Home | History | Annotate | Line # | Download | only in kern
      1 /*	$NetBSD: kern_ktrace.c,v 1.186 2024/09/08 09:36:51 rillig Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2006, 2007, 2008, 2020 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * Copyright (c) 1989, 1993
     34  *	The Regents of the University of California.  All rights reserved.
     35  *
     36  * Redistribution and use in source and binary forms, with or without
     37  * modification, are permitted provided that the following conditions
     38  * are met:
     39  * 1. Redistributions of source code must retain the above copyright
     40  *    notice, this list of conditions and the following disclaimer.
     41  * 2. Redistributions in binary form must reproduce the above copyright
     42  *    notice, this list of conditions and the following disclaimer in the
     43  *    documentation and/or other materials provided with the distribution.
     44  * 3. Neither the name of the University nor the names of its contributors
     45  *    may be used to endorse or promote products derived from this software
     46  *    without specific prior written permission.
     47  *
     48  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     49  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     50  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     51  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     52  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     53  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     54  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     55  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     56  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     57  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     58  * SUCH DAMAGE.
     59  *
     60  *	@(#)kern_ktrace.c	8.5 (Berkeley) 5/14/95
     61  */
     62 
     63 #include <sys/cdefs.h>
     64 __KERNEL_RCSID(0, "$NetBSD: kern_ktrace.c,v 1.186 2024/09/08 09:36:51 rillig Exp $");
     65 
     66 #include <sys/param.h>
     67 
     68 #include <sys/callout.h>
     69 #include <sys/cpu.h>
     70 #include <sys/file.h>
     71 #include <sys/filedesc.h>
     72 #include <sys/ioctl.h>
     73 #include <sys/kauth.h>
     74 #include <sys/kernel.h>
     75 #include <sys/kmem.h>
     76 #include <sys/kthread.h>
     77 #include <sys/ktrace.h>
     78 #include <sys/mount.h>
     79 #include <sys/proc.h>
     80 #include <sys/syncobj.h>
     81 #include <sys/syscallargs.h>
     82 #include <sys/syslog.h>
     83 #include <sys/systm.h>
     84 
     85 /*
     86  * TODO:
     87  *	- need better error reporting?
     88  *	- userland utility to sort ktrace.out by timestamp.
     89  *	- keep minimum information in ktrace_entry when rest of alloc failed.
     90  *	- per trace control of configurable parameters.
     91  */
     92 
     93 struct ktrace_entry {
     94 	TAILQ_ENTRY(ktrace_entry) kte_list;
     95 	struct	ktr_header kte_kth;
     96 	void	*kte_buf;
     97 	size_t	kte_bufsz;
     98 #define	KTE_SPACE		32
     99 	uint8_t kte_space[KTE_SPACE] __aligned(sizeof(register_t));
    100 };
    101 
    102 struct ktr_desc {
    103 	TAILQ_ENTRY(ktr_desc) ktd_list;
    104 	int ktd_flags;
    105 #define	KTDF_WAIT		0x0001
    106 #define	KTDF_DONE		0x0002
    107 #define	KTDF_BLOCKING		0x0004
    108 #define	KTDF_INTERACTIVE	0x0008
    109 	int ktd_error;
    110 #define	KTDE_ENOMEM		0x0001
    111 #define	KTDE_ENOSPC		0x0002
    112 	int ktd_errcnt;
    113 	int ktd_ref;			/* # of reference */
    114 	int ktd_qcount;			/* # of entry in the queue */
    115 
    116 	/*
    117 	 * Params to control behaviour.
    118 	 */
    119 	int ktd_delayqcnt;		/* # of entry allowed to delay */
    120 	int ktd_wakedelay;		/* delay of wakeup in *tick* */
    121 	int ktd_intrwakdl;		/* ditto, but when interactive */
    122 
    123 	file_t *ktd_fp;			/* trace output file */
    124 	lwp_t *ktd_lwp;			/* our kernel thread */
    125 	TAILQ_HEAD(, ktrace_entry) ktd_queue;
    126 	callout_t ktd_wakch;		/* delayed wakeup */
    127 	kcondvar_t ktd_sync_cv;
    128 	kcondvar_t ktd_cv;
    129 };
    130 
    131 static void	ktrwrite(struct ktr_desc *, struct ktrace_entry *);
    132 static int	ktrops(lwp_t *, struct proc *, int, int,
    133 		    struct ktr_desc *);
    134 static int	ktrsetchildren(lwp_t *, struct proc *, int, int,
    135 		    struct ktr_desc *);
    136 static int	ktrcanset(lwp_t *, struct proc *);
    137 static int	ktrsamefile(file_t *, file_t *);
    138 static void	ktr_kmem(lwp_t *, int, const void *, size_t);
    139 static void	ktr_io(lwp_t *, int, enum uio_rw, struct iovec *, size_t);
    140 
    141 static struct ktr_desc *
    142 		ktd_lookup(file_t *);
    143 static void	ktdrel(struct ktr_desc *);
    144 static void	ktdref(struct ktr_desc *);
    145 static void	ktefree(struct ktrace_entry *);
    146 static void	ktd_logerrl(struct ktr_desc *, int);
    147 static void	ktrace_thread(void *);
    148 static int	ktrderefall(struct ktr_desc *, int);
    149 
    150 /*
    151  * Default values.
    152  */
    153 #define	KTD_MAXENTRY		1000	/* XXX: tune */
    154 #define	KTD_TIMEOUT		5	/* XXX: tune */
    155 #define	KTD_DELAYQCNT		100	/* XXX: tune */
    156 #define	KTD_WAKEDELAY		5000	/* XXX: tune */
    157 #define	KTD_INTRWAKDL		100	/* XXX: tune */
    158 
    159 /*
    160  * Patchable variables.
    161  */
    162 int ktd_maxentry = KTD_MAXENTRY;	/* max # of entry in the queue */
    163 int ktd_timeout = KTD_TIMEOUT;		/* timeout in seconds */
    164 int ktd_delayqcnt = KTD_DELAYQCNT;	/* # of entry allowed to delay */
    165 int ktd_wakedelay = KTD_WAKEDELAY;	/* delay of wakeup in *ms* */
    166 int ktd_intrwakdl = KTD_INTRWAKDL;	/* ditto, but when interactive */
    167 
    168 kmutex_t ktrace_lock;
    169 int ktrace_on;
    170 static TAILQ_HEAD(, ktr_desc) ktdq = TAILQ_HEAD_INITIALIZER(ktdq);
    171 static pool_cache_t kte_cache;
    172 
    173 static kauth_listener_t ktrace_listener;
    174 
    175 static void
    176 ktd_wakeup(struct ktr_desc *ktd)
    177 {
    178 
    179 	callout_stop(&ktd->ktd_wakch);
    180 	cv_signal(&ktd->ktd_cv);
    181 }
    182 
    183 static void
    184 ktd_callout(void *arg)
    185 {
    186 
    187 	mutex_enter(&ktrace_lock);
    188 	ktd_wakeup(arg);
    189 	mutex_exit(&ktrace_lock);
    190 }
    191 
    192 static void
    193 ktd_logerrl(struct ktr_desc *ktd, int error)
    194 {
    195 
    196 	ktd->ktd_error |= error;
    197 	ktd->ktd_errcnt++;
    198 }
    199 
    200 #if 0
    201 static void
    202 ktd_logerr(struct proc *p, int error)
    203 {
    204 	struct ktr_desc *ktd;
    205 
    206 	KASSERT(mutex_owned(&ktrace_lock));
    207 
    208 	ktd = p->p_tracep;
    209 	if (ktd == NULL)
    210 		return;
    211 
    212 	ktd_logerrl(ktd, error);
    213 }
    214 #endif
    215 
    216 static int
    217 ktrace_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
    218     void *arg0, void *arg1, void *arg2, void *arg3)
    219 {
    220 	struct proc *p;
    221 	int result;
    222 	enum kauth_process_req req;
    223 
    224 	result = KAUTH_RESULT_DEFER;
    225 	p = arg0;
    226 
    227 	if (action != KAUTH_PROCESS_KTRACE)
    228 		return result;
    229 
    230 	req = (enum kauth_process_req)(uintptr_t)arg1;
    231 
    232 	/* Privileged; secmodel should handle these. */
    233 	if (req == KAUTH_REQ_PROCESS_KTRACE_PERSISTENT)
    234 		return result;
    235 
    236 	if ((p->p_traceflag & KTRFAC_PERSISTENT) ||
    237 	    (p->p_flag & PK_SUGID))
    238 		return result;
    239 
    240 	if (kauth_cred_geteuid(cred) == kauth_cred_getuid(p->p_cred) &&
    241 	    kauth_cred_getuid(cred) == kauth_cred_getsvuid(p->p_cred) &&
    242 	    kauth_cred_getgid(cred) == kauth_cred_getgid(p->p_cred) &&
    243 	    kauth_cred_getgid(cred) == kauth_cred_getsvgid(p->p_cred))
    244 		result = KAUTH_RESULT_ALLOW;
    245 
    246 	return result;
    247 }
    248 
    249 /*
    250  * Initialise the ktrace system.
    251  */
    252 void
    253 ktrinit(void)
    254 {
    255 
    256 	mutex_init(&ktrace_lock, MUTEX_DEFAULT, IPL_NONE);
    257 	kte_cache = pool_cache_init(sizeof(struct ktrace_entry), 0, 0, 0,
    258 	    "ktrace", &pool_allocator_nointr, IPL_NONE, NULL, NULL, NULL);
    259 
    260 	ktrace_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
    261 	    ktrace_listener_cb, NULL);
    262 }
    263 
    264 /*
    265  * Release a reference.  Called with ktrace_lock held.
    266  */
    267 static void
    268 ktdrel(struct ktr_desc *ktd)
    269 {
    270 
    271 	KASSERT(mutex_owned(&ktrace_lock));
    272 
    273 	KDASSERT(ktd->ktd_ref != 0);
    274 	KASSERT(ktd->ktd_ref > 0);
    275 	KASSERT(ktrace_on > 0);
    276 	ktrace_on--;
    277 	if (--ktd->ktd_ref <= 0) {
    278 		ktd->ktd_flags |= KTDF_DONE;
    279 		cv_signal(&ktd->ktd_cv);
    280 	}
    281 }
    282 
    283 static void
    284 ktdref(struct ktr_desc *ktd)
    285 {
    286 
    287 	KASSERT(mutex_owned(&ktrace_lock));
    288 
    289 	ktd->ktd_ref++;
    290 	ktrace_on++;
    291 }
    292 
    293 static struct ktr_desc *
    294 ktd_lookup(file_t *fp)
    295 {
    296 	struct ktr_desc *ktd;
    297 
    298 	KASSERT(mutex_owned(&ktrace_lock));
    299 
    300 	for (ktd = TAILQ_FIRST(&ktdq); ktd != NULL;
    301 	    ktd = TAILQ_NEXT(ktd, ktd_list)) {
    302 		if (ktrsamefile(ktd->ktd_fp, fp)) {
    303 			ktdref(ktd);
    304 			break;
    305 		}
    306 	}
    307 
    308 	return (ktd);
    309 }
    310 
    311 void
    312 ktraddentry(lwp_t *l, struct ktrace_entry *kte, int flags)
    313 {
    314 	struct proc *p = l->l_proc;
    315 	struct ktr_desc *ktd;
    316 #ifdef DEBUG
    317 	struct timeval t1, t2;
    318 #endif
    319 
    320 	mutex_enter(&ktrace_lock);
    321 
    322 	if (p->p_traceflag & KTRFAC_TRC_EMUL) {
    323 		/* Add emulation trace before first entry for this process */
    324 		p->p_traceflag &= ~KTRFAC_TRC_EMUL;
    325 		mutex_exit(&ktrace_lock);
    326 		ktrexit(l);
    327 		ktremul();
    328 		(void)ktrenter(l);
    329 		mutex_enter(&ktrace_lock);
    330 	}
    331 
    332 	/* Tracing may have been cancelled. */
    333 	ktd = p->p_tracep;
    334 	if (ktd == NULL)
    335 		goto freekte;
    336 
    337 	/*
    338 	 * Bump reference count so that the object will remain while
    339 	 * we are here.  Note that the trace is controlled by other
    340 	 * process.
    341 	 */
    342 	ktdref(ktd);
    343 
    344 	if (ktd->ktd_flags & KTDF_DONE)
    345 		goto relktd;
    346 
    347 	if (ktd->ktd_qcount > ktd_maxentry) {
    348 		ktd_logerrl(ktd, KTDE_ENOSPC);
    349 		goto relktd;
    350 	}
    351 	TAILQ_INSERT_TAIL(&ktd->ktd_queue, kte, kte_list);
    352 	ktd->ktd_qcount++;
    353 	if (ktd->ktd_flags & KTDF_BLOCKING)
    354 		goto skip_sync;
    355 
    356 	if (flags & KTA_WAITOK &&
    357 	    (/* flags & KTA_LARGE */0 || ktd->ktd_flags & KTDF_WAIT ||
    358 	    ktd->ktd_qcount > ktd_maxentry >> 1))
    359 		/*
    360 		 * Sync with writer thread since we're requesting rather
    361 		 * big one or many requests are pending.
    362 		 */
    363 		do {
    364 			ktd->ktd_flags |= KTDF_WAIT;
    365 			ktd_wakeup(ktd);
    366 #ifdef DEBUG
    367 			getmicrouptime(&t1);
    368 #endif
    369 			if (cv_timedwait(&ktd->ktd_sync_cv, &ktrace_lock,
    370 			    ktd_timeout * hz) != 0) {
    371 				ktd->ktd_flags |= KTDF_BLOCKING;
    372 				/*
    373 				 * Maybe the writer thread is blocking
    374 				 * completely for some reason, but
    375 				 * don't stop target process forever.
    376 				 */
    377 				log(LOG_NOTICE, "ktrace timeout\n");
    378 				break;
    379 			}
    380 #ifdef DEBUG
    381 			getmicrouptime(&t2);
    382 			timersub(&t2, &t1, &t2);
    383 			if (t2.tv_sec > 0)
    384 				log(LOG_NOTICE,
    385 				    "ktrace long wait: %lld.%06ld\n",
    386 				    (long long)t2.tv_sec, (long)t2.tv_usec);
    387 #endif
    388 		} while (p->p_tracep == ktd &&
    389 		    (ktd->ktd_flags & (KTDF_WAIT | KTDF_DONE)) == KTDF_WAIT);
    390 	else {
    391 		/* Schedule delayed wakeup */
    392 		if (ktd->ktd_qcount > ktd->ktd_delayqcnt)
    393 			ktd_wakeup(ktd);	/* Wakeup now */
    394 		else if (!callout_pending(&ktd->ktd_wakch))
    395 			callout_reset(&ktd->ktd_wakch,
    396 			    ktd->ktd_flags & KTDF_INTERACTIVE ?
    397 			    ktd->ktd_intrwakdl : ktd->ktd_wakedelay,
    398 			    ktd_callout, ktd);
    399 	}
    400 
    401 skip_sync:
    402 	ktdrel(ktd);
    403 	mutex_exit(&ktrace_lock);
    404 	ktrexit(l);
    405 	return;
    406 
    407 relktd:
    408 	ktdrel(ktd);
    409 
    410 freekte:
    411 	mutex_exit(&ktrace_lock);
    412 	ktefree(kte);
    413 	ktrexit(l);
    414 }
    415 
    416 static void
    417 ktefree(struct ktrace_entry *kte)
    418 {
    419 
    420 	if (kte->kte_buf != kte->kte_space)
    421 		kmem_free(kte->kte_buf, kte->kte_bufsz);
    422 	pool_cache_put(kte_cache, kte);
    423 }
    424 
    425 /*
    426  * "deep" compare of two files for the purposes of clearing a trace.
    427  * Returns true if they're the same open file, or if they point at the
    428  * same underlying vnode/socket.
    429  */
    430 
    431 static int
    432 ktrsamefile(file_t *f1, file_t *f2)
    433 {
    434 
    435 	return ((f1 == f2) ||
    436 	    ((f1 != NULL) && (f2 != NULL) &&
    437 		(f1->f_type == f2->f_type) &&
    438 		(f1->f_data == f2->f_data)));
    439 }
    440 
    441 void
    442 ktrderef(struct proc *p)
    443 {
    444 	struct ktr_desc *ktd = p->p_tracep;
    445 
    446 	KASSERT(mutex_owned(&ktrace_lock));
    447 
    448 	p->p_traceflag = 0;
    449 	if (ktd == NULL)
    450 		return;
    451 	p->p_tracep = NULL;
    452 
    453 	cv_broadcast(&ktd->ktd_sync_cv);
    454 	ktdrel(ktd);
    455 }
    456 
    457 void
    458 ktradref(struct proc *p)
    459 {
    460 	struct ktr_desc *ktd = p->p_tracep;
    461 
    462 	KASSERT(mutex_owned(&ktrace_lock));
    463 
    464 	ktdref(ktd);
    465 }
    466 
    467 static int
    468 ktrderefall(struct ktr_desc *ktd, int auth)
    469 {
    470 	lwp_t *curl = curlwp;
    471 	struct proc *p;
    472 	int error = 0;
    473 
    474 	mutex_enter(&proc_lock);
    475 	PROCLIST_FOREACH(p, &allproc) {
    476 		if (p->p_tracep != ktd)
    477 			continue;
    478 		mutex_enter(p->p_lock);
    479 		mutex_enter(&ktrace_lock);
    480 		if (p->p_tracep == ktd) {
    481 			if (!auth || ktrcanset(curl, p))
    482 				ktrderef(p);
    483 			else
    484 				error = EPERM;
    485 		}
    486 		mutex_exit(&ktrace_lock);
    487 		mutex_exit(p->p_lock);
    488 	}
    489 	mutex_exit(&proc_lock);
    490 
    491 	return error;
    492 }
    493 
    494 int
    495 ktealloc(struct ktrace_entry **ktep, void **bufp, lwp_t *l, int type,
    496 	 size_t sz)
    497 {
    498 	struct proc *p = l->l_proc;
    499 	struct ktrace_entry *kte;
    500 	struct ktr_header *kth;
    501 	void *buf;
    502 
    503 	if (ktrenter(l))
    504 		return EAGAIN;
    505 
    506 	kte = pool_cache_get(kte_cache, PR_WAITOK);
    507 	if (sz > sizeof(kte->kte_space)) {
    508 		buf = kmem_alloc(sz, KM_SLEEP);
    509 	} else
    510 		buf = kte->kte_space;
    511 
    512 	kte->kte_bufsz = sz;
    513 	kte->kte_buf = buf;
    514 
    515 	kth = &kte->kte_kth;
    516 	(void)memset(kth, 0, sizeof(*kth));
    517 	kth->ktr_len = sz;
    518 	kth->ktr_type = type;
    519 	kth->ktr_pid = p->p_pid;
    520 	memcpy(kth->ktr_comm, p->p_comm, MAXCOMLEN);
    521 	kth->ktr_version = KTRFAC_VERSION(p->p_traceflag);
    522 	kth->ktr_lid = l->l_lid;
    523 	nanotime(&kth->ktr_ts);
    524 
    525 	*ktep = kte;
    526 	*bufp = buf;
    527 
    528 	return 0;
    529 }
    530 
    531 void
    532 ktesethdrlen(struct ktrace_entry *kte, size_t l)
    533 {
    534 	kte->kte_kth.ktr_len = l;
    535 }
    536 
    537 void
    538 ktr_syscall(register_t code, const register_t args[], int narg)
    539 {
    540 	lwp_t *l = curlwp;
    541 	struct proc *p = l->l_proc;
    542 	struct ktrace_entry *kte;
    543 	struct ktr_syscall *ktp;
    544 	register_t *argp;
    545 	size_t len;
    546 	u_int i;
    547 
    548 	if (!KTRPOINT(p, KTR_SYSCALL))
    549 		return;
    550 
    551 	len = sizeof(struct ktr_syscall) + narg * sizeof argp[0];
    552 
    553 	if (ktealloc(&kte, (void *)&ktp, l, KTR_SYSCALL, len))
    554 		return;
    555 
    556 	ktp->ktr_code = code;
    557 	ktp->ktr_argsize = narg * sizeof argp[0];
    558 	argp = (register_t *)(ktp + 1);
    559 	for (i = 0; i < narg; i++)
    560 		*argp++ = args[i];
    561 
    562 	ktraddentry(l, kte, KTA_WAITOK);
    563 }
    564 
    565 void
    566 ktr_sysret(register_t code, int error, register_t *retval)
    567 {
    568 	lwp_t *l = curlwp;
    569 	struct ktrace_entry *kte;
    570 	struct ktr_sysret *ktp;
    571 
    572 	if (!KTRPOINT(l->l_proc, KTR_SYSRET))
    573 		return;
    574 
    575 	if (ktealloc(&kte, (void *)&ktp, l, KTR_SYSRET,
    576 	    sizeof(struct ktr_sysret)))
    577 		return;
    578 
    579 	ktp->ktr_code = code;
    580 	ktp->ktr_eosys = 0;			/* XXX unused */
    581 	ktp->ktr_error = error;
    582 	ktp->ktr_retval = retval && error == 0 ? retval[0] : 0;
    583 	ktp->ktr_retval_1 = retval && error == 0 ? retval[1] : 0;
    584 
    585 	ktraddentry(l, kte, KTA_WAITOK);
    586 }
    587 
    588 void
    589 ktr_namei(const char *path, size_t pathlen)
    590 {
    591 	lwp_t *l = curlwp;
    592 
    593 	if (!KTRPOINT(l->l_proc, KTR_NAMEI))
    594 		return;
    595 
    596 	ktr_kmem(l, KTR_NAMEI, path, pathlen);
    597 }
    598 
    599 void
    600 ktr_namei2(const char *eroot, size_t erootlen,
    601 	  const char *path, size_t pathlen)
    602 {
    603 	lwp_t *l = curlwp;
    604 	struct ktrace_entry *kte;
    605 	void *buf;
    606 
    607 	if (!KTRPOINT(l->l_proc, KTR_NAMEI))
    608 		return;
    609 
    610 	if (ktealloc(&kte, &buf, l, KTR_NAMEI, erootlen + pathlen))
    611 		return;
    612 	memcpy(buf, eroot, erootlen);
    613 	buf = (char *)buf + erootlen;
    614 	memcpy(buf, path, pathlen);
    615 	ktraddentry(l, kte, KTA_WAITOK);
    616 }
    617 
    618 void
    619 ktr_emul(void)
    620 {
    621 	lwp_t *l = curlwp;
    622 	const char *emul = l->l_proc->p_emul->e_name;
    623 
    624 	if (!KTRPOINT(l->l_proc, KTR_EMUL))
    625 		return;
    626 
    627 	ktr_kmem(l, KTR_EMUL, emul, strlen(emul));
    628 }
    629 
    630 void
    631 ktr_execarg(const void *bf, size_t len)
    632 {
    633 	lwp_t *l = curlwp;
    634 
    635 	if (!KTRPOINT(l->l_proc, KTR_EXEC_ARG))
    636 		return;
    637 
    638 	ktr_kmem(l, KTR_EXEC_ARG, bf, len);
    639 }
    640 
    641 void
    642 ktr_execenv(const void *bf, size_t len)
    643 {
    644 	lwp_t *l = curlwp;
    645 
    646 	if (!KTRPOINT(l->l_proc, KTR_EXEC_ENV))
    647 		return;
    648 
    649 	ktr_kmem(l, KTR_EXEC_ENV, bf, len);
    650 }
    651 
    652 void
    653 ktr_execfd(int fd, u_int dtype)
    654 {
    655 	struct ktrace_entry *kte;
    656 	struct ktr_execfd* ktp;
    657 
    658 	lwp_t *l = curlwp;
    659 
    660 	if (!KTRPOINT(l->l_proc, KTR_EXEC_FD))
    661 		return;
    662 
    663 	if (ktealloc(&kte, (void *)&ktp, l, KTR_EXEC_FD, sizeof(*ktp)))
    664 		return;
    665 
    666 	ktp->ktr_fd = fd;
    667 	ktp->ktr_dtype = dtype;
    668 	ktraddentry(l, kte, KTA_WAITOK);
    669 }
    670 
    671 static void
    672 ktr_kmem(lwp_t *l, int type, const void *bf, size_t len)
    673 {
    674 	struct ktrace_entry *kte;
    675 	void *buf;
    676 
    677 	if (ktealloc(&kte, &buf, l, type, len))
    678 		return;
    679 	memcpy(buf, bf, len);
    680 	ktraddentry(l, kte, KTA_WAITOK);
    681 }
    682 
    683 static void
    684 ktr_io(lwp_t *l, int fd, enum uio_rw rw, struct iovec *iov, size_t len)
    685 {
    686 	struct ktrace_entry *kte;
    687 	struct ktr_genio *ktp;
    688 	size_t resid = len, cnt, buflen;
    689 	char *cp;
    690 
    691  next:
    692 	buflen = uimin(PAGE_SIZE, resid + sizeof(struct ktr_genio));
    693 
    694 	if (ktealloc(&kte, (void *)&ktp, l, KTR_GENIO, buflen))
    695 		return;
    696 
    697 	ktp->ktr_fd = fd;
    698 	ktp->ktr_rw = rw;
    699 
    700 	cp = (void *)(ktp + 1);
    701 	buflen -= sizeof(struct ktr_genio);
    702 	kte->kte_kth.ktr_len = sizeof(struct ktr_genio);
    703 
    704 	while (buflen > 0) {
    705 		cnt = uimin(iov->iov_len, buflen);
    706 		if (copyin(iov->iov_base, cp, cnt) != 0)
    707 			goto out;
    708 		kte->kte_kth.ktr_len += cnt;
    709 		cp += cnt;
    710 		buflen -= cnt;
    711 		resid -= cnt;
    712 		iov->iov_len -= cnt;
    713 		if (iov->iov_len == 0)
    714 			iov++;
    715 		else
    716 			iov->iov_base = (char *)iov->iov_base + cnt;
    717 	}
    718 
    719 	/*
    720 	 * Don't push so many entry at once.  It will cause kmem map
    721 	 * shortage.
    722 	 */
    723 	ktraddentry(l, kte, KTA_WAITOK | KTA_LARGE);
    724 	if (resid > 0) {
    725 		if (preempt_needed()) {
    726 			(void)ktrenter(l);
    727 			preempt();
    728 			ktrexit(l);
    729 		}
    730 
    731 		goto next;
    732 	}
    733 
    734 	return;
    735 
    736 out:
    737 	ktefree(kte);
    738 	ktrexit(l);
    739 }
    740 
    741 void
    742 ktr_genio(int fd, enum uio_rw rw, const void *addr, size_t len, int error)
    743 {
    744 	lwp_t *l = curlwp;
    745 	struct iovec iov;
    746 
    747 	if (!KTRPOINT(l->l_proc, KTR_GENIO) || error != 0)
    748 		return;
    749 	iov.iov_base = __UNCONST(addr);
    750 	iov.iov_len = len;
    751 	ktr_io(l, fd, rw, &iov, len);
    752 }
    753 
    754 void
    755 ktr_geniov(int fd, enum uio_rw rw, struct iovec *iov, size_t len, int error)
    756 {
    757 	lwp_t *l = curlwp;
    758 
    759 	if (!KTRPOINT(l->l_proc, KTR_GENIO) || error != 0)
    760 		return;
    761 	ktr_io(l, fd, rw, iov, len);
    762 }
    763 
    764 void
    765 ktr_mibio(int fd, enum uio_rw rw, const void *addr, size_t len, int error)
    766 {
    767 	lwp_t *l = curlwp;
    768 	struct iovec iov;
    769 
    770 	if (!KTRPOINT(l->l_proc, KTR_MIB) || error != 0)
    771 		return;
    772 	iov.iov_base = __UNCONST(addr);
    773 	iov.iov_len = len;
    774 	ktr_io(l, fd, rw, &iov, len);
    775 }
    776 
    777 void
    778 ktr_psig(int sig, sig_t action, const sigset_t *mask,
    779 	 const ksiginfo_t *ksi)
    780 {
    781 	struct ktrace_entry *kte;
    782 	lwp_t *l = curlwp;
    783 	struct {
    784 		struct ktr_psig	kp;
    785 		siginfo_t	si;
    786 	} *kbuf;
    787 
    788 	if (!KTRPOINT(l->l_proc, KTR_PSIG))
    789 		return;
    790 
    791 	if (ktealloc(&kte, (void *)&kbuf, l, KTR_PSIG, sizeof(*kbuf)))
    792 		return;
    793 
    794 	memset(&kbuf->kp, 0, sizeof(kbuf->kp));
    795 	kbuf->kp.signo = (char)sig;
    796 	kbuf->kp.action = action;
    797 	kbuf->kp.mask = *mask;
    798 
    799 	if (ksi) {
    800 		kbuf->kp.code = KSI_TRAPCODE(ksi);
    801 		(void)memset(&kbuf->si, 0, sizeof(kbuf->si));
    802 		kbuf->si._info = ksi->ksi_info;
    803 		kte->kte_kth.ktr_len = sizeof(*kbuf);
    804 	} else {
    805 		kbuf->kp.code = 0;
    806 		kte->kte_kth.ktr_len = sizeof(struct ktr_psig);
    807 	}
    808 
    809 	ktraddentry(l, kte, KTA_WAITOK);
    810 }
    811 
    812 void
    813 ktr_csw(int out, int user, const struct syncobj *syncobj)
    814 {
    815 	lwp_t *l = curlwp;
    816 	struct proc *p = l->l_proc;
    817 	struct ktrace_entry *kte;
    818 	struct ktr_csw *kc;
    819 
    820 	if (!KTRPOINT(p, KTR_CSW))
    821 		return;
    822 
    823 	/*
    824 	 * Don't record context switches resulting from blocking on
    825 	 * locks; the results are not useful, and the mutex may be in a
    826 	 * softint, which would lead us to ktealloc in softint context,
    827 	 * which is forbidden.
    828 	 */
    829 	if (syncobj == &mutex_syncobj || syncobj == &rw_syncobj)
    830 		return;
    831 	KASSERT(!cpu_intr_p());
    832 	KASSERT(!cpu_softintr_p());
    833 
    834 	/*
    835 	 * We can't sleep if we're already going to sleep (if original
    836 	 * condition is met during sleep, we hang up).
    837 	 *
    838 	 * XXX This is not ideal: it would be better to maintain a pool
    839 	 * of ktes and actually push this to the kthread when context
    840 	 * switch happens, however given the points where we are called
    841 	 * from that is difficult to do.
    842 	 */
    843 	if (out) {
    844 		if (ktrenter(l))
    845 			return;
    846 
    847 		nanotime(&l->l_ktrcsw);
    848 		l->l_pflag |= LP_KTRCSW;
    849 		if (user)
    850 			l->l_pflag |= LP_KTRCSWUSER;
    851 		else
    852 			l->l_pflag &= ~LP_KTRCSWUSER;
    853 
    854 		ktrexit(l);
    855 		return;
    856 	}
    857 
    858 	/*
    859 	 * On the way back in, we need to record twice: once for entry, and
    860 	 * once for exit.
    861 	 */
    862 	if ((l->l_pflag & LP_KTRCSW) != 0) {
    863 		struct timespec *ts;
    864 		l->l_pflag &= ~LP_KTRCSW;
    865 
    866 		if (ktealloc(&kte, (void *)&kc, l, KTR_CSW, sizeof(*kc)))
    867 			return;
    868 
    869 		kc->out = 1;
    870 		kc->user = ((l->l_pflag & LP_KTRCSWUSER) != 0);
    871 
    872 		ts = &l->l_ktrcsw;
    873 		switch (KTRFAC_VERSION(p->p_traceflag)) {
    874 		case 0:
    875 			kte->kte_kth.ktr_otv.tv_sec = ts->tv_sec;
    876 			kte->kte_kth.ktr_otv.tv_usec = ts->tv_nsec / 1000;
    877 			break;
    878 		case 1:
    879 			kte->kte_kth.ktr_ots.tv_sec = ts->tv_sec;
    880 			kte->kte_kth.ktr_ots.tv_nsec = ts->tv_nsec;
    881 			break;
    882 		case 2:
    883 			kte->kte_kth.ktr_ts.tv_sec = ts->tv_sec;
    884 			kte->kte_kth.ktr_ts.tv_nsec = ts->tv_nsec;
    885 			break;
    886 		default:
    887 			break;
    888 		}
    889 
    890 		ktraddentry(l, kte, KTA_WAITOK);
    891 	}
    892 
    893 	if (ktealloc(&kte, (void *)&kc, l, KTR_CSW, sizeof(*kc)))
    894 		return;
    895 
    896 	kc->out = 0;
    897 	kc->user = user;
    898 
    899 	ktraddentry(l, kte, KTA_WAITOK);
    900 }
    901 
    902 bool
    903 ktr_point(int fac_bit)
    904 {
    905 	return curlwp->l_proc->p_traceflag & fac_bit;
    906 }
    907 
    908 int
    909 ktruser(const char *id, void *addr, size_t len, int ustr)
    910 {
    911 	struct ktrace_entry *kte;
    912 	struct ktr_user *ktp;
    913 	lwp_t *l = curlwp;
    914 	void *user_dta;
    915 	int error;
    916 
    917 	if (!KTRPOINT(l->l_proc, KTR_USER))
    918 		return 0;
    919 
    920 	if (len > KTR_USER_MAXLEN)
    921 		return ENOSPC;
    922 
    923 	error = ktealloc(&kte, (void *)&ktp, l, KTR_USER, sizeof(*ktp) + len);
    924 	if (error != 0)
    925 		return error;
    926 
    927 	if (ustr) {
    928 		if (copyinstr(id, ktp->ktr_id, KTR_USER_MAXIDLEN, NULL) != 0)
    929 			ktp->ktr_id[0] = '\0';
    930 	} else
    931 		strncpy(ktp->ktr_id, id, KTR_USER_MAXIDLEN);
    932 	ktp->ktr_id[KTR_USER_MAXIDLEN-1] = '\0';
    933 
    934 	user_dta = (void *)(ktp + 1);
    935 	if ((error = copyin(addr, user_dta, len)) != 0)
    936 		kte->kte_kth.ktr_len = 0;
    937 
    938 	ktraddentry(l, kte, KTA_WAITOK);
    939 	return error;
    940 }
    941 
    942 void
    943 ktr_kuser(const char *id, const void *addr, size_t len)
    944 {
    945 	struct ktrace_entry *kte;
    946 	struct ktr_user *ktp;
    947 	lwp_t *l = curlwp;
    948 	int error;
    949 
    950 	if (!KTRPOINT(l->l_proc, KTR_USER))
    951 		return;
    952 
    953 	if (len > KTR_USER_MAXLEN)
    954 		return;
    955 
    956 	error = ktealloc(&kte, (void *)&ktp, l, KTR_USER, sizeof(*ktp) + len);
    957 	if (error != 0)
    958 		return;
    959 
    960 	strncpy(ktp->ktr_id, id, KTR_USER_MAXIDLEN - 1);
    961 	ktp->ktr_id[KTR_USER_MAXIDLEN - 1] = '\0';
    962 
    963 	memcpy(ktp + 1, addr, len);
    964 
    965 	ktraddentry(l, kte, KTA_WAITOK);
    966 }
    967 
    968 void
    969 ktr_mib(const int *name, u_int namelen)
    970 {
    971 	struct ktrace_entry *kte;
    972 	int *namep;
    973 	size_t size;
    974 	lwp_t *l = curlwp;
    975 
    976 	if (!KTRPOINT(l->l_proc, KTR_MIB))
    977 		return;
    978 
    979 	size = namelen * sizeof(*name);
    980 
    981 	if (ktealloc(&kte, (void *)&namep, l, KTR_MIB, size))
    982 		return;
    983 
    984 	(void)memcpy(namep, name, namelen * sizeof(*name));
    985 
    986 	ktraddentry(l, kte, KTA_WAITOK);
    987 }
    988 
    989 /* Interface and common routines */
    990 
    991 int
    992 ktrace_common(lwp_t *curl, int ops, int facs, int pid, file_t **fpp)
    993 {
    994 	struct proc *p;
    995 	struct pgrp *pg;
    996 	struct ktr_desc *ktd = NULL, *nktd;
    997 	file_t *fp = *fpp;
    998 	int ret = 0;
    999 	int error = 0;
   1000 	int descend;
   1001 
   1002 	descend = ops & KTRFLAG_DESCEND;
   1003 	facs = facs & ~((unsigned) KTRFAC_PERSISTENT);
   1004 
   1005 	(void)ktrenter(curl);
   1006 
   1007 	switch (KTROP(ops)) {
   1008 
   1009 	case KTROP_CLEARFILE:
   1010 		/*
   1011 		 * Clear all uses of the tracefile
   1012 		 */
   1013 		mutex_enter(&ktrace_lock);
   1014 		ktd = ktd_lookup(fp);
   1015 		mutex_exit(&ktrace_lock);
   1016 		if (ktd == NULL)
   1017 			goto done;
   1018 		error = ktrderefall(ktd, 1);
   1019 		goto done;
   1020 
   1021 	case KTROP_SET:
   1022 		mutex_enter(&ktrace_lock);
   1023 		ktd = ktd_lookup(fp);
   1024 		mutex_exit(&ktrace_lock);
   1025 		if (ktd == NULL) {
   1026 			nktd = kmem_alloc(sizeof(*nktd), KM_SLEEP);
   1027 			TAILQ_INIT(&nktd->ktd_queue);
   1028 			callout_init(&nktd->ktd_wakch, CALLOUT_MPSAFE);
   1029 			cv_init(&nktd->ktd_cv, "ktrwait");
   1030 			cv_init(&nktd->ktd_sync_cv, "ktrsync");
   1031 			nktd->ktd_flags = 0;
   1032 			nktd->ktd_qcount = 0;
   1033 			nktd->ktd_error = 0;
   1034 			nktd->ktd_errcnt = 0;
   1035 			nktd->ktd_delayqcnt = ktd_delayqcnt;
   1036 			nktd->ktd_wakedelay = mstohz(ktd_wakedelay);
   1037 			nktd->ktd_intrwakdl = mstohz(ktd_intrwakdl);
   1038 			nktd->ktd_ref = 0;
   1039 			nktd->ktd_fp = fp;
   1040 			mutex_enter(&ktrace_lock);
   1041 			ktdref(nktd);
   1042 			mutex_exit(&ktrace_lock);
   1043 
   1044 			/*
   1045 			 * XXX: not correct.  needs a way to detect
   1046 			 * whether ktruss or ktrace.
   1047 			 */
   1048 			if (fp->f_type == DTYPE_PIPE)
   1049 				nktd->ktd_flags |= KTDF_INTERACTIVE;
   1050 
   1051 			mutex_enter(&fp->f_lock);
   1052 			fp->f_count++;
   1053 			mutex_exit(&fp->f_lock);
   1054 			error = kthread_create(PRI_NONE, KTHREAD_MPSAFE, NULL,
   1055 			    ktrace_thread, nktd, &nktd->ktd_lwp, "ktrace");
   1056 			if (error != 0) {
   1057 				kmem_free(nktd, sizeof(*nktd));
   1058 				nktd = NULL;
   1059 				mutex_enter(&fp->f_lock);
   1060 				fp->f_count--;
   1061 				mutex_exit(&fp->f_lock);
   1062 				goto done;
   1063 			}
   1064 
   1065 			mutex_enter(&ktrace_lock);
   1066 			ktd = ktd_lookup(fp);
   1067 			if (ktd != NULL) {
   1068 				ktdrel(nktd);
   1069 				nktd = NULL;
   1070 			} else {
   1071 				TAILQ_INSERT_TAIL(&ktdq, nktd, ktd_list);
   1072 				ktd = nktd;
   1073 			}
   1074 			mutex_exit(&ktrace_lock);
   1075 		}
   1076 		break;
   1077 
   1078 	case KTROP_CLEAR:
   1079 		break;
   1080 	}
   1081 
   1082 	/*
   1083 	 * need something to (un)trace (XXX - why is this here?)
   1084 	 */
   1085 	if (!facs) {
   1086 		error = EINVAL;
   1087 		*fpp = NULL;
   1088 		goto done;
   1089 	}
   1090 
   1091 	/*
   1092 	 * do it
   1093 	 */
   1094 	mutex_enter(&proc_lock);
   1095 	if (pid < 0) {
   1096 		/*
   1097 		 * by process group
   1098 		 */
   1099 		if (pid == INT_MIN)
   1100 			pg = NULL;
   1101 		else
   1102 			pg = pgrp_find(-pid);
   1103 		if (pg == NULL)
   1104 			error = ESRCH;
   1105 		else {
   1106 			LIST_FOREACH(p, &pg->pg_members, p_pglist) {
   1107 				if (descend)
   1108 					ret |= ktrsetchildren(curl, p, ops,
   1109 					    facs, ktd);
   1110 				else
   1111 					ret |= ktrops(curl, p, ops, facs,
   1112 					    ktd);
   1113 			}
   1114 		}
   1115 
   1116 	} else {
   1117 		/*
   1118 		 * by pid
   1119 		 */
   1120 		p = proc_find(pid);
   1121 		if (p == NULL)
   1122 			error = ESRCH;
   1123 		else if (descend)
   1124 			ret |= ktrsetchildren(curl, p, ops, facs, ktd);
   1125 		else
   1126 			ret |= ktrops(curl, p, ops, facs, ktd);
   1127 	}
   1128 	mutex_exit(&proc_lock);
   1129 	if (error == 0 && !ret)
   1130 		error = EPERM;
   1131 	*fpp = NULL;
   1132 done:
   1133 	if (ktd != NULL) {
   1134 		mutex_enter(&ktrace_lock);
   1135 		if (error != 0) {
   1136 			/*
   1137 			 * Wakeup the thread so that it can be die if we
   1138 			 * can't trace any process.
   1139 			 */
   1140 			ktd_wakeup(ktd);
   1141 		}
   1142 		if (KTROP(ops) == KTROP_SET || KTROP(ops) == KTROP_CLEARFILE)
   1143 			ktdrel(ktd);
   1144 		mutex_exit(&ktrace_lock);
   1145 	}
   1146 	ktrexit(curl);
   1147 	return (error);
   1148 }
   1149 
   1150 /*
   1151  * fktrace system call
   1152  */
   1153 /* ARGSUSED */
   1154 int
   1155 sys_fktrace(struct lwp *l, const struct sys_fktrace_args *uap,
   1156     register_t *retval)
   1157 {
   1158 	/* {
   1159 		syscallarg(int) fd;
   1160 		syscallarg(int) ops;
   1161 		syscallarg(int) facs;
   1162 		syscallarg(int) pid;
   1163 	} */
   1164 	file_t *fp;
   1165 	int error, fd;
   1166 
   1167 	fd = SCARG(uap, fd);
   1168 	if ((fp = fd_getfile(fd)) == NULL)
   1169 		return (EBADF);
   1170 	if ((fp->f_flag & FWRITE) == 0)
   1171 		error = EBADF;
   1172 	else
   1173 		error = ktrace_common(l, SCARG(uap, ops),
   1174 		    SCARG(uap, facs), SCARG(uap, pid), &fp);
   1175 	fd_putfile(fd);
   1176 	return error;
   1177 }
   1178 
   1179 static int
   1180 ktrops(lwp_t *curl, struct proc *p, int ops, int facs,
   1181     struct ktr_desc *ktd)
   1182 {
   1183 	int vers = ops & KTRFAC_VER_MASK;
   1184 	int error = 0;
   1185 
   1186 	mutex_enter(p->p_lock);
   1187 	mutex_enter(&ktrace_lock);
   1188 
   1189 	if (!ktrcanset(curl, p))
   1190 		goto out;
   1191 
   1192 	switch (vers) {
   1193 	case KTRFACv0:
   1194 	case KTRFACv1:
   1195 	case KTRFACv2:
   1196 		break;
   1197 	default:
   1198 		error = EINVAL;
   1199 		goto out;
   1200 	}
   1201 
   1202 	if (KTROP(ops) == KTROP_SET) {
   1203 		if (p->p_tracep != ktd) {
   1204 			/*
   1205 			 * if trace file already in use, relinquish
   1206 			 */
   1207 			ktrderef(p);
   1208 			p->p_tracep = ktd;
   1209 			ktradref(p);
   1210 		}
   1211 		p->p_traceflag |= facs;
   1212 		if (kauth_authorize_process(curl->l_cred, KAUTH_PROCESS_KTRACE,
   1213 		    p, KAUTH_ARG(KAUTH_REQ_PROCESS_KTRACE_PERSISTENT), NULL,
   1214 		    NULL) == 0)
   1215 			p->p_traceflag |= KTRFAC_PERSISTENT;
   1216 	} else {
   1217 		/* KTROP_CLEAR */
   1218 		if (((p->p_traceflag &= ~facs) & KTRFAC_MASK) == 0) {
   1219 			/* no more tracing */
   1220 			ktrderef(p);
   1221 		}
   1222 	}
   1223 
   1224 	if (p->p_traceflag)
   1225 		p->p_traceflag |= vers;
   1226 	/*
   1227 	 * Emit an emulation record, every time there is a ktrace
   1228 	 * change/attach request.
   1229 	 */
   1230 	if (KTRPOINT(p, KTR_EMUL))
   1231 		p->p_traceflag |= KTRFAC_TRC_EMUL;
   1232 
   1233 	p->p_trace_enabled = trace_is_enabled(p);
   1234 #ifdef __HAVE_SYSCALL_INTERN
   1235 	(*p->p_emul->e_syscall_intern)(p);
   1236 #endif
   1237 
   1238  out:
   1239 	mutex_exit(&ktrace_lock);
   1240 	mutex_exit(p->p_lock);
   1241 
   1242 	return error ? 0 : 1;
   1243 }
   1244 
   1245 static int
   1246 ktrsetchildren(lwp_t *curl, struct proc *top, int ops, int facs,
   1247     struct ktr_desc *ktd)
   1248 {
   1249 	struct proc *p;
   1250 	int ret = 0;
   1251 
   1252 	KASSERT(mutex_owned(&proc_lock));
   1253 
   1254 	p = top;
   1255 	for (;;) {
   1256 		ret |= ktrops(curl, p, ops, facs, ktd);
   1257 		/*
   1258 		 * If this process has children, descend to them next,
   1259 		 * otherwise do any siblings, and if done with this level,
   1260 		 * follow back up the tree (but not past top).
   1261 		 */
   1262 		if (LIST_FIRST(&p->p_children) != NULL) {
   1263 			p = LIST_FIRST(&p->p_children);
   1264 			continue;
   1265 		}
   1266 		for (;;) {
   1267 			if (p == top)
   1268 				return (ret);
   1269 			if (LIST_NEXT(p, p_sibling) != NULL) {
   1270 				p = LIST_NEXT(p, p_sibling);
   1271 				break;
   1272 			}
   1273 			p = p->p_pptr;
   1274 		}
   1275 	}
   1276 	/*NOTREACHED*/
   1277 }
   1278 
   1279 static void
   1280 ktrwrite(struct ktr_desc *ktd, struct ktrace_entry *kte)
   1281 {
   1282 	size_t hlen;
   1283 	struct uio auio;
   1284 	struct iovec aiov[64], *iov;
   1285 	struct ktrace_entry *top = kte;
   1286 	struct ktr_header *kth;
   1287 	file_t *fp = ktd->ktd_fp;
   1288 	int error;
   1289 next:
   1290 	auio.uio_iov = iov = &aiov[0];
   1291 	auio.uio_offset = 0;
   1292 	auio.uio_rw = UIO_WRITE;
   1293 	auio.uio_resid = 0;
   1294 	auio.uio_iovcnt = 0;
   1295 	UIO_SETUP_SYSSPACE(&auio);
   1296 	do {
   1297 		struct timespec ts;
   1298 		lwpid_t lid;
   1299 		kth = &kte->kte_kth;
   1300 
   1301 		hlen = sizeof(struct ktr_header);
   1302 		switch (kth->ktr_version) {
   1303 		case 0:
   1304 			ts = kth->ktr_time;
   1305 
   1306 			kth->ktr_otv.tv_sec = ts.tv_sec;
   1307 			kth->ktr_otv.tv_usec = ts.tv_nsec / 1000;
   1308 			kth->ktr_unused = NULL;
   1309 			hlen -= sizeof(kth->_v) -
   1310 			    MAX(sizeof(kth->_v._v0), sizeof(kth->_v._v1));
   1311 			break;
   1312 		case 1:
   1313 			ts = kth->ktr_time;
   1314 			lid = kth->ktr_lid;
   1315 
   1316 			kth->ktr_ots.tv_sec = ts.tv_sec;
   1317 			kth->ktr_ots.tv_nsec = ts.tv_nsec;
   1318 			kth->ktr_olid = lid;
   1319 			hlen -= sizeof(kth->_v) -
   1320 			    MAX(sizeof(kth->_v._v0), sizeof(kth->_v._v1));
   1321 			break;
   1322 		}
   1323 		iov->iov_base = (void *)kth;
   1324 		iov++->iov_len = hlen;
   1325 		auio.uio_resid += hlen;
   1326 		auio.uio_iovcnt++;
   1327 		if (kth->ktr_len > 0) {
   1328 			iov->iov_base = kte->kte_buf;
   1329 			iov++->iov_len = kth->ktr_len;
   1330 			auio.uio_resid += kth->ktr_len;
   1331 			auio.uio_iovcnt++;
   1332 		}
   1333 	} while ((kte = TAILQ_NEXT(kte, kte_list)) != NULL &&
   1334 	    auio.uio_iovcnt < sizeof(aiov) / sizeof(aiov[0]) - 1);
   1335 
   1336 again:
   1337 	error = (*fp->f_ops->fo_write)(fp, &fp->f_offset, &auio,
   1338 	    fp->f_cred, FOF_UPDATE_OFFSET);
   1339 	switch (error) {
   1340 
   1341 	case 0:
   1342 		if (auio.uio_resid > 0)
   1343 			goto again;
   1344 		if (kte != NULL)
   1345 			goto next;
   1346 		break;
   1347 
   1348 	case EWOULDBLOCK:
   1349 		kpause("ktrzzz", false, 1, NULL);
   1350 		goto again;
   1351 
   1352 	default:
   1353 		/*
   1354 		 * If error encountered, give up tracing on this
   1355 		 * vnode.  Don't report EPIPE as this can easily
   1356 		 * happen with fktrace()/ktruss.
   1357 		 */
   1358 #ifndef DEBUG
   1359 		if (error != EPIPE)
   1360 #endif
   1361 			log(LOG_NOTICE,
   1362 			    "ktrace write failed, errno %d, tracing stopped\n",
   1363 			    error);
   1364 		(void)ktrderefall(ktd, 0);
   1365 	}
   1366 
   1367 	while ((kte = top) != NULL) {
   1368 		top = TAILQ_NEXT(top, kte_list);
   1369 		ktefree(kte);
   1370 	}
   1371 }
   1372 
   1373 static void
   1374 ktrace_thread(void *arg)
   1375 {
   1376 	struct ktr_desc *ktd = arg;
   1377 	file_t *fp = ktd->ktd_fp;
   1378 	struct ktrace_entry *kte;
   1379 	int ktrerr, errcnt;
   1380 
   1381 	mutex_enter(&ktrace_lock);
   1382 	for (;;) {
   1383 		kte = TAILQ_FIRST(&ktd->ktd_queue);
   1384 		if (kte == NULL) {
   1385 			if (ktd->ktd_flags & KTDF_WAIT) {
   1386 				ktd->ktd_flags &= ~(KTDF_WAIT | KTDF_BLOCKING);
   1387 				cv_broadcast(&ktd->ktd_sync_cv);
   1388 			}
   1389 			if (ktd->ktd_ref == 0)
   1390 				break;
   1391 			cv_wait(&ktd->ktd_cv, &ktrace_lock);
   1392 			continue;
   1393 		}
   1394 		TAILQ_INIT(&ktd->ktd_queue);
   1395 		ktd->ktd_qcount = 0;
   1396 		ktrerr = ktd->ktd_error;
   1397 		errcnt = ktd->ktd_errcnt;
   1398 		ktd->ktd_error = ktd->ktd_errcnt = 0;
   1399 		mutex_exit(&ktrace_lock);
   1400 
   1401 		if (ktrerr) {
   1402 			log(LOG_NOTICE,
   1403 			    "ktrace failed, fp %p, error 0x%x, total %d\n",
   1404 			    fp, ktrerr, errcnt);
   1405 		}
   1406 		ktrwrite(ktd, kte);
   1407 		mutex_enter(&ktrace_lock);
   1408 	}
   1409 
   1410 	if (ktd_lookup(ktd->ktd_fp) == ktd) {
   1411 		TAILQ_REMOVE(&ktdq, ktd, ktd_list);
   1412 	} else {
   1413 		/* nothing, collision in KTROP_SET */
   1414 	}
   1415 
   1416 	callout_halt(&ktd->ktd_wakch, &ktrace_lock);
   1417 	callout_destroy(&ktd->ktd_wakch);
   1418 	mutex_exit(&ktrace_lock);
   1419 
   1420 	/*
   1421 	 * ktrace file descriptor can't be watched (are not visible to
   1422 	 * userspace), so no kqueue stuff here
   1423 	 * XXX: The above comment is wrong, because the fktrace file
   1424 	 * descriptor is available in userland.
   1425 	 */
   1426 	closef(fp);
   1427 
   1428 	cv_destroy(&ktd->ktd_sync_cv);
   1429 	cv_destroy(&ktd->ktd_cv);
   1430 
   1431 	kmem_free(ktd, sizeof(*ktd));
   1432 
   1433 	kthread_exit(0);
   1434 }
   1435 
   1436 /*
   1437  * Return true if caller has permission to set the ktracing state
   1438  * of target.  Essentially, the target can't possess any
   1439  * more permissions than the caller.  KTRFAC_PERSISTENT signifies that
   1440  * the tracing will persist on sugid processes during exec; it is only
   1441  * settable by a process with appropriate credentials.
   1442  *
   1443  * TODO: check groups.  use caller effective gid.
   1444  */
   1445 static int
   1446 ktrcanset(lwp_t *calll, struct proc *targetp)
   1447 {
   1448 	KASSERT(mutex_owned(targetp->p_lock));
   1449 	KASSERT(mutex_owned(&ktrace_lock));
   1450 
   1451 	if (kauth_authorize_process(calll->l_cred, KAUTH_PROCESS_KTRACE,
   1452 	    targetp, NULL, NULL, NULL) == 0)
   1453 		return (1);
   1454 
   1455 	return (0);
   1456 }
   1457 
   1458 /*
   1459  * Put user defined entry to ktrace records.
   1460  */
   1461 int
   1462 sys_utrace(struct lwp *l, const struct sys_utrace_args *uap, register_t *retval)
   1463 {
   1464 	/* {
   1465 		syscallarg(const char *) label;
   1466 		syscallarg(void *) addr;
   1467 		syscallarg(size_t) len;
   1468 	} */
   1469 
   1470 	return ktruser(SCARG(uap, label), SCARG(uap, addr),
   1471 	    SCARG(uap, len), 1);
   1472 }
   1473