kern_proc.c revision 272566
1/*-
2 * Copyright (c) 1982, 1986, 1989, 1991, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 *    may be used to endorse or promote products derived from this software
15 *    without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 *	@(#)kern_proc.c	8.7 (Berkeley) 2/14/95
30 */
31
32#include <sys/cdefs.h>
33__FBSDID("$FreeBSD: head/sys/kern/kern_proc.c 272566 2014-10-05 17:35:59Z kib $");
34
35#include "opt_compat.h"
36#include "opt_ddb.h"
37#include "opt_ktrace.h"
38#include "opt_kstack_pages.h"
39#include "opt_stack.h"
40
41#include <sys/param.h>
42#include <sys/systm.h>
43#include <sys/elf.h>
44#include <sys/exec.h>
45#include <sys/kernel.h>
46#include <sys/limits.h>
47#include <sys/lock.h>
48#include <sys/loginclass.h>
49#include <sys/malloc.h>
50#include <sys/mman.h>
51#include <sys/mount.h>
52#include <sys/mutex.h>
53#include <sys/proc.h>
54#include <sys/ptrace.h>
55#include <sys/refcount.h>
56#include <sys/resourcevar.h>
57#include <sys/rwlock.h>
58#include <sys/sbuf.h>
59#include <sys/sysent.h>
60#include <sys/sched.h>
61#include <sys/smp.h>
62#include <sys/stack.h>
63#include <sys/stat.h>
64#include <sys/sysctl.h>
65#include <sys/filedesc.h>
66#include <sys/tty.h>
67#include <sys/signalvar.h>
68#include <sys/sdt.h>
69#include <sys/sx.h>
70#include <sys/user.h>
71#include <sys/jail.h>
72#include <sys/vnode.h>
73#include <sys/eventhandler.h>
74
75#ifdef DDB
76#include <ddb/ddb.h>
77#endif
78
79#include <vm/vm.h>
80#include <vm/vm_param.h>
81#include <vm/vm_extern.h>
82#include <vm/pmap.h>
83#include <vm/vm_map.h>
84#include <vm/vm_object.h>
85#include <vm/vm_page.h>
86#include <vm/uma.h>
87
88#ifdef COMPAT_FREEBSD32
89#include <compat/freebsd32/freebsd32.h>
90#include <compat/freebsd32/freebsd32_util.h>
91#endif
92
93SDT_PROVIDER_DEFINE(proc);
94SDT_PROBE_DEFINE4(proc, kernel, ctor, entry, "struct proc *", "int",
95    "void *", "int");
96SDT_PROBE_DEFINE4(proc, kernel, ctor, return, "struct proc *", "int",
97    "void *", "int");
98SDT_PROBE_DEFINE4(proc, kernel, dtor, entry, "struct proc *", "int",
99    "void *", "struct thread *");
100SDT_PROBE_DEFINE3(proc, kernel, dtor, return, "struct proc *", "int",
101    "void *");
102SDT_PROBE_DEFINE3(proc, kernel, init, entry, "struct proc *", "int",
103    "int");
104SDT_PROBE_DEFINE3(proc, kernel, init, return, "struct proc *", "int",
105    "int");
106
107MALLOC_DEFINE(M_PGRP, "pgrp", "process group header");
108MALLOC_DEFINE(M_SESSION, "session", "session header");
109static MALLOC_DEFINE(M_PROC, "proc", "Proc structures");
110MALLOC_DEFINE(M_SUBPROC, "subproc", "Proc sub-structures");
111
112static void doenterpgrp(struct proc *, struct pgrp *);
113static void orphanpg(struct pgrp *pg);
114static void fill_kinfo_aggregate(struct proc *p, struct kinfo_proc *kp);
115static void fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp);
116static void fill_kinfo_thread(struct thread *td, struct kinfo_proc *kp,
117    int preferthread);
118static void pgadjustjobc(struct pgrp *pgrp, int entering);
119static void pgdelete(struct pgrp *);
120static int proc_ctor(void *mem, int size, void *arg, int flags);
121static void proc_dtor(void *mem, int size, void *arg);
122static int proc_init(void *mem, int size, int flags);
123static void proc_fini(void *mem, int size);
124static void pargs_free(struct pargs *pa);
125static struct proc *zpfind_locked(pid_t pid);
126
127/*
128 * Other process lists
129 */
130struct pidhashhead *pidhashtbl;
131u_long pidhash;
132struct pgrphashhead *pgrphashtbl;
133u_long pgrphash;
134struct proclist allproc;
135struct proclist zombproc;
136struct sx allproc_lock;
137struct sx proctree_lock;
138struct mtx ppeers_lock;
139uma_zone_t proc_zone;
140
141int kstack_pages = KSTACK_PAGES;
142SYSCTL_INT(_kern, OID_AUTO, kstack_pages, CTLFLAG_RD, &kstack_pages, 0,
143    "Kernel stack size in pages");
144static int vmmap_skip_res_cnt = 0;
145SYSCTL_INT(_kern, OID_AUTO, proc_vmmap_skip_resident_count, CTLFLAG_RW,
146    &vmmap_skip_res_cnt, 0,
147    "Skip calculation of the pages resident count in kern.proc.vmmap");
148
149CTASSERT(sizeof(struct kinfo_proc) == KINFO_PROC_SIZE);
150#ifdef COMPAT_FREEBSD32
151CTASSERT(sizeof(struct kinfo_proc32) == KINFO_PROC32_SIZE);
152#endif
153
154/*
155 * Initialize global process hashing structures.
156 */
157void
158procinit()
159{
160
161	sx_init(&allproc_lock, "allproc");
162	sx_init(&proctree_lock, "proctree");
163	mtx_init(&ppeers_lock, "p_peers", NULL, MTX_DEF);
164	LIST_INIT(&allproc);
165	LIST_INIT(&zombproc);
166	pidhashtbl = hashinit(maxproc / 4, M_PROC, &pidhash);
167	pgrphashtbl = hashinit(maxproc / 4, M_PROC, &pgrphash);
168	proc_zone = uma_zcreate("PROC", sched_sizeof_proc(),
169	    proc_ctor, proc_dtor, proc_init, proc_fini,
170	    UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
171	uihashinit();
172}
173
174/*
175 * Prepare a proc for use.
176 */
177static int
178proc_ctor(void *mem, int size, void *arg, int flags)
179{
180	struct proc *p;
181
182	p = (struct proc *)mem;
183	SDT_PROBE(proc, kernel, ctor , entry, p, size, arg, flags, 0);
184	EVENTHANDLER_INVOKE(process_ctor, p);
185	SDT_PROBE(proc, kernel, ctor , return, p, size, arg, flags, 0);
186	return (0);
187}
188
189/*
190 * Reclaim a proc after use.
191 */
192static void
193proc_dtor(void *mem, int size, void *arg)
194{
195	struct proc *p;
196	struct thread *td;
197
198	/* INVARIANTS checks go here */
199	p = (struct proc *)mem;
200	td = FIRST_THREAD_IN_PROC(p);
201	SDT_PROBE(proc, kernel, dtor, entry, p, size, arg, td, 0);
202	if (td != NULL) {
203#ifdef INVARIANTS
204		KASSERT((p->p_numthreads == 1),
205		    ("bad number of threads in exiting process"));
206		KASSERT(STAILQ_EMPTY(&p->p_ktr), ("proc_dtor: non-empty p_ktr"));
207#endif
208		/* Free all OSD associated to this thread. */
209		osd_thread_exit(td);
210	}
211	EVENTHANDLER_INVOKE(process_dtor, p);
212	if (p->p_ksi != NULL)
213		KASSERT(! KSI_ONQ(p->p_ksi), ("SIGCHLD queue"));
214	SDT_PROBE(proc, kernel, dtor, return, p, size, arg, 0, 0);
215}
216
217/*
218 * Initialize type-stable parts of a proc (when newly created).
219 */
220static int
221proc_init(void *mem, int size, int flags)
222{
223	struct proc *p;
224
225	p = (struct proc *)mem;
226	SDT_PROBE(proc, kernel, init, entry, p, size, flags, 0, 0);
227	p->p_sched = (struct p_sched *)&p[1];
228	bzero(&p->p_mtx, sizeof(struct mtx));
229	mtx_init(&p->p_mtx, "process lock", NULL, MTX_DEF | MTX_DUPOK);
230	mtx_init(&p->p_slock, "process slock", NULL, MTX_SPIN | MTX_RECURSE);
231	cv_init(&p->p_pwait, "ppwait");
232	cv_init(&p->p_dbgwait, "dbgwait");
233	TAILQ_INIT(&p->p_threads);	     /* all threads in proc */
234	EVENTHANDLER_INVOKE(process_init, p);
235	p->p_stats = pstats_alloc();
236	SDT_PROBE(proc, kernel, init, return, p, size, flags, 0, 0);
237	return (0);
238}
239
240/*
241 * UMA should ensure that this function is never called.
242 * Freeing a proc structure would violate type stability.
243 */
244static void
245proc_fini(void *mem, int size)
246{
247#ifdef notnow
248	struct proc *p;
249
250	p = (struct proc *)mem;
251	EVENTHANDLER_INVOKE(process_fini, p);
252	pstats_free(p->p_stats);
253	thread_free(FIRST_THREAD_IN_PROC(p));
254	mtx_destroy(&p->p_mtx);
255	if (p->p_ksi != NULL)
256		ksiginfo_free(p->p_ksi);
257#else
258	panic("proc reclaimed");
259#endif
260}
261
262/*
263 * Is p an inferior of the current process?
264 */
265int
266inferior(struct proc *p)
267{
268
269	sx_assert(&proctree_lock, SX_LOCKED);
270	PROC_LOCK_ASSERT(p, MA_OWNED);
271	for (; p != curproc; p = proc_realparent(p)) {
272		if (p->p_pid == 0)
273			return (0);
274	}
275	return (1);
276}
277
278struct proc *
279pfind_locked(pid_t pid)
280{
281	struct proc *p;
282
283	sx_assert(&allproc_lock, SX_LOCKED);
284	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
285		if (p->p_pid == pid) {
286			PROC_LOCK(p);
287			if (p->p_state == PRS_NEW) {
288				PROC_UNLOCK(p);
289				p = NULL;
290			}
291			break;
292		}
293	}
294	return (p);
295}
296
297/*
298 * Locate a process by number; return only "live" processes -- i.e., neither
299 * zombies nor newly born but incompletely initialized processes.  By not
300 * returning processes in the PRS_NEW state, we allow callers to avoid
301 * testing for that condition to avoid dereferencing p_ucred, et al.
302 */
303struct proc *
304pfind(pid_t pid)
305{
306	struct proc *p;
307
308	sx_slock(&allproc_lock);
309	p = pfind_locked(pid);
310	sx_sunlock(&allproc_lock);
311	return (p);
312}
313
314static struct proc *
315pfind_tid_locked(pid_t tid)
316{
317	struct proc *p;
318	struct thread *td;
319
320	sx_assert(&allproc_lock, SX_LOCKED);
321	FOREACH_PROC_IN_SYSTEM(p) {
322		PROC_LOCK(p);
323		if (p->p_state == PRS_NEW) {
324			PROC_UNLOCK(p);
325			continue;
326		}
327		FOREACH_THREAD_IN_PROC(p, td) {
328			if (td->td_tid == tid)
329				goto found;
330		}
331		PROC_UNLOCK(p);
332	}
333found:
334	return (p);
335}
336
337/*
338 * Locate a process group by number.
339 * The caller must hold proctree_lock.
340 */
341struct pgrp *
342pgfind(pgid)
343	register pid_t pgid;
344{
345	register struct pgrp *pgrp;
346
347	sx_assert(&proctree_lock, SX_LOCKED);
348
349	LIST_FOREACH(pgrp, PGRPHASH(pgid), pg_hash) {
350		if (pgrp->pg_id == pgid) {
351			PGRP_LOCK(pgrp);
352			return (pgrp);
353		}
354	}
355	return (NULL);
356}
357
358/*
359 * Locate process and do additional manipulations, depending on flags.
360 */
361int
362pget(pid_t pid, int flags, struct proc **pp)
363{
364	struct proc *p;
365	int error;
366
367	sx_slock(&allproc_lock);
368	if (pid <= PID_MAX) {
369		p = pfind_locked(pid);
370		if (p == NULL && (flags & PGET_NOTWEXIT) == 0)
371			p = zpfind_locked(pid);
372	} else if ((flags & PGET_NOTID) == 0) {
373		p = pfind_tid_locked(pid);
374	} else {
375		p = NULL;
376	}
377	sx_sunlock(&allproc_lock);
378	if (p == NULL)
379		return (ESRCH);
380	if ((flags & PGET_CANSEE) != 0) {
381		error = p_cansee(curthread, p);
382		if (error != 0)
383			goto errout;
384	}
385	if ((flags & PGET_CANDEBUG) != 0) {
386		error = p_candebug(curthread, p);
387		if (error != 0)
388			goto errout;
389	}
390	if ((flags & PGET_ISCURRENT) != 0 && curproc != p) {
391		error = EPERM;
392		goto errout;
393	}
394	if ((flags & PGET_NOTWEXIT) != 0 && (p->p_flag & P_WEXIT) != 0) {
395		error = ESRCH;
396		goto errout;
397	}
398	if ((flags & PGET_NOTINEXEC) != 0 && (p->p_flag & P_INEXEC) != 0) {
399		/*
400		 * XXXRW: Not clear ESRCH is the right error during proc
401		 * execve().
402		 */
403		error = ESRCH;
404		goto errout;
405	}
406	if ((flags & PGET_HOLD) != 0) {
407		_PHOLD(p);
408		PROC_UNLOCK(p);
409	}
410	*pp = p;
411	return (0);
412errout:
413	PROC_UNLOCK(p);
414	return (error);
415}
416
417/*
418 * Create a new process group.
419 * pgid must be equal to the pid of p.
420 * Begin a new session if required.
421 */
422int
423enterpgrp(p, pgid, pgrp, sess)
424	register struct proc *p;
425	pid_t pgid;
426	struct pgrp *pgrp;
427	struct session *sess;
428{
429
430	sx_assert(&proctree_lock, SX_XLOCKED);
431
432	KASSERT(pgrp != NULL, ("enterpgrp: pgrp == NULL"));
433	KASSERT(p->p_pid == pgid,
434	    ("enterpgrp: new pgrp and pid != pgid"));
435	KASSERT(pgfind(pgid) == NULL,
436	    ("enterpgrp: pgrp with pgid exists"));
437	KASSERT(!SESS_LEADER(p),
438	    ("enterpgrp: session leader attempted setpgrp"));
439
440	mtx_init(&pgrp->pg_mtx, "process group", NULL, MTX_DEF | MTX_DUPOK);
441
442	if (sess != NULL) {
443		/*
444		 * new session
445		 */
446		mtx_init(&sess->s_mtx, "session", NULL, MTX_DEF);
447		PROC_LOCK(p);
448		p->p_flag &= ~P_CONTROLT;
449		PROC_UNLOCK(p);
450		PGRP_LOCK(pgrp);
451		sess->s_leader = p;
452		sess->s_sid = p->p_pid;
453		refcount_init(&sess->s_count, 1);
454		sess->s_ttyvp = NULL;
455		sess->s_ttydp = NULL;
456		sess->s_ttyp = NULL;
457		bcopy(p->p_session->s_login, sess->s_login,
458			    sizeof(sess->s_login));
459		pgrp->pg_session = sess;
460		KASSERT(p == curproc,
461		    ("enterpgrp: mksession and p != curproc"));
462	} else {
463		pgrp->pg_session = p->p_session;
464		sess_hold(pgrp->pg_session);
465		PGRP_LOCK(pgrp);
466	}
467	pgrp->pg_id = pgid;
468	LIST_INIT(&pgrp->pg_members);
469
470	/*
471	 * As we have an exclusive lock of proctree_lock,
472	 * this should not deadlock.
473	 */
474	LIST_INSERT_HEAD(PGRPHASH(pgid), pgrp, pg_hash);
475	pgrp->pg_jobc = 0;
476	SLIST_INIT(&pgrp->pg_sigiolst);
477	PGRP_UNLOCK(pgrp);
478
479	doenterpgrp(p, pgrp);
480
481	return (0);
482}
483
484/*
485 * Move p to an existing process group
486 */
487int
488enterthispgrp(p, pgrp)
489	register struct proc *p;
490	struct pgrp *pgrp;
491{
492
493	sx_assert(&proctree_lock, SX_XLOCKED);
494	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
495	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
496	PGRP_LOCK_ASSERT(p->p_pgrp, MA_NOTOWNED);
497	SESS_LOCK_ASSERT(p->p_session, MA_NOTOWNED);
498	KASSERT(pgrp->pg_session == p->p_session,
499		("%s: pgrp's session %p, p->p_session %p.\n",
500		__func__,
501		pgrp->pg_session,
502		p->p_session));
503	KASSERT(pgrp != p->p_pgrp,
504		("%s: p belongs to pgrp.", __func__));
505
506	doenterpgrp(p, pgrp);
507
508	return (0);
509}
510
511/*
512 * Move p to a process group
513 */
514static void
515doenterpgrp(p, pgrp)
516	struct proc *p;
517	struct pgrp *pgrp;
518{
519	struct pgrp *savepgrp;
520
521	sx_assert(&proctree_lock, SX_XLOCKED);
522	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
523	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
524	PGRP_LOCK_ASSERT(p->p_pgrp, MA_NOTOWNED);
525	SESS_LOCK_ASSERT(p->p_session, MA_NOTOWNED);
526
527	savepgrp = p->p_pgrp;
528
529	/*
530	 * Adjust eligibility of affected pgrps to participate in job control.
531	 * Increment eligibility counts before decrementing, otherwise we
532	 * could reach 0 spuriously during the first call.
533	 */
534	fixjobc(p, pgrp, 1);
535	fixjobc(p, p->p_pgrp, 0);
536
537	PGRP_LOCK(pgrp);
538	PGRP_LOCK(savepgrp);
539	PROC_LOCK(p);
540	LIST_REMOVE(p, p_pglist);
541	p->p_pgrp = pgrp;
542	PROC_UNLOCK(p);
543	LIST_INSERT_HEAD(&pgrp->pg_members, p, p_pglist);
544	PGRP_UNLOCK(savepgrp);
545	PGRP_UNLOCK(pgrp);
546	if (LIST_EMPTY(&savepgrp->pg_members))
547		pgdelete(savepgrp);
548}
549
550/*
551 * remove process from process group
552 */
553int
554leavepgrp(p)
555	register struct proc *p;
556{
557	struct pgrp *savepgrp;
558
559	sx_assert(&proctree_lock, SX_XLOCKED);
560	savepgrp = p->p_pgrp;
561	PGRP_LOCK(savepgrp);
562	PROC_LOCK(p);
563	LIST_REMOVE(p, p_pglist);
564	p->p_pgrp = NULL;
565	PROC_UNLOCK(p);
566	PGRP_UNLOCK(savepgrp);
567	if (LIST_EMPTY(&savepgrp->pg_members))
568		pgdelete(savepgrp);
569	return (0);
570}
571
572/*
573 * delete a process group
574 */
575static void
576pgdelete(pgrp)
577	register struct pgrp *pgrp;
578{
579	struct session *savesess;
580	struct tty *tp;
581
582	sx_assert(&proctree_lock, SX_XLOCKED);
583	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
584	SESS_LOCK_ASSERT(pgrp->pg_session, MA_NOTOWNED);
585
586	/*
587	 * Reset any sigio structures pointing to us as a result of
588	 * F_SETOWN with our pgid.
589	 */
590	funsetownlst(&pgrp->pg_sigiolst);
591
592	PGRP_LOCK(pgrp);
593	tp = pgrp->pg_session->s_ttyp;
594	LIST_REMOVE(pgrp, pg_hash);
595	savesess = pgrp->pg_session;
596	PGRP_UNLOCK(pgrp);
597
598	/* Remove the reference to the pgrp before deallocating it. */
599	if (tp != NULL) {
600		tty_lock(tp);
601		tty_rel_pgrp(tp, pgrp);
602	}
603
604	mtx_destroy(&pgrp->pg_mtx);
605	free(pgrp, M_PGRP);
606	sess_release(savesess);
607}
608
609static void
610pgadjustjobc(pgrp, entering)
611	struct pgrp *pgrp;
612	int entering;
613{
614
615	PGRP_LOCK(pgrp);
616	if (entering)
617		pgrp->pg_jobc++;
618	else {
619		--pgrp->pg_jobc;
620		if (pgrp->pg_jobc == 0)
621			orphanpg(pgrp);
622	}
623	PGRP_UNLOCK(pgrp);
624}
625
626/*
627 * Adjust pgrp jobc counters when specified process changes process group.
628 * We count the number of processes in each process group that "qualify"
629 * the group for terminal job control (those with a parent in a different
630 * process group of the same session).  If that count reaches zero, the
631 * process group becomes orphaned.  Check both the specified process'
632 * process group and that of its children.
633 * entering == 0 => p is leaving specified group.
634 * entering == 1 => p is entering specified group.
635 */
636void
637fixjobc(p, pgrp, entering)
638	register struct proc *p;
639	register struct pgrp *pgrp;
640	int entering;
641{
642	register struct pgrp *hispgrp;
643	register struct session *mysession;
644
645	sx_assert(&proctree_lock, SX_LOCKED);
646	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
647	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
648	SESS_LOCK_ASSERT(pgrp->pg_session, MA_NOTOWNED);
649
650	/*
651	 * Check p's parent to see whether p qualifies its own process
652	 * group; if so, adjust count for p's process group.
653	 */
654	mysession = pgrp->pg_session;
655	if ((hispgrp = p->p_pptr->p_pgrp) != pgrp &&
656	    hispgrp->pg_session == mysession)
657		pgadjustjobc(pgrp, entering);
658
659	/*
660	 * Check this process' children to see whether they qualify
661	 * their process groups; if so, adjust counts for children's
662	 * process groups.
663	 */
664	LIST_FOREACH(p, &p->p_children, p_sibling) {
665		hispgrp = p->p_pgrp;
666		if (hispgrp == pgrp ||
667		    hispgrp->pg_session != mysession)
668			continue;
669		PROC_LOCK(p);
670		if (p->p_state == PRS_ZOMBIE) {
671			PROC_UNLOCK(p);
672			continue;
673		}
674		PROC_UNLOCK(p);
675		pgadjustjobc(hispgrp, entering);
676	}
677}
678
679/*
680 * A process group has become orphaned;
681 * if there are any stopped processes in the group,
682 * hang-up all process in that group.
683 */
684static void
685orphanpg(pg)
686	struct pgrp *pg;
687{
688	register struct proc *p;
689
690	PGRP_LOCK_ASSERT(pg, MA_OWNED);
691
692	LIST_FOREACH(p, &pg->pg_members, p_pglist) {
693		PROC_LOCK(p);
694		if (P_SHOULDSTOP(p)) {
695			PROC_UNLOCK(p);
696			LIST_FOREACH(p, &pg->pg_members, p_pglist) {
697				PROC_LOCK(p);
698				kern_psignal(p, SIGHUP);
699				kern_psignal(p, SIGCONT);
700				PROC_UNLOCK(p);
701			}
702			return;
703		}
704		PROC_UNLOCK(p);
705	}
706}
707
708void
709sess_hold(struct session *s)
710{
711
712	refcount_acquire(&s->s_count);
713}
714
715void
716sess_release(struct session *s)
717{
718
719	if (refcount_release(&s->s_count)) {
720		if (s->s_ttyp != NULL) {
721			tty_lock(s->s_ttyp);
722			tty_rel_sess(s->s_ttyp, s);
723		}
724		mtx_destroy(&s->s_mtx);
725		free(s, M_SESSION);
726	}
727}
728
729#ifdef DDB
730
731DB_SHOW_COMMAND(pgrpdump, pgrpdump)
732{
733	register struct pgrp *pgrp;
734	register struct proc *p;
735	register int i;
736
737	for (i = 0; i <= pgrphash; i++) {
738		if (!LIST_EMPTY(&pgrphashtbl[i])) {
739			printf("\tindx %d\n", i);
740			LIST_FOREACH(pgrp, &pgrphashtbl[i], pg_hash) {
741				printf(
742			"\tpgrp %p, pgid %ld, sess %p, sesscnt %d, mem %p\n",
743				    (void *)pgrp, (long)pgrp->pg_id,
744				    (void *)pgrp->pg_session,
745				    pgrp->pg_session->s_count,
746				    (void *)LIST_FIRST(&pgrp->pg_members));
747				LIST_FOREACH(p, &pgrp->pg_members, p_pglist) {
748					printf("\t\tpid %ld addr %p pgrp %p\n",
749					    (long)p->p_pid, (void *)p,
750					    (void *)p->p_pgrp);
751				}
752			}
753		}
754	}
755}
756#endif /* DDB */
757
758/*
759 * Calculate the kinfo_proc members which contain process-wide
760 * informations.
761 * Must be called with the target process locked.
762 */
763static void
764fill_kinfo_aggregate(struct proc *p, struct kinfo_proc *kp)
765{
766	struct thread *td;
767
768	PROC_LOCK_ASSERT(p, MA_OWNED);
769
770	kp->ki_estcpu = 0;
771	kp->ki_pctcpu = 0;
772	FOREACH_THREAD_IN_PROC(p, td) {
773		thread_lock(td);
774		kp->ki_pctcpu += sched_pctcpu(td);
775		kp->ki_estcpu += td->td_estcpu;
776		thread_unlock(td);
777	}
778}
779
780/*
781 * Clear kinfo_proc and fill in any information that is common
782 * to all threads in the process.
783 * Must be called with the target process locked.
784 */
785static void
786fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp)
787{
788	struct thread *td0;
789	struct tty *tp;
790	struct session *sp;
791	struct ucred *cred;
792	struct sigacts *ps;
793
794	/* For proc_realparent. */
795	sx_assert(&proctree_lock, SX_LOCKED);
796	PROC_LOCK_ASSERT(p, MA_OWNED);
797	bzero(kp, sizeof(*kp));
798
799	kp->ki_structsize = sizeof(*kp);
800	kp->ki_paddr = p;
801	kp->ki_addr =/* p->p_addr; */0; /* XXX */
802	kp->ki_args = p->p_args;
803	kp->ki_textvp = p->p_textvp;
804#ifdef KTRACE
805	kp->ki_tracep = p->p_tracevp;
806	kp->ki_traceflag = p->p_traceflag;
807#endif
808	kp->ki_fd = p->p_fd;
809	kp->ki_vmspace = p->p_vmspace;
810	kp->ki_flag = p->p_flag;
811	kp->ki_flag2 = p->p_flag2;
812	cred = p->p_ucred;
813	if (cred) {
814		kp->ki_uid = cred->cr_uid;
815		kp->ki_ruid = cred->cr_ruid;
816		kp->ki_svuid = cred->cr_svuid;
817		kp->ki_cr_flags = 0;
818		if (cred->cr_flags & CRED_FLAG_CAPMODE)
819			kp->ki_cr_flags |= KI_CRF_CAPABILITY_MODE;
820		/* XXX bde doesn't like KI_NGROUPS */
821		if (cred->cr_ngroups > KI_NGROUPS) {
822			kp->ki_ngroups = KI_NGROUPS;
823			kp->ki_cr_flags |= KI_CRF_GRP_OVERFLOW;
824		} else
825			kp->ki_ngroups = cred->cr_ngroups;
826		bcopy(cred->cr_groups, kp->ki_groups,
827		    kp->ki_ngroups * sizeof(gid_t));
828		kp->ki_rgid = cred->cr_rgid;
829		kp->ki_svgid = cred->cr_svgid;
830		/* If jailed(cred), emulate the old P_JAILED flag. */
831		if (jailed(cred)) {
832			kp->ki_flag |= P_JAILED;
833			/* If inside the jail, use 0 as a jail ID. */
834			if (cred->cr_prison != curthread->td_ucred->cr_prison)
835				kp->ki_jid = cred->cr_prison->pr_id;
836		}
837		strlcpy(kp->ki_loginclass, cred->cr_loginclass->lc_name,
838		    sizeof(kp->ki_loginclass));
839	}
840	ps = p->p_sigacts;
841	if (ps) {
842		mtx_lock(&ps->ps_mtx);
843		kp->ki_sigignore = ps->ps_sigignore;
844		kp->ki_sigcatch = ps->ps_sigcatch;
845		mtx_unlock(&ps->ps_mtx);
846	}
847	if (p->p_state != PRS_NEW &&
848	    p->p_state != PRS_ZOMBIE &&
849	    p->p_vmspace != NULL) {
850		struct vmspace *vm = p->p_vmspace;
851
852		kp->ki_size = vm->vm_map.size;
853		kp->ki_rssize = vmspace_resident_count(vm); /*XXX*/
854		FOREACH_THREAD_IN_PROC(p, td0) {
855			if (!TD_IS_SWAPPED(td0))
856				kp->ki_rssize += td0->td_kstack_pages;
857		}
858		kp->ki_swrss = vm->vm_swrss;
859		kp->ki_tsize = vm->vm_tsize;
860		kp->ki_dsize = vm->vm_dsize;
861		kp->ki_ssize = vm->vm_ssize;
862	} else if (p->p_state == PRS_ZOMBIE)
863		kp->ki_stat = SZOMB;
864	if (kp->ki_flag & P_INMEM)
865		kp->ki_sflag = PS_INMEM;
866	else
867		kp->ki_sflag = 0;
868	/* Calculate legacy swtime as seconds since 'swtick'. */
869	kp->ki_swtime = (ticks - p->p_swtick) / hz;
870	kp->ki_pid = p->p_pid;
871	kp->ki_nice = p->p_nice;
872	kp->ki_fibnum = p->p_fibnum;
873	kp->ki_start = p->p_stats->p_start;
874	timevaladd(&kp->ki_start, &boottime);
875	PROC_SLOCK(p);
876	rufetch(p, &kp->ki_rusage);
877	kp->ki_runtime = cputick2usec(p->p_rux.rux_runtime);
878	calcru(p, &kp->ki_rusage.ru_utime, &kp->ki_rusage.ru_stime);
879	PROC_SUNLOCK(p);
880	calccru(p, &kp->ki_childutime, &kp->ki_childstime);
881	/* Some callers want child times in a single value. */
882	kp->ki_childtime = kp->ki_childstime;
883	timevaladd(&kp->ki_childtime, &kp->ki_childutime);
884
885	FOREACH_THREAD_IN_PROC(p, td0)
886		kp->ki_cow += td0->td_cow;
887
888	tp = NULL;
889	if (p->p_pgrp) {
890		kp->ki_pgid = p->p_pgrp->pg_id;
891		kp->ki_jobc = p->p_pgrp->pg_jobc;
892		sp = p->p_pgrp->pg_session;
893
894		if (sp != NULL) {
895			kp->ki_sid = sp->s_sid;
896			SESS_LOCK(sp);
897			strlcpy(kp->ki_login, sp->s_login,
898			    sizeof(kp->ki_login));
899			if (sp->s_ttyvp)
900				kp->ki_kiflag |= KI_CTTY;
901			if (SESS_LEADER(p))
902				kp->ki_kiflag |= KI_SLEADER;
903			/* XXX proctree_lock */
904			tp = sp->s_ttyp;
905			SESS_UNLOCK(sp);
906		}
907	}
908	if ((p->p_flag & P_CONTROLT) && tp != NULL) {
909		kp->ki_tdev = tty_udev(tp);
910		kp->ki_tpgid = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
911		if (tp->t_session)
912			kp->ki_tsid = tp->t_session->s_sid;
913	} else
914		kp->ki_tdev = NODEV;
915	if (p->p_comm[0] != '\0')
916		strlcpy(kp->ki_comm, p->p_comm, sizeof(kp->ki_comm));
917	if (p->p_sysent && p->p_sysent->sv_name != NULL &&
918	    p->p_sysent->sv_name[0] != '\0')
919		strlcpy(kp->ki_emul, p->p_sysent->sv_name, sizeof(kp->ki_emul));
920	kp->ki_siglist = p->p_siglist;
921	kp->ki_xstat = p->p_xstat;
922	kp->ki_acflag = p->p_acflag;
923	kp->ki_lock = p->p_lock;
924	if (p->p_pptr) {
925		kp->ki_ppid = proc_realparent(p)->p_pid;
926		if (p->p_flag & P_TRACED)
927			kp->ki_tracer = p->p_pptr->p_pid;
928	}
929}
930
931/*
932 * Fill in information that is thread specific.  Must be called with
933 * target process locked.  If 'preferthread' is set, overwrite certain
934 * process-related fields that are maintained for both threads and
935 * processes.
936 */
937static void
938fill_kinfo_thread(struct thread *td, struct kinfo_proc *kp, int preferthread)
939{
940	struct proc *p;
941
942	p = td->td_proc;
943	kp->ki_tdaddr = td;
944	PROC_LOCK_ASSERT(p, MA_OWNED);
945
946	if (preferthread)
947		PROC_SLOCK(p);
948	thread_lock(td);
949	if (td->td_wmesg != NULL)
950		strlcpy(kp->ki_wmesg, td->td_wmesg, sizeof(kp->ki_wmesg));
951	else
952		bzero(kp->ki_wmesg, sizeof(kp->ki_wmesg));
953	strlcpy(kp->ki_tdname, td->td_name, sizeof(kp->ki_tdname));
954	if (TD_ON_LOCK(td)) {
955		kp->ki_kiflag |= KI_LOCKBLOCK;
956		strlcpy(kp->ki_lockname, td->td_lockname,
957		    sizeof(kp->ki_lockname));
958	} else {
959		kp->ki_kiflag &= ~KI_LOCKBLOCK;
960		bzero(kp->ki_lockname, sizeof(kp->ki_lockname));
961	}
962
963	if (p->p_state == PRS_NORMAL) { /* approximate. */
964		if (TD_ON_RUNQ(td) ||
965		    TD_CAN_RUN(td) ||
966		    TD_IS_RUNNING(td)) {
967			kp->ki_stat = SRUN;
968		} else if (P_SHOULDSTOP(p)) {
969			kp->ki_stat = SSTOP;
970		} else if (TD_IS_SLEEPING(td)) {
971			kp->ki_stat = SSLEEP;
972		} else if (TD_ON_LOCK(td)) {
973			kp->ki_stat = SLOCK;
974		} else {
975			kp->ki_stat = SWAIT;
976		}
977	} else if (p->p_state == PRS_ZOMBIE) {
978		kp->ki_stat = SZOMB;
979	} else {
980		kp->ki_stat = SIDL;
981	}
982
983	/* Things in the thread */
984	kp->ki_wchan = td->td_wchan;
985	kp->ki_pri.pri_level = td->td_priority;
986	kp->ki_pri.pri_native = td->td_base_pri;
987	kp->ki_lastcpu = td->td_lastcpu;
988	kp->ki_oncpu = td->td_oncpu;
989	kp->ki_tdflags = td->td_flags;
990	kp->ki_tid = td->td_tid;
991	kp->ki_numthreads = p->p_numthreads;
992	kp->ki_pcb = td->td_pcb;
993	kp->ki_kstack = (void *)td->td_kstack;
994	kp->ki_slptime = (ticks - td->td_slptick) / hz;
995	kp->ki_pri.pri_class = td->td_pri_class;
996	kp->ki_pri.pri_user = td->td_user_pri;
997
998	if (preferthread) {
999		rufetchtd(td, &kp->ki_rusage);
1000		kp->ki_runtime = cputick2usec(td->td_rux.rux_runtime);
1001		kp->ki_pctcpu = sched_pctcpu(td);
1002		kp->ki_estcpu = td->td_estcpu;
1003		kp->ki_cow = td->td_cow;
1004	}
1005
1006	/* We can't get this anymore but ps etc never used it anyway. */
1007	kp->ki_rqindex = 0;
1008
1009	if (preferthread)
1010		kp->ki_siglist = td->td_siglist;
1011	kp->ki_sigmask = td->td_sigmask;
1012	thread_unlock(td);
1013	if (preferthread)
1014		PROC_SUNLOCK(p);
1015}
1016
1017/*
1018 * Fill in a kinfo_proc structure for the specified process.
1019 * Must be called with the target process locked.
1020 */
1021void
1022fill_kinfo_proc(struct proc *p, struct kinfo_proc *kp)
1023{
1024
1025	MPASS(FIRST_THREAD_IN_PROC(p) != NULL);
1026
1027	fill_kinfo_proc_only(p, kp);
1028	fill_kinfo_thread(FIRST_THREAD_IN_PROC(p), kp, 0);
1029	fill_kinfo_aggregate(p, kp);
1030}
1031
1032struct pstats *
1033pstats_alloc(void)
1034{
1035
1036	return (malloc(sizeof(struct pstats), M_SUBPROC, M_ZERO|M_WAITOK));
1037}
1038
1039/*
1040 * Copy parts of p_stats; zero the rest of p_stats (statistics).
1041 */
1042void
1043pstats_fork(struct pstats *src, struct pstats *dst)
1044{
1045
1046	bzero(&dst->pstat_startzero,
1047	    __rangeof(struct pstats, pstat_startzero, pstat_endzero));
1048	bcopy(&src->pstat_startcopy, &dst->pstat_startcopy,
1049	    __rangeof(struct pstats, pstat_startcopy, pstat_endcopy));
1050}
1051
1052void
1053pstats_free(struct pstats *ps)
1054{
1055
1056	free(ps, M_SUBPROC);
1057}
1058
1059static struct proc *
1060zpfind_locked(pid_t pid)
1061{
1062	struct proc *p;
1063
1064	sx_assert(&allproc_lock, SX_LOCKED);
1065	LIST_FOREACH(p, &zombproc, p_list) {
1066		if (p->p_pid == pid) {
1067			PROC_LOCK(p);
1068			break;
1069		}
1070	}
1071	return (p);
1072}
1073
1074/*
1075 * Locate a zombie process by number
1076 */
1077struct proc *
1078zpfind(pid_t pid)
1079{
1080	struct proc *p;
1081
1082	sx_slock(&allproc_lock);
1083	p = zpfind_locked(pid);
1084	sx_sunlock(&allproc_lock);
1085	return (p);
1086}
1087
1088#ifdef COMPAT_FREEBSD32
1089
1090/*
1091 * This function is typically used to copy out the kernel address, so
1092 * it can be replaced by assignment of zero.
1093 */
1094static inline uint32_t
1095ptr32_trim(void *ptr)
1096{
1097	uintptr_t uptr;
1098
1099	uptr = (uintptr_t)ptr;
1100	return ((uptr > UINT_MAX) ? 0 : uptr);
1101}
1102
1103#define PTRTRIM_CP(src,dst,fld) \
1104	do { (dst).fld = ptr32_trim((src).fld); } while (0)
1105
1106static void
1107freebsd32_kinfo_proc_out(const struct kinfo_proc *ki, struct kinfo_proc32 *ki32)
1108{
1109	int i;
1110
1111	bzero(ki32, sizeof(struct kinfo_proc32));
1112	ki32->ki_structsize = sizeof(struct kinfo_proc32);
1113	CP(*ki, *ki32, ki_layout);
1114	PTRTRIM_CP(*ki, *ki32, ki_args);
1115	PTRTRIM_CP(*ki, *ki32, ki_paddr);
1116	PTRTRIM_CP(*ki, *ki32, ki_addr);
1117	PTRTRIM_CP(*ki, *ki32, ki_tracep);
1118	PTRTRIM_CP(*ki, *ki32, ki_textvp);
1119	PTRTRIM_CP(*ki, *ki32, ki_fd);
1120	PTRTRIM_CP(*ki, *ki32, ki_vmspace);
1121	PTRTRIM_CP(*ki, *ki32, ki_wchan);
1122	CP(*ki, *ki32, ki_pid);
1123	CP(*ki, *ki32, ki_ppid);
1124	CP(*ki, *ki32, ki_pgid);
1125	CP(*ki, *ki32, ki_tpgid);
1126	CP(*ki, *ki32, ki_sid);
1127	CP(*ki, *ki32, ki_tsid);
1128	CP(*ki, *ki32, ki_jobc);
1129	CP(*ki, *ki32, ki_tdev);
1130	CP(*ki, *ki32, ki_siglist);
1131	CP(*ki, *ki32, ki_sigmask);
1132	CP(*ki, *ki32, ki_sigignore);
1133	CP(*ki, *ki32, ki_sigcatch);
1134	CP(*ki, *ki32, ki_uid);
1135	CP(*ki, *ki32, ki_ruid);
1136	CP(*ki, *ki32, ki_svuid);
1137	CP(*ki, *ki32, ki_rgid);
1138	CP(*ki, *ki32, ki_svgid);
1139	CP(*ki, *ki32, ki_ngroups);
1140	for (i = 0; i < KI_NGROUPS; i++)
1141		CP(*ki, *ki32, ki_groups[i]);
1142	CP(*ki, *ki32, ki_size);
1143	CP(*ki, *ki32, ki_rssize);
1144	CP(*ki, *ki32, ki_swrss);
1145	CP(*ki, *ki32, ki_tsize);
1146	CP(*ki, *ki32, ki_dsize);
1147	CP(*ki, *ki32, ki_ssize);
1148	CP(*ki, *ki32, ki_xstat);
1149	CP(*ki, *ki32, ki_acflag);
1150	CP(*ki, *ki32, ki_pctcpu);
1151	CP(*ki, *ki32, ki_estcpu);
1152	CP(*ki, *ki32, ki_slptime);
1153	CP(*ki, *ki32, ki_swtime);
1154	CP(*ki, *ki32, ki_cow);
1155	CP(*ki, *ki32, ki_runtime);
1156	TV_CP(*ki, *ki32, ki_start);
1157	TV_CP(*ki, *ki32, ki_childtime);
1158	CP(*ki, *ki32, ki_flag);
1159	CP(*ki, *ki32, ki_kiflag);
1160	CP(*ki, *ki32, ki_traceflag);
1161	CP(*ki, *ki32, ki_stat);
1162	CP(*ki, *ki32, ki_nice);
1163	CP(*ki, *ki32, ki_lock);
1164	CP(*ki, *ki32, ki_rqindex);
1165	CP(*ki, *ki32, ki_oncpu);
1166	CP(*ki, *ki32, ki_lastcpu);
1167	bcopy(ki->ki_tdname, ki32->ki_tdname, TDNAMLEN + 1);
1168	bcopy(ki->ki_wmesg, ki32->ki_wmesg, WMESGLEN + 1);
1169	bcopy(ki->ki_login, ki32->ki_login, LOGNAMELEN + 1);
1170	bcopy(ki->ki_lockname, ki32->ki_lockname, LOCKNAMELEN + 1);
1171	bcopy(ki->ki_comm, ki32->ki_comm, COMMLEN + 1);
1172	bcopy(ki->ki_emul, ki32->ki_emul, KI_EMULNAMELEN + 1);
1173	bcopy(ki->ki_loginclass, ki32->ki_loginclass, LOGINCLASSLEN + 1);
1174	CP(*ki, *ki32, ki_tracer);
1175	CP(*ki, *ki32, ki_flag2);
1176	CP(*ki, *ki32, ki_fibnum);
1177	CP(*ki, *ki32, ki_cr_flags);
1178	CP(*ki, *ki32, ki_jid);
1179	CP(*ki, *ki32, ki_numthreads);
1180	CP(*ki, *ki32, ki_tid);
1181	CP(*ki, *ki32, ki_pri);
1182	freebsd32_rusage_out(&ki->ki_rusage, &ki32->ki_rusage);
1183	freebsd32_rusage_out(&ki->ki_rusage_ch, &ki32->ki_rusage_ch);
1184	PTRTRIM_CP(*ki, *ki32, ki_pcb);
1185	PTRTRIM_CP(*ki, *ki32, ki_kstack);
1186	PTRTRIM_CP(*ki, *ki32, ki_udata);
1187	CP(*ki, *ki32, ki_sflag);
1188	CP(*ki, *ki32, ki_tdflags);
1189}
1190#endif
1191
1192int
1193kern_proc_out(struct proc *p, struct sbuf *sb, int flags)
1194{
1195	struct thread *td;
1196	struct kinfo_proc ki;
1197#ifdef COMPAT_FREEBSD32
1198	struct kinfo_proc32 ki32;
1199#endif
1200	int error;
1201
1202	PROC_LOCK_ASSERT(p, MA_OWNED);
1203	MPASS(FIRST_THREAD_IN_PROC(p) != NULL);
1204
1205	error = 0;
1206	fill_kinfo_proc(p, &ki);
1207	if ((flags & KERN_PROC_NOTHREADS) != 0) {
1208#ifdef COMPAT_FREEBSD32
1209		if ((flags & KERN_PROC_MASK32) != 0) {
1210			freebsd32_kinfo_proc_out(&ki, &ki32);
1211			if (sbuf_bcat(sb, &ki32, sizeof(ki32)) != 0)
1212				error = ENOMEM;
1213		} else
1214#endif
1215			if (sbuf_bcat(sb, &ki, sizeof(ki)) != 0)
1216				error = ENOMEM;
1217	} else {
1218		FOREACH_THREAD_IN_PROC(p, td) {
1219			fill_kinfo_thread(td, &ki, 1);
1220#ifdef COMPAT_FREEBSD32
1221			if ((flags & KERN_PROC_MASK32) != 0) {
1222				freebsd32_kinfo_proc_out(&ki, &ki32);
1223				if (sbuf_bcat(sb, &ki32, sizeof(ki32)) != 0)
1224					error = ENOMEM;
1225			} else
1226#endif
1227				if (sbuf_bcat(sb, &ki, sizeof(ki)) != 0)
1228					error = ENOMEM;
1229			if (error != 0)
1230				break;
1231		}
1232	}
1233	PROC_UNLOCK(p);
1234	return (error);
1235}
1236
1237static int
1238sysctl_out_proc(struct proc *p, struct sysctl_req *req, int flags,
1239    int doingzomb)
1240{
1241	struct sbuf sb;
1242	struct kinfo_proc ki;
1243	struct proc *np;
1244	int error, error2;
1245	pid_t pid;
1246
1247	pid = p->p_pid;
1248	sbuf_new_for_sysctl(&sb, (char *)&ki, sizeof(ki), req);
1249	error = kern_proc_out(p, &sb, flags);
1250	error2 = sbuf_finish(&sb);
1251	sbuf_delete(&sb);
1252	if (error != 0)
1253		return (error);
1254	else if (error2 != 0)
1255		return (error2);
1256	if (doingzomb)
1257		np = zpfind(pid);
1258	else {
1259		if (pid == 0)
1260			return (0);
1261		np = pfind(pid);
1262	}
1263	if (np == NULL)
1264		return (ESRCH);
1265	if (np != p) {
1266		PROC_UNLOCK(np);
1267		return (ESRCH);
1268	}
1269	PROC_UNLOCK(np);
1270	return (0);
1271}
1272
1273static int
1274sysctl_kern_proc(SYSCTL_HANDLER_ARGS)
1275{
1276	int *name = (int *)arg1;
1277	u_int namelen = arg2;
1278	struct proc *p;
1279	int flags, doingzomb, oid_number;
1280	int error = 0;
1281
1282	oid_number = oidp->oid_number;
1283	if (oid_number != KERN_PROC_ALL &&
1284	    (oid_number & KERN_PROC_INC_THREAD) == 0)
1285		flags = KERN_PROC_NOTHREADS;
1286	else {
1287		flags = 0;
1288		oid_number &= ~KERN_PROC_INC_THREAD;
1289	}
1290#ifdef COMPAT_FREEBSD32
1291	if (req->flags & SCTL_MASK32)
1292		flags |= KERN_PROC_MASK32;
1293#endif
1294	if (oid_number == KERN_PROC_PID) {
1295		if (namelen != 1)
1296			return (EINVAL);
1297		error = sysctl_wire_old_buffer(req, 0);
1298		if (error)
1299			return (error);
1300		sx_slock(&proctree_lock);
1301		error = pget((pid_t)name[0], PGET_CANSEE, &p);
1302		if (error == 0)
1303			error = sysctl_out_proc(p, req, flags, 0);
1304		sx_sunlock(&proctree_lock);
1305		return (error);
1306	}
1307
1308	switch (oid_number) {
1309	case KERN_PROC_ALL:
1310		if (namelen != 0)
1311			return (EINVAL);
1312		break;
1313	case KERN_PROC_PROC:
1314		if (namelen != 0 && namelen != 1)
1315			return (EINVAL);
1316		break;
1317	default:
1318		if (namelen != 1)
1319			return (EINVAL);
1320		break;
1321	}
1322
1323	if (!req->oldptr) {
1324		/* overestimate by 5 procs */
1325		error = SYSCTL_OUT(req, 0, sizeof (struct kinfo_proc) * 5);
1326		if (error)
1327			return (error);
1328	}
1329	error = sysctl_wire_old_buffer(req, 0);
1330	if (error != 0)
1331		return (error);
1332	sx_slock(&proctree_lock);
1333	sx_slock(&allproc_lock);
1334	for (doingzomb=0 ; doingzomb < 2 ; doingzomb++) {
1335		if (!doingzomb)
1336			p = LIST_FIRST(&allproc);
1337		else
1338			p = LIST_FIRST(&zombproc);
1339		for (; p != 0; p = LIST_NEXT(p, p_list)) {
1340			/*
1341			 * Skip embryonic processes.
1342			 */
1343			PROC_LOCK(p);
1344			if (p->p_state == PRS_NEW) {
1345				PROC_UNLOCK(p);
1346				continue;
1347			}
1348			KASSERT(p->p_ucred != NULL,
1349			    ("process credential is NULL for non-NEW proc"));
1350			/*
1351			 * Show a user only appropriate processes.
1352			 */
1353			if (p_cansee(curthread, p)) {
1354				PROC_UNLOCK(p);
1355				continue;
1356			}
1357			/*
1358			 * TODO - make more efficient (see notes below).
1359			 * do by session.
1360			 */
1361			switch (oid_number) {
1362
1363			case KERN_PROC_GID:
1364				if (p->p_ucred->cr_gid != (gid_t)name[0]) {
1365					PROC_UNLOCK(p);
1366					continue;
1367				}
1368				break;
1369
1370			case KERN_PROC_PGRP:
1371				/* could do this by traversing pgrp */
1372				if (p->p_pgrp == NULL ||
1373				    p->p_pgrp->pg_id != (pid_t)name[0]) {
1374					PROC_UNLOCK(p);
1375					continue;
1376				}
1377				break;
1378
1379			case KERN_PROC_RGID:
1380				if (p->p_ucred->cr_rgid != (gid_t)name[0]) {
1381					PROC_UNLOCK(p);
1382					continue;
1383				}
1384				break;
1385
1386			case KERN_PROC_SESSION:
1387				if (p->p_session == NULL ||
1388				    p->p_session->s_sid != (pid_t)name[0]) {
1389					PROC_UNLOCK(p);
1390					continue;
1391				}
1392				break;
1393
1394			case KERN_PROC_TTY:
1395				if ((p->p_flag & P_CONTROLT) == 0 ||
1396				    p->p_session == NULL) {
1397					PROC_UNLOCK(p);
1398					continue;
1399				}
1400				/* XXX proctree_lock */
1401				SESS_LOCK(p->p_session);
1402				if (p->p_session->s_ttyp == NULL ||
1403				    tty_udev(p->p_session->s_ttyp) !=
1404				    (dev_t)name[0]) {
1405					SESS_UNLOCK(p->p_session);
1406					PROC_UNLOCK(p);
1407					continue;
1408				}
1409				SESS_UNLOCK(p->p_session);
1410				break;
1411
1412			case KERN_PROC_UID:
1413				if (p->p_ucred->cr_uid != (uid_t)name[0]) {
1414					PROC_UNLOCK(p);
1415					continue;
1416				}
1417				break;
1418
1419			case KERN_PROC_RUID:
1420				if (p->p_ucred->cr_ruid != (uid_t)name[0]) {
1421					PROC_UNLOCK(p);
1422					continue;
1423				}
1424				break;
1425
1426			case KERN_PROC_PROC:
1427				break;
1428
1429			default:
1430				break;
1431
1432			}
1433
1434			error = sysctl_out_proc(p, req, flags, doingzomb);
1435			if (error) {
1436				sx_sunlock(&allproc_lock);
1437				sx_sunlock(&proctree_lock);
1438				return (error);
1439			}
1440		}
1441	}
1442	sx_sunlock(&allproc_lock);
1443	sx_sunlock(&proctree_lock);
1444	return (0);
1445}
1446
1447struct pargs *
1448pargs_alloc(int len)
1449{
1450	struct pargs *pa;
1451
1452	pa = malloc(sizeof(struct pargs) + len, M_PARGS,
1453		M_WAITOK);
1454	refcount_init(&pa->ar_ref, 1);
1455	pa->ar_length = len;
1456	return (pa);
1457}
1458
1459static void
1460pargs_free(struct pargs *pa)
1461{
1462
1463	free(pa, M_PARGS);
1464}
1465
1466void
1467pargs_hold(struct pargs *pa)
1468{
1469
1470	if (pa == NULL)
1471		return;
1472	refcount_acquire(&pa->ar_ref);
1473}
1474
1475void
1476pargs_drop(struct pargs *pa)
1477{
1478
1479	if (pa == NULL)
1480		return;
1481	if (refcount_release(&pa->ar_ref))
1482		pargs_free(pa);
1483}
1484
1485static int
1486proc_read_mem(struct thread *td, struct proc *p, vm_offset_t offset, void* buf,
1487    size_t len)
1488{
1489	struct iovec iov;
1490	struct uio uio;
1491
1492	iov.iov_base = (caddr_t)buf;
1493	iov.iov_len = len;
1494	uio.uio_iov = &iov;
1495	uio.uio_iovcnt = 1;
1496	uio.uio_offset = offset;
1497	uio.uio_resid = (ssize_t)len;
1498	uio.uio_segflg = UIO_SYSSPACE;
1499	uio.uio_rw = UIO_READ;
1500	uio.uio_td = td;
1501
1502	return (proc_rwmem(p, &uio));
1503}
1504
1505static int
1506proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf,
1507    size_t len)
1508{
1509	size_t i;
1510	int error;
1511
1512	error = proc_read_mem(td, p, (vm_offset_t)sptr, buf, len);
1513	/*
1514	 * Reading the chunk may validly return EFAULT if the string is shorter
1515	 * than the chunk and is aligned at the end of the page, assuming the
1516	 * next page is not mapped.  So if EFAULT is returned do a fallback to
1517	 * one byte read loop.
1518	 */
1519	if (error == EFAULT) {
1520		for (i = 0; i < len; i++, buf++, sptr++) {
1521			error = proc_read_mem(td, p, (vm_offset_t)sptr, buf, 1);
1522			if (error != 0)
1523				return (error);
1524			if (*buf == '\0')
1525				break;
1526		}
1527		error = 0;
1528	}
1529	return (error);
1530}
1531
1532#define PROC_AUXV_MAX	256	/* Safety limit on auxv size. */
1533
1534enum proc_vector_type {
1535	PROC_ARG,
1536	PROC_ENV,
1537	PROC_AUX,
1538};
1539
1540#ifdef COMPAT_FREEBSD32
1541static int
1542get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp,
1543    size_t *vsizep, enum proc_vector_type type)
1544{
1545	struct freebsd32_ps_strings pss;
1546	Elf32_Auxinfo aux;
1547	vm_offset_t vptr, ptr;
1548	uint32_t *proc_vector32;
1549	char **proc_vector;
1550	size_t vsize, size;
1551	int i, error;
1552
1553	error = proc_read_mem(td, p, (vm_offset_t)(p->p_sysent->sv_psstrings),
1554	    &pss, sizeof(pss));
1555	if (error != 0)
1556		return (error);
1557	switch (type) {
1558	case PROC_ARG:
1559		vptr = (vm_offset_t)PTRIN(pss.ps_argvstr);
1560		vsize = pss.ps_nargvstr;
1561		if (vsize > ARG_MAX)
1562			return (ENOEXEC);
1563		size = vsize * sizeof(int32_t);
1564		break;
1565	case PROC_ENV:
1566		vptr = (vm_offset_t)PTRIN(pss.ps_envstr);
1567		vsize = pss.ps_nenvstr;
1568		if (vsize > ARG_MAX)
1569			return (ENOEXEC);
1570		size = vsize * sizeof(int32_t);
1571		break;
1572	case PROC_AUX:
1573		vptr = (vm_offset_t)PTRIN(pss.ps_envstr) +
1574		    (pss.ps_nenvstr + 1) * sizeof(int32_t);
1575		if (vptr % 4 != 0)
1576			return (ENOEXEC);
1577		for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) {
1578			error = proc_read_mem(td, p, ptr, &aux, sizeof(aux));
1579			if (error != 0)
1580				return (error);
1581			if (aux.a_type == AT_NULL)
1582				break;
1583			ptr += sizeof(aux);
1584		}
1585		if (aux.a_type != AT_NULL)
1586			return (ENOEXEC);
1587		vsize = i + 1;
1588		size = vsize * sizeof(aux);
1589		break;
1590	default:
1591		KASSERT(0, ("Wrong proc vector type: %d", type));
1592		return (EINVAL);
1593	}
1594	proc_vector32 = malloc(size, M_TEMP, M_WAITOK);
1595	error = proc_read_mem(td, p, vptr, proc_vector32, size);
1596	if (error != 0)
1597		goto done;
1598	if (type == PROC_AUX) {
1599		*proc_vectorp = (char **)proc_vector32;
1600		*vsizep = vsize;
1601		return (0);
1602	}
1603	proc_vector = malloc(vsize * sizeof(char *), M_TEMP, M_WAITOK);
1604	for (i = 0; i < (int)vsize; i++)
1605		proc_vector[i] = PTRIN(proc_vector32[i]);
1606	*proc_vectorp = proc_vector;
1607	*vsizep = vsize;
1608done:
1609	free(proc_vector32, M_TEMP);
1610	return (error);
1611}
1612#endif
1613
1614static int
1615get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp,
1616    size_t *vsizep, enum proc_vector_type type)
1617{
1618	struct ps_strings pss;
1619	Elf_Auxinfo aux;
1620	vm_offset_t vptr, ptr;
1621	char **proc_vector;
1622	size_t vsize, size;
1623	int error, i;
1624
1625#ifdef COMPAT_FREEBSD32
1626	if (SV_PROC_FLAG(p, SV_ILP32) != 0)
1627		return (get_proc_vector32(td, p, proc_vectorp, vsizep, type));
1628#endif
1629	error = proc_read_mem(td, p, (vm_offset_t)(p->p_sysent->sv_psstrings),
1630	    &pss, sizeof(pss));
1631	if (error != 0)
1632		return (error);
1633	switch (type) {
1634	case PROC_ARG:
1635		vptr = (vm_offset_t)pss.ps_argvstr;
1636		vsize = pss.ps_nargvstr;
1637		if (vsize > ARG_MAX)
1638			return (ENOEXEC);
1639		size = vsize * sizeof(char *);
1640		break;
1641	case PROC_ENV:
1642		vptr = (vm_offset_t)pss.ps_envstr;
1643		vsize = pss.ps_nenvstr;
1644		if (vsize > ARG_MAX)
1645			return (ENOEXEC);
1646		size = vsize * sizeof(char *);
1647		break;
1648	case PROC_AUX:
1649		/*
1650		 * The aux array is just above env array on the stack. Check
1651		 * that the address is naturally aligned.
1652		 */
1653		vptr = (vm_offset_t)pss.ps_envstr + (pss.ps_nenvstr + 1)
1654		    * sizeof(char *);
1655#if __ELF_WORD_SIZE == 64
1656		if (vptr % sizeof(uint64_t) != 0)
1657#else
1658		if (vptr % sizeof(uint32_t) != 0)
1659#endif
1660			return (ENOEXEC);
1661		/*
1662		 * We count the array size reading the aux vectors from the
1663		 * stack until AT_NULL vector is returned.  So (to keep the code
1664		 * simple) we read the process stack twice: the first time here
1665		 * to find the size and the second time when copying the vectors
1666		 * to the allocated proc_vector.
1667		 */
1668		for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) {
1669			error = proc_read_mem(td, p, ptr, &aux, sizeof(aux));
1670			if (error != 0)
1671				return (error);
1672			if (aux.a_type == AT_NULL)
1673				break;
1674			ptr += sizeof(aux);
1675		}
1676		/*
1677		 * If the PROC_AUXV_MAX entries are iterated over, and we have
1678		 * not reached AT_NULL, it is most likely we are reading wrong
1679		 * data: either the process doesn't have auxv array or data has
1680		 * been modified. Return the error in this case.
1681		 */
1682		if (aux.a_type != AT_NULL)
1683			return (ENOEXEC);
1684		vsize = i + 1;
1685		size = vsize * sizeof(aux);
1686		break;
1687	default:
1688		KASSERT(0, ("Wrong proc vector type: %d", type));
1689		return (EINVAL); /* In case we are built without INVARIANTS. */
1690	}
1691	proc_vector = malloc(size, M_TEMP, M_WAITOK);
1692	if (proc_vector == NULL)
1693		return (ENOMEM);
1694	error = proc_read_mem(td, p, vptr, proc_vector, size);
1695	if (error != 0) {
1696		free(proc_vector, M_TEMP);
1697		return (error);
1698	}
1699	*proc_vectorp = proc_vector;
1700	*vsizep = vsize;
1701
1702	return (0);
1703}
1704
1705#define GET_PS_STRINGS_CHUNK_SZ	256	/* Chunk size (bytes) for ps_strings operations. */
1706
1707static int
1708get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb,
1709    enum proc_vector_type type)
1710{
1711	size_t done, len, nchr, vsize;
1712	int error, i;
1713	char **proc_vector, *sptr;
1714	char pss_string[GET_PS_STRINGS_CHUNK_SZ];
1715
1716	PROC_ASSERT_HELD(p);
1717
1718	/*
1719	 * We are not going to read more than 2 * (PATH_MAX + ARG_MAX) bytes.
1720	 */
1721	nchr = 2 * (PATH_MAX + ARG_MAX);
1722
1723	error = get_proc_vector(td, p, &proc_vector, &vsize, type);
1724	if (error != 0)
1725		return (error);
1726	for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) {
1727		/*
1728		 * The program may have scribbled into its argv array, e.g. to
1729		 * remove some arguments.  If that has happened, break out
1730		 * before trying to read from NULL.
1731		 */
1732		if (proc_vector[i] == NULL)
1733			break;
1734		for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) {
1735			error = proc_read_string(td, p, sptr, pss_string,
1736			    sizeof(pss_string));
1737			if (error != 0)
1738				goto done;
1739			len = strnlen(pss_string, GET_PS_STRINGS_CHUNK_SZ);
1740			if (done + len >= nchr)
1741				len = nchr - done - 1;
1742			sbuf_bcat(sb, pss_string, len);
1743			if (len != GET_PS_STRINGS_CHUNK_SZ)
1744				break;
1745			done += GET_PS_STRINGS_CHUNK_SZ;
1746		}
1747		sbuf_bcat(sb, "", 1);
1748		done += len + 1;
1749	}
1750done:
1751	free(proc_vector, M_TEMP);
1752	return (error);
1753}
1754
1755int
1756proc_getargv(struct thread *td, struct proc *p, struct sbuf *sb)
1757{
1758
1759	return (get_ps_strings(curthread, p, sb, PROC_ARG));
1760}
1761
1762int
1763proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb)
1764{
1765
1766	return (get_ps_strings(curthread, p, sb, PROC_ENV));
1767}
1768
1769int
1770proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb)
1771{
1772	size_t vsize, size;
1773	char **auxv;
1774	int error;
1775
1776	error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX);
1777	if (error == 0) {
1778#ifdef COMPAT_FREEBSD32
1779		if (SV_PROC_FLAG(p, SV_ILP32) != 0)
1780			size = vsize * sizeof(Elf32_Auxinfo);
1781		else
1782#endif
1783			size = vsize * sizeof(Elf_Auxinfo);
1784		if (sbuf_bcat(sb, auxv, size) != 0)
1785			error = ENOMEM;
1786		free(auxv, M_TEMP);
1787	}
1788	return (error);
1789}
1790
1791/*
1792 * This sysctl allows a process to retrieve the argument list or process
1793 * title for another process without groping around in the address space
1794 * of the other process.  It also allow a process to set its own "process
1795 * title to a string of its own choice.
1796 */
1797static int
1798sysctl_kern_proc_args(SYSCTL_HANDLER_ARGS)
1799{
1800	int *name = (int *)arg1;
1801	u_int namelen = arg2;
1802	struct pargs *newpa, *pa;
1803	struct proc *p;
1804	struct sbuf sb;
1805	int flags, error = 0, error2;
1806
1807	if (namelen != 1)
1808		return (EINVAL);
1809
1810	flags = PGET_CANSEE;
1811	if (req->newptr != NULL)
1812		flags |= PGET_ISCURRENT;
1813	error = pget((pid_t)name[0], flags, &p);
1814	if (error)
1815		return (error);
1816
1817	pa = p->p_args;
1818	if (pa != NULL) {
1819		pargs_hold(pa);
1820		PROC_UNLOCK(p);
1821		error = SYSCTL_OUT(req, pa->ar_args, pa->ar_length);
1822		pargs_drop(pa);
1823	} else if ((p->p_flag & (P_WEXIT | P_SYSTEM)) == 0) {
1824		_PHOLD(p);
1825		PROC_UNLOCK(p);
1826		sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
1827		error = proc_getargv(curthread, p, &sb);
1828		error2 = sbuf_finish(&sb);
1829		PRELE(p);
1830		sbuf_delete(&sb);
1831		if (error == 0 && error2 != 0)
1832			error = error2;
1833	} else {
1834		PROC_UNLOCK(p);
1835	}
1836	if (error != 0 || req->newptr == NULL)
1837		return (error);
1838
1839	if (req->newlen + sizeof(struct pargs) > ps_arg_cache_limit)
1840		return (ENOMEM);
1841	newpa = pargs_alloc(req->newlen);
1842	error = SYSCTL_IN(req, newpa->ar_args, req->newlen);
1843	if (error != 0) {
1844		pargs_free(newpa);
1845		return (error);
1846	}
1847	PROC_LOCK(p);
1848	pa = p->p_args;
1849	p->p_args = newpa;
1850	PROC_UNLOCK(p);
1851	pargs_drop(pa);
1852	return (0);
1853}
1854
1855/*
1856 * This sysctl allows a process to retrieve environment of another process.
1857 */
1858static int
1859sysctl_kern_proc_env(SYSCTL_HANDLER_ARGS)
1860{
1861	int *name = (int *)arg1;
1862	u_int namelen = arg2;
1863	struct proc *p;
1864	struct sbuf sb;
1865	int error, error2;
1866
1867	if (namelen != 1)
1868		return (EINVAL);
1869
1870	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
1871	if (error != 0)
1872		return (error);
1873	if ((p->p_flag & P_SYSTEM) != 0) {
1874		PRELE(p);
1875		return (0);
1876	}
1877
1878	sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
1879	error = proc_getenvv(curthread, p, &sb);
1880	error2 = sbuf_finish(&sb);
1881	PRELE(p);
1882	sbuf_delete(&sb);
1883	return (error != 0 ? error : error2);
1884}
1885
1886/*
1887 * This sysctl allows a process to retrieve ELF auxiliary vector of
1888 * another process.
1889 */
1890static int
1891sysctl_kern_proc_auxv(SYSCTL_HANDLER_ARGS)
1892{
1893	int *name = (int *)arg1;
1894	u_int namelen = arg2;
1895	struct proc *p;
1896	struct sbuf sb;
1897	int error, error2;
1898
1899	if (namelen != 1)
1900		return (EINVAL);
1901
1902	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
1903	if (error != 0)
1904		return (error);
1905	if ((p->p_flag & P_SYSTEM) != 0) {
1906		PRELE(p);
1907		return (0);
1908	}
1909	sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
1910	error = proc_getauxv(curthread, p, &sb);
1911	error2 = sbuf_finish(&sb);
1912	PRELE(p);
1913	sbuf_delete(&sb);
1914	return (error != 0 ? error : error2);
1915}
1916
1917/*
1918 * This sysctl allows a process to retrieve the path of the executable for
1919 * itself or another process.
1920 */
1921static int
1922sysctl_kern_proc_pathname(SYSCTL_HANDLER_ARGS)
1923{
1924	pid_t *pidp = (pid_t *)arg1;
1925	unsigned int arglen = arg2;
1926	struct proc *p;
1927	struct vnode *vp;
1928	char *retbuf, *freebuf;
1929	int error;
1930
1931	if (arglen != 1)
1932		return (EINVAL);
1933	if (*pidp == -1) {	/* -1 means this process */
1934		p = req->td->td_proc;
1935	} else {
1936		error = pget(*pidp, PGET_CANSEE, &p);
1937		if (error != 0)
1938			return (error);
1939	}
1940
1941	vp = p->p_textvp;
1942	if (vp == NULL) {
1943		if (*pidp != -1)
1944			PROC_UNLOCK(p);
1945		return (0);
1946	}
1947	vref(vp);
1948	if (*pidp != -1)
1949		PROC_UNLOCK(p);
1950	error = vn_fullpath(req->td, vp, &retbuf, &freebuf);
1951	vrele(vp);
1952	if (error)
1953		return (error);
1954	error = SYSCTL_OUT(req, retbuf, strlen(retbuf) + 1);
1955	free(freebuf, M_TEMP);
1956	return (error);
1957}
1958
1959static int
1960sysctl_kern_proc_sv_name(SYSCTL_HANDLER_ARGS)
1961{
1962	struct proc *p;
1963	char *sv_name;
1964	int *name;
1965	int namelen;
1966	int error;
1967
1968	namelen = arg2;
1969	if (namelen != 1)
1970		return (EINVAL);
1971
1972	name = (int *)arg1;
1973	error = pget((pid_t)name[0], PGET_CANSEE, &p);
1974	if (error != 0)
1975		return (error);
1976	sv_name = p->p_sysent->sv_name;
1977	PROC_UNLOCK(p);
1978	return (sysctl_handle_string(oidp, sv_name, 0, req));
1979}
1980
1981#ifdef KINFO_OVMENTRY_SIZE
1982CTASSERT(sizeof(struct kinfo_ovmentry) == KINFO_OVMENTRY_SIZE);
1983#endif
1984
1985#ifdef COMPAT_FREEBSD7
1986static int
1987sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS)
1988{
1989	vm_map_entry_t entry, tmp_entry;
1990	unsigned int last_timestamp;
1991	char *fullpath, *freepath;
1992	struct kinfo_ovmentry *kve;
1993	struct vattr va;
1994	struct ucred *cred;
1995	int error, *name;
1996	struct vnode *vp;
1997	struct proc *p;
1998	vm_map_t map;
1999	struct vmspace *vm;
2000
2001	name = (int *)arg1;
2002	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2003	if (error != 0)
2004		return (error);
2005	vm = vmspace_acquire_ref(p);
2006	if (vm == NULL) {
2007		PRELE(p);
2008		return (ESRCH);
2009	}
2010	kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK);
2011
2012	map = &vm->vm_map;
2013	vm_map_lock_read(map);
2014	for (entry = map->header.next; entry != &map->header;
2015	    entry = entry->next) {
2016		vm_object_t obj, tobj, lobj;
2017		vm_offset_t addr;
2018
2019		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
2020			continue;
2021
2022		bzero(kve, sizeof(*kve));
2023		kve->kve_structsize = sizeof(*kve);
2024
2025		kve->kve_private_resident = 0;
2026		obj = entry->object.vm_object;
2027		if (obj != NULL) {
2028			VM_OBJECT_RLOCK(obj);
2029			if (obj->shadow_count == 1)
2030				kve->kve_private_resident =
2031				    obj->resident_page_count;
2032		}
2033		kve->kve_resident = 0;
2034		addr = entry->start;
2035		while (addr < entry->end) {
2036			if (pmap_extract(map->pmap, addr))
2037				kve->kve_resident++;
2038			addr += PAGE_SIZE;
2039		}
2040
2041		for (lobj = tobj = obj; tobj; tobj = tobj->backing_object) {
2042			if (tobj != obj)
2043				VM_OBJECT_RLOCK(tobj);
2044			if (lobj != obj)
2045				VM_OBJECT_RUNLOCK(lobj);
2046			lobj = tobj;
2047		}
2048
2049		kve->kve_start = (void*)entry->start;
2050		kve->kve_end = (void*)entry->end;
2051		kve->kve_offset = (off_t)entry->offset;
2052
2053		if (entry->protection & VM_PROT_READ)
2054			kve->kve_protection |= KVME_PROT_READ;
2055		if (entry->protection & VM_PROT_WRITE)
2056			kve->kve_protection |= KVME_PROT_WRITE;
2057		if (entry->protection & VM_PROT_EXECUTE)
2058			kve->kve_protection |= KVME_PROT_EXEC;
2059
2060		if (entry->eflags & MAP_ENTRY_COW)
2061			kve->kve_flags |= KVME_FLAG_COW;
2062		if (entry->eflags & MAP_ENTRY_NEEDS_COPY)
2063			kve->kve_flags |= KVME_FLAG_NEEDS_COPY;
2064		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
2065			kve->kve_flags |= KVME_FLAG_NOCOREDUMP;
2066
2067		last_timestamp = map->timestamp;
2068		vm_map_unlock_read(map);
2069
2070		kve->kve_fileid = 0;
2071		kve->kve_fsid = 0;
2072		freepath = NULL;
2073		fullpath = "";
2074		if (lobj) {
2075			vp = NULL;
2076			switch (lobj->type) {
2077			case OBJT_DEFAULT:
2078				kve->kve_type = KVME_TYPE_DEFAULT;
2079				break;
2080			case OBJT_VNODE:
2081				kve->kve_type = KVME_TYPE_VNODE;
2082				vp = lobj->handle;
2083				vref(vp);
2084				break;
2085			case OBJT_SWAP:
2086				kve->kve_type = KVME_TYPE_SWAP;
2087				break;
2088			case OBJT_DEVICE:
2089				kve->kve_type = KVME_TYPE_DEVICE;
2090				break;
2091			case OBJT_PHYS:
2092				kve->kve_type = KVME_TYPE_PHYS;
2093				break;
2094			case OBJT_DEAD:
2095				kve->kve_type = KVME_TYPE_DEAD;
2096				break;
2097			case OBJT_SG:
2098				kve->kve_type = KVME_TYPE_SG;
2099				break;
2100			default:
2101				kve->kve_type = KVME_TYPE_UNKNOWN;
2102				break;
2103			}
2104			if (lobj != obj)
2105				VM_OBJECT_RUNLOCK(lobj);
2106
2107			kve->kve_ref_count = obj->ref_count;
2108			kve->kve_shadow_count = obj->shadow_count;
2109			VM_OBJECT_RUNLOCK(obj);
2110			if (vp != NULL) {
2111				vn_fullpath(curthread, vp, &fullpath,
2112				    &freepath);
2113				cred = curthread->td_ucred;
2114				vn_lock(vp, LK_SHARED | LK_RETRY);
2115				if (VOP_GETATTR(vp, &va, cred) == 0) {
2116					kve->kve_fileid = va.va_fileid;
2117					kve->kve_fsid = va.va_fsid;
2118				}
2119				vput(vp);
2120			}
2121		} else {
2122			kve->kve_type = KVME_TYPE_NONE;
2123			kve->kve_ref_count = 0;
2124			kve->kve_shadow_count = 0;
2125		}
2126
2127		strlcpy(kve->kve_path, fullpath, sizeof(kve->kve_path));
2128		if (freepath != NULL)
2129			free(freepath, M_TEMP);
2130
2131		error = SYSCTL_OUT(req, kve, sizeof(*kve));
2132		vm_map_lock_read(map);
2133		if (error)
2134			break;
2135		if (last_timestamp != map->timestamp) {
2136			vm_map_lookup_entry(map, addr - 1, &tmp_entry);
2137			entry = tmp_entry;
2138		}
2139	}
2140	vm_map_unlock_read(map);
2141	vmspace_free(vm);
2142	PRELE(p);
2143	free(kve, M_TEMP);
2144	return (error);
2145}
2146#endif	/* COMPAT_FREEBSD7 */
2147
2148#ifdef KINFO_VMENTRY_SIZE
2149CTASSERT(sizeof(struct kinfo_vmentry) == KINFO_VMENTRY_SIZE);
2150#endif
2151
2152static void
2153kern_proc_vmmap_resident(vm_map_t map, vm_map_entry_t entry,
2154    struct kinfo_vmentry *kve)
2155{
2156	vm_object_t obj, tobj;
2157	vm_page_t m, m_adv;
2158	vm_offset_t addr;
2159	vm_paddr_t locked_pa;
2160	vm_pindex_t pi, pi_adv, pindex;
2161
2162	locked_pa = 0;
2163	obj = entry->object.vm_object;
2164	addr = entry->start;
2165	m_adv = NULL;
2166	pi = OFF_TO_IDX(entry->offset);
2167	for (; addr < entry->end; addr += IDX_TO_OFF(pi_adv), pi += pi_adv) {
2168		if (m_adv != NULL) {
2169			m = m_adv;
2170		} else {
2171			pi_adv = OFF_TO_IDX(entry->end - addr);
2172			pindex = pi;
2173			for (tobj = obj;; tobj = tobj->backing_object) {
2174				m = vm_page_find_least(tobj, pindex);
2175				if (m != NULL) {
2176					if (m->pindex == pindex)
2177						break;
2178					if (pi_adv > m->pindex - pindex) {
2179						pi_adv = m->pindex - pindex;
2180						m_adv = m;
2181					}
2182				}
2183				if (tobj->backing_object == NULL)
2184					goto next;
2185				pindex += OFF_TO_IDX(tobj->
2186				    backing_object_offset);
2187			}
2188		}
2189		m_adv = NULL;
2190		if (m->psind != 0 && addr + pagesizes[1] <= entry->end &&
2191		    (addr & (pagesizes[1] - 1)) == 0 &&
2192		    (pmap_mincore(map->pmap, addr, &locked_pa) &
2193		    MINCORE_SUPER) != 0) {
2194			kve->kve_flags |= KVME_FLAG_SUPER;
2195			pi_adv = OFF_TO_IDX(pagesizes[1]);
2196		} else {
2197			/*
2198			 * We do not test the found page on validity.
2199			 * Either the page is busy and being paged in,
2200			 * or it was invalidated.  The first case
2201			 * should be counted as resident, the second
2202			 * is not so clear; we do account both.
2203			 */
2204			pi_adv = 1;
2205		}
2206		kve->kve_resident += pi_adv;
2207next:;
2208	}
2209	PA_UNLOCK_COND(locked_pa);
2210}
2211
2212/*
2213 * Must be called with the process locked and will return unlocked.
2214 */
2215int
2216kern_proc_vmmap_out(struct proc *p, struct sbuf *sb)
2217{
2218	vm_map_entry_t entry, tmp_entry;
2219	struct vattr va;
2220	vm_map_t map;
2221	vm_object_t obj, tobj, lobj;
2222	char *fullpath, *freepath;
2223	struct kinfo_vmentry *kve;
2224	struct ucred *cred;
2225	struct vnode *vp;
2226	struct vmspace *vm;
2227	vm_offset_t addr;
2228	unsigned int last_timestamp;
2229	int error;
2230
2231	PROC_LOCK_ASSERT(p, MA_OWNED);
2232
2233	_PHOLD(p);
2234	PROC_UNLOCK(p);
2235	vm = vmspace_acquire_ref(p);
2236	if (vm == NULL) {
2237		PRELE(p);
2238		return (ESRCH);
2239	}
2240	kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK);
2241
2242	error = 0;
2243	map = &vm->vm_map;
2244	vm_map_lock_read(map);
2245	for (entry = map->header.next; entry != &map->header;
2246	    entry = entry->next) {
2247		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
2248			continue;
2249
2250		addr = entry->end;
2251		bzero(kve, sizeof(*kve));
2252		obj = entry->object.vm_object;
2253		if (obj != NULL) {
2254			for (tobj = obj; tobj != NULL;
2255			    tobj = tobj->backing_object) {
2256				VM_OBJECT_RLOCK(tobj);
2257				lobj = tobj;
2258			}
2259			if (obj->backing_object == NULL)
2260				kve->kve_private_resident =
2261				    obj->resident_page_count;
2262			if (!vmmap_skip_res_cnt)
2263				kern_proc_vmmap_resident(map, entry, kve);
2264			for (tobj = obj; tobj != NULL;
2265			    tobj = tobj->backing_object) {
2266				if (tobj != obj && tobj != lobj)
2267					VM_OBJECT_RUNLOCK(tobj);
2268			}
2269		} else {
2270			lobj = NULL;
2271		}
2272
2273		kve->kve_start = entry->start;
2274		kve->kve_end = entry->end;
2275		kve->kve_offset = entry->offset;
2276
2277		if (entry->protection & VM_PROT_READ)
2278			kve->kve_protection |= KVME_PROT_READ;
2279		if (entry->protection & VM_PROT_WRITE)
2280			kve->kve_protection |= KVME_PROT_WRITE;
2281		if (entry->protection & VM_PROT_EXECUTE)
2282			kve->kve_protection |= KVME_PROT_EXEC;
2283
2284		if (entry->eflags & MAP_ENTRY_COW)
2285			kve->kve_flags |= KVME_FLAG_COW;
2286		if (entry->eflags & MAP_ENTRY_NEEDS_COPY)
2287			kve->kve_flags |= KVME_FLAG_NEEDS_COPY;
2288		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
2289			kve->kve_flags |= KVME_FLAG_NOCOREDUMP;
2290		if (entry->eflags & MAP_ENTRY_GROWS_UP)
2291			kve->kve_flags |= KVME_FLAG_GROWS_UP;
2292		if (entry->eflags & MAP_ENTRY_GROWS_DOWN)
2293			kve->kve_flags |= KVME_FLAG_GROWS_DOWN;
2294
2295		last_timestamp = map->timestamp;
2296		vm_map_unlock_read(map);
2297
2298		freepath = NULL;
2299		fullpath = "";
2300		if (lobj != NULL) {
2301			vp = NULL;
2302			switch (lobj->type) {
2303			case OBJT_DEFAULT:
2304				kve->kve_type = KVME_TYPE_DEFAULT;
2305				break;
2306			case OBJT_VNODE:
2307				kve->kve_type = KVME_TYPE_VNODE;
2308				vp = lobj->handle;
2309				vref(vp);
2310				break;
2311			case OBJT_SWAP:
2312				kve->kve_type = KVME_TYPE_SWAP;
2313				break;
2314			case OBJT_DEVICE:
2315				kve->kve_type = KVME_TYPE_DEVICE;
2316				break;
2317			case OBJT_PHYS:
2318				kve->kve_type = KVME_TYPE_PHYS;
2319				break;
2320			case OBJT_DEAD:
2321				kve->kve_type = KVME_TYPE_DEAD;
2322				break;
2323			case OBJT_SG:
2324				kve->kve_type = KVME_TYPE_SG;
2325				break;
2326			case OBJT_MGTDEVICE:
2327				kve->kve_type = KVME_TYPE_MGTDEVICE;
2328				break;
2329			default:
2330				kve->kve_type = KVME_TYPE_UNKNOWN;
2331				break;
2332			}
2333			if (lobj != obj)
2334				VM_OBJECT_RUNLOCK(lobj);
2335
2336			kve->kve_ref_count = obj->ref_count;
2337			kve->kve_shadow_count = obj->shadow_count;
2338			VM_OBJECT_RUNLOCK(obj);
2339			if (vp != NULL) {
2340				vn_fullpath(curthread, vp, &fullpath,
2341				    &freepath);
2342				kve->kve_vn_type = vntype_to_kinfo(vp->v_type);
2343				cred = curthread->td_ucred;
2344				vn_lock(vp, LK_SHARED | LK_RETRY);
2345				if (VOP_GETATTR(vp, &va, cred) == 0) {
2346					kve->kve_vn_fileid = va.va_fileid;
2347					kve->kve_vn_fsid = va.va_fsid;
2348					kve->kve_vn_mode =
2349					    MAKEIMODE(va.va_type, va.va_mode);
2350					kve->kve_vn_size = va.va_size;
2351					kve->kve_vn_rdev = va.va_rdev;
2352					kve->kve_status = KF_ATTR_VALID;
2353				}
2354				vput(vp);
2355			}
2356		} else {
2357			kve->kve_type = KVME_TYPE_NONE;
2358			kve->kve_ref_count = 0;
2359			kve->kve_shadow_count = 0;
2360		}
2361
2362		strlcpy(kve->kve_path, fullpath, sizeof(kve->kve_path));
2363		if (freepath != NULL)
2364			free(freepath, M_TEMP);
2365
2366		/* Pack record size down */
2367		kve->kve_structsize = offsetof(struct kinfo_vmentry, kve_path) +
2368		    strlen(kve->kve_path) + 1;
2369		kve->kve_structsize = roundup(kve->kve_structsize,
2370		    sizeof(uint64_t));
2371		if (sbuf_bcat(sb, kve, kve->kve_structsize) != 0)
2372			error = ENOMEM;
2373		vm_map_lock_read(map);
2374		if (error != 0)
2375			break;
2376		if (last_timestamp != map->timestamp) {
2377			vm_map_lookup_entry(map, addr - 1, &tmp_entry);
2378			entry = tmp_entry;
2379		}
2380	}
2381	vm_map_unlock_read(map);
2382	vmspace_free(vm);
2383	PRELE(p);
2384	free(kve, M_TEMP);
2385	return (error);
2386}
2387
2388static int
2389sysctl_kern_proc_vmmap(SYSCTL_HANDLER_ARGS)
2390{
2391	struct proc *p;
2392	struct sbuf sb;
2393	int error, error2, *name;
2394
2395	name = (int *)arg1;
2396	sbuf_new_for_sysctl(&sb, NULL, sizeof(struct kinfo_vmentry), req);
2397	error = pget((pid_t)name[0], PGET_CANDEBUG | PGET_NOTWEXIT, &p);
2398	if (error != 0) {
2399		sbuf_delete(&sb);
2400		return (error);
2401	}
2402	error = kern_proc_vmmap_out(p, &sb);
2403	error2 = sbuf_finish(&sb);
2404	sbuf_delete(&sb);
2405	return (error != 0 ? error : error2);
2406}
2407
2408#if defined(STACK) || defined(DDB)
2409static int
2410sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
2411{
2412	struct kinfo_kstack *kkstp;
2413	int error, i, *name, numthreads;
2414	lwpid_t *lwpidarray;
2415	struct thread *td;
2416	struct stack *st;
2417	struct sbuf sb;
2418	struct proc *p;
2419
2420	name = (int *)arg1;
2421	error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p);
2422	if (error != 0)
2423		return (error);
2424
2425	kkstp = malloc(sizeof(*kkstp), M_TEMP, M_WAITOK);
2426	st = stack_create();
2427
2428	lwpidarray = NULL;
2429	numthreads = 0;
2430	PROC_LOCK(p);
2431repeat:
2432	if (numthreads < p->p_numthreads) {
2433		if (lwpidarray != NULL) {
2434			free(lwpidarray, M_TEMP);
2435			lwpidarray = NULL;
2436		}
2437		numthreads = p->p_numthreads;
2438		PROC_UNLOCK(p);
2439		lwpidarray = malloc(sizeof(*lwpidarray) * numthreads, M_TEMP,
2440		    M_WAITOK | M_ZERO);
2441		PROC_LOCK(p);
2442		goto repeat;
2443	}
2444	i = 0;
2445
2446	/*
2447	 * XXXRW: During the below loop, execve(2) and countless other sorts
2448	 * of changes could have taken place.  Should we check to see if the
2449	 * vmspace has been replaced, or the like, in order to prevent
2450	 * giving a snapshot that spans, say, execve(2), with some threads
2451	 * before and some after?  Among other things, the credentials could
2452	 * have changed, in which case the right to extract debug info might
2453	 * no longer be assured.
2454	 */
2455	FOREACH_THREAD_IN_PROC(p, td) {
2456		KASSERT(i < numthreads,
2457		    ("sysctl_kern_proc_kstack: numthreads"));
2458		lwpidarray[i] = td->td_tid;
2459		i++;
2460	}
2461	numthreads = i;
2462	for (i = 0; i < numthreads; i++) {
2463		td = thread_find(p, lwpidarray[i]);
2464		if (td == NULL) {
2465			continue;
2466		}
2467		bzero(kkstp, sizeof(*kkstp));
2468		(void)sbuf_new(&sb, kkstp->kkst_trace,
2469		    sizeof(kkstp->kkst_trace), SBUF_FIXEDLEN);
2470		thread_lock(td);
2471		kkstp->kkst_tid = td->td_tid;
2472		if (TD_IS_SWAPPED(td))
2473			kkstp->kkst_state = KKST_STATE_SWAPPED;
2474		else if (TD_IS_RUNNING(td))
2475			kkstp->kkst_state = KKST_STATE_RUNNING;
2476		else {
2477			kkstp->kkst_state = KKST_STATE_STACKOK;
2478			stack_save_td(st, td);
2479		}
2480		thread_unlock(td);
2481		PROC_UNLOCK(p);
2482		stack_sbuf_print(&sb, st);
2483		sbuf_finish(&sb);
2484		sbuf_delete(&sb);
2485		error = SYSCTL_OUT(req, kkstp, sizeof(*kkstp));
2486		PROC_LOCK(p);
2487		if (error)
2488			break;
2489	}
2490	_PRELE(p);
2491	PROC_UNLOCK(p);
2492	if (lwpidarray != NULL)
2493		free(lwpidarray, M_TEMP);
2494	stack_destroy(st);
2495	free(kkstp, M_TEMP);
2496	return (error);
2497}
2498#endif
2499
2500/*
2501 * This sysctl allows a process to retrieve the full list of groups from
2502 * itself or another process.
2503 */
2504static int
2505sysctl_kern_proc_groups(SYSCTL_HANDLER_ARGS)
2506{
2507	pid_t *pidp = (pid_t *)arg1;
2508	unsigned int arglen = arg2;
2509	struct proc *p;
2510	struct ucred *cred;
2511	int error;
2512
2513	if (arglen != 1)
2514		return (EINVAL);
2515	if (*pidp == -1) {	/* -1 means this process */
2516		p = req->td->td_proc;
2517		PROC_LOCK(p);
2518	} else {
2519		error = pget(*pidp, PGET_CANSEE, &p);
2520		if (error != 0)
2521			return (error);
2522	}
2523
2524	cred = crhold(p->p_ucred);
2525	PROC_UNLOCK(p);
2526
2527	error = SYSCTL_OUT(req, cred->cr_groups,
2528	    cred->cr_ngroups * sizeof(gid_t));
2529	crfree(cred);
2530	return (error);
2531}
2532
2533/*
2534 * This sysctl allows a process to retrieve or/and set the resource limit for
2535 * another process.
2536 */
2537static int
2538sysctl_kern_proc_rlimit(SYSCTL_HANDLER_ARGS)
2539{
2540	int *name = (int *)arg1;
2541	u_int namelen = arg2;
2542	struct rlimit rlim;
2543	struct proc *p;
2544	u_int which;
2545	int flags, error;
2546
2547	if (namelen != 2)
2548		return (EINVAL);
2549
2550	which = (u_int)name[1];
2551	if (which >= RLIM_NLIMITS)
2552		return (EINVAL);
2553
2554	if (req->newptr != NULL && req->newlen != sizeof(rlim))
2555		return (EINVAL);
2556
2557	flags = PGET_HOLD | PGET_NOTWEXIT;
2558	if (req->newptr != NULL)
2559		flags |= PGET_CANDEBUG;
2560	else
2561		flags |= PGET_CANSEE;
2562	error = pget((pid_t)name[0], flags, &p);
2563	if (error != 0)
2564		return (error);
2565
2566	/*
2567	 * Retrieve limit.
2568	 */
2569	if (req->oldptr != NULL) {
2570		PROC_LOCK(p);
2571		lim_rlimit(p, which, &rlim);
2572		PROC_UNLOCK(p);
2573	}
2574	error = SYSCTL_OUT(req, &rlim, sizeof(rlim));
2575	if (error != 0)
2576		goto errout;
2577
2578	/*
2579	 * Set limit.
2580	 */
2581	if (req->newptr != NULL) {
2582		error = SYSCTL_IN(req, &rlim, sizeof(rlim));
2583		if (error == 0)
2584			error = kern_proc_setrlimit(curthread, p, which, &rlim);
2585	}
2586
2587errout:
2588	PRELE(p);
2589	return (error);
2590}
2591
2592/*
2593 * This sysctl allows a process to retrieve ps_strings structure location of
2594 * another process.
2595 */
2596static int
2597sysctl_kern_proc_ps_strings(SYSCTL_HANDLER_ARGS)
2598{
2599	int *name = (int *)arg1;
2600	u_int namelen = arg2;
2601	struct proc *p;
2602	vm_offset_t ps_strings;
2603	int error;
2604#ifdef COMPAT_FREEBSD32
2605	uint32_t ps_strings32;
2606#endif
2607
2608	if (namelen != 1)
2609		return (EINVAL);
2610
2611	error = pget((pid_t)name[0], PGET_CANDEBUG, &p);
2612	if (error != 0)
2613		return (error);
2614#ifdef COMPAT_FREEBSD32
2615	if ((req->flags & SCTL_MASK32) != 0) {
2616		/*
2617		 * We return 0 if the 32 bit emulation request is for a 64 bit
2618		 * process.
2619		 */
2620		ps_strings32 = SV_PROC_FLAG(p, SV_ILP32) != 0 ?
2621		    PTROUT(p->p_sysent->sv_psstrings) : 0;
2622		PROC_UNLOCK(p);
2623		error = SYSCTL_OUT(req, &ps_strings32, sizeof(ps_strings32));
2624		return (error);
2625	}
2626#endif
2627	ps_strings = p->p_sysent->sv_psstrings;
2628	PROC_UNLOCK(p);
2629	error = SYSCTL_OUT(req, &ps_strings, sizeof(ps_strings));
2630	return (error);
2631}
2632
2633/*
2634 * This sysctl allows a process to retrieve umask of another process.
2635 */
2636static int
2637sysctl_kern_proc_umask(SYSCTL_HANDLER_ARGS)
2638{
2639	int *name = (int *)arg1;
2640	u_int namelen = arg2;
2641	struct proc *p;
2642	int error;
2643	u_short fd_cmask;
2644
2645	if (namelen != 1)
2646		return (EINVAL);
2647
2648	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2649	if (error != 0)
2650		return (error);
2651
2652	FILEDESC_SLOCK(p->p_fd);
2653	fd_cmask = p->p_fd->fd_cmask;
2654	FILEDESC_SUNLOCK(p->p_fd);
2655	PRELE(p);
2656	error = SYSCTL_OUT(req, &fd_cmask, sizeof(fd_cmask));
2657	return (error);
2658}
2659
2660/*
2661 * This sysctl allows a process to set and retrieve binary osreldate of
2662 * another process.
2663 */
2664static int
2665sysctl_kern_proc_osrel(SYSCTL_HANDLER_ARGS)
2666{
2667	int *name = (int *)arg1;
2668	u_int namelen = arg2;
2669	struct proc *p;
2670	int flags, error, osrel;
2671
2672	if (namelen != 1)
2673		return (EINVAL);
2674
2675	if (req->newptr != NULL && req->newlen != sizeof(osrel))
2676		return (EINVAL);
2677
2678	flags = PGET_HOLD | PGET_NOTWEXIT;
2679	if (req->newptr != NULL)
2680		flags |= PGET_CANDEBUG;
2681	else
2682		flags |= PGET_CANSEE;
2683	error = pget((pid_t)name[0], flags, &p);
2684	if (error != 0)
2685		return (error);
2686
2687	error = SYSCTL_OUT(req, &p->p_osrel, sizeof(p->p_osrel));
2688	if (error != 0)
2689		goto errout;
2690
2691	if (req->newptr != NULL) {
2692		error = SYSCTL_IN(req, &osrel, sizeof(osrel));
2693		if (error != 0)
2694			goto errout;
2695		if (osrel < 0) {
2696			error = EINVAL;
2697			goto errout;
2698		}
2699		p->p_osrel = osrel;
2700	}
2701errout:
2702	PRELE(p);
2703	return (error);
2704}
2705
2706static int
2707sysctl_kern_proc_sigtramp(SYSCTL_HANDLER_ARGS)
2708{
2709	int *name = (int *)arg1;
2710	u_int namelen = arg2;
2711	struct proc *p;
2712	struct kinfo_sigtramp kst;
2713	const struct sysentvec *sv;
2714	int error;
2715#ifdef COMPAT_FREEBSD32
2716	struct kinfo_sigtramp32 kst32;
2717#endif
2718
2719	if (namelen != 1)
2720		return (EINVAL);
2721
2722	error = pget((pid_t)name[0], PGET_CANDEBUG, &p);
2723	if (error != 0)
2724		return (error);
2725	sv = p->p_sysent;
2726#ifdef COMPAT_FREEBSD32
2727	if ((req->flags & SCTL_MASK32) != 0) {
2728		bzero(&kst32, sizeof(kst32));
2729		if (SV_PROC_FLAG(p, SV_ILP32)) {
2730			if (sv->sv_sigcode_base != 0) {
2731				kst32.ksigtramp_start = sv->sv_sigcode_base;
2732				kst32.ksigtramp_end = sv->sv_sigcode_base +
2733				    *sv->sv_szsigcode;
2734			} else {
2735				kst32.ksigtramp_start = sv->sv_psstrings -
2736				    *sv->sv_szsigcode;
2737				kst32.ksigtramp_end = sv->sv_psstrings;
2738			}
2739		}
2740		PROC_UNLOCK(p);
2741		error = SYSCTL_OUT(req, &kst32, sizeof(kst32));
2742		return (error);
2743	}
2744#endif
2745	bzero(&kst, sizeof(kst));
2746	if (sv->sv_sigcode_base != 0) {
2747		kst.ksigtramp_start = (char *)sv->sv_sigcode_base;
2748		kst.ksigtramp_end = (char *)sv->sv_sigcode_base +
2749		    *sv->sv_szsigcode;
2750	} else {
2751		kst.ksigtramp_start = (char *)sv->sv_psstrings -
2752		    *sv->sv_szsigcode;
2753		kst.ksigtramp_end = (char *)sv->sv_psstrings;
2754	}
2755	PROC_UNLOCK(p);
2756	error = SYSCTL_OUT(req, &kst, sizeof(kst));
2757	return (error);
2758}
2759
2760SYSCTL_NODE(_kern, KERN_PROC, proc, CTLFLAG_RD,  0, "Process table");
2761
2762SYSCTL_PROC(_kern_proc, KERN_PROC_ALL, all, CTLFLAG_RD|CTLTYPE_STRUCT|
2763	CTLFLAG_MPSAFE, 0, 0, sysctl_kern_proc, "S,proc",
2764	"Return entire process table");
2765
2766static SYSCTL_NODE(_kern_proc, KERN_PROC_GID, gid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2767	sysctl_kern_proc, "Process table");
2768
2769static SYSCTL_NODE(_kern_proc, KERN_PROC_PGRP, pgrp, CTLFLAG_RD | CTLFLAG_MPSAFE,
2770	sysctl_kern_proc, "Process table");
2771
2772static SYSCTL_NODE(_kern_proc, KERN_PROC_RGID, rgid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2773	sysctl_kern_proc, "Process table");
2774
2775static SYSCTL_NODE(_kern_proc, KERN_PROC_SESSION, sid, CTLFLAG_RD |
2776	CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2777
2778static SYSCTL_NODE(_kern_proc, KERN_PROC_TTY, tty, CTLFLAG_RD | CTLFLAG_MPSAFE,
2779	sysctl_kern_proc, "Process table");
2780
2781static SYSCTL_NODE(_kern_proc, KERN_PROC_UID, uid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2782	sysctl_kern_proc, "Process table");
2783
2784static SYSCTL_NODE(_kern_proc, KERN_PROC_RUID, ruid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2785	sysctl_kern_proc, "Process table");
2786
2787static SYSCTL_NODE(_kern_proc, KERN_PROC_PID, pid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2788	sysctl_kern_proc, "Process table");
2789
2790static SYSCTL_NODE(_kern_proc, KERN_PROC_PROC, proc, CTLFLAG_RD | CTLFLAG_MPSAFE,
2791	sysctl_kern_proc, "Return process table, no threads");
2792
2793static SYSCTL_NODE(_kern_proc, KERN_PROC_ARGS, args,
2794	CTLFLAG_RW | CTLFLAG_ANYBODY | CTLFLAG_MPSAFE,
2795	sysctl_kern_proc_args, "Process argument list");
2796
2797static SYSCTL_NODE(_kern_proc, KERN_PROC_ENV, env, CTLFLAG_RD | CTLFLAG_MPSAFE,
2798	sysctl_kern_proc_env, "Process environment");
2799
2800static SYSCTL_NODE(_kern_proc, KERN_PROC_AUXV, auxv, CTLFLAG_RD |
2801	CTLFLAG_MPSAFE, sysctl_kern_proc_auxv, "Process ELF auxiliary vector");
2802
2803static SYSCTL_NODE(_kern_proc, KERN_PROC_PATHNAME, pathname, CTLFLAG_RD |
2804	CTLFLAG_MPSAFE, sysctl_kern_proc_pathname, "Process executable path");
2805
2806static SYSCTL_NODE(_kern_proc, KERN_PROC_SV_NAME, sv_name, CTLFLAG_RD |
2807	CTLFLAG_MPSAFE, sysctl_kern_proc_sv_name,
2808	"Process syscall vector name (ABI type)");
2809
2810static SYSCTL_NODE(_kern_proc, (KERN_PROC_GID | KERN_PROC_INC_THREAD), gid_td,
2811	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2812
2813static SYSCTL_NODE(_kern_proc, (KERN_PROC_PGRP | KERN_PROC_INC_THREAD), pgrp_td,
2814	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2815
2816static SYSCTL_NODE(_kern_proc, (KERN_PROC_RGID | KERN_PROC_INC_THREAD), rgid_td,
2817	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2818
2819static SYSCTL_NODE(_kern_proc, (KERN_PROC_SESSION | KERN_PROC_INC_THREAD),
2820	sid_td, CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2821
2822static SYSCTL_NODE(_kern_proc, (KERN_PROC_TTY | KERN_PROC_INC_THREAD), tty_td,
2823	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2824
2825static SYSCTL_NODE(_kern_proc, (KERN_PROC_UID | KERN_PROC_INC_THREAD), uid_td,
2826	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2827
2828static SYSCTL_NODE(_kern_proc, (KERN_PROC_RUID | KERN_PROC_INC_THREAD), ruid_td,
2829	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2830
2831static SYSCTL_NODE(_kern_proc, (KERN_PROC_PID | KERN_PROC_INC_THREAD), pid_td,
2832	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2833
2834static SYSCTL_NODE(_kern_proc, (KERN_PROC_PROC | KERN_PROC_INC_THREAD), proc_td,
2835	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc,
2836	"Return process table, no threads");
2837
2838#ifdef COMPAT_FREEBSD7
2839static SYSCTL_NODE(_kern_proc, KERN_PROC_OVMMAP, ovmmap, CTLFLAG_RD |
2840	CTLFLAG_MPSAFE, sysctl_kern_proc_ovmmap, "Old Process vm map entries");
2841#endif
2842
2843static SYSCTL_NODE(_kern_proc, KERN_PROC_VMMAP, vmmap, CTLFLAG_RD |
2844	CTLFLAG_MPSAFE, sysctl_kern_proc_vmmap, "Process vm map entries");
2845
2846#if defined(STACK) || defined(DDB)
2847static SYSCTL_NODE(_kern_proc, KERN_PROC_KSTACK, kstack, CTLFLAG_RD |
2848	CTLFLAG_MPSAFE, sysctl_kern_proc_kstack, "Process kernel stacks");
2849#endif
2850
2851static SYSCTL_NODE(_kern_proc, KERN_PROC_GROUPS, groups, CTLFLAG_RD |
2852	CTLFLAG_MPSAFE, sysctl_kern_proc_groups, "Process groups");
2853
2854static SYSCTL_NODE(_kern_proc, KERN_PROC_RLIMIT, rlimit, CTLFLAG_RW |
2855	CTLFLAG_ANYBODY | CTLFLAG_MPSAFE, sysctl_kern_proc_rlimit,
2856	"Process resource limits");
2857
2858static SYSCTL_NODE(_kern_proc, KERN_PROC_PS_STRINGS, ps_strings, CTLFLAG_RD |
2859	CTLFLAG_MPSAFE, sysctl_kern_proc_ps_strings,
2860	"Process ps_strings location");
2861
2862static SYSCTL_NODE(_kern_proc, KERN_PROC_UMASK, umask, CTLFLAG_RD |
2863	CTLFLAG_MPSAFE, sysctl_kern_proc_umask, "Process umask");
2864
2865static SYSCTL_NODE(_kern_proc, KERN_PROC_OSREL, osrel, CTLFLAG_RW |
2866	CTLFLAG_ANYBODY | CTLFLAG_MPSAFE, sysctl_kern_proc_osrel,
2867	"Process binary osreldate");
2868
2869static SYSCTL_NODE(_kern_proc, KERN_PROC_SIGTRAMP, sigtramp, CTLFLAG_RD |
2870	CTLFLAG_MPSAFE, sysctl_kern_proc_sigtramp,
2871	"Process signal trampoline location");
2872