 0)
500 				psignal(t, data);
501 		}
502 		break;
503 
504 	case PT_KILL:
505 		if (pid < THREAD_PID_OFFSET && tr->ps_single)
506 			t = tr->ps_single;
507 
508 		/* just send the process a KILL signal. */
509 		data = SIGKILL;
510 		goto sendsig;	/* in PT_CONTINUE, above. */
511 
512 	case PT_ATTACH:
513 		/*
514 		 * As was done in procfs:
515 		 * Go ahead and set the trace flag.
516 		 * Save the old parent (it's reset in
517 		 *   _DETACH, and also in kern_exit.c:wait4()
518 		 * Reparent the process so that the tracing
519 		 *   proc gets to see all the action.
520 		 * Stop the target.
521 		 */
522 		atomic_setbits_int(&tr->ps_flags, PS_TRACED);
523 		tr->ps_oppid = tr->ps_pptr->ps_pid;
524 		if (tr->ps_pptr != p->p_p)
525 			proc_reparent(tr, p->p_p);
526 		if (tr->ps_ptstat == NULL)
527 			tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat),
528 			    M_SUBPROC, M_WAITOK);
529 		data = SIGSTOP;
530 		goto sendsig;
531 	default:
532 		KASSERTMSG(0, "%s: unhandled request %d", __func__, req);
533 		break;
534 	}
535 
536 fail:
537 	return error;
538 }
539 
540 /*
541  * ptrace kernel-state requests: thread list, event mask, process state
542  */
543 int
544 ptrace_kstate(struct proc *p, int req, pid_t pid, void *addr)
545 {
546 	struct process *tr;			/* target process */
547 	struct ptrace_event *pe = addr;
548 	int error;
549 
550 	KASSERT((p->p_flag & P_SYSTEM) == 0);
551 
552 	/* Find the process we're supposed to be operating on. */
553 	if ((tr = prfind(pid)) == NULL)
554 		return ESRCH;
555 
556 	if ((error = process_checktracestate(p->p_p, tr, NULL)))
557 		return error;
558 
559 	switch (req) {
560 	case PT_GET_THREAD_FIRST:
561 	case PT_GET_THREAD_NEXT:
562 	      {
563 		struct ptrace_thread_state *pts = addr;
564 		struct proc *t;
565 
566 		if (req == PT_GET_THREAD_NEXT) {
567 			t = tfind(pts->pts_tid - THREAD_PID_OFFSET);
568 			if (t == NULL || ISSET(t->p_flag, P_WEXIT))
569 				return ESRCH;
570 			if (t->p_p != tr)
571 				return EINVAL;
572 			t = TAILQ_NEXT(t, p_thr_link);
573 		} else {
574 			t = TAILQ_FIRST(&tr->ps_threads);
575 		}
576 
577 		if (t == NULL)
578 			pts->pts_tid = -1;
579 		else
580 			pts->pts_tid = t->p_tid + THREAD_PID_OFFSET;
581 		return 0;
582 	      }
583 	}
584 
585 	switch (req) {
586 	case PT_GET_EVENT_MASK:
587 		pe->pe_set_event = tr->ps_ptmask;
588 		break;
589 	case PT_SET_EVENT_MASK:
590 		tr->ps_ptmask = pe->pe_set_event;
591 		break;
592 	case PT_GET_PROCESS_STATE:
593 		if (tr->ps_single)
594 			tr->ps_ptstat->pe_tid =
595 			    tr->ps_single->p_tid + THREAD_PID_OFFSET;
596 		memcpy(addr, tr->ps_ptstat, sizeof *tr->ps_ptstat);
597 		break;
598 	default:
599 		KASSERTMSG(0, "%s: unhandled request %d", __func__, req);
600 		break;
601 	}
602 
603 	return 0;
604 }
605 
606 /*
607  * ptrace user-state requests: memory access, registers, stack cookie
608  */
609 int
610 ptrace_ustate(struct proc *p, int req, pid_t pid, void *addr, int data,
611     register_t *retval)
612 {
613 	struct proc *t;				/* target thread */
614 	struct process *tr;			/* target process */
615 	struct uio uio;
616 	struct iovec iov;
617 	int error, write;
618 	int temp = 0;
619 
620 	KASSERT((p->p_flag & P_SYSTEM) == 0);
621 
622 	/* Accept either PID or TID */
623 	if ((tr = process_tprfind(pid, &t)) == NULL)
624 		return ESRCH;
625 
626 	if ((error = process_checktracestate(p->p_p, tr, t)))
627 		return error;
628 
629 	FIX_SSTEP(t);
630 
631 	/* Now do the operation. */
632 	write = 0;
633 
634 	if ((error = process_checkioperm(p, tr)) != 0)
635 		return error;
636 
637 	switch (req) {
638 	case PT_WRITE_I:		/* XXX no separate I and D spaces */
639 	case PT_WRITE_D:
640 		write = 1;
641 		temp = data;
642 	case PT_READ_I:		/* XXX no separate I and D spaces */
643 	case PT_READ_D:
644 		/* write = 0 done above. */
645 		iov.iov_base = (caddr_t)&temp;
646 		iov.iov_len = sizeof(int);
647 		uio.uio_iov = &iov;
648 		uio.uio_iovcnt = 1;
649 		uio.uio_offset = (off_t)(vaddr_t)addr;
650 		uio.uio_resid = sizeof(int);
651 		uio.uio_segflg = UIO_SYSSPACE;
652 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
653 		uio.uio_procp = p;
654 		error = process_domem(p, tr, &uio, write ? PT_WRITE_I :
655 				PT_READ_I);
656 		if (write == 0)
657 			*retval = temp;
658 		return error;
659 
660 	case PT_IO:
661 	      {
662 		struct ptrace_io_desc *piod = addr;
663 
664 		iov.iov_base = piod->piod_addr;
665 		iov.iov_len = piod->piod_len;
666 		uio.uio_iov = &iov;
667 		uio.uio_iovcnt = 1;
668 		uio.uio_offset = (off_t)(vaddr_t)piod->piod_offs;
669 		uio.uio_resid = piod->piod_len;
670 		uio.uio_segflg = UIO_USERSPACE;
671 		uio.uio_procp = p;
672 		switch (piod->piod_op) {
673 		case PIOD_READ_I:
674 			req = PT_READ_I;
675 			uio.uio_rw = UIO_READ;
676 			break;
677 		case PIOD_READ_D:
678 			req = PT_READ_D;
679 			uio.uio_rw = UIO_READ;
680 			break;
681 		case PIOD_WRITE_I:
682 			req = PT_WRITE_I;
683 			uio.uio_rw = UIO_WRITE;
684 			break;
685 		case PIOD_WRITE_D:
686 			req = PT_WRITE_D;
687 			uio.uio_rw = UIO_WRITE;
688 			break;
689 		case PIOD_READ_AUXV:
690 			req = PT_READ_D;
691 			uio.uio_rw = UIO_READ;
692 			temp = tr->ps_emul->e_arglen * sizeof(char *);
693 			if (uio.uio_offset > temp)
694 				return EIO;
695 			if (uio.uio_resid > temp - uio.uio_offset)
696 				uio.uio_resid = temp - uio.uio_offset;
697 			piod->piod_len = iov.iov_len = uio.uio_resid;
698 			error = process_auxv_offset(p, tr, &uio);
699 			if (error)
700 				return error;
701 			break;
702 		default:
703 			return EINVAL;
704 		}
705 		error = process_domem(p, tr, &uio, req);
706 		piod->piod_len -= uio.uio_resid;
707 		return error;
708 	      }
709 
710 	case PT_SETREGS:
711 		return process_write_regs(t, addr);
712 	case PT_GETREGS:
713 		return process_read_regs(t, addr);
714 
715 #ifdef PT_SETFPREGS
716 	case PT_SETFPREGS:
717 		return process_write_fpregs(t, addr);
718 #endif
719 #ifdef PT_SETFPREGS
720 	case PT_GETFPREGS:
721 		return process_read_fpregs(t, addr);
722 #endif
723 #ifdef PT_SETXMMREGS
724 	case PT_SETXMMREGS:
725 		return process_write_xmmregs(t, addr);
726 #endif
727 #ifdef PT_SETXMMREGS
728 	case PT_GETXMMREGS:
729 		return process_read_xmmregs(t, addr);
730 #endif
731 #ifdef PT_WCOOKIE
732 	case PT_WCOOKIE:
733 		*(register_t *)addr = process_get_wcookie(t);
734 		return 0;
735 #endif
736 	default:
737 		KASSERTMSG(0, "%s: unhandled request %d", __func__, req);
738 		break;
739 	}
740 
741 	return 0;
742 }
743 
744 
745 /*
746  * Helper for doing "it could be a PID or TID" lookup.  On failure
747  * returns NULL; on success returns the selected process and sets *tp
748  * to an appropriate thread in that process.
749  */
750 static inline struct process *
751 process_tprfind(pid_t tpid, struct proc **tp)
752 {
753 	if (tpid > THREAD_PID_OFFSET) {
754 		struct proc *t = tfind(tpid - THREAD_PID_OFFSET);
755 
756 		if (t == NULL)
757 			return NULL;
758 		*tp = t;
759 		return t->p_p;
760 	} else {
761 		struct process *tr = prfind(tpid);
762 
763 		if (tr == NULL)
764 			return NULL;
765 		*tp = TAILQ_FIRST(&tr->ps_threads);
766 		return tr;
767 	}
768 }
769 
770 
771 /*
772  * Check whether 'tr' is currently traced by 'curpr' and in a state
773  * to be manipulated.  If 't' is supplied then it must be stopped and
774  * waited for.
775  */
776 static inline int
777 process_checktracestate(struct process *curpr, struct process *tr,
778     struct proc *t)
779 {
780 	/*
781 	 * You can't do what you want to the process if:
782 	 *	(1) It's not being traced at all,
783 	 */
784 	if (!ISSET(tr->ps_flags, PS_TRACED))
785 		return EPERM;
786 
787 	/*
788 	 *	(2) it's not being traced by _you_, or
789 	 */
790 	if (tr->ps_pptr != curpr)
791 		return EBUSY;
792 
793 	/*
794 	 *	(3) it's in the middle of execve(2)
795 	 */
796 	if (ISSET(tr->ps_flags, PS_INEXEC))
797 		return EAGAIN;
798 
799 	/*
800 	 *	(4) if a thread was specified and it's not currently stopped.
801 	 */
802 	if (t != NULL &&
803 	    (t->p_stat != SSTOP || !ISSET(tr->ps_flags, PS_WAITED)))
804 		return EBUSY;
805 
806 	return 0;
807 }
808 
809 
810 /*
811  * Check if a process is allowed to fiddle with the memory of another.
812  *
813  * p = tracer
814  * tr = tracee
815  *
816  * 1.  You can't attach to a process not owned by you or one that has raised
817  *     its privileges.
818  * 1a. ...unless you are root.
819  *
820  * 2.  init is always off-limits because it can control the securelevel.
821  * 2a. ...unless securelevel is permanently set to insecure.
822  *
823  * 3.  Processes that are in the process of doing an exec() are always
824  *     off-limits because of the can of worms they are. Just wait a
825  *     second.
826  */
827 int
828 process_checkioperm(struct proc *p, struct process *tr)
829 {
830 	int error;
831 
832 	if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid ||
833 	    ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)) &&
834 	    (error = suser(p)) != 0)
835 		return (error);
836 
837 	if ((tr->ps_pid == 1) && (securelevel > -1))
838 		return (EPERM);
839 
840 	if (ISSET(tr->ps_flags, PS_INEXEC))
841 		return (EAGAIN);
842 
843 	return (0);
844 }
845 
846 int
847 process_domem(struct proc *curp, struct process *tr, struct uio *uio, int req)
848 {
849 	struct vmspace *vm;
850 	int error;
851 	vaddr_t addr;
852 	vsize_t len;
853 
854 	len = uio->uio_resid;
855 	if (len == 0)
856 		return 0;
857 
858 	if ((error = process_checkioperm(curp, tr)) != 0)
859 		return error;
860 
861 	/* XXXCDC: how should locking work here? */
862 	vm = tr->ps_vmspace;
863 	if ((tr->ps_flags & PS_EXITING) || (vm->vm_refcnt < 1))
864 		return EFAULT;
865 	addr = uio->uio_offset;
866 
867 	vm->vm_refcnt++;
868 
869 	error = uvm_io(&vm->vm_map, uio,
870 	    (uio->uio_rw == UIO_WRITE) ? UVM_IO_FIXPROT : 0);
871 
872 	uvmspace_free(vm);
873 
874 	if (error == 0 && req == PT_WRITE_I)
875 		pmap_proc_iflush(tr, addr, len);
876 
877 	return error;
878 }
879 
880 int
881 process_auxv_offset(struct proc *curp, struct process *tr, struct uio *uiop)
882 {
883 	struct vmspace *vm;
884 	struct ps_strings pss;
885 	struct iovec iov;
886 	struct uio uio;
887 	int error;
888 
889 	iov.iov_base = &pss;
890 	iov.iov_len = sizeof(pss);
891 	uio.uio_iov = &iov;
892 	uio.uio_iovcnt = 1;
893 	uio.uio_offset = (off_t)tr->ps_strings;
894 	uio.uio_resid = sizeof(pss);
895 	uio.uio_segflg = UIO_SYSSPACE;
896 	uio.uio_rw = UIO_READ;
897 	uio.uio_procp = curp;
898 
899 	vm = tr->ps_vmspace;
900 	if ((tr->ps_flags & PS_EXITING) || (vm->vm_refcnt < 1))
901 		return EFAULT;
902 
903 	vm->vm_refcnt++;
904 	error = uvm_io(&vm->vm_map, &uio, 0);
905 	uvmspace_free(vm);
906 
907 	if (error != 0)
908 		return error;
909 
910 	if (pss.ps_envstr == NULL)
911 		return EIO;
912 
913 	uiop->uio_offset += (off_t)(vaddr_t)(pss.ps_envstr + pss.ps_nenvstr + 1);
914 #ifdef MACHINE_STACK_GROWS_UP
915 	if (uiop->uio_offset < (off_t)tr->ps_strings)
916 		return EIO;
917 #else
918 	if (uiop->uio_offset > (off_t)tr->ps_strings)
919 		return EIO;
920 	if ((uiop->uio_offset + uiop->uio_resid) > (off_t)tr->ps_strings)
921 		uiop->uio_resid = (off_t)tr->ps_strings - uiop->uio_offset;
922 #endif
923 
924 	return 0;
925 }
926 #endif
927