xref: /freebsd/sys/kern/kern_proc.c (revision 70a8349311934f20fcb65e763b8ac80134446796)
1 /*-
2  * Copyright (c) 1982, 1986, 1989, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)kern_proc.c	8.7 (Berkeley) 2/14/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_compat.h"
36 #include "opt_ddb.h"
37 #include "opt_ktrace.h"
38 #include "opt_kstack_pages.h"
39 #include "opt_stack.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/elf.h>
44 #include <sys/eventhandler.h>
45 #include <sys/exec.h>
46 #include <sys/jail.h>
47 #include <sys/kernel.h>
48 #include <sys/limits.h>
49 #include <sys/lock.h>
50 #include <sys/loginclass.h>
51 #include <sys/malloc.h>
52 #include <sys/mman.h>
53 #include <sys/mount.h>
54 #include <sys/mutex.h>
55 #include <sys/proc.h>
56 #include <sys/ptrace.h>
57 #include <sys/refcount.h>
58 #include <sys/resourcevar.h>
59 #include <sys/rwlock.h>
60 #include <sys/sbuf.h>
61 #include <sys/sysent.h>
62 #include <sys/sched.h>
63 #include <sys/smp.h>
64 #include <sys/stack.h>
65 #include <sys/stat.h>
66 #include <sys/sysctl.h>
67 #include <sys/filedesc.h>
68 #include <sys/tty.h>
69 #include <sys/signalvar.h>
70 #include <sys/sdt.h>
71 #include <sys/sx.h>
72 #include <sys/user.h>
73 #include <sys/vnode.h>
74 #include <sys/wait.h>
75 
76 #ifdef DDB
77 #include <ddb/ddb.h>
78 #endif
79 
80 #include <vm/vm.h>
81 #include <vm/vm_param.h>
82 #include <vm/vm_extern.h>
83 #include <vm/pmap.h>
84 #include <vm/vm_map.h>
85 #include <vm/vm_object.h>
86 #include <vm/vm_page.h>
87 #include <vm/uma.h>
88 
89 #ifdef COMPAT_FREEBSD32
90 #include <compat/freebsd32/freebsd32.h>
91 #include <compat/freebsd32/freebsd32_util.h>
92 #endif
93 
94 SDT_PROVIDER_DEFINE(proc);
95 SDT_PROBE_DEFINE4(proc, , ctor, entry, "struct proc *", "int", "void *",
96     "int");
97 SDT_PROBE_DEFINE4(proc, , ctor, return, "struct proc *", "int", "void *",
98     "int");
99 SDT_PROBE_DEFINE4(proc, , dtor, entry, "struct proc *", "int", "void *",
100     "struct thread *");
101 SDT_PROBE_DEFINE3(proc, , dtor, return, "struct proc *", "int", "void *");
102 SDT_PROBE_DEFINE3(proc, , init, entry, "struct proc *", "int", "int");
103 SDT_PROBE_DEFINE3(proc, , init, return, "struct proc *", "int", "int");
104 
105 MALLOC_DEFINE(M_PGRP, "pgrp", "process group header");
106 MALLOC_DEFINE(M_SESSION, "session", "session header");
107 static MALLOC_DEFINE(M_PROC, "proc", "Proc structures");
108 MALLOC_DEFINE(M_SUBPROC, "subproc", "Proc sub-structures");
109 
110 static void doenterpgrp(struct proc *, struct pgrp *);
111 static void orphanpg(struct pgrp *pg);
112 static void fill_kinfo_aggregate(struct proc *p, struct kinfo_proc *kp);
113 static void fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp);
114 static void fill_kinfo_thread(struct thread *td, struct kinfo_proc *kp,
115     int preferthread);
116 static void pgadjustjobc(struct pgrp *pgrp, int entering);
117 static void pgdelete(struct pgrp *);
118 static int proc_ctor(void *mem, int size, void *arg, int flags);
119 static void proc_dtor(void *mem, int size, void *arg);
120 static int proc_init(void *mem, int size, int flags);
121 static void proc_fini(void *mem, int size);
122 static void pargs_free(struct pargs *pa);
123 static struct proc *zpfind_locked(pid_t pid);
124 
125 /*
126  * Other process lists
127  */
128 struct pidhashhead *pidhashtbl;
129 u_long pidhash;
130 struct pgrphashhead *pgrphashtbl;
131 u_long pgrphash;
132 struct proclist allproc;
133 struct proclist zombproc;
134 struct sx __exclusive_cache_line allproc_lock;
135 struct sx __exclusive_cache_line proctree_lock;
136 struct mtx __exclusive_cache_line ppeers_lock;
137 uma_zone_t proc_zone;
138 
139 /*
140  * The offset of various fields in struct proc and struct thread.
141  * These are used by kernel debuggers to enumerate kernel threads and
142  * processes.
143  */
144 const int proc_off_p_pid = offsetof(struct proc, p_pid);
145 const int proc_off_p_comm = offsetof(struct proc, p_comm);
146 const int proc_off_p_list = offsetof(struct proc, p_list);
147 const int proc_off_p_threads = offsetof(struct proc, p_threads);
148 const int thread_off_td_tid = offsetof(struct thread, td_tid);
149 const int thread_off_td_name = offsetof(struct thread, td_name);
150 const int thread_off_td_oncpu = offsetof(struct thread, td_oncpu);
151 const int thread_off_td_pcb = offsetof(struct thread, td_pcb);
152 const int thread_off_td_plist = offsetof(struct thread, td_plist);
153 
154 int kstack_pages = KSTACK_PAGES;
155 SYSCTL_INT(_kern, OID_AUTO, kstack_pages, CTLFLAG_RD, &kstack_pages, 0,
156     "Kernel stack size in pages");
157 static int vmmap_skip_res_cnt = 0;
158 SYSCTL_INT(_kern, OID_AUTO, proc_vmmap_skip_resident_count, CTLFLAG_RW,
159     &vmmap_skip_res_cnt, 0,
160     "Skip calculation of the pages resident count in kern.proc.vmmap");
161 
162 CTASSERT(sizeof(struct kinfo_proc) == KINFO_PROC_SIZE);
163 #ifdef COMPAT_FREEBSD32
164 CTASSERT(sizeof(struct kinfo_proc32) == KINFO_PROC32_SIZE);
165 #endif
166 
167 /*
168  * Initialize global process hashing structures.
169  */
170 void
171 procinit(void)
172 {
173 
174 	sx_init(&allproc_lock, "allproc");
175 	sx_init(&proctree_lock, "proctree");
176 	mtx_init(&ppeers_lock, "p_peers", NULL, MTX_DEF);
177 	LIST_INIT(&allproc);
178 	LIST_INIT(&zombproc);
179 	pidhashtbl = hashinit(maxproc / 4, M_PROC, &pidhash);
180 	pgrphashtbl = hashinit(maxproc / 4, M_PROC, &pgrphash);
181 	proc_zone = uma_zcreate("PROC", sched_sizeof_proc(),
182 	    proc_ctor, proc_dtor, proc_init, proc_fini,
183 	    UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
184 	uihashinit();
185 }
186 
187 /*
188  * Prepare a proc for use.
189  */
190 static int
191 proc_ctor(void *mem, int size, void *arg, int flags)
192 {
193 	struct proc *p;
194 	struct thread *td;
195 
196 	p = (struct proc *)mem;
197 	SDT_PROBE4(proc, , ctor , entry, p, size, arg, flags);
198 	EVENTHANDLER_INVOKE(process_ctor, p);
199 	SDT_PROBE4(proc, , ctor , return, p, size, arg, flags);
200 	td = FIRST_THREAD_IN_PROC(p);
201 	if (td != NULL) {
202 		/* Make sure all thread constructors are executed */
203 		EVENTHANDLER_INVOKE(thread_ctor, td);
204 	}
205 	return (0);
206 }
207 
208 /*
209  * Reclaim a proc after use.
210  */
211 static void
212 proc_dtor(void *mem, int size, void *arg)
213 {
214 	struct proc *p;
215 	struct thread *td;
216 
217 	/* INVARIANTS checks go here */
218 	p = (struct proc *)mem;
219 	td = FIRST_THREAD_IN_PROC(p);
220 	SDT_PROBE4(proc, , dtor, entry, p, size, arg, td);
221 	if (td != NULL) {
222 #ifdef INVARIANTS
223 		KASSERT((p->p_numthreads == 1),
224 		    ("bad number of threads in exiting process"));
225 		KASSERT(STAILQ_EMPTY(&p->p_ktr), ("proc_dtor: non-empty p_ktr"));
226 #endif
227 		/* Free all OSD associated to this thread. */
228 		osd_thread_exit(td);
229 		td_softdep_cleanup(td);
230 		MPASS(td->td_su == NULL);
231 
232 		/* Make sure all thread destructors are executed */
233 		EVENTHANDLER_INVOKE(thread_dtor, td);
234 	}
235 	EVENTHANDLER_INVOKE(process_dtor, p);
236 	if (p->p_ksi != NULL)
237 		KASSERT(! KSI_ONQ(p->p_ksi), ("SIGCHLD queue"));
238 	SDT_PROBE3(proc, , dtor, return, p, size, arg);
239 }
240 
241 /*
242  * Initialize type-stable parts of a proc (when newly created).
243  */
244 static int
245 proc_init(void *mem, int size, int flags)
246 {
247 	struct proc *p;
248 
249 	p = (struct proc *)mem;
250 	SDT_PROBE3(proc, , init, entry, p, size, flags);
251 	mtx_init(&p->p_mtx, "process lock", NULL, MTX_DEF | MTX_DUPOK | MTX_NEW);
252 	mtx_init(&p->p_slock, "process slock", NULL, MTX_SPIN | MTX_NEW);
253 	mtx_init(&p->p_statmtx, "pstatl", NULL, MTX_SPIN | MTX_NEW);
254 	mtx_init(&p->p_itimmtx, "pitiml", NULL, MTX_SPIN | MTX_NEW);
255 	mtx_init(&p->p_profmtx, "pprofl", NULL, MTX_SPIN | MTX_NEW);
256 	cv_init(&p->p_pwait, "ppwait");
257 	cv_init(&p->p_dbgwait, "dbgwait");
258 	TAILQ_INIT(&p->p_threads);	     /* all threads in proc */
259 	EVENTHANDLER_INVOKE(process_init, p);
260 	p->p_stats = pstats_alloc();
261 	p->p_pgrp = NULL;
262 	SDT_PROBE3(proc, , init, return, p, size, flags);
263 	return (0);
264 }
265 
266 /*
267  * UMA should ensure that this function is never called.
268  * Freeing a proc structure would violate type stability.
269  */
270 static void
271 proc_fini(void *mem, int size)
272 {
273 #ifdef notnow
274 	struct proc *p;
275 
276 	p = (struct proc *)mem;
277 	EVENTHANDLER_INVOKE(process_fini, p);
278 	pstats_free(p->p_stats);
279 	thread_free(FIRST_THREAD_IN_PROC(p));
280 	mtx_destroy(&p->p_mtx);
281 	if (p->p_ksi != NULL)
282 		ksiginfo_free(p->p_ksi);
283 #else
284 	panic("proc reclaimed");
285 #endif
286 }
287 
288 /*
289  * Is p an inferior of the current process?
290  */
291 int
292 inferior(struct proc *p)
293 {
294 
295 	sx_assert(&proctree_lock, SX_LOCKED);
296 	PROC_LOCK_ASSERT(p, MA_OWNED);
297 	for (; p != curproc; p = proc_realparent(p)) {
298 		if (p->p_pid == 0)
299 			return (0);
300 	}
301 	return (1);
302 }
303 
304 struct proc *
305 pfind_locked(pid_t pid)
306 {
307 	struct proc *p;
308 
309 	sx_assert(&allproc_lock, SX_LOCKED);
310 	LIST_FOREACH(p, PIDHASH(pid), p_hash) {
311 		if (p->p_pid == pid) {
312 			PROC_LOCK(p);
313 			if (p->p_state == PRS_NEW) {
314 				PROC_UNLOCK(p);
315 				p = NULL;
316 			}
317 			break;
318 		}
319 	}
320 	return (p);
321 }
322 
323 /*
324  * Locate a process by number; return only "live" processes -- i.e., neither
325  * zombies nor newly born but incompletely initialized processes.  By not
326  * returning processes in the PRS_NEW state, we allow callers to avoid
327  * testing for that condition to avoid dereferencing p_ucred, et al.
328  */
329 struct proc *
330 pfind(pid_t pid)
331 {
332 	struct proc *p;
333 
334 	sx_slock(&allproc_lock);
335 	p = pfind_locked(pid);
336 	sx_sunlock(&allproc_lock);
337 	return (p);
338 }
339 
340 static struct proc *
341 pfind_tid_locked(pid_t tid)
342 {
343 	struct proc *p;
344 	struct thread *td;
345 
346 	sx_assert(&allproc_lock, SX_LOCKED);
347 	FOREACH_PROC_IN_SYSTEM(p) {
348 		PROC_LOCK(p);
349 		if (p->p_state == PRS_NEW) {
350 			PROC_UNLOCK(p);
351 			continue;
352 		}
353 		FOREACH_THREAD_IN_PROC(p, td) {
354 			if (td->td_tid == tid)
355 				goto found;
356 		}
357 		PROC_UNLOCK(p);
358 	}
359 found:
360 	return (p);
361 }
362 
363 /*
364  * Locate a process group by number.
365  * The caller must hold proctree_lock.
366  */
367 struct pgrp *
368 pgfind(pid_t pgid)
369 {
370 	struct pgrp *pgrp;
371 
372 	sx_assert(&proctree_lock, SX_LOCKED);
373 
374 	LIST_FOREACH(pgrp, PGRPHASH(pgid), pg_hash) {
375 		if (pgrp->pg_id == pgid) {
376 			PGRP_LOCK(pgrp);
377 			return (pgrp);
378 		}
379 	}
380 	return (NULL);
381 }
382 
383 /*
384  * Locate process and do additional manipulations, depending on flags.
385  */
386 int
387 pget(pid_t pid, int flags, struct proc **pp)
388 {
389 	struct proc *p;
390 	int error;
391 
392 	p = curproc;
393 	if (p->p_pid == pid) {
394 		PROC_LOCK(p);
395 	} else {
396 		sx_slock(&allproc_lock);
397 		if (pid <= PID_MAX) {
398 			p = pfind_locked(pid);
399 			if (p == NULL && (flags & PGET_NOTWEXIT) == 0)
400 				p = zpfind_locked(pid);
401 		} else if ((flags & PGET_NOTID) == 0) {
402 			p = pfind_tid_locked(pid);
403 		} else {
404 			p = NULL;
405 		}
406 		sx_sunlock(&allproc_lock);
407 		if (p == NULL)
408 			return (ESRCH);
409 		if ((flags & PGET_CANSEE) != 0) {
410 			error = p_cansee(curthread, p);
411 			if (error != 0)
412 				goto errout;
413 		}
414 	}
415 	if ((flags & PGET_CANDEBUG) != 0) {
416 		error = p_candebug(curthread, p);
417 		if (error != 0)
418 			goto errout;
419 	}
420 	if ((flags & PGET_ISCURRENT) != 0 && curproc != p) {
421 		error = EPERM;
422 		goto errout;
423 	}
424 	if ((flags & PGET_NOTWEXIT) != 0 && (p->p_flag & P_WEXIT) != 0) {
425 		error = ESRCH;
426 		goto errout;
427 	}
428 	if ((flags & PGET_NOTINEXEC) != 0 && (p->p_flag & P_INEXEC) != 0) {
429 		/*
430 		 * XXXRW: Not clear ESRCH is the right error during proc
431 		 * execve().
432 		 */
433 		error = ESRCH;
434 		goto errout;
435 	}
436 	if ((flags & PGET_HOLD) != 0) {
437 		_PHOLD(p);
438 		PROC_UNLOCK(p);
439 	}
440 	*pp = p;
441 	return (0);
442 errout:
443 	PROC_UNLOCK(p);
444 	return (error);
445 }
446 
447 /*
448  * Create a new process group.
449  * pgid must be equal to the pid of p.
450  * Begin a new session if required.
451  */
452 int
453 enterpgrp(struct proc *p, pid_t pgid, struct pgrp *pgrp, struct session *sess)
454 {
455 
456 	sx_assert(&proctree_lock, SX_XLOCKED);
457 
458 	KASSERT(pgrp != NULL, ("enterpgrp: pgrp == NULL"));
459 	KASSERT(p->p_pid == pgid,
460 	    ("enterpgrp: new pgrp and pid != pgid"));
461 	KASSERT(pgfind(pgid) == NULL,
462 	    ("enterpgrp: pgrp with pgid exists"));
463 	KASSERT(!SESS_LEADER(p),
464 	    ("enterpgrp: session leader attempted setpgrp"));
465 
466 	mtx_init(&pgrp->pg_mtx, "process group", NULL, MTX_DEF | MTX_DUPOK);
467 
468 	if (sess != NULL) {
469 		/*
470 		 * new session
471 		 */
472 		mtx_init(&sess->s_mtx, "session", NULL, MTX_DEF);
473 		PROC_LOCK(p);
474 		p->p_flag &= ~P_CONTROLT;
475 		PROC_UNLOCK(p);
476 		PGRP_LOCK(pgrp);
477 		sess->s_leader = p;
478 		sess->s_sid = p->p_pid;
479 		refcount_init(&sess->s_count, 1);
480 		sess->s_ttyvp = NULL;
481 		sess->s_ttydp = NULL;
482 		sess->s_ttyp = NULL;
483 		bcopy(p->p_session->s_login, sess->s_login,
484 			    sizeof(sess->s_login));
485 		pgrp->pg_session = sess;
486 		KASSERT(p == curproc,
487 		    ("enterpgrp: mksession and p != curproc"));
488 	} else {
489 		pgrp->pg_session = p->p_session;
490 		sess_hold(pgrp->pg_session);
491 		PGRP_LOCK(pgrp);
492 	}
493 	pgrp->pg_id = pgid;
494 	LIST_INIT(&pgrp->pg_members);
495 
496 	/*
497 	 * As we have an exclusive lock of proctree_lock,
498 	 * this should not deadlock.
499 	 */
500 	LIST_INSERT_HEAD(PGRPHASH(pgid), pgrp, pg_hash);
501 	pgrp->pg_jobc = 0;
502 	SLIST_INIT(&pgrp->pg_sigiolst);
503 	PGRP_UNLOCK(pgrp);
504 
505 	doenterpgrp(p, pgrp);
506 
507 	return (0);
508 }
509 
510 /*
511  * Move p to an existing process group
512  */
513 int
514 enterthispgrp(struct proc *p, struct pgrp *pgrp)
515 {
516 
517 	sx_assert(&proctree_lock, SX_XLOCKED);
518 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
519 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
520 	PGRP_LOCK_ASSERT(p->p_pgrp, MA_NOTOWNED);
521 	SESS_LOCK_ASSERT(p->p_session, MA_NOTOWNED);
522 	KASSERT(pgrp->pg_session == p->p_session,
523 		("%s: pgrp's session %p, p->p_session %p.\n",
524 		__func__,
525 		pgrp->pg_session,
526 		p->p_session));
527 	KASSERT(pgrp != p->p_pgrp,
528 		("%s: p belongs to pgrp.", __func__));
529 
530 	doenterpgrp(p, pgrp);
531 
532 	return (0);
533 }
534 
535 /*
536  * Move p to a process group
537  */
538 static void
539 doenterpgrp(struct proc *p, struct pgrp *pgrp)
540 {
541 	struct pgrp *savepgrp;
542 
543 	sx_assert(&proctree_lock, SX_XLOCKED);
544 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
545 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
546 	PGRP_LOCK_ASSERT(p->p_pgrp, MA_NOTOWNED);
547 	SESS_LOCK_ASSERT(p->p_session, MA_NOTOWNED);
548 
549 	savepgrp = p->p_pgrp;
550 
551 	/*
552 	 * Adjust eligibility of affected pgrps to participate in job control.
553 	 * Increment eligibility counts before decrementing, otherwise we
554 	 * could reach 0 spuriously during the first call.
555 	 */
556 	fixjobc(p, pgrp, 1);
557 	fixjobc(p, p->p_pgrp, 0);
558 
559 	PGRP_LOCK(pgrp);
560 	PGRP_LOCK(savepgrp);
561 	PROC_LOCK(p);
562 	LIST_REMOVE(p, p_pglist);
563 	p->p_pgrp = pgrp;
564 	PROC_UNLOCK(p);
565 	LIST_INSERT_HEAD(&pgrp->pg_members, p, p_pglist);
566 	PGRP_UNLOCK(savepgrp);
567 	PGRP_UNLOCK(pgrp);
568 	if (LIST_EMPTY(&savepgrp->pg_members))
569 		pgdelete(savepgrp);
570 }
571 
572 /*
573  * remove process from process group
574  */
575 int
576 leavepgrp(struct proc *p)
577 {
578 	struct pgrp *savepgrp;
579 
580 	sx_assert(&proctree_lock, SX_XLOCKED);
581 	savepgrp = p->p_pgrp;
582 	PGRP_LOCK(savepgrp);
583 	PROC_LOCK(p);
584 	LIST_REMOVE(p, p_pglist);
585 	p->p_pgrp = NULL;
586 	PROC_UNLOCK(p);
587 	PGRP_UNLOCK(savepgrp);
588 	if (LIST_EMPTY(&savepgrp->pg_members))
589 		pgdelete(savepgrp);
590 	return (0);
591 }
592 
593 /*
594  * delete a process group
595  */
596 static void
597 pgdelete(struct pgrp *pgrp)
598 {
599 	struct session *savesess;
600 	struct tty *tp;
601 
602 	sx_assert(&proctree_lock, SX_XLOCKED);
603 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
604 	SESS_LOCK_ASSERT(pgrp->pg_session, MA_NOTOWNED);
605 
606 	/*
607 	 * Reset any sigio structures pointing to us as a result of
608 	 * F_SETOWN with our pgid.
609 	 */
610 	funsetownlst(&pgrp->pg_sigiolst);
611 
612 	PGRP_LOCK(pgrp);
613 	tp = pgrp->pg_session->s_ttyp;
614 	LIST_REMOVE(pgrp, pg_hash);
615 	savesess = pgrp->pg_session;
616 	PGRP_UNLOCK(pgrp);
617 
618 	/* Remove the reference to the pgrp before deallocating it. */
619 	if (tp != NULL) {
620 		tty_lock(tp);
621 		tty_rel_pgrp(tp, pgrp);
622 	}
623 
624 	mtx_destroy(&pgrp->pg_mtx);
625 	free(pgrp, M_PGRP);
626 	sess_release(savesess);
627 }
628 
629 static void
630 pgadjustjobc(struct pgrp *pgrp, int entering)
631 {
632 
633 	PGRP_LOCK(pgrp);
634 	if (entering)
635 		pgrp->pg_jobc++;
636 	else {
637 		--pgrp->pg_jobc;
638 		if (pgrp->pg_jobc == 0)
639 			orphanpg(pgrp);
640 	}
641 	PGRP_UNLOCK(pgrp);
642 }
643 
644 /*
645  * Adjust pgrp jobc counters when specified process changes process group.
646  * We count the number of processes in each process group that "qualify"
647  * the group for terminal job control (those with a parent in a different
648  * process group of the same session).  If that count reaches zero, the
649  * process group becomes orphaned.  Check both the specified process'
650  * process group and that of its children.
651  * entering == 0 => p is leaving specified group.
652  * entering == 1 => p is entering specified group.
653  */
654 void
655 fixjobc(struct proc *p, struct pgrp *pgrp, int entering)
656 {
657 	struct pgrp *hispgrp;
658 	struct session *mysession;
659 	struct proc *q;
660 
661 	sx_assert(&proctree_lock, SX_LOCKED);
662 	PROC_LOCK_ASSERT(p, MA_NOTOWNED);
663 	PGRP_LOCK_ASSERT(pgrp, MA_NOTOWNED);
664 	SESS_LOCK_ASSERT(pgrp->pg_session, MA_NOTOWNED);
665 
666 	/*
667 	 * Check p's parent to see whether p qualifies its own process
668 	 * group; if so, adjust count for p's process group.
669 	 */
670 	mysession = pgrp->pg_session;
671 	if ((hispgrp = p->p_pptr->p_pgrp) != pgrp &&
672 	    hispgrp->pg_session == mysession)
673 		pgadjustjobc(pgrp, entering);
674 
675 	/*
676 	 * Check this process' children to see whether they qualify
677 	 * their process groups; if so, adjust counts for children's
678 	 * process groups.
679 	 */
680 	LIST_FOREACH(q, &p->p_children, p_sibling) {
681 		hispgrp = q->p_pgrp;
682 		if (hispgrp == pgrp ||
683 		    hispgrp->pg_session != mysession)
684 			continue;
685 		if (q->p_state == PRS_ZOMBIE)
686 			continue;
687 		pgadjustjobc(hispgrp, entering);
688 	}
689 }
690 
691 void
692 killjobc(void)
693 {
694 	struct session *sp;
695 	struct tty *tp;
696 	struct proc *p;
697 	struct vnode *ttyvp;
698 
699 	p = curproc;
700 	MPASS(p->p_flag & P_WEXIT);
701 	/*
702 	 * Do a quick check to see if there is anything to do with the
703 	 * proctree_lock held. pgrp and LIST_EMPTY checks are for fixjobc().
704 	 */
705 	PROC_LOCK(p);
706 	if (!SESS_LEADER(p) &&
707 	    (p->p_pgrp == p->p_pptr->p_pgrp) &&
708 	    LIST_EMPTY(&p->p_children)) {
709 		PROC_UNLOCK(p);
710 		return;
711 	}
712 	PROC_UNLOCK(p);
713 
714 	sx_xlock(&proctree_lock);
715 	if (SESS_LEADER(p)) {
716 		sp = p->p_session;
717 
718 		/*
719 		 * s_ttyp is not zero'd; we use this to indicate that
720 		 * the session once had a controlling terminal. (for
721 		 * logging and informational purposes)
722 		 */
723 		SESS_LOCK(sp);
724 		ttyvp = sp->s_ttyvp;
725 		tp = sp->s_ttyp;
726 		sp->s_ttyvp = NULL;
727 		sp->s_ttydp = NULL;
728 		sp->s_leader = NULL;
729 		SESS_UNLOCK(sp);
730 
731 		/*
732 		 * Signal foreground pgrp and revoke access to
733 		 * controlling terminal if it has not been revoked
734 		 * already.
735 		 *
736 		 * Because the TTY may have been revoked in the mean
737 		 * time and could already have a new session associated
738 		 * with it, make sure we don't send a SIGHUP to a
739 		 * foreground process group that does not belong to this
740 		 * session.
741 		 */
742 
743 		if (tp != NULL) {
744 			tty_lock(tp);
745 			if (tp->t_session == sp)
746 				tty_signal_pgrp(tp, SIGHUP);
747 			tty_unlock(tp);
748 		}
749 
750 		if (ttyvp != NULL) {
751 			sx_xunlock(&proctree_lock);
752 			if (vn_lock(ttyvp, LK_EXCLUSIVE) == 0) {
753 				VOP_REVOKE(ttyvp, REVOKEALL);
754 				VOP_UNLOCK(ttyvp, 0);
755 			}
756 			vrele(ttyvp);
757 			sx_xlock(&proctree_lock);
758 		}
759 	}
760 	fixjobc(p, p->p_pgrp, 0);
761 	sx_xunlock(&proctree_lock);
762 }
763 
764 /*
765  * A process group has become orphaned;
766  * if there are any stopped processes in the group,
767  * hang-up all process in that group.
768  */
769 static void
770 orphanpg(struct pgrp *pg)
771 {
772 	struct proc *p;
773 
774 	PGRP_LOCK_ASSERT(pg, MA_OWNED);
775 
776 	LIST_FOREACH(p, &pg->pg_members, p_pglist) {
777 		PROC_LOCK(p);
778 		if (P_SHOULDSTOP(p) == P_STOPPED_SIG) {
779 			PROC_UNLOCK(p);
780 			LIST_FOREACH(p, &pg->pg_members, p_pglist) {
781 				PROC_LOCK(p);
782 				kern_psignal(p, SIGHUP);
783 				kern_psignal(p, SIGCONT);
784 				PROC_UNLOCK(p);
785 			}
786 			return;
787 		}
788 		PROC_UNLOCK(p);
789 	}
790 }
791 
792 void
793 sess_hold(struct session *s)
794 {
795 
796 	refcount_acquire(&s->s_count);
797 }
798 
799 void
800 sess_release(struct session *s)
801 {
802 
803 	if (refcount_release(&s->s_count)) {
804 		if (s->s_ttyp != NULL) {
805 			tty_lock(s->s_ttyp);
806 			tty_rel_sess(s->s_ttyp, s);
807 		}
808 		mtx_destroy(&s->s_mtx);
809 		free(s, M_SESSION);
810 	}
811 }
812 
813 #ifdef DDB
814 
815 DB_SHOW_COMMAND(pgrpdump, pgrpdump)
816 {
817 	struct pgrp *pgrp;
818 	struct proc *p;
819 	int i;
820 
821 	for (i = 0; i <= pgrphash; i++) {
822 		if (!LIST_EMPTY(&pgrphashtbl[i])) {
823 			printf("\tindx %d\n", i);
824 			LIST_FOREACH(pgrp, &pgrphashtbl[i], pg_hash) {
825 				printf(
826 			"\tpgrp %p, pgid %ld, sess %p, sesscnt %d, mem %p\n",
827 				    (void *)pgrp, (long)pgrp->pg_id,
828 				    (void *)pgrp->pg_session,
829 				    pgrp->pg_session->s_count,
830 				    (void *)LIST_FIRST(&pgrp->pg_members));
831 				LIST_FOREACH(p, &pgrp->pg_members, p_pglist) {
832 					printf("\t\tpid %ld addr %p pgrp %p\n",
833 					    (long)p->p_pid, (void *)p,
834 					    (void *)p->p_pgrp);
835 				}
836 			}
837 		}
838 	}
839 }
840 #endif /* DDB */
841 
842 /*
843  * Calculate the kinfo_proc members which contain process-wide
844  * informations.
845  * Must be called with the target process locked.
846  */
847 static void
848 fill_kinfo_aggregate(struct proc *p, struct kinfo_proc *kp)
849 {
850 	struct thread *td;
851 
852 	PROC_LOCK_ASSERT(p, MA_OWNED);
853 
854 	kp->ki_estcpu = 0;
855 	kp->ki_pctcpu = 0;
856 	FOREACH_THREAD_IN_PROC(p, td) {
857 		thread_lock(td);
858 		kp->ki_pctcpu += sched_pctcpu(td);
859 		kp->ki_estcpu += sched_estcpu(td);
860 		thread_unlock(td);
861 	}
862 }
863 
864 /*
865  * Clear kinfo_proc and fill in any information that is common
866  * to all threads in the process.
867  * Must be called with the target process locked.
868  */
869 static void
870 fill_kinfo_proc_only(struct proc *p, struct kinfo_proc *kp)
871 {
872 	struct thread *td0;
873 	struct tty *tp;
874 	struct session *sp;
875 	struct ucred *cred;
876 	struct sigacts *ps;
877 	struct timeval boottime;
878 
879 	/* For proc_realparent. */
880 	sx_assert(&proctree_lock, SX_LOCKED);
881 	PROC_LOCK_ASSERT(p, MA_OWNED);
882 	bzero(kp, sizeof(*kp));
883 
884 	kp->ki_structsize = sizeof(*kp);
885 	kp->ki_paddr = p;
886 	kp->ki_addr =/* p->p_addr; */0; /* XXX */
887 	kp->ki_args = p->p_args;
888 	kp->ki_textvp = p->p_textvp;
889 #ifdef KTRACE
890 	kp->ki_tracep = p->p_tracevp;
891 	kp->ki_traceflag = p->p_traceflag;
892 #endif
893 	kp->ki_fd = p->p_fd;
894 	kp->ki_vmspace = p->p_vmspace;
895 	kp->ki_flag = p->p_flag;
896 	kp->ki_flag2 = p->p_flag2;
897 	cred = p->p_ucred;
898 	if (cred) {
899 		kp->ki_uid = cred->cr_uid;
900 		kp->ki_ruid = cred->cr_ruid;
901 		kp->ki_svuid = cred->cr_svuid;
902 		kp->ki_cr_flags = 0;
903 		if (cred->cr_flags & CRED_FLAG_CAPMODE)
904 			kp->ki_cr_flags |= KI_CRF_CAPABILITY_MODE;
905 		/* XXX bde doesn't like KI_NGROUPS */
906 		if (cred->cr_ngroups > KI_NGROUPS) {
907 			kp->ki_ngroups = KI_NGROUPS;
908 			kp->ki_cr_flags |= KI_CRF_GRP_OVERFLOW;
909 		} else
910 			kp->ki_ngroups = cred->cr_ngroups;
911 		bcopy(cred->cr_groups, kp->ki_groups,
912 		    kp->ki_ngroups * sizeof(gid_t));
913 		kp->ki_rgid = cred->cr_rgid;
914 		kp->ki_svgid = cred->cr_svgid;
915 		/* If jailed(cred), emulate the old P_JAILED flag. */
916 		if (jailed(cred)) {
917 			kp->ki_flag |= P_JAILED;
918 			/* If inside the jail, use 0 as a jail ID. */
919 			if (cred->cr_prison != curthread->td_ucred->cr_prison)
920 				kp->ki_jid = cred->cr_prison->pr_id;
921 		}
922 		strlcpy(kp->ki_loginclass, cred->cr_loginclass->lc_name,
923 		    sizeof(kp->ki_loginclass));
924 	}
925 	ps = p->p_sigacts;
926 	if (ps) {
927 		mtx_lock(&ps->ps_mtx);
928 		kp->ki_sigignore = ps->ps_sigignore;
929 		kp->ki_sigcatch = ps->ps_sigcatch;
930 		mtx_unlock(&ps->ps_mtx);
931 	}
932 	if (p->p_state != PRS_NEW &&
933 	    p->p_state != PRS_ZOMBIE &&
934 	    p->p_vmspace != NULL) {
935 		struct vmspace *vm = p->p_vmspace;
936 
937 		kp->ki_size = vm->vm_map.size;
938 		kp->ki_rssize = vmspace_resident_count(vm); /*XXX*/
939 		FOREACH_THREAD_IN_PROC(p, td0) {
940 			if (!TD_IS_SWAPPED(td0))
941 				kp->ki_rssize += td0->td_kstack_pages;
942 		}
943 		kp->ki_swrss = vm->vm_swrss;
944 		kp->ki_tsize = vm->vm_tsize;
945 		kp->ki_dsize = vm->vm_dsize;
946 		kp->ki_ssize = vm->vm_ssize;
947 	} else if (p->p_state == PRS_ZOMBIE)
948 		kp->ki_stat = SZOMB;
949 	if (kp->ki_flag & P_INMEM)
950 		kp->ki_sflag = PS_INMEM;
951 	else
952 		kp->ki_sflag = 0;
953 	/* Calculate legacy swtime as seconds since 'swtick'. */
954 	kp->ki_swtime = (ticks - p->p_swtick) / hz;
955 	kp->ki_pid = p->p_pid;
956 	kp->ki_nice = p->p_nice;
957 	kp->ki_fibnum = p->p_fibnum;
958 	kp->ki_start = p->p_stats->p_start;
959 	getboottime(&boottime);
960 	timevaladd(&kp->ki_start, &boottime);
961 	PROC_STATLOCK(p);
962 	rufetch(p, &kp->ki_rusage);
963 	kp->ki_runtime = cputick2usec(p->p_rux.rux_runtime);
964 	calcru(p, &kp->ki_rusage.ru_utime, &kp->ki_rusage.ru_stime);
965 	PROC_STATUNLOCK(p);
966 	calccru(p, &kp->ki_childutime, &kp->ki_childstime);
967 	/* Some callers want child times in a single value. */
968 	kp->ki_childtime = kp->ki_childstime;
969 	timevaladd(&kp->ki_childtime, &kp->ki_childutime);
970 
971 	FOREACH_THREAD_IN_PROC(p, td0)
972 		kp->ki_cow += td0->td_cow;
973 
974 	tp = NULL;
975 	if (p->p_pgrp) {
976 		kp->ki_pgid = p->p_pgrp->pg_id;
977 		kp->ki_jobc = p->p_pgrp->pg_jobc;
978 		sp = p->p_pgrp->pg_session;
979 
980 		if (sp != NULL) {
981 			kp->ki_sid = sp->s_sid;
982 			SESS_LOCK(sp);
983 			strlcpy(kp->ki_login, sp->s_login,
984 			    sizeof(kp->ki_login));
985 			if (sp->s_ttyvp)
986 				kp->ki_kiflag |= KI_CTTY;
987 			if (SESS_LEADER(p))
988 				kp->ki_kiflag |= KI_SLEADER;
989 			/* XXX proctree_lock */
990 			tp = sp->s_ttyp;
991 			SESS_UNLOCK(sp);
992 		}
993 	}
994 	if ((p->p_flag & P_CONTROLT) && tp != NULL) {
995 		kp->ki_tdev = tty_udev(tp);
996 		kp->ki_tdev_freebsd11 = kp->ki_tdev; /* truncate */
997 		kp->ki_tpgid = tp->t_pgrp ? tp->t_pgrp->pg_id : NO_PID;
998 		if (tp->t_session)
999 			kp->ki_tsid = tp->t_session->s_sid;
1000 	} else {
1001 		kp->ki_tdev = NODEV;
1002 		kp->ki_tdev_freebsd11 = kp->ki_tdev; /* truncate */
1003 	}
1004 	if (p->p_comm[0] != '\0')
1005 		strlcpy(kp->ki_comm, p->p_comm, sizeof(kp->ki_comm));
1006 	if (p->p_sysent && p->p_sysent->sv_name != NULL &&
1007 	    p->p_sysent->sv_name[0] != '\0')
1008 		strlcpy(kp->ki_emul, p->p_sysent->sv_name, sizeof(kp->ki_emul));
1009 	kp->ki_siglist = p->p_siglist;
1010 	kp->ki_xstat = KW_EXITCODE(p->p_xexit, p->p_xsig);
1011 	kp->ki_acflag = p->p_acflag;
1012 	kp->ki_lock = p->p_lock;
1013 	if (p->p_pptr) {
1014 		kp->ki_ppid = proc_realparent(p)->p_pid;
1015 		if (p->p_flag & P_TRACED)
1016 			kp->ki_tracer = p->p_pptr->p_pid;
1017 	}
1018 }
1019 
1020 /*
1021  * Fill in information that is thread specific.  Must be called with
1022  * target process locked.  If 'preferthread' is set, overwrite certain
1023  * process-related fields that are maintained for both threads and
1024  * processes.
1025  */
1026 static void
1027 fill_kinfo_thread(struct thread *td, struct kinfo_proc *kp, int preferthread)
1028 {
1029 	struct proc *p;
1030 
1031 	p = td->td_proc;
1032 	kp->ki_tdaddr = td;
1033 	PROC_LOCK_ASSERT(p, MA_OWNED);
1034 
1035 	if (preferthread)
1036 		PROC_STATLOCK(p);
1037 	thread_lock(td);
1038 	if (td->td_wmesg != NULL)
1039 		strlcpy(kp->ki_wmesg, td->td_wmesg, sizeof(kp->ki_wmesg));
1040 	else
1041 		bzero(kp->ki_wmesg, sizeof(kp->ki_wmesg));
1042 	if (strlcpy(kp->ki_tdname, td->td_name, sizeof(kp->ki_tdname)) >=
1043 	    sizeof(kp->ki_tdname)) {
1044 		strlcpy(kp->ki_moretdname,
1045 		    td->td_name + sizeof(kp->ki_tdname) - 1,
1046 		    sizeof(kp->ki_moretdname));
1047 	} else {
1048 		bzero(kp->ki_moretdname, sizeof(kp->ki_moretdname));
1049 	}
1050 	if (TD_ON_LOCK(td)) {
1051 		kp->ki_kiflag |= KI_LOCKBLOCK;
1052 		strlcpy(kp->ki_lockname, td->td_lockname,
1053 		    sizeof(kp->ki_lockname));
1054 	} else {
1055 		kp->ki_kiflag &= ~KI_LOCKBLOCK;
1056 		bzero(kp->ki_lockname, sizeof(kp->ki_lockname));
1057 	}
1058 
1059 	if (p->p_state == PRS_NORMAL) { /* approximate. */
1060 		if (TD_ON_RUNQ(td) ||
1061 		    TD_CAN_RUN(td) ||
1062 		    TD_IS_RUNNING(td)) {
1063 			kp->ki_stat = SRUN;
1064 		} else if (P_SHOULDSTOP(p)) {
1065 			kp->ki_stat = SSTOP;
1066 		} else if (TD_IS_SLEEPING(td)) {
1067 			kp->ki_stat = SSLEEP;
1068 		} else if (TD_ON_LOCK(td)) {
1069 			kp->ki_stat = SLOCK;
1070 		} else {
1071 			kp->ki_stat = SWAIT;
1072 		}
1073 	} else if (p->p_state == PRS_ZOMBIE) {
1074 		kp->ki_stat = SZOMB;
1075 	} else {
1076 		kp->ki_stat = SIDL;
1077 	}
1078 
1079 	/* Things in the thread */
1080 	kp->ki_wchan = td->td_wchan;
1081 	kp->ki_pri.pri_level = td->td_priority;
1082 	kp->ki_pri.pri_native = td->td_base_pri;
1083 
1084 	/*
1085 	 * Note: legacy fields; clamp at the old NOCPU value and/or
1086 	 * the maximum u_char CPU value.
1087 	 */
1088 	if (td->td_lastcpu == NOCPU)
1089 		kp->ki_lastcpu_old = NOCPU_OLD;
1090 	else if (td->td_lastcpu > MAXCPU_OLD)
1091 		kp->ki_lastcpu_old = MAXCPU_OLD;
1092 	else
1093 		kp->ki_lastcpu_old = td->td_lastcpu;
1094 
1095 	if (td->td_oncpu == NOCPU)
1096 		kp->ki_oncpu_old = NOCPU_OLD;
1097 	else if (td->td_oncpu > MAXCPU_OLD)
1098 		kp->ki_oncpu_old = MAXCPU_OLD;
1099 	else
1100 		kp->ki_oncpu_old = td->td_oncpu;
1101 
1102 	kp->ki_lastcpu = td->td_lastcpu;
1103 	kp->ki_oncpu = td->td_oncpu;
1104 	kp->ki_tdflags = td->td_flags;
1105 	kp->ki_tid = td->td_tid;
1106 	kp->ki_numthreads = p->p_numthreads;
1107 	kp->ki_pcb = td->td_pcb;
1108 	kp->ki_kstack = (void *)td->td_kstack;
1109 	kp->ki_slptime = (ticks - td->td_slptick) / hz;
1110 	kp->ki_pri.pri_class = td->td_pri_class;
1111 	kp->ki_pri.pri_user = td->td_user_pri;
1112 
1113 	if (preferthread) {
1114 		rufetchtd(td, &kp->ki_rusage);
1115 		kp->ki_runtime = cputick2usec(td->td_rux.rux_runtime);
1116 		kp->ki_pctcpu = sched_pctcpu(td);
1117 		kp->ki_estcpu = sched_estcpu(td);
1118 		kp->ki_cow = td->td_cow;
1119 	}
1120 
1121 	/* We can't get this anymore but ps etc never used it anyway. */
1122 	kp->ki_rqindex = 0;
1123 
1124 	if (preferthread)
1125 		kp->ki_siglist = td->td_siglist;
1126 	kp->ki_sigmask = td->td_sigmask;
1127 	thread_unlock(td);
1128 	if (preferthread)
1129 		PROC_STATUNLOCK(p);
1130 }
1131 
1132 /*
1133  * Fill in a kinfo_proc structure for the specified process.
1134  * Must be called with the target process locked.
1135  */
1136 void
1137 fill_kinfo_proc(struct proc *p, struct kinfo_proc *kp)
1138 {
1139 
1140 	MPASS(FIRST_THREAD_IN_PROC(p) != NULL);
1141 
1142 	fill_kinfo_proc_only(p, kp);
1143 	fill_kinfo_thread(FIRST_THREAD_IN_PROC(p), kp, 0);
1144 	fill_kinfo_aggregate(p, kp);
1145 }
1146 
1147 struct pstats *
1148 pstats_alloc(void)
1149 {
1150 
1151 	return (malloc(sizeof(struct pstats), M_SUBPROC, M_ZERO|M_WAITOK));
1152 }
1153 
1154 /*
1155  * Copy parts of p_stats; zero the rest of p_stats (statistics).
1156  */
1157 void
1158 pstats_fork(struct pstats *src, struct pstats *dst)
1159 {
1160 
1161 	bzero(&dst->pstat_startzero,
1162 	    __rangeof(struct pstats, pstat_startzero, pstat_endzero));
1163 	bcopy(&src->pstat_startcopy, &dst->pstat_startcopy,
1164 	    __rangeof(struct pstats, pstat_startcopy, pstat_endcopy));
1165 }
1166 
1167 void
1168 pstats_free(struct pstats *ps)
1169 {
1170 
1171 	free(ps, M_SUBPROC);
1172 }
1173 
1174 static struct proc *
1175 zpfind_locked(pid_t pid)
1176 {
1177 	struct proc *p;
1178 
1179 	sx_assert(&allproc_lock, SX_LOCKED);
1180 	LIST_FOREACH(p, &zombproc, p_list) {
1181 		if (p->p_pid == pid) {
1182 			PROC_LOCK(p);
1183 			break;
1184 		}
1185 	}
1186 	return (p);
1187 }
1188 
1189 /*
1190  * Locate a zombie process by number
1191  */
1192 struct proc *
1193 zpfind(pid_t pid)
1194 {
1195 	struct proc *p;
1196 
1197 	sx_slock(&allproc_lock);
1198 	p = zpfind_locked(pid);
1199 	sx_sunlock(&allproc_lock);
1200 	return (p);
1201 }
1202 
1203 #ifdef COMPAT_FREEBSD32
1204 
1205 /*
1206  * This function is typically used to copy out the kernel address, so
1207  * it can be replaced by assignment of zero.
1208  */
1209 static inline uint32_t
1210 ptr32_trim(void *ptr)
1211 {
1212 	uintptr_t uptr;
1213 
1214 	uptr = (uintptr_t)ptr;
1215 	return ((uptr > UINT_MAX) ? 0 : uptr);
1216 }
1217 
1218 #define PTRTRIM_CP(src,dst,fld) \
1219 	do { (dst).fld = ptr32_trim((src).fld); } while (0)
1220 
1221 static void
1222 freebsd32_kinfo_proc_out(const struct kinfo_proc *ki, struct kinfo_proc32 *ki32)
1223 {
1224 	int i;
1225 
1226 	bzero(ki32, sizeof(struct kinfo_proc32));
1227 	ki32->ki_structsize = sizeof(struct kinfo_proc32);
1228 	CP(*ki, *ki32, ki_layout);
1229 	PTRTRIM_CP(*ki, *ki32, ki_args);
1230 	PTRTRIM_CP(*ki, *ki32, ki_paddr);
1231 	PTRTRIM_CP(*ki, *ki32, ki_addr);
1232 	PTRTRIM_CP(*ki, *ki32, ki_tracep);
1233 	PTRTRIM_CP(*ki, *ki32, ki_textvp);
1234 	PTRTRIM_CP(*ki, *ki32, ki_fd);
1235 	PTRTRIM_CP(*ki, *ki32, ki_vmspace);
1236 	PTRTRIM_CP(*ki, *ki32, ki_wchan);
1237 	CP(*ki, *ki32, ki_pid);
1238 	CP(*ki, *ki32, ki_ppid);
1239 	CP(*ki, *ki32, ki_pgid);
1240 	CP(*ki, *ki32, ki_tpgid);
1241 	CP(*ki, *ki32, ki_sid);
1242 	CP(*ki, *ki32, ki_tsid);
1243 	CP(*ki, *ki32, ki_jobc);
1244 	CP(*ki, *ki32, ki_tdev);
1245 	CP(*ki, *ki32, ki_tdev_freebsd11);
1246 	CP(*ki, *ki32, ki_siglist);
1247 	CP(*ki, *ki32, ki_sigmask);
1248 	CP(*ki, *ki32, ki_sigignore);
1249 	CP(*ki, *ki32, ki_sigcatch);
1250 	CP(*ki, *ki32, ki_uid);
1251 	CP(*ki, *ki32, ki_ruid);
1252 	CP(*ki, *ki32, ki_svuid);
1253 	CP(*ki, *ki32, ki_rgid);
1254 	CP(*ki, *ki32, ki_svgid);
1255 	CP(*ki, *ki32, ki_ngroups);
1256 	for (i = 0; i < KI_NGROUPS; i++)
1257 		CP(*ki, *ki32, ki_groups[i]);
1258 	CP(*ki, *ki32, ki_size);
1259 	CP(*ki, *ki32, ki_rssize);
1260 	CP(*ki, *ki32, ki_swrss);
1261 	CP(*ki, *ki32, ki_tsize);
1262 	CP(*ki, *ki32, ki_dsize);
1263 	CP(*ki, *ki32, ki_ssize);
1264 	CP(*ki, *ki32, ki_xstat);
1265 	CP(*ki, *ki32, ki_acflag);
1266 	CP(*ki, *ki32, ki_pctcpu);
1267 	CP(*ki, *ki32, ki_estcpu);
1268 	CP(*ki, *ki32, ki_slptime);
1269 	CP(*ki, *ki32, ki_swtime);
1270 	CP(*ki, *ki32, ki_cow);
1271 	CP(*ki, *ki32, ki_runtime);
1272 	TV_CP(*ki, *ki32, ki_start);
1273 	TV_CP(*ki, *ki32, ki_childtime);
1274 	CP(*ki, *ki32, ki_flag);
1275 	CP(*ki, *ki32, ki_kiflag);
1276 	CP(*ki, *ki32, ki_traceflag);
1277 	CP(*ki, *ki32, ki_stat);
1278 	CP(*ki, *ki32, ki_nice);
1279 	CP(*ki, *ki32, ki_lock);
1280 	CP(*ki, *ki32, ki_rqindex);
1281 	CP(*ki, *ki32, ki_oncpu);
1282 	CP(*ki, *ki32, ki_lastcpu);
1283 
1284 	/* XXX TODO: wrap cpu value as appropriate */
1285 	CP(*ki, *ki32, ki_oncpu_old);
1286 	CP(*ki, *ki32, ki_lastcpu_old);
1287 
1288 	bcopy(ki->ki_tdname, ki32->ki_tdname, TDNAMLEN + 1);
1289 	bcopy(ki->ki_wmesg, ki32->ki_wmesg, WMESGLEN + 1);
1290 	bcopy(ki->ki_login, ki32->ki_login, LOGNAMELEN + 1);
1291 	bcopy(ki->ki_lockname, ki32->ki_lockname, LOCKNAMELEN + 1);
1292 	bcopy(ki->ki_comm, ki32->ki_comm, COMMLEN + 1);
1293 	bcopy(ki->ki_emul, ki32->ki_emul, KI_EMULNAMELEN + 1);
1294 	bcopy(ki->ki_loginclass, ki32->ki_loginclass, LOGINCLASSLEN + 1);
1295 	bcopy(ki->ki_moretdname, ki32->ki_moretdname, MAXCOMLEN - TDNAMLEN + 1);
1296 	CP(*ki, *ki32, ki_tracer);
1297 	CP(*ki, *ki32, ki_flag2);
1298 	CP(*ki, *ki32, ki_fibnum);
1299 	CP(*ki, *ki32, ki_cr_flags);
1300 	CP(*ki, *ki32, ki_jid);
1301 	CP(*ki, *ki32, ki_numthreads);
1302 	CP(*ki, *ki32, ki_tid);
1303 	CP(*ki, *ki32, ki_pri);
1304 	freebsd32_rusage_out(&ki->ki_rusage, &ki32->ki_rusage);
1305 	freebsd32_rusage_out(&ki->ki_rusage_ch, &ki32->ki_rusage_ch);
1306 	PTRTRIM_CP(*ki, *ki32, ki_pcb);
1307 	PTRTRIM_CP(*ki, *ki32, ki_kstack);
1308 	PTRTRIM_CP(*ki, *ki32, ki_udata);
1309 	PTRTRIM_CP(*ki, *ki32, ki_tdaddr);
1310 	CP(*ki, *ki32, ki_sflag);
1311 	CP(*ki, *ki32, ki_tdflags);
1312 }
1313 #endif
1314 
1315 int
1316 kern_proc_out(struct proc *p, struct sbuf *sb, int flags)
1317 {
1318 	struct thread *td;
1319 	struct kinfo_proc ki;
1320 #ifdef COMPAT_FREEBSD32
1321 	struct kinfo_proc32 ki32;
1322 #endif
1323 	int error;
1324 
1325 	PROC_LOCK_ASSERT(p, MA_OWNED);
1326 	MPASS(FIRST_THREAD_IN_PROC(p) != NULL);
1327 
1328 	error = 0;
1329 	fill_kinfo_proc(p, &ki);
1330 	if ((flags & KERN_PROC_NOTHREADS) != 0) {
1331 #ifdef COMPAT_FREEBSD32
1332 		if ((flags & KERN_PROC_MASK32) != 0) {
1333 			freebsd32_kinfo_proc_out(&ki, &ki32);
1334 			if (sbuf_bcat(sb, &ki32, sizeof(ki32)) != 0)
1335 				error = ENOMEM;
1336 		} else
1337 #endif
1338 			if (sbuf_bcat(sb, &ki, sizeof(ki)) != 0)
1339 				error = ENOMEM;
1340 	} else {
1341 		FOREACH_THREAD_IN_PROC(p, td) {
1342 			fill_kinfo_thread(td, &ki, 1);
1343 #ifdef COMPAT_FREEBSD32
1344 			if ((flags & KERN_PROC_MASK32) != 0) {
1345 				freebsd32_kinfo_proc_out(&ki, &ki32);
1346 				if (sbuf_bcat(sb, &ki32, sizeof(ki32)) != 0)
1347 					error = ENOMEM;
1348 			} else
1349 #endif
1350 				if (sbuf_bcat(sb, &ki, sizeof(ki)) != 0)
1351 					error = ENOMEM;
1352 			if (error != 0)
1353 				break;
1354 		}
1355 	}
1356 	PROC_UNLOCK(p);
1357 	return (error);
1358 }
1359 
1360 static int
1361 sysctl_out_proc(struct proc *p, struct sysctl_req *req, int flags,
1362     int doingzomb)
1363 {
1364 	struct sbuf sb;
1365 	struct kinfo_proc ki;
1366 	struct proc *np;
1367 	int error, error2;
1368 	pid_t pid;
1369 
1370 	pid = p->p_pid;
1371 	sbuf_new_for_sysctl(&sb, (char *)&ki, sizeof(ki), req);
1372 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
1373 	error = kern_proc_out(p, &sb, flags);
1374 	error2 = sbuf_finish(&sb);
1375 	sbuf_delete(&sb);
1376 	if (error != 0)
1377 		return (error);
1378 	else if (error2 != 0)
1379 		return (error2);
1380 	if (doingzomb)
1381 		np = zpfind(pid);
1382 	else {
1383 		if (pid == 0)
1384 			return (0);
1385 		np = pfind(pid);
1386 	}
1387 	if (np == NULL)
1388 		return (ESRCH);
1389 	if (np != p) {
1390 		PROC_UNLOCK(np);
1391 		return (ESRCH);
1392 	}
1393 	PROC_UNLOCK(np);
1394 	return (0);
1395 }
1396 
1397 static int
1398 sysctl_kern_proc(SYSCTL_HANDLER_ARGS)
1399 {
1400 	int *name = (int *)arg1;
1401 	u_int namelen = arg2;
1402 	struct proc *p;
1403 	int flags, doingzomb, oid_number;
1404 	int error = 0;
1405 
1406 	oid_number = oidp->oid_number;
1407 	if (oid_number != KERN_PROC_ALL &&
1408 	    (oid_number & KERN_PROC_INC_THREAD) == 0)
1409 		flags = KERN_PROC_NOTHREADS;
1410 	else {
1411 		flags = 0;
1412 		oid_number &= ~KERN_PROC_INC_THREAD;
1413 	}
1414 #ifdef COMPAT_FREEBSD32
1415 	if (req->flags & SCTL_MASK32)
1416 		flags |= KERN_PROC_MASK32;
1417 #endif
1418 	if (oid_number == KERN_PROC_PID) {
1419 		if (namelen != 1)
1420 			return (EINVAL);
1421 		error = sysctl_wire_old_buffer(req, 0);
1422 		if (error)
1423 			return (error);
1424 		sx_slock(&proctree_lock);
1425 		error = pget((pid_t)name[0], PGET_CANSEE, &p);
1426 		if (error == 0)
1427 			error = sysctl_out_proc(p, req, flags, 0);
1428 		sx_sunlock(&proctree_lock);
1429 		return (error);
1430 	}
1431 
1432 	switch (oid_number) {
1433 	case KERN_PROC_ALL:
1434 		if (namelen != 0)
1435 			return (EINVAL);
1436 		break;
1437 	case KERN_PROC_PROC:
1438 		if (namelen != 0 && namelen != 1)
1439 			return (EINVAL);
1440 		break;
1441 	default:
1442 		if (namelen != 1)
1443 			return (EINVAL);
1444 		break;
1445 	}
1446 
1447 	if (!req->oldptr) {
1448 		/* overestimate by 5 procs */
1449 		error = SYSCTL_OUT(req, 0, sizeof (struct kinfo_proc) * 5);
1450 		if (error)
1451 			return (error);
1452 	}
1453 	error = sysctl_wire_old_buffer(req, 0);
1454 	if (error != 0)
1455 		return (error);
1456 	sx_slock(&proctree_lock);
1457 	sx_slock(&allproc_lock);
1458 	for (doingzomb=0 ; doingzomb < 2 ; doingzomb++) {
1459 		if (!doingzomb)
1460 			p = LIST_FIRST(&allproc);
1461 		else
1462 			p = LIST_FIRST(&zombproc);
1463 		for (; p != NULL; p = LIST_NEXT(p, p_list)) {
1464 			/*
1465 			 * Skip embryonic processes.
1466 			 */
1467 			PROC_LOCK(p);
1468 			if (p->p_state == PRS_NEW) {
1469 				PROC_UNLOCK(p);
1470 				continue;
1471 			}
1472 			KASSERT(p->p_ucred != NULL,
1473 			    ("process credential is NULL for non-NEW proc"));
1474 			/*
1475 			 * Show a user only appropriate processes.
1476 			 */
1477 			if (p_cansee(curthread, p)) {
1478 				PROC_UNLOCK(p);
1479 				continue;
1480 			}
1481 			/*
1482 			 * TODO - make more efficient (see notes below).
1483 			 * do by session.
1484 			 */
1485 			switch (oid_number) {
1486 
1487 			case KERN_PROC_GID:
1488 				if (p->p_ucred->cr_gid != (gid_t)name[0]) {
1489 					PROC_UNLOCK(p);
1490 					continue;
1491 				}
1492 				break;
1493 
1494 			case KERN_PROC_PGRP:
1495 				/* could do this by traversing pgrp */
1496 				if (p->p_pgrp == NULL ||
1497 				    p->p_pgrp->pg_id != (pid_t)name[0]) {
1498 					PROC_UNLOCK(p);
1499 					continue;
1500 				}
1501 				break;
1502 
1503 			case KERN_PROC_RGID:
1504 				if (p->p_ucred->cr_rgid != (gid_t)name[0]) {
1505 					PROC_UNLOCK(p);
1506 					continue;
1507 				}
1508 				break;
1509 
1510 			case KERN_PROC_SESSION:
1511 				if (p->p_session == NULL ||
1512 				    p->p_session->s_sid != (pid_t)name[0]) {
1513 					PROC_UNLOCK(p);
1514 					continue;
1515 				}
1516 				break;
1517 
1518 			case KERN_PROC_TTY:
1519 				if ((p->p_flag & P_CONTROLT) == 0 ||
1520 				    p->p_session == NULL) {
1521 					PROC_UNLOCK(p);
1522 					continue;
1523 				}
1524 				/* XXX proctree_lock */
1525 				SESS_LOCK(p->p_session);
1526 				if (p->p_session->s_ttyp == NULL ||
1527 				    tty_udev(p->p_session->s_ttyp) !=
1528 				    (dev_t)name[0]) {
1529 					SESS_UNLOCK(p->p_session);
1530 					PROC_UNLOCK(p);
1531 					continue;
1532 				}
1533 				SESS_UNLOCK(p->p_session);
1534 				break;
1535 
1536 			case KERN_PROC_UID:
1537 				if (p->p_ucred->cr_uid != (uid_t)name[0]) {
1538 					PROC_UNLOCK(p);
1539 					continue;
1540 				}
1541 				break;
1542 
1543 			case KERN_PROC_RUID:
1544 				if (p->p_ucred->cr_ruid != (uid_t)name[0]) {
1545 					PROC_UNLOCK(p);
1546 					continue;
1547 				}
1548 				break;
1549 
1550 			case KERN_PROC_PROC:
1551 				break;
1552 
1553 			default:
1554 				break;
1555 
1556 			}
1557 
1558 			error = sysctl_out_proc(p, req, flags, doingzomb);
1559 			if (error) {
1560 				sx_sunlock(&allproc_lock);
1561 				sx_sunlock(&proctree_lock);
1562 				return (error);
1563 			}
1564 		}
1565 	}
1566 	sx_sunlock(&allproc_lock);
1567 	sx_sunlock(&proctree_lock);
1568 	return (0);
1569 }
1570 
1571 struct pargs *
1572 pargs_alloc(int len)
1573 {
1574 	struct pargs *pa;
1575 
1576 	pa = malloc(sizeof(struct pargs) + len, M_PARGS,
1577 		M_WAITOK);
1578 	refcount_init(&pa->ar_ref, 1);
1579 	pa->ar_length = len;
1580 	return (pa);
1581 }
1582 
1583 static void
1584 pargs_free(struct pargs *pa)
1585 {
1586 
1587 	free(pa, M_PARGS);
1588 }
1589 
1590 void
1591 pargs_hold(struct pargs *pa)
1592 {
1593 
1594 	if (pa == NULL)
1595 		return;
1596 	refcount_acquire(&pa->ar_ref);
1597 }
1598 
1599 void
1600 pargs_drop(struct pargs *pa)
1601 {
1602 
1603 	if (pa == NULL)
1604 		return;
1605 	if (refcount_release(&pa->ar_ref))
1606 		pargs_free(pa);
1607 }
1608 
1609 static int
1610 proc_read_string(struct thread *td, struct proc *p, const char *sptr, char *buf,
1611     size_t len)
1612 {
1613 	ssize_t n;
1614 
1615 	/*
1616 	 * This may return a short read if the string is shorter than the chunk
1617 	 * and is aligned at the end of the page, and the following page is not
1618 	 * mapped.
1619 	 */
1620 	n = proc_readmem(td, p, (vm_offset_t)sptr, buf, len);
1621 	if (n <= 0)
1622 		return (ENOMEM);
1623 	return (0);
1624 }
1625 
1626 #define PROC_AUXV_MAX	256	/* Safety limit on auxv size. */
1627 
1628 enum proc_vector_type {
1629 	PROC_ARG,
1630 	PROC_ENV,
1631 	PROC_AUX,
1632 };
1633 
1634 #ifdef COMPAT_FREEBSD32
1635 static int
1636 get_proc_vector32(struct thread *td, struct proc *p, char ***proc_vectorp,
1637     size_t *vsizep, enum proc_vector_type type)
1638 {
1639 	struct freebsd32_ps_strings pss;
1640 	Elf32_Auxinfo aux;
1641 	vm_offset_t vptr, ptr;
1642 	uint32_t *proc_vector32;
1643 	char **proc_vector;
1644 	size_t vsize, size;
1645 	int i, error;
1646 
1647 	error = 0;
1648 	if (proc_readmem(td, p, (vm_offset_t)p->p_sysent->sv_psstrings, &pss,
1649 	    sizeof(pss)) != sizeof(pss))
1650 		return (ENOMEM);
1651 	switch (type) {
1652 	case PROC_ARG:
1653 		vptr = (vm_offset_t)PTRIN(pss.ps_argvstr);
1654 		vsize = pss.ps_nargvstr;
1655 		if (vsize > ARG_MAX)
1656 			return (ENOEXEC);
1657 		size = vsize * sizeof(int32_t);
1658 		break;
1659 	case PROC_ENV:
1660 		vptr = (vm_offset_t)PTRIN(pss.ps_envstr);
1661 		vsize = pss.ps_nenvstr;
1662 		if (vsize > ARG_MAX)
1663 			return (ENOEXEC);
1664 		size = vsize * sizeof(int32_t);
1665 		break;
1666 	case PROC_AUX:
1667 		vptr = (vm_offset_t)PTRIN(pss.ps_envstr) +
1668 		    (pss.ps_nenvstr + 1) * sizeof(int32_t);
1669 		if (vptr % 4 != 0)
1670 			return (ENOEXEC);
1671 		for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) {
1672 			if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) !=
1673 			    sizeof(aux))
1674 				return (ENOMEM);
1675 			if (aux.a_type == AT_NULL)
1676 				break;
1677 			ptr += sizeof(aux);
1678 		}
1679 		if (aux.a_type != AT_NULL)
1680 			return (ENOEXEC);
1681 		vsize = i + 1;
1682 		size = vsize * sizeof(aux);
1683 		break;
1684 	default:
1685 		KASSERT(0, ("Wrong proc vector type: %d", type));
1686 		return (EINVAL);
1687 	}
1688 	proc_vector32 = malloc(size, M_TEMP, M_WAITOK);
1689 	if (proc_readmem(td, p, vptr, proc_vector32, size) != size) {
1690 		error = ENOMEM;
1691 		goto done;
1692 	}
1693 	if (type == PROC_AUX) {
1694 		*proc_vectorp = (char **)proc_vector32;
1695 		*vsizep = vsize;
1696 		return (0);
1697 	}
1698 	proc_vector = malloc(vsize * sizeof(char *), M_TEMP, M_WAITOK);
1699 	for (i = 0; i < (int)vsize; i++)
1700 		proc_vector[i] = PTRIN(proc_vector32[i]);
1701 	*proc_vectorp = proc_vector;
1702 	*vsizep = vsize;
1703 done:
1704 	free(proc_vector32, M_TEMP);
1705 	return (error);
1706 }
1707 #endif
1708 
1709 static int
1710 get_proc_vector(struct thread *td, struct proc *p, char ***proc_vectorp,
1711     size_t *vsizep, enum proc_vector_type type)
1712 {
1713 	struct ps_strings pss;
1714 	Elf_Auxinfo aux;
1715 	vm_offset_t vptr, ptr;
1716 	char **proc_vector;
1717 	size_t vsize, size;
1718 	int i;
1719 
1720 #ifdef COMPAT_FREEBSD32
1721 	if (SV_PROC_FLAG(p, SV_ILP32) != 0)
1722 		return (get_proc_vector32(td, p, proc_vectorp, vsizep, type));
1723 #endif
1724 	if (proc_readmem(td, p, (vm_offset_t)p->p_sysent->sv_psstrings, &pss,
1725 	    sizeof(pss)) != sizeof(pss))
1726 		return (ENOMEM);
1727 	switch (type) {
1728 	case PROC_ARG:
1729 		vptr = (vm_offset_t)pss.ps_argvstr;
1730 		vsize = pss.ps_nargvstr;
1731 		if (vsize > ARG_MAX)
1732 			return (ENOEXEC);
1733 		size = vsize * sizeof(char *);
1734 		break;
1735 	case PROC_ENV:
1736 		vptr = (vm_offset_t)pss.ps_envstr;
1737 		vsize = pss.ps_nenvstr;
1738 		if (vsize > ARG_MAX)
1739 			return (ENOEXEC);
1740 		size = vsize * sizeof(char *);
1741 		break;
1742 	case PROC_AUX:
1743 		/*
1744 		 * The aux array is just above env array on the stack. Check
1745 		 * that the address is naturally aligned.
1746 		 */
1747 		vptr = (vm_offset_t)pss.ps_envstr + (pss.ps_nenvstr + 1)
1748 		    * sizeof(char *);
1749 #if __ELF_WORD_SIZE == 64
1750 		if (vptr % sizeof(uint64_t) != 0)
1751 #else
1752 		if (vptr % sizeof(uint32_t) != 0)
1753 #endif
1754 			return (ENOEXEC);
1755 		/*
1756 		 * We count the array size reading the aux vectors from the
1757 		 * stack until AT_NULL vector is returned.  So (to keep the code
1758 		 * simple) we read the process stack twice: the first time here
1759 		 * to find the size and the second time when copying the vectors
1760 		 * to the allocated proc_vector.
1761 		 */
1762 		for (ptr = vptr, i = 0; i < PROC_AUXV_MAX; i++) {
1763 			if (proc_readmem(td, p, ptr, &aux, sizeof(aux)) !=
1764 			    sizeof(aux))
1765 				return (ENOMEM);
1766 			if (aux.a_type == AT_NULL)
1767 				break;
1768 			ptr += sizeof(aux);
1769 		}
1770 		/*
1771 		 * If the PROC_AUXV_MAX entries are iterated over, and we have
1772 		 * not reached AT_NULL, it is most likely we are reading wrong
1773 		 * data: either the process doesn't have auxv array or data has
1774 		 * been modified. Return the error in this case.
1775 		 */
1776 		if (aux.a_type != AT_NULL)
1777 			return (ENOEXEC);
1778 		vsize = i + 1;
1779 		size = vsize * sizeof(aux);
1780 		break;
1781 	default:
1782 		KASSERT(0, ("Wrong proc vector type: %d", type));
1783 		return (EINVAL); /* In case we are built without INVARIANTS. */
1784 	}
1785 	proc_vector = malloc(size, M_TEMP, M_WAITOK);
1786 	if (proc_readmem(td, p, vptr, proc_vector, size) != size) {
1787 		free(proc_vector, M_TEMP);
1788 		return (ENOMEM);
1789 	}
1790 	*proc_vectorp = proc_vector;
1791 	*vsizep = vsize;
1792 
1793 	return (0);
1794 }
1795 
1796 #define GET_PS_STRINGS_CHUNK_SZ	256	/* Chunk size (bytes) for ps_strings operations. */
1797 
1798 static int
1799 get_ps_strings(struct thread *td, struct proc *p, struct sbuf *sb,
1800     enum proc_vector_type type)
1801 {
1802 	size_t done, len, nchr, vsize;
1803 	int error, i;
1804 	char **proc_vector, *sptr;
1805 	char pss_string[GET_PS_STRINGS_CHUNK_SZ];
1806 
1807 	PROC_ASSERT_HELD(p);
1808 
1809 	/*
1810 	 * We are not going to read more than 2 * (PATH_MAX + ARG_MAX) bytes.
1811 	 */
1812 	nchr = 2 * (PATH_MAX + ARG_MAX);
1813 
1814 	error = get_proc_vector(td, p, &proc_vector, &vsize, type);
1815 	if (error != 0)
1816 		return (error);
1817 	for (done = 0, i = 0; i < (int)vsize && done < nchr; i++) {
1818 		/*
1819 		 * The program may have scribbled into its argv array, e.g. to
1820 		 * remove some arguments.  If that has happened, break out
1821 		 * before trying to read from NULL.
1822 		 */
1823 		if (proc_vector[i] == NULL)
1824 			break;
1825 		for (sptr = proc_vector[i]; ; sptr += GET_PS_STRINGS_CHUNK_SZ) {
1826 			error = proc_read_string(td, p, sptr, pss_string,
1827 			    sizeof(pss_string));
1828 			if (error != 0)
1829 				goto done;
1830 			len = strnlen(pss_string, GET_PS_STRINGS_CHUNK_SZ);
1831 			if (done + len >= nchr)
1832 				len = nchr - done - 1;
1833 			sbuf_bcat(sb, pss_string, len);
1834 			if (len != GET_PS_STRINGS_CHUNK_SZ)
1835 				break;
1836 			done += GET_PS_STRINGS_CHUNK_SZ;
1837 		}
1838 		sbuf_bcat(sb, "", 1);
1839 		done += len + 1;
1840 	}
1841 done:
1842 	free(proc_vector, M_TEMP);
1843 	return (error);
1844 }
1845 
1846 int
1847 proc_getargv(struct thread *td, struct proc *p, struct sbuf *sb)
1848 {
1849 
1850 	return (get_ps_strings(curthread, p, sb, PROC_ARG));
1851 }
1852 
1853 int
1854 proc_getenvv(struct thread *td, struct proc *p, struct sbuf *sb)
1855 {
1856 
1857 	return (get_ps_strings(curthread, p, sb, PROC_ENV));
1858 }
1859 
1860 int
1861 proc_getauxv(struct thread *td, struct proc *p, struct sbuf *sb)
1862 {
1863 	size_t vsize, size;
1864 	char **auxv;
1865 	int error;
1866 
1867 	error = get_proc_vector(td, p, &auxv, &vsize, PROC_AUX);
1868 	if (error == 0) {
1869 #ifdef COMPAT_FREEBSD32
1870 		if (SV_PROC_FLAG(p, SV_ILP32) != 0)
1871 			size = vsize * sizeof(Elf32_Auxinfo);
1872 		else
1873 #endif
1874 			size = vsize * sizeof(Elf_Auxinfo);
1875 		if (sbuf_bcat(sb, auxv, size) != 0)
1876 			error = ENOMEM;
1877 		free(auxv, M_TEMP);
1878 	}
1879 	return (error);
1880 }
1881 
1882 /*
1883  * This sysctl allows a process to retrieve the argument list or process
1884  * title for another process without groping around in the address space
1885  * of the other process.  It also allow a process to set its own "process
1886  * title to a string of its own choice.
1887  */
1888 static int
1889 sysctl_kern_proc_args(SYSCTL_HANDLER_ARGS)
1890 {
1891 	int *name = (int *)arg1;
1892 	u_int namelen = arg2;
1893 	struct pargs *newpa, *pa;
1894 	struct proc *p;
1895 	struct sbuf sb;
1896 	int flags, error = 0, error2;
1897 
1898 	if (namelen != 1)
1899 		return (EINVAL);
1900 
1901 	flags = PGET_CANSEE;
1902 	if (req->newptr != NULL)
1903 		flags |= PGET_ISCURRENT;
1904 	error = pget((pid_t)name[0], flags, &p);
1905 	if (error)
1906 		return (error);
1907 
1908 	pa = p->p_args;
1909 	if (pa != NULL) {
1910 		pargs_hold(pa);
1911 		PROC_UNLOCK(p);
1912 		error = SYSCTL_OUT(req, pa->ar_args, pa->ar_length);
1913 		pargs_drop(pa);
1914 	} else if ((p->p_flag & (P_WEXIT | P_SYSTEM)) == 0) {
1915 		_PHOLD(p);
1916 		PROC_UNLOCK(p);
1917 		sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
1918 		sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
1919 		error = proc_getargv(curthread, p, &sb);
1920 		error2 = sbuf_finish(&sb);
1921 		PRELE(p);
1922 		sbuf_delete(&sb);
1923 		if (error == 0 && error2 != 0)
1924 			error = error2;
1925 	} else {
1926 		PROC_UNLOCK(p);
1927 	}
1928 	if (error != 0 || req->newptr == NULL)
1929 		return (error);
1930 
1931 	if (req->newlen + sizeof(struct pargs) > ps_arg_cache_limit)
1932 		return (ENOMEM);
1933 	newpa = pargs_alloc(req->newlen);
1934 	error = SYSCTL_IN(req, newpa->ar_args, req->newlen);
1935 	if (error != 0) {
1936 		pargs_free(newpa);
1937 		return (error);
1938 	}
1939 	PROC_LOCK(p);
1940 	pa = p->p_args;
1941 	p->p_args = newpa;
1942 	PROC_UNLOCK(p);
1943 	pargs_drop(pa);
1944 	return (0);
1945 }
1946 
1947 /*
1948  * This sysctl allows a process to retrieve environment of another process.
1949  */
1950 static int
1951 sysctl_kern_proc_env(SYSCTL_HANDLER_ARGS)
1952 {
1953 	int *name = (int *)arg1;
1954 	u_int namelen = arg2;
1955 	struct proc *p;
1956 	struct sbuf sb;
1957 	int error, error2;
1958 
1959 	if (namelen != 1)
1960 		return (EINVAL);
1961 
1962 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
1963 	if (error != 0)
1964 		return (error);
1965 	if ((p->p_flag & P_SYSTEM) != 0) {
1966 		PRELE(p);
1967 		return (0);
1968 	}
1969 
1970 	sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
1971 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
1972 	error = proc_getenvv(curthread, p, &sb);
1973 	error2 = sbuf_finish(&sb);
1974 	PRELE(p);
1975 	sbuf_delete(&sb);
1976 	return (error != 0 ? error : error2);
1977 }
1978 
1979 /*
1980  * This sysctl allows a process to retrieve ELF auxiliary vector of
1981  * another process.
1982  */
1983 static int
1984 sysctl_kern_proc_auxv(SYSCTL_HANDLER_ARGS)
1985 {
1986 	int *name = (int *)arg1;
1987 	u_int namelen = arg2;
1988 	struct proc *p;
1989 	struct sbuf sb;
1990 	int error, error2;
1991 
1992 	if (namelen != 1)
1993 		return (EINVAL);
1994 
1995 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
1996 	if (error != 0)
1997 		return (error);
1998 	if ((p->p_flag & P_SYSTEM) != 0) {
1999 		PRELE(p);
2000 		return (0);
2001 	}
2002 	sbuf_new_for_sysctl(&sb, NULL, GET_PS_STRINGS_CHUNK_SZ, req);
2003 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
2004 	error = proc_getauxv(curthread, p, &sb);
2005 	error2 = sbuf_finish(&sb);
2006 	PRELE(p);
2007 	sbuf_delete(&sb);
2008 	return (error != 0 ? error : error2);
2009 }
2010 
2011 /*
2012  * This sysctl allows a process to retrieve the path of the executable for
2013  * itself or another process.
2014  */
2015 static int
2016 sysctl_kern_proc_pathname(SYSCTL_HANDLER_ARGS)
2017 {
2018 	pid_t *pidp = (pid_t *)arg1;
2019 	unsigned int arglen = arg2;
2020 	struct proc *p;
2021 	struct vnode *vp;
2022 	char *retbuf, *freebuf;
2023 	int error;
2024 
2025 	if (arglen != 1)
2026 		return (EINVAL);
2027 	if (*pidp == -1) {	/* -1 means this process */
2028 		p = req->td->td_proc;
2029 	} else {
2030 		error = pget(*pidp, PGET_CANSEE, &p);
2031 		if (error != 0)
2032 			return (error);
2033 	}
2034 
2035 	vp = p->p_textvp;
2036 	if (vp == NULL) {
2037 		if (*pidp != -1)
2038 			PROC_UNLOCK(p);
2039 		return (0);
2040 	}
2041 	vref(vp);
2042 	if (*pidp != -1)
2043 		PROC_UNLOCK(p);
2044 	error = vn_fullpath(req->td, vp, &retbuf, &freebuf);
2045 	vrele(vp);
2046 	if (error)
2047 		return (error);
2048 	error = SYSCTL_OUT(req, retbuf, strlen(retbuf) + 1);
2049 	free(freebuf, M_TEMP);
2050 	return (error);
2051 }
2052 
2053 static int
2054 sysctl_kern_proc_sv_name(SYSCTL_HANDLER_ARGS)
2055 {
2056 	struct proc *p;
2057 	char *sv_name;
2058 	int *name;
2059 	int namelen;
2060 	int error;
2061 
2062 	namelen = arg2;
2063 	if (namelen != 1)
2064 		return (EINVAL);
2065 
2066 	name = (int *)arg1;
2067 	error = pget((pid_t)name[0], PGET_CANSEE, &p);
2068 	if (error != 0)
2069 		return (error);
2070 	sv_name = p->p_sysent->sv_name;
2071 	PROC_UNLOCK(p);
2072 	return (sysctl_handle_string(oidp, sv_name, 0, req));
2073 }
2074 
2075 #ifdef KINFO_OVMENTRY_SIZE
2076 CTASSERT(sizeof(struct kinfo_ovmentry) == KINFO_OVMENTRY_SIZE);
2077 #endif
2078 
2079 #ifdef COMPAT_FREEBSD7
2080 static int
2081 sysctl_kern_proc_ovmmap(SYSCTL_HANDLER_ARGS)
2082 {
2083 	vm_map_entry_t entry, tmp_entry;
2084 	unsigned int last_timestamp;
2085 	char *fullpath, *freepath;
2086 	struct kinfo_ovmentry *kve;
2087 	struct vattr va;
2088 	struct ucred *cred;
2089 	int error, *name;
2090 	struct vnode *vp;
2091 	struct proc *p;
2092 	vm_map_t map;
2093 	struct vmspace *vm;
2094 
2095 	name = (int *)arg1;
2096 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2097 	if (error != 0)
2098 		return (error);
2099 	vm = vmspace_acquire_ref(p);
2100 	if (vm == NULL) {
2101 		PRELE(p);
2102 		return (ESRCH);
2103 	}
2104 	kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK);
2105 
2106 	map = &vm->vm_map;
2107 	vm_map_lock_read(map);
2108 	for (entry = map->header.next; entry != &map->header;
2109 	    entry = entry->next) {
2110 		vm_object_t obj, tobj, lobj;
2111 		vm_offset_t addr;
2112 
2113 		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
2114 			continue;
2115 
2116 		bzero(kve, sizeof(*kve));
2117 		kve->kve_structsize = sizeof(*kve);
2118 
2119 		kve->kve_private_resident = 0;
2120 		obj = entry->object.vm_object;
2121 		if (obj != NULL) {
2122 			VM_OBJECT_RLOCK(obj);
2123 			if (obj->shadow_count == 1)
2124 				kve->kve_private_resident =
2125 				    obj->resident_page_count;
2126 		}
2127 		kve->kve_resident = 0;
2128 		addr = entry->start;
2129 		while (addr < entry->end) {
2130 			if (pmap_extract(map->pmap, addr))
2131 				kve->kve_resident++;
2132 			addr += PAGE_SIZE;
2133 		}
2134 
2135 		for (lobj = tobj = obj; tobj; tobj = tobj->backing_object) {
2136 			if (tobj != obj)
2137 				VM_OBJECT_RLOCK(tobj);
2138 			if (lobj != obj)
2139 				VM_OBJECT_RUNLOCK(lobj);
2140 			lobj = tobj;
2141 		}
2142 
2143 		kve->kve_start = (void*)entry->start;
2144 		kve->kve_end = (void*)entry->end;
2145 		kve->kve_offset = (off_t)entry->offset;
2146 
2147 		if (entry->protection & VM_PROT_READ)
2148 			kve->kve_protection |= KVME_PROT_READ;
2149 		if (entry->protection & VM_PROT_WRITE)
2150 			kve->kve_protection |= KVME_PROT_WRITE;
2151 		if (entry->protection & VM_PROT_EXECUTE)
2152 			kve->kve_protection |= KVME_PROT_EXEC;
2153 
2154 		if (entry->eflags & MAP_ENTRY_COW)
2155 			kve->kve_flags |= KVME_FLAG_COW;
2156 		if (entry->eflags & MAP_ENTRY_NEEDS_COPY)
2157 			kve->kve_flags |= KVME_FLAG_NEEDS_COPY;
2158 		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
2159 			kve->kve_flags |= KVME_FLAG_NOCOREDUMP;
2160 
2161 		last_timestamp = map->timestamp;
2162 		vm_map_unlock_read(map);
2163 
2164 		kve->kve_fileid = 0;
2165 		kve->kve_fsid = 0;
2166 		freepath = NULL;
2167 		fullpath = "";
2168 		if (lobj) {
2169 			vp = NULL;
2170 			switch (lobj->type) {
2171 			case OBJT_DEFAULT:
2172 				kve->kve_type = KVME_TYPE_DEFAULT;
2173 				break;
2174 			case OBJT_VNODE:
2175 				kve->kve_type = KVME_TYPE_VNODE;
2176 				vp = lobj->handle;
2177 				vref(vp);
2178 				break;
2179 			case OBJT_SWAP:
2180 				if ((lobj->flags & OBJ_TMPFS_NODE) != 0) {
2181 					kve->kve_type = KVME_TYPE_VNODE;
2182 					if ((lobj->flags & OBJ_TMPFS) != 0) {
2183 						vp = lobj->un_pager.swp.swp_tmpfs;
2184 						vref(vp);
2185 					}
2186 				} else {
2187 					kve->kve_type = KVME_TYPE_SWAP;
2188 				}
2189 				break;
2190 			case OBJT_DEVICE:
2191 				kve->kve_type = KVME_TYPE_DEVICE;
2192 				break;
2193 			case OBJT_PHYS:
2194 				kve->kve_type = KVME_TYPE_PHYS;
2195 				break;
2196 			case OBJT_DEAD:
2197 				kve->kve_type = KVME_TYPE_DEAD;
2198 				break;
2199 			case OBJT_SG:
2200 				kve->kve_type = KVME_TYPE_SG;
2201 				break;
2202 			default:
2203 				kve->kve_type = KVME_TYPE_UNKNOWN;
2204 				break;
2205 			}
2206 			if (lobj != obj)
2207 				VM_OBJECT_RUNLOCK(lobj);
2208 
2209 			kve->kve_ref_count = obj->ref_count;
2210 			kve->kve_shadow_count = obj->shadow_count;
2211 			VM_OBJECT_RUNLOCK(obj);
2212 			if (vp != NULL) {
2213 				vn_fullpath(curthread, vp, &fullpath,
2214 				    &freepath);
2215 				cred = curthread->td_ucred;
2216 				vn_lock(vp, LK_SHARED | LK_RETRY);
2217 				if (VOP_GETATTR(vp, &va, cred) == 0) {
2218 					kve->kve_fileid = va.va_fileid;
2219 					/* truncate */
2220 					kve->kve_fsid = va.va_fsid;
2221 				}
2222 				vput(vp);
2223 			}
2224 		} else {
2225 			kve->kve_type = KVME_TYPE_NONE;
2226 			kve->kve_ref_count = 0;
2227 			kve->kve_shadow_count = 0;
2228 		}
2229 
2230 		strlcpy(kve->kve_path, fullpath, sizeof(kve->kve_path));
2231 		if (freepath != NULL)
2232 			free(freepath, M_TEMP);
2233 
2234 		error = SYSCTL_OUT(req, kve, sizeof(*kve));
2235 		vm_map_lock_read(map);
2236 		if (error)
2237 			break;
2238 		if (last_timestamp != map->timestamp) {
2239 			vm_map_lookup_entry(map, addr - 1, &tmp_entry);
2240 			entry = tmp_entry;
2241 		}
2242 	}
2243 	vm_map_unlock_read(map);
2244 	vmspace_free(vm);
2245 	PRELE(p);
2246 	free(kve, M_TEMP);
2247 	return (error);
2248 }
2249 #endif	/* COMPAT_FREEBSD7 */
2250 
2251 #ifdef KINFO_VMENTRY_SIZE
2252 CTASSERT(sizeof(struct kinfo_vmentry) == KINFO_VMENTRY_SIZE);
2253 #endif
2254 
2255 static void
2256 kern_proc_vmmap_resident(vm_map_t map, vm_map_entry_t entry,
2257     struct kinfo_vmentry *kve)
2258 {
2259 	vm_object_t obj, tobj;
2260 	vm_page_t m, m_adv;
2261 	vm_offset_t addr;
2262 	vm_paddr_t locked_pa;
2263 	vm_pindex_t pi, pi_adv, pindex;
2264 
2265 	locked_pa = 0;
2266 	obj = entry->object.vm_object;
2267 	addr = entry->start;
2268 	m_adv = NULL;
2269 	pi = OFF_TO_IDX(entry->offset);
2270 	for (; addr < entry->end; addr += IDX_TO_OFF(pi_adv), pi += pi_adv) {
2271 		if (m_adv != NULL) {
2272 			m = m_adv;
2273 		} else {
2274 			pi_adv = atop(entry->end - addr);
2275 			pindex = pi;
2276 			for (tobj = obj;; tobj = tobj->backing_object) {
2277 				m = vm_page_find_least(tobj, pindex);
2278 				if (m != NULL) {
2279 					if (m->pindex == pindex)
2280 						break;
2281 					if (pi_adv > m->pindex - pindex) {
2282 						pi_adv = m->pindex - pindex;
2283 						m_adv = m;
2284 					}
2285 				}
2286 				if (tobj->backing_object == NULL)
2287 					goto next;
2288 				pindex += OFF_TO_IDX(tobj->
2289 				    backing_object_offset);
2290 			}
2291 		}
2292 		m_adv = NULL;
2293 		if (m->psind != 0 && addr + pagesizes[1] <= entry->end &&
2294 		    (addr & (pagesizes[1] - 1)) == 0 &&
2295 		    (pmap_mincore(map->pmap, addr, &locked_pa) &
2296 		    MINCORE_SUPER) != 0) {
2297 			kve->kve_flags |= KVME_FLAG_SUPER;
2298 			pi_adv = atop(pagesizes[1]);
2299 		} else {
2300 			/*
2301 			 * We do not test the found page on validity.
2302 			 * Either the page is busy and being paged in,
2303 			 * or it was invalidated.  The first case
2304 			 * should be counted as resident, the second
2305 			 * is not so clear; we do account both.
2306 			 */
2307 			pi_adv = 1;
2308 		}
2309 		kve->kve_resident += pi_adv;
2310 next:;
2311 	}
2312 	PA_UNLOCK_COND(locked_pa);
2313 }
2314 
2315 /*
2316  * Must be called with the process locked and will return unlocked.
2317  */
2318 int
2319 kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags)
2320 {
2321 	vm_map_entry_t entry, tmp_entry;
2322 	struct vattr va;
2323 	vm_map_t map;
2324 	vm_object_t obj, tobj, lobj;
2325 	char *fullpath, *freepath;
2326 	struct kinfo_vmentry *kve;
2327 	struct ucred *cred;
2328 	struct vnode *vp;
2329 	struct vmspace *vm;
2330 	vm_offset_t addr;
2331 	unsigned int last_timestamp;
2332 	int error;
2333 
2334 	PROC_LOCK_ASSERT(p, MA_OWNED);
2335 
2336 	_PHOLD(p);
2337 	PROC_UNLOCK(p);
2338 	vm = vmspace_acquire_ref(p);
2339 	if (vm == NULL) {
2340 		PRELE(p);
2341 		return (ESRCH);
2342 	}
2343 	kve = malloc(sizeof(*kve), M_TEMP, M_WAITOK | M_ZERO);
2344 
2345 	error = 0;
2346 	map = &vm->vm_map;
2347 	vm_map_lock_read(map);
2348 	for (entry = map->header.next; entry != &map->header;
2349 	    entry = entry->next) {
2350 		if (entry->eflags & MAP_ENTRY_IS_SUB_MAP)
2351 			continue;
2352 
2353 		addr = entry->end;
2354 		bzero(kve, sizeof(*kve));
2355 		obj = entry->object.vm_object;
2356 		if (obj != NULL) {
2357 			for (tobj = obj; tobj != NULL;
2358 			    tobj = tobj->backing_object) {
2359 				VM_OBJECT_RLOCK(tobj);
2360 				lobj = tobj;
2361 			}
2362 			if (obj->backing_object == NULL)
2363 				kve->kve_private_resident =
2364 				    obj->resident_page_count;
2365 			if (!vmmap_skip_res_cnt)
2366 				kern_proc_vmmap_resident(map, entry, kve);
2367 			for (tobj = obj; tobj != NULL;
2368 			    tobj = tobj->backing_object) {
2369 				if (tobj != obj && tobj != lobj)
2370 					VM_OBJECT_RUNLOCK(tobj);
2371 			}
2372 		} else {
2373 			lobj = NULL;
2374 		}
2375 
2376 		kve->kve_start = entry->start;
2377 		kve->kve_end = entry->end;
2378 		kve->kve_offset = entry->offset;
2379 
2380 		if (entry->protection & VM_PROT_READ)
2381 			kve->kve_protection |= KVME_PROT_READ;
2382 		if (entry->protection & VM_PROT_WRITE)
2383 			kve->kve_protection |= KVME_PROT_WRITE;
2384 		if (entry->protection & VM_PROT_EXECUTE)
2385 			kve->kve_protection |= KVME_PROT_EXEC;
2386 
2387 		if (entry->eflags & MAP_ENTRY_COW)
2388 			kve->kve_flags |= KVME_FLAG_COW;
2389 		if (entry->eflags & MAP_ENTRY_NEEDS_COPY)
2390 			kve->kve_flags |= KVME_FLAG_NEEDS_COPY;
2391 		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
2392 			kve->kve_flags |= KVME_FLAG_NOCOREDUMP;
2393 		if (entry->eflags & MAP_ENTRY_GROWS_UP)
2394 			kve->kve_flags |= KVME_FLAG_GROWS_UP;
2395 		if (entry->eflags & MAP_ENTRY_GROWS_DOWN)
2396 			kve->kve_flags |= KVME_FLAG_GROWS_DOWN;
2397 
2398 		last_timestamp = map->timestamp;
2399 		vm_map_unlock_read(map);
2400 
2401 		freepath = NULL;
2402 		fullpath = "";
2403 		if (lobj != NULL) {
2404 			vp = NULL;
2405 			switch (lobj->type) {
2406 			case OBJT_DEFAULT:
2407 				kve->kve_type = KVME_TYPE_DEFAULT;
2408 				break;
2409 			case OBJT_VNODE:
2410 				kve->kve_type = KVME_TYPE_VNODE;
2411 				vp = lobj->handle;
2412 				vref(vp);
2413 				break;
2414 			case OBJT_SWAP:
2415 				if ((lobj->flags & OBJ_TMPFS_NODE) != 0) {
2416 					kve->kve_type = KVME_TYPE_VNODE;
2417 					if ((lobj->flags & OBJ_TMPFS) != 0) {
2418 						vp = lobj->un_pager.swp.swp_tmpfs;
2419 						vref(vp);
2420 					}
2421 				} else {
2422 					kve->kve_type = KVME_TYPE_SWAP;
2423 				}
2424 				break;
2425 			case OBJT_DEVICE:
2426 				kve->kve_type = KVME_TYPE_DEVICE;
2427 				break;
2428 			case OBJT_PHYS:
2429 				kve->kve_type = KVME_TYPE_PHYS;
2430 				break;
2431 			case OBJT_DEAD:
2432 				kve->kve_type = KVME_TYPE_DEAD;
2433 				break;
2434 			case OBJT_SG:
2435 				kve->kve_type = KVME_TYPE_SG;
2436 				break;
2437 			case OBJT_MGTDEVICE:
2438 				kve->kve_type = KVME_TYPE_MGTDEVICE;
2439 				break;
2440 			default:
2441 				kve->kve_type = KVME_TYPE_UNKNOWN;
2442 				break;
2443 			}
2444 			if (lobj != obj)
2445 				VM_OBJECT_RUNLOCK(lobj);
2446 
2447 			kve->kve_ref_count = obj->ref_count;
2448 			kve->kve_shadow_count = obj->shadow_count;
2449 			VM_OBJECT_RUNLOCK(obj);
2450 			if (vp != NULL) {
2451 				vn_fullpath(curthread, vp, &fullpath,
2452 				    &freepath);
2453 				kve->kve_vn_type = vntype_to_kinfo(vp->v_type);
2454 				cred = curthread->td_ucred;
2455 				vn_lock(vp, LK_SHARED | LK_RETRY);
2456 				if (VOP_GETATTR(vp, &va, cred) == 0) {
2457 					kve->kve_vn_fileid = va.va_fileid;
2458 					kve->kve_vn_fsid = va.va_fsid;
2459 					kve->kve_vn_fsid_freebsd11 =
2460 					    kve->kve_vn_fsid; /* truncate */
2461 					kve->kve_vn_mode =
2462 					    MAKEIMODE(va.va_type, va.va_mode);
2463 					kve->kve_vn_size = va.va_size;
2464 					kve->kve_vn_rdev = va.va_rdev;
2465 					kve->kve_vn_rdev_freebsd11 =
2466 					    kve->kve_vn_rdev; /* truncate */
2467 					kve->kve_status = KF_ATTR_VALID;
2468 				}
2469 				vput(vp);
2470 			}
2471 		} else {
2472 			kve->kve_type = KVME_TYPE_NONE;
2473 			kve->kve_ref_count = 0;
2474 			kve->kve_shadow_count = 0;
2475 		}
2476 
2477 		strlcpy(kve->kve_path, fullpath, sizeof(kve->kve_path));
2478 		if (freepath != NULL)
2479 			free(freepath, M_TEMP);
2480 
2481 		/* Pack record size down */
2482 		if ((flags & KERN_VMMAP_PACK_KINFO) != 0)
2483 			kve->kve_structsize =
2484 			    offsetof(struct kinfo_vmentry, kve_path) +
2485 			    strlen(kve->kve_path) + 1;
2486 		else
2487 			kve->kve_structsize = sizeof(*kve);
2488 		kve->kve_structsize = roundup(kve->kve_structsize,
2489 		    sizeof(uint64_t));
2490 
2491 		/* Halt filling and truncate rather than exceeding maxlen */
2492 		if (maxlen != -1 && maxlen < kve->kve_structsize) {
2493 			error = 0;
2494 			vm_map_lock_read(map);
2495 			break;
2496 		} else if (maxlen != -1)
2497 			maxlen -= kve->kve_structsize;
2498 
2499 		if (sbuf_bcat(sb, kve, kve->kve_structsize) != 0)
2500 			error = ENOMEM;
2501 		vm_map_lock_read(map);
2502 		if (error != 0)
2503 			break;
2504 		if (last_timestamp != map->timestamp) {
2505 			vm_map_lookup_entry(map, addr - 1, &tmp_entry);
2506 			entry = tmp_entry;
2507 		}
2508 	}
2509 	vm_map_unlock_read(map);
2510 	vmspace_free(vm);
2511 	PRELE(p);
2512 	free(kve, M_TEMP);
2513 	return (error);
2514 }
2515 
2516 static int
2517 sysctl_kern_proc_vmmap(SYSCTL_HANDLER_ARGS)
2518 {
2519 	struct proc *p;
2520 	struct sbuf sb;
2521 	int error, error2, *name;
2522 
2523 	name = (int *)arg1;
2524 	sbuf_new_for_sysctl(&sb, NULL, sizeof(struct kinfo_vmentry), req);
2525 	sbuf_clear_flags(&sb, SBUF_INCLUDENUL);
2526 	error = pget((pid_t)name[0], PGET_CANDEBUG | PGET_NOTWEXIT, &p);
2527 	if (error != 0) {
2528 		sbuf_delete(&sb);
2529 		return (error);
2530 	}
2531 	error = kern_proc_vmmap_out(p, &sb, -1, KERN_VMMAP_PACK_KINFO);
2532 	error2 = sbuf_finish(&sb);
2533 	sbuf_delete(&sb);
2534 	return (error != 0 ? error : error2);
2535 }
2536 
2537 #if defined(STACK) || defined(DDB)
2538 static int
2539 sysctl_kern_proc_kstack(SYSCTL_HANDLER_ARGS)
2540 {
2541 	struct kinfo_kstack *kkstp;
2542 	int error, i, *name, numthreads;
2543 	lwpid_t *lwpidarray;
2544 	struct thread *td;
2545 	struct stack *st;
2546 	struct sbuf sb;
2547 	struct proc *p;
2548 
2549 	name = (int *)arg1;
2550 	error = pget((pid_t)name[0], PGET_NOTINEXEC | PGET_WANTREAD, &p);
2551 	if (error != 0)
2552 		return (error);
2553 
2554 	kkstp = malloc(sizeof(*kkstp), M_TEMP, M_WAITOK);
2555 	st = stack_create(M_WAITOK);
2556 
2557 	lwpidarray = NULL;
2558 	PROC_LOCK(p);
2559 	do {
2560 		if (lwpidarray != NULL) {
2561 			free(lwpidarray, M_TEMP);
2562 			lwpidarray = NULL;
2563 		}
2564 		numthreads = p->p_numthreads;
2565 		PROC_UNLOCK(p);
2566 		lwpidarray = malloc(sizeof(*lwpidarray) * numthreads, M_TEMP,
2567 		    M_WAITOK | M_ZERO);
2568 		PROC_LOCK(p);
2569 	} while (numthreads < p->p_numthreads);
2570 
2571 	/*
2572 	 * XXXRW: During the below loop, execve(2) and countless other sorts
2573 	 * of changes could have taken place.  Should we check to see if the
2574 	 * vmspace has been replaced, or the like, in order to prevent
2575 	 * giving a snapshot that spans, say, execve(2), with some threads
2576 	 * before and some after?  Among other things, the credentials could
2577 	 * have changed, in which case the right to extract debug info might
2578 	 * no longer be assured.
2579 	 */
2580 	i = 0;
2581 	FOREACH_THREAD_IN_PROC(p, td) {
2582 		KASSERT(i < numthreads,
2583 		    ("sysctl_kern_proc_kstack: numthreads"));
2584 		lwpidarray[i] = td->td_tid;
2585 		i++;
2586 	}
2587 	numthreads = i;
2588 	for (i = 0; i < numthreads; i++) {
2589 		td = thread_find(p, lwpidarray[i]);
2590 		if (td == NULL) {
2591 			continue;
2592 		}
2593 		bzero(kkstp, sizeof(*kkstp));
2594 		(void)sbuf_new(&sb, kkstp->kkst_trace,
2595 		    sizeof(kkstp->kkst_trace), SBUF_FIXEDLEN);
2596 		thread_lock(td);
2597 		kkstp->kkst_tid = td->td_tid;
2598 		if (TD_IS_SWAPPED(td)) {
2599 			kkstp->kkst_state = KKST_STATE_SWAPPED;
2600 		} else if (TD_IS_RUNNING(td)) {
2601 			if (stack_save_td_running(st, td) == 0)
2602 				kkstp->kkst_state = KKST_STATE_STACKOK;
2603 			else
2604 				kkstp->kkst_state = KKST_STATE_RUNNING;
2605 		} else {
2606 			kkstp->kkst_state = KKST_STATE_STACKOK;
2607 			stack_save_td(st, td);
2608 		}
2609 		thread_unlock(td);
2610 		PROC_UNLOCK(p);
2611 		stack_sbuf_print(&sb, st);
2612 		sbuf_finish(&sb);
2613 		sbuf_delete(&sb);
2614 		error = SYSCTL_OUT(req, kkstp, sizeof(*kkstp));
2615 		PROC_LOCK(p);
2616 		if (error)
2617 			break;
2618 	}
2619 	_PRELE(p);
2620 	PROC_UNLOCK(p);
2621 	if (lwpidarray != NULL)
2622 		free(lwpidarray, M_TEMP);
2623 	stack_destroy(st);
2624 	free(kkstp, M_TEMP);
2625 	return (error);
2626 }
2627 #endif
2628 
2629 /*
2630  * This sysctl allows a process to retrieve the full list of groups from
2631  * itself or another process.
2632  */
2633 static int
2634 sysctl_kern_proc_groups(SYSCTL_HANDLER_ARGS)
2635 {
2636 	pid_t *pidp = (pid_t *)arg1;
2637 	unsigned int arglen = arg2;
2638 	struct proc *p;
2639 	struct ucred *cred;
2640 	int error;
2641 
2642 	if (arglen != 1)
2643 		return (EINVAL);
2644 	if (*pidp == -1) {	/* -1 means this process */
2645 		p = req->td->td_proc;
2646 		PROC_LOCK(p);
2647 	} else {
2648 		error = pget(*pidp, PGET_CANSEE, &p);
2649 		if (error != 0)
2650 			return (error);
2651 	}
2652 
2653 	cred = crhold(p->p_ucred);
2654 	PROC_UNLOCK(p);
2655 
2656 	error = SYSCTL_OUT(req, cred->cr_groups,
2657 	    cred->cr_ngroups * sizeof(gid_t));
2658 	crfree(cred);
2659 	return (error);
2660 }
2661 
2662 /*
2663  * This sysctl allows a process to retrieve or/and set the resource limit for
2664  * another process.
2665  */
2666 static int
2667 sysctl_kern_proc_rlimit(SYSCTL_HANDLER_ARGS)
2668 {
2669 	int *name = (int *)arg1;
2670 	u_int namelen = arg2;
2671 	struct rlimit rlim;
2672 	struct proc *p;
2673 	u_int which;
2674 	int flags, error;
2675 
2676 	if (namelen != 2)
2677 		return (EINVAL);
2678 
2679 	which = (u_int)name[1];
2680 	if (which >= RLIM_NLIMITS)
2681 		return (EINVAL);
2682 
2683 	if (req->newptr != NULL && req->newlen != sizeof(rlim))
2684 		return (EINVAL);
2685 
2686 	flags = PGET_HOLD | PGET_NOTWEXIT;
2687 	if (req->newptr != NULL)
2688 		flags |= PGET_CANDEBUG;
2689 	else
2690 		flags |= PGET_CANSEE;
2691 	error = pget((pid_t)name[0], flags, &p);
2692 	if (error != 0)
2693 		return (error);
2694 
2695 	/*
2696 	 * Retrieve limit.
2697 	 */
2698 	if (req->oldptr != NULL) {
2699 		PROC_LOCK(p);
2700 		lim_rlimit_proc(p, which, &rlim);
2701 		PROC_UNLOCK(p);
2702 	}
2703 	error = SYSCTL_OUT(req, &rlim, sizeof(rlim));
2704 	if (error != 0)
2705 		goto errout;
2706 
2707 	/*
2708 	 * Set limit.
2709 	 */
2710 	if (req->newptr != NULL) {
2711 		error = SYSCTL_IN(req, &rlim, sizeof(rlim));
2712 		if (error == 0)
2713 			error = kern_proc_setrlimit(curthread, p, which, &rlim);
2714 	}
2715 
2716 errout:
2717 	PRELE(p);
2718 	return (error);
2719 }
2720 
2721 /*
2722  * This sysctl allows a process to retrieve ps_strings structure location of
2723  * another process.
2724  */
2725 static int
2726 sysctl_kern_proc_ps_strings(SYSCTL_HANDLER_ARGS)
2727 {
2728 	int *name = (int *)arg1;
2729 	u_int namelen = arg2;
2730 	struct proc *p;
2731 	vm_offset_t ps_strings;
2732 	int error;
2733 #ifdef COMPAT_FREEBSD32
2734 	uint32_t ps_strings32;
2735 #endif
2736 
2737 	if (namelen != 1)
2738 		return (EINVAL);
2739 
2740 	error = pget((pid_t)name[0], PGET_CANDEBUG, &p);
2741 	if (error != 0)
2742 		return (error);
2743 #ifdef COMPAT_FREEBSD32
2744 	if ((req->flags & SCTL_MASK32) != 0) {
2745 		/*
2746 		 * We return 0 if the 32 bit emulation request is for a 64 bit
2747 		 * process.
2748 		 */
2749 		ps_strings32 = SV_PROC_FLAG(p, SV_ILP32) != 0 ?
2750 		    PTROUT(p->p_sysent->sv_psstrings) : 0;
2751 		PROC_UNLOCK(p);
2752 		error = SYSCTL_OUT(req, &ps_strings32, sizeof(ps_strings32));
2753 		return (error);
2754 	}
2755 #endif
2756 	ps_strings = p->p_sysent->sv_psstrings;
2757 	PROC_UNLOCK(p);
2758 	error = SYSCTL_OUT(req, &ps_strings, sizeof(ps_strings));
2759 	return (error);
2760 }
2761 
2762 /*
2763  * This sysctl allows a process to retrieve umask of another process.
2764  */
2765 static int
2766 sysctl_kern_proc_umask(SYSCTL_HANDLER_ARGS)
2767 {
2768 	int *name = (int *)arg1;
2769 	u_int namelen = arg2;
2770 	struct proc *p;
2771 	int error;
2772 	u_short fd_cmask;
2773 
2774 	if (namelen != 1)
2775 		return (EINVAL);
2776 
2777 	error = pget((pid_t)name[0], PGET_WANTREAD, &p);
2778 	if (error != 0)
2779 		return (error);
2780 
2781 	FILEDESC_SLOCK(p->p_fd);
2782 	fd_cmask = p->p_fd->fd_cmask;
2783 	FILEDESC_SUNLOCK(p->p_fd);
2784 	PRELE(p);
2785 	error = SYSCTL_OUT(req, &fd_cmask, sizeof(fd_cmask));
2786 	return (error);
2787 }
2788 
2789 /*
2790  * This sysctl allows a process to set and retrieve binary osreldate of
2791  * another process.
2792  */
2793 static int
2794 sysctl_kern_proc_osrel(SYSCTL_HANDLER_ARGS)
2795 {
2796 	int *name = (int *)arg1;
2797 	u_int namelen = arg2;
2798 	struct proc *p;
2799 	int flags, error, osrel;
2800 
2801 	if (namelen != 1)
2802 		return (EINVAL);
2803 
2804 	if (req->newptr != NULL && req->newlen != sizeof(osrel))
2805 		return (EINVAL);
2806 
2807 	flags = PGET_HOLD | PGET_NOTWEXIT;
2808 	if (req->newptr != NULL)
2809 		flags |= PGET_CANDEBUG;
2810 	else
2811 		flags |= PGET_CANSEE;
2812 	error = pget((pid_t)name[0], flags, &p);
2813 	if (error != 0)
2814 		return (error);
2815 
2816 	error = SYSCTL_OUT(req, &p->p_osrel, sizeof(p->p_osrel));
2817 	if (error != 0)
2818 		goto errout;
2819 
2820 	if (req->newptr != NULL) {
2821 		error = SYSCTL_IN(req, &osrel, sizeof(osrel));
2822 		if (error != 0)
2823 			goto errout;
2824 		if (osrel < 0) {
2825 			error = EINVAL;
2826 			goto errout;
2827 		}
2828 		p->p_osrel = osrel;
2829 	}
2830 errout:
2831 	PRELE(p);
2832 	return (error);
2833 }
2834 
2835 static int
2836 sysctl_kern_proc_sigtramp(SYSCTL_HANDLER_ARGS)
2837 {
2838 	int *name = (int *)arg1;
2839 	u_int namelen = arg2;
2840 	struct proc *p;
2841 	struct kinfo_sigtramp kst;
2842 	const struct sysentvec *sv;
2843 	int error;
2844 #ifdef COMPAT_FREEBSD32
2845 	struct kinfo_sigtramp32 kst32;
2846 #endif
2847 
2848 	if (namelen != 1)
2849 		return (EINVAL);
2850 
2851 	error = pget((pid_t)name[0], PGET_CANDEBUG, &p);
2852 	if (error != 0)
2853 		return (error);
2854 	sv = p->p_sysent;
2855 #ifdef COMPAT_FREEBSD32
2856 	if ((req->flags & SCTL_MASK32) != 0) {
2857 		bzero(&kst32, sizeof(kst32));
2858 		if (SV_PROC_FLAG(p, SV_ILP32)) {
2859 			if (sv->sv_sigcode_base != 0) {
2860 				kst32.ksigtramp_start = sv->sv_sigcode_base;
2861 				kst32.ksigtramp_end = sv->sv_sigcode_base +
2862 				    *sv->sv_szsigcode;
2863 			} else {
2864 				kst32.ksigtramp_start = sv->sv_psstrings -
2865 				    *sv->sv_szsigcode;
2866 				kst32.ksigtramp_end = sv->sv_psstrings;
2867 			}
2868 		}
2869 		PROC_UNLOCK(p);
2870 		error = SYSCTL_OUT(req, &kst32, sizeof(kst32));
2871 		return (error);
2872 	}
2873 #endif
2874 	bzero(&kst, sizeof(kst));
2875 	if (sv->sv_sigcode_base != 0) {
2876 		kst.ksigtramp_start = (char *)sv->sv_sigcode_base;
2877 		kst.ksigtramp_end = (char *)sv->sv_sigcode_base +
2878 		    *sv->sv_szsigcode;
2879 	} else {
2880 		kst.ksigtramp_start = (char *)sv->sv_psstrings -
2881 		    *sv->sv_szsigcode;
2882 		kst.ksigtramp_end = (char *)sv->sv_psstrings;
2883 	}
2884 	PROC_UNLOCK(p);
2885 	error = SYSCTL_OUT(req, &kst, sizeof(kst));
2886 	return (error);
2887 }
2888 
2889 SYSCTL_NODE(_kern, KERN_PROC, proc, CTLFLAG_RD,  0, "Process table");
2890 
2891 SYSCTL_PROC(_kern_proc, KERN_PROC_ALL, all, CTLFLAG_RD|CTLTYPE_STRUCT|
2892 	CTLFLAG_MPSAFE, 0, 0, sysctl_kern_proc, "S,proc",
2893 	"Return entire process table");
2894 
2895 static SYSCTL_NODE(_kern_proc, KERN_PROC_GID, gid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2896 	sysctl_kern_proc, "Process table");
2897 
2898 static SYSCTL_NODE(_kern_proc, KERN_PROC_PGRP, pgrp, CTLFLAG_RD | CTLFLAG_MPSAFE,
2899 	sysctl_kern_proc, "Process table");
2900 
2901 static SYSCTL_NODE(_kern_proc, KERN_PROC_RGID, rgid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2902 	sysctl_kern_proc, "Process table");
2903 
2904 static SYSCTL_NODE(_kern_proc, KERN_PROC_SESSION, sid, CTLFLAG_RD |
2905 	CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2906 
2907 static SYSCTL_NODE(_kern_proc, KERN_PROC_TTY, tty, CTLFLAG_RD | CTLFLAG_MPSAFE,
2908 	sysctl_kern_proc, "Process table");
2909 
2910 static SYSCTL_NODE(_kern_proc, KERN_PROC_UID, uid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2911 	sysctl_kern_proc, "Process table");
2912 
2913 static SYSCTL_NODE(_kern_proc, KERN_PROC_RUID, ruid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2914 	sysctl_kern_proc, "Process table");
2915 
2916 static SYSCTL_NODE(_kern_proc, KERN_PROC_PID, pid, CTLFLAG_RD | CTLFLAG_MPSAFE,
2917 	sysctl_kern_proc, "Process table");
2918 
2919 static SYSCTL_NODE(_kern_proc, KERN_PROC_PROC, proc, CTLFLAG_RD | CTLFLAG_MPSAFE,
2920 	sysctl_kern_proc, "Return process table, no threads");
2921 
2922 static SYSCTL_NODE(_kern_proc, KERN_PROC_ARGS, args,
2923 	CTLFLAG_RW | CTLFLAG_CAPWR | CTLFLAG_ANYBODY | CTLFLAG_MPSAFE,
2924 	sysctl_kern_proc_args, "Process argument list");
2925 
2926 static SYSCTL_NODE(_kern_proc, KERN_PROC_ENV, env, CTLFLAG_RD | CTLFLAG_MPSAFE,
2927 	sysctl_kern_proc_env, "Process environment");
2928 
2929 static SYSCTL_NODE(_kern_proc, KERN_PROC_AUXV, auxv, CTLFLAG_RD |
2930 	CTLFLAG_MPSAFE, sysctl_kern_proc_auxv, "Process ELF auxiliary vector");
2931 
2932 static SYSCTL_NODE(_kern_proc, KERN_PROC_PATHNAME, pathname, CTLFLAG_RD |
2933 	CTLFLAG_MPSAFE, sysctl_kern_proc_pathname, "Process executable path");
2934 
2935 static SYSCTL_NODE(_kern_proc, KERN_PROC_SV_NAME, sv_name, CTLFLAG_RD |
2936 	CTLFLAG_MPSAFE, sysctl_kern_proc_sv_name,
2937 	"Process syscall vector name (ABI type)");
2938 
2939 static SYSCTL_NODE(_kern_proc, (KERN_PROC_GID | KERN_PROC_INC_THREAD), gid_td,
2940 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2941 
2942 static SYSCTL_NODE(_kern_proc, (KERN_PROC_PGRP | KERN_PROC_INC_THREAD), pgrp_td,
2943 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2944 
2945 static SYSCTL_NODE(_kern_proc, (KERN_PROC_RGID | KERN_PROC_INC_THREAD), rgid_td,
2946 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2947 
2948 static SYSCTL_NODE(_kern_proc, (KERN_PROC_SESSION | KERN_PROC_INC_THREAD),
2949 	sid_td, CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2950 
2951 static SYSCTL_NODE(_kern_proc, (KERN_PROC_TTY | KERN_PROC_INC_THREAD), tty_td,
2952 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2953 
2954 static SYSCTL_NODE(_kern_proc, (KERN_PROC_UID | KERN_PROC_INC_THREAD), uid_td,
2955 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2956 
2957 static SYSCTL_NODE(_kern_proc, (KERN_PROC_RUID | KERN_PROC_INC_THREAD), ruid_td,
2958 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2959 
2960 static SYSCTL_NODE(_kern_proc, (KERN_PROC_PID | KERN_PROC_INC_THREAD), pid_td,
2961 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc, "Process table");
2962 
2963 static SYSCTL_NODE(_kern_proc, (KERN_PROC_PROC | KERN_PROC_INC_THREAD), proc_td,
2964 	CTLFLAG_RD | CTLFLAG_MPSAFE, sysctl_kern_proc,
2965 	"Return process table, no threads");
2966 
2967 #ifdef COMPAT_FREEBSD7
2968 static SYSCTL_NODE(_kern_proc, KERN_PROC_OVMMAP, ovmmap, CTLFLAG_RD |
2969 	CTLFLAG_MPSAFE, sysctl_kern_proc_ovmmap, "Old Process vm map entries");
2970 #endif
2971 
2972 static SYSCTL_NODE(_kern_proc, KERN_PROC_VMMAP, vmmap, CTLFLAG_RD |
2973 	CTLFLAG_MPSAFE, sysctl_kern_proc_vmmap, "Process vm map entries");
2974 
2975 #if defined(STACK) || defined(DDB)
2976 static SYSCTL_NODE(_kern_proc, KERN_PROC_KSTACK, kstack, CTLFLAG_RD |
2977 	CTLFLAG_MPSAFE, sysctl_kern_proc_kstack, "Process kernel stacks");
2978 #endif
2979 
2980 static SYSCTL_NODE(_kern_proc, KERN_PROC_GROUPS, groups, CTLFLAG_RD |
2981 	CTLFLAG_MPSAFE, sysctl_kern_proc_groups, "Process groups");
2982 
2983 static SYSCTL_NODE(_kern_proc, KERN_PROC_RLIMIT, rlimit, CTLFLAG_RW |
2984 	CTLFLAG_ANYBODY | CTLFLAG_MPSAFE, sysctl_kern_proc_rlimit,
2985 	"Process resource limits");
2986 
2987 static SYSCTL_NODE(_kern_proc, KERN_PROC_PS_STRINGS, ps_strings, CTLFLAG_RD |
2988 	CTLFLAG_MPSAFE, sysctl_kern_proc_ps_strings,
2989 	"Process ps_strings location");
2990 
2991 static SYSCTL_NODE(_kern_proc, KERN_PROC_UMASK, umask, CTLFLAG_RD |
2992 	CTLFLAG_MPSAFE, sysctl_kern_proc_umask, "Process umask");
2993 
2994 static SYSCTL_NODE(_kern_proc, KERN_PROC_OSREL, osrel, CTLFLAG_RW |
2995 	CTLFLAG_ANYBODY | CTLFLAG_MPSAFE, sysctl_kern_proc_osrel,
2996 	"Process binary osreldate");
2997 
2998 static SYSCTL_NODE(_kern_proc, KERN_PROC_SIGTRAMP, sigtramp, CTLFLAG_RD |
2999 	CTLFLAG_MPSAFE, sysctl_kern_proc_sigtramp,
3000 	"Process signal trampoline location");
3001 
3002 int allproc_gen;
3003 
3004 /*
3005  * stop_all_proc() purpose is to stop all process which have usermode,
3006  * except current process for obvious reasons.  This makes it somewhat
3007  * unreliable when invoked from multithreaded process.  The service
3008  * must not be user-callable anyway.
3009  */
3010 void
3011 stop_all_proc(void)
3012 {
3013 	struct proc *cp, *p;
3014 	int r, gen;
3015 	bool restart, seen_stopped, seen_exiting, stopped_some;
3016 
3017 	cp = curproc;
3018 allproc_loop:
3019 	sx_xlock(&allproc_lock);
3020 	gen = allproc_gen;
3021 	seen_exiting = seen_stopped = stopped_some = restart = false;
3022 	LIST_REMOVE(cp, p_list);
3023 	LIST_INSERT_HEAD(&allproc, cp, p_list);
3024 	for (;;) {
3025 		p = LIST_NEXT(cp, p_list);
3026 		if (p == NULL)
3027 			break;
3028 		LIST_REMOVE(cp, p_list);
3029 		LIST_INSERT_AFTER(p, cp, p_list);
3030 		PROC_LOCK(p);
3031 		if ((p->p_flag & (P_KPROC | P_SYSTEM | P_TOTAL_STOP)) != 0) {
3032 			PROC_UNLOCK(p);
3033 			continue;
3034 		}
3035 		if ((p->p_flag & P_WEXIT) != 0) {
3036 			seen_exiting = true;
3037 			PROC_UNLOCK(p);
3038 			continue;
3039 		}
3040 		if (P_SHOULDSTOP(p) == P_STOPPED_SINGLE) {
3041 			/*
3042 			 * Stopped processes are tolerated when there
3043 			 * are no other processes which might continue
3044 			 * them.  P_STOPPED_SINGLE but not
3045 			 * P_TOTAL_STOP process still has at least one
3046 			 * thread running.
3047 			 */
3048 			seen_stopped = true;
3049 			PROC_UNLOCK(p);
3050 			continue;
3051 		}
3052 		_PHOLD(p);
3053 		sx_xunlock(&allproc_lock);
3054 		r = thread_single(p, SINGLE_ALLPROC);
3055 		if (r != 0)
3056 			restart = true;
3057 		else
3058 			stopped_some = true;
3059 		_PRELE(p);
3060 		PROC_UNLOCK(p);
3061 		sx_xlock(&allproc_lock);
3062 	}
3063 	/* Catch forked children we did not see in iteration. */
3064 	if (gen != allproc_gen)
3065 		restart = true;
3066 	sx_xunlock(&allproc_lock);
3067 	if (restart || stopped_some || seen_exiting || seen_stopped) {
3068 		kern_yield(PRI_USER);
3069 		goto allproc_loop;
3070 	}
3071 }
3072 
3073 void
3074 resume_all_proc(void)
3075 {
3076 	struct proc *cp, *p;
3077 
3078 	cp = curproc;
3079 	sx_xlock(&allproc_lock);
3080 	LIST_REMOVE(cp, p_list);
3081 	LIST_INSERT_HEAD(&allproc, cp, p_list);
3082 	for (;;) {
3083 		p = LIST_NEXT(cp, p_list);
3084 		if (p == NULL)
3085 			break;
3086 		LIST_REMOVE(cp, p_list);
3087 		LIST_INSERT_AFTER(p, cp, p_list);
3088 		PROC_LOCK(p);
3089 		if ((p->p_flag & P_TOTAL_STOP) != 0) {
3090 			sx_xunlock(&allproc_lock);
3091 			_PHOLD(p);
3092 			thread_single_end(p, SINGLE_ALLPROC);
3093 			_PRELE(p);
3094 			PROC_UNLOCK(p);
3095 			sx_xlock(&allproc_lock);
3096 		} else {
3097 			PROC_UNLOCK(p);
3098 		}
3099 	}
3100 	sx_xunlock(&allproc_lock);
3101 }
3102 
3103 /* #define	TOTAL_STOP_DEBUG	1 */
3104 #ifdef TOTAL_STOP_DEBUG
3105 volatile static int ap_resume;
3106 #include <sys/mount.h>
3107 
3108 static int
3109 sysctl_debug_stop_all_proc(SYSCTL_HANDLER_ARGS)
3110 {
3111 	int error, val;
3112 
3113 	val = 0;
3114 	ap_resume = 0;
3115 	error = sysctl_handle_int(oidp, &val, 0, req);
3116 	if (error != 0 || req->newptr == NULL)
3117 		return (error);
3118 	if (val != 0) {
3119 		stop_all_proc();
3120 		syncer_suspend();
3121 		while (ap_resume == 0)
3122 			;
3123 		syncer_resume();
3124 		resume_all_proc();
3125 	}
3126 	return (0);
3127 }
3128 
3129 SYSCTL_PROC(_debug, OID_AUTO, stop_all_proc, CTLTYPE_INT | CTLFLAG_RW |
3130     CTLFLAG_MPSAFE, __DEVOLATILE(int *, &ap_resume), 0,
3131     sysctl_debug_stop_all_proc, "I",
3132     "");
3133 #endif
3134