sys/kern/sys_process.c

   1 /*-
   2  * Copyright (c) 1994, Sean Eric Fagan
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgement:
  15  *      This product includes software developed by Sean Eric Fagan.
  16  * 4. The name of the author may not be used to endorse or promote products
  17  *    derived from this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  29  * SUCH DAMAGE.
  30  */
  31
  32 #include <sys/cdefs.h>
  33 __FBSDID("$FreeBSD$");
  34
  35 #include "opt_compat.h"
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/lock.h>
  40 #include <sys/mutex.h>
  41 #include <sys/syscallsubr.h>
  42 #include <sys/sysproto.h>
  43 #include <sys/proc.h>
  44 #include <sys/vnode.h>
  45 #include <sys/ptrace.h>
  46 #include <sys/sx.h>
  47 #include <sys/malloc.h>
  48 #include <sys/signalvar.h>
  49
  50 #include <machine/reg.h>
  51
  52 #include <vm/vm.h>
  53 #include <vm/pmap.h>
  54 #include <vm/vm_extern.h>
  55 #include <vm/vm_map.h>
  56 #include <vm/vm_kern.h>
  57 #include <vm/vm_object.h>
  58 #include <vm/vm_page.h>
  59
  60 #ifdef COMPAT_IA32
  61 #include <sys/procfs.h>
  62 #include <machine/fpu.h>
  63 #include <compat/ia32/ia32_reg.h>
  64
  65 extern struct sysentvec ia32_freebsd_sysvec;
  66
  67 struct ptrace_io_desc32 {
  68         int             piod_op;
  69         u_int32_t       piod_offs;
  70         u_int32_t       piod_addr;
  71         u_int32_t       piod_len;
  72 };
  73 #endif
  74
  75 /*
  76  * Functions implemented using PROC_ACTION():
  77  *
  78  * proc_read_regs(proc, regs)
  79  *      Get the current user-visible register set from the process
  80  *      and copy it into the regs structure (<machine/reg.h>).
  81  *      The process is stopped at the time read_regs is called.
  82  *
  83  * proc_write_regs(proc, regs)
  84  *      Update the current register set from the passed in regs
  85  *      structure.  Take care to avoid clobbering special CPU
  86  *      registers or privileged bits in the PSL.
  87  *      Depending on the architecture this may have fix-up work to do,
  88  *      especially if the IAR or PCW are modified.
  89  *      The process is stopped at the time write_regs is called.
  90  *
  91  * proc_read_fpregs, proc_write_fpregs
  92  *      deal with the floating point register set, otherwise as above.
  93  *
  94  * proc_read_dbregs, proc_write_dbregs
  95  *      deal with the processor debug register set, otherwise as above.
  96  *
  97  * proc_sstep(proc)
  98  *      Arrange for the process to trap after executing a single instruction.
  99  */
 100
 101 #define PROC_ACTION(action) do {                                        \
 102         int error;                                                      \
 103                                                                         \
 104         PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);                        \
 105         if ((td->td_proc->p_sflag & PS_INMEM) == 0)                     \
 106                 error = EIO;                                            \
 107         else                                                            \
 108                 error = (action);                                       \
 109         return (error);                                                 \
 110 } while(0)
 111
 112 int
 113 proc_read_regs(struct thread *td, struct reg *regs)
 114 {
 115
 116         PROC_ACTION(fill_regs(td, regs));
 117 }
 118
 119 int
 120 proc_write_regs(struct thread *td, struct reg *regs)
 121 {
 122
 123         PROC_ACTION(set_regs(td, regs));
 124 }
 125
 126 int
 127 proc_read_dbregs(struct thread *td, struct dbreg *dbregs)
 128 {
 129
 130         PROC_ACTION(fill_dbregs(td, dbregs));
 131 }
 132
 133 int
 134 proc_write_dbregs(struct thread *td, struct dbreg *dbregs)
 135 {
 136
 137         PROC_ACTION(set_dbregs(td, dbregs));
 138 }
 139
 140 /*
 141  * Ptrace doesn't support fpregs at all, and there are no security holes
 142  * or translations for fpregs, so we can just copy them.
 143  */
 144 int
 145 proc_read_fpregs(struct thread *td, struct fpreg *fpregs)
 146 {
 147
 148         PROC_ACTION(fill_fpregs(td, fpregs));
 149 }
 150
 151 int
 152 proc_write_fpregs(struct thread *td, struct fpreg *fpregs)
 153 {
 154
 155         PROC_ACTION(set_fpregs(td, fpregs));
 156 }
 157
 158 #ifdef COMPAT_IA32
 159 /* For 32 bit binaries, we need to expose the 32 bit regs layouts. */
 160 int
 161 proc_read_regs32(struct thread *td, struct reg32 *regs32)
 162 {
 163
 164         PROC_ACTION(fill_regs32(td, regs32));
 165 }
 166
 167 int
 168 proc_write_regs32(struct thread *td, struct reg32 *regs32)
 169 {
 170
 171         PROC_ACTION(set_regs32(td, regs32));
 172 }
 173
 174 int
 175 proc_read_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
 176 {
 177
 178         PROC_ACTION(fill_dbregs32(td, dbregs32));
 179 }
 180
 181 int
 182 proc_write_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
 183 {
 184
 185         PROC_ACTION(set_dbregs32(td, dbregs32));
 186 }
 187
 188 int
 189 proc_read_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
 190 {
 191
 192         PROC_ACTION(fill_fpregs32(td, fpregs32));
 193 }
 194
 195 int
 196 proc_write_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
 197 {
 198
 199         PROC_ACTION(set_fpregs32(td, fpregs32));
 200 }
 201 #endif
 202
 203 int
 204 proc_sstep(struct thread *td)
 205 {
 206
 207         PROC_ACTION(ptrace_single_step(td));
 208 }
 209
 210 int
 211 proc_rwmem(struct proc *p, struct uio *uio)
 212 {
 213         struct vmspace *vm;
 214         vm_map_t map;
 215         vm_object_t backing_object, object = NULL;
 216         vm_offset_t pageno = 0;         /* page number */
 217         vm_prot_t reqprot;
 218         int error, refcnt, writing;
 219
 220         /*
 221          * if the vmspace is in the midst of being deallocated or the
 222          * process is exiting, don't try to grab anything.  The page table
 223          * usage in that process can be messed up.
 224          */
 225         vm = p->p_vmspace;
 226         if ((p->p_flag & P_WEXIT))
 227                 return (EFAULT);
 228         do {
 229                 if ((refcnt = vm->vm_refcnt) < 1)
 230                         return (EFAULT);
 231         } while (!atomic_cmpset_int(&vm->vm_refcnt, refcnt, refcnt + 1));
 232
 233         /*
 234          * The map we want...
 235          */
 236         map = &vm->vm_map;
 237
 238         writing = uio->uio_rw == UIO_WRITE;
 239         reqprot = writing ? (VM_PROT_WRITE | VM_PROT_OVERRIDE_WRITE) :
 240             VM_PROT_READ;
 241
 242         /*
 243          * Only map in one page at a time.  We don't have to, but it
 244          * makes things easier.  This way is trivial - right?
 245          */
 246         do {
 247                 vm_map_t tmap;
 248                 vm_offset_t uva;
 249                 int page_offset;                /* offset into page */
 250                 vm_map_entry_t out_entry;
 251                 vm_prot_t out_prot;
 252                 boolean_t wired;
 253                 vm_pindex_t pindex;
 254                 u_int len;
 255                 vm_page_t m;
 256
 257                 object = NULL;
 258
 259                 uva = (vm_offset_t)uio->uio_offset;
 260
 261                 /*
 262                  * Get the page number of this segment.
 263                  */
 264                 pageno = trunc_page(uva);
 265                 page_offset = uva - pageno;
 266
 267                 /*
 268                  * How many bytes to copy
 269                  */
 270                 len = min(PAGE_SIZE - page_offset, uio->uio_resid);
 271
 272                 /*
 273                  * Fault the page on behalf of the process
 274                  */
 275                 error = vm_fault(map, pageno, reqprot, VM_FAULT_NORMAL);
 276                 if (error) {
 277                         error = EFAULT;
 278                         break;
 279                 }
 280
 281                 /*
 282                  * Now we need to get the page.  out_entry, out_prot, wired,
 283                  * and single_use aren't used.  One would think the vm code
 284                  * would be a *bit* nicer...  We use tmap because
 285                  * vm_map_lookup() can change the map argument.
 286                  */
 287                 tmap = map;
 288                 error = vm_map_lookup(&tmap, pageno, reqprot, &out_entry,
 289                     &object, &pindex, &out_prot, &wired);
 290                 if (error) {
 291                         error = EFAULT;
 292                         break;
 293                 }
 294                 VM_OBJECT_LOCK(object);
 295                 while ((m = vm_page_lookup(object, pindex)) == NULL &&
 296                     !writing &&
 297                     (backing_object = object->backing_object) != NULL) {
 298                         /*
 299                          * Allow fallback to backing objects if we are reading.
 300                          */
 301                         VM_OBJECT_LOCK(backing_object);
 302                         pindex += OFF_TO_IDX(object->backing_object_offset);
 303                         VM_OBJECT_UNLOCK(object);
 304                         object = backing_object;
 305                 }
 306                 VM_OBJECT_UNLOCK(object);
 307                 if (m == NULL) {
 308                         vm_map_lookup_done(tmap, out_entry);
 309                         error = EFAULT;
 310                         break;
 311                 }
 312
 313                 /*
 314                  * Hold the page in memory.
 315                  */
 316                 vm_page_lock_queues();
 317                 vm_page_hold(m);
 318                 vm_page_unlock_queues();
 319
 320                 /*
 321                  * We're done with tmap now.
 322                  */
 323                 vm_map_lookup_done(tmap, out_entry);
 324
 325                 /*
 326                  * Now do the i/o move.
 327                  */
 328                 error = uiomove_fromphys(&m, page_offset, len, uio);
 329
 330                 /*
 331                  * Release the page.
 332                  */
 333                 vm_page_lock_queues();
 334                 vm_page_unhold(m);
 335                 vm_page_unlock_queues();
 336
 337         } while (error == 0 && uio->uio_resid > 0);
 338
 339         vmspace_free(vm);
 340         return (error);
 341 }
 342
 343 /*
 344  * Process debugging system call.
 345  */
 346 #ifndef _SYS_SYSPROTO_H_
 347 struct ptrace_args {
 348         int     req;
 349         pid_t   pid;
 350         caddr_t addr;
 351         int     data;
 352 };
 353 #endif
 354
 355 #ifdef COMPAT_IA32
 356 /*
 357  * This CPP subterfuge is to try and reduce the number of ifdefs in
 358  * the body of the code.
 359  *   COPYIN(uap->addr, &r.reg, sizeof r.reg);
 360  * becomes either:
 361  *   copyin(uap->addr, &r.reg, sizeof r.reg);
 362  * or
 363  *   copyin(uap->addr, &r.reg32, sizeof r.reg32);
 364  * .. except this is done at runtime.
 365  */
 366 #define COPYIN(u, k, s)         wrap32 ? \
 367         copyin(u, k ## 32, s ## 32) : \
 368         copyin(u, k, s)
 369 #define COPYOUT(k, u, s)        wrap32 ? \
 370         copyout(k ## 32, u, s ## 32) : \
 371         copyout(k, u, s)
 372 #else
 373 #define COPYIN(u, k, s)         copyin(u, k, s)
 374 #define COPYOUT(k, u, s)        copyout(k, u, s)
 375 #endif
 376 /*
 377  * MPSAFE
 378  */
 379 int
 380 ptrace(struct thread *td, struct ptrace_args *uap)
 381 {
 382         /*
 383          * XXX this obfuscation is to reduce stack usage, but the register
 384          * structs may be too large to put on the stack anyway.
 385          */
 386         union {
 387                 struct ptrace_io_desc piod;
 388                 struct ptrace_lwpinfo pl;
 389                 struct dbreg dbreg;
 390                 struct fpreg fpreg;
 391                 struct reg reg;
 392 #ifdef COMPAT_IA32
 393                 struct dbreg32 dbreg32;
 394                 struct fpreg32 fpreg32;
 395                 struct reg32 reg32;
 396                 struct ptrace_io_desc32 piod32;
 397 #endif
 398         } r;
 399         void *addr;
 400         int error = 0;
 401 #ifdef COMPAT_IA32
 402         int wrap32 = 0;
 403
 404         if (td->td_proc->p_sysent == &ia32_freebsd_sysvec)
 405                 wrap32 = 1;
 406 #endif
 407         addr = &r;
 408         switch (uap->req) {
 409         case PT_GETREGS:
 410         case PT_GETFPREGS:
 411         case PT_GETDBREGS:
 412         case PT_LWPINFO:
 413                 break;
 414         case PT_SETREGS:
 415                 error = COPYIN(uap->addr, &r.reg, sizeof r.reg);
 416                 break;
 417         case PT_SETFPREGS:
 418                 error = COPYIN(uap->addr, &r.fpreg, sizeof r.fpreg);
 419                 break;
 420         case PT_SETDBREGS:
 421                 error = COPYIN(uap->addr, &r.dbreg, sizeof r.dbreg);
 422                 break;
 423         case PT_IO:
 424                 error = COPYIN(uap->addr, &r.piod, sizeof r.piod);
 425                 break;
 426         default:
 427                 addr = uap->addr;
 428                 break;
 429         }
 430         if (error)
 431                 return (error);
 432
 433         error = kern_ptrace(td, uap->req, uap->pid, addr, uap->data);
 434         if (error)
 435                 return (error);
 436
 437         switch (uap->req) {
 438         case PT_IO:
 439                 error = COPYOUT(&r.piod, uap->addr, sizeof r.piod);
 440                 break;
 441         case PT_GETREGS:
 442                 error = COPYOUT(&r.reg, uap->addr, sizeof r.reg);
 443                 break;
 444         case PT_GETFPREGS:
 445                 error = COPYOUT(&r.fpreg, uap->addr, sizeof r.fpreg);
 446                 break;
 447         case PT_GETDBREGS:
 448                 error = COPYOUT(&r.dbreg, uap->addr, sizeof r.dbreg);
 449                 break;
 450         case PT_LWPINFO:
 451                 error = copyout(&r.pl, uap->addr, uap->data);
 452                 break;
 453         }
 454
 455         return (error);
 456 }
 457 #undef COPYIN
 458 #undef COPYOUT
 459
 460 #ifdef COMPAT_IA32
 461 /*
 462  *   PROC_READ(regs, td2, addr);
 463  * becomes either:
 464  *   proc_read_regs(td2, addr);
 465  * or
 466  *   proc_read_regs32(td2, addr);
 467  * .. except this is done at runtime.  There is an additional
 468  * complication in that PROC_WRITE disallows 32 bit consumers
 469  * from writing to 64 bit address space targets.
 470  */
 471 #define PROC_READ(w, t, a)      wrap32 ? \
 472         proc_read_ ## w ## 32(t, a) : \
 473         proc_read_ ## w (t, a)
 474 #define PROC_WRITE(w, t, a)     wrap32 ? \
 475         (safe ? proc_write_ ## w ## 32(t, a) : EINVAL ) : \
 476         proc_write_ ## w (t, a)
 477 #else
 478 #define PROC_READ(w, t, a)      proc_read_ ## w (t, a)
 479 #define PROC_WRITE(w, t, a)     proc_write_ ## w (t, a)
 480 #endif
 481
 482 int
 483 kern_ptrace(struct thread *td, int req, pid_t pid, void *addr, int data)
 484 {
 485         struct iovec iov;
 486         struct uio uio;
 487         struct proc *curp, *p, *pp;
 488         struct thread *td2 = NULL;
 489         struct ptrace_io_desc *piod = NULL;
 490         struct ptrace_lwpinfo *pl;
 491         int error, write, tmp, num;
 492         int proctree_locked = 0;
 493         lwpid_t tid = 0, *buf;
 494 #ifdef COMPAT_IA32
 495         int wrap32 = 0, safe = 0;
 496         struct ptrace_io_desc32 *piod32 = NULL;
 497 #endif
 498
 499         curp = td->td_proc;
 500
 501         /* Lock proctree before locking the process. */
 502         switch (req) {
 503         case PT_TRACE_ME:
 504         case PT_ATTACH:
 505         case PT_STEP:
 506         case PT_CONTINUE:
 507         case PT_TO_SCE:
 508         case PT_TO_SCX:
 509         case PT_SYSCALL:
 510         case PT_DETACH:
 511                 sx_xlock(&proctree_lock);
 512                 proctree_locked = 1;
 513                 break;
 514         default:
 515                 break;
 516         }
 517
 518         write = 0;
 519         if (req == PT_TRACE_ME) {
 520                 p = td->td_proc;
 521                 PROC_LOCK(p);
 522         } else {
 523                 if (pid <= PID_MAX) {
 524                         if ((p = pfind(pid)) == NULL) {
 525                                 if (proctree_locked)
 526                                         sx_xunlock(&proctree_lock);
 527                                 return (ESRCH);
 528                         }
 529                 } else {
 530                         /* this is slow, should be optimized */
 531                         sx_slock(&allproc_lock);
 532                         FOREACH_PROC_IN_SYSTEM(p) {
 533                                 PROC_LOCK(p);
 534                                 mtx_lock_spin(&sched_lock);
 535                                 FOREACH_THREAD_IN_PROC(p, td2) {
 536                                         if (td2->td_tid == pid)
 537                                                 break;
 538                                 }
 539                                 mtx_unlock_spin(&sched_lock);
 540                                 if (td2 != NULL)
 541                                         break; /* proc lock held */
 542                                 PROC_UNLOCK(p);
 543                         }
 544                         sx_sunlock(&allproc_lock);
 545                         if (p == NULL) {
 546                                 if (proctree_locked)
 547                                         sx_xunlock(&proctree_lock);
 548                                 return (ESRCH);
 549                         }
 550                         tid = pid;
 551                         pid = p->p_pid;
 552                 }
 553         }
 554         if ((error = p_cansee(td, p)) != 0)
 555                 goto fail;
 556
 557         if ((error = p_candebug(td, p)) != 0)
 558                 goto fail;
 559
 560         /*
 561          * System processes can't be debugged.
 562          */
 563         if ((p->p_flag & P_SYSTEM) != 0) {
 564                 error = EINVAL;
 565                 goto fail;
 566         }
 567
 568         if (tid == 0) {
 569                 if ((p->p_flag & P_STOPPED_TRACE) != 0) {
 570                         KASSERT(p->p_xthread != NULL, ("NULL p_xthread"));
 571                         td2 = p->p_xthread;
 572                 } else {
 573                         td2 = FIRST_THREAD_IN_PROC(p);
 574                 }
 575                 tid = td2->td_tid;
 576         }
 577
 578 #ifdef COMPAT_IA32
 579         /*
 580          * Test if we're a 32 bit client and what the target is.
 581          * Set the wrap controls accordingly.
 582          */
 583         if (td->td_proc->p_sysent == &ia32_freebsd_sysvec) {
 584                 if (td2->td_proc->p_sysent == &ia32_freebsd_sysvec)
 585                         safe = 1;
 586                 wrap32 = 1;
 587         }
 588 #endif
 589         /*
 590          * Permissions check
 591          */
 592         switch (req) {
 593         case PT_TRACE_ME:
 594                 /* Always legal. */
 595                 break;
 596
 597         case PT_ATTACH:
 598                 /* Self */
 599                 if (p->p_pid == td->td_proc->p_pid) {
 600                         error = EINVAL;
 601                         goto fail;
 602                 }
 603
 604                 /* Already traced */
 605                 if (p->p_flag & P_TRACED) {
 606                         error = EBUSY;
 607                         goto fail;
 608                 }
 609
 610                 /* Can't trace an ancestor if you're being traced. */
 611                 if (curp->p_flag & P_TRACED) {
 612                         for (pp = curp->p_pptr; pp != NULL; pp = pp->p_pptr) {
 613                                 if (pp == p) {
 614                                         error = EINVAL;
 615                                         goto fail;
 616                                 }
 617                         }
 618                 }
 619
 620
 621                 /* OK */
 622                 break;
 623
 624         case PT_CLEARSTEP:
 625                 /* Allow thread to clear single step for itself */
 626                 if (td->td_tid == tid)
 627                         break;
 628
 629                 /* FALLTHROUGH */
 630         default:
 631                 /* not being traced... */
 632                 if ((p->p_flag & P_TRACED) == 0) {
 633                         error = EPERM;
 634                         goto fail;
 635                 }
 636
 637                 /* not being traced by YOU */
 638                 if (p->p_pptr != td->td_proc) {
 639                         error = EBUSY;
 640                         goto fail;
 641                 }
 642
 643                 /* not currently stopped */
 644                 if ((p->p_flag & (P_STOPPED_SIG | P_STOPPED_TRACE)) == 0 ||
 645                     p->p_suspcount != p->p_numthreads  ||
 646                     (p->p_flag & P_WAITED) == 0) {
 647                         error = EBUSY;
 648                         goto fail;
 649                 }
 650
 651                 if ((p->p_flag & P_STOPPED_TRACE) == 0) {
 652                         static int count = 0;
 653                         if (count++ == 0)
 654                                 printf("P_STOPPED_TRACE not set.\n");
 655                 }
 656
 657                 /* OK */
 658                 break;
 659         }
 660
 661 #ifdef FIX_SSTEP
 662         /*
 663          * Single step fixup ala procfs
 664          */
 665         FIX_SSTEP(td2);                 /* XXXKSE */
 666 #endif
 667
 668         /*
 669          * Actually do the requests
 670          */
 671
 672         td->td_retval[0] = 0;
 673
 674         switch (req) {
 675         case PT_TRACE_ME:
 676                 /* set my trace flag and "owner" so it can read/write me */
 677                 p->p_flag |= P_TRACED;
 678                 p->p_oppid = p->p_pptr->p_pid;
 679                 PROC_UNLOCK(p);
 680                 sx_xunlock(&proctree_lock);
 681                 return (0);
 682
 683         case PT_ATTACH:
 684                 /* security check done above */
 685                 p->p_flag |= P_TRACED;
 686                 p->p_oppid = p->p_pptr->p_pid;
 687                 if (p->p_pptr != td->td_proc) {
 688                         PROC_LOCK(p->p_pptr);
 689                         sigqueue_take(p->p_ksi);
 690                         PROC_UNLOCK(p->p_pptr);
 691                         proc_reparent(p, td->td_proc);
 692                 }
 693                 data = SIGSTOP;
 694                 goto sendsig;   /* in PT_CONTINUE below */
 695
 696         case PT_CLEARSTEP:
 697                 _PHOLD(p);
 698                 error = ptrace_clear_single_step(td2);
 699                 _PRELE(p);
 700                 if (error)
 701                         goto fail;
 702                 PROC_UNLOCK(p);
 703                 return (0);
 704
 705         case PT_SETSTEP:
 706                 _PHOLD(p);
 707                 error = ptrace_single_step(td2);
 708                 _PRELE(p);
 709                 if (error)
 710                         goto fail;
 711                 PROC_UNLOCK(p);
 712                 return (0);
 713
 714         case PT_SUSPEND:
 715                 _PHOLD(p);
 716                 mtx_lock_spin(&sched_lock);
 717                 td2->td_flags |= TDF_DBSUSPEND;
 718                 mtx_unlock_spin(&sched_lock);
 719                 _PRELE(p);
 720                 PROC_UNLOCK(p);
 721                 return (0);
 722
 723         case PT_RESUME:
 724                 _PHOLD(p);
 725                 mtx_lock_spin(&sched_lock);
 726                 td2->td_flags &= ~TDF_DBSUSPEND;
 727                 mtx_unlock_spin(&sched_lock);
 728                 _PRELE(p);
 729                 PROC_UNLOCK(p);
 730                 return (0);
 731
 732         case PT_STEP:
 733         case PT_CONTINUE:
 734         case PT_TO_SCE:
 735         case PT_TO_SCX:
 736         case PT_SYSCALL:
 737         case PT_DETACH:
 738                 /* Zero means do not send any signal */
 739                 if (data < 0 || data > _SIG_MAXSIG) {
 740                         error = EINVAL;
 741                         goto fail;
 742                 }
 743
 744                 _PHOLD(p);
 745
 746                 switch (req) {
 747                 case PT_STEP:
 748                         PROC_UNLOCK(p);
 749                         error = ptrace_single_step(td2);
 750                         if (error) {
 751                                 PRELE(p);
 752                                 goto fail_noproc;
 753                         }
 754                         PROC_LOCK(p);
 755                         break;
 756                 case PT_TO_SCE:
 757                         p->p_stops |= S_PT_SCE;
 758                         break;
 759                 case PT_TO_SCX:
 760                         p->p_stops |= S_PT_SCX;
 761                         break;
 762                 case PT_SYSCALL:
 763                         p->p_stops |= S_PT_SCE | S_PT_SCX;
 764                         break;
 765                 }
 766
 767                 if (addr != (void *)1) {
 768                         PROC_UNLOCK(p);
 769                         error = ptrace_set_pc(td2, (u_long)(uintfptr_t)addr);
 770                         if (error) {
 771                                 PRELE(p);
 772                                 goto fail_noproc;
 773                         }
 774                         PROC_LOCK(p);
 775                 }
 776                 _PRELE(p);
 777
 778                 if (req == PT_DETACH) {
 779                         /* reset process parent */
 780                         if (p->p_oppid != p->p_pptr->p_pid) {
 781                                 struct proc *pp;
 782
 783                                 PROC_LOCK(p->p_pptr);
 784                                 sigqueue_take(p->p_ksi);
 785                                 PROC_UNLOCK(p->p_pptr);
 786
 787                                 PROC_UNLOCK(p);
 788                                 pp = pfind(p->p_oppid);
 789                                 if (pp == NULL)
 790                                         pp = initproc;
 791                                 else
 792                                         PROC_UNLOCK(pp);
 793                                 PROC_LOCK(p);
 794                                 proc_reparent(p, pp);
 795                                 if (pp == initproc)
 796                                         p->p_sigparent = SIGCHLD;
 797                         }
 798                         p->p_flag &= ~(P_TRACED | P_WAITED);
 799                         p->p_oppid = 0;
 800
 801                         /* should we send SIGCHLD? */
 802                         /* childproc_continued(p); */
 803                 }
 804
 805         sendsig:
 806                 if (proctree_locked)
 807                         sx_xunlock(&proctree_lock);
 808                 /* deliver or queue signal */
 809                 mtx_lock_spin(&sched_lock);
 810                 td2->td_flags &= ~TDF_XSIG;
 811                 mtx_unlock_spin(&sched_lock);
 812                 td2->td_xsig = data;
 813                 p->p_xstat = data;
 814                 p->p_xthread = NULL;
 815                 if ((p->p_flag & (P_STOPPED_SIG | P_STOPPED_TRACE)) != 0) {
 816                         mtx_lock_spin(&sched_lock);
 817                         if (req == PT_DETACH) {
 818                                 struct thread *td3;
 819                                 FOREACH_THREAD_IN_PROC(p, td3)
 820                                         td3->td_flags &= ~TDF_DBSUSPEND;
 821                         }
 822                         /*
 823                          * unsuspend all threads, to not let a thread run,
 824                          * you should use PT_SUSPEND to suspend it before
 825                          * continuing process.
 826                          */
 827                         mtx_unlock_spin(&sched_lock);
 828                         thread_continued(p);
 829                         p->p_flag &= ~(P_STOPPED_TRACE|P_STOPPED_SIG|P_WAITED);
 830                         mtx_lock_spin(&sched_lock);
 831                         thread_unsuspend(p);
 832                         mtx_unlock_spin(&sched_lock);
 833                 }
 834
 835                 if (data)
 836                         psignal(p, data);
 837
 838                 PROC_UNLOCK(p);
 839                 return (0);
 840
 841         case PT_WRITE_I:
 842         case PT_WRITE_D:
 843                 write = 1;
 844                 /* FALLTHROUGH */
 845         case PT_READ_I:
 846         case PT_READ_D:
 847                 PROC_UNLOCK(p);
 848                 tmp = 0;
 849                 /* write = 0 set above */
 850                 iov.iov_base = write ? (caddr_t)&data : (caddr_t)&tmp;
 851                 iov.iov_len = sizeof(int);
 852                 uio.uio_iov = &iov;
 853                 uio.uio_iovcnt = 1;
 854                 uio.uio_offset = (off_t)(uintptr_t)addr;
 855                 uio.uio_resid = sizeof(int);
 856                 uio.uio_segflg = UIO_SYSSPACE;  /* i.e.: the uap */
 857                 uio.uio_rw = write ? UIO_WRITE : UIO_READ;
 858                 uio.uio_td = td;
 859                 error = proc_rwmem(p, &uio);
 860                 if (uio.uio_resid != 0) {
 861                         /*
 862                          * XXX proc_rwmem() doesn't currently return ENOSPC,
 863                          * so I think write() can bogusly return 0.
 864                          * XXX what happens for short writes?  We don't want
 865                          * to write partial data.
 866                          * XXX proc_rwmem() returns EPERM for other invalid
 867                          * addresses.  Convert this to EINVAL.  Does this
 868                          * clobber returns of EPERM for other reasons?
 869                          */
 870                         if (error == 0 || error == ENOSPC || error == EPERM)
 871                                 error = EINVAL; /* EOF */
 872                 }
 873                 if (!write)
 874                         td->td_retval[0] = tmp;
 875                 return (error);
 876
 877         case PT_IO:
 878                 PROC_UNLOCK(p);
 879 #ifdef COMPAT_IA32
 880                 if (wrap32) {
 881                         piod32 = addr;
 882                         iov.iov_base = (void *)(uintptr_t)piod32->piod_addr;
 883                         iov.iov_len = piod32->piod_len;
 884                         uio.uio_offset = (off_t)(uintptr_t)piod32->piod_offs;
 885                         uio.uio_resid = piod32->piod_len;
 886                 } else
 887 #endif
 888                 {
 889                         piod = addr;
 890                         iov.iov_base = piod->piod_addr;
 891                         iov.iov_len = piod->piod_len;
 892                         uio.uio_offset = (off_t)(uintptr_t)piod->piod_offs;
 893                         uio.uio_resid = piod->piod_len;
 894                 }
 895                 uio.uio_iov = &iov;
 896                 uio.uio_iovcnt = 1;
 897                 uio.uio_segflg = UIO_USERSPACE;
 898                 uio.uio_td = td;
 899 #ifdef COMPAT_IA32
 900                 tmp = wrap32 ? piod32->piod_op : piod->piod_op;
 901 #else
 902                 tmp = piod->piod_op;
 903 #endif
 904                 switch (tmp) {
 905                 case PIOD_READ_D:
 906                 case PIOD_READ_I:
 907                         uio.uio_rw = UIO_READ;
 908                         break;
 909                 case PIOD_WRITE_D:
 910                 case PIOD_WRITE_I:
 911                         uio.uio_rw = UIO_WRITE;
 912                         break;
 913                 default:
 914                         return (EINVAL);
 915                 }
 916                 error = proc_rwmem(p, &uio);
 917 #ifdef COMPAT_IA32
 918                 if (wrap32)
 919                         piod32->piod_len -= uio.uio_resid;
 920                 else
 921 #endif
 922                         piod->piod_len -= uio.uio_resid;
 923                 return (error);
 924
 925         case PT_KILL:
 926                 data = SIGKILL;
 927                 goto sendsig;   /* in PT_CONTINUE above */
 928
 929         case PT_SETREGS:
 930                 _PHOLD(p);
 931                 error = PROC_WRITE(regs, td2, addr);
 932                 _PRELE(p);
 933                 PROC_UNLOCK(p);
 934                 return (error);
 935
 936         case PT_GETREGS:
 937                 _PHOLD(p);
 938                 error = PROC_READ(regs, td2, addr);
 939                 _PRELE(p);
 940                 PROC_UNLOCK(p);
 941                 return (error);
 942
 943         case PT_SETFPREGS:
 944                 _PHOLD(p);
 945                 error = PROC_WRITE(fpregs, td2, addr);
 946                 _PRELE(p);
 947                 PROC_UNLOCK(p);
 948                 return (error);
 949
 950         case PT_GETFPREGS:
 951                 _PHOLD(p);
 952                 error = PROC_READ(fpregs, td2, addr);
 953                 _PRELE(p);
 954                 PROC_UNLOCK(p);
 955                 return (error);
 956
 957         case PT_SETDBREGS:
 958                 _PHOLD(p);
 959                 error = PROC_WRITE(dbregs, td2, addr);
 960                 _PRELE(p);
 961                 PROC_UNLOCK(p);
 962                 return (error);
 963
 964         case PT_GETDBREGS:
 965                 _PHOLD(p);
 966                 error = PROC_READ(dbregs, td2, addr);
 967                 _PRELE(p);
 968                 PROC_UNLOCK(p);
 969                 return (error);
 970
 971         case PT_LWPINFO:
 972                 if (data == 0 || data > sizeof(*pl))
 973                         return (EINVAL);
 974                 pl = addr;
 975                 _PHOLD(p);
 976                 pl->pl_lwpid = td2->td_tid;
 977                 if (td2->td_flags & TDF_XSIG)
 978                         pl->pl_event = PL_EVENT_SIGNAL;
 979                 else
 980                         pl->pl_event = 0;
 981                 if (td2->td_pflags & TDP_SA) {
 982                         pl->pl_flags = PL_FLAG_SA;
 983                         if (td2->td_upcall && !TD_CAN_UNBIND(td2))
 984                                 pl->pl_flags |= PL_FLAG_BOUND;
 985                 } else {
 986                         pl->pl_flags = 0;
 987                 }
 988                 _PRELE(p);
 989                 PROC_UNLOCK(p);
 990                 return (0);
 991
 992         case PT_GETNUMLWPS:
 993                 td->td_retval[0] = p->p_numthreads;
 994                 PROC_UNLOCK(p);
 995                 return (0);
 996
 997         case PT_GETLWPLIST:
 998                 if (data <= 0) {
 999                         PROC_UNLOCK(p);
1000                         return (EINVAL);
1001                 }
1002                 num = imin(p->p_numthreads, data);
1003                 PROC_UNLOCK(p);
1004                 buf = malloc(num * sizeof(lwpid_t), M_TEMP, M_WAITOK);
1005                 tmp = 0;
1006                 PROC_LOCK(p);
1007                 mtx_lock_spin(&sched_lock);
1008                 FOREACH_THREAD_IN_PROC(p, td2) {
1009                         if (tmp >= num)
1010                                 break;
1011                         buf[tmp++] = td2->td_tid;
1012                 }
1013                 mtx_unlock_spin(&sched_lock);
1014                 PROC_UNLOCK(p);
1015                 error = copyout(buf, addr, tmp * sizeof(lwpid_t));
1016                 free(buf, M_TEMP);
1017                 if (!error)
1018                         td->td_retval[0] = num;
1019                 return (error);
1020
1021         default:
1022 #ifdef __HAVE_PTRACE_MACHDEP
1023                 if (req >= PT_FIRSTMACH) {
1024                         _PHOLD(p);
1025                         PROC_UNLOCK(p);
1026                         error = cpu_ptrace(td2, req, addr, data);
1027                         PRELE(p);
1028                         return (error);
1029                 }
1030 #endif
1031                 break;
1032         }
1033
1034         /* Unknown request. */
1035         error = EINVAL;
1036
1037 fail:
1038         PROC_UNLOCK(p);
1039 fail_noproc:
1040         if (proctree_locked)
1041                 sx_xunlock(&proctree_lock);
1042         return (error);
1043 }
1044 #undef PROC_READ
1045 #undef PROC_WRITE
1046
1047 /*
1048  * Stop a process because of a debugging event;
1049  * stay stopped until p->p_step is cleared
1050  * (cleared by PIOCCONT in procfs).
1051  */
1052 void
1053 stopevent(struct proc *p, unsigned int event, unsigned int val)
1054 {
1055
1056         PROC_LOCK_ASSERT(p, MA_OWNED);
1057         p->p_step = 1;
1058         do {
1059                 p->p_xstat = val;
1060                 p->p_xthread = NULL;
1061                 p->p_stype = event;     /* Which event caused the stop? */
1062                 wakeup(&p->p_stype);    /* Wake up any PIOCWAIT'ing procs */
1063                 msleep(&p->p_step, &p->p_mtx, PWAIT, "stopevent", 0);
1064         } while (p->p_step);
1065 }