xref: /freebsd/sys/kern/sys_process.c (revision 32b99a26c37ffcba4b1437f548cbbe7fcf1323dc)
1 /*-
2  * SPDX-License-Identifier: BSD-4-Clause
3  *
4  * Copyright (c) 1994, Sean Eric Fagan
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Sean Eric Fagan.
18  * 4. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #include <sys/systm.h>
35 #include <sys/capsicum.h>
36 #include <sys/filedesc.h>
37 #include <sys/imgact.h>
38 #include <sys/ktr.h>
39 #include <sys/limits.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mman.h>
43 #include <sys/mutex.h>
44 #include <sys/priv.h>
45 #include <sys/proc.h>
46 #include <sys/procdesc.h>
47 #include <sys/ptrace.h>
48 #include <sys/reg.h>
49 #include <sys/rwlock.h>
50 #include <sys/signalvar.h>
51 #include <sys/sleepqueue.h>
52 #include <sys/sx.h>
53 #include <sys/syscallsubr.h>
54 #include <sys/sysctl.h>
55 #include <sys/sysent.h>
56 #include <sys/sysproto.h>
57 #include <sys/vnode.h>
58 
59 #include <security/audit/audit.h>
60 
61 #include <vm/vm.h>
62 #include <vm/pmap.h>
63 #include <vm/vm_extern.h>
64 #include <vm/vm_map.h>
65 #include <vm/vm_kern.h>
66 #include <vm/vm_object.h>
67 #include <vm/vm_page.h>
68 #include <vm/vm_param.h>
69 
70 #ifdef COMPAT_FREEBSD32
71 #include <sys/procfs.h>
72 #endif
73 
74 bool allow_ptrace_in_cap_mode = true;
75 SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace_in_cap_mode, CTLFLAG_RWTUN,
76     &allow_ptrace_in_cap_mode, 0,
77     "Allow ptrace(2) in capability mode");
78 
79 /* Assert it's safe to unlock a process, e.g. to allocate working memory */
80 #define	PROC_ASSERT_TRACEREQ(p)	MPASS(((p)->p_flag2 & P2_PTRACEREQ) != 0)
81 
82 /*
83  * Functions implemented below:
84  *
85  * proc_read_regs(proc, regs)
86  *	Get the current user-visible register set from the process
87  *	and copy it into the regs structure (<machine/reg.h>).
88  *	The process is stopped at the time read_regs is called.
89  *
90  * proc_write_regs(proc, regs)
91  *	Update the current register set from the passed in regs
92  *	structure.  Take care to avoid clobbering special CPU
93  *	registers or privileged bits in the PSL.
94  *	Depending on the architecture this may have fix-up work to do,
95  *	especially if the IAR or PCW are modified.
96  *	The process is stopped at the time write_regs is called.
97  *
98  * proc_read_fpregs, proc_write_fpregs
99  *	deal with the floating point register set, otherwise as above.
100  *
101  * proc_read_dbregs, proc_write_dbregs
102  *	deal with the processor debug register set, otherwise as above.
103  *
104  * proc_sstep(proc)
105  *	Arrange for the process to trap after executing a single instruction.
106  */
107 
108 int
109 proc_read_regs(struct thread *td, struct reg *regs)
110 {
111 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
112 	return (fill_regs(td, regs));
113 }
114 
115 int
116 proc_write_regs(struct thread *td, struct reg *regs)
117 {
118 	int error;
119 
120 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
121 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
122 	if (error != 0)
123 		return (error);
124 	return (set_regs(td, regs));
125 }
126 
127 int
128 proc_read_dbregs(struct thread *td, struct dbreg *dbregs)
129 {
130 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
131 	return (fill_dbregs(td, dbregs));
132 }
133 
134 int
135 proc_write_dbregs(struct thread *td, struct dbreg *dbregs)
136 {
137 	int error;
138 
139 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
140 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
141 	if (error != 0)
142 		return (error);
143 	return (set_dbregs(td, dbregs));
144 }
145 
146 /*
147  * Ptrace doesn't support fpregs at all, and there are no security holes
148  * or translations for fpregs, so we can just copy them.
149  */
150 int
151 proc_read_fpregs(struct thread *td, struct fpreg *fpregs)
152 {
153 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
154 	return (fill_fpregs(td, fpregs));
155 }
156 
157 int
158 proc_write_fpregs(struct thread *td, struct fpreg *fpregs)
159 {
160 	int error;
161 
162 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
163 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
164 	if (error != 0)
165 		return (error);
166 	return (set_fpregs(td, fpregs));
167 }
168 
169 static struct regset *
170 proc_find_regset(struct thread *td, int note)
171 {
172 	struct regset **regsetp, **regset_end, *regset;
173 	struct sysentvec *sv;
174 
175 	sv = td->td_proc->p_sysent;
176 	regsetp = sv->sv_regset_begin;
177 	if (regsetp == NULL)
178 		return (NULL);
179 	regset_end = sv->sv_regset_end;
180 	MPASS(regset_end != NULL);
181 	for (; regsetp < regset_end; regsetp++) {
182 		regset = *regsetp;
183 		if (regset->note != note)
184 			continue;
185 
186 		return (regset);
187 	}
188 
189 	return (NULL);
190 }
191 
192 static int
193 proc_read_regset(struct thread *td, int note, struct iovec *iov)
194 {
195 	struct regset *regset;
196 	struct proc *p;
197 	void *buf;
198 	size_t size;
199 	int error;
200 
201 	regset = proc_find_regset(td, note);
202 	if (regset == NULL)
203 		return (EINVAL);
204 
205 	if (regset->get == NULL)
206 		return (EINVAL);
207 
208 	size = regset->size;
209 	/*
210 	 * The regset is dynamically sized, e.g. the size could change
211 	 * depending on the hardware, or may have a per-thread size.
212 	 */
213 	if (size == 0) {
214 		if (!regset->get(regset, td, NULL, &size))
215 			return (EINVAL);
216 	}
217 
218 	if (iov->iov_base == NULL) {
219 		iov->iov_len = size;
220 		if (iov->iov_len == 0)
221 			return (EINVAL);
222 
223 		return (0);
224 	}
225 
226 	/* The length is wrong, return an error */
227 	if (iov->iov_len != size)
228 		return (EINVAL);
229 
230 	error = 0;
231 	p = td->td_proc;
232 
233 	/* Drop the proc lock while allocating the temp buffer */
234 	PROC_ASSERT_TRACEREQ(p);
235 	PROC_UNLOCK(p);
236 	buf = malloc(size, M_TEMP, M_WAITOK);
237 	PROC_LOCK(p);
238 
239 	if (!regset->get(regset, td, buf, &size)) {
240 		error = EINVAL;
241 	} else {
242 		KASSERT(size == regset->size || regset->size == 0,
243 		    ("%s: Getter function changed the size", __func__));
244 
245 		iov->iov_len = size;
246 		PROC_UNLOCK(p);
247 		error = copyout(buf, iov->iov_base, size);
248 		PROC_LOCK(p);
249 	}
250 
251 	free(buf, M_TEMP);
252 
253 	return (error);
254 }
255 
256 static int
257 proc_write_regset(struct thread *td, int note, struct iovec *iov)
258 {
259 	struct regset *regset;
260 	struct proc *p;
261 	void *buf;
262 	size_t size;
263 	int error;
264 
265 	regset = proc_find_regset(td, note);
266 	if (regset == NULL)
267 		return (EINVAL);
268 
269 	size = regset->size;
270 	/*
271 	 * The regset is dynamically sized, e.g. the size could change
272 	 * depending on the hardware, or may have a per-thread size.
273 	 */
274 	if (size == 0) {
275 		if (!regset->get(regset, td, NULL, &size))
276 			return (EINVAL);
277 	}
278 
279 	/* The length is wrong, return an error */
280 	if (iov->iov_len != size)
281 		return (EINVAL);
282 
283 	if (regset->set == NULL)
284 		return (EINVAL);
285 
286 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
287 	if (error != 0)
288 		return (error);
289 
290 	p = td->td_proc;
291 
292 	/* Drop the proc lock while allocating the temp buffer */
293 	PROC_ASSERT_TRACEREQ(p);
294 	PROC_UNLOCK(p);
295 	buf = malloc(size, M_TEMP, M_WAITOK);
296 	error = copyin(iov->iov_base, buf, size);
297 	PROC_LOCK(p);
298 
299 	if (error == 0) {
300 		if (!regset->set(regset, td, buf, size)) {
301 			error = EINVAL;
302 		}
303 	}
304 
305 	free(buf, M_TEMP);
306 
307 	return (error);
308 }
309 
310 #ifdef COMPAT_FREEBSD32
311 /* For 32 bit binaries, we need to expose the 32 bit regs layouts. */
312 int
313 proc_read_regs32(struct thread *td, struct reg32 *regs32)
314 {
315 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
316 	return (fill_regs32(td, regs32));
317 }
318 
319 int
320 proc_write_regs32(struct thread *td, struct reg32 *regs32)
321 {
322 	int error;
323 
324 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
325 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
326 	if (error != 0)
327 		return (error);
328 	return (set_regs32(td, regs32));
329 }
330 
331 int
332 proc_read_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
333 {
334 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
335 	return (fill_dbregs32(td, dbregs32));
336 }
337 
338 int
339 proc_write_dbregs32(struct thread *td, struct dbreg32 *dbregs32)
340 {
341 	int error;
342 
343 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
344 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
345 	if (error != 0)
346 		return (error);
347 	return (set_dbregs32(td, dbregs32));
348 }
349 
350 int
351 proc_read_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
352 {
353 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
354 	return (fill_fpregs32(td, fpregs32));
355 }
356 
357 int
358 proc_write_fpregs32(struct thread *td, struct fpreg32 *fpregs32)
359 {
360 	int error;
361 
362 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
363 	error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
364 	if (error != 0)
365 		return (error);
366 	return (set_fpregs32(td, fpregs32));
367 }
368 #endif
369 
370 int
371 proc_sstep(struct thread *td)
372 {
373 	PROC_LOCK_ASSERT(td->td_proc, MA_OWNED);
374 	return (ptrace_single_step(td));
375 }
376 
377 static int
378 proc_vmspace_check_access(struct thread *td, struct proc *p, int flags)
379 {
380 	PROC_ASSERT_HELD(p);
381 	if ((flags & PRVM_CHECK_DEBUG) != 0)
382 		return (p_candebug(td, p));
383 	if ((flags & PRVM_CHECK_VISIBILITY) != 0)
384 		return (p_cansee(td, p));
385 	return (0);
386 }
387 
388 int
389 proc_vmspace_ref(struct thread *td, struct proc *p, int flags,
390     struct vmspace **vmp)
391 {
392 	struct vmspace *vm;
393 	int error;
394 
395 	MPASS((flags & ~(PRVM_BLOCK_EXEC | PRVM_CHECK_VISIBILITY |
396 	    PRVM_CHECK_DEBUG)) == 0);
397 	MPASS((flags & (PRVM_CHECK_VISIBILITY | PRVM_CHECK_DEBUG)) !=
398 	    (PRVM_CHECK_VISIBILITY | PRVM_CHECK_DEBUG));
399 
400 	PROC_LOCK(p);
401 	if (p != td->td_proc) {
402 		PROC_ASSERT_HELD(p);
403 
404 		/*
405 		 * Make sure that the vmspace doesn't switch out from
406 		 * under us.
407 		 */
408 		if ((flags & PRVM_BLOCK_EXEC) != 0) {
409 			for (;;) {
410 				if (!execve_block(td, p)) {
411 					PROC_LOCK(p);
412 					continue;
413 				}
414 				error = proc_vmspace_check_access(td, p, flags);
415 				if (error != 0) {
416 					execve_unblock(td, p);
417 					PROC_UNLOCK(p);
418 					return (error);
419 				}
420 				break;
421 			}
422 		} else {
423 			error = proc_vmspace_check_access(td, p, flags);
424 			if (error != 0) {
425 				PROC_UNLOCK(p);
426 				return (error);
427 			}
428 		}
429 	}
430 	vm = vmspace_acquire_ref(p);
431 	if (vm == NULL) {
432 		if (p != td->td_proc && (flags & PRVM_BLOCK_EXEC) != 0)
433 			execve_unblock(td, p);
434 		PROC_UNLOCK(p);
435 		return (ESRCH);
436 	}
437 	PROC_UNLOCK(p);
438 	*vmp = vm;
439 	return (0);
440 }
441 
442 void
443 proc_vmspace_unref(struct thread *td, struct proc *p, int flags,
444     struct vmspace *vm)
445 {
446 	vmspace_free(vm);
447 	if (p != td->td_proc && (flags & PRVM_BLOCK_EXEC) != 0) {
448 		PROC_LOCK(p);
449 		PROC_ASSERT_HELD(p);
450 		execve_unblock(td, p);
451 		PROC_UNLOCK(p);
452 	}
453 }
454 
455 static int
456 vmspace_rwmem(struct vmspace *vm, struct uio *uio)
457 {
458 	vm_map_t map;
459 	vm_offset_t pageno;		/* page number */
460 	vm_prot_t reqprot;
461 	ssize_t orig_resid;
462 	int error, fault_flags, page_offset, writing;
463 
464 	map = &vm->vm_map;
465 
466 	/*
467 	 * If we are writing, then we request vm_fault() to create a private
468 	 * copy of each page.  Since these copies will not be writeable by the
469 	 * process, we must explicitly request that they be dirtied.
470 	 */
471 	writing = uio->uio_rw == UIO_WRITE;
472 	reqprot = writing ? VM_PROT_COPY | VM_PROT_READ : VM_PROT_READ;
473 	fault_flags = writing ? VM_FAULT_DIRTY : VM_FAULT_NORMAL;
474 
475 	orig_resid = uio->uio_resid;
476 
477 	if (writing) {
478 		error = priv_check(curthread, PRIV_PROC_MEM_WRITE);
479 		if (error != 0)
480 			return (error);
481 	}
482 
483 	/*
484 	 * Only map in one page at a time.  We don't have to, but it
485 	 * makes things easier.  This way is trivial - right?
486 	 */
487 	do {
488 		vm_offset_t uva;
489 		u_int len;
490 		vm_page_t m;
491 
492 		uva = (vm_offset_t)uio->uio_offset;
493 
494 		/*
495 		 * Get the page number of this segment.
496 		 */
497 		pageno = trunc_page(uva);
498 		page_offset = uva - pageno;
499 
500 		/*
501 		 * How many bytes to copy
502 		 */
503 		len = MIN(PAGE_SIZE - page_offset, uio->uio_resid);
504 
505 		/*
506 		 * Fault and hold the page on behalf of the process.
507 		 */
508 		error = vm_fault(map, pageno, reqprot, fault_flags, &m);
509 		if (error != KERN_SUCCESS) {
510 			if (error == KERN_RESOURCE_SHORTAGE)
511 				error = ENOMEM;
512 			else
513 				error = EFAULT;
514 			break;
515 		}
516 
517 		/*
518 		 * Now do the i/o move.
519 		 */
520 		error = uiomove_fromphys(&m, page_offset, len, uio);
521 
522 		/* Make the I-cache coherent for breakpoints. */
523 		if (writing && error == 0) {
524 			vm_map_lock_read(map);
525 			if (vm_map_check_protection(map, pageno, pageno +
526 			    PAGE_SIZE, VM_PROT_EXECUTE))
527 				vm_sync_icache(map, uva, len);
528 			vm_map_unlock_read(map);
529 		}
530 
531 		/*
532 		 * Release the page.
533 		 */
534 		vm_page_unwire(m, PQ_ACTIVE);
535 
536 	} while (error == 0 && uio->uio_resid > 0);
537 	return (uio->uio_resid == orig_resid ? error : 0);
538 }
539 
540 int
541 proc_rwmem(struct proc *p, struct uio *uio, int flags)
542 {
543 	struct vmspace *vm;
544 	struct thread *td;
545 	int error;
546 
547 	td = curthread;
548 	error = proc_vmspace_ref(td, p, flags, &vm);
549 	if (error != 0)
550 		return (error);
551 	error = vmspace_rwmem(vm, uio);
552 	proc_vmspace_unref(td, p, flags, vm);
553 	return (error);
554 }
555 
556 ssize_t
557 vmspace_iop(struct thread *td, struct vmspace *vm, vm_offset_t va, void *buf,
558     size_t len, enum uio_rw rw)
559 {
560 	struct iovec iov;
561 	struct uio uio;
562 	ssize_t slen;
563 	int error;
564 
565 	MPASS(len < SSIZE_MAX);
566 	slen = (ssize_t)len;
567 
568 	iov.iov_base = (caddr_t)buf;
569 	iov.iov_len = len;
570 	uio.uio_iov = &iov;
571 	uio.uio_iovcnt = 1;
572 	uio.uio_offset = va;
573 	uio.uio_resid = slen;
574 	uio.uio_segflg = UIO_SYSSPACE;
575 	uio.uio_rw = rw;
576 	uio.uio_td = td;
577 	error = vmspace_rwmem(vm, &uio);
578 	if (error != 0 || uio.uio_resid == slen)
579 		return (-1);
580 	return (slen - uio.uio_resid);
581 }
582 
583 ssize_t
584 proc_readmem(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
585     size_t len)
586 {
587 
588 	return (vmspace_iop(td, p->p_vmspace, va, buf, len, UIO_READ));
589 }
590 
591 ssize_t
592 proc_writemem(struct thread *td, struct proc *p, vm_offset_t va, void *buf,
593     size_t len)
594 {
595 
596 	return (vmspace_iop(td, p->p_vmspace, va, buf, len, UIO_WRITE));
597 }
598 
599 static int
600 ptrace_vm_entry(struct thread *td, struct proc *p, struct ptrace_vm_entry *pve)
601 {
602 	struct vattr vattr;
603 	vm_map_t map;
604 	vm_map_entry_t entry;
605 	vm_object_t obj, tobj, lobj;
606 	struct vmspace *vm;
607 	struct vnode *vp;
608 	char *freepath, *fullpath;
609 	u_int pathlen;
610 	int error, index;
611 
612 	error = 0;
613 	obj = NULL;
614 
615 	vm = vmspace_acquire_ref(p);
616 	map = &vm->vm_map;
617 	vm_map_lock_read(map);
618 
619 	do {
620 		KASSERT((map->header.eflags & MAP_ENTRY_IS_SUB_MAP) == 0,
621 		    ("Submap in map header"));
622 		index = 0;
623 		VM_MAP_ENTRY_FOREACH(entry, map) {
624 			if (index >= pve->pve_entry &&
625 			    (entry->eflags & MAP_ENTRY_IS_SUB_MAP) == 0)
626 				break;
627 			index++;
628 		}
629 		if (index < pve->pve_entry) {
630 			error = EINVAL;
631 			break;
632 		}
633 		if (entry == &map->header) {
634 			error = ENOENT;
635 			break;
636 		}
637 
638 		/* We got an entry. */
639 		pve->pve_entry = index + 1;
640 		pve->pve_timestamp = map->timestamp;
641 		pve->pve_start = entry->start;
642 		pve->pve_end = entry->end - 1;
643 		pve->pve_offset = entry->offset;
644 		pve->pve_prot = entry->protection |
645 		    PROT_MAX(entry->max_protection);
646 
647 		/* Backing object's path needed? */
648 		if (pve->pve_pathlen == 0)
649 			break;
650 
651 		pathlen = pve->pve_pathlen;
652 		pve->pve_pathlen = 0;
653 
654 		obj = entry->object.vm_object;
655 		if (obj != NULL)
656 			VM_OBJECT_RLOCK(obj);
657 	} while (0);
658 
659 	vm_map_unlock_read(map);
660 
661 	pve->pve_fsid = VNOVAL;
662 	pve->pve_fileid = VNOVAL;
663 
664 	if (error == 0 && obj != NULL) {
665 		lobj = obj;
666 		for (tobj = obj; tobj != NULL; tobj = tobj->backing_object) {
667 			if (tobj != obj)
668 				VM_OBJECT_RLOCK(tobj);
669 			if (lobj != obj)
670 				VM_OBJECT_RUNLOCK(lobj);
671 			lobj = tobj;
672 			pve->pve_offset += tobj->backing_object_offset;
673 		}
674 		vp = vm_object_vnode(lobj);
675 		if (vp != NULL)
676 			vref(vp);
677 		if (lobj != obj)
678 			VM_OBJECT_RUNLOCK(lobj);
679 		VM_OBJECT_RUNLOCK(obj);
680 
681 		if (vp != NULL) {
682 			freepath = NULL;
683 			fullpath = NULL;
684 			vn_fullpath(vp, &fullpath, &freepath);
685 			vn_lock(vp, LK_SHARED | LK_RETRY);
686 			if (VOP_GETATTR(vp, &vattr, td->td_ucred) == 0) {
687 				pve->pve_fileid = vattr.va_fileid;
688 				pve->pve_fsid = vattr.va_fsid;
689 			}
690 			vput(vp);
691 
692 			if (fullpath != NULL) {
693 				pve->pve_pathlen = strlen(fullpath) + 1;
694 				if (pve->pve_pathlen <= pathlen) {
695 					error = copyout(fullpath, pve->pve_path,
696 					    pve->pve_pathlen);
697 				} else
698 					error = ENAMETOOLONG;
699 			}
700 			if (freepath != NULL)
701 				free(freepath, M_TEMP);
702 		}
703 	}
704 	vmspace_free(vm);
705 	if (error == 0)
706 		CTR3(KTR_PTRACE, "PT_VM_ENTRY: pid %d, entry %d, start %p",
707 		    p->p_pid, pve->pve_entry, pve->pve_start);
708 
709 	return (error);
710 }
711 
712 static int
713 ptrace_check_allowed(struct thread *td, int req, bool pd_mode, pid_t pid)
714 {
715 	if (!allow_ptrace)
716 		return (ENOSYS);
717 	if (!IN_CAPABILITY_MODE(td))
718 		return (0);
719 	if (!allow_ptrace_in_cap_mode)
720 		return (ECAPMODE);
721 	if (pd_mode)
722 		return (0);
723 	if (req == PT_GET_CHILDREN && pid == td->td_proc->p_pid)
724 		return (0);
725 	if (req == PT_CLEARSTEP && pid == td->td_tid)
726 		return (0);
727 	return (ECAPMODE);
728 }
729 
730 /*
731  * Process debugging system call.
732  */
733 #ifndef _SYS_SYSPROTO_H_
734 struct ptrace_args {
735 	int	req;
736 	pid_t	pid;
737 	caddr_t	addr;
738 	int	data;
739 };
740 #endif
741 
742 static int
743 ptrace_useraction(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd,
744     lwpid_t lwpid, void *uaddr, int udata)
745 {
746 	/*
747 	 * XXX this obfuscation is to reduce stack usage, but the register
748 	 * structs may be too large to put on the stack anyway.
749 	 */
750 	union {
751 		struct ptrace_io_desc piod;
752 		struct ptrace_lwpinfo pl;
753 		struct ptrace_vm_entry pve;
754 		struct ptrace_coredump pc;
755 		struct ptrace_sc_remote sr;
756 		struct dbreg dbreg;
757 		struct fpreg fpreg;
758 		struct reg reg;
759 		struct iovec vec;
760 		syscallarg_t args[nitems(td->td_sa.args)];
761 		struct ptrace_sc_ret psr;
762 		int ptevents;
763 		struct ptrace_child *children;
764 		char sv_name[32];
765 	} r;
766 	syscallarg_t pscr_args[nitems(td->td_sa.args)];
767 	void *addr;
768 	int error, data;
769 
770 	error = ptrace_check_allowed(td, req, pd_mode, pid);
771 	if (error != 0)
772 		return (error);
773 
774 	addr = &r;
775 	switch (req) {
776 	case PT_GET_EVENT_MASK:
777 	case PT_LWPINFO:
778 	case PT_GET_SC_ARGS:
779 	case PT_GET_SC_RET:
780 		break;
781 	case PT_SET_SC_RET:
782 		error = udata != sizeof(r.psr) ? EINVAL :
783 		    copyin(uaddr, &r.psr, sizeof(r.psr));
784 		break;
785 	case PT_GETREGS:
786 		bzero(&r.reg, sizeof(r.reg));
787 		break;
788 	case PT_GETFPREGS:
789 		bzero(&r.fpreg, sizeof(r.fpreg));
790 		break;
791 	case PT_GETDBREGS:
792 		bzero(&r.dbreg, sizeof(r.dbreg));
793 		break;
794 	case PT_GETREGSET:
795 	case PT_SETREGSET:
796 		error = copyin(uaddr, &r.vec, sizeof(r.vec));
797 		break;
798 	case PT_SETREGS:
799 		error = copyin(uaddr, &r.reg, sizeof(r.reg));
800 		break;
801 	case PT_SETFPREGS:
802 		error = copyin(uaddr, &r.fpreg, sizeof(r.fpreg));
803 		break;
804 	case PT_SETDBREGS:
805 		error = copyin(uaddr, &r.dbreg, sizeof(r.dbreg));
806 		break;
807 	case PT_SET_EVENT_MASK:
808 		error = udata != sizeof(r.ptevents) ? EINVAL :
809 		    copyin(uaddr, &r.ptevents, udata);
810 		break;
811 	case PT_IO:
812 		error = copyin(uaddr, &r.piod, sizeof(r.piod));
813 		break;
814 	case PT_VM_ENTRY:
815 		error = copyin(uaddr, &r.pve, sizeof(r.pve));
816 		break;
817 	case PT_COREDUMP:
818 		error = udata != sizeof(r.pc) ? EINVAL :
819 		    copyin(uaddr, &r.pc, udata);
820 		break;
821 	case PT_SC_REMOTE:
822 		error = udata != sizeof(r.sr) ? EINVAL :
823 		    copyin(uaddr, &r.sr, udata);
824 		if (error != 0)
825 			break;
826 		if (r.sr.pscr_nargs > nitems(td->td_sa.args)) {
827 			error = EINVAL;
828 			break;
829 		}
830 		error = copyin(r.sr.pscr_args, pscr_args,
831 		    sizeof(u_long) * r.sr.pscr_nargs);
832 		if (error != 0)
833 			break;
834 		r.sr.pscr_args = pscr_args;
835 		break;
836 	case PT_GET_CHILDREN:
837 		if (uaddr == NULL)
838 			addr = NULL;
839 		else if (udata < 0)
840 			error = EINVAL;
841 		else
842 			addr = &r.children;
843 		break;
844 	case PT_GET_ABI_NAME:
845 		if (udata < 0) {
846 			error = EINVAL;
847 			break;
848 		}
849 		data = udata;
850 		udata = sizeof(r.sv_name);
851 		break;
852 	case PTINTERNAL_FIRST ... PTINTERNAL_LAST:
853 		error = EINVAL;
854 		break;
855 	default:
856 		addr = uaddr;
857 		break;
858 	}
859 	if (error != 0)
860 		return (error);
861 
862 	error = ptrace_action(td, req, pd_mode, pid, pfd, lwpid, addr, udata);
863 	if (error != 0)
864 		return (error);
865 
866 	switch (req) {
867 	case PT_VM_ENTRY:
868 		error = copyout(&r.pve, uaddr, sizeof(r.pve));
869 		break;
870 	case PT_IO:
871 		error = copyout(&r.piod, uaddr, sizeof(r.piod));
872 		break;
873 	case PT_GETREGS:
874 		error = copyout(&r.reg, uaddr, sizeof(r.reg));
875 		break;
876 	case PT_GETFPREGS:
877 		error = copyout(&r.fpreg, uaddr, sizeof(r.fpreg));
878 		break;
879 	case PT_GETDBREGS:
880 		error = copyout(&r.dbreg, uaddr, sizeof(r.dbreg));
881 		break;
882 	case PT_GETREGSET:
883 		error = copyout(&r.vec, uaddr, sizeof(r.vec));
884 		break;
885 	case PT_GET_EVENT_MASK:
886 		/* NB: The size in uap->data is validated in ptraceimpl(). */
887 		error = copyout(&r.ptevents, uaddr, udata);
888 		break;
889 	case PT_LWPINFO:
890 		/* NB: The size in uap->data is validated in ptraceimpl(). */
891 		error = copyout(&r.pl, uaddr, udata);
892 		break;
893 	case PT_GET_SC_ARGS:
894 		error = copyout(r.args, uaddr, MIN(udata, sizeof(r.args)));
895 		break;
896 	case PT_GET_SC_RET:
897 		error = copyout(&r.psr, uaddr, MIN(udata, sizeof(r.psr)));
898 		break;
899 	case PT_SC_REMOTE:
900 		error = copyout(&r.sr.pscr_ret, (char *)uaddr +
901 		    offsetof(struct ptrace_sc_remote, pscr_ret),
902 		    sizeof(r.sr.pscr_ret));
903 		break;
904 	case PT_GET_CHILDREN:
905 		if (uaddr != NULL) {
906 			error = copyout(r.children, uaddr,
907 			    td->td_retval[0] * sizeof(struct ptrace_child));
908 			free(r.children, M_TEMP);
909 		}
910 		break;
911 	case PT_GET_ABI_NAME:
912 		error = data <= strlen(r.sv_name) ? ENOMEM :
913 		    copyout(&r.sv_name, uaddr, strlen(r.sv_name) + 1);
914 		break;
915 	}
916 
917 	return (error);
918 }
919 
920 #ifdef COMPAT_FREEBSD32
921 /*
922  *   PROC_READ(regs, td2, addr);
923  * becomes either:
924  *   proc_read_regs(td2, addr);
925  * or
926  *   proc_read_regs32(td2, addr);
927  * .. except this is done at runtime.  There is an additional
928  * complication in that PROC_WRITE disallows 32 bit consumers
929  * from writing to 64 bit address space targets.
930  */
931 #define	PROC_READ(w, t, a)	wrap32 ? \
932 	proc_read_ ## w ## 32(t, a) : \
933 	proc_read_ ## w (t, a)
934 #define	PROC_WRITE(w, t, a)	wrap32 ? \
935 	(safe ? proc_write_ ## w ## 32(t, a) : EINVAL ) : \
936 	proc_write_ ## w (t, a)
937 #else
938 #define	PROC_READ(w, t, a)	proc_read_ ## w (t, a)
939 #define	PROC_WRITE(w, t, a)	proc_write_ ## w (t, a)
940 #endif
941 
942 void
943 proc_set_traced(struct proc *p, bool stop)
944 {
945 
946 	sx_assert(&proctree_lock, SX_XLOCKED);
947 	PROC_LOCK_ASSERT(p, MA_OWNED);
948 	p->p_flag |= P_TRACED;
949 	if (stop)
950 		p->p_flag2 |= P2_PTRACE_FSTP;
951 	p->p_ptevents = PTRACE_DEFAULT;
952 }
953 
954 void
955 ptrace_unsuspend(struct proc *p)
956 {
957 	PROC_LOCK_ASSERT(p, MA_OWNED);
958 
959 	PROC_SLOCK(p);
960 	p->p_flag &= ~(P_STOPPED_TRACE | P_STOPPED_SIG | P_WAITED);
961 	thread_unsuspend(p);
962 	PROC_SUNLOCK(p);
963 	itimer_proc_continue(p);
964 	kqtimer_proc_continue(p);
965 }
966 
967 static int
968 proc_can_ptrace1(struct thread *td, struct proc *p)
969 {
970 	int error;
971 
972 	PROC_LOCK_ASSERT(p, MA_OWNED);
973 
974 	if ((p->p_flag & P_WEXIT) != 0)
975 		return (ESRCH);
976 	if ((error = p_cansee(td, p)) != 0)
977 		return (error);
978 	if ((error = p_candebug(td, p)) != 0)
979 		return (error);
980 	return (0);
981 }
982 
983 static int
984 proc_can_ptrace(struct thread *td, struct proc *p)
985 {
986 	int error;
987 
988 	PROC_LOCK_ASSERT(p, MA_OWNED);
989 
990 	if ((error = proc_can_ptrace1(td, p)) != 0)
991 		return (error);
992 
993 	/* not being traced... */
994 	if ((p->p_flag & P_TRACED) == 0)
995 		return (EPERM);
996 
997 	/* not being traced by YOU */
998 	if (p->p_pptr != td->td_proc)
999 		return (EBUSY);
1000 
1001 	/* not currently stopped */
1002 	if ((p->p_flag & P_STOPPED_TRACE) == 0 ||
1003 	    p->p_suspcount != p->p_numthreads  ||
1004 	    (p->p_flag & P_WAITED) == 0)
1005 		return (EBUSY);
1006 
1007 	return (0);
1008 }
1009 
1010 static int
1011 ptrace_count_children(struct thread *td, struct proc *p, bool count_everything)
1012 {
1013 	struct proc *pp;
1014 	int error, num;
1015 
1016 	sx_assert(&proctree_lock, SX_LOCKED);
1017 	num = 0;
1018 	LIST_FOREACH(pp, &p->p_children, p_sibling) {
1019 		if (count_everything) {
1020 			error = 0;
1021 		} else {
1022 			PROC_LOCK(pp);
1023 			error = p_cansee(td, pp);
1024 			PROC_UNLOCK(pp);
1025 		}
1026 		if (error != 0)
1027 			continue;
1028 		num++;
1029 	}
1030 	LIST_FOREACH(pp, &p->p_orphans, p_orphan) {
1031 		if (count_everything) {
1032 			error = 0;
1033 		} else {
1034 			PROC_LOCK(pp);
1035 			error = p_cansee(td, pp);
1036 			PROC_UNLOCK(pp);
1037 		}
1038 		if (error != 0)
1039 			continue;
1040 		num++;
1041 	}
1042 	return (num);
1043 }
1044 
1045 static bool
1046 ptrace_report_child(struct thread *td, struct proc *p, struct proc *pp,
1047     struct ptrace_child *ptc)
1048 {
1049 	sx_assert(&proctree_lock, SX_LOCKED);
1050 
1051 	PROC_LOCK(pp);
1052 	if (p_cansee(td, pp) != 0) {
1053 		PROC_UNLOCK(pp);
1054 		return (false);
1055 	}
1056 	ptc->pid = pp->p_pid;
1057 	if ((pp->p_flag & P_TRACED) != 0) {
1058 		ptc->flags |= PTCHLD_TRACED;
1059 		if (pp->p_pptr == td->td_proc)
1060 			ptc->flags |= PTCHLD_TRACED_BY_ME;
1061 	}
1062 	if ((pp->p_flag & P_WEXIT) != 0)
1063 		ptc->flags |= PTCHLD_EXITED;
1064 	PROC_UNLOCK(pp);
1065 	return (true);
1066 }
1067 
1068 static struct thread *
1069 ptrace_sel_coredump_thread(struct proc *p)
1070 {
1071 	struct thread *td2;
1072 
1073 	PROC_LOCK_ASSERT(p, MA_OWNED);
1074 	MPASS((p->p_flag & P_STOPPED_TRACE) != 0);
1075 
1076 	FOREACH_THREAD_IN_PROC(p, td2) {
1077 		if ((td2->td_dbgflags & TDB_SSWITCH) != 0)
1078 			return (td2);
1079 	}
1080 	return (NULL);
1081 }
1082 
1083 int
1084 ptrace_action(struct thread *td, int req, bool pd_mode, pid_t pid, int pfd,
1085     lwpid_t lwpid, void *addr, int data)
1086 {
1087 	struct iovec iov;
1088 	struct uio uio;
1089 	struct proc *curp, *p, *pp;
1090 	struct thread *td2 = NULL, *td3;
1091 	struct ptrace_io_desc *piod = NULL;
1092 	struct ptrace_lwpinfo *pl;
1093 	struct ptrace_sc_ret *psr;
1094 	struct ptrace_sc_remote *pscr;
1095 	struct file *fp;
1096 	struct ptrace_coredump *pc;
1097 	struct thr_coredump_req *tcq;
1098 	struct thr_syscall_req *tsr;
1099 	struct file *pfp;
1100 	struct ptrace_child *children, *ptc;
1101 	int error, num, num1, tmp;
1102 	lwpid_t tid = 0, *buf;
1103 #ifdef COMPAT_FREEBSD32
1104 	int wrap32 = 0, safe = 0;
1105 #endif
1106 	bool need_can_ptrace, proctree_locked, p2_req_set;
1107 
1108 	curp = td->td_proc;
1109 	proctree_locked = false;
1110 	p2_req_set = false;
1111 	pfp = NULL;
1112 
1113 	/* Lock proctree before locking the process. */
1114 	switch (req) {
1115 	case PT_TRACE_ME:
1116 	case PT_ATTACH:
1117 	case PT_STEP:
1118 	case PT_CONTINUE:
1119 	case PT_TO_SCE:
1120 	case PT_TO_SCX:
1121 	case PT_SYSCALL:
1122 	case PT_FOLLOW_FORK:
1123 	case PT_LWP_EVENTS:
1124 	case PT_GET_EVENT_MASK:
1125 	case PT_SET_EVENT_MASK:
1126 	case PT_DETACH:
1127 	case PT_GET_SC_ARGS:
1128 	case PT_GET_CHILDREN:
1129 		sx_xlock(&proctree_lock);
1130 		proctree_locked = true;
1131 		break;
1132 	default:
1133 		break;
1134 	}
1135 
1136 	if (req == PT_TRACE_ME) {
1137 		p = td->td_proc;
1138 		PROC_LOCK(p);
1139 	} else if (pd_mode) {
1140 		if (!proctree_locked)
1141 			sx_slock(&proctree_lock);
1142 		error = fget_procdesc(td, pfd, &cap_ptrace_rights, EINVAL,
1143 		    &pfp, NULL, &p);
1144 		if (!proctree_locked)
1145 			sx_sunlock(&proctree_lock);
1146 		if (error != 0)
1147 			goto fail_proctree;
1148 		pid = p->p_pid;
1149 		if (lwpid != -1) {
1150 			FOREACH_THREAD_IN_PROC(p, td2) {
1151 				if (td2->td_tid == lwpid)
1152 					break;
1153 			}
1154 			if (td2 == NULL) {
1155 				PROC_UNLOCK(p);
1156 				error = ESRCH;
1157 				goto fail_proctree;
1158 			}
1159 			tid = td2->td_tid;
1160 		}
1161 	} else if (pid <= PID_MAX) {
1162 		if ((p = pfind(pid)) == NULL) {
1163 			error = ESRCH;
1164 			goto fail_proctree;
1165 		}
1166 	} else {
1167 		td2 = tdfind(pid, -1);
1168 		if (td2 == NULL) {
1169 			error = ESRCH;
1170 			goto fail_proctree;
1171 		}
1172 		p = td2->td_proc;
1173 		tid = pid;
1174 		pid = p->p_pid;
1175 	}
1176 	AUDIT_ARG_PROCESS(p);
1177 
1178 	error = proc_can_ptrace1(td, p);
1179 	if (error != 0)
1180 		goto fail;
1181 
1182 	/*
1183 	 * System processes can't be debugged.
1184 	 */
1185 	if ((p->p_flag & P_SYSTEM) != 0) {
1186 		error = EINVAL;
1187 		goto fail;
1188 	}
1189 
1190 	if (tid == 0) {
1191 		if ((p->p_flag & P_STOPPED_TRACE) != 0)
1192 			td2 = p->p_xthread;
1193 		if (td2 == NULL)
1194 			td2 = FIRST_THREAD_IN_PROC(p);
1195 		tid = td2->td_tid;
1196 	}
1197 
1198 #ifdef COMPAT_FREEBSD32
1199 	/*
1200 	 * Test if we're a 32 bit client and what the target is.
1201 	 * Set the wrap controls accordingly.
1202 	 */
1203 	if (SV_CURPROC_FLAG(SV_ILP32)) {
1204 		if (SV_PROC_FLAG(td2->td_proc, SV_ILP32))
1205 			safe = 1;
1206 		wrap32 = 1;
1207 	}
1208 #endif
1209 	/*
1210 	 * Permissions check
1211 	 */
1212 	need_can_ptrace = true;
1213 	switch (req) {
1214 	case PT_TRACE_ME:
1215 		/*
1216 		 * Always legal, when there is a parent process which
1217 		 * could trace us.  Otherwise, reject.
1218 		 */
1219 		if ((p->p_flag & P_TRACED) != 0) {
1220 			error = EBUSY;
1221 			goto fail;
1222 		}
1223 		if (p->p_pptr == initproc) {
1224 			error = EPERM;
1225 			goto fail;
1226 		}
1227 		break;
1228 
1229 	case PT_ATTACH:
1230 		/* Self */
1231 		if (p == td->td_proc) {
1232 			error = EINVAL;
1233 			goto fail;
1234 		}
1235 
1236 		/* Already traced */
1237 		if (p->p_flag & P_TRACED) {
1238 			error = EBUSY;
1239 			goto fail;
1240 		}
1241 
1242 		/* Can't trace an ancestor if you're being traced. */
1243 		if (curp->p_flag & P_TRACED) {
1244 			for (pp = curp->p_pptr; pp != NULL; pp = pp->p_pptr) {
1245 				if (pp == p) {
1246 					error = EINVAL;
1247 					goto fail;
1248 				}
1249 			}
1250 		}
1251 
1252 		/* OK */
1253 		break;
1254 
1255 	default:
1256 		/*
1257 		 * Allow thread to clear single step for itself.
1258 		 * PT_GET_CHILDREN on itself does not need P_TRACED.
1259 		 */
1260 		if ((req == PT_CLEARSTEP && td->td_tid == tid) ||
1261 		    (req == PT_GET_CHILDREN && p == curp))
1262 			need_can_ptrace = false;
1263 
1264 		/*
1265 		 * Check for ptrace eligibility before waiting for
1266 		 * holds to drain.
1267 		 */
1268 		if (need_can_ptrace) {
1269 			error = proc_can_ptrace(td, p);
1270 			if (error != 0)
1271 				goto fail;
1272 		}
1273 
1274 		/*
1275 		 * Block parallel ptrace requests.  Most important, do
1276 		 * not allow other thread in debugger to continue the
1277 		 * debuggee until coredump finished.
1278 		 */
1279 		while ((p->p_flag2 & P2_PTRACEREQ) != 0) {
1280 			if (proctree_locked)
1281 				sx_xunlock(&proctree_lock);
1282 			error = msleep(&p->p_flag2, &p->p_mtx, PPAUSE | PCATCH |
1283 			    (proctree_locked ? PDROP : 0), "pptrace", 0);
1284 			if (proctree_locked) {
1285 				sx_xlock(&proctree_lock);
1286 				PROC_LOCK(p);
1287 			}
1288 			if (error == 0 && td2->td_proc != p)
1289 				error = ESRCH;
1290 			if (error == 0 && need_can_ptrace)
1291 				error = proc_can_ptrace(td, p);
1292 			if (error != 0)
1293 				goto fail;
1294 		}
1295 
1296 		/* Ok */
1297 		break;
1298 	}
1299 
1300 	/*
1301 	 * Keep this process around and request parallel ptrace()
1302 	 * request to wait until we finish this request.
1303 	 */
1304 	MPASS((p->p_flag2 & P2_PTRACEREQ) == 0);
1305 	p->p_flag2 |= P2_PTRACEREQ;
1306 	p2_req_set = true;
1307 	_PHOLD(p);
1308 
1309 	/*
1310 	 * Actually do the requests
1311 	 */
1312 
1313 	td->td_retval[0] = 0;
1314 
1315 	switch (req) {
1316 	case PT_TRACE_ME:
1317 		/* set my trace flag and "owner" so it can read/write me */
1318 		proc_set_traced(p, false);
1319 		if (p->p_flag & P_PPWAIT)
1320 			p->p_flag |= P_PPTRACE;
1321 		CTR1(KTR_PTRACE, "PT_TRACE_ME: pid %d", p->p_pid);
1322 		break;
1323 
1324 	case PT_ATTACH:
1325 		/* security check done above */
1326 		/*
1327 		 * It would be nice if the tracing relationship was separate
1328 		 * from the parent relationship but that would require
1329 		 * another set of links in the proc struct or for "wait"
1330 		 * to scan the entire proc table.  To make life easier,
1331 		 * we just re-parent the process we're trying to trace.
1332 		 * The old parent is remembered so we can put things back
1333 		 * on a "detach".
1334 		 */
1335 		proc_set_traced(p, true);
1336 		proc_reparent(p, td->td_proc, false);
1337 		CTR2(KTR_PTRACE, "PT_ATTACH: pid %d, oppid %d", p->p_pid,
1338 		    p->p_oppid);
1339 
1340 		sx_xunlock(&proctree_lock);
1341 		proctree_locked = false;
1342 		MPASS(p->p_xthread == NULL);
1343 		MPASS((p->p_flag & P_STOPPED_TRACE) == 0);
1344 
1345 		/*
1346 		 * If already stopped due to a stop signal, clear the
1347 		 * existing stop before triggering a traced SIGSTOP.
1348 		 */
1349 		if ((p->p_flag & P_STOPPED_SIG) != 0) {
1350 			PROC_SLOCK(p);
1351 			p->p_flag &= ~(P_STOPPED_SIG | P_WAITED);
1352 			thread_unsuspend(p);
1353 			PROC_SUNLOCK(p);
1354 		}
1355 
1356 		kern_psignal(p, SIGSTOP);
1357 		break;
1358 
1359 	case PT_CLEARSTEP:
1360 		CTR2(KTR_PTRACE, "PT_CLEARSTEP: tid %d (pid %d)", td2->td_tid,
1361 		    p->p_pid);
1362 		error = ptrace_clear_single_step(td2);
1363 		break;
1364 
1365 	case PT_SETSTEP:
1366 		CTR2(KTR_PTRACE, "PT_SETSTEP: tid %d (pid %d)", td2->td_tid,
1367 		    p->p_pid);
1368 		error = ptrace_single_step(td2);
1369 		break;
1370 
1371 	case PT_SUSPEND:
1372 		CTR2(KTR_PTRACE, "PT_SUSPEND: tid %d (pid %d)", td2->td_tid,
1373 		    p->p_pid);
1374 		td2->td_dbgflags |= TDB_SUSPEND;
1375 		ast_sched(td2, TDA_SUSPEND);
1376 		break;
1377 
1378 	case PT_RESUME:
1379 		CTR2(KTR_PTRACE, "PT_RESUME: tid %d (pid %d)", td2->td_tid,
1380 		    p->p_pid);
1381 		td2->td_dbgflags &= ~TDB_SUSPEND;
1382 		break;
1383 
1384 	case PT_FOLLOW_FORK:
1385 		CTR3(KTR_PTRACE, "PT_FOLLOW_FORK: pid %d %s -> %s", p->p_pid,
1386 		    p->p_ptevents & PTRACE_FORK ? "enabled" : "disabled",
1387 		    data ? "enabled" : "disabled");
1388 		if (data)
1389 			p->p_ptevents |= PTRACE_FORK;
1390 		else
1391 			p->p_ptevents &= ~PTRACE_FORK;
1392 		break;
1393 
1394 	case PT_LWP_EVENTS:
1395 		CTR3(KTR_PTRACE, "PT_LWP_EVENTS: pid %d %s -> %s", p->p_pid,
1396 		    p->p_ptevents & PTRACE_LWP ? "enabled" : "disabled",
1397 		    data ? "enabled" : "disabled");
1398 		if (data)
1399 			p->p_ptevents |= PTRACE_LWP;
1400 		else
1401 			p->p_ptevents &= ~PTRACE_LWP;
1402 		break;
1403 
1404 	case PT_GET_EVENT_MASK:
1405 		if (data != sizeof(p->p_ptevents)) {
1406 			error = EINVAL;
1407 			break;
1408 		}
1409 		CTR2(KTR_PTRACE, "PT_GET_EVENT_MASK: pid %d mask %#x", p->p_pid,
1410 		    p->p_ptevents);
1411 		*(int *)addr = p->p_ptevents;
1412 		break;
1413 
1414 	case PT_SET_EVENT_MASK:
1415 		if (data != sizeof(p->p_ptevents)) {
1416 			error = EINVAL;
1417 			break;
1418 		}
1419 		tmp = *(int *)addr;
1420 		if ((tmp & ~(PTRACE_EXEC | PTRACE_SCE | PTRACE_SCX |
1421 		    PTRACE_FORK | PTRACE_LWP | PTRACE_VFORK)) != 0) {
1422 			error = EINVAL;
1423 			break;
1424 		}
1425 		CTR3(KTR_PTRACE, "PT_SET_EVENT_MASK: pid %d mask %#x -> %#x",
1426 		    p->p_pid, p->p_ptevents, tmp);
1427 		p->p_ptevents = tmp;
1428 		break;
1429 
1430 	case PT_GET_SC_ARGS:
1431 	case PTLINUX_GET_SC_ARGS:
1432 		CTR2(KTR_PTRACE, "%s: pid %d", req == PT_GET_SC_ARGS ?
1433 		    "PT_GET_SC_ARGS" : "PT_LINUX_GET_SC_ARGS", p->p_pid);
1434 		if (((td2->td_dbgflags & (TDB_SCE | TDB_SCX)) == 0 &&
1435 		     td2->td_sa.code == 0)
1436 #ifdef COMPAT_FREEBSD32
1437 		    || (wrap32 && !safe)
1438 #endif
1439 		    ) {
1440 			error = EINVAL;
1441 			break;
1442 		}
1443 		if (req == PT_GET_SC_ARGS) {
1444 			bzero(addr, sizeof(td2->td_sa.args));
1445 			bcopy(td2->td_sa.args, addr, td2->td_sa.callp->sy_narg *
1446 			    sizeof(syscallarg_t));
1447 		} else {
1448 			/*
1449 			 * Emulate a Linux bug which which strace(1) depends on:
1450 			 * at initialization it tests whether ptrace works by
1451 			 * calling close(2), or some other single-argument
1452 			 * syscall, _with six arguments_, and then verifies
1453 			 * whether it can fetch them all using this API;
1454 			 * otherwise it bails out.
1455 			 */
1456 			bcopy(td2->td_sa.args, addr, 6 * sizeof(syscallarg_t));
1457 		}
1458 		break;
1459 
1460 	case PT_GET_SC_RET:
1461 		if ((td2->td_dbgflags & TDB_SCX) == 0
1462 #ifdef COMPAT_FREEBSD32
1463 		    || (wrap32 && !safe)
1464 #endif
1465 		    ) {
1466 			error = EINVAL;
1467 			break;
1468 		}
1469 		psr = addr;
1470 		bzero(psr, sizeof(*psr));
1471 		psr->sr_error = td2->td_errno;
1472 		if (psr->sr_error == 0) {
1473 			psr->sr_retval[0] = td2->td_retval[0];
1474 			psr->sr_retval[1] = td2->td_retval[1];
1475 		}
1476 		CTR4(KTR_PTRACE,
1477 		    "PT_GET_SC_RET: pid %d error %d retval %#lx,%#lx",
1478 		    p->p_pid, psr->sr_error, psr->sr_retval[0],
1479 		    psr->sr_retval[1]);
1480 		break;
1481 
1482 	case PT_SET_SC_RET:
1483 		if ((td2->td_dbgflags & TDB_SCE) == 0
1484 #ifdef COMPAT_FREEBSD32
1485 		    || (wrap32 && !safe)
1486 #endif
1487 		    ) {
1488 			error = EINVAL;
1489 			break;
1490 		}
1491 		psr = addr;
1492 		td2->td_errno = psr->sr_error;
1493 		if (td2->td_errno == 0) {
1494 			td2->td_retval[0] = psr->sr_retval[0];
1495 			td2->td_retval[1] = psr->sr_retval[1];
1496 		}
1497 		td2->td_dbgflags |= TDB_SET_SC_RET;
1498 		break;
1499 
1500 	case PT_STEP:
1501 	case PT_CONTINUE:
1502 	case PT_TO_SCE:
1503 	case PT_TO_SCX:
1504 	case PT_SYSCALL:
1505 	case PT_DETACH:
1506 		/* Zero means do not send any signal */
1507 		if (data < 0 || data > _SIG_MAXSIG) {
1508 			error = EINVAL;
1509 			break;
1510 		}
1511 
1512 		switch (req) {
1513 		case PT_STEP:
1514 			CTR3(KTR_PTRACE, "PT_STEP: tid %d (pid %d), sig = %d",
1515 			    td2->td_tid, p->p_pid, data);
1516 			error = ptrace_single_step(td2);
1517 			if (error != 0)
1518 				goto out;
1519 			break;
1520 		case PT_CONTINUE:
1521 		case PT_TO_SCE:
1522 		case PT_TO_SCX:
1523 		case PT_SYSCALL:
1524 			if (addr != (void *)1) {
1525 				error = ptrace_set_pc(td2,
1526 				    (u_long)(uintfptr_t)addr);
1527 				if (error != 0)
1528 					goto out;
1529 				td2->td_dbgflags |= TDB_USERWR;
1530 			}
1531 			switch (req) {
1532 			case PT_TO_SCE:
1533 				p->p_ptevents |= PTRACE_SCE;
1534 				CTR4(KTR_PTRACE,
1535 		    "PT_TO_SCE: pid %d, events = %#x, PC = %#lx, sig = %d",
1536 				    p->p_pid, p->p_ptevents,
1537 				    (u_long)(uintfptr_t)addr, data);
1538 				break;
1539 			case PT_TO_SCX:
1540 				p->p_ptevents |= PTRACE_SCX;
1541 				CTR4(KTR_PTRACE,
1542 		    "PT_TO_SCX: pid %d, events = %#x, PC = %#lx, sig = %d",
1543 				    p->p_pid, p->p_ptevents,
1544 				    (u_long)(uintfptr_t)addr, data);
1545 				break;
1546 			case PT_SYSCALL:
1547 				p->p_ptevents |= PTRACE_SYSCALL;
1548 				CTR4(KTR_PTRACE,
1549 		    "PT_SYSCALL: pid %d, events = %#x, PC = %#lx, sig = %d",
1550 				    p->p_pid, p->p_ptevents,
1551 				    (u_long)(uintfptr_t)addr, data);
1552 				break;
1553 			case PT_CONTINUE:
1554 				CTR3(KTR_PTRACE,
1555 				    "PT_CONTINUE: pid %d, PC = %#lx, sig = %d",
1556 				    p->p_pid, (u_long)(uintfptr_t)addr, data);
1557 				break;
1558 			}
1559 			break;
1560 		case PT_DETACH:
1561 			/*
1562 			 * Clear P_TRACED before reparenting
1563 			 * a detached process back to its original
1564 			 * parent.  Otherwise the debugee will be set
1565 			 * as an orphan of the debugger.
1566 			 */
1567 			p->p_flag &= ~(P_TRACED | P_WAITED);
1568 
1569 			/*
1570 			 * Reset the process parent.
1571 			 */
1572 			if (p->p_oppid != p->p_pptr->p_pid) {
1573 				PROC_LOCK(p->p_pptr);
1574 				sigqueue_take(p->p_ksi);
1575 				PROC_UNLOCK(p->p_pptr);
1576 
1577 				pp = proc_realparent(p);
1578 				proc_reparent(p, pp, false);
1579 				if (pp == initproc)
1580 					p->p_sigparent = SIGCHLD;
1581 				CTR3(KTR_PTRACE,
1582 			    "PT_DETACH: pid %d reparented to pid %d, sig %d",
1583 				    p->p_pid, pp->p_pid, data);
1584 			} else {
1585 				CTR2(KTR_PTRACE, "PT_DETACH: pid %d, sig %d",
1586 				    p->p_pid, data);
1587 			}
1588 
1589 			p->p_ptevents = 0;
1590 			FOREACH_THREAD_IN_PROC(p, td3) {
1591 				if ((td3->td_dbgflags & TDB_FSTP) != 0) {
1592 					sigqueue_delete(&td3->td_sigqueue,
1593 					    SIGSTOP);
1594 				}
1595 				td3->td_dbgflags &= ~(TDB_XSIG | TDB_FSTP |
1596 				    TDB_SUSPEND | TDB_BORN);
1597 			}
1598 
1599 			if ((p->p_flag2 & P2_PTRACE_FSTP) != 0) {
1600 				sigqueue_delete(&p->p_sigqueue, SIGSTOP);
1601 				p->p_flag2 &= ~P2_PTRACE_FSTP;
1602 			}
1603 
1604 			/*
1605 			 * Send SIGCHLD and wakeup the parent as needed.  It
1606 			 * may be the case that they had stopped the child
1607 			 * before it got ptraced, and now they're in the middle
1608 			 * of a wait(2) for it to continue.
1609 			 */
1610 			PROC_LOCK(p->p_pptr);
1611 			childproc_continued(p);
1612 			PROC_UNLOCK(p->p_pptr);
1613 			break;
1614 		}
1615 
1616 		sx_xunlock(&proctree_lock);
1617 		proctree_locked = false;
1618 
1619 	sendsig:
1620 		MPASS(!proctree_locked);
1621 
1622 		/*
1623 		 * Clear the pending event for the thread that just
1624 		 * reported its event (p_xthread), if any.  This may
1625 		 * not be the thread passed to PT_CONTINUE, PT_STEP,
1626 		 * etc. if the debugger is resuming a different
1627 		 * thread.  There might be no reporting thread if
1628 		 * the process was just attached.
1629 		 *
1630 		 * Deliver any pending signal via the reporting thread.
1631 		 */
1632 		if (p->p_xthread != NULL) {
1633 			p->p_xthread->td_dbgflags &= ~TDB_XSIG;
1634 			p->p_xthread->td_xsig = data;
1635 			p->p_xthread = NULL;
1636 		}
1637 		p->p_xsig = data;
1638 
1639 		/*
1640 		 * P_WKILLED is insurance that a PT_KILL/SIGKILL
1641 		 * always works immediately, even if another thread is
1642 		 * unsuspended first and attempts to handle a
1643 		 * different signal or if the POSIX.1b style signal
1644 		 * queue cannot accommodate any new signals.
1645 		 */
1646 		if (data == SIGKILL)
1647 			proc_wkilled(p);
1648 
1649 		/*
1650 		 * If the PT_CONTINUE-like operation is attempted on
1651 		 * the thread on sleepq, this is possible only after
1652 		 * the transparent PT_ATTACH.  In this case, if the
1653 		 * caller modified the thread state, e.g. by writing
1654 		 * register file or specifying the pc, make the thread
1655 		 * xstopped by waking it up.
1656 		 */
1657 		if ((td2->td_dbgflags & TDB_USERWR) != 0 &&
1658 		    pt_attach_transparent) {
1659 			thread_lock(td2);
1660 			if (TD_ON_SLEEPQ(td2) &&
1661 			    (td2->td_flags & TDF_SINTR) != 0) {
1662 				td2->td_dbgflags &= ~TDB_USERWR;
1663 				sleepq_abort(td2, EINTR);
1664 			} else {
1665 				thread_unlock(td2);
1666 			}
1667 		}
1668 
1669 		/*
1670 		 * Unsuspend all threads.  To leave a thread
1671 		 * suspended, use PT_SUSPEND to suspend it before
1672 		 * continuing the process.
1673 		 */
1674 		ptrace_unsuspend(p);
1675 		break;
1676 
1677 	case PT_WRITE_I:
1678 	case PT_WRITE_D:
1679 		td2->td_dbgflags |= TDB_USERWR;
1680 		PROC_UNLOCK(p);
1681 		error = 0;
1682 		if (proc_writemem(td, p, (off_t)(uintptr_t)addr, &data,
1683 		    sizeof(int)) != sizeof(int))
1684 			error = ENOMEM;
1685 		else
1686 			CTR3(KTR_PTRACE, "PT_WRITE: pid %d: %p <= %#x",
1687 			    p->p_pid, addr, data);
1688 		PROC_LOCK(p);
1689 		break;
1690 
1691 	case PT_READ_I:
1692 	case PT_READ_D:
1693 		PROC_UNLOCK(p);
1694 		error = tmp = 0;
1695 		if (proc_readmem(td, p, (off_t)(uintptr_t)addr, &tmp,
1696 		    sizeof(int)) != sizeof(int))
1697 			error = ENOMEM;
1698 		else
1699 			CTR3(KTR_PTRACE, "PT_READ: pid %d: %p >= %#x",
1700 			    p->p_pid, addr, tmp);
1701 		td->td_retval[0] = tmp;
1702 		PROC_LOCK(p);
1703 		break;
1704 
1705 	case PT_IO:
1706 		piod = addr;
1707 		if (piod->piod_len > SSIZE_MAX) {
1708 			error = EINVAL;
1709 			goto out;
1710 		}
1711 		iov.iov_base = piod->piod_addr;
1712 		iov.iov_len = piod->piod_len;
1713 		uio.uio_offset = (off_t)(uintptr_t)piod->piod_offs;
1714 		uio.uio_resid = piod->piod_len;
1715 		uio.uio_iov = &iov;
1716 		uio.uio_iovcnt = 1;
1717 		uio.uio_segflg = UIO_USERSPACE;
1718 		uio.uio_td = td;
1719 		switch (piod->piod_op) {
1720 		case PIOD_READ_D:
1721 		case PIOD_READ_I:
1722 			CTR3(KTR_PTRACE, "PT_IO: pid %d: READ (%p, %#x)",
1723 			    p->p_pid, (uintptr_t)uio.uio_offset, uio.uio_resid);
1724 			uio.uio_rw = UIO_READ;
1725 			break;
1726 		case PIOD_WRITE_D:
1727 		case PIOD_WRITE_I:
1728 			CTR3(KTR_PTRACE, "PT_IO: pid %d: WRITE (%p, %#x)",
1729 			    p->p_pid, (uintptr_t)uio.uio_offset, uio.uio_resid);
1730 			td2->td_dbgflags |= TDB_USERWR;
1731 			uio.uio_rw = UIO_WRITE;
1732 			break;
1733 		default:
1734 			error = EINVAL;
1735 			goto out;
1736 		}
1737 		PROC_UNLOCK(p);
1738 		error = proc_rwmem(p, &uio, 0);
1739 		piod->piod_len -= uio.uio_resid;
1740 		PROC_LOCK(p);
1741 		break;
1742 
1743 	case PT_KILL:
1744 		CTR1(KTR_PTRACE, "PT_KILL: pid %d", p->p_pid);
1745 		data = SIGKILL;
1746 		goto sendsig;	/* in PT_CONTINUE above */
1747 
1748 	case PT_SETREGS:
1749 		CTR2(KTR_PTRACE, "PT_SETREGS: tid %d (pid %d)", td2->td_tid,
1750 		    p->p_pid);
1751 		td2->td_dbgflags |= TDB_USERWR;
1752 		error = PROC_WRITE(regs, td2, addr);
1753 		break;
1754 
1755 	case PT_GETREGS:
1756 		CTR2(KTR_PTRACE, "PT_GETREGS: tid %d (pid %d)", td2->td_tid,
1757 		    p->p_pid);
1758 		error = PROC_READ(regs, td2, addr);
1759 		break;
1760 
1761 	case PT_SETFPREGS:
1762 		CTR2(KTR_PTRACE, "PT_SETFPREGS: tid %d (pid %d)", td2->td_tid,
1763 		    p->p_pid);
1764 		td2->td_dbgflags |= TDB_USERWR;
1765 		error = PROC_WRITE(fpregs, td2, addr);
1766 		break;
1767 
1768 	case PT_GETFPREGS:
1769 		CTR2(KTR_PTRACE, "PT_GETFPREGS: tid %d (pid %d)", td2->td_tid,
1770 		    p->p_pid);
1771 		error = PROC_READ(fpregs, td2, addr);
1772 		break;
1773 
1774 	case PT_SETDBREGS:
1775 		CTR2(KTR_PTRACE, "PT_SETDBREGS: tid %d (pid %d)", td2->td_tid,
1776 		    p->p_pid);
1777 		td2->td_dbgflags |= TDB_USERWR;
1778 		error = PROC_WRITE(dbregs, td2, addr);
1779 		break;
1780 
1781 	case PT_GETDBREGS:
1782 		CTR2(KTR_PTRACE, "PT_GETDBREGS: tid %d (pid %d)", td2->td_tid,
1783 		    p->p_pid);
1784 		error = PROC_READ(dbregs, td2, addr);
1785 		break;
1786 
1787 	case PT_SETREGSET:
1788 		CTR2(KTR_PTRACE, "PT_SETREGSET: tid %d (pid %d)", td2->td_tid,
1789 		    p->p_pid);
1790 		error = proc_write_regset(td2, data, addr);
1791 		break;
1792 
1793 	case PT_GETREGSET:
1794 		CTR2(KTR_PTRACE, "PT_GETREGSET: tid %d (pid %d)", td2->td_tid,
1795 		    p->p_pid);
1796 		error = proc_read_regset(td2, data, addr);
1797 		break;
1798 
1799 	case PT_LWPINFO:
1800 		if (data <= 0 || data > sizeof(*pl)) {
1801 			error = EINVAL;
1802 			break;
1803 		}
1804 		pl = addr;
1805 		bzero(pl, sizeof(*pl));
1806 		pl->pl_lwpid = td2->td_tid;
1807 		pl->pl_event = PL_EVENT_NONE;
1808 		pl->pl_flags = 0;
1809 		if (td2->td_dbgflags & TDB_XSIG) {
1810 			pl->pl_event = PL_EVENT_SIGNAL;
1811 			if (td2->td_si.si_signo != 0 &&
1812 			    data >= offsetof(struct ptrace_lwpinfo, pl_siginfo)
1813 			    + sizeof(pl->pl_siginfo)){
1814 				pl->pl_flags |= PL_FLAG_SI;
1815 				pl->pl_siginfo = td2->td_si;
1816 			}
1817 		}
1818 		if (td2->td_dbgflags & TDB_SCE)
1819 			pl->pl_flags |= PL_FLAG_SCE;
1820 		else if (td2->td_dbgflags & TDB_SCX)
1821 			pl->pl_flags |= PL_FLAG_SCX;
1822 		if (td2->td_dbgflags & TDB_EXEC)
1823 			pl->pl_flags |= PL_FLAG_EXEC;
1824 		if (td2->td_dbgflags & TDB_FORK) {
1825 			pl->pl_flags |= PL_FLAG_FORKED;
1826 			pl->pl_child_pid = td2->td_dbg_forked;
1827 			if (td2->td_dbgflags & TDB_VFORK)
1828 				pl->pl_flags |= PL_FLAG_VFORKED;
1829 		} else if ((td2->td_dbgflags & (TDB_SCX | TDB_VFORK)) ==
1830 		    TDB_VFORK)
1831 			pl->pl_flags |= PL_FLAG_VFORK_DONE;
1832 		if (td2->td_dbgflags & TDB_CHILD)
1833 			pl->pl_flags |= PL_FLAG_CHILD;
1834 		if (td2->td_dbgflags & TDB_BORN)
1835 			pl->pl_flags |= PL_FLAG_BORN;
1836 		if (td2->td_dbgflags & TDB_EXIT)
1837 			pl->pl_flags |= PL_FLAG_EXITED;
1838 		pl->pl_sigmask = td2->td_sigmask;
1839 		pl->pl_siglist = td2->td_siglist;
1840 		strcpy(pl->pl_tdname, td2->td_name);
1841 		if (td2->td_sa.code != 0) {
1842 			pl->pl_syscall_code = td2->td_sa.code;
1843 			pl->pl_syscall_narg = td2->td_sa.callp->sy_narg;
1844 		}
1845 		CTR6(KTR_PTRACE,
1846     "PT_LWPINFO: tid %d (pid %d) event %d flags %#x child pid %d syscall %d",
1847 		    td2->td_tid, p->p_pid, pl->pl_event, pl->pl_flags,
1848 		    pl->pl_child_pid, pl->pl_syscall_code);
1849 		break;
1850 
1851 	case PT_GETNUMLWPS:
1852 		CTR2(KTR_PTRACE, "PT_GETNUMLWPS: pid %d: %d threads", p->p_pid,
1853 		    p->p_numthreads);
1854 		td->td_retval[0] = p->p_numthreads;
1855 		break;
1856 
1857 	case PT_GETLWPLIST:
1858 		CTR3(KTR_PTRACE, "PT_GETLWPLIST: pid %d: data %d, actual %d",
1859 		    p->p_pid, data, p->p_numthreads);
1860 		if (data <= 0) {
1861 			error = EINVAL;
1862 			break;
1863 		}
1864 		num = imin(p->p_numthreads, data);
1865 		PROC_UNLOCK(p);
1866 		buf = malloc(num * sizeof(lwpid_t), M_TEMP, M_WAITOK);
1867 		tmp = 0;
1868 		PROC_LOCK(p);
1869 		FOREACH_THREAD_IN_PROC(p, td2) {
1870 			if (tmp >= num)
1871 				break;
1872 			buf[tmp++] = td2->td_tid;
1873 		}
1874 		PROC_UNLOCK(p);
1875 		error = copyout(buf, addr, tmp * sizeof(lwpid_t));
1876 		free(buf, M_TEMP);
1877 		if (!error)
1878 			td->td_retval[0] = tmp;
1879 		PROC_LOCK(p);
1880 		break;
1881 
1882 	case PT_VM_TIMESTAMP:
1883 		CTR2(KTR_PTRACE, "PT_VM_TIMESTAMP: pid %d: timestamp %d",
1884 		    p->p_pid, p->p_vmspace->vm_map.timestamp);
1885 		td->td_retval[0] = p->p_vmspace->vm_map.timestamp;
1886 		break;
1887 
1888 	case PT_VM_ENTRY:
1889 		PROC_UNLOCK(p);
1890 		error = ptrace_vm_entry(td, p, addr);
1891 		PROC_LOCK(p);
1892 		break;
1893 
1894 	case PT_COREDUMP:
1895 		pc = addr;
1896 		CTR2(KTR_PTRACE, "PT_COREDUMP: pid %d, fd %d",
1897 		    p->p_pid, pc->pc_fd);
1898 
1899 		if ((pc->pc_flags & ~(PC_COMPRESS | PC_ALL)) != 0) {
1900 			error = EINVAL;
1901 			break;
1902 		}
1903 		PROC_UNLOCK(p);
1904 
1905 		tcq = malloc(sizeof(*tcq), M_TEMP, M_WAITOK | M_ZERO);
1906 		fp = NULL;
1907 		error = fget_write(td, pc->pc_fd, &cap_write_rights, &fp);
1908 		if (error != 0)
1909 			goto coredump_cleanup_nofp;
1910 		if (fp->f_type != DTYPE_VNODE || fp->f_vnode->v_type != VREG) {
1911 			error = EPIPE;
1912 			goto coredump_cleanup;
1913 		}
1914 
1915 		PROC_LOCK(p);
1916 		error = proc_can_ptrace(td, p);
1917 		if (error != 0)
1918 			goto coredump_cleanup_locked;
1919 
1920 		td2 = ptrace_sel_coredump_thread(p);
1921 		if (td2 == NULL) {
1922 			error = EBUSY;
1923 			goto coredump_cleanup_locked;
1924 		}
1925 		KASSERT((td2->td_dbgflags & (TDB_COREDUMPREQ |
1926 		    TDB_SCREMOTEREQ)) == 0,
1927 		    ("proc %d tid %d req coredump", p->p_pid, td2->td_tid));
1928 
1929 		tcq->tc_vp = fp->f_vnode;
1930 		tcq->tc_limit = pc->pc_limit == 0 ? OFF_MAX : pc->pc_limit;
1931 		tcq->tc_flags = SVC_PT_COREDUMP;
1932 		if ((pc->pc_flags & PC_COMPRESS) == 0)
1933 			tcq->tc_flags |= SVC_NOCOMPRESS;
1934 		if ((pc->pc_flags & PC_ALL) != 0)
1935 			tcq->tc_flags |= SVC_ALL;
1936 		td2->td_remotereq = tcq;
1937 		td2->td_dbgflags |= TDB_COREDUMPREQ;
1938 		thread_run_flash(td2);
1939 		while ((td2->td_dbgflags & TDB_COREDUMPREQ) != 0)
1940 			msleep(p, &p->p_mtx, PPAUSE, "crdmp", 0);
1941 		error = tcq->tc_error;
1942 coredump_cleanup_locked:
1943 		PROC_UNLOCK(p);
1944 coredump_cleanup:
1945 		fdrop(fp, td);
1946 coredump_cleanup_nofp:
1947 		free(tcq, M_TEMP);
1948 		PROC_LOCK(p);
1949 		break;
1950 
1951 	case PT_SC_REMOTE:
1952 		pscr = addr;
1953 		CTR2(KTR_PTRACE, "PT_SC_REMOTE: pid %d, syscall %d",
1954 		    p->p_pid, pscr->pscr_syscall);
1955 		if ((td2->td_dbgflags & TDB_BOUNDARY) == 0) {
1956 			error = EBUSY;
1957 			break;
1958 		}
1959 		PROC_UNLOCK(p);
1960 		MPASS(pscr->pscr_nargs <= nitems(td->td_sa.args));
1961 
1962 		tsr = malloc(sizeof(struct thr_syscall_req), M_TEMP,
1963 		    M_WAITOK | M_ZERO);
1964 
1965 		tsr->ts_sa.code = pscr->pscr_syscall;
1966 		tsr->ts_nargs = pscr->pscr_nargs;
1967 		memcpy(&tsr->ts_sa.args, pscr->pscr_args,
1968 		    sizeof(syscallarg_t) * tsr->ts_nargs);
1969 
1970 		PROC_LOCK(p);
1971 		error = proc_can_ptrace(td, p);
1972 		if (error != 0) {
1973 			free(tsr, M_TEMP);
1974 			break;
1975 		}
1976 		if (td2->td_proc != p) {
1977 			free(tsr, M_TEMP);
1978 			error = ESRCH;
1979 			break;
1980 		}
1981 		KASSERT((td2->td_dbgflags & (TDB_COREDUMPREQ |
1982 		    TDB_SCREMOTEREQ)) == 0,
1983 		    ("proc %d tid %d req coredump", p->p_pid, td2->td_tid));
1984 
1985 		td2->td_remotereq = tsr;
1986 		td2->td_dbgflags |= TDB_SCREMOTEREQ;
1987 		thread_run_flash(td2);
1988 		while ((td2->td_dbgflags & TDB_SCREMOTEREQ) != 0)
1989 			msleep(p, &p->p_mtx, PPAUSE, "pscrx", 0);
1990 		error = 0;
1991 		memcpy(&pscr->pscr_ret, &tsr->ts_ret, sizeof(tsr->ts_ret));
1992 		free(tsr, M_TEMP);
1993 		break;
1994 
1995 	case PT_GET_CHILDREN:
1996 		PROC_UNLOCK(p);
1997 get_children_repeat:
1998 		/*
1999 		 * If addr != NULL, we should ignore p_cansee() to
2000 		 * allocate enough space for the children array,
2001 		 * because the process is allowed to change visibility
2002 		 * between loops.  But do not count children which
2003 		 * we cannot see when only returning the count, to
2004 		 * avoid a leak of information.
2005 		 */
2006 		num = ptrace_count_children(td, p, addr != NULL);
2007 
2008 		if (addr == NULL) {
2009 			td->td_retval[0] = num;
2010 			PROC_LOCK(p);
2011 			break;
2012 		}
2013 		if (data < num * sizeof(struct ptrace_child)) {
2014 			error = ENOMEM;
2015 			PROC_LOCK(p);
2016 			break;
2017 		}
2018 		sx_xunlock(&proctree_lock);
2019 		children = mallocarray(num, sizeof(struct ptrace_child),
2020 		    M_TEMP, M_WAITOK | M_ZERO);
2021 		sx_xlock(&proctree_lock);
2022 		num1 = ptrace_count_children(td, p, true);
2023 		if (num1 > num) {
2024 			free(children, M_TEMP);
2025 			goto get_children_repeat;
2026 		}
2027 		num = num1;
2028 		num1 = 0;
2029 		LIST_FOREACH(pp, &p->p_children, p_sibling) {
2030 			MPASS(num1 < num);
2031 			ptc = &children[num1];
2032 			if (ptrace_report_child(td, p, pp, ptc))
2033 				num1++;
2034 		}
2035 		LIST_FOREACH(pp, &p->p_orphans, p_orphan) {
2036 			MPASS(num1 < num);
2037 			ptc = &children[num1];
2038 			if (ptrace_report_child(td, p, pp, ptc)) {
2039 				num1++;
2040 				ptc->flags |= PTCHLD_ORPHAN;
2041 			}
2042 		}
2043 		*(struct ptrace_child **)addr = children;
2044 		td->td_retval[0] = num1;
2045 		PROC_LOCK(p);
2046 		break;
2047 
2048 	case PT_GET_ABI_NAME:
2049 		if (strlcpy(addr, p->p_sysent->sv_name, data) >= data)
2050 			error = ENOMEM;
2051 		break;
2052 
2053 	default:
2054 #ifdef __HAVE_PTRACE_MACHDEP
2055 		if (req >= PT_FIRSTMACH) {
2056 			PROC_UNLOCK(p);
2057 			error = cpu_ptrace(td2, req, addr, data);
2058 			PROC_LOCK(p);
2059 		} else
2060 #endif
2061 			/* Unknown request. */
2062 			error = EINVAL;
2063 		break;
2064 	}
2065 out:
2066 	/* Drop our hold on this process now that the request has completed. */
2067 	_PRELE(p);
2068 fail:
2069 	if (p2_req_set) {
2070 		if ((p->p_flag2 & P2_PTRACEREQ) != 0)
2071 			wakeup(&p->p_flag2);
2072 		p->p_flag2 &= ~P2_PTRACEREQ;
2073 	}
2074 	PROC_UNLOCK(p);
2075 fail_proctree:
2076 	if (proctree_locked)
2077 		sx_xunlock(&proctree_lock);
2078 	if (pfp != NULL)
2079 		fdrop(pfp, td);
2080 	return (error);
2081 }
2082 #undef PROC_READ
2083 #undef PROC_WRITE
2084 
2085 int
2086 kern_ptrace(struct thread *td, int req, pid_t pid, void *addr, int data)
2087 {
2088 	return (ptrace_action(td, req, false, pid, -1, -1, addr, data));
2089 }
2090 
2091 int
2092 sys_ptrace(struct thread *td, struct ptrace_args *uap)
2093 {
2094 	int error;
2095 
2096 	AUDIT_ARG_PID(uap->pid);
2097 	AUDIT_ARG_CMD(uap->req);
2098 	AUDIT_ARG_VALUE(uap->data);
2099 
2100 	error = ptrace_useraction(td, uap->req, false, uap->pid, -1, -1,
2101 	    uap->addr, uap->data);
2102 	return (error);
2103 }
2104 
2105 int
2106 sys_pdptrace(struct thread *td, struct pdptrace_args *uap)
2107 {
2108 	int error;
2109 
2110 	AUDIT_ARG_FD(uap->pfd);
2111 	AUDIT_ARG_CMD(uap->req);
2112 	AUDIT_ARG_VALUE(uap->data);
2113 
2114 	error = ptrace_useraction(td, uap->req, true, -1, uap->pfd, uap->lwpid,
2115 	    uap->addr, uap->data);
2116 	return (error);
2117 }
2118