1.\" $FreeBSD$ 2.\" $NetBSD: ptrace.2,v 1.2 1995/02/27 12:35:37 cgd Exp $ 3.\" 4.\" This file is in the public domain. 5.Dd December 29, 2015 6.Dt PTRACE 2 7.Os 8.Sh NAME 9.Nm ptrace 10.Nd process tracing and debugging 11.Sh LIBRARY 12.Lb libc 13.Sh SYNOPSIS 14.In sys/types.h 15.In sys/ptrace.h 16.Ft int 17.Fn ptrace "int request" "pid_t pid" "caddr_t addr" "int data" 18.Sh DESCRIPTION 19The 20.Fn ptrace 21system call 22provides tracing and debugging facilities. 23It allows one process 24(the 25.Em tracing 26process) 27to control another 28(the 29.Em traced 30process). 31The tracing process must first attach to the traced process, and then 32issue a series of 33.Fn ptrace 34system calls to control the execution of the process, as well as access 35process memory and register state. 36For the duration of the tracing session, the traced process will be 37.Dq re-parented , 38with its parent process ID (and resulting behavior) 39changed to the tracing process. 40It is permissible for a tracing process to attach to more than one 41other process at a time. 42When the tracing process has completed its work, it must detach the 43traced process; if a tracing process exits without first detaching all 44processes it has attached, those processes will be killed. 45.Pp 46Most of the time, the traced process runs normally, but when it 47receives a signal 48(see 49.Xr sigaction 2 ) , 50it stops. 51The tracing process is expected to notice this via 52.Xr wait 2 53or the delivery of a 54.Dv SIGCHLD 55signal, examine the state of the stopped process, and cause it to 56terminate or continue as appropriate. 57The signal may be a normal process signal, generated as a result of 58traced process behavior, or use of the 59.Xr kill 2 60system call; alternatively, it may be generated by the tracing facility 61as a result of attaching, system calls, or stepping by the tracing 62process. 63The tracing process may choose to intercept the signal, using it to 64observe process behavior (such as 65.Dv SIGTRAP ) , 66or forward the signal to the process if appropriate. 67The 68.Fn ptrace 69system call 70is the mechanism by which all this happens. 71.Pp 72The 73.Fa request 74argument specifies what operation is being performed; the meaning of 75the rest of the arguments depends on the operation, but except for one 76special case noted below, all 77.Fn ptrace 78calls are made by the tracing process, and the 79.Fa pid 80argument specifies the process ID of the traced process 81or a corresponding thread ID. 82The 83.Fa request 84argument 85can be: 86.Bl -tag -width 12n 87.It Dv PT_TRACE_ME 88This request is the only one used by the traced process; it declares 89that the process expects to be traced by its parent. 90All the other arguments are ignored. 91(If the parent process does not expect to trace the child, it will 92probably be rather confused by the results; once the traced process 93stops, it cannot be made to continue except via 94.Fn ptrace . ) 95When a process has used this request and calls 96.Xr execve 2 97or any of the routines built on it 98(such as 99.Xr execv 3 ) , 100it will stop before executing the first instruction of the new image. 101Also, any setuid or setgid bits on the executable being executed will 102be ignored. 103If the child was created by 104.Xr vfork 2 105system call or 106.Xr rfork 2 107call with the 108.Dv RFMEM 109flag specified, the debugging events are reported to the parent 110only after the 111.Xr execve 2 112is executed. 113.It Dv PT_READ_I , Dv PT_READ_D 114These requests read a single 115.Vt int 116of data from the traced process's address space. 117Traditionally, 118.Fn ptrace 119has allowed for machines with distinct address spaces for instruction 120and data, which is why there are two requests: conceptually, 121.Dv PT_READ_I 122reads from the instruction space and 123.Dv PT_READ_D 124reads from the data space. 125In the current 126.Fx 127implementation, these two requests are completely identical. 128The 129.Fa addr 130argument specifies the address 131(in the traced process's virtual address space) 132at which the read is to be done. 133This address does not have to meet any alignment constraints. 134The value read is returned as the return value from 135.Fn ptrace . 136.It Dv PT_WRITE_I , Dv PT_WRITE_D 137These requests parallel 138.Dv PT_READ_I 139and 140.Dv PT_READ_D , 141except that they write rather than read. 142The 143.Fa data 144argument supplies the value to be written. 145.It Dv PT_IO 146This request allows reading and writing arbitrary amounts of data in 147the traced process's address space. 148The 149.Fa addr 150argument specifies a pointer to a 151.Vt "struct ptrace_io_desc" , 152which is defined as follows: 153.Bd -literal 154struct ptrace_io_desc { 155 int piod_op; /* I/O operation */ 156 void *piod_offs; /* child offset */ 157 void *piod_addr; /* parent offset */ 158 size_t piod_len; /* request length */ 159}; 160 161/* 162 * Operations in piod_op. 163 */ 164#define PIOD_READ_D 1 /* Read from D space */ 165#define PIOD_WRITE_D 2 /* Write to D space */ 166#define PIOD_READ_I 3 /* Read from I space */ 167#define PIOD_WRITE_I 4 /* Write to I space */ 168.Ed 169.Pp 170The 171.Fa data 172argument is ignored. 173The actual number of bytes read or written is stored in 174.Va piod_len 175upon return. 176.It Dv PT_CONTINUE 177The traced process continues execution. 178The 179.Fa addr 180argument 181is an address specifying the place where execution is to be resumed 182(a new value for the program counter), 183or 184.Po Vt caddr_t Pc Ns 1 185to indicate that execution is to pick up where it left off. 186The 187.Fa data 188argument 189provides a signal number to be delivered to the traced process as it 190resumes execution, or 0 if no signal is to be sent. 191.It Dv PT_STEP 192The traced process is single stepped one instruction. 193The 194.Fa addr 195argument 196should be passed 197.Po Vt caddr_t Pc Ns 1 . 198The 199.Fa data 200argument 201provides a signal number to be delivered to the traced process as it 202resumes execution, or 0 if no signal is to be sent. 203.It Dv PT_KILL 204The traced process terminates, as if 205.Dv PT_CONTINUE 206had been used with 207.Dv SIGKILL 208given as the signal to be delivered. 209.It Dv PT_ATTACH 210This request allows a process to gain control of an otherwise 211unrelated process and begin tracing it. 212It does not need any cooperation from the to-be-traced process. 213In 214this case, 215.Fa pid 216specifies the process ID of the to-be-traced process, and the other 217two arguments are ignored. 218This request requires that the target process must have the same real 219UID as the tracing process, and that it must not be executing a setuid 220or setgid executable. 221(If the tracing process is running as root, these restrictions do not 222apply.) 223The tracing process will see the newly-traced process stop and may 224then control it as if it had been traced all along. 225.It Dv PT_DETACH 226This request is like PT_CONTINUE, except that it does not allow 227specifying an alternate place to continue execution, and after it 228succeeds, the traced process is no longer traced and continues 229execution normally. 230.It Dv PT_GETREGS 231This request reads the traced process's machine registers into the 232.Do 233.Vt "struct reg" 234.Dc 235(defined in 236.In machine/reg.h ) 237pointed to by 238.Fa addr . 239.It Dv PT_SETREGS 240This request is the converse of 241.Dv PT_GETREGS ; 242it loads the traced process's machine registers from the 243.Do 244.Vt "struct reg" 245.Dc 246(defined in 247.In machine/reg.h ) 248pointed to by 249.Fa addr . 250.It Dv PT_GETFPREGS 251This request reads the traced process's floating-point registers into 252the 253.Do 254.Vt "struct fpreg" 255.Dc 256(defined in 257.In machine/reg.h ) 258pointed to by 259.Fa addr . 260.It Dv PT_SETFPREGS 261This request is the converse of 262.Dv PT_GETFPREGS ; 263it loads the traced process's floating-point registers from the 264.Do 265.Vt "struct fpreg" 266.Dc 267(defined in 268.In machine/reg.h ) 269pointed to by 270.Fa addr . 271.It Dv PT_GETDBREGS 272This request reads the traced process's debug registers into 273the 274.Do 275.Vt "struct dbreg" 276.Dc 277(defined in 278.In machine/reg.h ) 279pointed to by 280.Fa addr . 281.It Dv PT_SETDBREGS 282This request is the converse of 283.Dv PT_GETDBREGS ; 284it loads the traced process's debug registers from the 285.Do 286.Vt "struct dbreg" 287.Dc 288(defined in 289.In machine/reg.h ) 290pointed to by 291.Fa addr . 292.It Dv PT_LWPINFO 293This request can be used to obtain information about the kernel thread, 294also known as light-weight process, that caused the traced process to stop. 295The 296.Fa addr 297argument specifies a pointer to a 298.Vt "struct ptrace_lwpinfo" , 299which is defined as follows: 300.Bd -literal 301struct ptrace_lwpinfo { 302 lwpid_t pl_lwpid; 303 int pl_event; 304 int pl_flags; 305 sigset_t pl_sigmask; 306 sigset_t pl_siglist; 307 siginfo_t pl_siginfo; 308 char pl_tdname[MAXCOMLEN + 1]; 309 pid_t pl_child_pid; 310 u_int pl_syscall_code; 311 u_int pl_syscall_narg; 312}; 313.Ed 314.Pp 315The 316.Fa data 317argument is to be set to the size of the structure known to the caller. 318This allows the structure to grow without affecting older programs. 319.Pp 320The fields in the 321.Vt "struct ptrace_lwpinfo" 322have the following meaning: 323.Bl -tag -width indent -compact 324.It pl_lwpid 325LWP id of the thread 326.It pl_event 327Event that caused the stop. 328Currently defined events are 329.Bl -tag -width indent -compact 330.It PL_EVENT_NONE 331No reason given 332.It PL_EVENT_SIGNAL 333Thread stopped due to the pending signal 334.El 335.It pl_flags 336Flags that specify additional details about observed stop. 337Currently defined flags are: 338.Bl -tag -width indent -compact 339.It PL_FLAG_SCE 340The thread stopped due to system call entry, right after the kernel is entered. 341The debugger may examine syscall arguments that are stored in memory and 342registers according to the ABI of the current process, and modify them, 343if needed. 344.It PL_FLAG_SCX 345The thread is stopped immediately before syscall is returning to the usermode. 346The debugger may examine system call return values in the ABI-defined registers 347and/or memory. 348.It PL_FLAG_EXEC 349When 350.Dv PL_FLAG_SCX 351is set, this flag may be additionally specified to inform that the 352program being executed by debuggee process has been changed by successful 353execution of a system call from the 354.Fn execve 2 355family. 356.It PL_FLAG_SI 357Indicates that 358.Va pl_siginfo 359member of 360.Vt "struct ptrace_lwpinfo" 361contains valid information. 362.It PL_FLAG_FORKED 363Indicates that the process is returning from a call to 364.Fn fork 2 365that created a new child process. 366The process identifier of the new process is available in the 367.Va pl_child_pid 368member of 369.Vt "struct ptrace_lwpinfo" . 370.It PL_FLAG_CHILD 371The flag is set for first event reported from a new child, which is 372automatically attached due to 373.Dv PT_FOLLOW_FORK 374enabled. 375.It PL_FLAG_BORN 376This flag is set for the first event reported from a new LWP when LWP 377events are enabled via 378.Dv PT_LWP_EVENTS . 379It is reported along with 380.Dv PL_FLAG_SCX 381and is always reported if LWP events are enabled. 382.It PL_FLAG_EXITED 383This flag is set for the last event reported by an exiting LWP when 384LWP events are enabled via 385.Dv PT_LWP_EVENTS . 386Note that this event is not reported when the last LWP in a process exits. 387The termination of the last thread is reported via a normal process exit 388event. 389.El 390.It pl_sigmask 391The current signal mask of the LWP 392.It pl_siglist 393The current pending set of signals for the LWP. 394Note that signals that are delivered to the process would not appear 395on an LWP siglist until the thread is selected for delivery. 396.It pl_siginfo 397The siginfo that accompanies the signal pending. 398Only valid for 399.Dv PL_EVENT_SIGNAL 400stop when 401.Dv PL_FLAG_SI 402is set in 403.Va pl_flags . 404.It pl_tdname 405The name of the thread. 406.It pl_child_pid 407The process identifier of the new child process. 408Only valid for a 409.Dv PL_EVENT_SIGNAL 410stop when 411.Dv PL_FLAG_FORKED 412is set in 413.Va pl_flags . 414.It pl_syscall_code 415The ABI-specific identifier of the current system call. 416Note that for indirect system calls this field reports the indirected 417system call. 418Only valid when 419.Dv PL_FLAG_SCE 420or 421.Dv PL_FLAG_SCX 422is set in 423.Va pl_flags. 424.It pl_syscall_narg 425The number of arguments passed to the current system call not counting 426the system call identifier. 427Note that for indirect system calls this field reports the arguments 428passed to the indirected system call. 429Only valid when 430.Dv PL_FLAG_SCE 431or 432.Dv PL_FLAG_SCX 433is set in 434.Va pl_flags. 435.El 436.It PT_GETNUMLWPS 437This request returns the number of kernel threads associated with the 438traced process. 439.It PT_GETLWPLIST 440This request can be used to get the current thread list. 441A pointer to an array of type 442.Vt lwpid_t 443should be passed in 444.Fa addr , 445with the array size specified by 446.Fa data . 447The return value from 448.Fn ptrace 449is the count of array entries filled in. 450.It PT_SETSTEP 451This request will turn on single stepping of the specified process. 452.It PT_CLEARSTEP 453This request will turn off single stepping of the specified process. 454.It PT_SUSPEND 455This request will suspend the specified thread. 456.It PT_RESUME 457This request will resume the specified thread. 458.It PT_TO_SCE 459This request will trace the specified process on each system call entry. 460.It PT_TO_SCX 461This request will trace the specified process on each system call exit. 462.It PT_SYSCALL 463This request will trace the specified process 464on each system call entry and exit. 465.It PT_FOLLOW_FORK 466This request controls tracing for new child processes of a traced process. 467If 468.Fa data 469is non-zero, 470then new child processes will enable tracing and stop before executing their 471first instruction. 472If 473.Fa data 474is zero, then new child processes will execute without tracing enabled. 475By default, tracing is not enabled for new child processes. 476Child processes do not inherit this property. 477The traced process will set the 478.Dv PL_FLAG_FORKED 479flag upon exit from a system call that creates a new process. 480.It PT_LWP_EVENTS 481This request controls tracing of LWP creation and destruction. 482If 483.Fa data 484is non-zero, 485then LWPs will stop to report creation and destruction events. 486If 487.Fa data 488is zero, 489then LWP creation and destruction events will not be reported. 490By default, tracing is not enabled for LWP events. 491Child processes do not inherit this property. 492New LWPs will stop to report an event with 493.Dv PL_FLAG_BORN 494set before executing their first instruction. 495Exiting LWPs will stop to report an event with 496.Dv PL_FLAG_EXITED 497set before completing their termination. 498.Pp 499Note that new processes do not report an event for the creation of their 500initial thread, 501and exiting processes do not report an event for the termination of the 502last thread. 503.It PT_VM_TIMESTAMP 504This request returns the generation number or timestamp of the memory map of 505the traced process as the return value from 506.Fn ptrace . 507This provides a low-cost way for the tracing process to determine if the 508VM map changed since the last time this request was made. 509.It PT_VM_ENTRY 510This request is used to iterate over the entries of the VM map of the traced 511process. 512The 513.Fa addr 514argument specifies a pointer to a 515.Vt "struct ptrace_vm_entry" , 516which is defined as follows: 517.Bd -literal 518struct ptrace_vm_entry { 519 int pve_entry; 520 int pve_timestamp; 521 u_long pve_start; 522 u_long pve_end; 523 u_long pve_offset; 524 u_int pve_prot; 525 u_int pve_pathlen; 526 long pve_fileid; 527 uint32_t pve_fsid; 528 char *pve_path; 529}; 530.Ed 531.Pp 532The first entry is returned by setting 533.Va pve_entry 534to zero. 535Subsequent entries are returned by leaving 536.Va pve_entry 537unmodified from the value returned by previous requests. 538The 539.Va pve_timestamp 540field can be used to detect changes to the VM map while iterating over the 541entries. 542The tracing process can then take appropriate action, such as restarting. 543By setting 544.Va pve_pathlen 545to a non-zero value on entry, the pathname of the backing object is returned 546in the buffer pointed to by 547.Va pve_path , 548provided the entry is backed by a vnode. 549The 550.Va pve_pathlen 551field is updated with the actual length of the pathname (including the 552terminating null character). 553The 554.Va pve_offset 555field is the offset within the backing object at which the range starts. 556The range is located in the VM space at 557.Va pve_start 558and extends up to 559.Va pve_end 560(inclusive). 561.Pp 562The 563.Fa data 564argument is ignored. 565.El 566.Sh x86 MACHINE-SPECIFIC REQUESTS 567.Bl -tag -width "Dv PT_GETXSTATE_INFO" 568.It Dv PT_GETXMMREGS 569Copy the XMM FPU state into the buffer pointed to by the 570argument 571.Fa addr . 572The buffer has the same layout as the 32-bit save buffer for the 573machine instruction 574.Dv FXSAVE . 575.Pp 576This request is only valid for i386 programs, both on native 32-bit 577systems and on amd64 kernels. 578For 64-bit amd64 programs, the XMM state is reported as part of 579the FPU state returned by the 580.Dv PT_GETFPREGS 581request. 582.Pp 583The 584.Fa data 585argument is ignored. 586.It Dv PT_SETXMMREGS 587Load the XMM FPU state for the thread from the buffer pointed to 588by the argument 589.Fa addr . 590The buffer has the same layout as the 32-bit load buffer for the 591machine instruction 592.Dv FXRSTOR . 593.Pp 594As with 595.Dv PT_GETXMMREGS, 596this request is only valid for i386 programs. 597.Pp 598The 599.Fa data 600argument is ignored. 601.It Dv PT_GETXSTATE_INFO 602Report which XSAVE FPU extensions are supported by the CPU 603and allowed in userspace programs. 604The 605.Fa addr 606argument must point to a variable of type 607.Vt struct ptrace_xstate_info , 608which contains the information on the request return. 609.Vt struct ptrace_xstate_info 610is defined as follows: 611.Bd -literal 612struct ptrace_xstate_info { 613 uint64_t xsave_mask; 614 uint32_t xsave_len; 615}; 616.Ed 617The 618.Dv xsave_mask 619field is a bitmask of the currently enabled extensions. 620The meaning of the bits is defined in the Intel and AMD 621processor documentation. 622The 623.Dv xsave_len 624field reports the length of the XSAVE area for storing the hardware 625state for currently enabled extensions in the format defined by the x86 626.Dv XSAVE 627machine instruction. 628.Pp 629The 630.Fa data 631argument value must be equal to the size of the 632.Vt struct ptrace_xstate_info . 633.It Dv PT_GETXSTATE 634Return the content of the XSAVE area for the thread. 635The 636.Fa addr 637argument points to the buffer where the content is copied, and the 638.Fa data 639argument specifies the size of the buffer. 640The kernel copies out as much content as allowed by the buffer size. 641The buffer layout is specified by the layout of the save area for the 642.Dv XSAVE 643machine instruction. 644.It Dv PT_SETXSTATE 645Load the XSAVE state for the thread from the buffer specified by the 646.Fa addr 647pointer. 648The buffer size is passed in the 649.Fa data 650argument. 651The buffer must be at least as large as the 652.Vt struct savefpu 653(defined in 654.Pa x86/fpu.h ) 655to allow the complete x87 FPU and XMM state load. 656It must not be larger than the XSAVE state length, as reported by the 657.Dv xsave_len 658field from the 659.Vt struct ptrace_xstate_info 660of the 661.Dv PT_GETXSTATE_INFO 662request. 663Layout of the buffer is identical to the layout of the load area for the 664.Dv XRSTOR 665machine instruction. 666.It Dv PT_GETFSBASE 667Return the value of the base used when doing segmented 668memory addressing using the %fs segment register. 669The 670.Fa addr 671argument points to an 672.Vt unsigned long 673variable where the base value is stored. 674.Pp 675The 676.Fa data 677argument is ignored. 678.It Dv PT_GETGSBASE 679Like the 680.Dv PT_GETFSBASE 681request, but returns the base for the %gs segment register. 682.It Dv PT_SETFSBASE 683Set the base for the %fs segment register to the value pointed to 684by the 685.Fa addr 686argument. 687.Fa addr 688must point to the 689.Vt unsigned long 690variable containing the new base. 691.Pp 692The 693.Fa data 694argument is ignored. 695.It Dv PT_SETGSBASE 696Like the 697.Dv PT_SETFSBASE 698request, but sets the base for the %gs segment register. 699.El 700.Sh PowerPC MACHINE-SPECIFIC REQUESTS 701.Bl -tag -width "Dv PT_SETVRREGS" 702.It Dv PT_GETVRREGS 703Return the thread's 704.Dv ALTIVEC 705machine state in the buffer pointed to by 706.Fa addr . 707.Pp 708The 709.Fa data 710argument is ignored. 711.It Dv PT_SETVRREGS 712Set the thread's 713.Dv ALTIVEC 714machine state from the buffer pointed to by 715.Fa addr . 716.Pp 717The 718.Fa data 719argument is ignored. 720.El 721.Pp 722Additionally, other machine-specific requests can exist. 723.Sh RETURN VALUES 724Some requests can cause 725.Fn ptrace 726to return 727\-1 728as a non-error value; to disambiguate, 729.Va errno 730can be set to 0 before the call and checked afterwards. 731.Sh ERRORS 732The 733.Fn ptrace 734system call may fail if: 735.Bl -tag -width Er 736.It Bq Er ESRCH 737.Bl -bullet -compact 738.It 739No process having the specified process ID exists. 740.El 741.It Bq Er EINVAL 742.Bl -bullet -compact 743.It 744A process attempted to use 745.Dv PT_ATTACH 746on itself. 747.It 748The 749.Fa request 750argument 751was not one of the legal requests. 752.It 753The signal number 754(in 755.Fa data ) 756to 757.Dv PT_CONTINUE 758was neither 0 nor a legal signal number. 759.It 760.Dv PT_GETREGS , 761.Dv PT_SETREGS , 762.Dv PT_GETFPREGS , 763.Dv PT_SETFPREGS , 764.Dv PT_GETDBREGS , 765or 766.Dv PT_SETDBREGS 767was attempted on a process with no valid register set. 768(This is normally true only of system processes.) 769.It 770.Dv PT_VM_ENTRY 771was given an invalid value for 772.Fa pve_entry . 773This can also be caused by changes to the VM map of the process. 774.It 775The size (in 776.Fa data ) 777provided to 778.Dv PT_LWPINFO 779was less than or equal to zero, or larger than the 780.Vt ptrace_lwpinfo 781structure known to the kernel. 782.It 783The size (in 784.Fa data ) 785provided to the x86-specific 786.Dv PT_GETXSTATE_INFO 787request was not equal to the size of the 788.Vt struct ptrace_xstate_info . 789.It 790The size (in 791.Fa data ) 792provided to the x86-specific 793.Dv PT_SETXSTATE 794request was less than the size of the x87 plus the XMM save area. 795.It 796The size (in 797.Fa data ) 798provided to the x86-specific 799.Dv PT_SETXSTATE 800request was larger than returned in the 801.Dv xsave_len 802member of the 803.Vt struct ptrace_xstate_info 804from the 805.Dv PT_GETXSTATE_INFO 806request. 807.It 808The base value, provided to the amd64-specific requests 809.Dv PT_SETFSBASE 810or 811.Dv PT_SETGSBASE , 812pointed outside of the valid user address space. 813This error will not occur in 32-bit programs. 814.El 815.It Bq Er EBUSY 816.Bl -bullet -compact 817.It 818.Dv PT_ATTACH 819was attempted on a process that was already being traced. 820.It 821A request attempted to manipulate a process that was being traced by 822some process other than the one making the request. 823.It 824A request 825(other than 826.Dv PT_ATTACH ) 827specified a process that was not stopped. 828.El 829.It Bq Er EPERM 830.Bl -bullet -compact 831.It 832A request 833(other than 834.Dv PT_ATTACH ) 835attempted to manipulate a process that was not being traced at all. 836.It 837An attempt was made to use 838.Dv PT_ATTACH 839on a process in violation of the requirements listed under 840.Dv PT_ATTACH 841above. 842.El 843.It Bq Er ENOENT 844.Bl -bullet -compact 845.It 846.Dv PT_VM_ENTRY 847previously returned the last entry of the memory map. 848No more entries exist. 849.El 850.It Bq Er ENAMETOOLONG 851.Bl -bullet -compact 852.It 853.Dv PT_VM_ENTRY 854cannot return the pathname of the backing object because the buffer is not big 855enough. 856.Fa pve_pathlen 857holds the minimum buffer size required on return. 858.El 859.El 860.Sh SEE ALSO 861.Xr execve 2 , 862.Xr sigaction 2 , 863.Xr wait 2 , 864.Xr execv 3 , 865.Xr i386_clr_watch 3 , 866.Xr i386_set_watch 3 867.Sh HISTORY 868The 869.Fn ptrace 870function appeared in 871.At v7 . 872