Home | History | Annotate | Line # | Download | only in kern
sys_ptrace_common.c revision 1.24
      1 /*	$NetBSD: sys_ptrace_common.c,v 1.24 2017/12/07 15:21:34 christos Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Andrew Doran.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*-
     33  * Copyright (c) 1982, 1986, 1989, 1993
     34  *	The Regents of the University of California.  All rights reserved.
     35  * (c) UNIX System Laboratories, Inc.
     36  * All or some portions of this file are derived from material licensed
     37  * to the University of California by American Telephone and Telegraph
     38  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
     39  * the permission of UNIX System Laboratories, Inc.
     40  *
     41  * This code is derived from software contributed to Berkeley by
     42  * Jan-Simon Pendry.
     43  *
     44  * Redistribution and use in source and binary forms, with or without
     45  * modification, are permitted provided that the following conditions
     46  * are met:
     47  * 1. Redistributions of source code must retain the above copyright
     48  *    notice, this list of conditions and the following disclaimer.
     49  * 2. Redistributions in binary form must reproduce the above copyright
     50  *    notice, this list of conditions and the following disclaimer in the
     51  *    documentation and/or other materials provided with the distribution.
     52  * 3. Neither the name of the University nor the names of its contributors
     53  *    may be used to endorse or promote products derived from this software
     54  *    without specific prior written permission.
     55  *
     56  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     57  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     58  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     59  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     60  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     61  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     62  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     63  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     64  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     65  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     66  * SUCH DAMAGE.
     67  *
     68  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
     69  */
     70 
     71 /*-
     72  * Copyright (c) 1993 Jan-Simon Pendry.
     73  * Copyright (c) 1994 Christopher G. Demetriou.  All rights reserved.
     74  *
     75  * This code is derived from software contributed to Berkeley by
     76  * Jan-Simon Pendry.
     77  *
     78  * Redistribution and use in source and binary forms, with or without
     79  * modification, are permitted provided that the following conditions
     80  * are met:
     81  * 1. Redistributions of source code must retain the above copyright
     82  *    notice, this list of conditions and the following disclaimer.
     83  * 2. Redistributions in binary form must reproduce the above copyright
     84  *    notice, this list of conditions and the following disclaimer in the
     85  *    documentation and/or other materials provided with the distribution.
     86  * 3. All advertising materials mentioning features or use of this software
     87  *    must display the following acknowledgement:
     88  *	This product includes software developed by the University of
     89  *	California, Berkeley and its contributors.
     90  * 4. Neither the name of the University nor the names of its contributors
     91  *    may be used to endorse or promote products derived from this software
     92  *    without specific prior written permission.
     93  *
     94  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     95  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     96  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     97  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     98  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     99  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
    100  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
    101  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
    102  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
    103  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
    104  * SUCH DAMAGE.
    105  *
    106  *	from: @(#)sys_process.c	8.1 (Berkeley) 6/10/93
    107  */
    108 
    109 /*
    110  * References:
    111  *	(1) Bach's "The Design of the UNIX Operating System",
    112  *	(2) sys/miscfs/procfs from UCB's 4.4BSD-Lite distribution,
    113  *	(3) the "4.4BSD Programmer's Reference Manual" published
    114  *		by USENIX and O'Reilly & Associates.
    115  * The 4.4BSD PRM does a reasonably good job of documenting what the various
    116  * ptrace() requests should actually do, and its text is quoted several times
    117  * in this file.
    118  */
    119 
    120 #include <sys/cdefs.h>
    121 __KERNEL_RCSID(0, "$NetBSD: sys_ptrace_common.c,v 1.24 2017/12/07 15:21:34 christos Exp $");
    122 
    123 #ifdef _KERNEL_OPT
    124 #include "opt_ptrace.h"
    125 #include "opt_ktrace.h"
    126 #include "opt_pax.h"
    127 #include "opt_compat_netbsd32.h"
    128 #endif
    129 
    130 #include <sys/param.h>
    131 #include <sys/systm.h>
    132 #include <sys/proc.h>
    133 #include <sys/errno.h>
    134 #include <sys/exec.h>
    135 #include <sys/pax.h>
    136 #include <sys/ptrace.h>
    137 #include <sys/uio.h>
    138 #include <sys/ras.h>
    139 #include <sys/kmem.h>
    140 #include <sys/kauth.h>
    141 #include <sys/mount.h>
    142 #include <sys/syscallargs.h>
    143 #include <sys/module.h>
    144 #include <sys/condvar.h>
    145 #include <sys/mutex.h>
    146 
    147 #include <uvm/uvm_extern.h>
    148 
    149 #include <machine/reg.h>
    150 
    151 #ifdef PTRACE
    152 
    153 # ifdef DEBUG
    154 #  define DPRINTF(a) uprintf a
    155 # else
    156 #  define DPRINTF(a)
    157 # endif
    158 
    159 static kauth_listener_t ptrace_listener;
    160 static int process_auxv_offset(struct proc *, struct uio *);
    161 
    162 #if 0
    163 static int ptrace_cbref;
    164 static kmutex_t ptrace_mtx;
    165 static kcondvar_t ptrace_cv;
    166 #endif
    167 
    168 static int
    169 ptrace_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
    170     void *arg0, void *arg1, void *arg2, void *arg3)
    171 {
    172 	struct proc *p;
    173 	int result;
    174 
    175 	result = KAUTH_RESULT_DEFER;
    176 	p = arg0;
    177 
    178 #if 0
    179 	mutex_enter(&ptrace_mtx);
    180 	ptrace_cbref++;
    181 	mutex_exit(&ptrace_mtx);
    182 #endif
    183 	if (action != KAUTH_PROCESS_PTRACE)
    184 		goto out;
    185 
    186 	switch ((u_long)arg1) {
    187 	case PT_TRACE_ME:
    188 	case PT_ATTACH:
    189 	case PT_WRITE_I:
    190 	case PT_WRITE_D:
    191 	case PT_READ_I:
    192 	case PT_READ_D:
    193 	case PT_IO:
    194 #ifdef PT_GETREGS
    195 	case PT_GETREGS:
    196 #endif
    197 #ifdef PT_SETREGS
    198 	case PT_SETREGS:
    199 #endif
    200 #ifdef PT_GETFPREGS
    201 	case PT_GETFPREGS:
    202 #endif
    203 #ifdef PT_SETFPREGS
    204 	case PT_SETFPREGS:
    205 #endif
    206 #ifdef PT_GETDBREGS
    207 	case PT_GETDBREGS:
    208 #endif
    209 #ifdef PT_SETDBREGS
    210 	case PT_SETDBREGS:
    211 #endif
    212 	case PT_SET_EVENT_MASK:
    213 	case PT_GET_EVENT_MASK:
    214 	case PT_GET_PROCESS_STATE:
    215 	case PT_SET_SIGINFO:
    216 	case PT_GET_SIGINFO:
    217 	case PT_SET_SIGMASK:
    218 	case PT_GET_SIGMASK:
    219 #ifdef __HAVE_PTRACE_MACHDEP
    220 	PTRACE_MACHDEP_REQUEST_CASES
    221 #endif
    222 		if (kauth_cred_getuid(cred) != kauth_cred_getuid(p->p_cred) ||
    223 		    ISSET(p->p_flag, PK_SUGID)) {
    224 			break;
    225 		}
    226 
    227 		result = KAUTH_RESULT_ALLOW;
    228 
    229 	break;
    230 
    231 #ifdef PT_STEP
    232 	case PT_STEP:
    233 	case PT_SETSTEP:
    234 	case PT_CLEARSTEP:
    235 #endif
    236 	case PT_CONTINUE:
    237 	case PT_KILL:
    238 	case PT_DETACH:
    239 	case PT_LWPINFO:
    240 	case PT_SYSCALL:
    241 	case PT_SYSCALLEMU:
    242 	case PT_DUMPCORE:
    243 	case PT_RESUME:
    244 	case PT_SUSPEND:
    245 		result = KAUTH_RESULT_ALLOW;
    246 		break;
    247 
    248 	default:
    249 		break;
    250 	}
    251 
    252  out:
    253 #if 0
    254 	mutex_enter(&ptrace_mtx);
    255 	if (--ptrace_cbref == 0)
    256 		cv_broadcast(&ptrace_cv);
    257 	mutex_exit(&ptrace_mtx);
    258 #endif
    259 
    260 	return result;
    261 }
    262 
    263 int
    264 ptrace_init(void)
    265 {
    266 
    267 #if 0
    268 	mutex_init(&ptrace_mtx, MUTEX_DEFAULT, IPL_NONE);
    269 	cv_init(&ptrace_cv, "ptracecb");
    270 	ptrace_cbref = 0;
    271 #endif
    272 	ptrace_listener = kauth_listen_scope(KAUTH_SCOPE_PROCESS,
    273 	    ptrace_listener_cb, NULL);
    274 	return 0;
    275 }
    276 
    277 int
    278 ptrace_fini(void)
    279 {
    280 
    281 	kauth_unlisten_scope(ptrace_listener);
    282 
    283 #if 0
    284 	/* Make sure no-one is executing our kauth listener */
    285 
    286 	mutex_enter(&ptrace_mtx);
    287 	while (ptrace_cbref != 0)
    288 		cv_wait(&ptrace_cv, &ptrace_mtx);
    289 	mutex_exit(&ptrace_mtx);
    290 	mutex_destroy(&ptrace_mtx);
    291 	cv_destroy(&ptrace_cv);
    292 #endif
    293 
    294 	return 0;
    295 }
    296 
    297 int
    298 do_ptrace(struct ptrace_methods *ptm, struct lwp *l, int req, pid_t pid,
    299     void *addr, int data, register_t *retval)
    300 {
    301 	struct proc *p = l->l_proc;
    302 	struct lwp *lt;
    303 	struct lwp *lt2;
    304 	struct proc *t;				/* target process */
    305 	struct uio uio;
    306 	struct iovec iov;
    307 	struct ptrace_io_desc piod;
    308 	struct ptrace_event pe;
    309 	struct ptrace_state ps;
    310 	struct ptrace_lwpinfo pl;
    311 	struct ptrace_siginfo psi;
    312 	struct vmspace *vm;
    313 	int error, write, tmp, pheld;
    314 	int signo = 0;
    315 	int resume_all;
    316 	ksiginfo_t ksi;
    317 	char *path;
    318 	int len = 0;
    319 	error = 0;
    320 
    321 	/*
    322 	 * If attaching or detaching, we need to get a write hold on the
    323 	 * proclist lock so that we can re-parent the target process.
    324 	 */
    325 	mutex_enter(proc_lock);
    326 
    327 	/* "A foolish consistency..." XXX */
    328 	if (req == PT_TRACE_ME) {
    329 		t = p;
    330 		mutex_enter(t->p_lock);
    331 	} else {
    332 		/* Find the process we're supposed to be operating on. */
    333 		t = proc_find(pid);
    334 		if (t == NULL) {
    335 			mutex_exit(proc_lock);
    336 			return ESRCH;
    337 		}
    338 
    339 		/* XXX-elad */
    340 		mutex_enter(t->p_lock);
    341 		error = kauth_authorize_process(l->l_cred, KAUTH_PROCESS_CANSEE,
    342 		    t, KAUTH_ARG(KAUTH_REQ_PROCESS_CANSEE_ENTRY), NULL, NULL);
    343 		if (error) {
    344 			mutex_exit(proc_lock);
    345 			mutex_exit(t->p_lock);
    346 			return ESRCH;
    347 		}
    348 	}
    349 
    350 	/*
    351 	 * Grab a reference on the process to prevent it from execing or
    352 	 * exiting.
    353 	 */
    354 	if (!rw_tryenter(&t->p_reflock, RW_READER)) {
    355 		mutex_exit(proc_lock);
    356 		mutex_exit(t->p_lock);
    357 		return EBUSY;
    358 	}
    359 
    360 	/* Make sure we can operate on it. */
    361 	switch (req) {
    362 	case  PT_TRACE_ME:
    363 		/* Saying that you're being traced is always legal. */
    364 		break;
    365 
    366 	case  PT_ATTACH:
    367 		/*
    368 		 * You can't attach to a process if:
    369 		 *	(1) it's the process that's doing the attaching,
    370 		 */
    371 		if (t->p_pid == p->p_pid) {
    372 			error = EINVAL;
    373 			break;
    374 		}
    375 
    376 		/*
    377 		 *  (2) it's a system process
    378 		 */
    379 		if (t->p_flag & PK_SYSTEM) {
    380 			error = EPERM;
    381 			break;
    382 		}
    383 
    384 		/*
    385 		 *	(3) it's already being traced, or
    386 		 */
    387 		if (ISSET(t->p_slflag, PSL_TRACED)) {
    388 			error = EBUSY;
    389 			break;
    390 		}
    391 
    392 		/*
    393 		 * 	(4) the tracer is chrooted, and its root directory is
    394 		 * 	    not at or above the root directory of the tracee
    395 		 */
    396 		mutex_exit(t->p_lock);	/* XXXSMP */
    397 		tmp = proc_isunder(t, l);
    398 		mutex_enter(t->p_lock);	/* XXXSMP */
    399 		if (!tmp) {
    400 			error = EPERM;
    401 			break;
    402 		}
    403 		break;
    404 
    405 	case  PT_READ_I:
    406 	case  PT_READ_D:
    407 	case  PT_WRITE_I:
    408 	case  PT_WRITE_D:
    409 	case  PT_IO:
    410 	case  PT_SET_SIGINFO:
    411 	case  PT_GET_SIGINFO:
    412 	case  PT_SET_SIGMASK:
    413 	case  PT_GET_SIGMASK:
    414 #ifdef PT_GETREGS
    415 	case  PT_GETREGS:
    416 #endif
    417 #ifdef PT_SETREGS
    418 	case  PT_SETREGS:
    419 #endif
    420 #ifdef PT_GETFPREGS
    421 	case  PT_GETFPREGS:
    422 #endif
    423 #ifdef PT_SETFPREGS
    424 	case  PT_SETFPREGS:
    425 #endif
    426 #ifdef PT_GETDBREGS
    427 	case  PT_GETDBREGS:
    428 #endif
    429 #ifdef PT_SETDBREGS
    430 	case  PT_SETDBREGS:
    431 #endif
    432 #ifdef __HAVE_PTRACE_MACHDEP
    433 	PTRACE_MACHDEP_REQUEST_CASES
    434 #endif
    435 		/*
    436 		 * You can't read/write the memory or registers of a process
    437 		 * if the tracer is chrooted, and its root directory is not at
    438 		 * or above the root directory of the tracee.
    439 		 */
    440 		mutex_exit(t->p_lock);	/* XXXSMP */
    441 		tmp = proc_isunder(t, l);
    442 		mutex_enter(t->p_lock);	/* XXXSMP */
    443 		if (!tmp) {
    444 			error = EPERM;
    445 			break;
    446 		}
    447 		/*FALLTHROUGH*/
    448 
    449 	case  PT_CONTINUE:
    450 	case  PT_KILL:
    451 	case  PT_DETACH:
    452 	case  PT_LWPINFO:
    453 	case  PT_SYSCALL:
    454 	case  PT_SYSCALLEMU:
    455 	case  PT_DUMPCORE:
    456 #ifdef PT_STEP
    457 	case  PT_STEP:
    458 	case  PT_SETSTEP:
    459 	case  PT_CLEARSTEP:
    460 #endif
    461 	case  PT_SET_EVENT_MASK:
    462 	case  PT_GET_EVENT_MASK:
    463 	case  PT_GET_PROCESS_STATE:
    464 	case  PT_RESUME:
    465 	case  PT_SUSPEND:
    466 		/*
    467 		 * You can't do what you want to the process if:
    468 		 *	(1) It's not being traced at all,
    469 		 */
    470 		if (!ISSET(t->p_slflag, PSL_TRACED)) {
    471 			error = EPERM;
    472 			break;
    473 		}
    474 
    475 		/*
    476 		 *	(2) it's not being traced by _you_, or
    477 		 */
    478 		if (t->p_pptr != p) {
    479 			DPRINTF(("parent %d != %d\n", t->p_pptr->p_pid,
    480 			    p->p_pid));
    481 			error = EBUSY;
    482 			break;
    483 		}
    484 
    485 		/*
    486 		 *	(3) it's not currently stopped.
    487 		 */
    488 		if (t->p_stat != SSTOP || !t->p_waited /* XXXSMP */) {
    489 			DPRINTF(("stat %d flag %d\n", t->p_stat,
    490 			    !t->p_waited));
    491 			error = EBUSY;
    492 			break;
    493 		}
    494 		break;
    495 
    496 	default:			/* It was not a legal request. */
    497 		error = EINVAL;
    498 		break;
    499 	}
    500 
    501 	if (error == 0) {
    502 		error = kauth_authorize_process(l->l_cred,
    503 		    KAUTH_PROCESS_PTRACE, t, KAUTH_ARG(req),
    504 		    NULL, NULL);
    505 	}
    506 	if (error == 0) {
    507 		lt = lwp_find_first(t);
    508 		if (lt == NULL)
    509 			error = ESRCH;
    510 	}
    511 
    512 	if (error != 0) {
    513 		mutex_exit(proc_lock);
    514 		mutex_exit(t->p_lock);
    515 		rw_exit(&t->p_reflock);
    516 		return error;
    517 	}
    518 
    519 	/* Do single-step fixup if needed. */
    520 	FIX_SSTEP(t);
    521 	KASSERT(lt != NULL);
    522 	lwp_addref(lt);
    523 
    524 	/*
    525 	 * Which locks do we need held? XXX Ugly.
    526 	 */
    527 	switch (req) {
    528 #ifdef PT_STEP
    529 	case PT_STEP:
    530 #endif
    531 	case PT_CONTINUE:
    532 	case PT_DETACH:
    533 	case PT_KILL:
    534 	case PT_SYSCALL:
    535 	case PT_SYSCALLEMU:
    536 	case PT_ATTACH:
    537 	case PT_TRACE_ME:
    538 		pheld = 1;
    539 		break;
    540 	default:
    541 		mutex_exit(proc_lock);
    542 		mutex_exit(t->p_lock);
    543 		pheld = 0;
    544 		break;
    545 	}
    546 
    547 	/* Now do the operation. */
    548 	write = 0;
    549 	*retval = 0;
    550 	tmp = 0;
    551 	resume_all = 1;
    552 
    553 	switch (req) {
    554 	case  PT_TRACE_ME:
    555 		/* Just set the trace flag. */
    556 		SET(t->p_slflag, PSL_TRACED);
    557 		t->p_opptr = t->p_pptr;
    558 		break;
    559 
    560 	case  PT_WRITE_I:		/* XXX no separate I and D spaces */
    561 	case  PT_WRITE_D:
    562 #if defined(__HAVE_RAS)
    563 		/*
    564 		 * Can't write to a RAS
    565 		 */
    566 		if (ras_lookup(t, addr) != (void *)-1) {
    567 			error = EACCES;
    568 			break;
    569 		}
    570 #endif
    571 		write = 1;
    572 		tmp = data;
    573 		/* FALLTHROUGH */
    574 
    575 	case  PT_READ_I:		/* XXX no separate I and D spaces */
    576 	case  PT_READ_D:
    577 		/* write = 0 done above. */
    578 		iov.iov_base = (void *)&tmp;
    579 		iov.iov_len = sizeof(tmp);
    580 		uio.uio_iov = &iov;
    581 		uio.uio_iovcnt = 1;
    582 		uio.uio_offset = (off_t)(unsigned long)addr;
    583 		uio.uio_resid = sizeof(tmp);
    584 		uio.uio_rw = write ? UIO_WRITE : UIO_READ;
    585 		UIO_SETUP_SYSSPACE(&uio);
    586 
    587 		error = process_domem(l, lt, &uio);
    588 		if (!write)
    589 			*retval = tmp;
    590 		break;
    591 
    592 	case  PT_IO:
    593 		error = ptm->ptm_copyinpiod(&piod, addr);
    594 		if (error)
    595 			break;
    596 
    597 		iov.iov_base = piod.piod_addr;
    598 		iov.iov_len = piod.piod_len;
    599 		uio.uio_iov = &iov;
    600 		uio.uio_iovcnt = 1;
    601 		uio.uio_offset = (off_t)(unsigned long)piod.piod_offs;
    602 		uio.uio_resid = piod.piod_len;
    603 
    604 		switch (piod.piod_op) {
    605 		case PIOD_READ_D:
    606 		case PIOD_READ_I:
    607 			uio.uio_rw = UIO_READ;
    608 			break;
    609 		case PIOD_WRITE_D:
    610 		case PIOD_WRITE_I:
    611 			/*
    612 			 * Can't write to a RAS
    613 			 */
    614 			if (ras_lookup(t, addr) != (void *)-1) {
    615 				return EACCES;
    616 			}
    617 			uio.uio_rw = UIO_WRITE;
    618 			break;
    619 		case PIOD_READ_AUXV:
    620 			req = PT_READ_D;
    621 			uio.uio_rw = UIO_READ;
    622 			tmp = t->p_execsw->es_arglen;
    623 			if (uio.uio_offset > tmp)
    624 				return EIO;
    625 			if (uio.uio_resid > tmp - uio.uio_offset)
    626 				uio.uio_resid = tmp - uio.uio_offset;
    627 			piod.piod_len = iov.iov_len = uio.uio_resid;
    628 			error = process_auxv_offset(t, &uio);
    629 			break;
    630 		default:
    631 			error = EINVAL;
    632 			break;
    633 		}
    634 		if (error)
    635 			break;
    636 		error = proc_vmspace_getref(l->l_proc, &vm);
    637 		if (error)
    638 			break;
    639 		uio.uio_vmspace = vm;
    640 
    641 		error = process_domem(l, lt, &uio);
    642 		piod.piod_len -= uio.uio_resid;
    643 		(void) ptm->ptm_copyoutpiod(&piod, addr);
    644 
    645 		uvmspace_free(vm);
    646 		break;
    647 
    648 	case  PT_DUMPCORE:
    649 		if ((path = addr) != NULL) {
    650 			char *dst;
    651 			len = data;
    652 
    653 			if (len < 0 || len >= MAXPATHLEN) {
    654 				error = EINVAL;
    655 				break;
    656 			}
    657 			dst = kmem_alloc(len + 1, KM_SLEEP);
    658 			if ((error = copyin(path, dst, len)) != 0) {
    659 				kmem_free(dst, len + 1);
    660 				break;
    661 			}
    662 			path = dst;
    663 			path[len] = '\0';
    664 		}
    665 		error = (*coredump_vec)(lt, path);
    666 		if (path)
    667 			kmem_free(path, len + 1);
    668 		break;
    669 
    670 #ifdef PT_STEP
    671 	case  PT_STEP:
    672 		/*
    673 		 * From the 4.4BSD PRM:
    674 		 * "Execution continues as in request PT_CONTINUE; however
    675 		 * as soon as possible after execution of at least one
    676 		 * instruction, execution stops again. [ ... ]"
    677 		 */
    678 #endif
    679 	case  PT_CONTINUE:
    680 	case  PT_SYSCALL:
    681 	case  PT_DETACH:
    682 		if (req == PT_SYSCALL) {
    683 			if (!ISSET(t->p_slflag, PSL_SYSCALL)) {
    684 				SET(t->p_slflag, PSL_SYSCALL);
    685 #ifdef __HAVE_SYSCALL_INTERN
    686 				(*t->p_emul->e_syscall_intern)(t);
    687 #endif
    688 			}
    689 		} else {
    690 			if (ISSET(t->p_slflag, PSL_SYSCALL)) {
    691 				CLR(t->p_slflag, PSL_SYSCALL);
    692 #ifdef __HAVE_SYSCALL_INTERN
    693 				(*t->p_emul->e_syscall_intern)(t);
    694 #endif
    695 			}
    696 		}
    697 		t->p_trace_enabled = trace_is_enabled(t);
    698 
    699 		/*
    700 		 * Pick up the LWPID, if supplied.  There are two cases:
    701 		 * data < 0 : step or continue single thread, lwp = -data
    702 		 * data > 0 in PT_STEP : step this thread, continue others
    703 		 * For operations other than PT_STEP, data > 0 means
    704 		 * data is the signo to deliver to the process.
    705 		 */
    706 		tmp = data;
    707 		if (tmp >= 0) {
    708 #ifdef PT_STEP
    709 			if (req == PT_STEP)
    710 				signo = 0;
    711 			else
    712 #endif
    713 			{
    714 				signo = tmp;
    715 				tmp = 0;	/* don't search for LWP */
    716 			}
    717 		} else
    718 			tmp = -tmp;
    719 
    720 		if (tmp > 0) {
    721 			if (req == PT_DETACH) {
    722 				error = EINVAL;
    723 				break;
    724 			}
    725 			lwp_delref2 (lt);
    726 			lt = lwp_find(t, tmp);
    727 			if (lt == NULL) {
    728 				error = ESRCH;
    729 				break;
    730 			}
    731 			lwp_addref(lt);
    732 			resume_all = 0;
    733 			signo = 0;
    734 		}
    735 
    736 		/*
    737 		 * From the 4.4BSD PRM:
    738 		 * "The data argument is taken as a signal number and the
    739 		 * child's execution continues at location addr as if it
    740 		 * incurred that signal.  Normally the signal number will
    741 		 * be either 0 to indicate that the signal that caused the
    742 		 * stop should be ignored, or that value fetched out of
    743 		 * the process's image indicating which signal caused
    744 		 * the stop.  If addr is (int *)1 then execution continues
    745 		 * from where it stopped."
    746 		 */
    747 
    748 		/* Check that the data is a valid signal number or zero. */
    749 		if (signo < 0 || signo >= NSIG) {
    750 			error = EINVAL;
    751 			break;
    752 		}
    753 
    754 		/* Prevent process deadlock */
    755 		if (resume_all) {
    756 #ifdef PT_STEP
    757 			if (req == PT_STEP) {
    758 				if (lt->l_flag & LW_WSUSPEND) {
    759 					error = EDEADLK;
    760 					break;
    761 				}
    762 			} else
    763 #endif
    764 			{
    765 				error = EDEADLK;
    766 				LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
    767 					if ((lt2->l_flag & LW_WSUSPEND) == 0) {
    768 						error = 0;
    769 						break;
    770 					}
    771 				}
    772 				if (error != 0)
    773 					break;
    774 			}
    775 		} else {
    776 			if (lt->l_flag & LW_WSUSPEND) {
    777 				error = EDEADLK;
    778 				break;
    779 			}
    780 		}
    781 
    782 		/* If the address parameter is not (int *)1, set the pc. */
    783 		if ((int *)addr != (int *)1) {
    784 			error = process_set_pc(lt, addr);
    785 			if (error != 0)
    786 				break;
    787 		}
    788 #ifdef PT_STEP
    789 		/*
    790 		 * Arrange for a single-step, if that's requested and possible.
    791 		 * More precisely, set the single step status as requested for
    792 		 * the requested thread, and clear it for other threads.
    793 		 */
    794 		LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
    795 			if (ISSET(lt2->l_pflag, LP_SINGLESTEP)) {
    796 				lwp_lock(lt2);
    797 				process_sstep(lt2, 1);
    798 				lwp_unlock(lt2);
    799 			} else if (lt != lt2) {
    800 				lwp_lock(lt2);
    801 				process_sstep(lt2, 0);
    802 				lwp_unlock(lt2);
    803 			}
    804 		}
    805 		error = process_sstep(lt,
    806 		    ISSET(lt->l_pflag, LP_SINGLESTEP) || req == PT_STEP);
    807 		if (error)
    808 			break;
    809 #endif
    810 		if (req == PT_DETACH) {
    811 			CLR(t->p_slflag, PSL_TRACED|PSL_SYSCALL);
    812 
    813 			/* give process back to original parent or init */
    814 			if (t->p_opptr != t->p_pptr) {
    815 				struct proc *pp = t->p_opptr;
    816 				proc_reparent(t, pp ? pp : initproc);
    817 			}
    818 
    819 			/* not being traced any more */
    820 			t->p_opptr = NULL;
    821 
    822 			/* clear single step */
    823 			LIST_FOREACH(lt2, &t->p_lwps, l_sibling) {
    824 				CLR(lt2->l_pflag, LP_SINGLESTEP);
    825 			}
    826 			CLR(lt->l_pflag, LP_SINGLESTEP);
    827 		}
    828 	sendsig:
    829 		t->p_fpid = 0;
    830 		t->p_vfpid = 0;
    831 		t->p_vfpid_done = 0;
    832 		t->p_lwp_created = 0;
    833 		t->p_lwp_exited = 0;
    834 		/* Finally, deliver the requested signal (or none). */
    835 		if (t->p_stat == SSTOP) {
    836 			/*
    837 			 * Unstop the process.  If it needs to take a
    838 			 * signal, make all efforts to ensure that at
    839 			 * an LWP runs to see it.
    840 			 */
    841 			t->p_xsig = signo;
    842 			if (resume_all)
    843 				proc_unstop(t);
    844 			else
    845 				lwp_unstop(lt);
    846 		} else if (t->p_sigctx.ps_faked) {
    847 			if (signo != t->p_sigctx.ps_info._signo) {
    848 				error = EINVAL;
    849 				break;
    850 			}
    851 			t->p_sigctx.ps_faked = false;
    852 			KSI_INIT_EMPTY(&ksi);
    853 			ksi.ksi_info = t->p_sigctx.ps_info;
    854 			ksi.ksi_lid = t->p_sigctx.ps_lwp;
    855 			kpsignal2(t, &ksi);
    856 		} else if (signo != 0) {
    857 			KSI_INIT_EMPTY(&ksi);
    858 			ksi.ksi_signo = signo;
    859 			kpsignal2(t, &ksi);
    860 		}
    861 		break;
    862 
    863 	case  PT_SYSCALLEMU:
    864 		if (!ISSET(t->p_slflag, PSL_SYSCALL) || t->p_stat != SSTOP) {
    865 			error = EINVAL;
    866 			break;
    867 		}
    868 		SET(t->p_slflag, PSL_SYSCALLEMU);
    869 		break;
    870 
    871 #ifdef PT_STEP
    872 	case  PT_SETSTEP:
    873 		write = 1;
    874 
    875 	case  PT_CLEARSTEP:
    876 		/* write = 0 done above. */
    877 
    878 		tmp = data;
    879 		if (tmp != 0 && t->p_nlwps > 1) {
    880 			lwp_delref(lt);
    881 			mutex_enter(t->p_lock);
    882 			lt = lwp_find(t, tmp);
    883 			if (lt == NULL) {
    884 				mutex_exit(t->p_lock);
    885 				error = ESRCH;
    886 				break;
    887 			}
    888 			lwp_addref(lt);
    889 			mutex_exit(t->p_lock);
    890 		}
    891 
    892 		if (ISSET(lt->l_flag, LW_SYSTEM))
    893 			error = EINVAL;
    894 		else if (write)
    895 			SET(lt->l_pflag, LP_SINGLESTEP);
    896 		else
    897 			CLR(lt->l_pflag, LP_SINGLESTEP);
    898 		break;
    899 #endif
    900 
    901 	case  PT_KILL:
    902 		/* just send the process a KILL signal. */
    903 		signo = SIGKILL;
    904 		goto sendsig;	/* in PT_CONTINUE, above. */
    905 
    906 	case  PT_ATTACH:
    907 		/*
    908 		 * Go ahead and set the trace flag.
    909 		 * Save the old parent (it's reset in
    910 		 *   _DETACH, and also in kern_exit.c:wait4()
    911 		 * Reparent the process so that the tracing
    912 		 *   proc gets to see all the action.
    913 		 * Stop the target.
    914 		 */
    915 		proc_changeparent(t, p);
    916 		signo = SIGSTOP;
    917 		goto sendsig;
    918 
    919 	case  PT_GET_EVENT_MASK:
    920 		if (data != sizeof(pe)) {
    921 			DPRINTF(("ptrace(%d): %d != %zu\n", req,
    922 			    data, sizeof(pe)));
    923 			error = EINVAL;
    924 			break;
    925 		}
    926 		memset(&pe, 0, sizeof(pe));
    927 		pe.pe_set_event = ISSET(t->p_slflag, PSL_TRACEFORK) ?
    928 		    PTRACE_FORK : 0;
    929 		pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK) ?
    930 		    PTRACE_VFORK : 0;
    931 		pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACEVFORK_DONE) ?
    932 		    PTRACE_VFORK_DONE : 0;
    933 		pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_CREATE) ?
    934 		    PTRACE_LWP_CREATE : 0;
    935 		pe.pe_set_event |= ISSET(t->p_slflag, PSL_TRACELWP_EXIT) ?
    936 		    PTRACE_LWP_EXIT : 0;
    937 		error = copyout(&pe, addr, sizeof(pe));
    938 		break;
    939 
    940 	case  PT_SET_EVENT_MASK:
    941 		if (data != sizeof(pe)) {
    942 			DPRINTF(("ptrace(%d): %d != %zu\n", req, data,
    943 			    sizeof(pe)));
    944 			error = EINVAL;
    945 			break;
    946 		}
    947 		if ((error = copyin(addr, &pe, sizeof(pe))) != 0)
    948 			return error;
    949 		if (pe.pe_set_event & PTRACE_FORK)
    950 			SET(t->p_slflag, PSL_TRACEFORK);
    951 		else
    952 			CLR(t->p_slflag, PSL_TRACEFORK);
    953 #if notyet
    954 		if (pe.pe_set_event & PTRACE_VFORK)
    955 			SET(t->p_slflag, PSL_TRACEVFORK);
    956 		else
    957 			CLR(t->p_slflag, PSL_TRACEVFORK);
    958 #else
    959 		if (pe.pe_set_event & PTRACE_VFORK) {
    960 			error = ENOTSUP;
    961 			break;
    962 		}
    963 #endif
    964 		if (pe.pe_set_event & PTRACE_VFORK_DONE)
    965 			SET(t->p_slflag, PSL_TRACEVFORK_DONE);
    966 		else
    967 			CLR(t->p_slflag, PSL_TRACEVFORK_DONE);
    968 		if (pe.pe_set_event & PTRACE_LWP_CREATE)
    969 			SET(t->p_slflag, PSL_TRACELWP_CREATE);
    970 		else
    971 			CLR(t->p_slflag, PSL_TRACELWP_CREATE);
    972 		if (pe.pe_set_event & PTRACE_LWP_EXIT)
    973 			SET(t->p_slflag, PSL_TRACELWP_EXIT);
    974 		else
    975 			CLR(t->p_slflag, PSL_TRACELWP_EXIT);
    976 		break;
    977 
    978 	case  PT_GET_PROCESS_STATE:
    979 		if (data != sizeof(ps)) {
    980 			DPRINTF(("ptrace(%d): %d != %zu\n", req, data,
    981 			    sizeof(ps)));
    982 			error = EINVAL;
    983 			break;
    984 		}
    985 		memset(&ps, 0, sizeof(ps));
    986 		if (t->p_fpid) {
    987 			ps.pe_report_event = PTRACE_FORK;
    988 			ps.pe_other_pid = t->p_fpid;
    989 		} else if (t->p_vfpid) {
    990 			ps.pe_report_event = PTRACE_VFORK;
    991 			ps.pe_other_pid = t->p_vfpid;
    992 		} else if (t->p_vfpid_done) {
    993 			ps.pe_report_event = PTRACE_VFORK_DONE;
    994 			ps.pe_other_pid = t->p_vfpid_done;
    995 		} else if (t->p_lwp_created) {
    996 			ps.pe_report_event = PTRACE_LWP_CREATE;
    997 			ps.pe_lwp = t->p_lwp_created;
    998 		} else if (t->p_lwp_exited) {
    999 			ps.pe_report_event = PTRACE_LWP_EXIT;
   1000 			ps.pe_lwp = t->p_lwp_exited;
   1001 		}
   1002 		error = copyout(&ps, addr, sizeof(ps));
   1003 		break;
   1004 
   1005 	case PT_LWPINFO:
   1006 		if (data != sizeof(pl)) {
   1007 			DPRINTF(("ptrace(%d): %d != %zu\n", req, data,
   1008 			    sizeof(pl)));
   1009 			error = EINVAL;
   1010 			break;
   1011 		}
   1012 		error = copyin(addr, &pl, sizeof(pl));
   1013 		if (error)
   1014 			break;
   1015 		tmp = pl.pl_lwpid;
   1016 		lwp_delref(lt);
   1017 		mutex_enter(t->p_lock);
   1018 		if (tmp == 0)
   1019 			lt = lwp_find_first(t);
   1020 		else {
   1021 			lt = lwp_find(t, tmp);
   1022 			if (lt == NULL) {
   1023 				mutex_exit(t->p_lock);
   1024 				error = ESRCH;
   1025 				break;
   1026 			}
   1027 			lt = LIST_NEXT(lt, l_sibling);
   1028 		}
   1029 		while (lt != NULL && !lwp_alive(lt))
   1030 			lt = LIST_NEXT(lt, l_sibling);
   1031 		pl.pl_lwpid = 0;
   1032 		pl.pl_event = 0;
   1033 		if (lt) {
   1034 			lwp_addref(lt);
   1035 			pl.pl_lwpid = lt->l_lid;
   1036 
   1037 			if (lt->l_flag & LW_WSUSPEND)
   1038 				pl.pl_event = PL_EVENT_SUSPENDED;
   1039 			/*
   1040 			 * If we match the lwp, or it was sent to every lwp,
   1041 			 * we set PL_EVENT_SIGNAL.
   1042 			 * XXX: ps_lwp == 0 means everyone and noone, so
   1043 			 * check ps_signo too.
   1044 			 */
   1045 			else if (lt->l_lid == t->p_sigctx.ps_lwp
   1046 			         || (t->p_sigctx.ps_lwp == 0 &&
   1047 			             t->p_sigctx.ps_info._signo))
   1048 				pl.pl_event = PL_EVENT_SIGNAL;
   1049 		}
   1050 		mutex_exit(t->p_lock);
   1051 
   1052 		error = copyout(&pl, addr, sizeof(pl));
   1053 		break;
   1054 
   1055 	case  PT_SET_SIGINFO:
   1056 		if (data != sizeof(psi)) {
   1057 			DPRINTF(("ptrace(%d): %d != %zu\n", req, data,
   1058 			    sizeof(psi)));
   1059 			error = EINVAL;
   1060 			break;
   1061 		}
   1062 
   1063 		error = copyin(addr, &psi, sizeof(psi));
   1064 		if (error)
   1065 			break;
   1066 
   1067 		/* Check that the data is a valid signal number or zero. */
   1068 		if (psi.psi_siginfo.si_signo < 0 ||
   1069 		    psi.psi_siginfo.si_signo >= NSIG) {
   1070 			error = EINVAL;
   1071 			break;
   1072 		}
   1073 
   1074 		tmp = psi.psi_lwpid;
   1075 		if (tmp != 0)
   1076 			lwp_delref(lt);
   1077 
   1078 		mutex_enter(t->p_lock);
   1079 
   1080 		if (tmp != 0) {
   1081 			lt = lwp_find(t, tmp);
   1082 			if (lt == NULL) {
   1083 				mutex_exit(t->p_lock);
   1084 				error = ESRCH;
   1085 				break;
   1086 			}
   1087 			lwp_addref(lt);
   1088 		}
   1089 
   1090 		t->p_sigctx.ps_faked = true;
   1091 		t->p_sigctx.ps_info = psi.psi_siginfo._info;
   1092 		t->p_sigctx.ps_lwp = psi.psi_lwpid;
   1093 		mutex_exit(t->p_lock);
   1094 		break;
   1095 
   1096 	case  PT_GET_SIGINFO:
   1097 		if (data != sizeof(psi)) {
   1098 			DPRINTF(("ptrace(%d): %d != %zu\n", req, data,
   1099 			    sizeof(psi)));
   1100 			error = EINVAL;
   1101 			break;
   1102 		}
   1103 		mutex_enter(t->p_lock);
   1104 		psi.psi_siginfo._info = t->p_sigctx.ps_info;
   1105 		psi.psi_lwpid = t->p_sigctx.ps_lwp;
   1106 		mutex_exit(t->p_lock);
   1107 
   1108 		error = copyout(&psi, addr, sizeof(psi));
   1109 		if (error)
   1110 			break;
   1111 
   1112 		break;
   1113 
   1114 	case  PT_SET_SIGMASK:
   1115 		write = 1;
   1116 
   1117 	case  PT_GET_SIGMASK:
   1118 		/* write = 0 done above. */
   1119 
   1120 		tmp = data;
   1121 		if (tmp != 0 && t->p_nlwps > 1) {
   1122 			lwp_delref(lt);
   1123 			mutex_enter(t->p_lock);
   1124 			lt = lwp_find(t, tmp);
   1125 			if (lt == NULL) {
   1126 				mutex_exit(t->p_lock);
   1127 				error = ESRCH;
   1128 				break;
   1129 			}
   1130 			lwp_addref(lt);
   1131 			mutex_exit(t->p_lock);
   1132 		}
   1133 
   1134 		if (lt->l_flag & LW_SYSTEM)
   1135 			error = EINVAL;
   1136 		else if (write == 1) {
   1137 			error = copyin(addr, &lt->l_sigmask, sizeof(sigset_t));
   1138 			sigminusset(&sigcantmask, &lt->l_sigmask);
   1139 		} else
   1140 			error = copyout(&lt->l_sigmask, addr, sizeof(sigset_t));
   1141 
   1142 		break;
   1143 
   1144 	case  PT_RESUME:
   1145 		write = 1;
   1146 
   1147 	case  PT_SUSPEND:
   1148 		/* write = 0 done above. */
   1149 
   1150 		tmp = data;
   1151 		if (tmp != 0 && t->p_nlwps > 1) {
   1152 			lwp_delref(lt);
   1153 			mutex_enter(t->p_lock);
   1154 			lt = lwp_find(t, tmp);
   1155 			if (lt == NULL) {
   1156 				mutex_exit(t->p_lock);
   1157 				error = ESRCH;
   1158 				break;
   1159 			}
   1160 			lwp_addref(lt);
   1161 			mutex_exit(t->p_lock);
   1162 		}
   1163 		if (lt->l_flag & LW_SYSTEM) {
   1164 			error = EINVAL;
   1165 		} else {
   1166 			lwp_lock(lt);
   1167 			if (write == 0)
   1168 				lt->l_flag |= LW_WSUSPEND;
   1169 			else
   1170 				lt->l_flag &= ~LW_WSUSPEND;
   1171 			lwp_unlock(lt);
   1172 		}
   1173 		break;
   1174 
   1175 #ifdef PT_SETREGS
   1176 	case  PT_SETREGS:
   1177 		write = 1;
   1178 #endif
   1179 #ifdef PT_GETREGS
   1180 	case  PT_GETREGS:
   1181 		/* write = 0 done above. */
   1182 #endif
   1183 #if defined(PT_SETREGS) || defined(PT_GETREGS)
   1184 		tmp = data;
   1185 		if (tmp != 0 && t->p_nlwps > 1) {
   1186 			lwp_delref(lt);
   1187 			mutex_enter(t->p_lock);
   1188 			lt = lwp_find(t, tmp);
   1189 			if (lt == NULL) {
   1190 				mutex_exit(t->p_lock);
   1191 				error = ESRCH;
   1192 				break;
   1193 			}
   1194 			lwp_addref(lt);
   1195 			mutex_exit(t->p_lock);
   1196 		}
   1197 		if (!process_validregs(lt))
   1198 			error = EINVAL;
   1199 		else {
   1200 			error = proc_vmspace_getref(p, &vm);
   1201 			if (error)
   1202 				break;
   1203 			iov.iov_base = addr;
   1204 			iov.iov_len = PROC_REGSZ(p);
   1205 			uio.uio_iov = &iov;
   1206 			uio.uio_iovcnt = 1;
   1207 			uio.uio_offset = 0;
   1208 			uio.uio_resid = iov.iov_len;
   1209 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
   1210 			uio.uio_vmspace = vm;
   1211 
   1212 			error = ptm->ptm_doregs(l, lt, &uio);
   1213 			uvmspace_free(vm);
   1214 		}
   1215 		break;
   1216 #endif
   1217 
   1218 #ifdef PT_SETFPREGS
   1219 	case  PT_SETFPREGS:
   1220 		write = 1;
   1221 		/*FALLTHROUGH*/
   1222 #endif
   1223 #ifdef PT_GETFPREGS
   1224 	case  PT_GETFPREGS:
   1225 		/* write = 0 done above. */
   1226 #endif
   1227 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
   1228 		tmp = data;
   1229 		if (tmp != 0 && t->p_nlwps > 1) {
   1230 			lwp_delref(lt);
   1231 			mutex_enter(t->p_lock);
   1232 			lt = lwp_find(t, tmp);
   1233 			if (lt == NULL) {
   1234 				mutex_exit(t->p_lock);
   1235 				error = ESRCH;
   1236 				break;
   1237 			}
   1238 			lwp_addref(lt);
   1239 			mutex_exit(t->p_lock);
   1240 		}
   1241 		if (!process_validfpregs(lt))
   1242 			error = EINVAL;
   1243 		else {
   1244 			error = proc_vmspace_getref(p, &vm);
   1245 			if (error)
   1246 				break;
   1247 			iov.iov_base = addr;
   1248 			iov.iov_len = PROC_FPREGSZ(p);
   1249 			uio.uio_iov = &iov;
   1250 			uio.uio_iovcnt = 1;
   1251 			uio.uio_offset = 0;
   1252 			uio.uio_resid = iov.iov_len;
   1253 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
   1254 			uio.uio_vmspace = vm;
   1255 
   1256 			error = ptm->ptm_dofpregs(l, lt, &uio);
   1257 			uvmspace_free(vm);
   1258 		}
   1259 		break;
   1260 #endif
   1261 
   1262 #ifdef PT_SETDBREGS
   1263 	case  PT_SETDBREGS:
   1264 		write = 1;
   1265 		/*FALLTHROUGH*/
   1266 #endif
   1267 #ifdef PT_GETDBREGS
   1268 	case  PT_GETDBREGS:
   1269 		/* write = 0 done above. */
   1270 #endif
   1271 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
   1272 		tmp = data;
   1273 		if (tmp != 0 && t->p_nlwps > 1) {
   1274 			lwp_delref(lt);
   1275 			mutex_enter(t->p_lock);
   1276 			lt = lwp_find(t, tmp);
   1277 			if (lt == NULL) {
   1278 				mutex_exit(t->p_lock);
   1279 				error = ESRCH;
   1280 				break;
   1281 			}
   1282 			lwp_addref(lt);
   1283 			mutex_exit(t->p_lock);
   1284 		}
   1285 		if (!process_validdbregs(lt))
   1286 			error = EINVAL;
   1287 		else {
   1288 			error = proc_vmspace_getref(p, &vm);
   1289 			if (error)
   1290 				break;
   1291 			iov.iov_base = addr;
   1292 			iov.iov_len = PROC_DBREGSZ(p);
   1293 			uio.uio_iov = &iov;
   1294 			uio.uio_iovcnt = 1;
   1295 			uio.uio_offset = 0;
   1296 			uio.uio_resid = iov.iov_len;
   1297 			uio.uio_rw = write ? UIO_WRITE : UIO_READ;
   1298 			uio.uio_vmspace = vm;
   1299 
   1300 			error = ptm->ptm_dodbregs(l, lt, &uio);
   1301 			uvmspace_free(vm);
   1302 		}
   1303 		break;
   1304 #endif
   1305 
   1306 #ifdef __HAVE_PTRACE_MACHDEP
   1307 	PTRACE_MACHDEP_REQUEST_CASES
   1308 		error = ptrace_machdep_dorequest(l, lt, req, addr, data);
   1309 		break;
   1310 #endif
   1311 	}
   1312 
   1313 	if (pheld) {
   1314 		mutex_exit(t->p_lock);
   1315 		mutex_exit(proc_lock);
   1316 	}
   1317 	if (lt != NULL)
   1318 		lwp_delref(lt);
   1319 	rw_exit(&t->p_reflock);
   1320 
   1321 	return error;
   1322 }
   1323 
   1324 typedef int (*regfunc_t)(struct lwp *, void *);
   1325 
   1326 #if defined(PT_GETDBREGS) || defined(PT_SETDBREGS) || \
   1327     defined(PT_GETFPREGS) || defined(PT_SETFPREGS) || \
   1328     defined(PT_GETREGS) || defined(PT_SETREGS)
   1329 static int
   1330 proc_regio(struct lwp *l, struct uio *uio, size_t kl, regfunc_t r, regfunc_t w)
   1331 {
   1332 	char buf[1024];
   1333 	int error;
   1334 	char *kv;
   1335 
   1336 	if (kl > sizeof(buf))
   1337 		return E2BIG;
   1338 
   1339 	if (uio->uio_offset < 0 || uio->uio_offset > (off_t)kl)
   1340 		return EINVAL;
   1341 
   1342 	kv = buf + uio->uio_offset;
   1343 	kl -= uio->uio_offset;
   1344 
   1345 	if (kl > uio->uio_resid)
   1346 		kl = uio->uio_resid;
   1347 
   1348 	error = (*r)(l, buf);
   1349 	if (error == 0)
   1350 		error = uiomove(kv, kl, uio);
   1351 	if (error == 0 && uio->uio_rw == UIO_WRITE) {
   1352 		if (l->l_stat != LSSTOP)
   1353 			error = EBUSY;
   1354 		else
   1355 			error = (*w)(l, buf);
   1356 	}
   1357 
   1358 	uio->uio_offset = 0;
   1359 	return error;
   1360 }
   1361 #endif
   1362 
   1363 int
   1364 process_doregs(struct lwp *curl /*tracer*/,
   1365     struct lwp *l /*traced*/,
   1366     struct uio *uio)
   1367 {
   1368 #if defined(PT_GETREGS) || defined(PT_SETREGS)
   1369 	size_t s;
   1370 	regfunc_t r, w;
   1371 
   1372 #ifdef COMPAT_NETBSD32
   1373 	const bool pk32 = (l->l_proc->p_flag & PK_32) != 0;
   1374 
   1375 	if (__predict_false(pk32)) {
   1376 		s = sizeof(struct reg32);
   1377 		r = (regfunc_t)process_read_regs32;
   1378 		w = (regfunc_t)process_write_regs32;
   1379 	} else
   1380 #endif
   1381 	{
   1382 		s = sizeof(struct reg);
   1383 		r = (regfunc_t)process_read_regs;
   1384 		w = (regfunc_t)process_write_regs;
   1385 	}
   1386 	return proc_regio(l, uio, s, r, w);
   1387 #else
   1388 	return EINVAL;
   1389 #endif
   1390 }
   1391 
   1392 int
   1393 process_validregs(struct lwp *l)
   1394 {
   1395 
   1396 #if defined(PT_SETREGS) || defined(PT_GETREGS)
   1397 	return (l->l_flag & LW_SYSTEM) == 0;
   1398 #else
   1399 	return 0;
   1400 #endif
   1401 }
   1402 
   1403 int
   1404 process_dofpregs(struct lwp *curl /*tracer*/,
   1405     struct lwp *l /*traced*/,
   1406     struct uio *uio)
   1407 {
   1408 #if defined(PT_GETFPREGS) || defined(PT_SETFPREGS)
   1409 	size_t s;
   1410 	regfunc_t r, w;
   1411 
   1412 #ifdef COMPAT_NETBSD32
   1413 	const bool pk32 = (l->l_proc->p_flag & PK_32) != 0;
   1414 
   1415 	if (__predict_false(pk32)) {
   1416 		s = sizeof(struct fpreg32);
   1417 		r = (regfunc_t)process_read_fpregs32;
   1418 		w = (regfunc_t)process_write_fpregs32;
   1419 	} else
   1420 #endif
   1421 	{
   1422 		s = sizeof(struct fpreg);
   1423 		r = (regfunc_t)process_read_fpregs;
   1424 		w = (regfunc_t)process_write_fpregs;
   1425 	}
   1426 	return proc_regio(l, uio, s, r, w);
   1427 #else
   1428 	return EINVAL;
   1429 #endif
   1430 }
   1431 
   1432 int
   1433 process_validfpregs(struct lwp *l)
   1434 {
   1435 
   1436 #if defined(PT_SETFPREGS) || defined(PT_GETFPREGS)
   1437 	return (l->l_flag & LW_SYSTEM) == 0;
   1438 #else
   1439 	return 0;
   1440 #endif
   1441 }
   1442 
   1443 int
   1444 process_dodbregs(struct lwp *curl /*tracer*/,
   1445     struct lwp *l /*traced*/,
   1446     struct uio *uio)
   1447 {
   1448 #if defined(PT_GETDBREGS) || defined(PT_SETDBREGS)
   1449 	size_t s;
   1450 	regfunc_t r, w;
   1451 
   1452 #ifdef COMPAT_NETBSD32
   1453 	const bool pk32 = (l->l_proc->p_flag & PK_32) != 0;
   1454 
   1455 	if (__predict_false(pk32)) {
   1456 		s = sizeof(struct dbreg32);
   1457 		r = (regfunc_t)process_read_dbregs32;
   1458 		w = (regfunc_t)process_write_dbregs32;
   1459 	} else
   1460 #endif
   1461 	{
   1462 		s = sizeof(struct dbreg);
   1463 		r = (regfunc_t)process_read_dbregs;
   1464 		w = (regfunc_t)process_write_dbregs;
   1465 	}
   1466 	return proc_regio(l, uio, s, r, w);
   1467 #else
   1468 	return EINVAL;
   1469 #endif
   1470 }
   1471 
   1472 int
   1473 process_validdbregs(struct lwp *l)
   1474 {
   1475 
   1476 #if defined(PT_SETDBREGS) || defined(PT_GETDBREGS)
   1477 	return (l->l_flag & LW_SYSTEM) == 0;
   1478 #else
   1479 	return 0;
   1480 #endif
   1481 }
   1482 
   1483 static int
   1484 process_auxv_offset(struct proc *p, struct uio *uio)
   1485 {
   1486 	struct ps_strings pss;
   1487 	int error;
   1488 	off_t off = (off_t)p->p_psstrp;
   1489 
   1490 	if ((error = copyin_psstrings(p, &pss)) != 0)
   1491 		return error;
   1492 
   1493 	if (pss.ps_envstr == NULL)
   1494 		return EIO;
   1495 
   1496 	uio->uio_offset += (off_t)(vaddr_t)(pss.ps_envstr + pss.ps_nenvstr + 1);
   1497 #ifdef __MACHINE_STACK_GROWS_UP
   1498 	if (uio->uio_offset < off)
   1499 		return EIO;
   1500 #else
   1501 	if (uio->uio_offset > off)
   1502 		return EIO;
   1503 	if ((uio->uio_offset + uio->uio_resid) > off)
   1504 		uio->uio_resid = off - uio->uio_offset;
   1505 #endif
   1506 	return 0;
   1507 }
   1508 #endif /* PTRACE */
   1509 
   1510 MODULE(MODULE_CLASS_EXEC, ptrace_common, "");
   1511 
   1512 static int
   1513 ptrace_common_modcmd(modcmd_t cmd, void *arg)
   1514 {
   1515         int error;
   1516 
   1517         switch (cmd) {
   1518         case MODULE_CMD_INIT:
   1519                 error = ptrace_init();
   1520                 break;
   1521         case MODULE_CMD_FINI:
   1522                 error = ptrace_fini();
   1523                 break;
   1524         default:
   1525 		ptrace_hooks();
   1526                 error = ENOTTY;
   1527                 break;
   1528         }
   1529         return error;
   1530 }
   1531