xref: /openbsd-src/sys/kern/sys_process.c (revision fc8189afa39060e6bb13a79179b6d727d5d040a4)
1 /*	$OpenBSD: sys_process.c,v 1.97 2024/04/02 08:27:22 deraadt Exp $	*/
2 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
3 
4 /*-
5  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
6  * Copyright (c) 1982, 1986, 1989, 1993
7  *	The Regents of the University of California.  All rights reserved.
8  * (c) UNIX System Laboratories, Inc.
9  * All or some portions of this file are derived from material licensed
10  * to the University of California by American Telephone and Telegraph
11  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
12  * the permission of UNIX System Laboratories, Inc.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  *
38  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
39  */
40 
41 /*
42  * References:
43  *	(1) Bach's "The Design of the UNIX Operating System",
44  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
45  *	(3) the "4.4BSD Programmer's Reference Manual" published
46  *		by USENIX and O'Reilly & Associates.
47  * The 4.4BSD PRM does a reasonably good job of documenting what the various
48  * ptrace() requests should actually do, and its text is quoted several times
49  * in this file.
50  */
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/exec.h>
55 #include <sys/proc.h>
56 #include <sys/signalvar.h>
57 #include <sys/errno.h>
58 #include <sys/malloc.h>
59 #include <sys/ptrace.h>
60 #include <sys/uio.h>
61 #include <sys/sched.h>
62 #include <sys/exec_elf.h>
63 
64 #include <sys/mount.h>
65 #include <sys/syscallargs.h>
66 
67 #include <uvm/uvm_extern.h>
68 
69 #include <machine/reg.h>
70 
71 #ifdef PTRACE
72 
73 static inline int	process_checktracestate(struct process *_curpr,
74 			    struct process *_tr, struct proc *_t);
75 static inline struct process *process_tprfind(pid_t _tpid, struct proc **_tp);
76 
77 int	ptrace_ctrl(struct proc *, int, pid_t, caddr_t, int);
78 int	ptrace_ustate(struct proc *, int, pid_t, void *, int, register_t *);
79 int	ptrace_kstate(struct proc *, int, pid_t, void *);
80 
81 int	global_ptrace;	/* permit tracing of not children */
82 
83 
84 /*
85  * Process debugging system call.
86  */
87 int
88 sys_ptrace(struct proc *p, void *v, register_t *retval)
89 {
90 	struct sys_ptrace_args /* {
91 		syscallarg(int) req;
92 		syscallarg(pid_t) pid;
93 		syscallarg(caddr_t) addr;
94 		syscallarg(int) data;
95 	} */ *uap = v;
96 	int req = SCARG(uap, req);
97 	pid_t pid = SCARG(uap, pid);
98 	caddr_t uaddr = SCARG(uap, addr);	/* userspace */
99 	void *kaddr = NULL;			/* kernelspace */
100 	int data = SCARG(uap, data);
101 	union {
102 		struct ptrace_thread_state u_pts;
103 		struct ptrace_io_desc u_piod;
104 		struct ptrace_event u_pe;
105 		struct ptrace_state u_ps;
106 		register_t u_wcookie;
107 		register_t u_pacmask[2];
108 	} u;
109 	int size = 0;
110 	enum { NONE, IN, IN_ALLOC, OUT, OUT_ALLOC, IN_OUT } mode;
111 	int kstate = 0;
112 	int error;
113 
114 	*retval = 0;
115 
116 	/* Figure out what sort of copyin/out operations we'll do */
117 	switch (req) {
118 	case PT_TRACE_ME:
119 	case PT_CONTINUE:
120 	case PT_KILL:
121 	case PT_ATTACH:
122 	case PT_DETACH:
123 #ifdef PT_STEP
124 	case PT_STEP:
125 #endif
126 		/* control operations do no copyin/out; dispatch directly */
127 		return ptrace_ctrl(p, req, pid, uaddr, data);
128 
129 	case PT_READ_I:
130 	case PT_READ_D:
131 	case PT_WRITE_I:
132 	case PT_WRITE_D:
133 		mode = NONE;
134 		break;
135 	case PT_IO:
136 		mode = IN_OUT;
137 		size = sizeof u.u_piod;
138 		data = size;	/* suppress the data == size check */
139 		break;
140 	case PT_GET_THREAD_FIRST:
141 		mode = OUT;
142 		size = sizeof u.u_pts;
143 		kstate = 1;
144 		break;
145 	case PT_GET_THREAD_NEXT:
146 		mode = IN_OUT;
147 		size = sizeof u.u_pts;
148 		kstate = 1;
149 		break;
150 	case PT_GET_EVENT_MASK:
151 		mode = OUT;
152 		size = sizeof u.u_pe;
153 		kstate = 1;
154 		break;
155 	case PT_SET_EVENT_MASK:
156 		mode = IN;
157 		size = sizeof u.u_pe;
158 		kstate = 1;
159 		break;
160 	case PT_GET_PROCESS_STATE:
161 		mode = OUT;
162 		size = sizeof u.u_ps;
163 		kstate = 1;
164 		break;
165 	case PT_GETREGS:
166 		mode = OUT_ALLOC;
167 		size = sizeof(struct reg);
168 		break;
169 	case PT_SETREGS:
170 		mode = IN_ALLOC;
171 		size = sizeof(struct reg);
172 		break;
173 #ifdef PT_GETFPREGS
174 	case PT_GETFPREGS:
175 		mode = OUT_ALLOC;
176 		size = sizeof(struct fpreg);
177 		break;
178 #endif
179 #ifdef PT_SETFPREGS
180 	case PT_SETFPREGS:
181 		mode = IN_ALLOC;
182 		size = sizeof(struct fpreg);
183 		break;
184 #endif
185 #ifdef PT_GETXMMREGS
186 	case PT_GETXMMREGS:
187 		mode = OUT_ALLOC;
188 		size = sizeof(struct xmmregs);
189 		break;
190 #endif
191 #ifdef PT_SETXMMREGS
192 	case PT_SETXMMREGS:
193 		mode = IN_ALLOC;
194 		size = sizeof(struct xmmregs);
195 		break;
196 #endif
197 #ifdef PT_WCOOKIE
198 	case PT_WCOOKIE:
199 		mode = OUT;
200 		size = sizeof u.u_wcookie;
201 		data = size;	/* suppress the data == size check */
202 		break;
203 #endif
204 #ifdef PT_PACMASK
205 	case PT_PACMASK:
206 		mode = OUT;
207 		size = sizeof u.u_pacmask;
208 		break;
209 #endif
210 	default:
211 		return EINVAL;
212 	}
213 
214 
215 	/* Now do any copyin()s and allocations in a consistent manner */
216 	switch (mode) {
217 	case NONE:
218 		kaddr = uaddr;
219 		break;
220 	case IN:
221 	case IN_OUT:
222 	case OUT:
223 		KASSERT(size <= sizeof u);
224 		if (data != size)
225 			return EINVAL;
226 		if (mode == OUT)
227 			memset(&u, 0, size);
228 		else { /* IN or IN_OUT */
229 			if ((error = copyin(uaddr, &u, size)))
230 				return error;
231 		}
232 		kaddr = &u;
233 		break;
234 	case IN_ALLOC:
235 		kaddr = malloc(size, M_TEMP, M_WAITOK);
236 		if ((error = copyin(uaddr, kaddr, size))) {
237 			free(kaddr, M_TEMP, size);
238 			return error;
239 		}
240 		break;
241 	case OUT_ALLOC:
242 		kaddr = malloc(size, M_TEMP, M_WAITOK | M_ZERO);
243 		break;
244 	}
245 
246 	if (kstate)
247 		error = ptrace_kstate(p, req, pid, kaddr);
248 	else
249 		error = ptrace_ustate(p, req, pid, kaddr, data, retval);
250 
251 	/* Do any copyout()s and frees */
252 	if (error == 0) {
253 		switch (mode) {
254 		case NONE:
255 		case IN:
256 		case IN_ALLOC:
257 			break;
258 		case IN_OUT:
259 		case OUT:
260 			error = copyout(&u, uaddr, size);
261 			if (req == PT_IO) {
262 				/* historically, errors here are ignored */
263 				error = 0;
264 			}
265 			break;
266 		case OUT_ALLOC:
267 			error = copyout(kaddr, uaddr, size);
268 			break;
269 		}
270 	}
271 
272 	if (mode == IN_ALLOC || mode == OUT_ALLOC)
273 		free(kaddr, M_TEMP, size);
274 	return error;
275 }
276 
277 /*
278  * ptrace control requests: attach, detach, continue, kill, single-step, etc
279  */
280 int
281 ptrace_ctrl(struct proc *p, int req, pid_t pid, caddr_t addr, int data)
282 {
283 	struct proc *t;				/* target thread */
284 	struct process *tr;			/* target process */
285 	int error = 0;
286 	int s;
287 
288 	switch (req) {
289 	case PT_TRACE_ME:
290 		/* Just set the trace flag. */
291 		tr = p->p_p;
292 		if (ISSET(tr->ps_flags, PS_TRACED))
293 			return EBUSY;
294 		atomic_setbits_int(&tr->ps_flags, PS_TRACED);
295 		tr->ps_oppid = tr->ps_pptr->ps_pid;
296 		if (tr->ps_ptstat == NULL)
297 			tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat),
298 			    M_SUBPROC, M_WAITOK);
299 		memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat));
300 		return 0;
301 
302 	/* calls that only operate on the PID */
303 	case PT_KILL:
304 	case PT_ATTACH:
305 	case PT_DETACH:
306 		/* Find the process we're supposed to be operating on. */
307 		if ((tr = prfind(pid)) == NULL) {
308 			error = ESRCH;
309 			goto fail;
310 		}
311 		t = TAILQ_FIRST(&tr->ps_threads);
312 		break;
313 
314 	/* calls that accept a PID or a thread ID */
315 	case PT_CONTINUE:
316 #ifdef PT_STEP
317 	case PT_STEP:
318 #endif
319 		if ((tr = process_tprfind(pid, &t)) == NULL) {
320 			error = ESRCH;
321 			goto fail;
322 		}
323 		break;
324 	}
325 
326 	/* Check permissions/state */
327 	if (req != PT_ATTACH) {
328 		/* Check that the data is a valid signal number or zero. */
329 		if (req != PT_KILL && (data < 0 || data >= NSIG)) {
330 			error = EINVAL;
331 			goto fail;
332 		}
333 
334 		/* Most operations require the target to already be traced */
335 		if ((error = process_checktracestate(p->p_p, tr, t)))
336 			goto fail;
337 
338 		/* Do single-step fixup if needed. */
339 		FIX_SSTEP(t);
340 	} else {
341 		/*
342 		 * PT_ATTACH is the opposite; you can't attach to a process if:
343 		 *	(1) it's the process that's doing the attaching,
344 		 */
345 		if (tr == p->p_p) {
346 			error = EINVAL;
347 			goto fail;
348 		}
349 
350 		/*
351 		 *	(2) it's a system process
352 		 */
353 		if (ISSET(tr->ps_flags, PS_SYSTEM)) {
354 			error = EPERM;
355 			goto fail;
356 		}
357 
358 		/*
359 		 *	(3) it's already being traced, or
360 		 */
361 		if (ISSET(tr->ps_flags, PS_TRACED)) {
362 			error = EBUSY;
363 			goto fail;
364 		}
365 
366 		/*
367 		 *	(4) it's in the middle of execve(2)
368 		 */
369 		if (ISSET(tr->ps_flags, PS_INEXEC)) {
370 			error = EAGAIN;
371 			goto fail;
372 		}
373 
374 		/*
375 		 *	(5) it's not owned by you, or the last exec
376 		 *	    gave us setuid/setgid privs (unless
377 		 *	    you're root), or...
378 		 *
379 		 *      [Note: once PS_SUGID or PS_SUGIDEXEC gets set in
380 		 *	execve(), they stay set until the process does
381 		 *	another execve().  Hence this prevents a setuid
382 		 *	process which revokes its special privileges using
383 		 *	setuid() from being traced.  This is good security.]
384 		 */
385 		if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid ||
386 		    ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)) &&
387 		    (error = suser(p)) != 0)
388 			goto fail;
389 
390 		/*
391 		 * 	(5.5) it's not a child of the tracing process.
392 		 */
393 		if (global_ptrace == 0 && !inferior(tr, p->p_p) &&
394 		    (error = suser(p)) != 0)
395 			goto fail;
396 
397 		/*
398 		 *	(6) ...it's init, which controls the security level
399 		 *	    of the entire system, and the system was not
400 		 *          compiled with permanently insecure mode turned
401 		 *	    on.
402 		 */
403 		if ((tr->ps_pid == 1) && (securelevel > -1)) {
404 			error = EPERM;
405 			goto fail;
406 		}
407 
408 		/*
409 		 *	(7) it's an ancestor of the current process and
410 		 *	    not init (because that would create a loop in
411 		 *	    the process graph).
412 		 */
413 		if (tr->ps_pid != 1 && inferior(p->p_p, tr)) {
414 			error = EINVAL;
415 			goto fail;
416 		}
417 	}
418 
419 	switch (req) {
420 
421 #ifdef PT_STEP
422 	case PT_STEP:
423 		/*
424 		 * From the 4.4BSD PRM:
425 		 * "Execution continues as in request PT_CONTINUE; however
426 		 * as soon as possible after execution of at least one
427 		 * instruction, execution stops again. [ ... ]"
428 		 */
429 #endif
430 	case PT_CONTINUE:
431 		/*
432 		 * From the 4.4BSD PRM:
433 		 * "The data argument is taken as a signal number and the
434 		 * child's execution continues at location addr as if it
435 		 * incurred that signal.  Normally the signal number will
436 		 * be either 0 to indicate that the signal that caused the
437 		 * stop should be ignored, or that value fetched out of
438 		 * the process's image indicating which signal caused
439 		 * the stop.  If addr is (int *)1 then execution continues
440 		 * from where it stopped."
441 		 */
442 
443 		if (pid < THREAD_PID_OFFSET && tr->ps_single)
444 			t = tr->ps_single;
445 
446 		/* If the address parameter is not (int *)1, set the pc. */
447 		if ((int *)addr != (int *)1)
448 			if ((error = process_set_pc(t, addr)) != 0)
449 				goto fail;
450 
451 #ifdef PT_STEP
452 		/*
453 		 * Arrange for a single-step, if that's requested and possible.
454 		 */
455 		error = process_sstep(t, req == PT_STEP);
456 		if (error)
457 			goto fail;
458 #endif
459 		goto sendsig;
460 
461 	case PT_DETACH:
462 		/*
463 		 * From the 4.4BSD PRM:
464 		 * "The data argument is taken as a signal number and the
465 		 * child's execution continues at location addr as if it
466 		 * incurred that signal.  Normally the signal number will
467 		 * be either 0 to indicate that the signal that caused the
468 		 * stop should be ignored, or that value fetched out of
469 		 * the process's image indicating which signal caused
470 		 * the stop.  If addr is (int *)1 then execution continues
471 		 * from where it stopped."
472 		 */
473 
474 		if (pid < THREAD_PID_OFFSET && tr->ps_single)
475 			t = tr->ps_single;
476 
477 #ifdef PT_STEP
478 		/*
479 		 * Stop single stepping.
480 		 */
481 		error = process_sstep(t, 0);
482 		if (error)
483 			goto fail;
484 #endif
485 
486 		process_untrace(tr);
487 		atomic_clearbits_int(&tr->ps_flags, PS_WAITED);
488 
489 	sendsig:
490 		memset(tr->ps_ptstat, 0, sizeof(*tr->ps_ptstat));
491 
492 		/* Finally, deliver the requested signal (or none). */
493 		if (t->p_stat == SSTOP) {
494 			tr->ps_xsig = data;
495 			SCHED_LOCK(s);
496 			unsleep(t);
497 			setrunnable(t);
498 			SCHED_UNLOCK(s);
499 		} else {
500 			if (data != 0)
501 				psignal(t, data);
502 		}
503 		break;
504 
505 	case PT_KILL:
506 		if (pid < THREAD_PID_OFFSET && tr->ps_single)
507 			t = tr->ps_single;
508 
509 		/* just send the process a KILL signal. */
510 		data = SIGKILL;
511 		goto sendsig;	/* in PT_CONTINUE, above. */
512 
513 	case PT_ATTACH:
514 		/*
515 		 * As was done in procfs:
516 		 * Go ahead and set the trace flag.
517 		 * Save the old parent (it's reset in
518 		 *   _DETACH, and also in kern_exit.c:wait4()
519 		 * Reparent the process so that the tracing
520 		 *   proc gets to see all the action.
521 		 * Stop the target.
522 		 */
523 		atomic_setbits_int(&tr->ps_flags, PS_TRACED);
524 		tr->ps_oppid = tr->ps_pptr->ps_pid;
525 		process_reparent(tr, p->p_p);
526 		if (tr->ps_ptstat == NULL)
527 			tr->ps_ptstat = malloc(sizeof(*tr->ps_ptstat),
528 			    M_SUBPROC, M_WAITOK);
529 		data = SIGSTOP;
530 		goto sendsig;
531 	default:
532 		KASSERTMSG(0, "%s: unhandled request %d", __func__, req);
533 		break;
534 	}
535 
536 fail:
537 	return error;
538 }
539 
540 /*
541  * ptrace kernel-state requests: thread list, event mask, process state
542  */
543 int
544 ptrace_kstate(struct proc *p, int req, pid_t pid, void *addr)
545 {
546 	struct process *tr;			/* target process */
547 	struct ptrace_event *pe = addr;
548 	int error;
549 
550 	KASSERT((p->p_flag & P_SYSTEM) == 0);
551 
552 	/* Find the process we're supposed to be operating on. */
553 	if ((tr = prfind(pid)) == NULL)
554 		return ESRCH;
555 
556 	if ((error = process_checktracestate(p->p_p, tr, NULL)))
557 		return error;
558 
559 	switch (req) {
560 	case PT_GET_THREAD_FIRST:
561 	case PT_GET_THREAD_NEXT:
562 	      {
563 		struct ptrace_thread_state *pts = addr;
564 		struct proc *t;
565 
566 		if (req == PT_GET_THREAD_NEXT) {
567 			t = tfind_user(pts->pts_tid, tr);
568 			if (t == NULL || ISSET(t->p_flag, P_WEXIT))
569 				return ESRCH;
570 			t = TAILQ_NEXT(t, p_thr_link);
571 		} else {
572 			t = TAILQ_FIRST(&tr->ps_threads);
573 		}
574 
575 		if (t == NULL)
576 			pts->pts_tid = -1;
577 		else
578 			pts->pts_tid = t->p_tid + THREAD_PID_OFFSET;
579 		return 0;
580 	      }
581 	}
582 
583 	switch (req) {
584 	case PT_GET_EVENT_MASK:
585 		pe->pe_set_event = tr->ps_ptmask;
586 		break;
587 	case PT_SET_EVENT_MASK:
588 		tr->ps_ptmask = pe->pe_set_event;
589 		break;
590 	case PT_GET_PROCESS_STATE:
591 		if (tr->ps_single)
592 			tr->ps_ptstat->pe_tid =
593 			    tr->ps_single->p_tid + THREAD_PID_OFFSET;
594 		memcpy(addr, tr->ps_ptstat, sizeof *tr->ps_ptstat);
595 		break;
596 	default:
597 		KASSERTMSG(0, "%s: unhandled request %d", __func__, req);
598 		break;
599 	}
600 
601 	return 0;
602 }
603 
604 /*
605  * ptrace user-state requests: memory access, registers, stack cookie
606  */
607 int
608 ptrace_ustate(struct proc *p, int req, pid_t pid, void *addr, int data,
609     register_t *retval)
610 {
611 	struct proc *t;				/* target thread */
612 	struct process *tr;			/* target process */
613 	struct uio uio;
614 	struct iovec iov;
615 	int error, write;
616 	int temp = 0;
617 
618 	KASSERT((p->p_flag & P_SYSTEM) == 0);
619 
620 	/* Accept either PID or TID */
621 	if ((tr = process_tprfind(pid, &t)) == NULL)
622 		return ESRCH;
623 
624 	if ((error = process_checktracestate(p->p_p, tr, t)))
625 		return error;
626 
627 	FIX_SSTEP(t);
628 
629 	/* Now do the operation. */
630 	write = 0;
631 
632 	if ((error = process_checkioperm(p, tr)) != 0)
633 		return error;
634 
635 	switch (req) {
636 	case PT_WRITE_I:		/* XXX no separate I and D spaces */
637 	case PT_WRITE_D:
638 		write = 1;
639 		temp = data;
640 	case PT_READ_I:		/* XXX no separate I and D spaces */
641 	case PT_READ_D:
642 		/* write = 0 done above. */
643 		iov.iov_base = (caddr_t)&temp;
644 		iov.iov_len = sizeof(int);
645 		uio.uio_iov = &iov;
646 		uio.uio_iovcnt = 1;
647 		uio.uio_offset = (off_t)(vaddr_t)addr;
648 		uio.uio_resid = sizeof(int);
649 		uio.uio_segflg = UIO_SYSSPACE;
650 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
651 		uio.uio_procp = p;
652 		error = process_domem(p, tr, &uio, write ? PT_WRITE_I :
653 				PT_READ_I);
654 		if (write == 0)
655 			*retval = temp;
656 		return error;
657 
658 	case PT_IO:
659 	      {
660 		struct ptrace_io_desc *piod = addr;
661 
662 		iov.iov_base = piod->piod_addr;
663 		iov.iov_len = piod->piod_len;
664 		uio.uio_iov = &iov;
665 		uio.uio_iovcnt = 1;
666 		uio.uio_offset = (off_t)(vaddr_t)piod->piod_offs;
667 		uio.uio_resid = piod->piod_len;
668 		uio.uio_segflg = UIO_USERSPACE;
669 		uio.uio_procp = p;
670 		switch (piod->piod_op) {
671 		case PIOD_READ_I:
672 			req = PT_READ_I;
673 			uio.uio_rw = UIO_READ;
674 			break;
675 		case PIOD_READ_D:
676 			req = PT_READ_D;
677 			uio.uio_rw = UIO_READ;
678 			break;
679 		case PIOD_WRITE_I:
680 			req = PT_WRITE_I;
681 			uio.uio_rw = UIO_WRITE;
682 			break;
683 		case PIOD_WRITE_D:
684 			req = PT_WRITE_D;
685 			uio.uio_rw = UIO_WRITE;
686 			break;
687 		case PIOD_READ_AUXV:
688 			req = PT_READ_D;
689 			uio.uio_rw = UIO_READ;
690 			temp = ELF_AUX_WORDS * sizeof(char *);
691 			if (uio.uio_offset > temp)
692 				return EIO;
693 			if (uio.uio_resid > temp - uio.uio_offset)
694 				uio.uio_resid = temp - uio.uio_offset;
695 			piod->piod_len = iov.iov_len = uio.uio_resid;
696 			uio.uio_offset += tr->ps_auxinfo;
697 #ifdef MACHINE_STACK_GROWS_UP
698 			if (uio.uio_offset < (off_t)tr->ps_strings)
699 				return EIO;
700 #else
701 			if (uio.uio_offset > (off_t)tr->ps_strings)
702 				return EIO;
703 			if ((uio.uio_offset + uio.uio_resid) >
704 			    (off_t)tr->ps_strings)
705 				uio.uio_resid = (off_t)tr->ps_strings -
706 				    uio.uio_offset;
707 #endif
708 			break;
709 		default:
710 			return EINVAL;
711 		}
712 		error = process_domem(p, tr, &uio, req);
713 		piod->piod_len -= uio.uio_resid;
714 		return error;
715 	      }
716 
717 	case PT_SETREGS:
718 		return process_write_regs(t, addr);
719 	case PT_GETREGS:
720 		return process_read_regs(t, addr);
721 
722 #ifdef PT_SETFPREGS
723 	case PT_SETFPREGS:
724 		return process_write_fpregs(t, addr);
725 #endif
726 #ifdef PT_SETFPREGS
727 	case PT_GETFPREGS:
728 		return process_read_fpregs(t, addr);
729 #endif
730 #ifdef PT_SETXMMREGS
731 	case PT_SETXMMREGS:
732 		return process_write_xmmregs(t, addr);
733 #endif
734 #ifdef PT_SETXMMREGS
735 	case PT_GETXMMREGS:
736 		return process_read_xmmregs(t, addr);
737 #endif
738 #ifdef PT_WCOOKIE
739 	case PT_WCOOKIE:
740 		*(register_t *)addr = process_get_wcookie(t);
741 		return 0;
742 #endif
743 #ifdef PT_PACMASK
744 	case PT_PACMASK:
745 		((register_t *)addr)[0] = process_get_pacmask(t);
746 		((register_t *)addr)[1] = process_get_pacmask(t);
747 		return 0;
748 #endif
749 	default:
750 		KASSERTMSG(0, "%s: unhandled request %d", __func__, req);
751 		break;
752 	}
753 
754 	return 0;
755 }
756 
757 
758 /*
759  * Helper for doing "it could be a PID or TID" lookup.  On failure
760  * returns NULL; on success returns the selected process and sets *tp
761  * to an appropriate thread in that process.
762  */
763 static inline struct process *
764 process_tprfind(pid_t tpid, struct proc **tp)
765 {
766 	if (tpid > THREAD_PID_OFFSET) {
767 		struct proc *t = tfind(tpid - THREAD_PID_OFFSET);
768 
769 		if (t == NULL)
770 			return NULL;
771 		*tp = t;
772 		return t->p_p;
773 	} else {
774 		struct process *tr = prfind(tpid);
775 
776 		if (tr == NULL)
777 			return NULL;
778 		*tp = TAILQ_FIRST(&tr->ps_threads);
779 		return tr;
780 	}
781 }
782 
783 
784 /*
785  * Check whether 'tr' is currently traced by 'curpr' and in a state
786  * to be manipulated.  If 't' is supplied then it must be stopped and
787  * waited for.
788  */
789 static inline int
790 process_checktracestate(struct process *curpr, struct process *tr,
791     struct proc *t)
792 {
793 	/*
794 	 * You can't do what you want to the process if:
795 	 *	(1) It's not being traced at all,
796 	 */
797 	if (!ISSET(tr->ps_flags, PS_TRACED))
798 		return EPERM;
799 
800 	/*
801 	 *	(2) it's not being traced by _you_, or
802 	 */
803 	if (tr->ps_pptr != curpr)
804 		return EBUSY;
805 
806 	/*
807 	 *	(3) it's in the middle of execve(2)
808 	 */
809 	if (ISSET(tr->ps_flags, PS_INEXEC))
810 		return EAGAIN;
811 
812 	/*
813 	 *	(4) if a thread was specified and it's not currently stopped.
814 	 */
815 	if (t != NULL &&
816 	    (t->p_stat != SSTOP || !ISSET(tr->ps_flags, PS_WAITED)))
817 		return EBUSY;
818 
819 	return 0;
820 }
821 
822 #endif /* PTRACE */
823 
824 /*
825  * Check if a process is allowed to fiddle with the memory of another.
826  *
827  * p = tracer
828  * tr = tracee
829  *
830  * 1.  You can't attach to a process not owned by you or one that has raised
831  *     its privileges.
832  * 1a. ...unless you are root.
833  *
834  * 2.  init is always off-limits because it can control the securelevel.
835  * 2a. ...unless securelevel is permanently set to insecure.
836  *
837  * 3.  Processes that are in the process of doing an exec() are always
838  *     off-limits because of the can of worms they are. Just wait a
839  *     second.
840  */
841 int
842 process_checkioperm(struct proc *p, struct process *tr)
843 {
844 	int error;
845 
846 	if ((tr->ps_ucred->cr_ruid != p->p_ucred->cr_ruid ||
847 	    ISSET(tr->ps_flags, PS_SUGIDEXEC | PS_SUGID)) &&
848 	    (error = suser(p)) != 0)
849 		return (error);
850 
851 	if ((tr->ps_pid == 1) && (securelevel > -1))
852 		return (EPERM);
853 
854 	if (ISSET(tr->ps_flags, PS_INEXEC))
855 		return (EAGAIN);
856 
857 	return (0);
858 }
859 
860 int
861 process_domem(struct proc *curp, struct process *tr, struct uio *uio, int req)
862 {
863 	struct vmspace *vm;
864 	int error;
865 	vaddr_t addr;
866 	vsize_t len;
867 
868 	len = uio->uio_resid;
869 	if (len == 0)
870 		return 0;
871 
872 	if ((error = process_checkioperm(curp, tr)) != 0)
873 		return error;
874 
875 	vm = tr->ps_vmspace;
876 	if ((tr->ps_flags & PS_EXITING) || (vm->vm_refcnt < 1))
877 		return EFAULT;
878 	addr = uio->uio_offset;
879 
880 	uvmspace_addref(vm);
881 
882 	error = uvm_io(&vm->vm_map, uio, UVM_IO_FIXPROT);
883 
884 	uvmspace_free(vm);
885 
886 	if (error == 0 && req == PT_WRITE_I)
887 		pmap_proc_iflush(tr, addr, len);
888 
889 	return error;
890 }
891